You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-user@portals.apache.org by mb...@oreillyauto.com on 2010/08/11 15:37:57 UTC
SSO IFrame form authentication
I am attempting to use SSO IFrame in Jetspeed 2.2.1 with no success. I
feel like I get the concept and have configured to authenticate to an
internal webapp using simple form based posting, however, when I access
the site via the SSO IFrame portlet, the authentication process never
seems to be invoked. I instead see the login page for the remote site. I
have traced the flow via Wireshark and see no evidence that the IFrame
ever attempts to post the form url. I have tried several internal sites
with similiar results. What am I missing?
Mike
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Hi,
Please see my comments below.
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 11:06:40 AM
> Subject: Re: SSO IFrame form authentication
>
> Are you suggesting that I could deploy the 2.2.1 j2-admin.war and
> apa-webcontent.war into my 2.2.0 implementation?
Well, I thought it would be just simple to deploy those newer portlet
applications.
However, I think it could break some other j2-admin portlets due to dependency
on new Jetspeed APIs.
Basically, the core reverse proxy iframe portlets are provided by apa-webcontent
which can be independently deployed to the old Jetspeed portal.
The sso reverse proxy iframe portlet in j2-admin just extends the core one form
apa-webcontent-jar.
So, I can say you can upgrade apa-webcontent-jar dependency in j2-admin and add
the new sso reverse proxy iframe portlet in the newer j2-admin portlet.
However, of course, this is not in the category of recommended practice.
I think we'd better focus on resolving the problem of preference data..
>
> Just a followup to the preferences problem. When I deployed 2.2.1, I
> copied the psml files from my 2.2.0 implementation to the 2.2.1
> directorys. I had to clone each of the IFrame portlets again in 2.2.1
Hmm. There could be somethings.
I think it would be useful to test the problems in 2.2.1 without copying the old
files which were created under 2.2.0.
By the way, the preference data will be retrieved by the fragment IDs in the
psml files.
So, when you clone those, you could check if the fragment id is the old one or
new generated one. Please have a look into the psml files.
If two fragments have the same fragment ID, then they will share the preferences
data.
Regards,
Woonsan
> Could this process have confused something in the 2.2.1 implementation. I
> will follow your suggestion of deploying with MySQL and see what happens
> as well. Thanks.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 12:35 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Hi,
>
> I haven't heard of that preferences data problem yet in 2.2.1.
> IMHO, It could help to localize the problems if you test against other
> databases
> like PostgreSQL or MySQL.
> On the other hand, I think you could deploy newer j2-admin.war and
> apa-webcontent.war which were included in 2.2.1.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 6:10:25 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, here's the rub. I believe the SSOReverseProxyIFramePortlet is new
>
> > in 2.2.1, which is where I was when I first posted, however, I found
> that
> > my configuration kept getting scrambled, so I reverted to 2.2.0 I will
> > try your suggestion on 2.2.1, but I will have to address the scrambling
> > issue. What is happening is this. I have cloned the IFramePortlet
> > several times and configured each for different static content being
> > served from apache2. I have avoided setting any user preferences, and,
>
> > instead, set the preferences for each clone in the PAM portlet.
> Everything
> > worked fine. Then after a few hours, the IFramePortlet content was all
>
> > mixed up. For instance, the portlet on page 1 would be showing the
> > content I had configured for the portlet on page 2 and so on. I went
> into
> > PAM and corrected the preferences to what they should be and assumed I
> was
> > ok, but the next morning things were scrambled again. I did some
> queries
> > in the derby db and it appears they are wrong there. I don't know if
> this
> > is a portlet id issue or an indexing problem or what, but I need a
> > resolution before I can proceed to 2.2.1 Of course, I have the exact
> same
> > configuration in 2.2.0 and am having no problem there, but I also have
> no
> > SSOReverseProxyIFrame there. Any ideas?
> >
> >
> >
> > From:
> > David Sean Taylor <d....@onehippo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/17/2010 07:19 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > > How did your testing go? I compared SSO Webcontent (which works,
> sort
> > of)
> > > to SSO IFrame classes and I see a method for preemptive login in the
> > > webcontent class but no reference at all in the SSO IFrame class.
> Does
> > > this just mean it is being done differently, or is something amiss in
>
> > the
> > > SSO IFrame class?
> >
> > There are two SSOIFrame classes:
> >
> > 1. SSOIFramePortlet
> > 2. SSOReverseProxyIFramePortlet
> >
> > Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> > you features not available in the older SSOIFramePortlet such as
> > auto-resizing and form-based authentication (what you are after)
> >
> > I tested with SSOReverseProxyIFramePortlet and it worked in the
> > example that comes with Jetspeed, but it takes a little bit of
> > configuration.
> >
> > First, ensure your Tomcat will need this attribute set in the
> > <Connector> element of server.xml:
> >
> > emptySessionPath="true"
> >
> > more detail here:
> >
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > If you had to change server.xml setting, then restart your server
> >
> > I took these steps to verify SSO with the example form-based login
> > that comes with Jetspeed:
> >
> > 1. login as admin
> > 2. navigate to the Jetspeed Administration space, SSO Management page,
> > or just go here:
> >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> >
> > Add a new Site with following parameters:
> >
> > Site Name: Form Example
> > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > Field name for User ID: user
> > Field name For Password value: pass
> >
> > Press Save
> >
> > Add a new credential for this site in the portlet on the right side
> > (SSO Details):
> >
> > Portal Principal: admin
> > Remote Principal: admin
> > Remote Credential: admin
> >
> > Press Add
> >
> > You can verify that the remote credential was added for the admin
> > user by going here:
> >
> > http://localhost:8080/jetspeed/ui/my-account.psml
> >
> > see the portlet on the right "SSO Change Passwords", a remote site
> > entry should be there named "Form Example"
> >
> > Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> > by searching on "iframe" and then selecting it from there and adding
> > to a page. To make things simple, I just added a page and then added
> > the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> > want to use Basic Authentication, so just hit cancel when challenged.
> > I then switched to edit mode (pencil icon), and entered the following
> > preferences:
> >
> > TITLE: My SSO Test
> > SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
> >
> > Press Save
> >
> > You should see in your portlet content something like:
> >
> > "Hello, admin. You have been authorized by form-based authentication
> !!!"
> >
> > Give that a try and see if it works. Then, move on to your specific
> > IFrame source and let us know how it goes...
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:E659D1E6FC.D1395).
> >
> >
> >
> >
> > This communication and any attachments are confidential, protected by
> > Communications Privacy Act 18 USCS § 2510, solely for the use of the
> > intended recipient, and may contain legally privileged material. If you
>
> > are not the intended recipient, please return or destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:9902C1E701.B0EA8).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Are you suggesting that I could deploy the 2.2.1 j2-admin.war and
apa-webcontent.war into my 2.2.0 implementation?
Just a followup to the preferences problem. When I deployed 2.2.1, I
copied the psml files from my 2.2.0 implementation to the 2.2.1
directorys. I had to clone each of the IFrame portlets again in 2.2.1
Could this process have confused something in the 2.2.1 implementation. I
will follow your suggestion of deploying with MySQL and see what happens
as well. Thanks.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/18/2010 12:35 PM
Subject:
Re: SSO IFrame form authentication
Hi,
I haven't heard of that preferences data problem yet in 2.2.1.
IMHO, It could help to localize the problems if you test against other
databases
like PostgreSQL or MySQL.
On the other hand, I think you could deploy newer j2-admin.war and
apa-webcontent.war which were included in 2.2.1.
-Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 6:10:25 AM
> Subject: Re: SSO IFrame form authentication
>
> Well, here's the rub. I believe the SSOReverseProxyIFramePortlet is new
> in 2.2.1, which is where I was when I first posted, however, I found
that
> my configuration kept getting scrambled, so I reverted to 2.2.0 I will
> try your suggestion on 2.2.1, but I will have to address the scrambling
> issue. What is happening is this. I have cloned the IFramePortlet
> several times and configured each for different static content being
> served from apache2. I have avoided setting any user preferences, and,
> instead, set the preferences for each clone in the PAM portlet.
Everything
> worked fine. Then after a few hours, the IFramePortlet content was all
> mixed up. For instance, the portlet on page 1 would be showing the
> content I had configured for the portlet on page 2 and so on. I went
into
> PAM and corrected the preferences to what they should be and assumed I
was
> ok, but the next morning things were scrambled again. I did some
queries
> in the derby db and it appears they are wrong there. I don't know if
this
> is a portlet id issue or an indexing problem or what, but I need a
> resolution before I can proceed to 2.2.1 Of course, I have the exact
same
> configuration in 2.2.0 and am having no problem there, but I also have
no
> SSOReverseProxyIFrame there. Any ideas?
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/17/2010 07:19 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > How did your testing go? I compared SSO Webcontent (which works,
sort
> of)
> > to SSO IFrame classes and I see a method for preemptive login in the
> > webcontent class but no reference at all in the SSO IFrame class.
Does
> > this just mean it is being done differently, or is something amiss in
> the
> > SSO IFrame class?
>
> There are two SSOIFrame classes:
>
> 1. SSOIFramePortlet
> 2. SSOReverseProxyIFramePortlet
>
> Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> you features not available in the older SSOIFramePortlet such as
> auto-resizing and form-based authentication (what you are after)
>
> I tested with SSOReverseProxyIFramePortlet and it worked in the
> example that comes with Jetspeed, but it takes a little bit of
> configuration.
>
> First, ensure your Tomcat will need this attribute set in the
> <Connector> element of server.xml:
>
> emptySessionPath="true"
>
> more detail here:
>
> http://portals.apache.org/applications/webcontent/index.html
>
> If you had to change server.xml setting, then restart your server
>
> I took these steps to verify SSO with the example form-based login
> that comes with Jetspeed:
>
> 1. login as admin
> 2. navigate to the Jetspeed Administration space, SSO Management page,
> or just go here:
>
> http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
>
> Add a new Site with following parameters:
>
> Site Name: Form Example
> Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> Field name for User ID: user
> Field name For Password value: pass
>
> Press Save
>
> Add a new credential for this site in the portlet on the right side
> (SSO Details):
>
> Portal Principal: admin
> Remote Principal: admin
> Remote Credential: admin
>
> Press Add
>
> You can verify that the remote credential was added for the admin
> user by going here:
>
> http://localhost:8080/jetspeed/ui/my-account.psml
>
> see the portlet on the right "SSO Change Passwords", a remote site
> entry should be there named "Form Example"
>
> Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> by searching on "iframe" and then selecting it from there and adding
> to a page. To make things simple, I just added a page and then added
> the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> want to use Basic Authentication, so just hit cancel when challenged.
> I then switched to edit mode (pencil icon), and entered the following
> preferences:
>
> TITLE: My SSO Test
> SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
>
> Press Save
>
> You should see in your portlet content something like:
>
> "Hello, admin. You have been authorized by form-based authentication
!!!"
>
> Give that a try and see if it works. Then, move on to your specific
> IFrame source and let us know how it goes...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E659D1E6FC.D1395).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it
immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:9902C1E701.B0EA8).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
I believe you can ignore my idea about the rewrite rules affecting the .js
After closer observation, it appears it is actually trying to access
fckeditor.html I have checked and see that the file is present, but I'm
getting a 404 just the same. I will investigate further. Thanks.
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Actually, I have tested with /j2-admin/examples/formauth.jsp, where I modified it to check additional parameters strictly to authenticate. And I also modified the SSO SITE url and SRC url preference (e.g., .../formauth.jsp?action=login). I succeeded in SSO with this test.
There could be something else, of course.
For example, I simply used request.getParameter("action") in my local formauth.jsp, which doesn't care if it's posted or in the query string.
Some target web page could accept form params only. In that case, the appended query string wouldn't work..
In this sense, I think we should allow users to add additional parameters in the SSO Admin portlet for SSO Site in the next version. It also makes it clearer.
-Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 8:29 PM
> Yes, I have tried it that way and
> many other combinations. I suspect the
> issue is as I described in my last post, when in the
> portlet that redirect
> is not getting to me and I think that CSID parm is
> important to getting
> logged in.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 01:16 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> When you tried to append
> "?Action=Login&RequestedURL=&Lang=en&TimeOffset=30"
> for the SSO SITE url,
> did you change the SRC preference for the portlet, too?
> If not, the portlet would not try to navigate the url with
> the additional
> parameters. That could be the cause.
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 7:38 PM
> > ok, I was right. SSO Login did
> > not stay working. I have need for these
> > add'l args in the login.
> >
> ?Action=Login&RequestedURL=&Lang=en&TimeOffset=30
> >
> > I found that if I append these to the login url
> in SSO
> > Admin, then try to
> > access the portlet, I get a 404, then if I remove the
> extra
> > args from SSO
> > Admin and go back to the portlet, I am logged
> in. Of
> > course, this only
> > works once and then it's broke again. Also,
> > evidently, the sso.form.Args
> > property does not help. Any other ideas?
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/20/2010 11:50 AM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > I believe the pages can be simply copied because I
> cannot
> > find anything to
> > watch with psml pages either.
> > By the way, you can copy those pages into any other
> folder
> > by configuring
> > the path in
> /jetspeed/WEB-INF/conf/override.properties. For
> > example,
> >
> > # default path to (XML) PSML pages root folder
> > psml.pages.path =
> > ${applicationRoot}/WEB-INF/migrated_pages
> >
> > Regards,
> >
> > Woonsan
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> >
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 3:05 PM
> > > I have installed 2.2.1 with MySQL and
> > > I now need to move my pages and
> > > layouts from the 2.2.0 installation. Given
> that
> > my
> > > previous 2.2.1
> > > installation on Derby is defunct, is there
> anything I
> > > should watch out for
> > > this time? Can I simply copy the psml's
> from
> > the
> > > 2.2.0 directories to the
> > > 2.2.1 directories? I have not
> seen a
> > > migration guide to address this
> > > need.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/18/2010 12:35 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Hi,
> > >
> > > I haven't heard of that preferences data problem
> yet
> > in
> > > 2.2.1.
> > > IMHO, It could help to localize the problems if
> you
> > test
> > > against other
> > > databases
> > > like PostgreSQL or MySQL.
> > > On the other hand, I think you could deploy
> newer
> > > j2-admin.war and
> > > apa-webcontent.war which were included in 2.2.1.
> > >
> > > -Woonsan
> > >
> > >
> > > ----- Original Message ----
> > > > From: "mballard@oreillyauto.com"
> > > <mb...@oreillyauto.com>
> > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > > Subject: Re: SSO IFrame form authentication
> > > >
> > > > Well, here's the rub. I believe the
> > > SSOReverseProxyIFramePortlet is new
> > >
> > > > in 2.2.1, which is where I was when I first
> > posted,
> > > however, I found
> > > that
> > > > my configuration kept getting scrambled, so
> I
> > reverted
> > > to 2.2.0 I will
> > > > try your suggestion on 2.2.1, but I will
> have to
> > > address the scrambling
> > > > issue. What is happening is
> this. I
> > have
> > > cloned the IFramePortlet
> > > > several times and configured each for
> different
> > static
> > > content being
> > > > served from apache2. I have avoided
> setting
> > any
> > > user preferences, and,
> > >
> > > > instead, set the preferences for each clone
> in
> > the
> > > PAM portlet.
> > > Everything
> > > > worked fine. Then after a few hours,
> the
> > > IFramePortlet content was all
> > >
> > > > mixed up. For instance, the portlet on
>
> > > page 1 would be showing the
> > > > content I had configured for the portlet on
> page
> >
> > > 2 and so on. I went
> > > into
> > > > PAM and corrected the preferences to what
> > they
> > > should be and assumed I
> > > was
> > > > ok, but the next morning things were
> > scrambled
> > > again. I did some
> > > queries
> > > > in the derby db and it appears they
> are
> > wrong
> > > there. I don't know if
> > > this
> > > > is a portlet id issue or an indexing
> > problem or
> > > what, but I need a
> > > > resolution before I can proceed to
> 2.2.1
> > > Of course, I have the exact
> > > same
> > > > configuration in 2.2.0 and am having
> no
> > problem
> > > there, but I also have
> > > no
> > > > SSOReverseProxyIFrame there.
> Any
> > ideas?
> > > >
> > > >
> > > >
> > > > From:
> > > > David Sean Taylor <d....@onehippo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/17/2010 07:19 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > On Tue, Aug 17, 2010 at 1:40 PM,
> > <mb...@oreillyauto.com>
> >
> > > wrote:
> > > > > How did your testing go? I
> compared
> > SSO
> > > Webcontent (which works,
> > > sort
> > > > of)
> > > > > to SSO IFrame classes and I see a
> method
> > > for preemptive login in the
> > > > > webcontent class but no reference at
> all in
> > > the SSO IFrame class.
> > > Does
> > > > > this just mean it is being done
> > > differently, or is something amiss in
> > >
> > > > the
> > > > > SSO IFrame class?
> > > >
> > > > There are two SSOIFrame classes:
> > > >
> > > > 1. SSOIFramePortlet
> > > > 2. SSOReverseProxyIFramePortlet
> > > >
> > > > Suggest using the second one,
> > > SSOReverseProxyIFramePortlet as it gives
> > > > you features not available in the
> older
> > > SSOIFramePortlet such as
> > > > auto-resizing and form-based authentication
>
> > > (what you are after)
> > > >
> > > > I tested with SSOReverseProxyIFramePortlet
> and
> > > it worked in the
> > > > example that comes with Jetspeed, but it
> takes a
> > > little bit of
> > > > configuration.
> > > >
> > > > First, ensure your Tomcat will need this
> > > attribute set in the
> > > > <Connector> element of
> server.xml:
> > > >
> > > > emptySessionPath="true"
> > > >
> > > > more detail here:
> > > >
> > > > http://portals.apache.org/applications/webcontent/index.html
> > > >
> > > > If you had to change server.xml
> setting,
> > then
> > > restart your server
> > > >
> > > > I took these steps to verify SSO with
> the
> > > example form-based login
> > > > that comes with Jetspeed:
> > > >
> > > > 1. login as admin
> > > > 2. navigate to the Jetspeed Administration
> > > space, SSO Management page,
> > > > or just go here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > >
> > > > Add a new Site with following
> parameters:
> > > >
> > > > Site Name: Form Example
> > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > Field name for User ID: user
> > > > Field name For Password value: pass
> > > >
> > > > Press Save
> > > >
> > > > Add a new credential for this site in
> the
> > > portlet on the right side
> > > > (SSO Details):
> > > >
> > > > Portal Principal: admin
> > > > Remote Principal: admin
> > > > Remote Credential: admin
> > > >
> > > > Press Add
> > > >
> > > > You can verify that the remote
> > credential
> > > was added for the admin
> > > > user by going here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > >
> > > > see the portlet on the right "SSO
> Change
> > > Passwords", a remote site
> > > > entry should be there named "Form
> Example"
> > > >
> > > > Next, you can use the Toolbox to find the
> > > Reverse Proxy Iframe Portlet
> > > > by searching on "iframe" and then selecting
> it
> > > from there and adding
> > > > to a page. To make things simple, I just
> added a
> > > page and then added
> > > > the Reverse Proxy Iframe Portlet there. At
> first
> > this
> > > portlet seems to
> > > > want to use Basic Authentication, so just
> hit
> > cancel
> > > when challenged.
> > > > I then switched to edit mode (pencil icon),
> and
> > > entered the following
> > > > preferences:
> > > >
> > > > TITLE: My SSO Test
> > > > SRC: http://localhost:$
> > {serverPort}${contextPath}/examples/formauth.jsp
> > > >
> > > > Press Save
> > > >
> > > > You should see in your portlet content
> something
> >
> > > like:
> > > >
> > > > "Hello, admin. You have been authorized by
> > > form-based authentication
> > > !!!"
> > > >
> > > > Give that a try and see if it works. Then,
> move
> > on
> > > to your specific
> > > > IFrame source and let us know how it
> > goes...
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> > jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for
> viruses
> > and
> > > > dangerous content by MailScanner, and
> is
> > > > believed to be clean
> > > (mailgw2:E659D1E6FC.D1395).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments
> are
> > > confidential, protected by
> > > > Communications Privacy Act 18 USCS §
> > 2510,
> > > solely for the use of the
> > > > intended recipient, and may contain
> > legally
> > > privileged material. If you
> > >
> > > > are not the intended recipient, please
> > return or
> > > destroy it
> > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:9902C1E701.B0EA8).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:8B04D2A000C.7088C).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:7C42D1E6FC.46C94).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Yes, I have tried it that way and many other combinations. I suspect the
issue is as I described in my last post, when in the portlet that redirect
is not getting to me and I think that CSID parm is important to getting
logged in.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/20/2010 01:16 PM
Subject:
Re: SSO IFrame form authentication
When you tried to append
"?Action=Login&RequestedURL=&Lang=en&TimeOffset=30" for the SSO SITE url,
did you change the SRC preference for the portlet, too?
If not, the portlet would not try to navigate the url with the additional
parameters. That could be the cause.
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 7:38 PM
> ok, I was right. SSO Login did
> not stay working. I have need for these
> add'l args in the login.
> ?Action=Login&RequestedURL=&Lang=en&TimeOffset=30
>
> I found that if I append these to the login url in SSO
> Admin, then try to
> access the portlet, I get a 404, then if I remove the extra
> args from SSO
> Admin and go back to the portlet, I am logged in. Of
> course, this only
> works once and then it's broke again. Also,
> evidently, the sso.form.Args
> property does not help. Any other ideas?
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 11:50 AM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I believe the pages can be simply copied because I cannot
> find anything to
> watch with psml pages either.
> By the way, you can copy those pages into any other folder
> by configuring
> the path in /jetspeed/WEB-INF/conf/override.properties. For
> example,
>
> # default path to (XML) PSML pages root folder
> psml.pages.path =
> ${applicationRoot}/WEB-INF/migrated_pages
>
> Regards,
>
> Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 3:05 PM
> > I have installed 2.2.1 with MySQL and
> > I now need to move my pages and
> > layouts from the 2.2.0 installation. Given that
> my
> > previous 2.2.1
> > installation on Derby is defunct, is there anything I
> > should watch out for
> > this time? Can I simply copy the psml's from
> the
> > 2.2.0 directories to the
> > 2.2.1 directories? I have not seen a
> > migration guide to address this
> > need.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:35 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > I haven't heard of that preferences data problem yet
> in
> > 2.2.1.
> > IMHO, It could help to localize the problems if you
> test
> > against other
> > databases
> > like PostgreSQL or MySQL.
> > On the other hand, I think you could deploy newer
> > j2-admin.war and
> > apa-webcontent.war which were included in 2.2.1.
> >
> > -Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> > <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > Well, here's the rub. I believe the
> > SSOReverseProxyIFramePortlet is new
> >
> > > in 2.2.1, which is where I was when I first
> posted,
> > however, I found
> > that
> > > my configuration kept getting scrambled, so I
> reverted
> > to 2.2.0 I will
> > > try your suggestion on 2.2.1, but I will have to
> > address the scrambling
> > > issue. What is happening is this. I
> have
> > cloned the IFramePortlet
> > > several times and configured each for different
> static
> > content being
> > > served from apache2. I have avoided setting
> any
> > user preferences, and,
> >
> > > instead, set the preferences for each clone in
> the
> > PAM portlet.
> > Everything
> > > worked fine. Then after a few hours, the
> > IFramePortlet content was all
> >
> > > mixed up. For instance, the portlet on
> > page 1 would be showing the
> > > content I had configured for the portlet on page
>
> > 2 and so on. I went
> > into
> > > PAM and corrected the preferences to what
> they
> > should be and assumed I
> > was
> > > ok, but the next morning things were
> scrambled
> > again. I did some
> > queries
> > > in the derby db and it appears they are
> wrong
> > there. I don't know if
> > this
> > > is a portlet id issue or an indexing
> problem or
> > what, but I need a
> > > resolution before I can proceed to 2.2.1
> > Of course, I have the exact
> > same
> > > configuration in 2.2.0 and am having no
> problem
> > there, but I also have
> > no
> > > SSOReverseProxyIFrame there. Any
> ideas?
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM,
> <mb...@oreillyauto.com>
>
> > wrote:
> > > > How did your testing go? I compared
> SSO
> > Webcontent (which works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method
> > for preemptive login in the
> > > > webcontent class but no reference at all in
> > the SSO IFrame class.
> > Does
> > > > this just mean it is being done
> > differently, or is something amiss in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one,
> > SSOReverseProxyIFramePortlet as it gives
> > > you features not available in the older
> > SSOIFramePortlet such as
> > > auto-resizing and form-based authentication
> > (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and
> > it worked in the
> > > example that comes with Jetspeed, but it takes a
> > little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this
> > attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting,
> then
> > restart your server
> > >
> > > I took these steps to verify SSO with the
> > example form-based login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration
> > space, SSO Management page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the
> > portlet on the right side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote
> credential
> > was added for the admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change
> > Passwords", a remote site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the
> > Reverse Proxy Iframe Portlet
> > > by searching on "iframe" and then selecting it
> > from there and adding
> > > to a page. To make things simple, I just added a
> > page and then added
> > > the Reverse Proxy Iframe Portlet there. At first
> this
> > portlet seems to
> > > want to use Basic Authentication, so just hit
> cancel
> > when challenged.
> > > I then switched to edit mode (pencil icon), and
> > entered the following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something
>
> > like:
> > >
> > > "Hello, admin. You have been authorized by
> > form-based authentication
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move
> on
> > to your specific
> > > IFrame source and let us know how it
> goes...
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses
> and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> > (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential, protected by
> > > Communications Privacy Act 18 USCS §
> 2510,
> > solely for the use of the
> > > intended recipient, and may contain
> legally
> > privileged material. If you
> >
> > > are not the intended recipient, please
> return or
> > destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:9902C1E701.B0EA8).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:8B04D2A000C.7088C).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:7C42D1E6FC.46C94).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
When you tried to append "?Action=Login&RequestedURL=&Lang=en&TimeOffset=30" for the SSO SITE url, did you change the SRC preference for the portlet, too?
If not, the portlet would not try to navigate the url with the additional parameters. That could be the cause.
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 7:38 PM
> ok, I was right. SSO Login did
> not stay working. I have need for these
> add'l args in the login.
> ?Action=Login&RequestedURL=&Lang=en&TimeOffset=30
>
> I found that if I append these to the login url in SSO
> Admin, then try to
> access the portlet, I get a 404, then if I remove the extra
> args from SSO
> Admin and go back to the portlet, I am logged in. Of
> course, this only
> works once and then it's broke again. Also,
> evidently, the sso.form.Args
> property does not help. Any other ideas?
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 11:50 AM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I believe the pages can be simply copied because I cannot
> find anything to
> watch with psml pages either.
> By the way, you can copy those pages into any other folder
> by configuring
> the path in /jetspeed/WEB-INF/conf/override.properties. For
> example,
>
> # default path to (XML) PSML pages root folder
> psml.pages.path =
> ${applicationRoot}/WEB-INF/migrated_pages
>
> Regards,
>
> Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 3:05 PM
> > I have installed 2.2.1 with MySQL and
> > I now need to move my pages and
> > layouts from the 2.2.0 installation. Given that
> my
> > previous 2.2.1
> > installation on Derby is defunct, is there anything I
> > should watch out for
> > this time? Can I simply copy the psml's from
> the
> > 2.2.0 directories to the
> > 2.2.1 directories? I have not seen a
> > migration guide to address this
> > need.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:35 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > I haven't heard of that preferences data problem yet
> in
> > 2.2.1.
> > IMHO, It could help to localize the problems if you
> test
> > against other
> > databases
> > like PostgreSQL or MySQL.
> > On the other hand, I think you could deploy newer
> > j2-admin.war and
> > apa-webcontent.war which were included in 2.2.1.
> >
> > -Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> > <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > Well, here's the rub. I believe the
> > SSOReverseProxyIFramePortlet is new
> >
> > > in 2.2.1, which is where I was when I first
> posted,
> > however, I found
> > that
> > > my configuration kept getting scrambled, so I
> reverted
> > to 2.2.0 I will
> > > try your suggestion on 2.2.1, but I will have to
> > address the scrambling
> > > issue. What is happening is this. I
> have
> > cloned the IFramePortlet
> > > several times and configured each for different
> static
> > content being
> > > served from apache2. I have avoided setting
> any
> > user preferences, and,
> >
> > > instead, set the preferences for each clone in
> the
> > PAM portlet.
> > Everything
> > > worked fine. Then after a few hours, the
> > IFramePortlet content was all
> >
> > > mixed up. For instance, the portlet on
> > page 1 would be showing the
> > > content I had configured for the portlet on page
>
> > 2 and so on. I went
> > into
> > > PAM and corrected the preferences to what
> they
> > should be and assumed I
> > was
> > > ok, but the next morning things were
> scrambled
> > again. I did some
> > queries
> > > in the derby db and it appears they are
> wrong
> > there. I don't know if
> > this
> > > is a portlet id issue or an indexing
> problem or
> > what, but I need a
> > > resolution before I can proceed to 2.2.1
> > Of course, I have the exact
> > same
> > > configuration in 2.2.0 and am having no
> problem
> > there, but I also have
> > no
> > > SSOReverseProxyIFrame there. Any
> ideas?
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM,
> <mb...@oreillyauto.com>
>
> > wrote:
> > > > How did your testing go? I compared
> SSO
> > Webcontent (which works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method
> > for preemptive login in the
> > > > webcontent class but no reference at all in
> > the SSO IFrame class.
> > Does
> > > > this just mean it is being done
> > differently, or is something amiss in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one,
> > SSOReverseProxyIFramePortlet as it gives
> > > you features not available in the older
> > SSOIFramePortlet such as
> > > auto-resizing and form-based authentication
> > (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and
> > it worked in the
> > > example that comes with Jetspeed, but it takes a
> > little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this
> > attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting,
> then
> > restart your server
> > >
> > > I took these steps to verify SSO with the
> > example form-based login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration
> > space, SSO Management page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the
> > portlet on the right side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote
> credential
> > was added for the admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change
> > Passwords", a remote site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the
> > Reverse Proxy Iframe Portlet
> > > by searching on "iframe" and then selecting it
> > from there and adding
> > > to a page. To make things simple, I just added a
> > page and then added
> > > the Reverse Proxy Iframe Portlet there. At first
> this
> > portlet seems to
> > > want to use Basic Authentication, so just hit
> cancel
> > when challenged.
> > > I then switched to edit mode (pencil icon), and
> > entered the following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something
>
> > like:
> > >
> > > "Hello, admin. You have been authorized by
> > form-based authentication
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move
> on
> > to your specific
> > > IFrame source and let us know how it
> goes...
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses
> and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> > (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential, protected by
> > > Communications Privacy Act 18 USCS §
> 2510,
> > solely for the use of the
> > > intended recipient, and may contain
> legally
> > privileged material. If you
> >
> > > are not the intended recipient, please
> return or
> > destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:9902C1E701.B0EA8).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:8B04D2A000C.7088C).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
ok, I was right. SSO Login did not stay working. I have need for these
add'l args in the login. ?Action=Login&RequestedURL=&Lang=en&TimeOffset=30
I found that if I append these to the login url in SSO Admin, then try to
access the portlet, I get a 404, then if I remove the extra args from SSO
Admin and go back to the portlet, I am logged in. Of course, this only
works once and then it's broke again. Also, evidently, the sso.form.Args
property does not help. Any other ideas?
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/20/2010 11:50 AM
Subject:
Re: SSO IFrame form authentication
I believe the pages can be simply copied because I cannot find anything to
watch with psml pages either.
By the way, you can copy those pages into any other folder by configuring
the path in /jetspeed/WEB-INF/conf/override.properties. For example,
# default path to (XML) PSML pages root folder
psml.pages.path = ${applicationRoot}/WEB-INF/migrated_pages
Regards,
Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 3:05 PM
> I have installed 2.2.1 with MySQL and
> I now need to move my pages and
> layouts from the 2.2.0 installation. Given that my
> previous 2.2.1
> installation on Derby is defunct, is there anything I
> should watch out for
> this time? Can I simply copy the psml's from the
> 2.2.0 directories to the
> 2.2.1 directories? I have not seen a
> migration guide to address this
> need.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 12:35 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Hi,
>
> I haven't heard of that preferences data problem yet in
> 2.2.1.
> IMHO, It could help to localize the problems if you test
> against other
> databases
> like PostgreSQL or MySQL.
> On the other hand, I think you could deploy newer
> j2-admin.war and
> apa-webcontent.war which were included in 2.2.1.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 6:10:25 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, here's the rub. I believe the
> SSOReverseProxyIFramePortlet is new
>
> > in 2.2.1, which is where I was when I first posted,
> however, I found
> that
> > my configuration kept getting scrambled, so I reverted
> to 2.2.0 I will
> > try your suggestion on 2.2.1, but I will have to
> address the scrambling
> > issue. What is happening is this. I have
> cloned the IFramePortlet
> > several times and configured each for different static
> content being
> > served from apache2. I have avoided setting any
> user preferences, and,
>
> > instead, set the preferences for each clone in the
> PAM portlet.
> Everything
> > worked fine. Then after a few hours, the
> IFramePortlet content was all
>
> > mixed up. For instance, the portlet on
> page 1 would be showing the
> > content I had configured for the portlet on page
> 2 and so on. I went
> into
> > PAM and corrected the preferences to what they
> should be and assumed I
> was
> > ok, but the next morning things were scrambled
> again. I did some
> queries
> > in the derby db and it appears they are wrong
> there. I don't know if
> this
> > is a portlet id issue or an indexing problem or
> what, but I need a
> > resolution before I can proceed to 2.2.1
> Of course, I have the exact
> same
> > configuration in 2.2.0 and am having no problem
> there, but I also have
> no
> > SSOReverseProxyIFrame there. Any ideas?
> >
> >
> >
> > From:
> > David Sean Taylor <d....@onehippo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/17/2010 07:19 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com>
> wrote:
> > > How did your testing go? I compared SSO
> Webcontent (which works,
> sort
> > of)
> > > to SSO IFrame classes and I see a method
> for preemptive login in the
> > > webcontent class but no reference at all in
> the SSO IFrame class.
> Does
> > > this just mean it is being done
> differently, or is something amiss in
>
> > the
> > > SSO IFrame class?
> >
> > There are two SSOIFrame classes:
> >
> > 1. SSOIFramePortlet
> > 2. SSOReverseProxyIFramePortlet
> >
> > Suggest using the second one,
> SSOReverseProxyIFramePortlet as it gives
> > you features not available in the older
> SSOIFramePortlet such as
> > auto-resizing and form-based authentication
> (what you are after)
> >
> > I tested with SSOReverseProxyIFramePortlet and
> it worked in the
> > example that comes with Jetspeed, but it takes a
> little bit of
> > configuration.
> >
> > First, ensure your Tomcat will need this
> attribute set in the
> > <Connector> element of server.xml:
> >
> > emptySessionPath="true"
> >
> > more detail here:
> >
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > If you had to change server.xml setting, then
> restart your server
> >
> > I took these steps to verify SSO with the
> example form-based login
> > that comes with Jetspeed:
> >
> > 1. login as admin
> > 2. navigate to the Jetspeed Administration
> space, SSO Management page,
> > or just go here:
> >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> >
> > Add a new Site with following parameters:
> >
> > Site Name: Form Example
> > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > Field name for User ID: user
> > Field name For Password value: pass
> >
> > Press Save
> >
> > Add a new credential for this site in the
> portlet on the right side
> > (SSO Details):
> >
> > Portal Principal: admin
> > Remote Principal: admin
> > Remote Credential: admin
> >
> > Press Add
> >
> > You can verify that the remote credential
> was added for the admin
> > user by going here:
> >
> > http://localhost:8080/jetspeed/ui/my-account.psml
> >
> > see the portlet on the right "SSO Change
> Passwords", a remote site
> > entry should be there named "Form Example"
> >
> > Next, you can use the Toolbox to find the
> Reverse Proxy Iframe Portlet
> > by searching on "iframe" and then selecting it
> from there and adding
> > to a page. To make things simple, I just added a
> page and then added
> > the Reverse Proxy Iframe Portlet there. At first this
> portlet seems to
> > want to use Basic Authentication, so just hit cancel
> when challenged.
> > I then switched to edit mode (pencil icon), and
> entered the following
> > preferences:
> >
> > TITLE: My SSO Test
> > SRC: http://localhost:$
{serverPort}${contextPath}/examples/formauth.jsp
> >
> > Press Save
> >
> > You should see in your portlet content something
> like:
> >
> > "Hello, admin. You have been authorized by
> form-based authentication
> !!!"
> >
> > Give that a try and see if it works. Then, move on
> to your specific
> > IFrame source and let us know how it goes...
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean
> (mailgw2:E659D1E6FC.D1395).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential, protected by
> > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
> > intended recipient, and may contain legally
> privileged material. If you
>
> > are not the intended recipient, please return or
> destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:9902C1E701.B0EA8).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:8B04D2A000C.7088C).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
If you want a snapshot build of j2-admin war, you can download it here:
http://repository.apache.org/snapshots/org/apache/portals/jetspeed-2/j2-admin/2.2.2-SNAPSHOT/
Currently, the most recent build is j2-admin-2.2.2-20100901.003458-18.war.
-Woonsan
--- On Wed, 9/1/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Wednesday, September 1, 2010, 4:56 PM
> Is there any way to get the updated
> SSO IFrame stuff short of compiling
> from source or awaiting 2.2.2 binaries? My experience
> so far with
> implementing a new release has necessitated pretty much
> rebuilding my site
> from scratch on the new release.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/30/2010 07:58 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I have just committed changes to fix the following issue:
> https://issues.apache.org/jira/browse/JS2-1208
> Now, the SSOIFramePortlet enables form based SSO, too.
