You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-dev@portals.apache.org by Mark McCullough <bu...@gmail.com> on 2006/09/19 17:42:58 UTC
Security Question
I'm using Jetspeed 2-m3. Is it possible to point authentication away from
table security_credential to one of my preexisting tables from another web
app? SSO doesn't seem to work, and one of the most important portlets link
to a different web app. I want the username/password to come from the same
table instead of forcing every user to have a jetspeed username/password and
web app username/password. Thanks.
Download form a portlet !
Posted by hamid bani <ha...@yahoo.com>.
Hi friends !
I want to let user to click on a link in my portlet and download a file !
Is it possible to do that in a JSF based portlet ?
---------------------------------
Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates starting at 1ยข/min.
Re: Security Question
Posted by hamid bani <ha...@yahoo.com>.
Hi friends !
I want to let user to click on a link in my portlet and download a file !
Is it possible to do that in a JSF based portlet ?
---------------------------------
Stay in the know. Pulse on the new Yahoo.com. Check it out.
Re: Security Question
Posted by Mark McCullough <bu...@gmail.com>.
In the case of my other web app that would share with Jetspeed, roles and
users are managed in the other application already, which means that by
using Jetspeed, I have to create users, passwords, and roles two times.
JDBCRealm would be very nice.
On 9/22/06, David Sean Taylor <da...@bluesunrise.com> wrote:
>
> Aaron Evans wrote:
> > Also, if you just use a JDBC realm in-place of the Jetspeed
> > components, you lose the ability to manage (add/update/delete)
> > users/roles via jetspeed.
>
> Thats the incentive of implementing Tomcat-JDBC-realm specific security
> components. You get a higher level of integration.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
>
>
Re: Security Question
Posted by David Sean Taylor <da...@bluesunrise.com>.
Aaron Evans wrote:
> Also, if you just use a JDBC realm in-place of the Jetspeed
> components, you lose the ability to manage (add/update/delete)
> users/roles via jetspeed.
Thats the incentive of implementing Tomcat-JDBC-realm specific security
components. You get a higher level of integration.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: Security Question
Posted by Aaron Evans <aa...@gmail.com>.
Also, if you just use a JDBC realm in-place of the Jetspeed
components, you lose the ability to manage (add/update/delete)
users/roles via jetspeed.
On 9/22/06, David Sean Taylor <da...@bluesunrise.com> wrote:
> Mark McCullough wrote:
> > I guess another way to put it is, has anyone out there been able to
> > properly
> > configure JDBCRealm with Jetspeed?
>
> AFAIK no one has done this yet, or at least no one has contributed it
> It would require implementing/overriding of a few of the security components
> Would be a valuable contribution...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: Security Question
Posted by David Sean Taylor <da...@bluesunrise.com>.
Mark McCullough wrote:
> I guess another way to put it is, has anyone out there been able to
> properly
> configure JDBCRealm with Jetspeed?
AFAIK no one has done this yet, or at least no one has contributed it
It would require implementing/overriding of a few of the security components
Would be a valuable contribution...
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: Security Question
Posted by Mark McCullough <bu...@gmail.com>.
I guess another way to put it is, has anyone out there been able to properly
configure JDBCRealm with Jetspeed?
On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
>
> I did create a different realm that points to my other DB. I commented out
> jetspeed's JAAS realm in jetspeed.xml, so authentication works perfectly.
> The problem is authorization. Even though you define where to pick up roles
> in server.xml, it is not using them, which is the problem. Instead, I'm
> getting authenticated but then roadblocked upon authorization.
>
>
> On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> >
> > Oh and BTW, if you do go with jetspeed's JAAS realm, in order to use
> > roles in a different table, then you need to look at the ATZ
> > components in WEB-INF/assembly/security-spi-atz.xml.
> >
> > On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> > > I'm not clear on what you mean by "I modified server.xml to use the
> > > other database for authentication". You set up a different realm?
> > >
> > > If you went this route (and did not use the jetspeed JAAS realm by
> > > creating custom ATN components), as far as jetspeed goes, I think
> > > you'd need to comment out it's JAAS realm from jetspeed.xml so it
> > > wouldn't override your realm for its context.
> > >
> > > However, even if you got that to work somehow, I'm really not sure
> > > what else would break in jetspeed...
