You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@syncope.apache.org by Daniel Gay <da...@quentinsystems.com> on 2014/06/04 20:07:00 UTC
Authentication via ConnId connector
I was looking to authenticate users in an existing database resource, and
during my research I came to the below conclusions. Can someone confirm
that these conclusions are correct?
1 - synchronizing passwords with the resource will not work unless the
passwords are in clear text
2 - Syncope does not support authentication through a ConnId connector,
even if I wrote a custom one specific to my existing database (via the
AuthenticateOp interface)
3 - JIRA issue SYNCOPE-160 addresses this problem (so is targeted for
Sycope 3.0)
Thanks for the help!
Re: Authentication via ConnId connector
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 05/06/2014 11:06, Francesco Chicchiriccò wrote:
> Hi Daniel,
> see my replies below.
>
> Regards.
>
> On 04/06/2014 20:07, Daniel Gay wrote:
>> I was looking to authenticate users in an existing database resource,
>> and during my research I came to the below conclusions. Can someone
>> confirm that these conclusions are correct?
>>
>> 1 - synchronizing passwords with the resource will not work unless
>> the passwords are in clear text
>
> Without any further customization on your own deployment, this is true.
>
> However, if you know in advance the cipher algorithm with which
> passwords are stored in the external resource (and if such algorithm
> is supported by Syncope), you can write a custom synchronization
> action [1] that will go over the ordinary password set mechanism,
> which takes a cleartext value and performs ciphering.
>
> Similarly, if the cipher algorithm on the external resource is
> invertible (say AES) and you know the key, you can barely decrypt the
> password and set it to user using the standard procedure.
Forgot to mention SYNCOPE-313 [3] which should automate most of this stuff.
>> 2 - Syncope does not support authentication through a ConnId
>> connector, even if I wrote a custom one specific to my existing
>> database (via the AuthenticateOp interface)
>
> Correct.
>
>> 3 - JIRA issue SYNCOPE-160 addresses this problem (so is targeted for
>> Sycope 3.0)
>
> Correct: you can, however, write your own Spring Security
> authentication provider - possibly extending [2] - which can delegate
> the authentication on the external resource, configure it in
>
> core/src/main/resources/securityContext.xml
>
> HTH
>
> [1] https://cwiki.apache.org/confluence/display/SYNCOPE/SyncActionsClass
> [2]
> http://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/security/SyncopeAuthenticationProvider.java
[3] https://issues.apache.org/jira/browse/SYNCOPE-313
--
Francesco Chicchiriccò
Tirasa - Open Source Excellence
http://www.tirasa.net/
Involved at The Apache Software Foundation:
member, Syncope PMC chair, Cocoon PMC, Olingo PMC
http://people.apache.org/~ilgrosso/
Re: Authentication via ConnId connector
Posted by Francesco Chicchiriccò <il...@apache.org>.
Hi Daniel,
see my replies below.
Regards.
On 04/06/2014 20:07, Daniel Gay wrote:
> I was looking to authenticate users in an existing database resource,
> and during my research I came to the below conclusions. Can someone
> confirm that these conclusions are correct?
>
> 1 - synchronizing passwords with the resource will not work unless the
> passwords are in clear text
Without any further customization on your own deployment, this is true.
However, if you know in advance the cipher algorithm with which
passwords are stored in the external resource (and if such algorithm is
supported by Syncope), you can write a custom synchronization action [1]
that will go over the ordinary password set mechanism, which takes a
cleartext value and performs ciphering.
Similarly, if the cipher algorithm on the external resource is
invertible (say AES) and you know the key, you can barely decrypt the
password and set it to user using the standard procedure.
> 2 - Syncope does not support authentication through a ConnId
> connector, even if I wrote a custom one specific to my existing
> database (via the AuthenticateOp interface)
Correct.
> 3 - JIRA issue SYNCOPE-160 addresses this problem (so is targeted for
> Sycope 3.0)
Correct: you can, however, write your own Spring Security authentication
provider - possibly extending [2] - which can delegate the
authentication on the external resource, configure it in
core/src/main/resources/securityContext.xml
HTH
[1] https://cwiki.apache.org/confluence/display/SYNCOPE/SyncActionsClass
[2]
http://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/security/SyncopeAuthenticationProvider.java
--
Francesco Chicchiriccò
Tirasa - Open Source Excellence
http://www.tirasa.net/
Involved at The Apache Software Foundation:
member, Syncope PMC chair, Cocoon PMC, Olingo PMC
http://people.apache.org/~ilgrosso/
Re: Authentication via ConnId connector
Posted by ilgrosso <il...@apache.org>.
FYI, SYNCOPE-164 [1] was recently moved to 1.2.0 and will provide the feature
as per the subject of this thread ("Authentication via ConnId connector").
Regards.
[1] https://issues.apache.org/jira/browse/SYNCOPE-164
--
View this message in context: http://syncope-user.1051894.n5.nabble.com/Authentication-via-ConnId-connector-tp5707583p5707627.html
Sent from the syncope-user mailing list archive at Nabble.com.