>
> Regards,
>
> Woonsan
>
> --- On Tue, 8/24/10, Woonsan Ko <wo...@yahoo.com>
> wrote:
>
> > From: Woonsan Ko <wo...@yahoo.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Tuesday, August 24, 2010, 3:42 AM
> > Sounds good. By default, it can post
> > "once per session". I like your idea.
> > I will try to fix the problem soon and let you know.
> >
> > Regards,
> >
> > Woonsan
> >
> > --- On Mon, 8/23/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Monday, August 23, 2010, 10:13 PM
> > > Well, if I understand the issue
> > > correctly, you would implement the SSO
> > > IFrame Portlet to pull the credentials from the
> SSO
> > Site
> > > and also provide
> > > the means to specify the other options for the
> form,
> > ie,
> > > sso.type,
> > > sso.form.Args, sso.form.Action, etc., which all
> > sounds
> > > fine, other than I
> > > don't know the ramifications of sending this
> form
> > every
> > > time the page is
> > > accessed. The description in the deployment
> guide
> > > infers that the login
> > > would only happen once, I assume once per
> session,
> > which
> > > would be ok. If
> > > I log out and back in to portal and navigate to
> the
> > page,
> > > it should send
> > > the login form again. I understand the
> difficulty
> > of
> > > a generic portlet
> > > knowing whether iframed content is authenticated
> or
> > not,
> > > but it seems once
> > > per session would suffice and if for some reason
> the
> > login
> > > failed, the
> > > user would have to nav to login form for the site
> and
> > login
> > > manually.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/23/2010 02:37 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Yes, I think the SSOIFramePortlet could be
> improved in
> > that
> > > way with some
> > > limitation: Because the hidden-form-posting-page
> is
> > not
> > > aware of the
> > > authentication status of the remote target
> website, it
> > has
> > > to post the
> > > hidden login form every time whenever it is
> visited.
> > >
> > > Mike, do you think this improvement could
> fulfill
> > your
> > > requirement?
> > >
> > > -Woonsan
> > >
> > > --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> > > wrote:
> > >
> > > > From: David Sean Taylor <d....@onehippo.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Monday, August 23, 2010, 9:17 PM
> > > > On Mon, Aug 23, 2010 at 11:37 AM,
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > wrote:
> > > > > Hi,
> > > > >
> > > > > I think the documentation [1] is
> misleading
> > for
> > > the
> > > > Form-authentication support, which is
> supported
> > only
> > > with
> > > > SSOWebContentPortlet.
> > > > > However, I think you can use
> > IFrameGenericPortlet
> > > to
> > > > allow that form authentication, simply by
> > configuring
> > > your
> > > > new view page in preferrences. For example,
> you
> > can
> > > read the
> > > > preferences and build a simple hidden form
> with
> > the
> > > sso
> > > > credentials info to post to the target
> site.
> > > > > If you want to retrieve the sso
> credentials
> > info
> > > for
> > > > the SSO site from your portlet or your view
> JSP
> > page,
> > > you
> > > > will probably need to access the Jetspeed
> SSO
> > > Manager,
> > > > listed here as Jetspeed Service component.
> [2]
> > > > >
> > > > > PortletContext context =
> > > getPortletContext();
> > > > > SSOManager sso =
> (SSOManager)
> > > > context.getAttribute("cps:SSO");
> > > > >
> > > > > You could refer to SSOProxyPortlet.java
> on
> > how to
> > > use
> > > > the component. [3]
> > > >
> > > > Woonsan, I like your solution. I think it
> could
> > be
> > > > generalized and
> > > > implemented in the SSO IFrame Portlet. I
> 've
> > created
> > > a
> > > > JIRA
> > > > "improvement" issue:
> > > >
> > > > https://issues.apache.org/jira/browse/JS2-1208
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:3E67D1E6FC.BD937).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:400981E6FC.828E4).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Is there any way to get the updated SSO IFrame stuff short of compiling
from source or awaiting 2.2.2 binaries? My experience so far with
implementing a new release has necessitated pretty much rebuilding my site
from scratch on the new release.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/30/2010 07:58 PM
Subject:
Re: SSO IFrame form authentication
I have just committed changes to fix the following issue:
https://issues.apache.org/jira/browse/JS2-1208
Now, the SSOIFramePortlet enables form based SSO, too.
Regards,
Woonsan
--- On Tue, 8/24/10, Woonsan Ko <wo...@yahoo.com> wrote:
> From: Woonsan Ko <wo...@yahoo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Tuesday, August 24, 2010, 3:42 AM
> Sounds good. By default, it can post
> "once per session". I like your idea.
> I will try to fix the problem soon and let you know.
>
> Regards,
>
> Woonsan
>
> --- On Mon, 8/23/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Monday, August 23, 2010, 10:13 PM
> > Well, if I understand the issue
> > correctly, you would implement the SSO
> > IFrame Portlet to pull the credentials from the SSO
> Site
> > and also provide
> > the means to specify the other options for the form,
> ie,
> > sso.type,
> > sso.form.Args, sso.form.Action, etc., which all
> sounds
> > fine, other than I
> > don't know the ramifications of sending this form
> every
> > time the page is
> > accessed. The description in the deployment guide
> > infers that the login
> > would only happen once, I assume once per session,
> which
> > would be ok. If
> > I log out and back in to portal and navigate to the
> page,
> > it should send
> > the login form again. I understand the difficulty
> of
> > a generic portlet
> > knowing whether iframed content is authenticated or
> not,
> > but it seems once
> > per session would suffice and if for some reason the
> login
> > failed, the
> > user would have to nav to login form for the site and
> login
> > manually.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/23/2010 02:37 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Yes, I think the SSOIFramePortlet could be improved in
> that
> > way with some
> > limitation: Because the hidden-form-posting-page is
> not
> > aware of the
> > authentication status of the remote target website, it
> has
> > to post the
> > hidden login form every time whenever it is visited.
> >
> > Mike, do you think this improvement could fulfill
> your
> > requirement?
> >
> > -Woonsan
> >
> > --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> > wrote:
> >
> > > From: David Sean Taylor <d....@onehippo.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Monday, August 23, 2010, 9:17 PM
> > > On Mon, Aug 23, 2010 at 11:37 AM,
> > > Woonsan Ko <wo...@yahoo.com>
> > > wrote:
> > > > Hi,
> > > >
> > > > I think the documentation [1] is misleading
> for
> > the
> > > Form-authentication support, which is supported
> only
> > with
> > > SSOWebContentPortlet.
> > > > However, I think you can use
> IFrameGenericPortlet
> > to
> > > allow that form authentication, simply by
> configuring
> > your
> > > new view page in preferrences. For example, you
> can
> > read the
> > > preferences and build a simple hidden form with
> the
> > sso
> > > credentials info to post to the target site.
> > > > If you want to retrieve the sso credentials
> info
> > for
> > > the SSO site from your portlet or your view JSP
> page,
> > you
> > > will probably need to access the Jetspeed SSO
> > Manager,
> > > listed here as Jetspeed Service component. [2]
> > > >
> > > > PortletContext context =
> > getPortletContext();
> > > > SSOManager sso = (SSOManager)
> > > context.getAttribute("cps:SSO");
> > > >
> > > > You could refer to SSOProxyPortlet.java on
> how to
> > use
> > > the component. [3]
> > >
> > > Woonsan, I like your solution. I think it could
> be
> > > generalized and
> > > implemented in the SSO IFrame Portlet. I 've
> created
> > a
> > > JIRA
> > > "improvement" issue:
> > >
> > > https://issues.apache.org/jira/browse/JS2-1208
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> > >
> > >
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:3E67D1E6FC.BD937).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:400981E6FC.828E4).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: Moving Jetspeed and data
Posted by David Taylor <da...@gmail.com>.
Sorry for the late response, I unsubscribed from my previous
email/job, and looks like I missed a few days (or more) of
jetspeed-user questions...
I think the problem is that when you clone a portlet - it doesn't get
written to the portlet.xml deployment descriptor. So when you
redeploy, you will wipe out any portlets in an application which are
not defined in the portlet.xml. I know, not a desirable effect, but
that's how it works. I am thinking maybe we should create a JIRA issue
/ bug report on this, its really more of a bug than a new feature
Its kind of a pain to have to create new portlet entries in your XML
file. It would be nice if you could export out a PA from the database
to a descriptor. We have been wanting that feature for a long time.
On Fri, Sep 10, 2010 at 6:39 AM, <mb...@oreillyauto.com> wrote:
> I have need to occassionally move a jetspeed instance from one server to
> another. tarring up the directory structure seems simple enough and seems
> to work fine. I also have used the jetspeed 2.2.1 installer functions to
> export and import data from/to mysql, as well as, mysqldump and simply
> moving the database directory structure. All of this seems to work fine
> at first, but for one exception. My jetspeed has many cloned portlets and
> although everything else moves and works great on the new server, the
> cloned portlets never seem to make it. They are in the import/export or
> the mysqldump or the directory structure, but they disappear after the
> first invocation of the jetspeed server after moving. How can I move an
> instance of jetspeed and ensure the complete configuration comes across?
> Actually, they do come across, I can see them in portlet_definitions
> table, but after I fire up jetspeed, they disappear.
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
--
David
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Moving Jetspeed and data
Posted by mb...@oreillyauto.com.
I have need to occassionally move a jetspeed instance from one server to
another. tarring up the directory structure seems simple enough and seems
to work fine. I also have used the jetspeed 2.2.1 installer functions to
export and import data from/to mysql, as well as, mysqldump and simply
moving the database directory structure. All of this seems to work fine
at first, but for one exception. My jetspeed has many cloned portlets and
although everything else moves and works great on the new server, the
cloned portlets never seem to make it. They are in the import/export or
the mysqldump or the directory structure, but they disappear after the
first invocation of the jetspeed server after moving. How can I move an
instance of jetspeed and ensure the complete configuration comes across?
Actually, they do come across, I can see them in portlet_definitions
table, but after I fire up jetspeed, they disappear.
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by David Sean Taylor <d....@onehippo.com>.
On Thu, Sep 2, 2010 at 9:45 AM, <mb...@oreillyauto.com> wrote:
> Yes, my bad, I didn't have all my ducks in a row. Seems to be working
> fine now, just what we needed. We have one exception in that mediawiki
> uses a server generated token in the login process. If we grab a token
> from a login page, and paste it into our portlet, SSO will work one time
> for that token, but since it changes each time, we're really scratching
> our heads as to how to accomodate SSO in this situation. At any rate,
> your changes have really made SSO useful for us. Thanks.
>
I once wrote an extended SSO Web Content portlet "SSOTicketPortlet":
http://www.java2s.com/Open-Source/Java-Document/Portal/jetspeed-2.1.3/org/apache/jetspeed/portlet/SSOTicketPortlet.java.htm
It retrieves a ticket(token) from the server its authenticating
against, and then includes it in subsequent request parameters for the
remainder of the session. It seems to be similar to what you need,
however one problem (again). As you can see in the class diagram in
the link above, it extends SSOWebContentPortlet, not SSOIFramePortlet.
It will require new coding to get it working in an SSO IFrame
portlet...
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Yes, my bad, I didn't have all my ducks in a row. Seems to be working
fine now, just what we needed. We have one exception in that mediawiki
uses a server generated token in the login process. If we grab a token
from a login page, and paste it into our portlet, SSO will work one time
for that token, but since it changes each time, we're really scratching
our heads as to how to accomodate SSO in this situation. At any rate,
your changes have really made SSO useful for us. Thanks.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
09/01/2010 04:56 PM
Subject:
Re: SSO IFrame form authentication
Hi,
The SSOIFramePortlet does not take any preference values for remote
user/credential. It takes those from the SSOManager.
By the way, if you want to use single remote user/credential for the
SSOSite for all portal user, then you can consider to choose a group
instead of a user in the SSO Details portlet.
For example, if you choose 'engineering' group without configuring any for
users, then every user in the group can be authenticated to the remote
site by the shared sso user/credentials.
One more thing to consider is that each user can configure his/her remote
user/credential (only for the user) in /portal/my-account.psml or
/ui/my-account.psml as well.
Regards,
Woonsan
--- On Wed, 9/1/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Wednesday, September 1, 2010, 10:26 PM
> So far the new changes seem to be
> working great, with one noted exception.
> It seems to me that if I set up a user in SSO Management,
> the user should
> not have to set up his/her credentials in the
> portlet. The portlet should
> just go to SSO Management to get that. However,
> unless I'm doing
> something wrong, it seems I have to do both. I don't
> want my users having
> to edit the portlet preferences.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/30/2010 07:58 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I have just committed changes to fix the following issue:
> https://issues.apache.org/jira/browse/JS2-1208
> Now, the SSOIFramePortlet enables form based SSO, too.
>
> Regards,
>
> Woonsan
>
> --- On Tue, 8/24/10, Woonsan Ko <wo...@yahoo.com>
> wrote:
>
> > From: Woonsan Ko <wo...@yahoo.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Tuesday, August 24, 2010, 3:42 AM
> > Sounds good. By default, it can post
> > "once per session". I like your idea.
> > I will try to fix the problem soon and let you know.
> >
> > Regards,
> >
> > Woonsan
> >
> > --- On Mon, 8/23/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Monday, August 23, 2010, 10:13 PM
> > > Well, if I understand the issue
> > > correctly, you would implement the SSO
> > > IFrame Portlet to pull the credentials from the
> SSO
> > Site
> > > and also provide
> > > the means to specify the other options for the
> form,
> > ie,
> > > sso.type,
> > > sso.form.Args, sso.form.Action, etc., which all
> > sounds
> > > fine, other than I
> > > don't know the ramifications of sending this
> form
> > every
> > > time the page is
> > > accessed. The description in the deployment
> guide
> > > infers that the login
> > > would only happen once, I assume once per
> session,
> > which
> > > would be ok. If
> > > I log out and back in to portal and navigate to
> the
> > page,
> > > it should send
> > > the login form again. I understand the
> difficulty
> > of
> > > a generic portlet
> > > knowing whether iframed content is authenticated
> or
> > not,
> > > but it seems once
> > > per session would suffice and if for some reason
> the
> > login
> > > failed, the
> > > user would have to nav to login form for the site
> and
> > login
> > > manually.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/23/2010 02:37 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Yes, I think the SSOIFramePortlet could be
> improved in
> > that
> > > way with some
> > > limitation: Because the hidden-form-posting-page
> is
> > not
> > > aware of the
> > > authentication status of the remote target
> website, it
> > has
> > > to post the
> > > hidden login form every time whenever it is
> visited.
> > >
> > > Mike, do you think this improvement could
> fulfill
> > your
> > > requirement?
> > >
> > > -Woonsan
> > >
> > > --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> > > wrote:
> > >
> > > > From: David Sean Taylor <d....@onehippo.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Monday, August 23, 2010, 9:17 PM
> > > > On Mon, Aug 23, 2010 at 11:37 AM,
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > wrote:
> > > > > Hi,
> > > > >
> > > > > I think the documentation [1] is
> misleading
> > for
> > > the
> > > > Form-authentication support, which is
> supported
> > only
> > > with
> > > > SSOWebContentPortlet.
> > > > > However, I think you can use
> > IFrameGenericPortlet
> > > to
> > > > allow that form authentication, simply by
> > configuring
> > > your
> > > > new view page in preferrences. For example,
> you
> > can
> > > read the
> > > > preferences and build a simple hidden form
> with
> > the
> > > sso
> > > > credentials info to post to the target
> site.
> > > > > If you want to retrieve the sso
> credentials
> > info
> > > for
> > > > the SSO site from your portlet or your view
> JSP
> > page,
> > > you
> > > > will probably need to access the Jetspeed
> SSO
> > > Manager,
> > > > listed here as Jetspeed Service component.
> [2]
> > > > >
> > > > > PortletContext context =
> > > getPortletContext();
> > > > > SSOManager sso =
> (SSOManager)
> > > > context.getAttribute("cps:SSO");
> > > > >
> > > > > You could refer to SSOProxyPortlet.java
> on
> > how to
> > > use
> > > > the component. [3]
> > > >
> > > > Woonsan, I like your solution. I think it
> could
> > be
> > > > generalized and
> > > > implemented in the SSO IFrame Portlet. I
> 've
> > created
> > > a
> > > > JIRA
> > > > "improvement" issue:
> > > >
> > > > https://issues.apache.org/jira/browse/JS2-1208
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:3E67D1E6FC.BD937).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:400981E6FC.828E4).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:E44191E6FC.1D82F).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Hi,
The SSOIFramePortlet does not take any preference values for remote user/credential. It takes those from the SSOManager.
By the way, if you want to use single remote user/credential for the SSOSite for all portal user, then you can consider to choose a group instead of a user in the SSO Details portlet.
For example, if you choose 'engineering' group without configuring any for users, then every user in the group can be authenticated to the remote site by the shared sso user/credentials.
One more thing to consider is that each user can configure his/her remote user/credential (only for the user) in /portal/my-account.psml or /ui/my-account.psml as well.
Regards,
Woonsan
--- On Wed, 9/1/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Wednesday, September 1, 2010, 10:26 PM
> So far the new changes seem to be
> working great, with one noted exception.
> It seems to me that if I set up a user in SSO Management,
> the user should
> not have to set up his/her credentials in the
> portlet. The portlet should
> just go to SSO Management to get that. However,
> unless I'm doing
> something wrong, it seems I have to do both. I don't
> want my users having
> to edit the portlet preferences.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/30/2010 07:58 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I have just committed changes to fix the following issue:
> https://issues.apache.org/jira/browse/JS2-1208
> Now, the SSOIFramePortlet enables form based SSO, too.
>
> Regards,
>
> Woonsan
>
> --- On Tue, 8/24/10, Woonsan Ko <wo...@yahoo.com>
> wrote:
>
> > From: Woonsan Ko <wo...@yahoo.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Tuesday, August 24, 2010, 3:42 AM
> > Sounds good. By default, it can post
> > "once per session". I like your idea.
> > I will try to fix the problem soon and let you know.
> >
> > Regards,
> >
> > Woonsan
> >
> > --- On Mon, 8/23/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Monday, August 23, 2010, 10:13 PM
> > > Well, if I understand the issue
> > > correctly, you would implement the SSO
> > > IFrame Portlet to pull the credentials from the
> SSO
> > Site
> > > and also provide
> > > the means to specify the other options for the
> form,
> > ie,
> > > sso.type,
> > > sso.form.Args, sso.form.Action, etc., which all
> > sounds
> > > fine, other than I
> > > don't know the ramifications of sending this
> form
> > every
> > > time the page is
> > > accessed. The description in the deployment
> guide
> > > infers that the login
> > > would only happen once, I assume once per
> session,
> > which
> > > would be ok. If
> > > I log out and back in to portal and navigate to
> the
> > page,
> > > it should send
> > > the login form again. I understand the
> difficulty
> > of
> > > a generic portlet
> > > knowing whether iframed content is authenticated
> or
> > not,
> > > but it seems once
> > > per session would suffice and if for some reason
> the
> > login
> > > failed, the
> > > user would have to nav to login form for the site
> and
> > login
> > > manually.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/23/2010 02:37 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Yes, I think the SSOIFramePortlet could be
> improved in
> > that
> > > way with some
> > > limitation: Because the hidden-form-posting-page
> is
> > not
> > > aware of the
> > > authentication status of the remote target
> website, it
> > has
> > > to post the
> > > hidden login form every time whenever it is
> visited.
> > >
> > > Mike, do you think this improvement could
> fulfill
> > your
> > > requirement?
> > >
> > > -Woonsan
> > >
> > > --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> > > wrote:
> > >
> > > > From: David Sean Taylor <d....@onehippo.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Monday, August 23, 2010, 9:17 PM
> > > > On Mon, Aug 23, 2010 at 11:37 AM,
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > wrote:
> > > > > Hi,
> > > > >
> > > > > I think the documentation [1] is
> misleading
> > for
> > > the
> > > > Form-authentication support, which is
> supported
> > only
> > > with
> > > > SSOWebContentPortlet.
> > > > > However, I think you can use
> > IFrameGenericPortlet
> > > to
> > > > allow that form authentication, simply by
> > configuring
> > > your
> > > > new view page in preferrences. For example,
> you
> > can
> > > read the
> > > > preferences and build a simple hidden form
> with
> > the
> > > sso
> > > > credentials info to post to the target
> site.
> > > > > If you want to retrieve the sso
> credentials
> > info
> > > for
> > > > the SSO site from your portlet or your view
> JSP
> > page,
> > > you
> > > > will probably need to access the Jetspeed
> SSO
> > > Manager,
> > > > listed here as Jetspeed Service component.
> [2]
> > > > >
> > > > > PortletContext context =
> > > getPortletContext();
> > > > > SSOManager sso =
> (SSOManager)
> > > > context.getAttribute("cps:SSO");
> > > > >
> > > > > You could refer to SSOProxyPortlet.java
> on
> > how to
> > > use
> > > > the component. [3]
> > > >
> > > > Woonsan, I like your solution. I think it
> could
> > be
> > > > generalized and
> > > > implemented in the SSO IFrame Portlet. I
> 've
> > created
> > > a
> > > > JIRA
> > > > "improvement" issue:
> > > >
> > > > https://issues.apache.org/jira/browse/JS2-1208
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:3E67D1E6FC.BD937).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:400981E6FC.828E4).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
So far the new changes seem to be working great, with one noted exception.
It seems to me that if I set up a user in SSO Management, the user should
not have to set up his/her credentials in the portlet. The portlet should
just go to SSO Management to get that. However, unless I'm doing
something wrong, it seems I have to do both. I don't want my users having
to edit the portlet preferences.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/30/2010 07:58 PM
Subject:
Re: SSO IFrame form authentication
I have just committed changes to fix the following issue:
https://issues.apache.org/jira/browse/JS2-1208
Now, the SSOIFramePortlet enables form based SSO, too.
Regards,
Woonsan
--- On Tue, 8/24/10, Woonsan Ko <wo...@yahoo.com> wrote:
> From: Woonsan Ko <wo...@yahoo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Tuesday, August 24, 2010, 3:42 AM
> Sounds good. By default, it can post
> "once per session". I like your idea.
> I will try to fix the problem soon and let you know.
>
> Regards,
>
> Woonsan
>
> --- On Mon, 8/23/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Monday, August 23, 2010, 10:13 PM
> > Well, if I understand the issue
> > correctly, you would implement the SSO
> > IFrame Portlet to pull the credentials from the SSO
> Site
> > and also provide
> > the means to specify the other options for the form,
> ie,
> > sso.type,
> > sso.form.Args, sso.form.Action, etc., which all
> sounds
> > fine, other than I
> > don't know the ramifications of sending this form
> every
> > time the page is
> > accessed. The description in the deployment guide
> > infers that the login
> > would only happen once, I assume once per session,
> which
> > would be ok. If
> > I log out and back in to portal and navigate to the
> page,
> > it should send
> > the login form again. I understand the difficulty
> of
> > a generic portlet
> > knowing whether iframed content is authenticated or
> not,
> > but it seems once
> > per session would suffice and if for some reason the
> login
> > failed, the
> > user would have to nav to login form for the site and
> login
> > manually.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/23/2010 02:37 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Yes, I think the SSOIFramePortlet could be improved in
> that
> > way with some
> > limitation: Because the hidden-form-posting-page is
> not
> > aware of the
> > authentication status of the remote target website, it
> has
> > to post the
> > hidden login form every time whenever it is visited.
> >
> > Mike, do you think this improvement could fulfill
> your
> > requirement?
> >
> > -Woonsan
> >
> > --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> > wrote:
> >
> > > From: David Sean Taylor <d....@onehippo.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Monday, August 23, 2010, 9:17 PM
> > > On Mon, Aug 23, 2010 at 11:37 AM,
> > > Woonsan Ko <wo...@yahoo.com>
> > > wrote:
> > > > Hi,
> > > >
> > > > I think the documentation [1] is misleading
> for
> > the
> > > Form-authentication support, which is supported
> only
> > with
> > > SSOWebContentPortlet.
> > > > However, I think you can use
> IFrameGenericPortlet
> > to
> > > allow that form authentication, simply by
> configuring
> > your
> > > new view page in preferrences. For example, you
> can
> > read the
> > > preferences and build a simple hidden form with
> the
> > sso
> > > credentials info to post to the target site.
> > > > If you want to retrieve the sso credentials
> info
> > for
> > > the SSO site from your portlet or your view JSP
> page,
> > you
> > > will probably need to access the Jetspeed SSO
> > Manager,
> > > listed here as Jetspeed Service component. [2]
> > > >
> > > > PortletContext context =
> > getPortletContext();
> > > > SSOManager sso = (SSOManager)
> > > context.getAttribute("cps:SSO");
> > > >
> > > > You could refer to SSOProxyPortlet.java on
> how to
> > use
> > > the component. [3]
> > >
> > > Woonsan, I like your solution. I think it could
> be
> > > generalized and
> > > implemented in the SSO IFrame Portlet. I 've
> created
> > a
> > > JIRA
> > > "improvement" issue:
> > >
> > > https://issues.apache.org/jira/browse/JS2-1208
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> > >
> > >
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:3E67D1E6FC.BD937).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:400981E6FC.828E4).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
I have just committed changes to fix the following issue:
https://issues.apache.org/jira/browse/JS2-1208
Now, the SSOIFramePortlet enables form based SSO, too.
Regards,
Woonsan
--- On Tue, 8/24/10, Woonsan Ko <wo...@yahoo.com> wrote:
> From: Woonsan Ko <wo...@yahoo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Tuesday, August 24, 2010, 3:42 AM
> Sounds good. By default, it can post
> "once per session". I like your idea.
> I will try to fix the problem soon and let you know.
>
> Regards,
>
> Woonsan
>
> --- On Mon, 8/23/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Monday, August 23, 2010, 10:13 PM
> > Well, if I understand the issue
> > correctly, you would implement the SSO
> > IFrame Portlet to pull the credentials from the SSO
> Site
> > and also provide
> > the means to specify the other options for the form,
> ie,
> > sso.type,
> > sso.form.Args, sso.form.Action, etc., which all
> sounds
> > fine, other than I
> > don't know the ramifications of sending this form
> every
> > time the page is
> > accessed. The description in the deployment guide
> > infers that the login
> > would only happen once, I assume once per session,
> which
> > would be ok. If
> > I log out and back in to portal and navigate to the
> page,
> > it should send
> > the login form again. I understand the difficulty
> of
> > a generic portlet
> > knowing whether iframed content is authenticated or
> not,
> > but it seems once
> > per session would suffice and if for some reason the
> login
> > failed, the
> > user would have to nav to login form for the site and
> login
> > manually.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/23/2010 02:37 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Yes, I think the SSOIFramePortlet could be improved in
> that
> > way with some
> > limitation: Because the hidden-form-posting-page is
> not
> > aware of the
> > authentication status of the remote target website, it
> has
> > to post the
> > hidden login form every time whenever it is visited.
> >
> > Mike, do you think this improvement could fulfill
> your
> > requirement?
> >
> > -Woonsan
> >
> > --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> > wrote:
> >
> > > From: David Sean Taylor <d....@onehippo.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Monday, August 23, 2010, 9:17 PM
> > > On Mon, Aug 23, 2010 at 11:37 AM,
> > > Woonsan Ko <wo...@yahoo.com>
> > > wrote:
> > > > Hi,
> > > >
> > > > I think the documentation [1] is misleading
> for
> > the
> > > Form-authentication support, which is supported
> only
> > with
> > > SSOWebContentPortlet.
> > > > However, I think you can use
> IFrameGenericPortlet
> > to
> > > allow that form authentication, simply by
> configuring
> > your
> > > new view page in preferrences. For example, you
> can
> > read the
> > > preferences and build a simple hidden form with
> the
> > sso
> > > credentials info to post to the target site.
> > > > If you want to retrieve the sso credentials
> info
> > for
> > > the SSO site from your portlet or your view JSP
> page,
> > you
> > > will probably need to access the Jetspeed SSO
> > Manager,
> > > listed here as Jetspeed Service component. [2]
> > > >
> > > > PortletContext context =
> > getPortletContext();
> > > > SSOManager sso = (SSOManager)
> > > context.getAttribute("cps:SSO");
> > > >
> > > > You could refer to SSOProxyPortlet.java on
> how to
> > use
> > > the component. [3]
> > >
> > > Woonsan, I like your solution. I think it could
> be
> > > generalized and
> > > implemented in the SSO IFrame Portlet. I 've
> created
> > a
> > > JIRA
> > > "improvement" issue:
> > >
> > > https://issues.apache.org/jira/browse/JS2-1208
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:3E67D1E6FC.BD937).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Sounds good. By default, it can post "once per session". I like your idea.
I will try to fix the problem soon and let you know.
Regards,
Woonsan
--- On Mon, 8/23/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Monday, August 23, 2010, 10:13 PM
> Well, if I understand the issue
> correctly, you would implement the SSO
> IFrame Portlet to pull the credentials from the SSO Site
> and also provide
> the means to specify the other options for the form, ie,
> sso.type,
> sso.form.Args, sso.form.Action, etc., which all sounds
> fine, other than I
> don't know the ramifications of sending this form every
> time the page is
> accessed. The description in the deployment guide
> infers that the login
> would only happen once, I assume once per session, which
> would be ok. If
> I log out and back in to portal and navigate to the page,
> it should send
> the login form again. I understand the difficulty of
> a generic portlet
> knowing whether iframed content is authenticated or not,
> but it seems once
> per session would suffice and if for some reason the login
> failed, the
> user would have to nav to login form for the site and login
> manually.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/23/2010 02:37 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Yes, I think the SSOIFramePortlet could be improved in that
> way with some
> limitation: Because the hidden-form-posting-page is not
> aware of the
> authentication status of the remote target website, it has
> to post the
> hidden login form every time whenever it is visited.
>
> Mike, do you think this improvement could fulfill your
> requirement?
>
> -Woonsan
>
> --- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com>
> wrote:
>
> > From: David Sean Taylor <d....@onehippo.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Monday, August 23, 2010, 9:17 PM
> > On Mon, Aug 23, 2010 at 11:37 AM,
> > Woonsan Ko <wo...@yahoo.com>
> > wrote:
> > > Hi,
> > >
> > > I think the documentation [1] is misleading for
> the
> > Form-authentication support, which is supported only
> with
> > SSOWebContentPortlet.
> > > However, I think you can use IFrameGenericPortlet
> to
> > allow that form authentication, simply by configuring
> your
> > new view page in preferrences. For example, you can
> read the
> > preferences and build a simple hidden form with the
> sso
> > credentials info to post to the target site.
> > > If you want to retrieve the sso credentials info
> for
> > the SSO site from your portlet or your view JSP page,
> you
> > will probably need to access the Jetspeed SSO
> Manager,
> > listed here as Jetspeed Service component. [2]
> > >
> > > PortletContext context =
> getPortletContext();
> > > SSOManager sso = (SSOManager)
> > context.getAttribute("cps:SSO");
> > >
> > > You could refer to SSOProxyPortlet.java on how to
> use
> > the component. [3]
> >
> > Woonsan, I like your solution. I think it could be
> > generalized and
> > implemented in the SSO IFrame Portlet. I 've created
> a
> > JIRA
> > "improvement" issue:
> >
> > https://issues.apache.org/jira/browse/JS2-1208
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:3E67D1E6FC.BD937).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Well, if I understand the issue correctly, you would implement the SSO
IFrame Portlet to pull the credentials from the SSO Site and also provide
the means to specify the other options for the form, ie, sso.type,
sso.form.Args, sso.form.Action, etc., which all sounds fine, other than I
don't know the ramifications of sending this form every time the page is
accessed. The description in the deployment guide infers that the login
would only happen once, I assume once per session, which would be ok. If
I log out and back in to portal and navigate to the page, it should send
the login form again. I understand the difficulty of a generic portlet
knowing whether iframed content is authenticated or not, but it seems once
per session would suffice and if for some reason the login failed, the
user would have to nav to login form for the site and login manually.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/23/2010 02:37 PM
Subject:
Re: SSO IFrame form authentication
Yes, I think the SSOIFramePortlet could be improved in that way with some
limitation: Because the hidden-form-posting-page is not aware of the
authentication status of the remote target website, it has to post the
hidden login form every time whenever it is visited.
Mike, do you think this improvement could fulfill your requirement?
-Woonsan
--- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com> wrote:
> From: David Sean Taylor <d....@onehippo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Monday, August 23, 2010, 9:17 PM
> On Mon, Aug 23, 2010 at 11:37 AM,
> Woonsan Ko <wo...@yahoo.com>
> wrote:
> > Hi,
> >
> > I think the documentation [1] is misleading for the
> Form-authentication support, which is supported only with
> SSOWebContentPortlet.
> > However, I think you can use IFrameGenericPortlet to
> allow that form authentication, simply by configuring your
> new view page in preferrences. For example, you can read the
> preferences and build a simple hidden form with the sso
> credentials info to post to the target site.
> > If you want to retrieve the sso credentials info for
> the SSO site from your portlet or your view JSP page, you
> will probably need to access the Jetspeed SSO Manager,
> listed here as Jetspeed Service component. [2]
> >
> > PortletContext context = getPortletContext();
> > SSOManager sso = (SSOManager)
> context.getAttribute("cps:SSO");
> >
> > You could refer to SSOProxyPortlet.java on how to use
> the component. [3]
>
> Woonsan, I like your solution. I think it could be
> generalized and
> implemented in the SSO IFrame Portlet. I 've created a
> JIRA
> "improvement" issue:
>
> https://issues.apache.org/jira/browse/JS2-1208
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:3E67D1E6FC.BD937).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Yes, I think the SSOIFramePortlet could be improved in that way with some limitation: Because the hidden-form-posting-page is not aware of the authentication status of the remote target website, it has to post the hidden login form every time whenever it is visited.
Mike, do you think this improvement could fulfill your requirement?
-Woonsan
--- On Mon, 8/23/10, David Sean Taylor <d....@onehippo.com> wrote:
> From: David Sean Taylor <d....@onehippo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Monday, August 23, 2010, 9:17 PM
> On Mon, Aug 23, 2010 at 11:37 AM,
> Woonsan Ko <wo...@yahoo.com>
> wrote:
> > Hi,
> >
> > I think the documentation [1] is misleading for the
> Form-authentication support, which is supported only with
> SSOWebContentPortlet.
> > However, I think you can use IFrameGenericPortlet to
> allow that form authentication, simply by configuring your
> new view page in preferrences. For example, you can read the
> preferences and build a simple hidden form with the sso
> credentials info to post to the target site.
> > If you want to retrieve the sso credentials info for
> the SSO site from your portlet or your view JSP page, you
> will probably need to access the Jetspeed SSO Manager,
> listed here as Jetspeed Service component. [2]
> >
> > PortletContext context = getPortletContext();
> > SSOManager sso = (SSOManager)
> context.getAttribute("cps:SSO");
> >
> > You could refer to SSOProxyPortlet.java on how to use
> the component. [3]
>
> Woonsan, I like your solution. I think it could be
> generalized and
> implemented in the SSO IFrame Portlet. I 've created a
> JIRA
> "improvement" issue:
>
> https://issues.apache.org/jira/browse/JS2-1208
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by David Sean Taylor <d....@onehippo.com>.
On Mon, Aug 23, 2010 at 11:37 AM, Woonsan Ko <wo...@yahoo.com> wrote:
> Hi,
>
> I think the documentation [1] is misleading for the Form-authentication support, which is supported only with SSOWebContentPortlet.
> However, I think you can use IFrameGenericPortlet to allow that form authentication, simply by configuring your new view page in preferrences. For example, you can read the preferences and build a simple hidden form with the sso credentials info to post to the target site.
> If you want to retrieve the sso credentials info for the SSO site from your portlet or your view JSP page, you will probably need to access the Jetspeed SSO Manager, listed here as Jetspeed Service component. [2]
>
> PortletContext context = getPortletContext();
> SSOManager sso = (SSOManager) context.getAttribute("cps:SSO");
>
> You could refer to SSOProxyPortlet.java on how to use the component. [3]
Woonsan, I like your solution. I think it could be generalized and
implemented in the SSO IFrame Portlet. I 've created a JIRA
"improvement" issue:
https://issues.apache.org/jira/browse/JS2-1208
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Sorry, use this url for the last reference:
[3] http://svn.apache.org/repos/asf/portals/jetspeed-2/applications/j2-admin/trunk/src/main/java/org/apache/jetspeed/portlets/sso/SSOProxyPortlet.java
--- On Mon, 8/23/10, Woonsan Ko <wo...@yahoo.com> wrote:
> From: Woonsan Ko <wo...@yahoo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Monday, August 23, 2010, 8:37 PM
> Hi,
>
> I think the documentation [1] is misleading for the
> Form-authentication support, which is supported only with
> SSOWebContentPortlet.
> However, I think you can use IFrameGenericPortlet to allow
> that form authentication, simply by configuring your new
> view page in preferrences. For example, you can read the
> preferences and build a simple hidden form with the sso
> credentials info to post to the target site.
> If you want to retrieve the sso credentials info for the
> SSO site from your portlet or your view JSP page, you will
> probably need to access the Jetspeed SSO Manager, listed
> here as Jetspeed Service component. [2]
>
> PortletContext context =
> getPortletContext();
> SSOManager sso = (SSOManager)
> context.getAttribute("cps:SSO");
>
> You could refer to SSOProxyPortlet.java on how to use the
> component. [3]
>
> [1] http://portals.apache.org/jetspeed-2/deployguide/config-sso.html
> [2] http://portals.apache.org/jetspeed-2/deployguide/guide-services.html
> [3] https://svn.apache.org/repos/asf/portals/jetspeed-2/applications/j2-admin/trunk/src/main/java/org/apache/jetspeed/portlets/sso/SSOProxyPortlet.java
>
>
> HTH,
>
> Woonsan
>
> --- On Mon, 8/23/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Monday, August 23, 2010, 7:45 PM
> > The only portlet producing acceptable
> > rendering results is the SSO IFrame
> > Portlet, which claims to use SSO, but appears to not
> work
> > according to the
> > documentation. The SSO section of the deployment
> > guide clearly spells out
> > how to use sso.type, sso.form.principal,
> > sso.form.credential, sso.Action,
> > sso.form.Args, etc to do what we need but it does not
> work
> > in the simplest
> > of examples of form based preemptive
> authentication.