> > >
> > > On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > > > I modified server.xml to use the other database for authentication.
> > That
> > > > works fine except roles are missing. If you look in the catalina log
> > it says
> > > > 'Username xxxx successfully authenticated', but I get Access For
> > View not
> > > > permitted. This is because the role isn't being picked up properly.
> > > > To fix this, I added a column in my username/password table to hold
> > the
> > > > roles, and manually inserted roles into there for each user but I
> > still get
> > > > the error. Is the portal somehow trying to pick up roles from the
> > jetspeed
> > > > DB even though I specifically defined in the server.xml where to
> > look?
> > > >
> > > > On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> > > > >
> > > > > I would continue to use jetspeed's JAAS realm for authentication,
> > but
> > > > > swap out the actual ATN components with your own custom
> > > > > implementations to lookup against your own tables.
> > > > >
> > > > > Look at jetspeed's WEB-INF/assembly/security-spi-atn.xml.
> > > > >
> > > > > You'll need to provide your own custom implementations for the
> > > > > org.apache.jetspeed.security.spi.CredentialHandler component (this
> > is
> > > > > for password encoding/hashing) and for the
> > > > > org.apache.jetspeed.security.spi.UserSecurityHandler component
> > (this
> > > > > is for the actual authentication).
> > > > >
> > > > > Then, I would suggest enabling SSO in tomcat (I just finished
> > > > > describing this on another post, perhaps for the user group).
> > > > >
> > > > > HTH,
> > > > > aaron
> > > > >
> > > > > On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > > > > > I'm using Jetspeed 2-m3. Is it possible to point authentication
> > away
> > > > > from
> > > > > > table security_credential to one of my preexisting tables from
> > another
> > > > > web
> > > > > > app? SSO doesn't seem to work, and one of the most important
> > portlets
> > > > > link
> > > > > > to a different web app. I want the username/password to come
> > from the
> > > > > same
> > > > > > table instead of forcing every user to have a jetspeed
> > username/password
> > > > > and
> > > > > > web app username/password. Thanks.
> > > > > >
> > > > > >
> > > > >
> > > > >
> > ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail:
> > jetspeed-dev-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> > jetspeed-dev-help@portals.apache.org
> > > > >
> > > > >
> > > >
> > > >
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
> >
> >
>
Re: Security Question
Posted by Mark McCullough <bu...@gmail.com>.
I did create a different realm that points to my other DB. I commented out
jetspeed's JAAS realm in jetspeed.xml, so authentication works perfectly.
The problem is authorization. Even though you define where to pick up roles
in server.xml, it is not using them, which is the problem. Instead, I'm
getting authenticated but then roadblocked upon authorization.
On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
>
> Oh and BTW, if you do go with jetspeed's JAAS realm, in order to use
> roles in a different table, then you need to look at the ATZ
> components in WEB-INF/assembly/security-spi-atz.xml.
>
> On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> > I'm not clear on what you mean by "I modified server.xml to use the
> > other database for authentication". You set up a different realm?
> >
> > If you went this route (and did not use the jetspeed JAAS realm by
> > creating custom ATN components), as far as jetspeed goes, I think
> > you'd need to comment out it's JAAS realm from jetspeed.xml so it
> > wouldn't override your realm for its context.
> >
> > However, even if you got that to work somehow, I'm really not sure
> > what else would break in jetspeed...
> >
> > On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > > I modified server.xml to use the other database for authentication.
> That
> > > works fine except roles are missing. If you look in the catalina log
> it says
> > > 'Username xxxx successfully authenticated', but I get Access For View
> not
> > > permitted. This is because the role isn't being picked up properly.
> > > To fix this, I added a column in my username/password table to hold
> the
> > > roles, and manually inserted roles into there for each user but I
> still get
> > > the error. Is the portal somehow trying to pick up roles from the
> jetspeed
> > > DB even though I specifically defined in the server.xml where to look?
> > >
> > > On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> > > >
> > > > I would continue to use jetspeed's JAAS realm for authentication,
> but
> > > > swap out the actual ATN components with your own custom
> > > > implementations to lookup against your own tables.
> > > >
> > > > Look at jetspeed's WEB-INF/assembly/security-spi-atn.xml.