> > I am at a loss as to
> > where to go next.
> >
> > Thanks, MikeB
> >
> > Mike Ballard
> > Director of Internet Development and Networking
> > O'Reilly Auto Parts
> > (417) 874-7107 Ofc
> > (417) 838-0271 Cell
> >
> > This message is protected by the Electronic
> Communications
> > Privacy Act, 18
> > USCS § 2510 et seq., and may not be used, copied or
> > forwarded without the
> > consent of the named recipient(s). The information
> > contained in this
> > message is confidential, is intended only for the use
> of
> > the individual or
> > entity named. If the reader of this message is not
> > the intended
> > recipient, you are hereby notified that any
> dissemination,
> > distribution or
> > copying of this communication is strictly
> prohibited.
> > If you have
> > received this communication in error, please notify
> me
> > immediately at
> > 417-874-7107.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/20/2010 06:54 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > How about prepending a double quote or single quote,
> > depending your target
> > website, in the regex expression?
> > For example,
> > \"\\/otrs\\/customer\\.pl\\?CSID
> > will exclude "/j2-admin/rproxy/otrs/...".
> >
> > Also, you can configure multiple custom replacements
> in the
> > configuration.
> > (Multiple keys are defined with the same keys.
> > For example,
> >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
> >
> > = \"\\/otrs\\/customer\\.pl
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
> >
> > = \"/j2-admin/rproxy/otrs/otrs/customer.pl
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
> >
> > = \"\\/otrs-web\\/customer\\.pl
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
> >
> > = \"/j2-admin/rproxy/otrs/otrs-web/customer.pl
> > ...
> >
> > -Woonsan
> >
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> >
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 10:52 PM
> > > Thank you, I had figured that
> > > out. Problem is that this rule replaces
> > > everything with /otrs/customer.pl even when it
> already
> > has
> > >
> > > /j2-admin/rproxy/otrs prepended. Since the
> > offending
> > > string is
> > >
> > http://hostname.domain-name.com:8080/otrs/customer.pl?CSID=10822f631e5c8aaaa5b4236cd2547c5d82
> >
> > >
> > > I attempted to construct a new rule with
> pattern
> >
> > > \\/otrs\\/customer\\.pl\\?CSID and replacement
> > > /j2-admin/rproxy/otrs/otrs/customer.pl?CSID
> > >
> > > However, it never seems to catch the pattern.
> I
> > tried
> > > it with escaping
> > > the ? and not escaping the ? as I wasn't sure
> which
> > it
> > > should be.
> > >
> > > I also have a similiar issue with /otrs-web.....
>
> > > coming from javascript,
> > > I assume. Problem is that some of these
> patterns
> > are
> > > prepended with the
> > > proxy and some are not. How to catch the ones
> > which
> > > need rewrite as
> > > opposed to the ones which do not.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/20/2010 03:35 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > If the pass configuration is for 'otrs' in your
> > example,
> > > "proxy.reverse.pass = otrs", then the
> configuration
> > keys
> > > should look like
> > > these:
> > >
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
> > >
> > > = \\/otrs\\/customer\\.pl
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
> > >
> > > = /j2-admin/rproxy/otrs/otrs/customer.pl
> > >
> > > --- On Fri, 8/20/10, Woonsan Ko <wo...@yahoo.com>
> > > wrote:
> > >
> > > > From: Woonsan Ko <wo...@yahoo.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Friday, August 20, 2010, 9:13 PM
> > > > I guess the first page which tried to
> > > > redirect to the second page with wrong url
> by
> > using
> > > > javascript.
> > > > If it redirects to other page from the
> > server-side
> > > with
> > > > http status code and header, then the
> reverse
> > proxy
> > > service
> > > > can detect and rewrite to a proxied url from
> the
> > > reverse
> > > > proxy configurations if found.
> > > >
> > > > Anyway, if the first page has javascript to
> > redirect,
> > > e.g.,
> > > > 'location.href =
> > > >
> > >
> >
> /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a',
> > > > that script line is not rewritten by
> default.
> > > > (By the way, you can refer to the default
> > rewriting
> > > class
> > > > here if you're interested in:
> > >
> > http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java
> >
> > > )
> > > >
> > > > If the redirecting script line is simple,
> then
> > you can
> > > add
> > > > a custom replace pattern in the reverse
> proxy
> > > configuration
> > > > like the following example:
> > > >
> > > >
> > >
> >
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns
> > > > = \\/otrs\\/customer\\.pl
> > > >
> > >
> >
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces
> > > > = /j2-admin/rproxy/otrs/otrs/customer.pl
> > > >
> > > > The above additional custom replace
> > configuration
> > > will
> > > > replace every line having that regex
> pattern.
> > > >
> > > > -Woonsan
> > > >
> > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > > wrote:
> > > >
> > > > > From: mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > > > Subject: Re: SSO IFrame form
> authentication
> > > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > > Date: Friday, August 20, 2010, 8:19 PM
> > > > > I am using
> > > > >
> > j2-admin::SSOReverseProxyIFramePortlet. I
> > > also
> > > > believe
> > > > > I am
> > > > > using the exact reverse properties as
> the
> > apache
> > > > > example. I have
> > > > > discovered one issue when accessing
> directly
> > in
> > > that
> > > > it
> > > > > appears when I
> > > > > enter
> > > > >
> > http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl
> > > ,
> > > > >
> > > > > and login manually, I am redirected to
>
> > > > >
> > >
> > http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
> >
> > >
> > > > >
> > > > > and I get an HTTP 404 error. If I
> > then
> > > correct the
> > > > > url and put the
> > > > > j2-admin/rproxy/otrs back in, I get
> the
> > correct
> > > page
> > > > > rendered and I am
> > > > > logged in. In any case, once I get
> > logged
> > > in and
> > > > try
> > > > > to drill down to an
> > > > > incident link, I get an error trying to
> load
> > the
> > > > javascript
> > > > > because
> > > > > something has changed the .js in the
> link
> > to
> > > .html
> > > > > Again, I am using the
> > > > > apache example config for rewriting.
> > > > >
> > > > > # ... Set max matching path part count
> > > > >
> proxy.reverse.pass.maxMatchingPathPartCount
> > = 2
> > > > >
> > > > > # ... Sets detail attributes for
> apache
> > path
> > > mapping
> > > > > proxy.reverse.pass = otrs
> > > > > proxy.reverse.pass.otrs.local = /otrs/
> > > > > proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> > > > > proxy.reverse.pass.otrs.rewriter.basic
> =
> > > > >
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > > >
> > proxy.reverse.pass.otrs.rewriter.parserAdaptor =
> > > html
> > > > >
> > >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
> > > >
> > > > >
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > > > >
> > > >
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> > > > > = text/html
> > > > >
> > > >
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > > > >
> > > > > = true
> > > > >
> > > > > Thanks, MikeB
> > > > >
> > > > > Mike Ballard
> > > > > Director of Internet Development and
> > Networking
> > > > > O'Reilly Auto Parts
> > > > > (417) 874-7107 Ofc
> > > > > (417) 838-0271 Cell
> > > > >
> > > > > This message is protected by the
> Electronic
> > > > Communications
> > > > > Privacy Act, 18
> > > > > USCS § 2510 et seq., and may not be
> used,
> > copied
> > > or
> > > > > forwarded without the
> > > > > consent of the named recipient(s).
> > The
> > > information
> > > > > contained in this
> > > > > message is confidential, is intended
> only
> > for the
> > > use
> > > > of
> > > > > the individual or
> > > > > entity named. If the reader of this
> > message
> > > is not
> > > > > the intended
> > > > > recipient, you are hereby notified that
> any
> > > > dissemination,
> > > > > distribution or
> > > > > copying of this communication is
> strictly
> > > > prohibited.
> > > > > If you have
> > > > > received this communication in error,
> > please
> > > notify
> > > > me
> > > > > immediately at
> > > > > 417-874-7107.
> > > > >
> > > > >
> > > > >
> > > > > From:
> > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > To:
> > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > Date:
> > > > > 08/20/2010 12:55 PM
> > > > > Subject:
> > > > > Re: SSO IFrame form authentication
> > > > >
> > > > >
> > > > >
> > > > > Regarding the problem of javascript
> link
> > ending
> > > in .js
> > > > to
> > > > > .html, with
> > > > > which portlet do you meet the problem?
> > > > > j2-admin::SSOReverseProxyIFramePortlet,
>
> > > > >
> > >
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> > > > > j2-admin::SSOIFramePortlet,
> > > > j2-admin::SSOWebContentPortlet,
> > > > > or
> > > > > j2-admin::SSOProxyPortletPortlet?
> > > > >
> > > > > j2-admin::SSOReverseProxyIFramePortlet
> and
> > > > >
> > >
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet
> > > > only
> > > > > are using the
> > > > > reverse proxy service.
> > > > >
> > > > > If you are using those reverse proxy
> > portlets,
> > > then
> > > > how's
> > > > > the rewriter
> > > > > configurations for the reverse proxy
> pass
> > mapping
> > > in
> > > > >
> > /j2-admin/WEB-INF/conf/reverseproxy.properties?
> > > > > I'd like to recommend you to use the
> > default
> > > > configuration
> > > > > like the apache
> > > > > example:
> > > > >
> > > > > # ... Sets detail attributes for
> apache
> > path
> > > mapping
> > > > > proxy.reverse.pass.apache.local =
> /apache/
> > > > > proxy.reverse.pass.apache.remote = http://apache.org/
> > > > >
> proxy.reverse.pass.apache.rewriter.basic =
> > > > >
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > > >
> > proxy.reverse.pass.apache.rewriter.parserAdaptor
> > > =
> > > > html
> > > > >
> > >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html
> > > > =
> > > > >
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > > > >
> > > >
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> > > > > = text/html
> > > > >
> > > >
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > > > >
> > > > > = true
> > > > >
> > > > > With the default example above, the
> > rewriting
> > > xml
> > > > rule
> > > > > files such as
> > > > > default-rewriter-rules.xml and
> > > rewriter-rules-mapping
> > > > do
> > > > > not play any role
> > > > > with reverse proxying portlets.
> > > > >
> > > > > The last example in the configuration
> file
> > still
> > > uses
> > > > the
> > > > > Neko and Sax
> > > > > parser adaptor configuation, which was
> > provided
> > > for
> > > > the old
> > > > > web content
> > > > > portlets. However, it turns out to be
> less
> > useful
> > > in
> > > > this
> > > > > reverse proxy
> > > > > portlets. (The old rewriting xml rules
> were
> > > mainly
> > > > for
> > > > > rewriting urls to
> > > > > portlet urls, while reverse proxy
> service
> > is
> > > just
> > > > another
> > > > > servlet-based
> > > > > solution with integration to portlet,
> > meaning the
> > > url
> > > > > rewriting doesn't
> > > > > need to be that complex any more.)
> > > > >
> > > > > One more tip is that you could test
> the
> > reverse
> > > > proxying by
> > > > > navigating the
> > > > > proxied urls directly.
> > > > > So, for example, if http://www.yourdomain.com/orders/ is mapped to
> > > > > /j2-admin/rproxy/yourdomain/orders/,
> then
> > you
> > > can
> > > > browse
> > > > > directly to
> > > > > http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> > > > > You can see what
> > > > > happens for rewriting problems with
> this
> > direct
> > > > access.
> > > > >
> > > > > HTH,
> > > > >
> > > > > Woonsan
> > > > >
> > > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > > <mb...@oreillyauto.com>
> > > > >
> > > > > wrote:
> > > > >
> > > > > > From: mballard@oreillyauto.com
> > > > > <mb...@oreillyauto.com>
> > > > > > Subject: Re: SSO IFrame form
> > authentication
> > > > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > > > Date: Friday, August 20, 2010,
> 6:55 PM
> > > > > > Good to know. So I have rebuilt
> > > > > > my site on 2.2.1 and it seems to
> be
> > > > > > stable, unlike the previous
> > implementation
> > > on
> > > > Derby.
> > > > > > Not sure if that's
> > > > > > an indication of a problem with
> 2.2.1
> > &
> > > > Derby, or
> > > > > just
> > > > > > a local issue. My
> > > > > > remaining issue is the rewrite in
> the
> > > reverse
> > > > proxy
> > > > > portlet
> > > > > > is changing a
> > > > > > javascript link ending in .js to
> .html
> >
> > > Any
> > > > > ideas?
> > > > > >
> > > > > >
> > > > > >
> > > > > > From:
> > > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > > To:
> > > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > > Date:
> > > > > > 08/20/2010 11:50 AM
> > > > > > Subject:
> > > > > > Re: SSO IFrame form
> authentication
> > > > > >
> > > > > >
> > > > > >
> > > > > > I believe the pages can be simply
> > copied
> > > because
> > > > I
> > > > > cannot
> > > > > > find anything to
> > > > > > watch with psml pages either.
> > > > > > By the way, you can copy those
> pages
> > into
> > > any
> > > > other
> > > > > folder
> > > > > > by configuring
> > > > > > the path in
> > > > >
> /jetspeed/WEB-INF/conf/override.properties.
> > For
> > > > > > example,
> > > > > >
> > > > > > # default path to (XML) PSML
> pages
> > root
> > > folder
> > > > > > psml.pages.path =
> > > > > >
> > ${applicationRoot}/WEB-INF/migrated_pages
> > > > > >
> > > > > > Regards,
> > > > > >
> > > > > > Woonsan
> > > > > >
> > > > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > > > <mb...@oreillyauto.com>
> > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > From: mballard@oreillyauto.com
> > > > > > <mb...@oreillyauto.com>
> > > > > > > Subject: Re: SSO IFrame form
> > > authentication
> > > > > > > To: "Jetspeed Users List"
> <je...@portals.apache.org>
> > > > > > > Date: Friday, August 20,
> 2010,
> > 3:05 PM
> > > > > > > I have installed 2.2.1 with
> MySQL
> > and
> > > > > > > I now need to move my pages
> and
> > > > > > > layouts from the 2.2.0
> > installation.
> > > > Given
> > > > > that
> > > > > > my
> > > > > > > previous 2.2.1
> > > > > > > installation on Derby is
> defunct,
> > is
> > > there
> > > > > anything I
> > > > > > > should watch out for
> > > > > > > this time? Can I simply
> copy
> > the
> > > psml's
> > > > > from
> > > > > > the
> > > > > > > 2.2.0 directories to the
> > > > > > > 2.2.1
> > directories? I
> > > have not
> > > > > seen a
> > > > > > > migration guide to address
> this
> > > > > > > need.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > From:
> > > > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > > > To:
> > > > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > > > Date:
> > > > > > > 08/18/2010 12:35 PM
> > > > > > > Subject:
> > > > > > > Re: SSO IFrame form
> > authentication
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > Hi,
> > > > > > >
> > > > > > > I haven't heard of that
> > preferences
> > > data
> > > > problem
> > > > > yet
> > > > > > in
> > > > > > > 2.2.1.
> > > > > > > IMHO, It could help to
> localize
> > the
> > > problems
> > > > if
> > > > > you
> > > > > > test
> > > > > > > against other
> > > > > > > databases
> > > > > > > like PostgreSQL or MySQL.
> > > > > > > On the other hand, I think
> you
> > could
> > > deploy
> > > > > newer
> > > > > > > j2-admin.war and
> > > > > > > apa-webcontent.war which
> were
> > included
> > > in
> > > > 2.2.1.
> > > > > > >
> > > > > > > -Woonsan
> > > > > > >
> > > > > > >
> > > > > > > ----- Original Message ----
> > > > > > > > From: "mballard@oreillyauto.com"
> > > > > > > <mb...@oreillyauto.com>
> > > > > > > > To: Jetspeed Users List
> > <je...@portals.apache.org>
> > > > > > > > Sent: Wed, August 18,
> 2010
> > 6:10:25
> > > AM
> > > > > > > > Subject: Re: SSO IFrame
> form
> > > > authentication
> > > > > > > >
> > > > > > > > Well, here's the rub.
> > I
> > > believe the
> > > > > > > SSOReverseProxyIFramePortlet
> is
> > new
> > > > > > >
> > > > > > > > in 2.2.1, which is where
> I
> > was
> > > when I
> > > > first
> > > > > > posted,
> > > > > > > however, I found
> > > > > > > that
> > > > > > > > my configuration kept
> > getting
> > > > scrambled, so
> > > > > I
> > > > > > reverted
> > > > > > > to 2.2.0 I will
> > > > > > > > try your suggestion on
> 2.2.1,
> > but
> > > I
> > > > will
> > > > > have to
> > > > > > > address the scrambling
> > > > > > > > issue. What is
> > happening is
> > > > > this. I
> > > > > > have
> > > > > > > cloned the IFramePortlet
> > > > > > > > several times and
> configured
> > each
> > > for
> > > > > different
> > > > > > static
> > > > > > > content being
> > > > > > > > served from apache2.
> I
> > have
> > > avoided
> > > > > setting
> > > > > > any
> > > > > > > user preferences, and,
> > > > > > >
> > > > > > > > instead, set the
> preferences
> > for
> > > each
> > > > clone
> > > > > in
> > > > > > the
> > > > > > > PAM portlet.
> > > > > > > Everything
> > > > > > > > worked fine. Then
> after
> > a
> > > few hours,
> > > > > the
> > > > > > > IFramePortlet content was all
>
> > > > > > >
> > > > > > > > mixed up. For
> instance,
> > the
> > > portlet
> > > > on
> > > > >
> > > > > > > page 1 would be showing the
> > > > > > > > content I had configured
> for
> > the
> > > > portlet on
> > > > > page
> > > > > >
> > > > > > > 2 and so on. I went
> > > > > > > into
> > > > > > > > PAM and corrected the
> > preferences
> > > to
> > > > what
> > > > > > they
> > > > > > > should be and assumed I
> > > > > > > was
> > > > > > > > ok, but the next
> morning
> > things
> > > were
> > > > > > scrambled
> > > > > > > again. I did some
> > > > > > > queries
> > > > > > > > in the derby db and it
> > > appears they
> > > > > are
> > > > > > wrong
> > > > > > > there. I don't know if
> > > > > > > this
> > > > > > > > is a portlet id issue or
> an
> > > indexing
> > > > > > problem or
> > > > > > > what, but I need a
> > > > > > > > resolution before I can
> > proceed to
> > >
> > > > > 2.2.1
> > > > > > > Of course, I have the exact
> > > > > > > same
> > > > > > > > configuration in 2.2.0
> and
> > > am having
> > > > > no
> > > > > > problem
> > > > > > > there, but I also have
> > > > > > > no
> > > > > > > > SSOReverseProxyIFrame
> > there.
> > >
> > > > > Any
> > > > > > ideas?
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > From:
> > > > > > > > David Sean Taylor <d....@onehippo.com>
> > > > > > > > To:
> > > > > > > > Jetspeed Users List
> > <je...@portals.apache.org>
> > > > > > > > Date:
> > > > > > > > 08/17/2010 07:19 PM
> > > > > > > > Subject:
> > > > > > > > Re: SSO IFrame form
> > > authentication
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > On Tue, Aug 17, 2010
> at
> > 1:40
> > > PM,
> > > > > > <mb...@oreillyauto.com>
> > > > > >
> > > > > > > wrote:
> > > > > > > > > How did your
> testing
> > > go? I
> > > > > compared
> > > > > > SSO
> > > > > > > Webcontent (which works,
> > > > > > > sort
> > > > > > > > of)
> > > > > > > > > to SSO IFrame
> classes
> > and I
> > > see a
> > > > > method
> > > > > > > for preemptive login in
> the
> > > > > > > > > webcontent class
> but no
> > > reference
> > > > at
> > > > > all in
> > > > > > > the SSO IFrame class.
> > > > > > > Does
> > > > > > > > > this just mean it
> is
> > being
> > > done
> > > > > > > differently, or is something
> amiss
> > in
> > > > > > >
> > > > > > > > the
> > > > > > > > > SSO IFrame
> class?
> > > > > > > >
> > > > > > > > There are two SSOIFrame
> > classes:
> > > > > > > >
> > > > > > > > 1. SSOIFramePortlet
> > > > > > > > 2.
> > > SSOReverseProxyIFramePortlet
> > > > > > > >
> > > > > > > > Suggest using the second
> one,
> >
> > > > > > > SSOReverseProxyIFramePortlet
> as
> > it
> > > gives
> > > > > > > > you features not
> available in
> > the
> > >
> > > > > older
> > > > > > > SSOIFramePortlet such as
> > > > > > > > auto-resizing and
> form-based
> > > > authentication
> > > > >
> > > > > > > (what you are after)
> > > > > > > >
> > > > > > > > I tested with
> > > > SSOReverseProxyIFramePortlet
> > > > > and
> > > > > > > it worked in the
> > > > > > > > example that comes with
> > Jetspeed,
> > > but
> > > > it
> > > > > takes a
> > > > > > > little bit of
> > > > > > > > configuration.
> > > > > > > >
> > > > > > > > First, ensure your
> Tomcat
> > will
> > > need
> > > > this
> > > > > > > attribute set in the
> > > > > > > > <Connector>
> element of
> >
> > > > > server.xml:
> > > > > > > >
> > > > > > > > emptySessionPath="true"
> > > > > > > >
> > > > > > > > more detail here:
> > > > > > > >
> > > > > > > > http://portals.apache.org/applications/webcontent/index.html
> > > > > > > >
> > > > > > > > If you had to change
> > > server.xml
> > > > > setting,
> > > > > > then
> > > > > > > restart your server
> > > > > > > >
> > > > > > > > I took these steps to
> > verify
> > > SSO
> > > > with
> > > > > the
> > > > > > > example form-based login
> > > > > > > > that comes with
> > Jetspeed:
> > > > > > > >
> > > > > > > > 1. login as admin
> > > > > > > > 2. navigate to the
> Jetspeed
> > > > Administration
> > > > > > > space, SSO Management page,
> > > > > > > > or just go here:
> > > > > > > >
> > > > > > > >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > > > > > >
> > > > > > > > Add a new Site with
> > > following
> > > > > parameters:
> > > > > > > >
> > > > > > > > Site Name: Form Example
> > > > > > > > Site URL:
> > http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > > > > > Field name for User
> > ID:
> > > user
> > > > > > > > Field name For Password
> > value:
> > > pass
> > > > > > > >
> > > > > > > > Press Save
> > > > > > > >
> > > > > > > > Add a new credential
> > for
> > > this site
> > > > in
> > > > > the
> > > > > > > portlet on the right side
> > > > > > > > (SSO Details):
> > > > > > > >
> > > > > > > > Portal
> > > Principal: admin
> > > > > > > > Remote
> > > Principal: admin
> > > > > > > > Remote Credential:
> admin
> > > > > > > >
> > > > > > > > Press Add
> > > > > > > >
> > > > > > > > You can verify
> > that
> > > the remote
> > > > > > credential
> > > > > > > was added for the admin
> > > > > > > > user by going here:
> > > > > > > >
> > > > > > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > > > > > >
> > > > > > > > see the portlet on
> the
> > right
> > > "SSO
> > > > > Change
> > > > > > > Passwords", a remote site
> > > > > > > > entry should be there
> > named
> > > "Form
> > > > > Example"
> > > > > > > >
> > > > > > > > Next, you can use the
> Toolbox
> > to
> > > find
> > > > the
> > > > > > > Reverse Proxy Iframe Portlet
> > > > > > > > by searching on "iframe"
> and
> > then
> > > > selecting
> > > > > it
> > > > > > > from there and adding
> > > > > > > > to a page. To make
> things
> > simple,
> > > I
> > > > just
> > > > > added a
> > > > > > > page and then added
> > > > > > > > the Reverse Proxy
> Iframe
> > Portlet
> > > there.
> > > > At
> > > > > first
> > > > > > this
> > > > > > > portlet seems to
> > > > > > > > want to use Basic
> > Authentication,
> > > so
> > > > just
> > > > > hit
> > > > > > cancel
> > > > > > > when challenged.
> > > > > > > > I then switched to edit
> mode
> > > (pencil
> > > > icon),
> > > > > and
> > > > > > > entered the following
> > > > > > > > preferences:
> > > > > > > >
> > > > > > > > TITLE: My SSO Test
> > > > > > > > SRC: http://localhost:$
> > > > > >
> > > {serverPort}${contextPath}/examples/formauth.jsp
> > > > > > > >
> > > > > > > > Press Save
> > > > > > > >
> > > > > > > > You should see in your
> > portlet
> > > content
> > > > > something
> > > > > >
> > > > > > > like:
> > > > > > > >
> > > > > > > > "Hello, admin. You have
> been
> > > authorized
> > > > by
> > > > > > > form-based authentication
> > > > > > > !!!"
> > > > > > > >
> > > > > > > > Give that a try and see
> if
> > it
> > > works.
> > > > Then,
> > > > > move
> > > > > > on
> > > > > > > to your specific
> > > > > > > > IFrame source and let us
> know
> > how
> > > it
> > > > > > goes...
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > > > To unsubscribe,
> e-mail:
> >
> > > > > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > > > For additional
> > commands,
> > > e-mail:
> > > > > > jetspeed-user-help@portals.apache.org
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > This message has been
> > > scanned for
> > > > > viruses
> > > > > > and
> > > > > > > > dangerous content by
> > MailScanner,
> > >
> > > > and
> > > > > is
> > > > > > > > believed to be clean
> > > > > > > (mailgw2:E659D1E6FC.D1395).
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > This communication and
> any
> > > > attachments
> > > > > are
> > > > > > > confidential, protected by
> > > > > > > > Communications Privacy
> Act
> > > 18 USCS
> > > > §
> > > > > > 2510,
> > > > > > > solely for the use of the
> > > > > > > > intended recipient, and
> may
> > > contain
> > > > > > legally
> > > > > > > privileged material. If you
> > > > > > >
> > > > > > > > are not the intended
> > recipient,
> > > please
> > > >
> > > > > > return or
> > > > > > > destroy it
> > > > > > > immediately.
> > > > > > > > Thank you.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > > To unsubscribe, e-mail:
> > > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > > For additional commands,
> e-mail:
> > > jetspeed-user-help@portals.apache.org
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > This message has been scanned
> for
> > > viruses
> > > > and
> > > > > > > dangerous content by
> MailScanner,
> > and
> > > is
> > > > > > > believed to be clean
> > > > (mailgw2:9902C1E701.B0EA8).
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > This communication and any
> > attachments
> > > are
> > > > > > confidential,
> > > > > > > protected by
> > > > > > > Communications Privacy Act 18
> USCS
> > §
> > > 2510,
> > > > > solely for
> > > > > > the
> > > > > > > use of the
> > > > > > > intended recipient, and may
> > contain
> > > legally
> > > > > > privileged
> > > > > > > material. If you
> > > > > > > are not the intended
> recipient,
> > please
> > > > return or
> > > > > > destroy it
> > > > > > > immediately.
> > > > > > > Thank you.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > To unsubscribe, e-mail:
> > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > For additional commands, e-mail:
> > > jetspeed-user-help@portals.apache.org
> > > > > >
> > > > > >
> > > > > > --
> > > > > > This message has been scanned for
> > viruses
> > > and
> > > > > > dangerous content by MailScanner,
> and
> > is
> > > > > > believed to be clean
> > > > (mailgw2:8B04D2A000C.7088C).
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > This communication and any
> attachments
> > are
> > > > > confidential,
> > > > > > protected by
> > > > > > Communications Privacy Act 18 USCS
> §
> > 2510,
> > > > solely for
> > > > > the
> > > > > > use of the
> > > > > > intended recipient, and may
> contain
> > legally
> > > > > privileged
> > > > > > material. If you
> > > > > > are not the intended recipient,
> please
> > > return or
> > > > > destroy it
> > > > > > immediately.
> > > > > > Thank you.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> > jetspeed-user-help@portals.apache.org
> > > > >
> > > > >
> > > > > --
> > > > > This message has been scanned for
> viruses
> > and
> > > > > dangerous content by MailScanner, and
> is
> > > > > believed to be clean
> > (mailgw2:792FC1E702.4691D).
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > This communication and any attachments
> are
> > > > confidential,
> > > > > protected by
> > > > > Communications Privacy Act 18 USCS §
> 2510,
> > > solely for
> > > > the
> > > > > use of the
> > > > > intended recipient, and may contain
> legally
> > > > privileged
> > > > > material. If you
> > > > > are not the intended recipient, please
> > return or
> > > > destroy it
> > > > > immediately.
> > > > > Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> (mailgw2:EE2E12A000A.92659).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:2DDC92A000B.D7312).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Hi,
I think the documentation [1] is misleading for the Form-authentication support, which is supported only with SSOWebContentPortlet.
However, I think you can use IFrameGenericPortlet to allow that form authentication, simply by configuring your new view page in preferrences. For example, you can read the preferences and build a simple hidden form with the sso credentials info to post to the target site.
If you want to retrieve the sso credentials info for the SSO site from your portlet or your view JSP page, you will probably need to access the Jetspeed SSO Manager, listed here as Jetspeed Service component. [2]
PortletContext context = getPortletContext();
SSOManager sso = (SSOManager) context.getAttribute("cps:SSO");
You could refer to SSOProxyPortlet.java on how to use the component. [3]
[1] http://portals.apache.org/jetspeed-2/deployguide/config-sso.html
[2] http://portals.apache.org/jetspeed-2/deployguide/guide-services.html
[3] https://svn.apache.org/repos/asf/portals/jetspeed-2/applications/j2-admin/trunk/src/main/java/org/apache/jetspeed/portlets/sso/SSOProxyPortlet.java
HTH,
Woonsan
--- On Mon, 8/23/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Monday, August 23, 2010, 7:45 PM
> The only portlet producing acceptable
> rendering results is the SSO IFrame
> Portlet, which claims to use SSO, but appears to not work
> according to the
> documentation. The SSO section of the deployment
> guide clearly spells out
> how to use sso.type, sso.form.principal,
> sso.form.credential, sso.Action,
> sso.form.Args, etc to do what we need but it does not work
> in the simplest
> of examples of form based preemptive authentication.
> I am at a loss as to
> where to go next.
>
> Thanks, MikeB
>
> Mike Ballard
> Director of Internet Development and Networking
> O'Reilly Auto Parts
> (417) 874-7107 Ofc
> (417) 838-0271 Cell
>
> This message is protected by the Electronic Communications
> Privacy Act, 18
> USCS § 2510 et seq., and may not be used, copied or
> forwarded without the
> consent of the named recipient(s). The information
> contained in this
> message is confidential, is intended only for the use of
> the individual or
> entity named. If the reader of this message is not
> the intended
> recipient, you are hereby notified that any dissemination,
> distribution or
> copying of this communication is strictly prohibited.
> If you have
> received this communication in error, please notify me
> immediately at
> 417-874-7107.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 06:54 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> How about prepending a double quote or single quote,
> depending your target
> website, in the regex expression?
> For example,
> \"\\/otrs\\/customer\\.pl\\?CSID
> will exclude "/j2-admin/rproxy/otrs/...".
>
> Also, you can configure multiple custom replacements in the
> configuration.
> (Multiple keys are defined with the same keys.
> For example,
>
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
>
> = \"\\/otrs\\/customer\\.pl
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
>
> = \"/j2-admin/rproxy/otrs/otrs/customer.pl
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
>
> = \"\\/otrs-web\\/customer\\.pl
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
>
> = \"/j2-admin/rproxy/otrs/otrs-web/customer.pl
> ...
>
> -Woonsan
>
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 10:52 PM
> > Thank you, I had figured that
> > out. Problem is that this rule replaces
> > everything with /otrs/customer.pl even when it already
> has
> >
> > /j2-admin/rproxy/otrs prepended. Since the
> offending
> > string is
> >
> http://hostname.domain-name.com:8080/otrs/customer.pl?CSID=10822f631e5c8aaaa5b4236cd2547c5d82
>
> >
> > I attempted to construct a new rule with pattern
>
> > \\/otrs\\/customer\\.pl\\?CSID and replacement
> > /j2-admin/rproxy/otrs/otrs/customer.pl?CSID
> >
> > However, it never seems to catch the pattern. I
> tried
> > it with escaping
> > the ? and not escaping the ? as I wasn't sure which
> it
> > should be.
> >
> > I also have a similiar issue with /otrs-web.....
> > coming from javascript,
> > I assume. Problem is that some of these patterns
> are
> > prepended with the
> > proxy and some are not. How to catch the ones
> which
> > need rewrite as
> > opposed to the ones which do not.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/20/2010 03:35 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > If the pass configuration is for 'otrs' in your
> example,
> > "proxy.reverse.pass = otrs", then the configuration
> keys
> > should look like
> > these:
> >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
> >
> > = \\/otrs\\/customer\\.pl
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
> >
> > = /j2-admin/rproxy/otrs/otrs/customer.pl
> >
> > --- On Fri, 8/20/10, Woonsan Ko <wo...@yahoo.com>
> > wrote:
> >
> > > From: Woonsan Ko <wo...@yahoo.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 9:13 PM
> > > I guess the first page which tried to
> > > redirect to the second page with wrong url by
> using
> > > javascript.
> > > If it redirects to other page from the
> server-side
> > with
> > > http status code and header, then the reverse
> proxy
> > service
> > > can detect and rewrite to a proxied url from the
> > reverse
> > > proxy configurations if found.
> > >
> > > Anyway, if the first page has javascript to
> redirect,
> > e.g.,
> > > 'location.href =
> > >
> >
> /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a',
> > > that script line is not rewritten by default.
> > > (By the way, you can refer to the default
> rewriting
> > class
> > > here if you're interested in:
> >
> http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java
>
> > )
> > >
> > > If the redirecting script line is simple, then
> you can
> > add
> > > a custom replace pattern in the reverse proxy
> > configuration
> > > like the following example:
> > >
> > >
> >
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns
> > > = \\/otrs\\/customer\\.pl
> > >
> >
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces
> > > = /j2-admin/rproxy/otrs/otrs/customer.pl
> > >
> > > The above additional custom replace
> configuration
> > will
> > > replace every line having that regex pattern.
> > >
> > > -Woonsan
> > >
> > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > > wrote:
> > >
> > > > From: mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Friday, August 20, 2010, 8:19 PM
> > > > I am using
> > > >
> j2-admin::SSOReverseProxyIFramePortlet. I
> > also
> > > believe
> > > > I am
> > > > using the exact reverse properties as the
> apache
> > > > example. I have
> > > > discovered one issue when accessing directly
> in
> > that
> > > it
> > > > appears when I
> > > > enter
> > > >
> http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl
> > ,
> > > >
> > > > and login manually, I am redirected to
> > > >
> >
> http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
>
> >
> > > >
> > > > and I get an HTTP 404 error. If I
> then
> > correct the
> > > > url and put the
> > > > j2-admin/rproxy/otrs back in, I get the
> correct
> > page
> > > > rendered and I am
> > > > logged in. In any case, once I get
> logged
> > in and
> > > try
> > > > to drill down to an
> > > > incident link, I get an error trying to load
> the
> > > javascript
> > > > because
> > > > something has changed the .js in the link
> to
> > .html
> > > > Again, I am using the
> > > > apache example config for rewriting.
> > > >
> > > > # ... Set max matching path part count
> > > > proxy.reverse.pass.maxMatchingPathPartCount
> = 2
> > > >
> > > > # ... Sets detail attributes for apache
> path
> > mapping
> > > > proxy.reverse.pass = otrs
> > > > proxy.reverse.pass.otrs.local = /otrs/
> > > > proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> > > > proxy.reverse.pass.otrs.rewriter.basic =
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor =
> > html
> > > >
> > proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
> > >
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > > >
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> > > > = text/html
> > > >
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > > >
> > > > = true
> > > >
> > > > Thanks, MikeB
> > > >
> > > > Mike Ballard
> > > > Director of Internet Development and
> Networking
> > > > O'Reilly Auto Parts
> > > > (417) 874-7107 Ofc
> > > > (417) 838-0271 Cell
> > > >
> > > > This message is protected by the Electronic
> > > Communications
> > > > Privacy Act, 18
> > > > USCS § 2510 et seq., and may not be used,
> copied
> > or
> > > > forwarded without the
> > > > consent of the named recipient(s).
> The
> > information
> > > > contained in this
> > > > message is confidential, is intended only
> for the
> > use
> > > of
> > > > the individual or
> > > > entity named. If the reader of this
> message
> > is not
> > > > the intended
> > > > recipient, you are hereby notified that any
> > > dissemination,
> > > > distribution or
> > > > copying of this communication is strictly
> > > prohibited.
> > > > If you have
> > > > received this communication in error,
> please
> > notify
> > > me
> > > > immediately at
> > > > 417-874-7107.
> > > >
> > > >
> > > >
> > > > From:
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/20/2010 12:55 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > Regarding the problem of javascript link
> ending
> > in .js
> > > to
> > > > .html, with
> > > > which portlet do you meet the problem?
> > > > j2-admin::SSOReverseProxyIFramePortlet,
> > > >
> > j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> > > > j2-admin::SSOIFramePortlet,
> > > j2-admin::SSOWebContentPortlet,
> > > > or
> > > > j2-admin::SSOProxyPortletPortlet?
> > > >
> > > > j2-admin::SSOReverseProxyIFramePortlet and
> > > >
> > j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet
> > > only
> > > > are using the
> > > > reverse proxy service.
> > > >
> > > > If you are using those reverse proxy
> portlets,
> > then
> > > how's
> > > > the rewriter
> > > > configurations for the reverse proxy pass
> mapping
> > in
> > > >
> /j2-admin/WEB-INF/conf/reverseproxy.properties?
> > > > I'd like to recommend you to use the
> default
> > > configuration
> > > > like the apache
> > > > example:
> > > >
> > > > # ... Sets detail attributes for apache
> path
> > mapping
> > > > proxy.reverse.pass.apache.local = /apache/
> > > > proxy.reverse.pass.apache.remote = http://apache.org/
> > > > proxy.reverse.pass.apache.rewriter.basic =
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > >
> proxy.reverse.pass.apache.rewriter.parserAdaptor
> > =
> > > html
> > > >
> > proxy.reverse.pass.apache.rewriter.parserAdaptor.html
> > > =
> > > >
> > >
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > > >
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> > > > = text/html
> > > >
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > > >
> > > > = true
> > > >
> > > > With the default example above, the
> rewriting
> > xml
> > > rule
> > > > files such as
> > > > default-rewriter-rules.xml and
> > rewriter-rules-mapping
> > > do
> > > > not play any role
> > > > with reverse proxying portlets.
> > > >
> > > > The last example in the configuration file
> still
> > uses
> > > the
> > > > Neko and Sax
> > > > parser adaptor configuation, which was
> provided
> > for
> > > the old
> > > > web content
> > > > portlets. However, it turns out to be less
> useful
> > in
> > > this
> > > > reverse proxy
> > > > portlets. (The old rewriting xml rules were
> > mainly
> > > for
> > > > rewriting urls to
> > > > portlet urls, while reverse proxy service
> is
> > just
> > > another
> > > > servlet-based
> > > > solution with integration to portlet,
> meaning the
> > url
> > > > rewriting doesn't
> > > > need to be that complex any more.)
> > > >
> > > > One more tip is that you could test the
> reverse
> > > proxying by
> > > > navigating the
> > > > proxied urls directly.
> > > > So, for example, if http://www.yourdomain.com/orders/ is mapped to
> > > > /j2-admin/rproxy/yourdomain/orders/, then
> you
> > can
> > > browse
> > > > directly to
> > > > http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> > > > You can see what
> > > > happens for rewriting problems with this
> direct
> > > access.
> > > >
> > > > HTH,
> > > >
> > > > Woonsan
> > > >
> > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > >
> > > > wrote:
> > > >
> > > > > From: mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > > > Subject: Re: SSO IFrame form
> authentication
> > > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > > Date: Friday, August 20, 2010, 6:55 PM
> > > > > Good to know. So I have rebuilt
> > > > > my site on 2.2.1 and it seems to be
> > > > > stable, unlike the previous
> implementation
> > on
> > > Derby.
> > > > > Not sure if that's
> > > > > an indication of a problem with 2.2.1
> &
> > > Derby, or
> > > > just
> > > > > a local issue. My
> > > > > remaining issue is the rewrite in the
> > reverse
> > > proxy
> > > > portlet
> > > > > is changing a
> > > > > javascript link ending in .js to .html
>
> > Any
> > > > ideas?
> > > > >
> > > > >
> > > > >
> > > > > From:
> > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > To:
> > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > Date:
> > > > > 08/20/2010 11:50 AM
> > > > > Subject:
> > > > > Re: SSO IFrame form authentication
> > > > >
> > > > >
> > > > >
> > > > > I believe the pages can be simply
> copied
> > because
> > > I
> > > > cannot
> > > > > find anything to
> > > > > watch with psml pages either.
> > > > > By the way, you can copy those pages
> into
> > any
> > > other
> > > > folder
> > > > > by configuring
> > > > > the path in
> > > > /jetspeed/WEB-INF/conf/override.properties.
> For
> > > > > example,
> > > > >
> > > > > # default path to (XML) PSML pages
> root
> > folder
> > > > > psml.pages.path =
> > > > >
> ${applicationRoot}/WEB-INF/migrated_pages
> > > > >
> > > > > Regards,
> > > > >
> > > > > Woonsan
> > > > >
> > > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > > <mb...@oreillyauto.com>
> > > > >
> > > > > wrote:
> > > > >
> > > > > > From: mballard@oreillyauto.com
> > > > > <mb...@oreillyauto.com>
> > > > > > Subject: Re: SSO IFrame form
> > authentication
> > > > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > > > Date: Friday, August 20, 2010,
> 3:05 PM
> > > > > > I have installed 2.2.1 with MySQL
> and
> > > > > > I now need to move my pages and
> > > > > > layouts from the 2.2.0
> installation.
> > > Given
> > > > that
> > > > > my
> > > > > > previous 2.2.1
> > > > > > installation on Derby is defunct,
> is
> > there
> > > > anything I
> > > > > > should watch out for
> > > > > > this time? Can I simply copy
> the
> > psml's
> > > > from
> > > > > the
> > > > > > 2.2.0 directories to the
> > > > > > 2.2.1
> directories? I
> > have not
> > > > seen a
> > > > > > migration guide to address this
> > > > > > need.
> > > > > >
> > > > > >
> > > > > >
> > > > > > From:
> > > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > > To:
> > > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > > Date:
> > > > > > 08/18/2010 12:35 PM
> > > > > > Subject:
> > > > > > Re: SSO IFrame form
> authentication
> > > > > >
> > > > > >
> > > > > >
> > > > > > Hi,
> > > > > >
> > > > > > I haven't heard of that
> preferences
> > data
> > > problem
> > > > yet
> > > > > in
> > > > > > 2.2.1.
> > > > > > IMHO, It could help to localize
> the
> > problems
> > > if
> > > > you
> > > > > test
> > > > > > against other
> > > > > > databases
> > > > > > like PostgreSQL or MySQL.
> > > > > > On the other hand, I think you
> could
> > deploy
> > > > newer
> > > > > > j2-admin.war and
> > > > > > apa-webcontent.war which were
> included
> > in
> > > 2.2.1.
> > > > > >
> > > > > > -Woonsan
> > > > > >
> > > > > >
> > > > > > ----- Original Message ----
> > > > > > > From: "mballard@oreillyauto.com"
> > > > > > <mb...@oreillyauto.com>
> > > > > > > To: Jetspeed Users List
> <je...@portals.apache.org>
> > > > > > > Sent: Wed, August 18, 2010
> 6:10:25
> > AM
> > > > > > > Subject: Re: SSO IFrame form
> > > authentication
> > > > > > >
> > > > > > > Well, here's the rub.
> I
> > believe the
> > > > > > SSOReverseProxyIFramePortlet is
> new
> > > > > >
> > > > > > > in 2.2.1, which is where I
> was
> > when I
> > > first
> > > > > posted,
> > > > > > however, I found
> > > > > > that
> > > > > > > my configuration kept
> getting
> > > scrambled, so
> > > > I
> > > > > reverted
> > > > > > to 2.2.0 I will
> > > > > > > try your suggestion on 2.2.1,
> but
> > I
> > > will
> > > > have to
> > > > > > address the scrambling
> > > > > > > issue. What is
> happening is
> > > > this. I
> > > > > have
> > > > > > cloned the IFramePortlet
> > > > > > > several times and configured
> each
> > for
> > > > different
> > > > > static
> > > > > > content being
> > > > > > > served from apache2. I
> have
> > avoided
> > > > setting
> > > > > any
> > > > > > user preferences, and,
> > > > > >
> > > > > > > instead, set the preferences
> for
> > each
> > > clone
> > > > in
> > > > > the
> > > > > > PAM portlet.
> > > > > > Everything
> > > > > > > worked fine. Then after
> a
> > few hours,
> > > > the
> > > > > > IFramePortlet content was all
> > > > > >
> > > > > > > mixed up. For instance,
> the
> > portlet
> > > on
> > > >
> > > > > > page 1 would be showing the
> > > > > > > content I had configured for
> the
> > > portlet on
> > > > page
> > > > >
> > > > > > 2 and so on. I went
> > > > > > into
> > > > > > > PAM and corrected the
> preferences
> > to
> > > what
> > > > > they
> > > > > > should be and assumed I
> > > > > > was
> > > > > > > ok, but the next morning
> things
> > were
> > > > > scrambled
> > > > > > again. I did some
> > > > > > queries
> > > > > > > in the derby db and it
> > appears they
> > > > are
> > > > > wrong
> > > > > > there. I don't know if
> > > > > > this
> > > > > > > is a portlet id issue or an
> > indexing
> > > > > problem or
> > > > > > what, but I need a
> > > > > > > resolution before I can
> proceed to
> >
> > > > 2.2.1
> > > > > > Of course, I have the exact
> > > > > > same
> > > > > > > configuration in 2.2.0 and
> > am having
> > > > no
> > > > > problem
> > > > > > there, but I also have
> > > > > > no
> > > > > > > SSOReverseProxyIFrame
> there.
> >
> > > > Any
> > > > > ideas?
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > From:
> > > > > > > David Sean Taylor <d....@onehippo.com>
> > > > > > > To:
> > > > > > > Jetspeed Users List
> <je...@portals.apache.org>
> > > > > > > Date:
> > > > > > > 08/17/2010 07:19 PM
> > > > > > > Subject:
> > > > > > > Re: SSO IFrame form
> > authentication
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > On Tue, Aug 17, 2010 at
> 1:40
> > PM,
> > > > > <mb...@oreillyauto.com>
> > > > >
> > > > > > wrote:
> > > > > > > > How did your testing
> > go? I
> > > > compared
> > > > > SSO
> > > > > > Webcontent (which works,
> > > > > > sort
> > > > > > > of)
> > > > > > > > to SSO IFrame classes
> and I
> > see a
> > > > method
> > > > > > for preemptive login in the
> > > > > > > > webcontent class but no
> > reference
> > > at
> > > > all in
> > > > > > the SSO IFrame class.
> > > > > > Does
> > > > > > > > this just mean it is
> being
> > done
> > > > > > differently, or is something amiss
> in
> > > > > >
> > > > > > > the
> > > > > > > > SSO IFrame class?
> > > > > > >
> > > > > > > There are two SSOIFrame
> classes:
> > > > > > >
> > > > > > > 1. SSOIFramePortlet
> > > > > > > 2.
> > SSOReverseProxyIFramePortlet
> > > > > > >
> > > > > > > Suggest using the second one,
>
> > > > > > SSOReverseProxyIFramePortlet as
> it
> > gives
> > > > > > > you features not available in
> the
> >
> > > > older
> > > > > > SSOIFramePortlet such as
> > > > > > > auto-resizing and form-based
> > > authentication
> > > >
> > > > > > (what you are after)
> > > > > > >
> > > > > > > I tested with
> > > SSOReverseProxyIFramePortlet
> > > > and
> > > > > > it worked in the
> > > > > > > example that comes with
> Jetspeed,
> > but
> > > it
> > > > takes a
> > > > > > little bit of
> > > > > > > configuration.
> > > > > > >
> > > > > > > First, ensure your Tomcat
> will
> > need
> > > this
> > > > > > attribute set in the
> > > > > > > <Connector> element of
>
> > > > server.xml:
> > > > > > >
> > > > > > > emptySessionPath="true"
> > > > > > >
> > > > > > > more detail here:
> > > > > > >
> > > > > > > http://portals.apache.org/applications/webcontent/index.html
> > > > > > >
> > > > > > > If you had to change
> > server.xml
> > > > setting,
> > > > > then
> > > > > > restart your server
> > > > > > >
> > > > > > > I took these steps to
> verify
> > SSO
> > > with
> > > > the
> > > > > > example form-based login
> > > > > > > that comes with
> Jetspeed:
> > > > > > >
> > > > > > > 1. login as admin
> > > > > > > 2. navigate to the Jetspeed
> > > Administration
> > > > > > space, SSO Management page,
> > > > > > > or just go here:
> > > > > > >
> > > > > > >
> http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > > > > >
> > > > > > > Add a new Site with
> > following
> > > > parameters:
> > > > > > >
> > > > > > > Site Name: Form Example
> > > > > > > Site URL:
> http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > > > > Field name for User
> ID:
> > user
> > > > > > > Field name For Password
> value:
> > pass
> > > > > > >
> > > > > > > Press Save
> > > > > > >
> > > > > > > Add a new credential
> for
> > this site
> > > in
> > > > the
> > > > > > portlet on the right side
> > > > > > > (SSO Details):
> > > > > > >
> > > > > > > Portal
> > Principal: admin
> > > > > > > Remote
> > Principal: admin
> > > > > > > Remote Credential: admin
> > > > > > >
> > > > > > > Press Add
> > > > > > >
> > > > > > > You can verify
> that
> > the remote
> > > > > credential
> > > > > > was added for the admin
> > > > > > > user by going here:
> > > > > > >
> > > > > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > > > > >
> > > > > > > see the portlet on the
> right
> > "SSO
> > > > Change
> > > > > > Passwords", a remote site
> > > > > > > entry should be there
> named
> > "Form
> > > > Example"
> > > > > > >
> > > > > > > Next, you can use the Toolbox
> to
> > find
> > > the
> > > > > > Reverse Proxy Iframe Portlet
> > > > > > > by searching on "iframe" and
> then
> > > selecting
> > > > it
> > > > > > from there and adding
> > > > > > > to a page. To make things
> simple,
> > I
> > > just
> > > > added a
> > > > > > page and then added
> > > > > > > the Reverse Proxy Iframe
> Portlet
> > there.
> > > At
> > > > first
> > > > > this
> > > > > > portlet seems to
> > > > > > > want to use Basic
> Authentication,
> > so
> > > just
> > > > hit
> > > > > cancel
> > > > > > when challenged.
> > > > > > > I then switched to edit mode
> > (pencil
> > > icon),
> > > > and
> > > > > > entered the following
> > > > > > > preferences:
> > > > > > >
> > > > > > > TITLE: My SSO Test
> > > > > > > SRC: http://localhost:$
> > > > >
> > {serverPort}${contextPath}/examples/formauth.jsp
> > > > > > >
> > > > > > > Press Save
> > > > > > >
> > > > > > > You should see in your
> portlet
> > content
> > > > something
> > > > >
> > > > > > like:
> > > > > > >
> > > > > > > "Hello, admin. You have been
> > authorized
> > > by
> > > > > > form-based authentication
> > > > > > !!!"
> > > > > > >
> > > > > > > Give that a try and see if
> it
> > works.
> > > Then,
> > > > move
> > > > > on
> > > > > > to your specific
> > > > > > > IFrame source and let us know
> how
> > it
> > > > > goes...
> > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > > To unsubscribe, e-mail:
>
> > > > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > > For additional
> commands,
> > e-mail:
> > > > > jetspeed-user-help@portals.apache.org
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > This message has been
> > scanned for
> > > > viruses
> > > > > and
> > > > > > > dangerous content by
> MailScanner,
> >
> > > and
> > > > is
> > > > > > > believed to be clean
> > > > > > (mailgw2:E659D1E6FC.D1395).
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > This communication and any
> > > attachments
> > > > are
> > > > > > confidential, protected by
> > > > > > > Communications Privacy Act
> > 18 USCS
> > > §
> > > > > 2510,
> > > > > > solely for the use of the
> > > > > > > intended recipient, and may
> > contain
> > > > > legally
> > > > > > privileged material. If you
> > > > > >
> > > > > > > are not the intended
> recipient,
> > please
> > >
> > > > > return or
> > > > > > destroy it
> > > > > > immediately.
> > > > > > > Thank you.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > To unsubscribe, e-mail:
> > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > For additional commands, e-mail:
> > jetspeed-user-help@portals.apache.org
> > > > > >
> > > > > >
> > > > > > --
> > > > > > This message has been scanned for
> > viruses
> > > and
> > > > > > dangerous content by MailScanner,
> and
> > is
> > > > > > believed to be clean
> > > (mailgw2:9902C1E701.B0EA8).
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > This communication and any
> attachments
> > are
> > > > > confidential,
> > > > > > protected by
> > > > > > Communications Privacy Act 18 USCS
> §
> > 2510,
> > > > solely for
> > > > > the
> > > > > > use of the
> > > > > > intended recipient, and may
> contain
> > legally
> > > > > privileged
> > > > > > material. If you
> > > > > > are not the intended recipient,
> please
> > > return or
> > > > > destroy it
> > > > > > immediately.
> > > > > > Thank you.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> > jetspeed-user-help@portals.apache.org
> > > > >
> > > > >
> > > > > --
> > > > > This message has been scanned for
> viruses
> > and
> > > > > dangerous content by MailScanner, and
> is
> > > > > believed to be clean
> > > (mailgw2:8B04D2A000C.7088C).
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > This communication and any attachments
> are
> > > > confidential,
> > > > > protected by
> > > > > Communications Privacy Act 18 USCS §
> 2510,
> > > solely for
> > > > the
> > > > > use of the
> > > > > intended recipient, and may contain
> legally
> > > > privileged
> > > > > material. If you
> > > > > are not the intended recipient, please
> > return or
> > > > destroy it
> > > > > immediately.
> > > > > Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for viruses
> and
> > > > dangerous content by MailScanner, and is
> > > > believed to be clean
> (mailgw2:792FC1E702.4691D).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments are
> > > confidential,
> > > > protected by
> > > > Communications Privacy Act 18 USCS § 2510,
> > solely for
> > > the
> > > > use of the
> > > > intended recipient, and may contain legally
> > > privileged
> > > > material. If you
> > > > are not the intended recipient, please
> return or
> > > destroy it
> > > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:EE2E12A000A.92659).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:2DDC92A000B.D7312).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
The only portlet producing acceptable rendering results is the SSO IFrame
Portlet, which claims to use SSO, but appears to not work according to the
documentation. The SSO section of the deployment guide clearly spells out
how to use sso.type, sso.form.principal, sso.form.credential, sso.Action,
sso.form.Args, etc to do what we need but it does not work in the simplest
of examples of form based preemptive authentication. I am at a loss as to
where to go next.
Thanks, MikeB
Mike Ballard
Director of Internet Development and Networking
O'Reilly Auto Parts
(417) 874-7107 Ofc
(417) 838-0271 Cell
This message is protected by the Electronic Communications Privacy Act, 18
USCS § 2510 et seq., and may not be used, copied or forwarded without the
consent of the named recipient(s). The information contained in this
message is confidential, is intended only for the use of the individual or
entity named. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution or
copying of this communication is strictly prohibited. If you have
received this communication in error, please notify me immediately at
417-874-7107.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/20/2010 06:54 PM
Subject:
Re: SSO IFrame form authentication
How about prepending a double quote or single quote, depending your target
website, in the regex expression?
For example,
\"\\/otrs\\/customer\\.pl\\?CSID
will exclude "/j2-admin/rproxy/otrs/...".
Also, you can configure multiple custom replacements in the configuration.
(Multiple keys are defined with the same keys.
For example,
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
= \"\\/otrs\\/customer\\.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
= \"/j2-admin/rproxy/otrs/otrs/customer.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
= \"\\/otrs-web\\/customer\\.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
= \"/j2-admin/rproxy/otrs/otrs-web/customer.pl
...
-Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 10:52 PM
> Thank you, I had figured that
> out. Problem is that this rule replaces
> everything with /otrs/customer.pl even when it already has
>
> /j2-admin/rproxy/otrs prepended. Since the offending
> string is
>
http://hostname.domain-name.com:8080/otrs/customer.pl?CSID=10822f631e5c8aaaa5b4236cd2547c5d82
>
> I attempted to construct a new rule with pattern
> \\/otrs\\/customer\\.pl\\?CSID and replacement
> /j2-admin/rproxy/otrs/otrs/customer.pl?CSID
>
> However, it never seems to catch the pattern. I tried
> it with escaping
> the ? and not escaping the ? as I wasn't sure which it
> should be.
>
> I also have a similiar issue with /otrs-web.....
> coming from javascript,
> I assume. Problem is that some of these patterns are
> prepended with the
> proxy and some are not. How to catch the ones which
> need rewrite as
> opposed to the ones which do not.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 03:35 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> If the pass configuration is for 'otrs' in your example,
> "proxy.reverse.pass = otrs", then the configuration keys
> should look like
> these:
>
>
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
>
> = \\/otrs\\/customer\\.pl
>
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
>
> = /j2-admin/rproxy/otrs/otrs/customer.pl
>
> --- On Fri, 8/20/10, Woonsan Ko <wo...@yahoo.com>
> wrote:
>
> > From: Woonsan Ko <wo...@yahoo.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 9:13 PM
> > I guess the first page which tried to
> > redirect to the second page with wrong url by using
> > javascript.
> > If it redirects to other page from the server-side
> with
> > http status code and header, then the reverse proxy
> service
> > can detect and rewrite to a proxied url from the
> reverse
> > proxy configurations if found.
> >
> > Anyway, if the first page has javascript to redirect,
> e.g.,
> > 'location.href =
> >
> /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a',
> > that script line is not rewritten by default.
> > (By the way, you can refer to the default rewriting
> class
> > here if you're interested in:
>
http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java
> )
> >
> > If the redirecting script line is simple, then you can
> add
> > a custom replace pattern in the reverse proxy
> configuration
> > like the following example:
> >
> >
>
proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns
> > = \\/otrs\\/customer\\.pl
> >
>
proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces
> > = /j2-admin/rproxy/otrs/otrs/customer.pl
> >
> > The above additional custom replace configuration
> will
> > replace every line having that regex pattern.
> >
> > -Woonsan
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 8:19 PM
> > > I am using
> > > j2-admin::SSOReverseProxyIFramePortlet. I
> also
> > believe
> > > I am
> > > using the exact reverse properties as the apache
> > > example. I have
> > > discovered one issue when accessing directly in
> that
> > it
> > > appears when I
> > > enter
> > >
http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl
> ,
> > >
> > > and login manually, I am redirected to
> > >
>
http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
>
> > >
> > > and I get an HTTP 404 error. If I then
> correct the
> > > url and put the
> > > j2-admin/rproxy/otrs back in, I get the correct
> page
> > > rendered and I am
> > > logged in. In any case, once I get logged
> in and
> > try
> > > to drill down to an
> > > incident link, I get an error trying to load the
> > javascript
> > > because
> > > something has changed the .js in the link to
> .html
> > > Again, I am using the
> > > apache example config for rewriting.
> > >
> > > # ... Set max matching path part count
> > > proxy.reverse.pass.maxMatchingPathPartCount = 2
> > >
> > > # ... Sets detail attributes for apache path
> mapping
> > > proxy.reverse.pass = otrs
> > > proxy.reverse.pass.otrs.local = /otrs/
> > > proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> > > proxy.reverse.pass.otrs.rewriter.basic =
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > proxy.reverse.pass.otrs.rewriter.parserAdaptor =
> html
> > >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
> >
> > >
> >
>
org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> > > = text/html
> > >
> >
>
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > >
> > > = true
> > >
> > > Thanks, MikeB
> > >
> > > Mike Ballard
> > > Director of Internet Development and Networking
> > > O'Reilly Auto Parts
> > > (417) 874-7107 Ofc
> > > (417) 838-0271 Cell
> > >
> > > This message is protected by the Electronic
> > Communications
> > > Privacy Act, 18
> > > USCS § 2510 et seq., and may not be used, copied
> or
> > > forwarded without the
> > > consent of the named recipient(s). The
> information
> > > contained in this
> > > message is confidential, is intended only for the
> use
> > of
> > > the individual or
> > > entity named. If the reader of this message
> is not
> > > the intended
> > > recipient, you are hereby notified that any
> > dissemination,
> > > distribution or
> > > copying of this communication is strictly
> > prohibited.
> > > If you have
> > > received this communication in error, please
> notify
> > me
> > > immediately at
> > > 417-874-7107.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/20/2010 12:55 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Regarding the problem of javascript link ending
> in .js
> > to
> > > .html, with
> > > which portlet do you meet the problem?
> > > j2-admin::SSOReverseProxyIFramePortlet,
> > >
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> > > j2-admin::SSOIFramePortlet,
> > j2-admin::SSOWebContentPortlet,
> > > or
> > > j2-admin::SSOProxyPortletPortlet?
> > >
> > > j2-admin::SSOReverseProxyIFramePortlet and
> > >
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet
> > only
> > > are using the
> > > reverse proxy service.
> > >
> > > If you are using those reverse proxy portlets,
> then
> > how's
> > > the rewriter
> > > configurations for the reverse proxy pass mapping
> in
> > > /j2-admin/WEB-INF/conf/reverseproxy.properties?
> > > I'd like to recommend you to use the default
> > configuration
> > > like the apache
> > > example:
> > >
> > > # ... Sets detail attributes for apache path
> mapping
> > > proxy.reverse.pass.apache.local = /apache/
> > > proxy.reverse.pass.apache.remote = http://apache.org/
> > > proxy.reverse.pass.apache.rewriter.basic =
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > proxy.reverse.pass.apache.rewriter.parserAdaptor
> =
> > html
> > >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html
> > =
> > >
> >
>
org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> > > = text/html
> > >
> >
>
proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > >
> > > = true
> > >
> > > With the default example above, the rewriting
> xml
> > rule
> > > files such as
> > > default-rewriter-rules.xml and
> rewriter-rules-mapping
> > do
> > > not play any role
> > > with reverse proxying portlets.
> > >
> > > The last example in the configuration file still
> uses
> > the
> > > Neko and Sax
> > > parser adaptor configuation, which was provided
> for
> > the old
> > > web content
> > > portlets. However, it turns out to be less useful
> in
> > this
> > > reverse proxy
> > > portlets. (The old rewriting xml rules were
> mainly
> > for
> > > rewriting urls to
> > > portlet urls, while reverse proxy service is
> just
> > another
> > > servlet-based
> > > solution with integration to portlet, meaning the
> url
> > > rewriting doesn't
> > > need to be that complex any more.)
> > >
> > > One more tip is that you could test the reverse
> > proxying by
> > > navigating the
> > > proxied urls directly.
> > > So, for example, if http://www.yourdomain.com/orders/ is mapped to
> > > /j2-admin/rproxy/yourdomain/orders/, then you
> can
> > browse
> > > directly to
> > > http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> > > You can see what
> > > happens for rewriting problems with this direct
> > access.
> > >
> > > HTH,
> > >
> > > Woonsan
> > >
> > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > >
> > > wrote:
> > >
> > > > From: mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Friday, August 20, 2010, 6:55 PM
> > > > Good to know. So I have rebuilt
> > > > my site on 2.2.1 and it seems to be
> > > > stable, unlike the previous implementation
> on
> > Derby.
> > > > Not sure if that's
> > > > an indication of a problem with 2.2.1 &
> > Derby, or
> > > just
> > > > a local issue. My
> > > > remaining issue is the rewrite in the
> reverse
> > proxy
> > > portlet
> > > > is changing a
> > > > javascript link ending in .js to .html
> Any
> > > ideas?
> > > >
> > > >
> > > >
> > > > From:
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/20/2010 11:50 AM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > I believe the pages can be simply copied
> because
> > I
> > > cannot
> > > > find anything to
> > > > watch with psml pages either.
> > > > By the way, you can copy those pages into
> any
> > other
> > > folder
> > > > by configuring
> > > > the path in
> > > /jetspeed/WEB-INF/conf/override.properties. For
> > > > example,
> > > >
> > > > # default path to (XML) PSML pages root
> folder
> > > > psml.pages.path =
> > > > ${applicationRoot}/WEB-INF/migrated_pages
> > > >
> > > > Regards,
> > > >
> > > > Woonsan
> > > >
> > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > >
> > > > wrote:
> > > >
> > > > > From: mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > > > Subject: Re: SSO IFrame form
> authentication
> > > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > > Date: Friday, August 20, 2010, 3:05 PM
> > > > > I have installed 2.2.1 with MySQL and
> > > > > I now need to move my pages and
> > > > > layouts from the 2.2.0 installation.
> > Given
> > > that
> > > > my
> > > > > previous 2.2.1
> > > > > installation on Derby is defunct, is
> there
> > > anything I
> > > > > should watch out for
> > > > > this time? Can I simply copy the
> psml's
> > > from
> > > > the
> > > > > 2.2.0 directories to the
> > > > > 2.2.1 directories? I
> have not
> > > seen a
> > > > > migration guide to address this
> > > > > need.
> > > > >
> > > > >
> > > > >
> > > > > From:
> > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > To:
> > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > Date:
> > > > > 08/18/2010 12:35 PM
> > > > > Subject:
> > > > > Re: SSO IFrame form authentication
> > > > >
> > > > >
> > > > >
> > > > > Hi,
> > > > >
> > > > > I haven't heard of that preferences
> data
> > problem
> > > yet
> > > > in
> > > > > 2.2.1.
> > > > > IMHO, It could help to localize the
> problems
> > if
> > > you
> > > > test
> > > > > against other
> > > > > databases
> > > > > like PostgreSQL or MySQL.
> > > > > On the other hand, I think you could
> deploy
> > > newer
> > > > > j2-admin.war and
> > > > > apa-webcontent.war which were included
> in
> > 2.2.1.
> > > > >
> > > > > -Woonsan
> > > > >
> > > > >
> > > > > ----- Original Message ----
> > > > > > From: "mballard@oreillyauto.com"
> > > > > <mb...@oreillyauto.com>
> > > > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > > > Sent: Wed, August 18, 2010 6:10:25
> AM
> > > > > > Subject: Re: SSO IFrame form
> > authentication
> > > > > >
> > > > > > Well, here's the rub. I
> believe the
> > > > > SSOReverseProxyIFramePortlet is new
> > > > >
> > > > > > in 2.2.1, which is where I was
> when I
> > first
> > > > posted,
> > > > > however, I found
> > > > > that
> > > > > > my configuration kept getting
> > scrambled, so
> > > I
> > > > reverted
> > > > > to 2.2.0 I will
> > > > > > try your suggestion on 2.2.1, but
> I
> > will
> > > have to
> > > > > address the scrambling
> > > > > > issue. What is happening is
> > > this. I
> > > > have
> > > > > cloned the IFramePortlet
> > > > > > several times and configured each
> for
> > > different
> > > > static
> > > > > content being
> > > > > > served from apache2. I have
> avoided
> > > setting
> > > > any
> > > > > user preferences, and,
> > > > >
> > > > > > instead, set the preferences for
> each
> > clone
> > > in
> > > > the
> > > > > PAM portlet.
> > > > > Everything
> > > > > > worked fine. Then after a
> few hours,
> > > the
> > > > > IFramePortlet content was all
> > > > >
> > > > > > mixed up. For instance, the
> portlet
> > on
> > >
> > > > > page 1 would be showing the
> > > > > > content I had configured for the
> > portlet on
> > > page
> > > >
> > > > > 2 and so on. I went
> > > > > into
> > > > > > PAM and corrected the preferences
> to
> > what
> > > > they
> > > > > should be and assumed I
> > > > > was
> > > > > > ok, but the next morning things
> were
> > > > scrambled
> > > > > again. I did some
> > > > > queries
> > > > > > in the derby db and it
> appears they
> > > are
> > > > wrong
> > > > > there. I don't know if
> > > > > this
> > > > > > is a portlet id issue or an
> indexing
> > > > problem or
> > > > > what, but I need a
> > > > > > resolution before I can proceed to
>
> > > 2.2.1
> > > > > Of course, I have the exact
> > > > > same
> > > > > > configuration in 2.2.0 and
> am having
> > > no
> > > > problem
> > > > > there, but I also have
> > > > > no
> > > > > > SSOReverseProxyIFrame there.
>
> > > Any
> > > > ideas?
> > > > > >
> > > > > >
> > > > > >
> > > > > > From:
> > > > > > David Sean Taylor <d....@onehippo.com>
> > > > > > To:
> > > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > > Date:
> > > > > > 08/17/2010 07:19 PM
> > > > > > Subject:
> > > > > > Re: SSO IFrame form
> authentication
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, Aug 17, 2010 at 1:40
> PM,
> > > > <mb...@oreillyauto.com>
> > > >
> > > > > wrote:
> > > > > > > How did your testing
> go? I
> > > compared
> > > > SSO
> > > > > Webcontent (which works,
> > > > > sort
> > > > > > of)
> > > > > > > to SSO IFrame classes and I
> see a
> > > method
> > > > > for preemptive login in the
> > > > > > > webcontent class but no
> reference
> > at
> > > all in
> > > > > the SSO IFrame class.
> > > > > Does
> > > > > > > this just mean it is being
> done
> > > > > differently, or is something amiss in
> > > > >
> > > > > > the
> > > > > > > SSO IFrame class?
> > > > > >
> > > > > > There are two SSOIFrame classes:
> > > > > >
> > > > > > 1. SSOIFramePortlet
> > > > > > 2.
> SSOReverseProxyIFramePortlet
> > > > > >
> > > > > > Suggest using the second one,
> > > > > SSOReverseProxyIFramePortlet as it
> gives
> > > > > > you features not available in the
>
> > > older
> > > > > SSOIFramePortlet such as
> > > > > > auto-resizing and form-based
> > authentication
> > >
> > > > > (what you are after)
> > > > > >
> > > > > > I tested with
> > SSOReverseProxyIFramePortlet
> > > and
> > > > > it worked in the
> > > > > > example that comes with Jetspeed,
> but
> > it
> > > takes a
> > > > > little bit of
> > > > > > configuration.
> > > > > >
> > > > > > First, ensure your Tomcat will
> need
> > this
> > > > > attribute set in the
> > > > > > <Connector> element of
> > > server.xml:
> > > > > >
> > > > > > emptySessionPath="true"
> > > > > >
> > > > > > more detail here:
> > > > > >
> > > > > > http://portals.apache.org/applications/webcontent/index.html
> > > > > >
> > > > > > If you had to change
> server.xml
> > > setting,
> > > > then
> > > > > restart your server
> > > > > >
> > > > > > I took these steps to verify
> SSO
> > with
> > > the
> > > > > example form-based login
> > > > > > that comes with Jetspeed:
> > > > > >
> > > > > > 1. login as admin
> > > > > > 2. navigate to the Jetspeed
> > Administration
> > > > > space, SSO Management page,
> > > > > > or just go here:
> > > > > >
> > > > > >
http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > > > >
> > > > > > Add a new Site with
> following
> > > parameters:
> > > > > >
> > > > > > Site Name: Form Example
> > > > > > Site URL:
http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > > > Field name for User ID:
> user
> > > > > > Field name For Password value:
> pass
> > > > > >
> > > > > > Press Save
> > > > > >
> > > > > > Add a new credential for
> this site
> > in
> > > the
> > > > > portlet on the right side
> > > > > > (SSO Details):
> > > > > >
> > > > > > Portal
> Principal: admin
> > > > > > Remote
> Principal: admin
> > > > > > Remote Credential: admin
> > > > > >
> > > > > > Press Add
> > > > > >
> > > > > > You can verify that
> the remote
> > > > credential
> > > > > was added for the admin
> > > > > > user by going here:
> > > > > >
> > > > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > > > >
> > > > > > see the portlet on the right
> "SSO
> > > Change
> > > > > Passwords", a remote site
> > > > > > entry should be there named
> "Form
> > > Example"
> > > > > >
> > > > > > Next, you can use the Toolbox to
> find
> > the
> > > > > Reverse Proxy Iframe Portlet
> > > > > > by searching on "iframe" and then
> > selecting
> > > it
> > > > > from there and adding
> > > > > > to a page. To make things simple,
> I
> > just
> > > added a
> > > > > page and then added
> > > > > > the Reverse Proxy Iframe Portlet
> there.
> > At
> > > first
> > > > this
> > > > > portlet seems to
> > > > > > want to use Basic Authentication,
> so
> > just
> > > hit
> > > > cancel
> > > > > when challenged.
> > > > > > I then switched to edit mode
> (pencil
> > icon),
> > > and
> > > > > entered the following
> > > > > > preferences:
> > > > > >
> > > > > > TITLE: My SSO Test
> > > > > > SRC: http://localhost:$
> > > >
> {serverPort}${contextPath}/examples/formauth.jsp
> > > > > >
> > > > > > Press Save
> > > > > >
> > > > > > You should see in your portlet
> content
> > > something
> > > >
> > > > > like:
> > > > > >
> > > > > > "Hello, admin. You have been
> authorized
> > by
> > > > > form-based authentication
> > > > > !!!"
> > > > > >
> > > > > > Give that a try and see if it
> works.
> > Then,
> > > move
> > > > on
> > > > > to your specific
> > > > > > IFrame source and let us know how
> it
> > > > goes...
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > To unsubscribe, e-mail:
> > > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > For additional commands,
> e-mail:
> > > > jetspeed-user-help@portals.apache.org
> > > > > >
> > > > > >
> > > > > > --
> > > > > > This message has been
> scanned for
> > > viruses
> > > > and
> > > > > > dangerous content by MailScanner,
>
> > and
> > > is
> > > > > > believed to be clean
> > > > > (mailgw2:E659D1E6FC.D1395).
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > This communication and any
> > attachments
> > > are
> > > > > confidential, protected by
> > > > > > Communications Privacy Act
> 18 USCS
> > §
> > > > 2510,
> > > > > solely for the use of the
> > > > > > intended recipient, and may
> contain
> > > > legally
> > > > > privileged material. If you
> > > > >
> > > > > > are not the intended recipient,
> please
> >
> > > > return or
> > > > > destroy it
> > > > > immediately.
> > > > > > Thank you.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > > >
> > > > >
> > > > > --
> > > > > This message has been scanned for
> viruses
> > and
> > > > > dangerous content by MailScanner, and
> is
> > > > > believed to be clean
> > (mailgw2:9902C1E701.B0EA8).
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > This communication and any attachments
> are
> > > > confidential,
> > > > > protected by
> > > > > Communications Privacy Act 18 USCS §
> 2510,
> > > solely for
> > > > the
> > > > > use of the
> > > > > intended recipient, and may contain
> legally
> > > > privileged
> > > > > material. If you
> > > > > are not the intended recipient, please
> > return or
> > > > destroy it
> > > > > immediately.
> > > > > Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for viruses
> and
> > > > dangerous content by MailScanner, and is
> > > > believed to be clean
> > (mailgw2:8B04D2A000C.7088C).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments are
> > > confidential,
> > > > protected by
> > > > Communications Privacy Act 18 USCS § 2510,
> > solely for
> > > the
> > > > use of the
> > > > intended recipient, and may contain legally
> > > privileged
> > > > material. If you
> > > > are not the intended recipient, please
> return or
> > > destroy it
> > > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:792FC1E702.4691D).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:EE2E12A000A.92659).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:2DDC92A000B.D7312).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
How about prepending a double quote or single quote, depending your target website, in the regex expression?
For example,
\"\\/otrs\\/customer\\.pl\\?CSID
will exclude "/j2-admin/rproxy/otrs/...".
Also, you can configure multiple custom replacements in the configuration.
(Multiple keys are defined with the same keys.
For example,
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns = \"\\/otrs\\/customer\\.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces = \"/j2-admin/rproxy/otrs/otrs/customer.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns = \"\\/otrs-web\\/customer\\.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces = \"/j2-admin/rproxy/otrs/otrs-web/customer.pl
...
-Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 10:52 PM
> Thank you, I had figured that
> out. Problem is that this rule replaces
> everything with /otrs/customer.pl even when it already has
>
> /j2-admin/rproxy/otrs prepended. Since the offending
> string is
> http://hostname.domain-name.com:8080/otrs/customer.pl?CSID=10822f631e5c8aaaa5b4236cd2547c5d82
>
> I attempted to construct a new rule with pattern
> \\/otrs\\/customer\\.pl\\?CSID and replacement
> /j2-admin/rproxy/otrs/otrs/customer.pl?CSID
>
> However, it never seems to catch the pattern. I tried
> it with escaping
> the ? and not escaping the ? as I wasn't sure which it
> should be.
>
> I also have a similiar issue with /otrs-web.....
> coming from javascript,
> I assume. Problem is that some of these patterns are
> prepended with the
> proxy and some are not. How to catch the ones which
> need rewrite as
> opposed to the ones which do not.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 03:35 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> If the pass configuration is for 'otrs' in your example,
> "proxy.reverse.pass = otrs", then the configuration keys
> should look like
> these:
>
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
>
> = \\/otrs\\/customer\\.pl
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
>
> = /j2-admin/rproxy/otrs/otrs/customer.pl
>
> --- On Fri, 8/20/10, Woonsan Ko <wo...@yahoo.com>
> wrote:
>
> > From: Woonsan Ko <wo...@yahoo.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 9:13 PM
> > I guess the first page which tried to
> > redirect to the second page with wrong url by using
> > javascript.
> > If it redirects to other page from the server-side
> with
> > http status code and header, then the reverse proxy
> service
> > can detect and rewrite to a proxied url from the
> reverse
> > proxy configurations if found.
> >
> > Anyway, if the first page has javascript to redirect,
> e.g.,
> > 'location.href =
> >
> /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a',
> > that script line is not rewritten by default.
> > (By the way, you can refer to the default rewriting
> class
> > here if you're interested in:
> http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java
> )
> >
> > If the redirecting script line is simple, then you can
> add
> > a custom replace pattern in the reverse proxy
> configuration
> > like the following example:
> >
> >
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns
> > = \\/otrs\\/customer\\.pl
> >
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces
> > = /j2-admin/rproxy/otrs/otrs/customer.pl
> >
> > The above additional custom replace configuration
> will
> > replace every line having that regex pattern.
> >
> > -Woonsan
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 8:19 PM
> > > I am using
> > > j2-admin::SSOReverseProxyIFramePortlet. I
> also
> > believe
> > > I am
> > > using the exact reverse properties as the apache
> > > example. I have
> > > discovered one issue when accessing directly in
> that
> > it
> > > appears when I
> > > enter
> > > http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl
> ,
> > >
> > > and login manually, I am redirected to
> > >
> http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
>
> > >
> > > and I get an HTTP 404 error. If I then
> correct the
> > > url and put the
> > > j2-admin/rproxy/otrs back in, I get the correct
> page
> > > rendered and I am
> > > logged in. In any case, once I get logged
> in and
> > try
> > > to drill down to an
> > > incident link, I get an error trying to load the
> > javascript
> > > because
> > > something has changed the .js in the link to
> .html
> > > Again, I am using the
> > > apache example config for rewriting.
> > >
> > > # ... Set max matching path part count
> > > proxy.reverse.pass.maxMatchingPathPartCount = 2
> > >
> > > # ... Sets detail attributes for apache path
> mapping
> > > proxy.reverse.pass = otrs
> > > proxy.reverse.pass.otrs.local = /otrs/
> > > proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> > > proxy.reverse.pass.otrs.rewriter.basic =
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > proxy.reverse.pass.otrs.rewriter.parserAdaptor =
> html
> > >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
> >
> > >
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> > > = text/html
> > >
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > >
> > > = true
> > >
> > > Thanks, MikeB
> > >
> > > Mike Ballard
> > > Director of Internet Development and Networking
> > > O'Reilly Auto Parts
> > > (417) 874-7107 Ofc
> > > (417) 838-0271 Cell
> > >
> > > This message is protected by the Electronic
> > Communications
> > > Privacy Act, 18
> > > USCS § 2510 et seq., and may not be used, copied
> or
> > > forwarded without the
> > > consent of the named recipient(s). The
> information
> > > contained in this
> > > message is confidential, is intended only for the
> use
> > of
> > > the individual or
> > > entity named. If the reader of this message
> is not
> > > the intended
> > > recipient, you are hereby notified that any
> > dissemination,
> > > distribution or
> > > copying of this communication is strictly
> > prohibited.
> > > If you have
> > > received this communication in error, please
> notify
> > me
> > > immediately at
> > > 417-874-7107.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/20/2010 12:55 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Regarding the problem of javascript link ending
> in .js
> > to
> > > .html, with
> > > which portlet do you meet the problem?
> > > j2-admin::SSOReverseProxyIFramePortlet,
> > >
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> > > j2-admin::SSOIFramePortlet,
> > j2-admin::SSOWebContentPortlet,
> > > or
> > > j2-admin::SSOProxyPortletPortlet?
> > >
> > > j2-admin::SSOReverseProxyIFramePortlet and
> > >
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet
> > only
> > > are using the
> > > reverse proxy service.
> > >
> > > If you are using those reverse proxy portlets,
> then
> > how's
> > > the rewriter
> > > configurations for the reverse proxy pass mapping
> in
> > > /j2-admin/WEB-INF/conf/reverseproxy.properties?
> > > I'd like to recommend you to use the default
> > configuration
> > > like the apache
> > > example:
> > >
> > > # ... Sets detail attributes for apache path
> mapping
> > > proxy.reverse.pass.apache.local = /apache/
> > > proxy.reverse.pass.apache.remote = http://apache.org/
> > > proxy.reverse.pass.apache.rewriter.basic =
> > >
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > > proxy.reverse.pass.apache.rewriter.parserAdaptor
> =
> > html
> > >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html
> > =
> > >
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> > > = text/html
> > >
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
> > >
> > > = true
> > >
> > > With the default example above, the rewriting
> xml
> > rule
> > > files such as
> > > default-rewriter-rules.xml and
> rewriter-rules-mapping
> > do
> > > not play any role
> > > with reverse proxying portlets.
> > >
> > > The last example in the configuration file still
> uses
> > the
> > > Neko and Sax
> > > parser adaptor configuation, which was provided
> for
> > the old
> > > web content
> > > portlets. However, it turns out to be less useful
> in
> > this
> > > reverse proxy
> > > portlets. (The old rewriting xml rules were
> mainly
> > for
> > > rewriting urls to
> > > portlet urls, while reverse proxy service is
> just
> > another
> > > servlet-based
> > > solution with integration to portlet, meaning the
> url
> > > rewriting doesn't
> > > need to be that complex any more.)
> > >
> > > One more tip is that you could test the reverse
> > proxying by
> > > navigating the
> > > proxied urls directly.
> > > So, for example, if http://www.yourdomain.com/orders/ is mapped to
> > > /j2-admin/rproxy/yourdomain/orders/, then you
> can
> > browse
> > > directly to
> > > http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> > > You can see what
> > > happens for rewriting problems with this direct
> > access.
> > >
> > > HTH,
> > >
> > > Woonsan
> > >
> > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > >
> > > wrote:
> > >
> > > > From: mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Friday, August 20, 2010, 6:55 PM
> > > > Good to know. So I have rebuilt
> > > > my site on 2.2.1 and it seems to be
> > > > stable, unlike the previous implementation
> on
> > Derby.
> > > > Not sure if that's
> > > > an indication of a problem with 2.2.1 &
> > Derby, or
> > > just
> > > > a local issue. My
> > > > remaining issue is the rewrite in the
> reverse
> > proxy
> > > portlet
> > > > is changing a
> > > > javascript link ending in .js to .html
> Any
> > > ideas?
> > > >
> > > >
> > > >
> > > > From:
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/20/2010 11:50 AM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > I believe the pages can be simply copied
> because
> > I
> > > cannot
> > > > find anything to
> > > > watch with psml pages either.
> > > > By the way, you can copy those pages into
> any
> > other
> > > folder
> > > > by configuring
> > > > the path in
> > > /jetspeed/WEB-INF/conf/override.properties. For
> > > > example,
> > > >
> > > > # default path to (XML) PSML pages root
> folder
> > > > psml.pages.path =
> > > > ${applicationRoot}/WEB-INF/migrated_pages
> > > >
> > > > Regards,
> > > >
> > > > Woonsan
> > > >
> > > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > >
> > > > wrote:
> > > >
> > > > > From: mballard@oreillyauto.com
> > > > <mb...@oreillyauto.com>
> > > > > Subject: Re: SSO IFrame form
> authentication
> > > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > > Date: Friday, August 20, 2010, 3:05 PM
> > > > > I have installed 2.2.1 with MySQL and
> > > > > I now need to move my pages and
> > > > > layouts from the 2.2.0 installation.
> > Given
> > > that
> > > > my
> > > > > previous 2.2.1
> > > > > installation on Derby is defunct, is
> there
> > > anything I
> > > > > should watch out for
> > > > > this time? Can I simply copy the
> psml's
> > > from
> > > > the
> > > > > 2.2.0 directories to the
> > > > > 2.2.1 directories? I
> have not
> > > seen a
> > > > > migration guide to address this
> > > > > need.
> > > > >
> > > > >
> > > > >
> > > > > From:
> > > > > Woonsan Ko <wo...@yahoo.com>
> > > > > To:
> > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > Date:
> > > > > 08/18/2010 12:35 PM
> > > > > Subject:
> > > > > Re: SSO IFrame form authentication
> > > > >
> > > > >
> > > > >
> > > > > Hi,
> > > > >
> > > > > I haven't heard of that preferences
> data
> > problem
> > > yet
> > > > in
> > > > > 2.2.1.
> > > > > IMHO, It could help to localize the
> problems
> > if
> > > you
> > > > test
> > > > > against other
> > > > > databases
> > > > > like PostgreSQL or MySQL.
> > > > > On the other hand, I think you could
> deploy
> > > newer
> > > > > j2-admin.war and
> > > > > apa-webcontent.war which were included
> in
> > 2.2.1.
> > > > >
> > > > > -Woonsan
> > > > >
> > > > >
> > > > > ----- Original Message ----
> > > > > > From: "mballard@oreillyauto.com"
> > > > > <mb...@oreillyauto.com>
> > > > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > > > Sent: Wed, August 18, 2010 6:10:25
> AM
> > > > > > Subject: Re: SSO IFrame form
> > authentication
> > > > > >
> > > > > > Well, here's the rub. I
> believe the
> > > > > SSOReverseProxyIFramePortlet is new
> > > > >
> > > > > > in 2.2.1, which is where I was
> when I
> > first
> > > > posted,
> > > > > however, I found
> > > > > that
> > > > > > my configuration kept getting
> > scrambled, so
> > > I
> > > > reverted
> > > > > to 2.2.0 I will
> > > > > > try your suggestion on 2.2.1, but
> I
> > will
> > > have to
> > > > > address the scrambling
> > > > > > issue. What is happening is
> > > this. I
> > > > have
> > > > > cloned the IFramePortlet
> > > > > > several times and configured each
> for
> > > different
> > > > static
> > > > > content being
> > > > > > served from apache2. I have
> avoided
> > > setting
> > > > any
> > > > > user preferences, and,
> > > > >
> > > > > > instead, set the preferences for
> each
> > clone
> > > in
> > > > the
> > > > > PAM portlet.
> > > > > Everything
> > > > > > worked fine. Then after a
> few hours,
> > > the
> > > > > IFramePortlet content was all
> > > > >
> > > > > > mixed up. For instance, the
> portlet
> > on
> > >
> > > > > page 1 would be showing the
> > > > > > content I had configured for the
> > portlet on
> > > page
> > > >
> > > > > 2 and so on. I went
> > > > > into
> > > > > > PAM and corrected the preferences
> to
> > what
> > > > they
> > > > > should be and assumed I
> > > > > was
> > > > > > ok, but the next morning things
> were
> > > > scrambled
> > > > > again. I did some
> > > > > queries
> > > > > > in the derby db and it
> appears they
> > > are
> > > > wrong
> > > > > there. I don't know if
> > > > > this
> > > > > > is a portlet id issue or an
> indexing
> > > > problem or
> > > > > what, but I need a
> > > > > > resolution before I can proceed to
>
> > > 2.2.1
> > > > > Of course, I have the exact
> > > > > same
> > > > > > configuration in 2.2.0 and
> am having
> > > no
> > > > problem
> > > > > there, but I also have
> > > > > no
> > > > > > SSOReverseProxyIFrame there.
>
> > > Any
> > > > ideas?
> > > > > >
> > > > > >
> > > > > >
> > > > > > From:
> > > > > > David Sean Taylor <d....@onehippo.com>
> > > > > > To:
> > > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > > Date:
> > > > > > 08/17/2010 07:19 PM
> > > > > > Subject:
> > > > > > Re: SSO IFrame form
> authentication
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, Aug 17, 2010 at 1:40
> PM,
> > > > <mb...@oreillyauto.com>
> > > >
> > > > > wrote:
> > > > > > > How did your testing
> go? I
> > > compared
> > > > SSO
> > > > > Webcontent (which works,
> > > > > sort
> > > > > > of)
> > > > > > > to SSO IFrame classes and I
> see a
> > > method
> > > > > for preemptive login in the
> > > > > > > webcontent class but no
> reference
> > at
> > > all in
> > > > > the SSO IFrame class.
> > > > > Does
> > > > > > > this just mean it is being
> done
> > > > > differently, or is something amiss in
> > > > >
> > > > > > the
> > > > > > > SSO IFrame class?
> > > > > >
> > > > > > There are two SSOIFrame classes:
> > > > > >
> > > > > > 1. SSOIFramePortlet
> > > > > > 2.
> SSOReverseProxyIFramePortlet
> > > > > >
> > > > > > Suggest using the second one,
> > > > > SSOReverseProxyIFramePortlet as it
> gives
> > > > > > you features not available in the
>
> > > older
> > > > > SSOIFramePortlet such as
> > > > > > auto-resizing and form-based
> > authentication
> > >
> > > > > (what you are after)
> > > > > >
> > > > > > I tested with
> > SSOReverseProxyIFramePortlet
> > > and
> > > > > it worked in the
> > > > > > example that comes with Jetspeed,
> but
> > it
> > > takes a
> > > > > little bit of
> > > > > > configuration.
> > > > > >
> > > > > > First, ensure your Tomcat will
> need
> > this
> > > > > attribute set in the
> > > > > > <Connector> element of
> > > server.xml:
> > > > > >
> > > > > > emptySessionPath="true"
> > > > > >
> > > > > > more detail here:
> > > > > >
> > > > > > http://portals.apache.org/applications/webcontent/index.html
> > > > > >
> > > > > > If you had to change
> server.xml
> > > setting,
> > > > then
> > > > > restart your server
> > > > > >
> > > > > > I took these steps to verify
> SSO
> > with
> > > the
> > > > > example form-based login
> > > > > > that comes with Jetspeed:
> > > > > >
> > > > > > 1. login as admin
> > > > > > 2. navigate to the Jetspeed
> > Administration
> > > > > space, SSO Management page,
> > > > > > or just go here:
> > > > > >
> > > > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > > > >
> > > > > > Add a new Site with
> following
> > > parameters:
> > > > > >
> > > > > > Site Name: Form Example
> > > > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > > > Field name for User ID:
> user
> > > > > > Field name For Password value:
> pass
> > > > > >
> > > > > > Press Save
> > > > > >
> > > > > > Add a new credential for
> this site
> > in
> > > the
> > > > > portlet on the right side
> > > > > > (SSO Details):
> > > > > >
> > > > > > Portal
> Principal: admin
> > > > > > Remote
> Principal: admin
> > > > > > Remote Credential: admin
> > > > > >
> > > > > > Press Add
> > > > > >
> > > > > > You can verify that
> the remote
> > > > credential
> > > > > was added for the admin
> > > > > > user by going here:
> > > > > >
> > > > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > > > >
> > > > > > see the portlet on the right
> "SSO
> > > Change
> > > > > Passwords", a remote site
> > > > > > entry should be there named
> "Form
> > > Example"
> > > > > >
> > > > > > Next, you can use the Toolbox to
> find
> > the
> > > > > Reverse Proxy Iframe Portlet
> > > > > > by searching on "iframe" and then
> > selecting
> > > it
> > > > > from there and adding
> > > > > > to a page. To make things simple,
> I
> > just
> > > added a
> > > > > page and then added
> > > > > > the Reverse Proxy Iframe Portlet
> there.
> > At
> > > first
> > > > this
> > > > > portlet seems to
> > > > > > want to use Basic Authentication,
> so
> > just
> > > hit
> > > > cancel
> > > > > when challenged.
> > > > > > I then switched to edit mode
> (pencil
> > icon),
> > > and
> > > > > entered the following
> > > > > > preferences:
> > > > > >
> > > > > > TITLE: My SSO Test
> > > > > > SRC: http://localhost:$
> > > >
> {serverPort}${contextPath}/examples/formauth.jsp
> > > > > >
> > > > > > Press Save
> > > > > >
> > > > > > You should see in your portlet
> content
> > > something
> > > >
> > > > > like:
> > > > > >
> > > > > > "Hello, admin. You have been
> authorized
> > by
> > > > > form-based authentication
> > > > > !!!"
> > > > > >
> > > > > > Give that a try and see if it
> works.
> > Then,
> > > move
> > > > on
> > > > > to your specific
> > > > > > IFrame source and let us know how
> it
> > > > goes...
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > > To unsubscribe, e-mail:
> > > jetspeed-user-unsubscribe@portals.apache.org
> > > > > > For additional commands,
> e-mail:
> > > > jetspeed-user-help@portals.apache.org
> > > > > >
> > > > > >
> > > > > > --
> > > > > > This message has been
> scanned for
> > > viruses
> > > > and
> > > > > > dangerous content by MailScanner,
>
> > and
> > > is
> > > > > > believed to be clean
> > > > > (mailgw2:E659D1E6FC.D1395).
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > This communication and any
> > attachments
> > > are
> > > > > confidential, protected by
> > > > > > Communications Privacy Act
> 18 USCS
> > §
> > > > 2510,
> > > > > solely for the use of the
> > > > > > intended recipient, and may
> contain
> > > > legally
> > > > > privileged material. If you
> > > > >
> > > > > > are not the intended recipient,
> please
> >
> > > > return or
> > > > > destroy it
> > > > > immediately.
> > > > > > Thank you.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > > >
> > > > >
> > > > > --
> > > > > This message has been scanned for
> viruses
> > and
> > > > > dangerous content by MailScanner, and
> is
> > > > > believed to be clean
> > (mailgw2:9902C1E701.B0EA8).
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > This communication and any attachments
> are
> > > > confidential,
> > > > > protected by
> > > > > Communications Privacy Act 18 USCS §
> 2510,
> > > solely for
> > > > the
> > > > > use of the
> > > > > intended recipient, and may contain
> legally
> > > > privileged
> > > > > material. If you
> > > > > are not the intended recipient, please
> > return or
> > > > destroy it
> > > > > immediately.
> > > > > Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for viruses
> and
> > > > dangerous content by MailScanner, and is
> > > > believed to be clean
> > (mailgw2:8B04D2A000C.7088C).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments are
> > > confidential,
> > > > protected by
> > > > Communications Privacy Act 18 USCS § 2510,
> > solely for
> > > the
> > > > use of the
> > > > intended recipient, and may contain legally
> > > privileged
> > > > material. If you
> > > > are not the intended recipient, please
> return or
> > > destroy it
> > > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:792FC1E702.4691D).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:EE2E12A000A.92659).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Thank you, I had figured that out. Problem is that this rule replaces
everything with /otrs/customer.pl even when it already has
/j2-admin/rproxy/otrs prepended. Since the offending string is
http://hostname.domain-name.com:8080/otrs/customer.pl?CSID=10822f631e5c8aaaa5b4236cd2547c5d82
I attempted to construct a new rule with pattern
\\/otrs\\/customer\\.pl\\?CSID and replacement
/j2-admin/rproxy/otrs/otrs/customer.pl?CSID
However, it never seems to catch the pattern. I tried it with escaping
the ? and not escaping the ? as I wasn't sure which it should be.
I also have a similiar issue with /otrs-web..... coming from javascript,
I assume. Problem is that some of these patterns are prepended with the
proxy and some are not. How to catch the ones which need rewrite as
opposed to the ones which do not.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/20/2010 03:35 PM
Subject:
Re: SSO IFrame form authentication
If the pass configuration is for 'otrs' in your example,
"proxy.reverse.pass = otrs", then the configuration keys should look like
these:
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns
= \\/otrs\\/customer\\.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces
= /j2-admin/rproxy/otrs/otrs/customer.pl
--- On Fri, 8/20/10, Woonsan Ko <wo...@yahoo.com> wrote:
> From: Woonsan Ko <wo...@yahoo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 9:13 PM
> I guess the first page which tried to
> redirect to the second page with wrong url by using
> javascript.
> If it redirects to other page from the server-side with
> http status code and header, then the reverse proxy service
> can detect and rewrite to a proxied url from the reverse
> proxy configurations if found.
>
> Anyway, if the first page has javascript to redirect, e.g.,
> 'location.href =
> /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a',
> that script line is not rewritten by default.
> (By the way, you can refer to the default rewriting class
> here if you're interested in:
http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java
)
>
> If the redirecting script line is simple, then you can add
> a custom replace pattern in the reverse proxy configuration
> like the following example:
>
>
proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns
> = \\/otrs\\/customer\\.pl
>
proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces
> = /j2-admin/rproxy/otrs/otrs/customer.pl
>
> The above additional custom replace configuration will
> replace every line having that regex pattern.
>
> -Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 8:19 PM
> > I am using
> > j2-admin::SSOReverseProxyIFramePortlet. I also
> believe
> > I am
> > using the exact reverse properties as the apache
> > example. I have
> > discovered one issue when accessing directly in that
> it
> > appears when I
> > enter
> > http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl
,
> >
> > and login manually, I am redirected to
> >
http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
> >
> > and I get an HTTP 404 error. If I then correct the
> > url and put the
> > j2-admin/rproxy/otrs back in, I get the correct page
> > rendered and I am
> > logged in. In any case, once I get logged in and
> try
> > to drill down to an
> > incident link, I get an error trying to load the
> javascript
> > because
> > something has changed the .js in the link to .html
> > Again, I am using the
> > apache example config for rewriting.
> >
> > # ... Set max matching path part count
> > proxy.reverse.pass.maxMatchingPathPartCount = 2
> >
> > # ... Sets detail attributes for apache path mapping
> > proxy.reverse.pass = otrs
> > proxy.reverse.pass.otrs.local = /otrs/
> > proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> > proxy.reverse.pass.otrs.rewriter.basic =
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > proxy.reverse.pass.otrs.rewriter.parserAdaptor = html
> > proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
>
> >
>
org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> > = text/html
> >
>
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
> >
> > = true
> >
> > Thanks, MikeB
> >
> > Mike Ballard
> > Director of Internet Development and Networking
> > O'Reilly Auto Parts
> > (417) 874-7107 Ofc
> > (417) 838-0271 Cell
> >
> > This message is protected by the Electronic
> Communications
> > Privacy Act, 18
> > USCS § 2510 et seq., and may not be used, copied or
> > forwarded without the
> > consent of the named recipient(s). The information
> > contained in this
> > message is confidential, is intended only for the use
> of
> > the individual or
> > entity named. If the reader of this message is not
> > the intended
> > recipient, you are hereby notified that any
> dissemination,
> > distribution or
> > copying of this communication is strictly
> prohibited.
> > If you have
> > received this communication in error, please notify
> me
> > immediately at
> > 417-874-7107.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/20/2010 12:55 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Regarding the problem of javascript link ending in .js
> to
> > .html, with
> > which portlet do you meet the problem?
> > j2-admin::SSOReverseProxyIFramePortlet,
> > j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> > j2-admin::SSOIFramePortlet,
> j2-admin::SSOWebContentPortlet,
> > or
> > j2-admin::SSOProxyPortletPortlet?
> >
> > j2-admin::SSOReverseProxyIFramePortlet and
> > j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet
> only
> > are using the
> > reverse proxy service.
> >
> > If you are using those reverse proxy portlets, then
> how's
> > the rewriter
> > configurations for the reverse proxy pass mapping in
> > /j2-admin/WEB-INF/conf/reverseproxy.properties?
> > I'd like to recommend you to use the default
> configuration
> > like the apache
> > example:
> >
> > # ... Sets detail attributes for apache path mapping
> > proxy.reverse.pass.apache.local = /apache/
> > proxy.reverse.pass.apache.remote = http://apache.org/
> > proxy.reverse.pass.apache.rewriter.basic =
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > proxy.reverse.pass.apache.rewriter.parserAdaptor =
> html
> > proxy.reverse.pass.apache.rewriter.parserAdaptor.html
> =
> >
>
org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> > = text/html
> >
>
proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
> >
> > = true
> >
> > With the default example above, the rewriting xml
> rule
> > files such as
> > default-rewriter-rules.xml and rewriter-rules-mapping
> do
> > not play any role
> > with reverse proxying portlets.
> >
> > The last example in the configuration file still uses
> the
> > Neko and Sax
> > parser adaptor configuation, which was provided for
> the old
> > web content
> > portlets. However, it turns out to be less useful in
> this
> > reverse proxy
> > portlets. (The old rewriting xml rules were mainly
> for
> > rewriting urls to
> > portlet urls, while reverse proxy service is just
> another
> > servlet-based
> > solution with integration to portlet, meaning the url
> > rewriting doesn't
> > need to be that complex any more.)
> >
> > One more tip is that you could test the reverse
> proxying by
> > navigating the
> > proxied urls directly.
> > So, for example, if http://www.yourdomain.com/orders/ is mapped to
> > /j2-admin/rproxy/yourdomain/orders/, then you can
> browse
> > directly to
> > http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> > You can see what
> > happens for rewriting problems with this direct
> access.
> >
> > HTH,
> >
> > Woonsan
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> >
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 6:55 PM
> > > Good to know. So I have rebuilt
> > > my site on 2.2.1 and it seems to be
> > > stable, unlike the previous implementation on
> Derby.
> > > Not sure if that's
> > > an indication of a problem with 2.2.1 &
> Derby, or
> > just
> > > a local issue. My
> > > remaining issue is the rewrite in the reverse
> proxy
> > portlet
> > > is changing a
> > > javascript link ending in .js to .html Any
> > ideas?
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/20/2010 11:50 AM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > I believe the pages can be simply copied because
> I
> > cannot
> > > find anything to
> > > watch with psml pages either.
> > > By the way, you can copy those pages into any
> other
> > folder
> > > by configuring
> > > the path in
> > /jetspeed/WEB-INF/conf/override.properties. For
> > > example,
> > >
> > > # default path to (XML) PSML pages root folder
> > > psml.pages.path =
> > > ${applicationRoot}/WEB-INF/migrated_pages
> > >
> > > Regards,
> > >
> > > Woonsan
> > >
> > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > >
> > > wrote:
> > >
> > > > From: mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Friday, August 20, 2010, 3:05 PM
> > > > I have installed 2.2.1 with MySQL and
> > > > I now need to move my pages and
> > > > layouts from the 2.2.0 installation.
> Given
> > that
> > > my
> > > > previous 2.2.1
> > > > installation on Derby is defunct, is there
> > anything I
> > > > should watch out for
> > > > this time? Can I simply copy the psml's
> > from
> > > the
> > > > 2.2.0 directories to the
> > > > 2.2.1 directories? I have not
> > seen a
> > > > migration guide to address this
> > > > need.
> > > >
> > > >
> > > >
> > > > From:
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/18/2010 12:35 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > Hi,
> > > >
> > > > I haven't heard of that preferences data
> problem
> > yet
> > > in
> > > > 2.2.1.
> > > > IMHO, It could help to localize the problems
> if
> > you
> > > test
> > > > against other
> > > > databases
> > > > like PostgreSQL or MySQL.
> > > > On the other hand, I think you could deploy
> > newer
> > > > j2-admin.war and
> > > > apa-webcontent.war which were included in
> 2.2.1.
> > > >
> > > > -Woonsan
> > > >
> > > >
> > > > ----- Original Message ----
> > > > > From: "mballard@oreillyauto.com"
> > > > <mb...@oreillyauto.com>
> > > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > > > Subject: Re: SSO IFrame form
> authentication
> > > > >
> > > > > Well, here's the rub. I believe the
> > > > SSOReverseProxyIFramePortlet is new
> > > >
> > > > > in 2.2.1, which is where I was when I
> first
> > > posted,
> > > > however, I found
> > > > that
> > > > > my configuration kept getting
> scrambled, so
> > I
> > > reverted
> > > > to 2.2.0 I will
> > > > > try your suggestion on 2.2.1, but I
> will
> > have to
> > > > address the scrambling
> > > > > issue. What is happening is
> > this. I
> > > have
> > > > cloned the IFramePortlet
> > > > > several times and configured each for
> > different
> > > static
> > > > content being
> > > > > served from apache2. I have avoided
> > setting
> > > any
> > > > user preferences, and,
> > > >
> > > > > instead, set the preferences for each
> clone
> > in
> > > the
> > > > PAM portlet.
> > > > Everything
> > > > > worked fine. Then after a few hours,
> > the
> > > > IFramePortlet content was all
> > > >
> > > > > mixed up. For instance, the portlet
> on
> >
> > > > page 1 would be showing the
> > > > > content I had configured for the
> portlet on
> > page
> > >
> > > > 2 and so on. I went
> > > > into
> > > > > PAM and corrected the preferences to
> what
> > > they
> > > > should be and assumed I
> > > > was
> > > > > ok, but the next morning things were
> > > scrambled
> > > > again. I did some
> > > > queries
> > > > > in the derby db and it appears they
> > are
> > > wrong
> > > > there. I don't know if
> > > > this
> > > > > is a portlet id issue or an indexing
> > > problem or
> > > > what, but I need a
> > > > > resolution before I can proceed to
> > 2.2.1
> > > > Of course, I have the exact
> > > > same
> > > > > configuration in 2.2.0 and am having
> > no
> > > problem
> > > > there, but I also have
> > > > no
> > > > > SSOReverseProxyIFrame there.
> > Any
> > > ideas?
> > > > >
> > > > >
> > > > >
> > > > > From:
> > > > > David Sean Taylor <d....@onehippo.com>
> > > > > To:
> > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > Date:
> > > > > 08/17/2010 07:19 PM
> > > > > Subject:
> > > > > Re: SSO IFrame form authentication
> > > > >
> > > > >
> > > > >
> > > > > On Tue, Aug 17, 2010 at 1:40 PM,
> > > <mb...@oreillyauto.com>
> > >
> > > > wrote:
> > > > > > How did your testing go? I
> > compared
> > > SSO
> > > > Webcontent (which works,
> > > > sort
> > > > > of)
> > > > > > to SSO IFrame classes and I see a
> > method
> > > > for preemptive login in the
> > > > > > webcontent class but no reference
> at
> > all in
> > > > the SSO IFrame class.
> > > > Does
> > > > > > this just mean it is being done
> > > > differently, or is something amiss in
> > > >
> > > > > the
> > > > > > SSO IFrame class?
> > > > >
> > > > > There are two SSOIFrame classes:
> > > > >
> > > > > 1. SSOIFramePortlet
> > > > > 2. SSOReverseProxyIFramePortlet
> > > > >
> > > > > Suggest using the second one,
> > > > SSOReverseProxyIFramePortlet as it gives
> > > > > you features not available in the
> > older
> > > > SSOIFramePortlet such as
> > > > > auto-resizing and form-based
> authentication
> >
> > > > (what you are after)
> > > > >
> > > > > I tested with
> SSOReverseProxyIFramePortlet
> > and
> > > > it worked in the
> > > > > example that comes with Jetspeed, but
> it
> > takes a
> > > > little bit of
> > > > > configuration.
> > > > >
> > > > > First, ensure your Tomcat will need
> this
> > > > attribute set in the
> > > > > <Connector> element of
> > server.xml:
> > > > >
> > > > > emptySessionPath="true"
> > > > >
> > > > > more detail here:
> > > > >
> > > > > http://portals.apache.org/applications/webcontent/index.html
> > > > >
> > > > > If you had to change server.xml
> > setting,
> > > then
> > > > restart your server
> > > > >
> > > > > I took these steps to verify SSO
> with
> > the
> > > > example form-based login
> > > > > that comes with Jetspeed:
> > > > >
> > > > > 1. login as admin
> > > > > 2. navigate to the Jetspeed
> Administration
> > > > space, SSO Management page,
> > > > > or just go here:
> > > > >
> > > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > > >
> > > > > Add a new Site with following
> > parameters:
> > > > >
> > > > > Site Name: Form Example
> > > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > > Field name for User ID: user
> > > > > Field name For Password value: pass
> > > > >
> > > > > Press Save
> > > > >
> > > > > Add a new credential for this site
> in
> > the
> > > > portlet on the right side
> > > > > (SSO Details):
> > > > >
> > > > > Portal Principal: admin
> > > > > Remote Principal: admin
> > > > > Remote Credential: admin
> > > > >
> > > > > Press Add
> > > > >
> > > > > You can verify that the remote
> > > credential
> > > > was added for the admin
> > > > > user by going here:
> > > > >
> > > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > > >
> > > > > see the portlet on the right "SSO
> > Change
> > > > Passwords", a remote site
> > > > > entry should be there named "Form
> > Example"
> > > > >
> > > > > Next, you can use the Toolbox to find
> the
> > > > Reverse Proxy Iframe Portlet
> > > > > by searching on "iframe" and then
> selecting
> > it
> > > > from there and adding
> > > > > to a page. To make things simple, I
> just
> > added a
> > > > page and then added
> > > > > the Reverse Proxy Iframe Portlet there.
> At
> > first
> > > this
> > > > portlet seems to
> > > > > want to use Basic Authentication, so
> just
> > hit
> > > cancel
> > > > when challenged.
> > > > > I then switched to edit mode (pencil
> icon),
> > and
> > > > entered the following
> > > > > preferences:
> > > > >
> > > > > TITLE: My SSO Test
> > > > > SRC: http://localhost:$
> > > {serverPort}${contextPath}/examples/formauth.jsp
> > > > >
> > > > > Press Save
> > > > >
> > > > > You should see in your portlet content
> > something
> > >
> > > > like:
> > > > >
> > > > > "Hello, admin. You have been authorized
> by
> > > > form-based authentication
> > > > !!!"
> > > > >
> > > > > Give that a try and see if it works.
> Then,
> > move
> > > on
> > > > to your specific
> > > > > IFrame source and let us know how it
> > > goes...
> > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail:
> > jetspeed-user-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> > > jetspeed-user-help@portals.apache.org
> > > > >
> > > > >
> > > > > --
> > > > > This message has been scanned for
> > viruses
> > > and
> > > > > dangerous content by MailScanner,
> and
> > is
> > > > > believed to be clean
> > > > (mailgw2:E659D1E6FC.D1395).
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > This communication and any
> attachments
> > are
> > > > confidential, protected by
> > > > > Communications Privacy Act 18 USCS
> §
> > > 2510,
> > > > solely for the use of the
> > > > > intended recipient, and may contain
> > > legally
> > > > privileged material. If you
> > > >
> > > > > are not the intended recipient, please
>
> > > return or
> > > > destroy it
> > > > immediately.
> > > > > Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for viruses
> and
> > > > dangerous content by MailScanner, and is
> > > > believed to be clean
> (mailgw2:9902C1E701.B0EA8).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments are
> > > confidential,
> > > > protected by
> > > > Communications Privacy Act 18 USCS § 2510,
> > solely for
> > > the
> > > > use of the
> > > > intended recipient, and may contain legally
> > > privileged
> > > > material. If you
> > > > are not the intended recipient, please
> return or
> > > destroy it
> > > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> (mailgw2:8B04D2A000C.7088C).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:792FC1E702.4691D).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:EE2E12A000A.92659).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
If the pass configuration is for 'otrs' in your example, "proxy.reverse.pass = otrs", then the configuration keys should look like these:
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customPatterns = \\/otrs\\/customer\\.pl
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.customReplaces = /j2-admin/rproxy/otrs/otrs/customer.pl
--- On Fri, 8/20/10, Woonsan Ko <wo...@yahoo.com> wrote:
> From: Woonsan Ko <wo...@yahoo.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 9:13 PM
> I guess the first page which tried to
> redirect to the second page with wrong url by using
> javascript.
> If it redirects to other page from the server-side with
> http status code and header, then the reverse proxy service
> can detect and rewrite to a proxied url from the reverse
> proxy configurations if found.
>
> Anyway, if the first page has javascript to redirect, e.g.,
> 'location.href =
> /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a',
> that script line is not rewritten by default.