> > > >
> > > > You'll need to provide your own custom implementations for the
> > > > org.apache.jetspeed.security.spi.CredentialHandler component (this
> is
> > > > for password encoding/hashing) and for the
> > > > org.apache.jetspeed.security.spi.UserSecurityHandler component (this
> > > > is for the actual authentication).
> > > >
> > > > Then, I would suggest enabling SSO in tomcat (I just finished
> > > > describing this on another post, perhaps for the user group).
> > > >
> > > > HTH,
> > > > aaron
> > > >
> > > > On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > > > > I'm using Jetspeed 2-m3. Is it possible to point authentication
> away
> > > > from
> > > > > table security_credential to one of my preexisting tables from
> another
> > > > web
> > > > > app? SSO doesn't seem to work, and one of the most important
> portlets
> > > > link
> > > > > to a different web app. I want the username/password to come from
> the
> > > > same
> > > > > table instead of forcing every user to have a jetspeed
> username/password
> > > > and
> > > > > web app username/password. Thanks.
> > > > >
> > > > >
> > > >
> > > >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-dev-help@portals.apache.org
> > > >
> > > >
> > >
> > >
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
>
>
Re: Security Question
Posted by Aaron Evans <aa...@gmail.com>.
Oh and BTW, if you do go with jetspeed's JAAS realm, in order to use
roles in a different table, then you need to look at the ATZ
components in WEB-INF/assembly/security-spi-atz.xml.
On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> I'm not clear on what you mean by "I modified server.xml to use the
> other database for authentication". You set up a different realm?
>
> If you went this route (and did not use the jetspeed JAAS realm by
> creating custom ATN components), as far as jetspeed goes, I think
> you'd need to comment out it's JAAS realm from jetspeed.xml so it
> wouldn't override your realm for its context.
>
> However, even if you got that to work somehow, I'm really not sure
> what else would break in jetspeed...
>
> On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > I modified server.xml to use the other database for authentication. That
> > works fine except roles are missing. If you look in the catalina log it says
> > 'Username xxxx successfully authenticated', but I get Access For View not
> > permitted. This is because the role isn't being picked up properly.
> > To fix this, I added a column in my username/password table to hold the
> > roles, and manually inserted roles into there for each user but I still get
> > the error. Is the portal somehow trying to pick up roles from the jetspeed
> > DB even though I specifically defined in the server.xml where to look?
> >
> > On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> > >
> > > I would continue to use jetspeed's JAAS realm for authentication, but
> > > swap out the actual ATN components with your own custom
> > > implementations to lookup against your own tables.
> > >
> > > Look at jetspeed's WEB-INF/assembly/security-spi-atn.xml.
> > >
> > > You'll need to provide your own custom implementations for the
> > > org.apache.jetspeed.security.spi.CredentialHandler component (this is
> > > for password encoding/hashing) and for the
> > > org.apache.jetspeed.security.spi.UserSecurityHandler component (this
> > > is for the actual authentication).
> > >
> > > Then, I would suggest enabling SSO in tomcat (I just finished
> > > describing this on another post, perhaps for the user group).
> > >
> > > HTH,
> > > aaron
> > >
> > > On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > > > I'm using Jetspeed 2-m3. Is it possible to point authentication away
> > > from
> > > > table security_credential to one of my preexisting tables from another
> > > web
> > > > app? SSO doesn't seem to work, and one of the most important portlets
> > > link
> > > > to a different web app. I want the username/password to come from the
> > > same
> > > > table instead of forcing every user to have a jetspeed username/password
> > > and
> > > > web app username/password. Thanks.
> > > >
> > > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
> > >
> > >
> >
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: Security Question
Posted by Aaron Evans <aa...@gmail.com>.
I'm not clear on what you mean by "I modified server.xml to use the
other database for authentication". You set up a different realm?
If you went this route (and did not use the jetspeed JAAS realm by
creating custom ATN components), as far as jetspeed goes, I think
you'd need to comment out it's JAAS realm from jetspeed.xml so it
wouldn't override your realm for its context.
However, even if you got that to work somehow, I'm really not sure
what else would break in jetspeed...
On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> I modified server.xml to use the other database for authentication. That
> works fine except roles are missing. If you look in the catalina log it says
> 'Username xxxx successfully authenticated', but I get Access For View not
> permitted. This is because the role isn't being picked up properly.