> (By the way, you can refer to the default rewriting class
> here if you're interested in: http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java)
>
> If the redirecting script line is simple, then you can add
> a custom replace pattern in the reverse proxy configuration
> like the following example:
>
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns
> = \\/otrs\\/customer\\.pl
> proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces
> = /j2-admin/rproxy/otrs/otrs/customer.pl
>
> The above additional custom replace configuration will
> replace every line having that regex pattern.
>
> -Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 8:19 PM
> > I am using
> > j2-admin::SSOReverseProxyIFramePortlet. I also
> believe
> > I am
> > using the exact reverse properties as the apache
> > example. I have
> > discovered one issue when accessing directly in that
> it
> > appears when I
> > enter
> > http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl,
> >
> > and login manually, I am redirected to
> > http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
> >
> > and I get an HTTP 404 error. If I then correct the
> > url and put the
> > j2-admin/rproxy/otrs back in, I get the correct page
> > rendered and I am
> > logged in. In any case, once I get logged in and
> try
> > to drill down to an
> > incident link, I get an error trying to load the
> javascript
> > because
> > something has changed the .js in the link to .html
> > Again, I am using the
> > apache example config for rewriting.
> >
> > # ... Set max matching path part count
> > proxy.reverse.pass.maxMatchingPathPartCount = 2
> >
> > # ... Sets detail attributes for apache path mapping
> > proxy.reverse.pass = otrs
> > proxy.reverse.pass.otrs.local = /otrs/
> > proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> > proxy.reverse.pass.otrs.rewriter.basic =
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > proxy.reverse.pass.otrs.rewriter.parserAdaptor = html
> > proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
>
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> > = text/html
> >
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
> >
> > = true
> >
> > Thanks, MikeB
> >
> > Mike Ballard
> > Director of Internet Development and Networking
> > O'Reilly Auto Parts
> > (417) 874-7107 Ofc
> > (417) 838-0271 Cell
> >
> > This message is protected by the Electronic
> Communications
> > Privacy Act, 18
> > USCS § 2510 et seq., and may not be used, copied or
> > forwarded without the
> > consent of the named recipient(s). The information
> > contained in this
> > message is confidential, is intended only for the use
> of
> > the individual or
> > entity named. If the reader of this message is not
> > the intended
> > recipient, you are hereby notified that any
> dissemination,
> > distribution or
> > copying of this communication is strictly
> prohibited.
> > If you have
> > received this communication in error, please notify
> me
> > immediately at
> > 417-874-7107.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/20/2010 12:55 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Regarding the problem of javascript link ending in .js
> to
> > .html, with
> > which portlet do you meet the problem?
> > j2-admin::SSOReverseProxyIFramePortlet,
> > j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> > j2-admin::SSOIFramePortlet,
> j2-admin::SSOWebContentPortlet,
> > or
> > j2-admin::SSOProxyPortletPortlet?
> >
> > j2-admin::SSOReverseProxyIFramePortlet and
> > j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet
> only
> > are using the
> > reverse proxy service.
> >
> > If you are using those reverse proxy portlets, then
> how's
> > the rewriter
> > configurations for the reverse proxy pass mapping in
> > /j2-admin/WEB-INF/conf/reverseproxy.properties?
> > I'd like to recommend you to use the default
> configuration
> > like the apache
> > example:
> >
> > # ... Sets detail attributes for apache path mapping
> > proxy.reverse.pass.apache.local = /apache/
> > proxy.reverse.pass.apache.remote = http://apache.org/
> > proxy.reverse.pass.apache.rewriter.basic =
> >
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> > proxy.reverse.pass.apache.rewriter.parserAdaptor =
> html
> > proxy.reverse.pass.apache.rewriter.parserAdaptor.html
> =
> >
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> > = text/html
> >
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
> >
> > = true
> >
> > With the default example above, the rewriting xml
> rule
> > files such as
> > default-rewriter-rules.xml and rewriter-rules-mapping
> do
> > not play any role
> > with reverse proxying portlets.
> >
> > The last example in the configuration file still uses
> the
> > Neko and Sax
> > parser adaptor configuation, which was provided for
> the old
> > web content
> > portlets. However, it turns out to be less useful in
> this
> > reverse proxy
> > portlets. (The old rewriting xml rules were mainly
> for
> > rewriting urls to
> > portlet urls, while reverse proxy service is just
> another
> > servlet-based
> > solution with integration to portlet, meaning the url
> > rewriting doesn't
> > need to be that complex any more.)
> >
> > One more tip is that you could test the reverse
> proxying by
> > navigating the
> > proxied urls directly.
> > So, for example, if http://www.yourdomain.com/orders/ is mapped to
> > /j2-admin/rproxy/yourdomain/orders/, then you can
> browse
> > directly to
> > http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> > You can see what
> > happens for rewriting problems with this direct
> access.
> >
> > HTH,
> >
> > Woonsan
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> >
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 6:55 PM
> > > Good to know. So I have rebuilt
> > > my site on 2.2.1 and it seems to be
> > > stable, unlike the previous implementation on
> Derby.
> > > Not sure if that's
> > > an indication of a problem with 2.2.1 &
> Derby, or
> > just
> > > a local issue. My
> > > remaining issue is the rewrite in the reverse
> proxy
> > portlet
> > > is changing a
> > > javascript link ending in .js to .html Any
> > ideas?
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/20/2010 11:50 AM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > I believe the pages can be simply copied because
> I
> > cannot
> > > find anything to
> > > watch with psml pages either.
> > > By the way, you can copy those pages into any
> other
> > folder
> > > by configuring
> > > the path in
> > /jetspeed/WEB-INF/conf/override.properties. For
> > > example,
> > >
> > > # default path to (XML) PSML pages root folder
> > > psml.pages.path =
> > > ${applicationRoot}/WEB-INF/migrated_pages
> > >
> > > Regards,
> > >
> > > Woonsan
> > >
> > > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > >
> > > wrote:
> > >
> > > > From: mballard@oreillyauto.com
> > > <mb...@oreillyauto.com>
> > > > Subject: Re: SSO IFrame form authentication
> > > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > > Date: Friday, August 20, 2010, 3:05 PM
> > > > I have installed 2.2.1 with MySQL and
> > > > I now need to move my pages and
> > > > layouts from the 2.2.0 installation.
> Given
> > that
> > > my
> > > > previous 2.2.1
> > > > installation on Derby is defunct, is there
> > anything I
> > > > should watch out for
> > > > this time? Can I simply copy the psml's
> > from
> > > the
> > > > 2.2.0 directories to the
> > > > 2.2.1 directories? I have not
> > seen a
> > > > migration guide to address this
> > > > need.
> > > >
> > > >
> > > >
> > > > From:
> > > > Woonsan Ko <wo...@yahoo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/18/2010 12:35 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > Hi,
> > > >
> > > > I haven't heard of that preferences data
> problem
> > yet
> > > in
> > > > 2.2.1.
> > > > IMHO, It could help to localize the problems
> if
> > you
> > > test
> > > > against other
> > > > databases
> > > > like PostgreSQL or MySQL.
> > > > On the other hand, I think you could deploy
> > newer
> > > > j2-admin.war and
> > > > apa-webcontent.war which were included in
> 2.2.1.
> > > >
> > > > -Woonsan
> > > >
> > > >
> > > > ----- Original Message ----
> > > > > From: "mballard@oreillyauto.com"
> > > > <mb...@oreillyauto.com>
> > > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > > > Subject: Re: SSO IFrame form
> authentication
> > > > >
> > > > > Well, here's the rub. I believe the
> > > > SSOReverseProxyIFramePortlet is new
> > > >
> > > > > in 2.2.1, which is where I was when I
> first
> > > posted,
> > > > however, I found
> > > > that
> > > > > my configuration kept getting
> scrambled, so
> > I
> > > reverted
> > > > to 2.2.0 I will
> > > > > try your suggestion on 2.2.1, but I
> will
> > have to
> > > > address the scrambling
> > > > > issue. What is happening is
> > this. I
> > > have
> > > > cloned the IFramePortlet
> > > > > several times and configured each for
> > different
> > > static
> > > > content being
> > > > > served from apache2. I have avoided
> > setting
> > > any
> > > > user preferences, and,
> > > >
> > > > > instead, set the preferences for each
> clone
> > in
> > > the
> > > > PAM portlet.
> > > > Everything
> > > > > worked fine. Then after a few hours,
> > the
> > > > IFramePortlet content was all
> > > >
> > > > > mixed up. For instance, the portlet
> on
> >
> > > > page 1 would be showing the
> > > > > content I had configured for the
> portlet on
> > page
> > >
> > > > 2 and so on. I went
> > > > into
> > > > > PAM and corrected the preferences to
> what
> > > they
> > > > should be and assumed I
> > > > was
> > > > > ok, but the next morning things were
> > > scrambled
> > > > again. I did some
> > > > queries
> > > > > in the derby db and it appears they
> > are
> > > wrong
> > > > there. I don't know if
> > > > this
> > > > > is a portlet id issue or an indexing
> > > problem or
> > > > what, but I need a
> > > > > resolution before I can proceed to
> > 2.2.1
> > > > Of course, I have the exact
> > > > same
> > > > > configuration in 2.2.0 and am having
> > no
> > > problem
> > > > there, but I also have
> > > > no
> > > > > SSOReverseProxyIFrame there.
> > Any
> > > ideas?
> > > > >
> > > > >
> > > > >
> > > > > From:
> > > > > David Sean Taylor <d....@onehippo.com>
> > > > > To:
> > > > > Jetspeed Users List <je...@portals.apache.org>
> > > > > Date:
> > > > > 08/17/2010 07:19 PM
> > > > > Subject:
> > > > > Re: SSO IFrame form authentication
> > > > >
> > > > >
> > > > >
> > > > > On Tue, Aug 17, 2010 at 1:40 PM,
> > > <mb...@oreillyauto.com>
> > >
> > > > wrote:
> > > > > > How did your testing go? I
> > compared
> > > SSO
> > > > Webcontent (which works,
> > > > sort
> > > > > of)
> > > > > > to SSO IFrame classes and I see a
> > method
> > > > for preemptive login in the
> > > > > > webcontent class but no reference
> at
> > all in
> > > > the SSO IFrame class.
> > > > Does
> > > > > > this just mean it is being done
> > > > differently, or is something amiss in
> > > >
> > > > > the
> > > > > > SSO IFrame class?
> > > > >
> > > > > There are two SSOIFrame classes:
> > > > >
> > > > > 1. SSOIFramePortlet
> > > > > 2. SSOReverseProxyIFramePortlet
> > > > >
> > > > > Suggest using the second one,
> > > > SSOReverseProxyIFramePortlet as it gives
> > > > > you features not available in the
> > older
> > > > SSOIFramePortlet such as
> > > > > auto-resizing and form-based
> authentication
> >
> > > > (what you are after)
> > > > >
> > > > > I tested with
> SSOReverseProxyIFramePortlet
> > and
> > > > it worked in the
> > > > > example that comes with Jetspeed, but
> it
> > takes a
> > > > little bit of
> > > > > configuration.
> > > > >
> > > > > First, ensure your Tomcat will need
> this
> > > > attribute set in the
> > > > > <Connector> element of
> > server.xml:
> > > > >
> > > > > emptySessionPath="true"
> > > > >
> > > > > more detail here:
> > > > >
> > > > > http://portals.apache.org/applications/webcontent/index.html
> > > > >
> > > > > If you had to change server.xml
> > setting,
> > > then
> > > > restart your server
> > > > >
> > > > > I took these steps to verify SSO
> with
> > the
> > > > example form-based login
> > > > > that comes with Jetspeed:
> > > > >
> > > > > 1. login as admin
> > > > > 2. navigate to the Jetspeed
> Administration
> > > > space, SSO Management page,
> > > > > or just go here:
> > > > >
> > > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > > >
> > > > > Add a new Site with following
> > parameters:
> > > > >
> > > > > Site Name: Form Example
> > > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > > Field name for User ID: user
> > > > > Field name For Password value: pass
> > > > >
> > > > > Press Save
> > > > >
> > > > > Add a new credential for this site
> in
> > the
> > > > portlet on the right side
> > > > > (SSO Details):
> > > > >
> > > > > Portal Principal: admin
> > > > > Remote Principal: admin
> > > > > Remote Credential: admin
> > > > >
> > > > > Press Add
> > > > >
> > > > > You can verify that the remote
> > > credential
> > > > was added for the admin
> > > > > user by going here:
> > > > >
> > > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > > >
> > > > > see the portlet on the right "SSO
> > Change
> > > > Passwords", a remote site
> > > > > entry should be there named "Form
> > Example"
> > > > >
> > > > > Next, you can use the Toolbox to find
> the
> > > > Reverse Proxy Iframe Portlet
> > > > > by searching on "iframe" and then
> selecting
> > it
> > > > from there and adding
> > > > > to a page. To make things simple, I
> just
> > added a
> > > > page and then added
> > > > > the Reverse Proxy Iframe Portlet there.
> At
> > first
> > > this
> > > > portlet seems to
> > > > > want to use Basic Authentication, so
> just
> > hit
> > > cancel
> > > > when challenged.
> > > > > I then switched to edit mode (pencil
> icon),
> > and
> > > > entered the following
> > > > > preferences:
> > > > >
> > > > > TITLE: My SSO Test
> > > > > SRC: http://localhost:$
> > > {serverPort}${contextPath}/examples/formauth.jsp
> > > > >
> > > > > Press Save
> > > > >
> > > > > You should see in your portlet content
> > something
> > >
> > > > like:
> > > > >
> > > > > "Hello, admin. You have been authorized
> by
> > > > form-based authentication
> > > > !!!"
> > > > >
> > > > > Give that a try and see if it works.
> Then,
> > move
> > > on
> > > > to your specific
> > > > > IFrame source and let us know how it
> > > goes...
> > > > >
> > > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail:
> > jetspeed-user-unsubscribe@portals.apache.org
> > > > > For additional commands, e-mail:
> > > jetspeed-user-help@portals.apache.org
> > > > >
> > > > >
> > > > > --
> > > > > This message has been scanned for
> > viruses
> > > and
> > > > > dangerous content by MailScanner,
> and
> > is
> > > > > believed to be clean
> > > > (mailgw2:E659D1E6FC.D1395).
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > This communication and any
> attachments
> > are
> > > > confidential, protected by
> > > > > Communications Privacy Act 18 USCS
> §
> > > 2510,
> > > > solely for the use of the
> > > > > intended recipient, and may contain
> > > legally
> > > > privileged material. If you
> > > >
> > > > > are not the intended recipient, please
>
> > > return or
> > > > destroy it
> > > > immediately.
> > > > > Thank you.
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for viruses
> and
> > > > dangerous content by MailScanner, and is
> > > > believed to be clean
> (mailgw2:9902C1E701.B0EA8).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments are
> > > confidential,
> > > > protected by
> > > > Communications Privacy Act 18 USCS § 2510,
> > solely for
> > > the
> > > > use of the
> > > > intended recipient, and may contain legally
> > > privileged
> > > > material. If you
> > > > are not the intended recipient, please
> return or
> > > destroy it
> > > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> (mailgw2:8B04D2A000C.7088C).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:792FC1E702.4691D).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
I guess the first page which tried to redirect to the second page with wrong url by using javascript.
If it redirects to other page from the server-side with http status code and header, then the reverse proxy service can detect and rewrite to a proxied url from the reverse proxy configurations if found.
Anyway, if the first page has javascript to redirect, e.g., 'location.href = /otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a', that script line is not rewritten by default.
(By the way, you can refer to the default rewriting class here if you're interested in: http://svn.apache.org/repos/asf/portals/applications/webcontent/trunk/webcontent-jar/src/main/java/org/apache/portals/applications/webcontent/proxy/impl/DefaultReverseProxyLinkRewritingParserAaptor.java)
If the redirecting script line is simple, then you can add a custom replace pattern in the reverse proxy configuration like the following example:
proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customPatterns = \\/otrs\\/customer\\.pl
proxy.reverse.pass.issues.rewriter.parserAdaptor.html.property.customReplaces = /j2-admin/rproxy/otrs/otrs/customer.pl
The above additional custom replace configuration will replace every line having that regex pattern.
-Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 8:19 PM
> I am using
> j2-admin::SSOReverseProxyIFramePortlet. I also believe
> I am
> using the exact reverse properties as the apache
> example. I have
> discovered one issue when accessing directly in that it
> appears when I
> enter
> http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl,
>
> and login manually, I am redirected to
> http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
>
> and I get an HTTP 404 error. If I then correct the
> url and put the
> j2-admin/rproxy/otrs back in, I get the correct page
> rendered and I am
> logged in. In any case, once I get logged in and try
> to drill down to an
> incident link, I get an error trying to load the javascript
> because
> something has changed the .js in the link to .html
> Again, I am using the
> apache example config for rewriting.
>
> # ... Set max matching path part count
> proxy.reverse.pass.maxMatchingPathPartCount = 2
>
> # ... Sets detail attributes for apache path mapping
> proxy.reverse.pass = otrs
> proxy.reverse.pass.otrs.local = /otrs/
> proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
> proxy.reverse.pass.otrs.rewriter.basic =
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> proxy.reverse.pass.otrs.rewriter.parserAdaptor = html
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType
> = text/html
> proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
>
> = true
>
> Thanks, MikeB
>
> Mike Ballard
> Director of Internet Development and Networking
> O'Reilly Auto Parts
> (417) 874-7107 Ofc
> (417) 838-0271 Cell
>
> This message is protected by the Electronic Communications
> Privacy Act, 18
> USCS § 2510 et seq., and may not be used, copied or
> forwarded without the
> consent of the named recipient(s). The information
> contained in this
> message is confidential, is intended only for the use of
> the individual or
> entity named. If the reader of this message is not
> the intended
> recipient, you are hereby notified that any dissemination,
> distribution or
> copying of this communication is strictly prohibited.
> If you have
> received this communication in error, please notify me
> immediately at
> 417-874-7107.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 12:55 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Regarding the problem of javascript link ending in .js to
> .html, with
> which portlet do you meet the problem?
> j2-admin::SSOReverseProxyIFramePortlet,
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
> j2-admin::SSOIFramePortlet, j2-admin::SSOWebContentPortlet,
> or
> j2-admin::SSOProxyPortletPortlet?
>
> j2-admin::SSOReverseProxyIFramePortlet and
> j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet only
> are using the
> reverse proxy service.
>
> If you are using those reverse proxy portlets, then how's
> the rewriter
> configurations for the reverse proxy pass mapping in
> /j2-admin/WEB-INF/conf/reverseproxy.properties?
> I'd like to recommend you to use the default configuration
> like the apache
> example:
>
> # ... Sets detail attributes for apache path mapping
> proxy.reverse.pass.apache.local = /apache/
> proxy.reverse.pass.apache.remote = http://apache.org/
> proxy.reverse.pass.apache.rewriter.basic =
> org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
> proxy.reverse.pass.apache.rewriter.parserAdaptor = html
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html =
> org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType
> = text/html
> proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
>
> = true
>
> With the default example above, the rewriting xml rule
> files such as
> default-rewriter-rules.xml and rewriter-rules-mapping do
> not play any role
> with reverse proxying portlets.
>
> The last example in the configuration file still uses the
> Neko and Sax
> parser adaptor configuation, which was provided for the old
> web content
> portlets. However, it turns out to be less useful in this
> reverse proxy
> portlets. (The old rewriting xml rules were mainly for
> rewriting urls to
> portlet urls, while reverse proxy service is just another
> servlet-based
> solution with integration to portlet, meaning the url
> rewriting doesn't
> need to be that complex any more.)
>
> One more tip is that you could test the reverse proxying by
> navigating the
> proxied urls directly.
> So, for example, if http://www.yourdomain.com/orders/ is mapped to
> /j2-admin/rproxy/yourdomain/orders/, then you can browse
> directly to
> http://localhost:8080/j2-admin/rproxy/yourdomain/orders/.
> You can see what
> happens for rewriting problems with this direct access.
>
> HTH,
>
> Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 6:55 PM
> > Good to know. So I have rebuilt
> > my site on 2.2.1 and it seems to be
> > stable, unlike the previous implementation on Derby.
> > Not sure if that's
> > an indication of a problem with 2.2.1 & Derby, or
> just
> > a local issue. My
> > remaining issue is the rewrite in the reverse proxy
> portlet
> > is changing a
> > javascript link ending in .js to .html Any
> ideas?
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/20/2010 11:50 AM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > I believe the pages can be simply copied because I
> cannot
> > find anything to
> > watch with psml pages either.
> > By the way, you can copy those pages into any other
> folder
> > by configuring
> > the path in
> /jetspeed/WEB-INF/conf/override.properties. For
> > example,
> >
> > # default path to (XML) PSML pages root folder
> > psml.pages.path =
> > ${applicationRoot}/WEB-INF/migrated_pages
> >
> > Regards,
> >
> > Woonsan
> >
> > --- On Fri, 8/20/10, mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> >
> > wrote:
> >
> > > From: mballard@oreillyauto.com
> > <mb...@oreillyauto.com>
> > > Subject: Re: SSO IFrame form authentication
> > > To: "Jetspeed Users List" <je...@portals.apache.org>
> > > Date: Friday, August 20, 2010, 3:05 PM
> > > I have installed 2.2.1 with MySQL and
> > > I now need to move my pages and
> > > layouts from the 2.2.0 installation. Given
> that
> > my
> > > previous 2.2.1
> > > installation on Derby is defunct, is there
> anything I
> > > should watch out for
> > > this time? Can I simply copy the psml's
> from
> > the
> > > 2.2.0 directories to the
> > > 2.2.1 directories? I have not
> seen a
> > > migration guide to address this
> > > need.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/18/2010 12:35 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Hi,
> > >
> > > I haven't heard of that preferences data problem
> yet
> > in
> > > 2.2.1.
> > > IMHO, It could help to localize the problems if
> you
> > test
> > > against other
> > > databases
> > > like PostgreSQL or MySQL.
> > > On the other hand, I think you could deploy
> newer
> > > j2-admin.war and
> > > apa-webcontent.war which were included in 2.2.1.
> > >
> > > -Woonsan
> > >
> > >
> > > ----- Original Message ----
> > > > From: "mballard@oreillyauto.com"
> > > <mb...@oreillyauto.com>
> > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > > Subject: Re: SSO IFrame form authentication
> > > >
> > > > Well, here's the rub. I believe the
> > > SSOReverseProxyIFramePortlet is new
> > >
> > > > in 2.2.1, which is where I was when I first
> > posted,
> > > however, I found
> > > that
> > > > my configuration kept getting scrambled, so
> I
> > reverted
> > > to 2.2.0 I will
> > > > try your suggestion on 2.2.1, but I will
> have to
> > > address the scrambling
> > > > issue. What is happening is
> this. I
> > have
> > > cloned the IFramePortlet
> > > > several times and configured each for
> different
> > static
> > > content being
> > > > served from apache2. I have avoided
> setting
> > any
> > > user preferences, and,
> > >
> > > > instead, set the preferences for each clone
> in
> > the
> > > PAM portlet.
> > > Everything
> > > > worked fine. Then after a few hours,
> the
> > > IFramePortlet content was all
> > >
> > > > mixed up. For instance, the portlet on
>
> > > page 1 would be showing the
> > > > content I had configured for the portlet on
> page
> >
> > > 2 and so on. I went
> > > into
> > > > PAM and corrected the preferences to what
> > they
> > > should be and assumed I
> > > was
> > > > ok, but the next morning things were
> > scrambled
> > > again. I did some
> > > queries
> > > > in the derby db and it appears they
> are
> > wrong
> > > there. I don't know if
> > > this
> > > > is a portlet id issue or an indexing
> > problem or
> > > what, but I need a
> > > > resolution before I can proceed to
> 2.2.1
> > > Of course, I have the exact
> > > same
> > > > configuration in 2.2.0 and am having
> no
> > problem
> > > there, but I also have
> > > no
> > > > SSOReverseProxyIFrame there.
> Any
> > ideas?
> > > >
> > > >
> > > >
> > > > From:
> > > > David Sean Taylor <d....@onehippo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/17/2010 07:19 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > On Tue, Aug 17, 2010 at 1:40 PM,
> > <mb...@oreillyauto.com>
> >
> > > wrote:
> > > > > How did your testing go? I
> compared
> > SSO
> > > Webcontent (which works,
> > > sort
> > > > of)
> > > > > to SSO IFrame classes and I see a
> method
> > > for preemptive login in the
> > > > > webcontent class but no reference at
> all in
> > > the SSO IFrame class.
> > > Does
> > > > > this just mean it is being done
> > > differently, or is something amiss in
> > >
> > > > the
> > > > > SSO IFrame class?
> > > >
> > > > There are two SSOIFrame classes:
> > > >
> > > > 1. SSOIFramePortlet
> > > > 2. SSOReverseProxyIFramePortlet
> > > >
> > > > Suggest using the second one,
> > > SSOReverseProxyIFramePortlet as it gives
> > > > you features not available in the
> older
> > > SSOIFramePortlet such as
> > > > auto-resizing and form-based authentication
>
> > > (what you are after)
> > > >
> > > > I tested with SSOReverseProxyIFramePortlet
> and
> > > it worked in the
> > > > example that comes with Jetspeed, but it
> takes a
> > > little bit of
> > > > configuration.
> > > >
> > > > First, ensure your Tomcat will need this
> > > attribute set in the
> > > > <Connector> element of
> server.xml:
> > > >
> > > > emptySessionPath="true"
> > > >
> > > > more detail here:
> > > >
> > > > http://portals.apache.org/applications/webcontent/index.html
> > > >
> > > > If you had to change server.xml
> setting,
> > then
> > > restart your server
> > > >
> > > > I took these steps to verify SSO with
> the
> > > example form-based login
> > > > that comes with Jetspeed:
> > > >
> > > > 1. login as admin
> > > > 2. navigate to the Jetspeed Administration
> > > space, SSO Management page,
> > > > or just go here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > >
> > > > Add a new Site with following
> parameters:
> > > >
> > > > Site Name: Form Example
> > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > Field name for User ID: user
> > > > Field name For Password value: pass
> > > >
> > > > Press Save
> > > >
> > > > Add a new credential for this site in
> the
> > > portlet on the right side
> > > > (SSO Details):
> > > >
> > > > Portal Principal: admin
> > > > Remote Principal: admin
> > > > Remote Credential: admin
> > > >
> > > > Press Add
> > > >
> > > > You can verify that the remote
> > credential
> > > was added for the admin
> > > > user by going here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > >
> > > > see the portlet on the right "SSO
> Change
> > > Passwords", a remote site
> > > > entry should be there named "Form
> Example"
> > > >
> > > > Next, you can use the Toolbox to find the
> > > Reverse Proxy Iframe Portlet
> > > > by searching on "iframe" and then selecting
> it
> > > from there and adding
> > > > to a page. To make things simple, I just
> added a
> > > page and then added
> > > > the Reverse Proxy Iframe Portlet there. At
> first
> > this
> > > portlet seems to
> > > > want to use Basic Authentication, so just
> hit
> > cancel
> > > when challenged.
> > > > I then switched to edit mode (pencil icon),
> and
> > > entered the following
> > > > preferences:
> > > >
> > > > TITLE: My SSO Test
> > > > SRC: http://localhost:$
> > {serverPort}${contextPath}/examples/formauth.jsp
> > > >
> > > > Press Save
> > > >
> > > > You should see in your portlet content
> something
> >
> > > like:
> > > >
> > > > "Hello, admin. You have been authorized by
> > > form-based authentication
> > > !!!"
> > > >
> > > > Give that a try and see if it works. Then,
> move
> > on
> > > to your specific
> > > > IFrame source and let us know how it
> > goes...
> > > >
> > > >
> > >
> >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands, e-mail:
> > jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned for
> viruses
> > and
> > > > dangerous content by MailScanner, and
> is
> > > > believed to be clean
> > > (mailgw2:E659D1E6FC.D1395).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments
> are
> > > confidential, protected by
> > > > Communications Privacy Act 18 USCS §
> > 2510,
> > > solely for the use of the
> > > > intended recipient, and may contain
> > legally
> > > privileged material. If you
> > >
> > > > are not the intended recipient, please
> > return or
> > > destroy it
> > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:9902C1E701.B0EA8).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential,
> > > protected by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for
> > the
> > > use of the
> > > intended recipient, and may contain legally
> > privileged
> > > material. If you
> > > are not the intended recipient, please return or
> > destroy it
> > > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:8B04D2A000C.7088C).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:792FC1E702.4691D).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
I am using j2-admin::SSOReverseProxyIFramePortlet. I also believe I am
using the exact reverse properties as the apache example. I have
discovered one issue when accessing directly in that it appears when I
enter
http://host.domain-name.com:8080/j2-admin/rproxy/otrs/otrs/customer.pl,
and login manually, I am redirected to
http://host.domain-name.com:8080/otrs/customer.pl?CSID=1047f4e2a54420bc329c4f2e3cd511e23a
and I get an HTTP 404 error. If I then correct the url and put the
j2-admin/rproxy/otrs back in, I get the correct page rendered and I am
logged in. In any case, once I get logged in and try to drill down to an
incident link, I get an error trying to load the javascript because
something has changed the .js in the link to .html Again, I am using the
apache example config for rewriting.
# ... Set max matching path part count
proxy.reverse.pass.maxMatchingPathPartCount = 2
# ... Sets detail attributes for apache path mapping
proxy.reverse.pass = otrs
proxy.reverse.pass.otrs.local = /otrs/
proxy.reverse.pass.otrs.remote = http://host.domain-name.com/
proxy.reverse.pass.otrs.rewriter.basic =
org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
proxy.reverse.pass.otrs.rewriter.parserAdaptor = html
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html =
org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.mimeType = text/html
proxy.reverse.pass.otrs.rewriter.parserAdaptor.html.property.lookUpAllMappings
= true
Thanks, MikeB
Mike Ballard
Director of Internet Development and Networking
O'Reilly Auto Parts
(417) 874-7107 Ofc
(417) 838-0271 Cell
This message is protected by the Electronic Communications Privacy Act, 18
USCS § 2510 et seq., and may not be used, copied or forwarded without the
consent of the named recipient(s). The information contained in this
message is confidential, is intended only for the use of the individual or
entity named. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution or
copying of this communication is strictly prohibited. If you have
received this communication in error, please notify me immediately at
417-874-7107.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/20/2010 12:55 PM
Subject:
Re: SSO IFrame form authentication
Regarding the problem of javascript link ending in .js to .html, with
which portlet do you meet the problem?
j2-admin::SSOReverseProxyIFramePortlet,
j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet,
j2-admin::SSOIFramePortlet, j2-admin::SSOWebContentPortlet, or
j2-admin::SSOProxyPortletPortlet?
j2-admin::SSOReverseProxyIFramePortlet and
j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet only are using the
reverse proxy service.
If you are using those reverse proxy portlets, then how's the rewriter
configurations for the reverse proxy pass mapping in
/j2-admin/WEB-INF/conf/reverseproxy.properties?
I'd like to recommend you to use the default configuration like the apache
example:
# ... Sets detail attributes for apache path mapping
proxy.reverse.pass.apache.local = /apache/
proxy.reverse.pass.apache.remote = http://apache.org/
proxy.reverse.pass.apache.rewriter.basic =
org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
proxy.reverse.pass.apache.rewriter.parserAdaptor = html
proxy.reverse.pass.apache.rewriter.parserAdaptor.html =
org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType = text/html
proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings
= true
With the default example above, the rewriting xml rule files such as
default-rewriter-rules.xml and rewriter-rules-mapping do not play any role
with reverse proxying portlets.
The last example in the configuration file still uses the Neko and Sax
parser adaptor configuation, which was provided for the old web content
portlets. However, it turns out to be less useful in this reverse proxy
portlets. (The old rewriting xml rules were mainly for rewriting urls to
portlet urls, while reverse proxy service is just another servlet-based
solution with integration to portlet, meaning the url rewriting doesn't
need to be that complex any more.)
One more tip is that you could test the reverse proxying by navigating the
proxied urls directly.
So, for example, if http://www.yourdomain.com/orders/ is mapped to
/j2-admin/rproxy/yourdomain/orders/, then you can browse directly to
http://localhost:8080/j2-admin/rproxy/yourdomain/orders/. You can see what
happens for rewriting problems with this direct access.
HTH,
Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 6:55 PM
> Good to know. So I have rebuilt
> my site on 2.2.1 and it seems to be
> stable, unlike the previous implementation on Derby.
> Not sure if that's
> an indication of a problem with 2.2.1 & Derby, or just
> a local issue. My
> remaining issue is the rewrite in the reverse proxy portlet
> is changing a
> javascript link ending in .js to .html Any ideas?
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 11:50 AM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I believe the pages can be simply copied because I cannot
> find anything to
> watch with psml pages either.
> By the way, you can copy those pages into any other folder
> by configuring
> the path in /jetspeed/WEB-INF/conf/override.properties. For
> example,
>
> # default path to (XML) PSML pages root folder
> psml.pages.path =
> ${applicationRoot}/WEB-INF/migrated_pages
>
> Regards,
>
> Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 3:05 PM
> > I have installed 2.2.1 with MySQL and
> > I now need to move my pages and
> > layouts from the 2.2.0 installation. Given that
> my
> > previous 2.2.1
> > installation on Derby is defunct, is there anything I
> > should watch out for
> > this time? Can I simply copy the psml's from
> the
> > 2.2.0 directories to the
> > 2.2.1 directories? I have not seen a
> > migration guide to address this
> > need.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:35 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > I haven't heard of that preferences data problem yet
> in
> > 2.2.1.
> > IMHO, It could help to localize the problems if you
> test
> > against other
> > databases
> > like PostgreSQL or MySQL.
> > On the other hand, I think you could deploy newer
> > j2-admin.war and
> > apa-webcontent.war which were included in 2.2.1.
> >
> > -Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> > <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > Well, here's the rub. I believe the
> > SSOReverseProxyIFramePortlet is new
> >
> > > in 2.2.1, which is where I was when I first
> posted,
> > however, I found
> > that
> > > my configuration kept getting scrambled, so I
> reverted
> > to 2.2.0 I will
> > > try your suggestion on 2.2.1, but I will have to
> > address the scrambling
> > > issue. What is happening is this. I
> have
> > cloned the IFramePortlet
> > > several times and configured each for different
> static
> > content being
> > > served from apache2. I have avoided setting
> any
> > user preferences, and,
> >
> > > instead, set the preferences for each clone in
> the
> > PAM portlet.
> > Everything
> > > worked fine. Then after a few hours, the
> > IFramePortlet content was all
> >
> > > mixed up. For instance, the portlet on
> > page 1 would be showing the
> > > content I had configured for the portlet on page
>
> > 2 and so on. I went
> > into
> > > PAM and corrected the preferences to what
> they
> > should be and assumed I
> > was
> > > ok, but the next morning things were
> scrambled
> > again. I did some
> > queries
> > > in the derby db and it appears they are
> wrong
> > there. I don't know if
> > this
> > > is a portlet id issue or an indexing
> problem or
> > what, but I need a
> > > resolution before I can proceed to 2.2.1
> > Of course, I have the exact
> > same
> > > configuration in 2.2.0 and am having no
> problem
> > there, but I also have
> > no
> > > SSOReverseProxyIFrame there. Any
> ideas?
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM,
> <mb...@oreillyauto.com>
>
> > wrote:
> > > > How did your testing go? I compared
> SSO
> > Webcontent (which works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method
> > for preemptive login in the
> > > > webcontent class but no reference at all in
> > the SSO IFrame class.
> > Does
> > > > this just mean it is being done
> > differently, or is something amiss in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one,
> > SSOReverseProxyIFramePortlet as it gives
> > > you features not available in the older
> > SSOIFramePortlet such as
> > > auto-resizing and form-based authentication
> > (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and
> > it worked in the
> > > example that comes with Jetspeed, but it takes a
> > little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this
> > attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting,
> then
> > restart your server
> > >
> > > I took these steps to verify SSO with the
> > example form-based login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration
> > space, SSO Management page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the
> > portlet on the right side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote
> credential
> > was added for the admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change
> > Passwords", a remote site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the
> > Reverse Proxy Iframe Portlet
> > > by searching on "iframe" and then selecting it
> > from there and adding
> > > to a page. To make things simple, I just added a
> > page and then added
> > > the Reverse Proxy Iframe Portlet there. At first
> this
> > portlet seems to
> > > want to use Basic Authentication, so just hit
> cancel
> > when challenged.
> > > I then switched to edit mode (pencil icon), and
> > entered the following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something
>
> > like:
> > >
> > > "Hello, admin. You have been authorized by
> > form-based authentication
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move
> on
> > to your specific
> > > IFrame source and let us know how it
> goes...
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses
> and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> > (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential, protected by
> > > Communications Privacy Act 18 USCS §
> 2510,
> > solely for the use of the
> > > intended recipient, and may contain
> legally
> > privileged material. If you
> >
> > > are not the intended recipient, please
> return or
> > destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:9902C1E701.B0EA8).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:8B04D2A000C.7088C).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:792FC1E702.4691D).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Regarding the problem of javascript link ending in .js to .html, with which portlet do you meet the problem?
j2-admin::SSOReverseProxyIFramePortlet, j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet, j2-admin::SSOIFramePortlet, j2-admin::SSOWebContentPortlet, or j2-admin::SSOProxyPortletPortlet?
j2-admin::SSOReverseProxyIFramePortlet and j2-admin::SSOFormBasedAuthReverseProxyIFramePortlet only are using the reverse proxy service.
If you are using those reverse proxy portlets, then how's the rewriter configurations for the reverse proxy pass mapping in /j2-admin/WEB-INF/conf/reverseproxy.properties?
I'd like to recommend you to use the default configuration like the apache example:
# ... Sets detail attributes for apache path mapping
proxy.reverse.pass.apache.local = /apache/
proxy.reverse.pass.apache.remote = http://apache.org/
proxy.reverse.pass.apache.rewriter.basic = org.apache.portals.applications.webcontent.rewriter.WebContentRewriter
proxy.reverse.pass.apache.rewriter.parserAdaptor = html
proxy.reverse.pass.apache.rewriter.parserAdaptor.html = org.apache.portals.applications.webcontent.proxy.impl.DefaultReverseProxyLinkRewritingParserAaptor
proxy.reverse.pass.apache.rewriter.parserAdaptor.html.mimeType = text/html
proxy.reverse.pass.apache.rewriter.parserAdaptor.html.property.lookUpAllMappings = true
With the default example above, the rewriting xml rule files such as default-rewriter-rules.xml and rewriter-rules-mapping do not play any role with reverse proxying portlets.
The last example in the configuration file still uses the Neko and Sax parser adaptor configuation, which was provided for the old web content portlets. However, it turns out to be less useful in this reverse proxy portlets. (The old rewriting xml rules were mainly for rewriting urls to portlet urls, while reverse proxy service is just another servlet-based solution with integration to portlet, meaning the url rewriting doesn't need to be that complex any more.)
One more tip is that you could test the reverse proxying by navigating the proxied urls directly.
So, for example, if http://www.yourdomain.com/orders/ is mapped to /j2-admin/rproxy/yourdomain/orders/, then you can browse directly to http://localhost:8080/j2-admin/rproxy/yourdomain/orders/. You can see what happens for rewriting problems with this direct access.
HTH,
Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 6:55 PM
> Good to know. So I have rebuilt
> my site on 2.2.1 and it seems to be
> stable, unlike the previous implementation on Derby.
> Not sure if that's
> an indication of a problem with 2.2.1 & Derby, or just
> a local issue. My
> remaining issue is the rewrite in the reverse proxy portlet
> is changing a
> javascript link ending in .js to .html Any ideas?
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/20/2010 11:50 AM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> I believe the pages can be simply copied because I cannot
> find anything to
> watch with psml pages either.
> By the way, you can copy those pages into any other folder
> by configuring
> the path in /jetspeed/WEB-INF/conf/override.properties. For
> example,
>
> # default path to (XML) PSML pages root folder
> psml.pages.path =
> ${applicationRoot}/WEB-INF/migrated_pages
>
> Regards,
>
> Woonsan
>
> --- On Fri, 8/20/10, mballard@oreillyauto.com
> <mb...@oreillyauto.com>
>
> wrote:
>
> > From: mballard@oreillyauto.com
> <mb...@oreillyauto.com>
> > Subject: Re: SSO IFrame form authentication
> > To: "Jetspeed Users List" <je...@portals.apache.org>
> > Date: Friday, August 20, 2010, 3:05 PM
> > I have installed 2.2.1 with MySQL and
> > I now need to move my pages and
> > layouts from the 2.2.0 installation. Given that
> my
> > previous 2.2.1
> > installation on Derby is defunct, is there anything I
> > should watch out for
> > this time? Can I simply copy the psml's from
> the
> > 2.2.0 directories to the
> > 2.2.1 directories? I have not seen a
> > migration guide to address this
> > need.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:35 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > I haven't heard of that preferences data problem yet
> in
> > 2.2.1.
> > IMHO, It could help to localize the problems if you
> test
> > against other
> > databases
> > like PostgreSQL or MySQL.
> > On the other hand, I think you could deploy newer
> > j2-admin.war and
> > apa-webcontent.war which were included in 2.2.1.
> >
> > -Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> > <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 6:10:25 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > Well, here's the rub. I believe the
> > SSOReverseProxyIFramePortlet is new
> >
> > > in 2.2.1, which is where I was when I first
> posted,
> > however, I found
> > that
> > > my configuration kept getting scrambled, so I
> reverted
> > to 2.2.0 I will
> > > try your suggestion on 2.2.1, but I will have to
> > address the scrambling
> > > issue. What is happening is this. I
> have
> > cloned the IFramePortlet
> > > several times and configured each for different
> static
> > content being
> > > served from apache2. I have avoided setting
> any
> > user preferences, and,
> >
> > > instead, set the preferences for each clone in
> the
> > PAM portlet.
> > Everything
> > > worked fine. Then after a few hours, the
> > IFramePortlet content was all
> >
> > > mixed up. For instance, the portlet on
> > page 1 would be showing the
> > > content I had configured for the portlet on page
>
> > 2 and so on. I went
> > into
> > > PAM and corrected the preferences to what
> they
> > should be and assumed I
> > was
> > > ok, but the next morning things were
> scrambled
> > again. I did some
> > queries
> > > in the derby db and it appears they are
> wrong
> > there. I don't know if
> > this
> > > is a portlet id issue or an indexing
> problem or
> > what, but I need a
> > > resolution before I can proceed to 2.2.1
> > Of course, I have the exact
> > same
> > > configuration in 2.2.0 and am having no
> problem
> > there, but I also have
> > no
> > > SSOReverseProxyIFrame there. Any
> ideas?
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM,
> <mb...@oreillyauto.com>
>
> > wrote:
> > > > How did your testing go? I compared
> SSO
> > Webcontent (which works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method
> > for preemptive login in the
> > > > webcontent class but no reference at all in
> > the SSO IFrame class.
> > Does
> > > > this just mean it is being done
> > differently, or is something amiss in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one,
> > SSOReverseProxyIFramePortlet as it gives
> > > you features not available in the older
> > SSOIFramePortlet such as
> > > auto-resizing and form-based authentication
> > (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and
> > it worked in the
> > > example that comes with Jetspeed, but it takes a
> > little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this
> > attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting,
> then
> > restart your server
> > >
> > > I took these steps to verify SSO with the
> > example form-based login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration
> > space, SSO Management page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the
> > portlet on the right side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote
> credential
> > was added for the admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change
> > Passwords", a remote site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the
> > Reverse Proxy Iframe Portlet
> > > by searching on "iframe" and then selecting it
> > from there and adding
> > > to a page. To make things simple, I just added a
> > page and then added
> > > the Reverse Proxy Iframe Portlet there. At first
> this
> > portlet seems to
> > > want to use Basic Authentication, so just hit
> cancel
> > when challenged.
> > > I then switched to edit mode (pencil icon), and
> > entered the following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something
>
> > like:
> > >
> > > "Hello, admin. You have been authorized by
> > form-based authentication
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move
> on
> > to your specific
> > > IFrame source and let us know how it
> goes...
> > >
> > >
> >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses
> and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> > (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> > confidential, protected by
> > > Communications Privacy Act 18 USCS §
> 2510,
> > solely for the use of the
> > > intended recipient, and may contain
> legally
> > privileged material. If you
> >
> > > are not the intended recipient, please
> return or
> > destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:9902C1E701.B0EA8).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential,
> > protected by
> > Communications Privacy Act 18 USCS § 2510, solely for
> the
> > use of the
> > intended recipient, and may contain legally
> privileged
> > material. If you
> > are not the intended recipient, please return or
> destroy it
> > immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:8B04D2A000C.7088C).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Good to know. So I have rebuilt my site on 2.2.1 and it seems to be
stable, unlike the previous implementation on Derby. Not sure if that's
an indication of a problem with 2.2.1 & Derby, or just a local issue. My
remaining issue is the rewrite in the reverse proxy portlet is changing a
javascript link ending in .js to .html Any ideas?
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/20/2010 11:50 AM
Subject:
Re: SSO IFrame form authentication
I believe the pages can be simply copied because I cannot find anything to
watch with psml pages either.
By the way, you can copy those pages into any other folder by configuring
the path in /jetspeed/WEB-INF/conf/override.properties. For example,
# default path to (XML) PSML pages root folder
psml.pages.path = ${applicationRoot}/WEB-INF/migrated_pages
Regards,
Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 3:05 PM
> I have installed 2.2.1 with MySQL and
> I now need to move my pages and
> layouts from the 2.2.0 installation. Given that my
> previous 2.2.1
> installation on Derby is defunct, is there anything I
> should watch out for
> this time? Can I simply copy the psml's from the
> 2.2.0 directories to the
> 2.2.1 directories? I have not seen a
> migration guide to address this
> need.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 12:35 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Hi,
>
> I haven't heard of that preferences data problem yet in
> 2.2.1.
> IMHO, It could help to localize the problems if you test
> against other
> databases
> like PostgreSQL or MySQL.
> On the other hand, I think you could deploy newer
> j2-admin.war and
> apa-webcontent.war which were included in 2.2.1.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 6:10:25 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, here's the rub. I believe the
> SSOReverseProxyIFramePortlet is new
>
> > in 2.2.1, which is where I was when I first posted,
> however, I found
> that
> > my configuration kept getting scrambled, so I reverted
> to 2.2.0 I will
> > try your suggestion on 2.2.1, but I will have to
> address the scrambling
> > issue. What is happening is this. I have
> cloned the IFramePortlet
> > several times and configured each for different static
> content being
> > served from apache2. I have avoided setting any
> user preferences, and,
>
> > instead, set the preferences for each clone in the
> PAM portlet.
> Everything
> > worked fine. Then after a few hours, the
> IFramePortlet content was all
>
> > mixed up. For instance, the portlet on
> page 1 would be showing the
> > content I had configured for the portlet on page
> 2 and so on. I went
> into
> > PAM and corrected the preferences to what they
> should be and assumed I
> was
> > ok, but the next morning things were scrambled
> again. I did some
> queries
> > in the derby db and it appears they are wrong
> there. I don't know if
> this
> > is a portlet id issue or an indexing problem or
> what, but I need a
> > resolution before I can proceed to 2.2.1
> Of course, I have the exact
> same
> > configuration in 2.2.0 and am having no problem
> there, but I also have
> no
> > SSOReverseProxyIFrame there. Any ideas?
> >
> >
> >
> > From:
> > David Sean Taylor <d....@onehippo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/17/2010 07:19 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com>
> wrote:
> > > How did your testing go? I compared SSO
> Webcontent (which works,
> sort
> > of)
> > > to SSO IFrame classes and I see a method
> for preemptive login in the
> > > webcontent class but no reference at all in
> the SSO IFrame class.
> Does
> > > this just mean it is being done
> differently, or is something amiss in
>
> > the
> > > SSO IFrame class?
> >
> > There are two SSOIFrame classes:
> >
> > 1. SSOIFramePortlet
> > 2. SSOReverseProxyIFramePortlet
> >
> > Suggest using the second one,
> SSOReverseProxyIFramePortlet as it gives
> > you features not available in the older
> SSOIFramePortlet such as
> > auto-resizing and form-based authentication
> (what you are after)
> >
> > I tested with SSOReverseProxyIFramePortlet and
> it worked in the
> > example that comes with Jetspeed, but it takes a
> little bit of
> > configuration.
> >
> > First, ensure your Tomcat will need this
> attribute set in the
> > <Connector> element of server.xml:
> >
> > emptySessionPath="true"
> >
> > more detail here:
> >
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > If you had to change server.xml setting, then
> restart your server
> >
> > I took these steps to verify SSO with the
> example form-based login
> > that comes with Jetspeed:
> >
> > 1. login as admin
> > 2. navigate to the Jetspeed Administration
> space, SSO Management page,
> > or just go here:
> >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> >
> > Add a new Site with following parameters:
> >
> > Site Name: Form Example
> > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > Field name for User ID: user
> > Field name For Password value: pass
> >
> > Press Save
> >
> > Add a new credential for this site in the
> portlet on the right side
> > (SSO Details):
> >
> > Portal Principal: admin
> > Remote Principal: admin
> > Remote Credential: admin
> >
> > Press Add
> >
> > You can verify that the remote credential
> was added for the admin
> > user by going here:
> >
> > http://localhost:8080/jetspeed/ui/my-account.psml
> >
> > see the portlet on the right "SSO Change
> Passwords", a remote site
> > entry should be there named "Form Example"
> >
> > Next, you can use the Toolbox to find the
> Reverse Proxy Iframe Portlet
> > by searching on "iframe" and then selecting it
> from there and adding
> > to a page. To make things simple, I just added a
> page and then added
> > the Reverse Proxy Iframe Portlet there. At first this
> portlet seems to
> > want to use Basic Authentication, so just hit cancel
> when challenged.
> > I then switched to edit mode (pencil icon), and
> entered the following
> > preferences:
> >
> > TITLE: My SSO Test
> > SRC: http://localhost:$
{serverPort}${contextPath}/examples/formauth.jsp
> >
> > Press Save
> >
> > You should see in your portlet content something
> like:
> >
> > "Hello, admin. You have been authorized by
> form-based authentication
> !!!"
> >
> > Give that a try and see if it works. Then, move on
> to your specific
> > IFrame source and let us know how it goes...
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean
> (mailgw2:E659D1E6FC.D1395).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential, protected by
> > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
> > intended recipient, and may contain legally
> privileged material. If you
>
> > are not the intended recipient, please return or
> destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:9902C1E701.B0EA8).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:8B04D2A000C.7088C).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
I believe the pages can be simply copied because I cannot find anything to watch with psml pages either.
By the way, you can copy those pages into any other folder by configuring the path in /jetspeed/WEB-INF/conf/override.properties. For example,
# default path to (XML) PSML pages root folder
psml.pages.path = ${applicationRoot}/WEB-INF/migrated_pages
Regards,
Woonsan
--- On Fri, 8/20/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Friday, August 20, 2010, 3:05 PM
> I have installed 2.2.1 with MySQL and
> I now need to move my pages and
> layouts from the 2.2.0 installation. Given that my
> previous 2.2.1
> installation on Derby is defunct, is there anything I
> should watch out for
> this time? Can I simply copy the psml's from the
> 2.2.0 directories to the
> 2.2.1 directories? I have not seen a
> migration guide to address this
> need.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 12:35 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Hi,
>
> I haven't heard of that preferences data problem yet in
> 2.2.1.
> IMHO, It could help to localize the problems if you test
> against other
> databases
> like PostgreSQL or MySQL.
> On the other hand, I think you could deploy newer
> j2-admin.war and
> apa-webcontent.war which were included in 2.2.1.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 6:10:25 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, here's the rub. I believe the
> SSOReverseProxyIFramePortlet is new
>
> > in 2.2.1, which is where I was when I first posted,
> however, I found
> that
> > my configuration kept getting scrambled, so I reverted
> to 2.2.0 I will
> > try your suggestion on 2.2.1, but I will have to
> address the scrambling
> > issue. What is happening is this. I have
> cloned the IFramePortlet
> > several times and configured each for different static
> content being
> > served from apache2. I have avoided setting any
> user preferences, and,
>
> > instead, set the preferences for each clone in the
> PAM portlet.
> Everything
> > worked fine. Then after a few hours, the
> IFramePortlet content was all
>
> > mixed up. For instance, the portlet on
> page 1 would be showing the
> > content I had configured for the portlet on page
> 2 and so on. I went
> into
> > PAM and corrected the preferences to what they
> should be and assumed I
> was
> > ok, but the next morning things were scrambled
> again. I did some
> queries
> > in the derby db and it appears they are wrong
> there. I don't know if
> this
> > is a portlet id issue or an indexing problem or
> what, but I need a
> > resolution before I can proceed to 2.2.1
> Of course, I have the exact
> same
> > configuration in 2.2.0 and am having no problem
> there, but I also have
> no
> > SSOReverseProxyIFrame there. Any ideas?
> >
> >
> >
> > From:
> > David Sean Taylor <d....@onehippo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/17/2010 07:19 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com>
> wrote:
> > > How did your testing go? I compared SSO
> Webcontent (which works,
> sort
> > of)
> > > to SSO IFrame classes and I see a method
> for preemptive login in the
> > > webcontent class but no reference at all in
> the SSO IFrame class.
> Does
> > > this just mean it is being done
> differently, or is something amiss in
>
> > the
> > > SSO IFrame class?
> >
> > There are two SSOIFrame classes:
> >
> > 1. SSOIFramePortlet
> > 2. SSOReverseProxyIFramePortlet
> >
> > Suggest using the second one,
> SSOReverseProxyIFramePortlet as it gives
> > you features not available in the older
> SSOIFramePortlet such as
> > auto-resizing and form-based authentication
> (what you are after)
> >
> > I tested with SSOReverseProxyIFramePortlet and
> it worked in the
> > example that comes with Jetspeed, but it takes a
> little bit of
> > configuration.
> >
> > First, ensure your Tomcat will need this
> attribute set in the
> > <Connector> element of server.xml:
> >
> > emptySessionPath="true"
> >
> > more detail here:
> >
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > If you had to change server.xml setting, then
> restart your server
> >
> > I took these steps to verify SSO with the
> example form-based login
> > that comes with Jetspeed:
> >
> > 1. login as admin
> > 2. navigate to the Jetspeed Administration
> space, SSO Management page,
> > or just go here:
> >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> >
> > Add a new Site with following parameters:
> >
> > Site Name: Form Example
> > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > Field name for User ID: user
> > Field name For Password value: pass
> >
> > Press Save
> >
> > Add a new credential for this site in the
> portlet on the right side
> > (SSO Details):
> >
> > Portal Principal: admin
> > Remote Principal: admin
> > Remote Credential: admin
> >
> > Press Add
> >
> > You can verify that the remote credential
> was added for the admin
> > user by going here:
> >
> > http://localhost:8080/jetspeed/ui/my-account.psml
> >
> > see the portlet on the right "SSO Change
> Passwords", a remote site
> > entry should be there named "Form Example"
> >
> > Next, you can use the Toolbox to find the
> Reverse Proxy Iframe Portlet
> > by searching on "iframe" and then selecting it
> from there and adding
> > to a page. To make things simple, I just added a
> page and then added
> > the Reverse Proxy Iframe Portlet there. At first this
> portlet seems to
> > want to use Basic Authentication, so just hit cancel
> when challenged.
> > I then switched to edit mode (pencil icon), and
> entered the following
> > preferences:
> >
> > TITLE: My SSO Test
> > SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
> >
> > Press Save
> >
> > You should see in your portlet content something
> like:
> >
> > "Hello, admin. You have been authorized by
> form-based authentication
> !!!"
> >
> > Give that a try and see if it works. Then, move on
> to your specific
> > IFrame source and let us know how it goes...
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean
> (mailgw2:E659D1E6FC.D1395).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential, protected by
> > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
> > intended recipient, and may contain legally
> privileged material. If you
>
> > are not the intended recipient, please return or
> destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:9902C1E701.B0EA8).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
I have installed 2.2.1 with MySQL and I now need to move my pages and
layouts from the 2.2.0 installation. Given that my previous 2.2.1
installation on Derby is defunct, is there anything I should watch out for
this time? Can I simply copy the psml's from the 2.2.0 directories to the
2.2.1 directories? I have not seen a migration guide to address this
need.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/18/2010 12:35 PM
Subject:
Re: SSO IFrame form authentication
Hi,
I haven't heard of that preferences data problem yet in 2.2.1.
IMHO, It could help to localize the problems if you test against other
databases
like PostgreSQL or MySQL.
On the other hand, I think you could deploy newer j2-admin.war and
apa-webcontent.war which were included in 2.2.1.
-Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 6:10:25 AM
> Subject: Re: SSO IFrame form authentication
>
> Well, here's the rub. I believe the SSOReverseProxyIFramePortlet is new
> in 2.2.1, which is where I was when I first posted, however, I found
that
> my configuration kept getting scrambled, so I reverted to 2.2.0 I will
> try your suggestion on 2.2.1, but I will have to address the scrambling
> issue. What is happening is this. I have cloned the IFramePortlet
> several times and configured each for different static content being
> served from apache2. I have avoided setting any user preferences, and,
> instead, set the preferences for each clone in the PAM portlet.
Everything
> worked fine. Then after a few hours, the IFramePortlet content was all
> mixed up. For instance, the portlet on page 1 would be showing the
> content I had configured for the portlet on page 2 and so on. I went
into
> PAM and corrected the preferences to what they should be and assumed I
was
> ok, but the next morning things were scrambled again. I did some
queries
> in the derby db and it appears they are wrong there. I don't know if
this
> is a portlet id issue or an indexing problem or what, but I need a
> resolution before I can proceed to 2.2.1 Of course, I have the exact
same
> configuration in 2.2.0 and am having no problem there, but I also have
no
> SSOReverseProxyIFrame there. Any ideas?
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/17/2010 07:19 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > How did your testing go? I compared SSO Webcontent (which works,
sort
> of)
> > to SSO IFrame classes and I see a method for preemptive login in the
> > webcontent class but no reference at all in the SSO IFrame class.
Does
> > this just mean it is being done differently, or is something amiss in
> the
> > SSO IFrame class?
>
> There are two SSOIFrame classes:
>
> 1. SSOIFramePortlet
> 2. SSOReverseProxyIFramePortlet
>
> Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> you features not available in the older SSOIFramePortlet such as
> auto-resizing and form-based authentication (what you are after)
>
> I tested with SSOReverseProxyIFramePortlet and it worked in the
> example that comes with Jetspeed, but it takes a little bit of
> configuration.
>
> First, ensure your Tomcat will need this attribute set in the
> <Connector> element of server.xml:
>
> emptySessionPath="true"
>
> more detail here:
>
> http://portals.apache.org/applications/webcontent/index.html
>
> If you had to change server.xml setting, then restart your server
>
> I took these steps to verify SSO with the example form-based login
> that comes with Jetspeed:
>
> 1. login as admin
> 2. navigate to the Jetspeed Administration space, SSO Management page,
> or just go here:
>
> http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
>
> Add a new Site with following parameters:
>
> Site Name: Form Example
> Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> Field name for User ID: user
> Field name For Password value: pass
>
> Press Save
>
> Add a new credential for this site in the portlet on the right side
> (SSO Details):
>
> Portal Principal: admin
> Remote Principal: admin
> Remote Credential: admin
>
> Press Add
>
> You can verify that the remote credential was added for the admin
> user by going here:
>
> http://localhost:8080/jetspeed/ui/my-account.psml
>
> see the portlet on the right "SSO Change Passwords", a remote site
> entry should be there named "Form Example"
>
> Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> by searching on "iframe" and then selecting it from there and adding
> to a page. To make things simple, I just added a page and then added
> the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> want to use Basic Authentication, so just hit cancel when challenged.
> I then switched to edit mode (pencil icon), and entered the following
> preferences:
>
> TITLE: My SSO Test
> SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
>
> Press Save
>
> You should see in your portlet content something like:
>
> "Hello, admin. You have been authorized by form-based authentication
!!!"
>
> Give that a try and see if it works. Then, move on to your specific
> IFrame source and let us know how it goes...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E659D1E6FC.D1395).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it
immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:9902C1E701.B0EA8).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Hi,
I haven't heard of that preferences data problem yet in 2.2.1.
IMHO, It could help to localize the problems if you test against other databases
like PostgreSQL or MySQL.
On the other hand, I think you could deploy newer j2-admin.war and
apa-webcontent.war which were included in 2.2.1.
-Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 6:10:25 AM
> Subject: Re: SSO IFrame form authentication
>
> Well, here's the rub. I believe the SSOReverseProxyIFramePortlet is new
> in 2.2.1, which is where I was when I first posted, however, I found that
> my configuration kept getting scrambled, so I reverted to 2.2.0 I will
> try your suggestion on 2.2.1, but I will have to address the scrambling
> issue. What is happening is this. I have cloned the IFramePortlet
> several times and configured each for different static content being
> served from apache2. I have avoided setting any user preferences, and,
> instead, set the preferences for each clone in the PAM portlet. Everything
> worked fine. Then after a few hours, the IFramePortlet content was all
> mixed up. For instance, the portlet on page 1 would be showing the
> content I had configured for the portlet on page 2 and so on. I went into
> PAM and corrected the preferences to what they should be and assumed I was
> ok, but the next morning things were scrambled again. I did some queries
> in the derby db and it appears they are wrong there. I don't know if this
> is a portlet id issue or an indexing problem or what, but I need a
> resolution before I can proceed to 2.2.1 Of course, I have the exact same
> configuration in 2.2.0 and am having no problem there, but I also have no
> SSOReverseProxyIFrame there. Any ideas?
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/17/2010 07:19 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > How did your testing go? I compared SSO Webcontent (which works, sort
> of)
> > to SSO IFrame classes and I see a method for preemptive login in the
> > webcontent class but no reference at all in the SSO IFrame class. Does
> > this just mean it is being done differently, or is something amiss in
> the
> > SSO IFrame class?
>
> There are two SSOIFrame classes:
>
> 1. SSOIFramePortlet
> 2. SSOReverseProxyIFramePortlet
>
> Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> you features not available in the older SSOIFramePortlet such as
> auto-resizing and form-based authentication (what you are after)
>
> I tested with SSOReverseProxyIFramePortlet and it worked in the
> example that comes with Jetspeed, but it takes a little bit of
> configuration.
>
> First, ensure your Tomcat will need this attribute set in the
> <Connector> element of server.xml:
>
> emptySessionPath="true"
>
> more detail here:
>
> http://portals.apache.org/applications/webcontent/index.html
>
> If you had to change server.xml setting, then restart your server
>
> I took these steps to verify SSO with the example form-based login
> that comes with Jetspeed:
>
> 1. login as admin
> 2. navigate to the Jetspeed Administration space, SSO Management page,
> or just go here:
>
> http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
>
> Add a new Site with following parameters:
>
> Site Name: Form Example
> Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> Field name for User ID: user
> Field name For Password value: pass
>
> Press Save
>
> Add a new credential for this site in the portlet on the right side
> (SSO Details):
>
> Portal Principal: admin
> Remote Principal: admin
> Remote Credential: admin
>
> Press Add
>
> You can verify that the remote credential was added for the admin
> user by going here:
>
> http://localhost:8080/jetspeed/ui/my-account.psml
>
> see the portlet on the right "SSO Change Passwords", a remote site
> entry should be there named "Form Example"
>
> Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> by searching on "iframe" and then selecting it from there and adding
> to a page. To make things simple, I just added a page and then added
> the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> want to use Basic Authentication, so just hit cancel when challenged.
> I then switched to edit mode (pencil icon), and entered the following
> preferences:
>
> TITLE: My SSO Test
> SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
>
> Press Save
>
> You should see in your portlet content something like:
>
> "Hello, admin. You have been authorized by form-based authentication !!!"
>
> Give that a try and see if it works. Then, move on to your specific
> IFrame source and let us know how it goes...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E659D1E6FC.D1395).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Well, here's the rub. I believe the SSOReverseProxyIFramePortlet is new
in 2.2.1, which is where I was when I first posted, however, I found that
my configuration kept getting scrambled, so I reverted to 2.2.0 I will
try your suggestion on 2.2.1, but I will have to address the scrambling
issue. What is happening is this. I have cloned the IFramePortlet
several times and configured each for different static content being
served from apache2. I have avoided setting any user preferences, and,
instead, set the preferences for each clone in the PAM portlet. Everything
worked fine. Then after a few hours, the IFramePortlet content was all
mixed up. For instance, the portlet on page 1 would be showing the
content I had configured for the portlet on page 2 and so on. I went into
PAM and corrected the preferences to what they should be and assumed I was
ok, but the next morning things were scrambled again. I did some queries
in the derby db and it appears they are wrong there. I don't know if this
is a portlet id issue or an indexing problem or what, but I need a
resolution before I can proceed to 2.2.1 Of course, I have the exact same
configuration in 2.2.0 and am having no problem there, but I also have no
SSOReverseProxyIFrame there. Any ideas?
From:
David Sean Taylor <d....@onehippo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/17/2010 07:19 PM
Subject:
Re: SSO IFrame form authentication
On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> How did your testing go? I compared SSO Webcontent (which works, sort
of)
> to SSO IFrame classes and I see a method for preemptive login in the
> webcontent class but no reference at all in the SSO IFrame class. Does
> this just mean it is being done differently, or is something amiss in
the
> SSO IFrame class?
There are two SSOIFrame classes:
1. SSOIFramePortlet
2. SSOReverseProxyIFramePortlet
Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
you features not available in the older SSOIFramePortlet such as
auto-resizing and form-based authentication (what you are after)
I tested with SSOReverseProxyIFramePortlet and it worked in the
example that comes with Jetspeed, but it takes a little bit of
configuration.
First, ensure your Tomcat will need this attribute set in the
<Connector> element of server.xml:
emptySessionPath="true"
more detail here:
http://portals.apache.org/applications/webcontent/index.html
If you had to change server.xml setting, then restart your server
I took these steps to verify SSO with the example form-based login
that comes with Jetspeed:
1. login as admin
2. navigate to the Jetspeed Administration space, SSO Management page,
or just go here:
http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
Add a new Site with following parameters:
Site Name: Form Example
Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
Field name for User ID: user
Field name For Password value: pass
Press Save
Add a new credential for this site in the portlet on the right side
(SSO Details):
Portal Principal: admin
Remote Principal: admin
Remote Credential: admin
Press Add
You can verify that the remote credential was added for the admin
user by going here:
http://localhost:8080/jetspeed/ui/my-account.psml
see the portlet on the right "SSO Change Passwords", a remote site
entry should be there named "Form Example"
Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
by searching on "iframe" and then selecting it from there and adding
to a page. To make things simple, I just added a page and then added
the Reverse Proxy Iframe Portlet there. At first this portlet seems to
want to use Basic Authentication, so just hit cancel when challenged.
I then switched to edit mode (pencil icon), and entered the following
preferences:
TITLE: My SSO Test
SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
Press Save
You should see in your portlet content something like:
"Hello, admin. You have been authorized by form-based authentication !!!"
Give that a try and see if it works. Then, move on to your specific
IFrame source and let us know how it goes...
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:E659D1E6FC.D1395).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Actually, I have found that I cannot manually log into this site when in
the reverse proxy portlet, but works fine on a vanilla browser page.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/18/2010 05:28 PM
Subject:
Re: SSO IFrame form authentication
Did you configure `emptySessionPath="true"' for the Connector in
$CATALINA_HOME/conf/server.xml?
Because all the SSO credentials are shared via session between the portlet
and
reverse proxy service servlet, the option above is necessary. The option
name is
case-sensitive and tomcat must be restarted. (Sometimes, you should check
if the
process is still running after trying to stop tomcat.)
Also, are you using j2-admin's reverse proxy service servlet
(/j2-admin/rproxy
or ${contextPath}/rproxy) with j2-admin's SSOReveseProxyIFramePortlet?
Session can be shared inside the same web application.
By the way, can you test it after refreshing the session? I've just found
that
the SSO credentials information are initialized when there's no existing
one in
the session.
And, when you right-click in the iframe, is the page properly
reverse-proxied?
The page should be from /j2-admin/rproxy/.... Otherwise, the reverse proxy
configuration could be wrong.
-Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 1:47:59 PM
> Subject: Re: SSO IFrame form authentication
>
> Well, that surprises me, as the SSO doc refers to an sso.form.Action
> property. And this works fine in the sso webcontent portlet in 2.2.0 I
> successfully configured it to post my login form, using sso.form.Action,
> log me in, then navigate to the SRC url. Works great, except
webcontent
> has problems rendering the page properly. Thats why I want to use SSO
> IFrame. The makes no distinction between IFrame and Webcontent
portlets
> as it relates to form based auth. At any rate, I have went thru your
> previous responses, tried using login.htm in the src, but I still never
> get a post . It simply does a get on the login.htm and renders the
page.
> I have been very careful to assure my SSO Admin properties are synced
with
> my portlet properties, so it should map to a set of credentials, but
they
> never get posted. The best I can do with the proxy portlets is get it
to
> do basic auth, which of course will not work with my target url.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 02:12 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Unfortunately, the portlet or any other SSO-related portlet does not
> provide
> different form auth URL from the navigating URL.
> So, the SRC URL must be the form auth target URL. It's up to the form
auth
>
> target URL to redirect to other contents.
> The SSOReverseProxyIFramePortlet is responsible only for sending
> credentials
> information to the target form auth page with specified parameter names
in
> POST
> method.
> This limitation is because it could be complicated if it should manage
> some
> states in a general way to check if the target site has authenticated
or
> not.
> On the other hand, it would be easier to add or customize a form auth
> target
> page; it can do authentication, store some session attributes and
redirect
> to
> other pages.
> SSOReverseProxyIFramePortlet remembers the last visited page; so when
you
> visit
> the page back, it will remember the navigation states during the
session.
> Also, you could choose basic authentication if you don't want to add or
> customize the form auth target page.
>
> Here are some details on SSO configurations.
> There are two places to configure SSO configs.
> Firstly, the system administrator should register SSO SITEs in
j2-admin's
> SSO
> Admin portlet. [1]
> Secondly, each user should register the SSO credentials information in
> my-account.psml which can be navigated by a link in the login portlet
> after
> authenticated.
> Thirdly, SSOReverseProxyIFramePortlet retrieves the SSO SITE
information
> and the
> user's SSO credentials information, determining those from the SRC url.
>
> In your example, you need to register an SSO SITE with
> http://host.domainname.com:8090/ATGAdmin/ or
> http://host.domainname.com:8090/
> with proper authentication mechanism.
> If the SSO SITE needs form authentication, you should provide proper
form
> auth
> parameters for username and password.
> When you visit a portal page including the sso reverse proxy iframe
> portlet, the
> portlet will find the best matched SSO SITE from the current navigation
> url.
> So, if the current proxied url
> is http://host.domainname.com:8090/ATGAdmin/login.jsp, then the portlet
> will
> retrieve the SSO SITE and credentials information for the user.
> If it is form-auth for the SSO SITE, the portlet will send the
credentials
>
> information with the specified parameter names in POST method to the
> target form
> auth page.
>
> [1]
> http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
>
> HTH,
>
> Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 11:37:23 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Thanks for the much needed documentaton. However, I still can't seem
to
>
> > tie the SSO configuration to the portlet. I can use the SSO Reverse
> Proxy
> > portlet to render the remote content, but I do not see how to get the
> > portlet to preemptively log into the site. My src is
> > http://host.domainname.com:8090/ATGAdmin/customers.htm, however, SSO
> > should be logging into
> http://host.domainname.com:8090/ATGAdmin/login.htm
> > I don't see how the SSO config knows that, and in my case, it
certainly
> > does not do it. To net it out, I can get the SSO portlet to render
the
> > site, but the login never happens.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:28 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > For the preferences of the portlet, you can refer to this
> documentation:
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > For URL related stuffs, there are three: SRC, PROXYREMOTEURL and
> > PROXYLOCALPATH.
> > The SRC preference is the same as the default IFrame portlet.
> > The PROXYREMOTEURL preference is for configuring the remote proxy
target
>
> > url
> > base path.
> > The PROXYLOCALPATH preference is for configuring the local proxy
pass
> base
> > path.
> > So, for example, if SRC is
http://www.yourcompany.com/foo/bar/test.html
>
> > and your
> > reverse proxy service (servlet) is configured to map
> /j2-admin/rproxy/foo/
> > to
> > http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
> > to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
> > to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
> > Also, please see the following documentation on how to configure
> reverse
> > proxy
> > service:
> > http://portals.apache.org/applications/webcontent/rproxy.html
> >
> > Regards,
> >
> > Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 7:22:38 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > I was able to successfully get form-based auth to work with your
> example
> >
> > > scenario, however, my own test case does not. I still simply go
> > directly
> > > to the login screen. I'm sure it has to do with the
proxyremoteurl
> and
> >
> > > proxylocalpath args, but I have not seen any detailed doc on how
> they
> > > work.
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com>
wrote:
> > > > How did your testing go? I compared SSO Webcontent (which
works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method for preemptive login
in
> the
> > > > webcontent class but no reference at all in the SSO IFrame
class.
> > Does
> > > > this just mean it is being done differently, or is something
amiss
> in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one, SSOReverseProxyIFramePortlet as it
> gives
> > > you features not available in the older SSOIFramePortlet such as
> > > auto-resizing and form-based authentication (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and it worked in the
> > > example that comes with Jetspeed, but it takes a little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting, then restart your server
> > >
> > > I took these steps to verify SSO with the example form-based
login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration space, SSO Management
> page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the portlet on the right
side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote credential was added for the
admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change Passwords", a remote
site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the Reverse Proxy Iframe
> Portlet
> > > by searching on "iframe" and then selecting it from there and
adding
> > > to a page. To make things simple, I just added a page and then
added
> > > the Reverse Proxy Iframe Portlet there. At first this portlet
seems
> to
> > > want to use Basic Authentication, so just hit cancel when
challenged.
> > > I then switched to edit mode (pencil icon), and entered the
following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something like:
> > >
> > > "Hello, admin. You have been authorized by form-based
authentication
>
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move on to your
specific
> > > IFrame source and let us know how it goes...
> > >
> > >
---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are confidential, protected
> by
> > > Communications Privacy Act 18 USCS § 2510, solely for the use of
the
>
> > > intended recipient, and may contain legally privileged material.
If
> you
> >
> > > are not the intended recipient, please return or destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:8B67A1E701.EB059).
> >
> >
> >
> >
> > This communication and any attachments are confidential, protected
by
> > Communications Privacy Act 18 USCS § 2510, solely for the use of the
> > intended recipient, and may contain legally privileged material. If
you
>
> > are not the intended recipient, please return or destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:AB8841E700.50A86).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it
immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:C70BC1E6FE.B6E38).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Well, not sure how, but it started working. Since I don't know what I did
to make it work, I'm skeptical that it will continue to work, but we'll
hope. Curious if something got cached to allow it to work and when the
cache expires it will quit. Only issue is that I get the base page
rendered just fine and then click a link on the the page which goes to a
different path, ie, I was on http://host/otrs/... and the link takes me
to http://host/otrs-web/... at which point that content gets a 404 in the
portlet. Of course, thats not the case in a non portlet page. Does this
mean I have to do more configuration or what?