> To fix this, I added a column in my username/password table to hold the
> roles, and manually inserted roles into there for each user but I still get
> the error. Is the portal somehow trying to pick up roles from the jetspeed
> DB even though I specifically defined in the server.xml where to look?
>
> On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
> >
> > I would continue to use jetspeed's JAAS realm for authentication, but
> > swap out the actual ATN components with your own custom
> > implementations to lookup against your own tables.
> >
> > Look at jetspeed's WEB-INF/assembly/security-spi-atn.xml.
> >
> > You'll need to provide your own custom implementations for the
> > org.apache.jetspeed.security.spi.CredentialHandler component (this is
> > for password encoding/hashing) and for the
> > org.apache.jetspeed.security.spi.UserSecurityHandler component (this
> > is for the actual authentication).
> >
> > Then, I would suggest enabling SSO in tomcat (I just finished
> > describing this on another post, perhaps for the user group).
> >
> > HTH,
> > aaron
> >
> > On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > > I'm using Jetspeed 2-m3. Is it possible to point authentication away
> > from
> > > table security_credential to one of my preexisting tables from another
> > web
> > > app? SSO doesn't seem to work, and one of the most important portlets
> > link
> > > to a different web app. I want the username/password to come from the
> > same
> > > table instead of forcing every user to have a jetspeed username/password
> > and
> > > web app username/password. Thanks.
> > >
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
> >
> >
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: Security Question
Posted by Mark McCullough <bu...@gmail.com>.
I modified server.xml to use the other database for authentication. That
works fine except roles are missing. If you look in the catalina log it says
'Username xxxx successfully authenticated', but I get Access For View not
permitted. This is because the role isn't being picked up properly.
To fix this, I added a column in my username/password table to hold the
roles, and manually inserted roles into there for each user but I still get
the error. Is the portal somehow trying to pick up roles from the jetspeed
DB even though I specifically defined in the server.xml where to look?
On 9/19/06, Aaron Evans <aa...@gmail.com> wrote:
>
> I would continue to use jetspeed's JAAS realm for authentication, but
> swap out the actual ATN components with your own custom
> implementations to lookup against your own tables.
>
> Look at jetspeed's WEB-INF/assembly/security-spi-atn.xml.
>
> You'll need to provide your own custom implementations for the
> org.apache.jetspeed.security.spi.CredentialHandler component (this is
> for password encoding/hashing) and for the
> org.apache.jetspeed.security.spi.UserSecurityHandler component (this
> is for the actual authentication).
>
> Then, I would suggest enabling SSO in tomcat (I just finished
> describing this on another post, perhaps for the user group).
>
> HTH,
> aaron
>
> On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> > I'm using Jetspeed 2-m3. Is it possible to point authentication away
> from
> > table security_credential to one of my preexisting tables from another
> web
> > app? SSO doesn't seem to work, and one of the most important portlets
> link
> > to a different web app. I want the username/password to come from the
> same
> > table instead of forcing every user to have a jetspeed username/password
> and
> > web app username/password. Thanks.
> >
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
>
>
Re: Security Question
Posted by Aaron Evans <aa...@gmail.com>.
I would continue to use jetspeed's JAAS realm for authentication, but
swap out the actual ATN components with your own custom
implementations to lookup against your own tables.
Look at jetspeed's WEB-INF/assembly/security-spi-atn.xml.
You'll need to provide your own custom implementations for the
org.apache.jetspeed.security.spi.CredentialHandler component (this is
for password encoding/hashing) and for the
org.apache.jetspeed.security.spi.UserSecurityHandler component (this
is for the actual authentication).
Then, I would suggest enabling SSO in tomcat (I just finished
describing this on another post, perhaps for the user group).
HTH,
aaron
On 9/19/06, Mark McCullough <bu...@gmail.com> wrote:
> I'm using Jetspeed 2-m3. Is it possible to point authentication away from
> table security_credential to one of my preexisting tables from another web
> app? SSO doesn't seem to work, and one of the most important portlets link
> to a different web app. I want the username/password to come from the same
> table instead of forcing every user to have a jetspeed username/password and
> web app username/password. Thanks.
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org