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/19/2010 01:19 PM
Subject:
Re: SSO IFrame form authentication
Regarding the additional hidden fields, can you append those in the SRC
url like this?
http://host.domainname.com:8090/ATGAdmin/login.jsp?hidden1=a&hidden2=b
--- On Thu, 8/19/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Thursday, August 19, 2010, 6:41 PM
> OK, finally got my simple case to
> work. I was able to set my src to
> customers.htm and my SSO url to login.htm and it works
> great now. However,
> this was a simple case and not the solution I need. I
> am now trying to
> login into a url which requires form auth with User &
> Password fields, and
> also has 3 or 4 hidden fields it is expecting. The
> sso doc in the
> deployment guide refers to sso.form.Args, but this doesn't
> seem to work.
> Should it, or is there another way to accomplish. The
> net result is
> reverse proxy is rendering my url but it doesn't log me
> in.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 05:28 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Did you configure `emptySessionPath="true"' for the
> Connector in
> $CATALINA_HOME/conf/server.xml?
> Because all the SSO credentials are shared via session
> between the portlet
> and
> reverse proxy service servlet, the option above is
> necessary. The option
> name is
> case-sensitive and tomcat must be restarted. (Sometimes,
> you should check
> if the
> process is still running after trying to stop tomcat.)
> Also, are you using j2-admin's reverse proxy service
> servlet
> (/j2-admin/rproxy
> or ${contextPath}/rproxy) with j2-admin's
> SSOReveseProxyIFramePortlet?
> Session can be shared inside the same web application.
> By the way, can you test it after refreshing the session?
> I've just found
> that
> the SSO credentials information are initialized when
> there's no existing
> one in
> the session.
> And, when you right-click in the iframe, is the page
> properly
> reverse-proxied?
> The page should be from /j2-admin/rproxy/.... Otherwise,
> the reverse proxy
>
> configuration could be wrong.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 1:47:59 PM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, that surprises me, as the SSO doc refers to an
> sso.form.Action
> > property. And this works fine in the sso
> webcontent portlet in 2.2.0 I
>
> > successfully configured it to post my login form,
> using sso.form.Action,
>
> > log me in, then navigate to the SRC url. Works
> great, except
> webcontent
> > has problems rendering the page properly. Thats
> why I want to use SSO
> > IFrame. The makes no distinction between IFrame
> and Webcontent
> portlets
> > as it relates to form based auth. At any rate,
> I have went thru your
> > previous responses, tried using login.htm in the
> src, but I still never
>
> > get a post . It simply does a get on the
> login.htm and renders the
> page.
> > I have been very careful to assure my SSO Admin
> properties are synced
> with
> > my portlet properties, so it should map to a set
> of credentials, but
> they
> > never get posted. The best I can do with
> the proxy portlets is get it
> to
> > do basic auth, which of course will not work
> with my target url.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 02:12 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Unfortunately, the portlet or any other
> SSO-related portlet does not
> > provide
> > different form auth URL from the navigating
> URL.
> > So, the SRC URL must be the form auth target URL. It's
> up to the form
> auth
> >
> > target URL to redirect to other contents.
> > The SSOReverseProxyIFramePortlet is responsible
> only for sending
> > credentials
> > information to the target form auth page with
> specified parameter names
> in
> > POST
> > method.
> > This limitation is because it could be complicated if
> it should manage
> > some
> > states in a general way to check if the target
> site has authenticated
> or
> > not.
> > On the other hand, it would be easier to add or
> customize a form auth
> > target
> > page; it can do authentication, store some
> session attributes and
> redirect
> > to
> > other pages.
> > SSOReverseProxyIFramePortlet remembers the last
> visited page; so when
> you
> > visit
> > the page back, it will remember the navigation states
> during the
> session.
> > Also, you could choose basic authentication if you
> don't want to add or
>
> > customize the form auth target page.
> >
> > Here are some details on SSO configurations.
> > There are two places to configure SSO configs.
> > Firstly, the system administrator should register SSO
> SITEs in
> j2-admin's
> > SSO
> > Admin portlet. [1]
> > Secondly, each user should register the SSO
> credentials information in
> > my-account.psml which can be navigated by a link
> in the login portlet
> > after
> > authenticated.
> > Thirdly, SSOReverseProxyIFramePortlet retrieves
> the SSO SITE
> information
> > and the
> > user's SSO credentials information, determining those
> from the SRC url.
> >
> > In your example, you need to register an SSO SITE with
>
> > http://host.domainname.com:8090/ATGAdmin/
> or
> > http://host.domainname.com:8090/
> > with proper authentication mechanism.
> > If the SSO SITE needs form authentication, you should
> provide proper
> form
> > auth
> > parameters for username and password.
> > When you visit a portal page including the sso
> reverse proxy iframe
> > portlet, the
> > portlet will find the best matched SSO SITE from the
> current navigation
> > url.
> > So, if the current proxied url
> > is http://host.domainname.com:8090/ATGAdmin/login.jsp,
> then the portlet
>
> > will
> > retrieve the SSO SITE and credentials information for
> the user.
> > If it is form-auth for the SSO SITE, the portlet
> will send the
> credentials
> >
> > information with the specified parameter names in POST
> method to the
> > target form
> > auth page.
> >
> > [1]
> >
http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
> >
> > HTH,
> >
> > Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 11:37:23 AM
> > > Subject: Re: SSO IFrame form
> authentication
> > >
> > > Thanks for the much needed
> documentaton. However, I still can't seem
> to
> >
> > > tie the SSO configuration to the
> portlet. I can use the SSO Reverse
> > Proxy
> > > portlet to render the remote content, but I
> do not see how to get the
>
> > > portlet to preemptively log into the
> site. My src is
> > > http://host.domainname.com:8090/ATGAdmin/customers.htm,
> however, SSO
> > > should be logging into
> > http://host.domainname.com:8090/ATGAdmin/login.htm
> > > I don't see how the SSO config knows that, and in
> my case, it
> certainly
> > > does not do it. To net it out, I can get
> the SSO portlet to render
> the
> > > site, but the login never happens.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/18/2010 12:28 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Hi,
> > >
> > > For the preferences of the portlet, you can
> refer to this
> > documentation:
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > For URL related stuffs, there are
> three: SRC, PROXYREMOTEURL and
> > > PROXYLOCALPATH.
> > > The SRC preference is the same as the
> default IFrame portlet.
> > > The PROXYREMOTEURL preference is for
> configuring the remote proxy
> target
> >
> > > url
> > > base path.
> > > The PROXYLOCALPATH preference is for
> configuring the local proxy
> pass
> > base
> > > path.
> > > So, for example, if SRC is
> http://www.yourcompany.com/foo/bar/test.html
> >
> > > and your
> > > reverse proxy service (servlet) is
> configured to map
> > /j2-admin/rproxy/foo/
> > > to
> > > http://www.yourcompany.com/foo/,
> then PROXYREMOTEURL should be set
> > > to http://www.yourcompany.com/foo/ and
> PROXYLOCALPATH should be set
> > > to /j2-admin/rproxy/foo/ or
> $[contextPath}/rproxy/foo/.
> > > Also, please see the following
> documentation on how to configure
> > reverse
> > > proxy
> > > service:
> > > http://portals.apache.org/applications/webcontent/rproxy.html
> > >
> > > Regards,
> > >
> > > Woonsan
> > >
> > >
> > > ----- Original Message ----
> > > > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > Sent: Wed, August 18, 2010
> 7:22:38 AM
> > > > Subject: Re: SSO IFrame form
> authentication
> > > >
> > > > I was able to successfully get
> form-based auth to work with your
> > example
> > >
> > > > scenario, however, my own test case
> does not. I still simply go
> > > directly
> > > > to the login screen. I'm
> sure it has to do with the
> proxyremoteurl
> > and
> > >
> > > > proxylocalpath args, but I
> have not seen any detailed doc on how
> > they
> > > > work.
> > > >
> > > >
> > > >
> > > > From:
> > > > David Sean Taylor <d....@onehippo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/17/2010 07:19 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > On Tue, Aug 17, 2010 at
> 1:40 PM, <mb...@oreillyauto.com>
>
> wrote:
> > > > > How did your testing go? I
> compared SSO Webcontent (which
> works,
> > > sort
> > > > of)
> > > > > to SSO IFrame classes and I
> see a method for preemptive login
> in
> > the
> > > > > webcontent class but no reference
> at all in the SSO IFrame
> class.
> > > Does
> > > > > this just mean it is being
> done differently, or is something
> amiss
> > in
> > >
> > > > the
> > > > > SSO IFrame class?
> > > >
> > > > There are two SSOIFrame classes:
> > > >
> > > > 1. SSOIFramePortlet
> > > > 2.
> SSOReverseProxyIFramePortlet
> > > >
> > > > Suggest using the second
> one, SSOReverseProxyIFramePortlet as it
> > gives
> > > > you features not available in
> the older SSOIFramePortlet such as
> > > > auto-resizing and form-based
> authentication (what you are after)
> > > >
> > > > I tested with
> SSOReverseProxyIFramePortlet and it worked in the
> > > > example that comes with
> Jetspeed, but it takes a little bit of
> > > > configuration.
> > > >
> > > > First, ensure your Tomcat will need
> this attribute set in the
> > > > <Connector> element
> of server.xml:
> > > >
> > > > emptySessionPath="true"
> > > >
> > > > more detail here:
> > > >
> > > > http://portals.apache.org/applications/webcontent/index.html
> > > >
> > > > If you had to change server.xml
> setting, then restart your server
> > > >
> > > > I took these steps to verify SSO
> with the example form-based
> login
> > > > that comes with Jetspeed:
> > > >
> > > > 1. login as admin
> > > > 2. navigate to the Jetspeed
> Administration space, SSO Management
> > page,
> > > > or just go here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > >
> > > > Add a new Site with following
> parameters:
> > > >
> > > > Site Name: Form Example
> > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > Field name for User ID:
> user
> > > > Field name For Password value: pass
> > > >
> > > > Press Save
> > > >
> > > > Add a new credential for this
> site in the portlet on the right
> side
> > > > (SSO Details):
> > > >
> > > >
> Portal Principal: admin
> > > > Remote Principal: admin
> > > > Remote Credential: admin
> > > >
> > > > Press Add
> > > >
> > > > You can verify that the
> remote credential was added for the
> admin
> > > > user by going here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > >
> > > > see the portlet on the
> right "SSO Change Passwords", a remote
> site
> > > > entry should be there named
> "Form Example"
> > > >
> > > > Next, you can use the Toolbox to
> find the Reverse Proxy Iframe
> > Portlet
> > > > by searching on "iframe"
> and then selecting it from there and
> adding
> > > > to a page. To make things
> simple, I just added a page and then
> added
> > > > the Reverse Proxy Iframe Portlet
> there. At first this portlet
> seems
> > to
> > > > want to use Basic
> Authentication, so just hit cancel when
> challenged.
> > > > I then switched to edit mode
> (pencil icon), and entered the
> following
> > > > preferences:
> > > >
> > > > TITLE: My SSO Test
> > > > SRC: http://localhost:$
> > {serverPort}${contextPath}/examples/formauth.jsp
> > > >
> > > > Press Save
> > > >
> > > > You should see in your portlet
> content something like:
> > > >
> > > > "Hello, admin. You have been
> authorized by form-based
> authentication
> >
> > > !!!"
> > > >
> > > > Give that a try and see if it
> works. Then, move on to your
> specific
> > > > IFrame source and let us know
> how it goes...
> > > >
> > > >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands,
> e-mail:
> > jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned
> for viruses and
> > > > dangerous content by
> MailScanner, and is
> > > > believed to be
> clean (mailgw2:E659D1E6FC.D1395).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments
> are confidential, protected
>
> > by
> > > > Communications Privacy Act 18
> USCS § 2510, solely for the use of
> the
> >
> > > > intended recipient, and may
> contain legally privileged material.
> If
> > you
> > >
> > > > are not the intended recipient,
> please return or destroy it
> > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for
> viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> (mailgw2:8B67A1E701.EB059).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> confidential, protected
> by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
>
> > > intended recipient, and may contain
> legally privileged material. If
> you
> >
> > > are not the intended recipient,
> please return or destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean
> (mailgw2:AB8841E700.50A86).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential, protected by
> > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
> > intended recipient, and may contain legally
> privileged material. If you
>
> > are not the intended recipient, please return or
> destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:C70BC1E6FE.B6E38).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:99F5A1E6FF.2A7BF).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
I have found the reason for the 404, but do not know how to fix it. It
seems the url is being rewritten and replacing the .js with .html in the
following link.
<script src="/otrs-web/js/fckeditor-2.6.4.1/fckeditor.js"></script>
to
<script src="/otrs-web/js/fckeditor-2.6.4.1/fckeditor.html"></script>
I have looked at the default rewrite rules but it is mostly greek.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/19/2010 01:19 PM
Subject:
Re: SSO IFrame form authentication
Regarding the additional hidden fields, can you append those in the SRC
url like this?
http://host.domainname.com:8090/ATGAdmin/login.jsp?hidden1=a&hidden2=b
--- On Thu, 8/19/10, mballard@oreillyauto.com <mb...@oreillyauto.com>
wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Thursday, August 19, 2010, 6:41 PM
> OK, finally got my simple case to
> work. I was able to set my src to
> customers.htm and my SSO url to login.htm and it works
> great now. However,
> this was a simple case and not the solution I need. I
> am now trying to
> login into a url which requires form auth with User &
> Password fields, and
> also has 3 or 4 hidden fields it is expecting. The
> sso doc in the
> deployment guide refers to sso.form.Args, but this doesn't
> seem to work.
> Should it, or is there another way to accomplish. The
> net result is
> reverse proxy is rendering my url but it doesn't log me
> in.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 05:28 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Did you configure `emptySessionPath="true"' for the
> Connector in
> $CATALINA_HOME/conf/server.xml?
> Because all the SSO credentials are shared via session
> between the portlet
> and
> reverse proxy service servlet, the option above is
> necessary. The option
> name is
> case-sensitive and tomcat must be restarted. (Sometimes,
> you should check
> if the
> process is still running after trying to stop tomcat.)
> Also, are you using j2-admin's reverse proxy service
> servlet
> (/j2-admin/rproxy
> or ${contextPath}/rproxy) with j2-admin's
> SSOReveseProxyIFramePortlet?
> Session can be shared inside the same web application.
> By the way, can you test it after refreshing the session?
> I've just found
> that
> the SSO credentials information are initialized when
> there's no existing
> one in
> the session.
> And, when you right-click in the iframe, is the page
> properly
> reverse-proxied?
> The page should be from /j2-admin/rproxy/.... Otherwise,
> the reverse proxy
>
> configuration could be wrong.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 1:47:59 PM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, that surprises me, as the SSO doc refers to an
> sso.form.Action
> > property. And this works fine in the sso
> webcontent portlet in 2.2.0 I
>
> > successfully configured it to post my login form,
> using sso.form.Action,
>
> > log me in, then navigate to the SRC url. Works
> great, except
> webcontent
> > has problems rendering the page properly. Thats
> why I want to use SSO
> > IFrame. The makes no distinction between IFrame
> and Webcontent
> portlets
> > as it relates to form based auth. At any rate,
> I have went thru your
> > previous responses, tried using login.htm in the
> src, but I still never
>
> > get a post . It simply does a get on the
> login.htm and renders the
> page.
> > I have been very careful to assure my SSO Admin
> properties are synced
> with
> > my portlet properties, so it should map to a set
> of credentials, but
> they
> > never get posted. The best I can do with
> the proxy portlets is get it
> to
> > do basic auth, which of course will not work
> with my target url.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 02:12 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Unfortunately, the portlet or any other
> SSO-related portlet does not
> > provide
> > different form auth URL from the navigating
> URL.
> > So, the SRC URL must be the form auth target URL. It's
> up to the form
> auth
> >
> > target URL to redirect to other contents.
> > The SSOReverseProxyIFramePortlet is responsible
> only for sending
> > credentials
> > information to the target form auth page with
> specified parameter names
> in
> > POST
> > method.
> > This limitation is because it could be complicated if
> it should manage
> > some
> > states in a general way to check if the target
> site has authenticated
> or
> > not.
> > On the other hand, it would be easier to add or
> customize a form auth
> > target
> > page; it can do authentication, store some
> session attributes and
> redirect
> > to
> > other pages.
> > SSOReverseProxyIFramePortlet remembers the last
> visited page; so when
> you
> > visit
> > the page back, it will remember the navigation states
> during the
> session.
> > Also, you could choose basic authentication if you
> don't want to add or
>
> > customize the form auth target page.
> >
> > Here are some details on SSO configurations.
> > There are two places to configure SSO configs.
> > Firstly, the system administrator should register SSO
> SITEs in
> j2-admin's
> > SSO
> > Admin portlet. [1]
> > Secondly, each user should register the SSO
> credentials information in
> > my-account.psml which can be navigated by a link
> in the login portlet
> > after
> > authenticated.
> > Thirdly, SSOReverseProxyIFramePortlet retrieves
> the SSO SITE
> information
> > and the
> > user's SSO credentials information, determining those
> from the SRC url.
> >
> > In your example, you need to register an SSO SITE with
>
> > http://host.domainname.com:8090/ATGAdmin/
> or
> > http://host.domainname.com:8090/
> > with proper authentication mechanism.
> > If the SSO SITE needs form authentication, you should
> provide proper
> form
> > auth
> > parameters for username and password.
> > When you visit a portal page including the sso
> reverse proxy iframe
> > portlet, the
> > portlet will find the best matched SSO SITE from the
> current navigation
> > url.
> > So, if the current proxied url
> > is http://host.domainname.com:8090/ATGAdmin/login.jsp,
> then the portlet
>
> > will
> > retrieve the SSO SITE and credentials information for
> the user.
> > If it is form-auth for the SSO SITE, the portlet
> will send the
> credentials
> >
> > information with the specified parameter names in POST
> method to the
> > target form
> > auth page.
> >
> > [1]
> >
http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
> >
> > HTH,
> >
> > Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 11:37:23 AM
> > > Subject: Re: SSO IFrame form
> authentication
> > >
> > > Thanks for the much needed
> documentaton. However, I still can't seem
> to
> >
> > > tie the SSO configuration to the
> portlet. I can use the SSO Reverse
> > Proxy
> > > portlet to render the remote content, but I
> do not see how to get the
>
> > > portlet to preemptively log into the
> site. My src is
> > > http://host.domainname.com:8090/ATGAdmin/customers.htm,
> however, SSO
> > > should be logging into
> > http://host.domainname.com:8090/ATGAdmin/login.htm
> > > I don't see how the SSO config knows that, and in
> my case, it
> certainly
> > > does not do it. To net it out, I can get
> the SSO portlet to render
> the
> > > site, but the login never happens.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/18/2010 12:28 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Hi,
> > >
> > > For the preferences of the portlet, you can
> refer to this
> > documentation:
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > For URL related stuffs, there are
> three: SRC, PROXYREMOTEURL and
> > > PROXYLOCALPATH.
> > > The SRC preference is the same as the
> default IFrame portlet.
> > > The PROXYREMOTEURL preference is for
> configuring the remote proxy
> target
> >
> > > url
> > > base path.
> > > The PROXYLOCALPATH preference is for
> configuring the local proxy
> pass
> > base
> > > path.
> > > So, for example, if SRC is
> http://www.yourcompany.com/foo/bar/test.html
> >
> > > and your
> > > reverse proxy service (servlet) is
> configured to map
> > /j2-admin/rproxy/foo/
> > > to
> > > http://www.yourcompany.com/foo/,
> then PROXYREMOTEURL should be set
> > > to http://www.yourcompany.com/foo/ and
> PROXYLOCALPATH should be set
> > > to /j2-admin/rproxy/foo/ or
> $[contextPath}/rproxy/foo/.
> > > Also, please see the following
> documentation on how to configure
> > reverse
> > > proxy
> > > service:
> > > http://portals.apache.org/applications/webcontent/rproxy.html
> > >
> > > Regards,
> > >
> > > Woonsan
> > >
> > >
> > > ----- Original Message ----
> > > > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > Sent: Wed, August 18, 2010
> 7:22:38 AM
> > > > Subject: Re: SSO IFrame form
> authentication
> > > >
> > > > I was able to successfully get
> form-based auth to work with your
> > example
> > >
> > > > scenario, however, my own test case
> does not. I still simply go
> > > directly
> > > > to the login screen. I'm
> sure it has to do with the
> proxyremoteurl
> > and
> > >
> > > > proxylocalpath args, but I
> have not seen any detailed doc on how
> > they
> > > > work.
> > > >
> > > >
> > > >
> > > > From:
> > > > David Sean Taylor <d....@onehippo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/17/2010 07:19 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > On Tue, Aug 17, 2010 at
> 1:40 PM, <mb...@oreillyauto.com>
>
> wrote:
> > > > > How did your testing go? I
> compared SSO Webcontent (which
> works,
> > > sort
> > > > of)
> > > > > to SSO IFrame classes and I
> see a method for preemptive login
> in
> > the
> > > > > webcontent class but no reference
> at all in the SSO IFrame
> class.
> > > Does
> > > > > this just mean it is being
> done differently, or is something
> amiss
> > in
> > >
> > > > the
> > > > > SSO IFrame class?
> > > >
> > > > There are two SSOIFrame classes:
> > > >
> > > > 1. SSOIFramePortlet
> > > > 2.
> SSOReverseProxyIFramePortlet
> > > >
> > > > Suggest using the second
> one, SSOReverseProxyIFramePortlet as it
> > gives
> > > > you features not available in
> the older SSOIFramePortlet such as
> > > > auto-resizing and form-based
> authentication (what you are after)
> > > >
> > > > I tested with
> SSOReverseProxyIFramePortlet and it worked in the
> > > > example that comes with
> Jetspeed, but it takes a little bit of
> > > > configuration.
> > > >
> > > > First, ensure your Tomcat will need
> this attribute set in the
> > > > <Connector> element
> of server.xml:
> > > >
> > > > emptySessionPath="true"
> > > >
> > > > more detail here:
> > > >
> > > > http://portals.apache.org/applications/webcontent/index.html
> > > >
> > > > If you had to change server.xml
> setting, then restart your server
> > > >
> > > > I took these steps to verify SSO
> with the example form-based
> login
> > > > that comes with Jetspeed:
> > > >
> > > > 1. login as admin
> > > > 2. navigate to the Jetspeed
> Administration space, SSO Management
> > page,
> > > > or just go here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > >
> > > > Add a new Site with following
> parameters:
> > > >
> > > > Site Name: Form Example
> > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > Field name for User ID:
> user
> > > > Field name For Password value: pass
> > > >
> > > > Press Save
> > > >
> > > > Add a new credential for this
> site in the portlet on the right
> side
> > > > (SSO Details):
> > > >
> > > >
> Portal Principal: admin
> > > > Remote Principal: admin
> > > > Remote Credential: admin
> > > >
> > > > Press Add
> > > >
> > > > You can verify that the
> remote credential was added for the
> admin
> > > > user by going here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > >
> > > > see the portlet on the
> right "SSO Change Passwords", a remote
> site
> > > > entry should be there named
> "Form Example"
> > > >
> > > > Next, you can use the Toolbox to
> find the Reverse Proxy Iframe
> > Portlet
> > > > by searching on "iframe"
> and then selecting it from there and
> adding
> > > > to a page. To make things
> simple, I just added a page and then
> added
> > > > the Reverse Proxy Iframe Portlet
> there. At first this portlet
> seems
> > to
> > > > want to use Basic
> Authentication, so just hit cancel when
> challenged.
> > > > I then switched to edit mode
> (pencil icon), and entered the
> following
> > > > preferences:
> > > >
> > > > TITLE: My SSO Test
> > > > SRC: http://localhost:$
> > {serverPort}${contextPath}/examples/formauth.jsp
> > > >
> > > > Press Save
> > > >
> > > > You should see in your portlet
> content something like:
> > > >
> > > > "Hello, admin. You have been
> authorized by form-based
> authentication
> >
> > > !!!"
> > > >
> > > > Give that a try and see if it
> works. Then, move on to your
> specific
> > > > IFrame source and let us know
> how it goes...
> > > >
> > > >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands,
> e-mail:
> > jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned
> for viruses and
> > > > dangerous content by
> MailScanner, and is
> > > > believed to be
> clean (mailgw2:E659D1E6FC.D1395).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments
> are confidential, protected
>
> > by
> > > > Communications Privacy Act 18
> USCS § 2510, solely for the use of
> the
> >
> > > > intended recipient, and may
> contain legally privileged material.
> If
> > you
> > >
> > > > are not the intended recipient,
> please return or destroy it
> > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for
> viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> (mailgw2:8B67A1E701.EB059).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> confidential, protected
> by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
>
> > > intended recipient, and may contain
> legally privileged material. If
> you
> >
> > > are not the intended recipient,
> please return or destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean
> (mailgw2:AB8841E700.50A86).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential, protected by
> > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
> > intended recipient, and may contain legally
> privileged material. If you
>
> > are not the intended recipient, please return or
> destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:C70BC1E6FE.B6E38).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:99F5A1E6FF.2A7BF).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Regarding the additional hidden fields, can you append those in the SRC url like this?
http://host.domainname.com:8090/ATGAdmin/login.jsp?hidden1=a&hidden2=b
--- On Thu, 8/19/10, mballard@oreillyauto.com <mb...@oreillyauto.com> wrote:
> From: mballard@oreillyauto.com <mb...@oreillyauto.com>
> Subject: Re: SSO IFrame form authentication
> To: "Jetspeed Users List" <je...@portals.apache.org>
> Date: Thursday, August 19, 2010, 6:41 PM
> OK, finally got my simple case to
> work. I was able to set my src to
> customers.htm and my SSO url to login.htm and it works
> great now. However,
> this was a simple case and not the solution I need. I
> am now trying to
> login into a url which requires form auth with User &
> Password fields, and
> also has 3 or 4 hidden fields it is expecting. The
> sso doc in the
> deployment guide refers to sso.form.Args, but this doesn't
> seem to work.
> Should it, or is there another way to accomplish. The
> net result is
> reverse proxy is rendering my url but it doesn't log me
> in.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 05:28 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Did you configure `emptySessionPath="true"' for the
> Connector in
> $CATALINA_HOME/conf/server.xml?
> Because all the SSO credentials are shared via session
> between the portlet
> and
> reverse proxy service servlet, the option above is
> necessary. The option
> name is
> case-sensitive and tomcat must be restarted. (Sometimes,
> you should check
> if the
> process is still running after trying to stop tomcat.)
> Also, are you using j2-admin's reverse proxy service
> servlet
> (/j2-admin/rproxy
> or ${contextPath}/rproxy) with j2-admin's
> SSOReveseProxyIFramePortlet?
> Session can be shared inside the same web application.
> By the way, can you test it after refreshing the session?
> I've just found
> that
> the SSO credentials information are initialized when
> there's no existing
> one in
> the session.
> And, when you right-click in the iframe, is the page
> properly
> reverse-proxied?
> The page should be from /j2-admin/rproxy/.... Otherwise,
> the reverse proxy
>
> configuration could be wrong.
>
> -Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 1:47:59 PM
> > Subject: Re: SSO IFrame form authentication
> >
> > Well, that surprises me, as the SSO doc refers to an
> sso.form.Action
> > property. And this works fine in the sso
> webcontent portlet in 2.2.0 I
>
> > successfully configured it to post my login form,
> using sso.form.Action,
>
> > log me in, then navigate to the SRC url. Works
> great, except
> webcontent
> > has problems rendering the page properly. Thats
> why I want to use SSO
> > IFrame. The makes no distinction between IFrame
> and Webcontent
> portlets
> > as it relates to form based auth. At any rate,
> I have went thru your
> > previous responses, tried using login.htm in the
> src, but I still never
>
> > get a post . It simply does a get on the
> login.htm and renders the
> page.
> > I have been very careful to assure my SSO Admin
> properties are synced
> with
> > my portlet properties, so it should map to a set
> of credentials, but
> they
> > never get posted. The best I can do with
> the proxy portlets is get it
> to
> > do basic auth, which of course will not work
> with my target url.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 02:12 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Unfortunately, the portlet or any other
> SSO-related portlet does not
> > provide
> > different form auth URL from the navigating
> URL.
> > So, the SRC URL must be the form auth target URL. It's
> up to the form
> auth
> >
> > target URL to redirect to other contents.
> > The SSOReverseProxyIFramePortlet is responsible
> only for sending
> > credentials
> > information to the target form auth page with
> specified parameter names
> in
> > POST
> > method.
> > This limitation is because it could be complicated if
> it should manage
> > some
> > states in a general way to check if the target
> site has authenticated
> or
> > not.
> > On the other hand, it would be easier to add or
> customize a form auth
> > target
> > page; it can do authentication, store some
> session attributes and
> redirect
> > to
> > other pages.
> > SSOReverseProxyIFramePortlet remembers the last
> visited page; so when
> you
> > visit
> > the page back, it will remember the navigation states
> during the
> session.
> > Also, you could choose basic authentication if you
> don't want to add or
>
> > customize the form auth target page.
> >
> > Here are some details on SSO configurations.
> > There are two places to configure SSO configs.
> > Firstly, the system administrator should register SSO
> SITEs in
> j2-admin's
> > SSO
> > Admin portlet. [1]
> > Secondly, each user should register the SSO
> credentials information in
> > my-account.psml which can be navigated by a link
> in the login portlet
> > after
> > authenticated.
> > Thirdly, SSOReverseProxyIFramePortlet retrieves
> the SSO SITE
> information
> > and the
> > user's SSO credentials information, determining those
> from the SRC url.
> >
> > In your example, you need to register an SSO SITE with
>
> > http://host.domainname.com:8090/ATGAdmin/
> or
> > http://host.domainname.com:8090/
> > with proper authentication mechanism.
> > If the SSO SITE needs form authentication, you should
> provide proper
> form
> > auth
> > parameters for username and password.
> > When you visit a portal page including the sso
> reverse proxy iframe
> > portlet, the
> > portlet will find the best matched SSO SITE from the
> current navigation
> > url.
> > So, if the current proxied url
> > is http://host.domainname.com:8090/ATGAdmin/login.jsp,
> then the portlet
>
> > will
> > retrieve the SSO SITE and credentials information for
> the user.
> > If it is form-auth for the SSO SITE, the portlet
> will send the
> credentials
> >
> > information with the specified parameter names in POST
> method to the
> > target form
> > auth page.
> >
> > [1]
> > http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
> >
> > HTH,
> >
> > Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 11:37:23 AM
> > > Subject: Re: SSO IFrame form
> authentication
> > >
> > > Thanks for the much needed
> documentaton. However, I still can't seem
> to
> >
> > > tie the SSO configuration to the
> portlet. I can use the SSO Reverse
> > Proxy
> > > portlet to render the remote content, but I
> do not see how to get the
>
> > > portlet to preemptively log into the
> site. My src is
> > > http://host.domainname.com:8090/ATGAdmin/customers.htm,
> however, SSO
> > > should be logging into
> > http://host.domainname.com:8090/ATGAdmin/login.htm
> > > I don't see how the SSO config knows that, and in
> my case, it
> certainly
> > > does not do it. To net it out, I can get
> the SSO portlet to render
> the
> > > site, but the login never happens.
> > >
> > >
> > >
> > > From:
> > > Woonsan Ko <wo...@yahoo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/18/2010 12:28 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > Hi,
> > >
> > > For the preferences of the portlet, you can
> refer to this
> > documentation:
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > For URL related stuffs, there are
> three: SRC, PROXYREMOTEURL and
> > > PROXYLOCALPATH.
> > > The SRC preference is the same as the
> default IFrame portlet.
> > > The PROXYREMOTEURL preference is for
> configuring the remote proxy
> target
> >
> > > url
> > > base path.
> > > The PROXYLOCALPATH preference is for
> configuring the local proxy
> pass
> > base
> > > path.
> > > So, for example, if SRC is
> http://www.yourcompany.com/foo/bar/test.html
> >
> > > and your
> > > reverse proxy service (servlet) is
> configured to map
> > /j2-admin/rproxy/foo/
> > > to
> > > http://www.yourcompany.com/foo/,
> then PROXYREMOTEURL should be set
> > > to http://www.yourcompany.com/foo/ and
> PROXYLOCALPATH should be set
> > > to /j2-admin/rproxy/foo/ or
> $[contextPath}/rproxy/foo/.
> > > Also, please see the following
> documentation on how to configure
> > reverse
> > > proxy
> > > service:
> > > http://portals.apache.org/applications/webcontent/rproxy.html
> > >
> > > Regards,
> > >
> > > Woonsan
> > >
> > >
> > > ----- Original Message ----
> > > > From: "mballard@oreillyauto.com"
> <mb...@oreillyauto.com>
> > > > To: Jetspeed Users List <je...@portals.apache.org>
> > > > Sent: Wed, August 18, 2010
> 7:22:38 AM
> > > > Subject: Re: SSO IFrame form
> authentication
> > > >
> > > > I was able to successfully get
> form-based auth to work with your
> > example
> > >
> > > > scenario, however, my own test case
> does not. I still simply go
> > > directly
> > > > to the login screen. I'm
> sure it has to do with the
> proxyremoteurl
> > and
> > >
> > > > proxylocalpath args, but I
> have not seen any detailed doc on how
> > they
> > > > work.
> > > >
> > > >
> > > >
> > > > From:
> > > > David Sean Taylor <d....@onehippo.com>
> > > > To:
> > > > Jetspeed Users List <je...@portals.apache.org>
> > > > Date:
> > > > 08/17/2010 07:19 PM
> > > > Subject:
> > > > Re: SSO IFrame form authentication
> > > >
> > > >
> > > >
> > > > On Tue, Aug 17, 2010 at
> 1:40 PM, <mb...@oreillyauto.com>
>
> wrote:
> > > > > How did your testing go? I
> compared SSO Webcontent (which
> works,
> > > sort
> > > > of)
> > > > > to SSO IFrame classes and I
> see a method for preemptive login
> in
> > the
> > > > > webcontent class but no reference
> at all in the SSO IFrame
> class.
> > > Does
> > > > > this just mean it is being
> done differently, or is something
> amiss
> > in
> > >
> > > > the
> > > > > SSO IFrame class?
> > > >
> > > > There are two SSOIFrame classes:
> > > >
> > > > 1. SSOIFramePortlet
> > > > 2.
> SSOReverseProxyIFramePortlet
> > > >
> > > > Suggest using the second
> one, SSOReverseProxyIFramePortlet as it
> > gives
> > > > you features not available in
> the older SSOIFramePortlet such as
> > > > auto-resizing and form-based
> authentication (what you are after)
> > > >
> > > > I tested with
> SSOReverseProxyIFramePortlet and it worked in the
> > > > example that comes with
> Jetspeed, but it takes a little bit of
> > > > configuration.
> > > >
> > > > First, ensure your Tomcat will need
> this attribute set in the
> > > > <Connector> element
> of server.xml:
> > > >
> > > > emptySessionPath="true"
> > > >
> > > > more detail here:
> > > >
> > > > http://portals.apache.org/applications/webcontent/index.html
> > > >
> > > > If you had to change server.xml
> setting, then restart your server
> > > >
> > > > I took these steps to verify SSO
> with the example form-based
> login
> > > > that comes with Jetspeed:
> > > >
> > > > 1. login as admin
> > > > 2. navigate to the Jetspeed
> Administration space, SSO Management
> > page,
> > > > or just go here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > > >
> > > > Add a new Site with following
> parameters:
> > > >
> > > > Site Name: Form Example
> > > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > > Field name for User ID:
> user
> > > > Field name For Password value: pass
> > > >
> > > > Press Save
> > > >
> > > > Add a new credential for this
> site in the portlet on the right
> side
> > > > (SSO Details):
> > > >
> > > >
> Portal Principal: admin
> > > > Remote Principal: admin
> > > > Remote Credential: admin
> > > >
> > > > Press Add
> > > >
> > > > You can verify that the
> remote credential was added for the
> admin
> > > > user by going here:
> > > >
> > > > http://localhost:8080/jetspeed/ui/my-account.psml
> > > >
> > > > see the portlet on the
> right "SSO Change Passwords", a remote
> site
> > > > entry should be there named
> "Form Example"
> > > >
> > > > Next, you can use the Toolbox to
> find the Reverse Proxy Iframe
> > Portlet
> > > > by searching on "iframe"
> and then selecting it from there and
> adding
> > > > to a page. To make things
> simple, I just added a page and then
> added
> > > > the Reverse Proxy Iframe Portlet
> there. At first this portlet
> seems
> > to
> > > > want to use Basic
> Authentication, so just hit cancel when
> challenged.
> > > > I then switched to edit mode
> (pencil icon), and entered the
> following
> > > > preferences:
> > > >
> > > > TITLE: My SSO Test
> > > > SRC: http://localhost:$
> > {serverPort}${contextPath}/examples/formauth.jsp
> > > >
> > > > Press Save
> > > >
> > > > You should see in your portlet
> content something like:
> > > >
> > > > "Hello, admin. You have been
> authorized by form-based
> authentication
> >
> > > !!!"
> > > >
> > > > Give that a try and see if it
> works. Then, move on to your
> specific
> > > > IFrame source and let us know
> how it goes...
> > > >
> > > >
> ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail:
> jetspeed-user-unsubscribe@portals.apache.org
> > > > For additional commands,
> e-mail:
> > jetspeed-user-help@portals.apache.org
> > > >
> > > >
> > > > --
> > > > This message has been scanned
> for viruses and
> > > > dangerous content by
> MailScanner, and is
> > > > believed to be
> clean (mailgw2:E659D1E6FC.D1395).
> > > >
> > > >
> > > >
> > > >
> > > > This communication and any attachments
> are confidential, protected
>
> > by
> > > > Communications Privacy Act 18
> USCS § 2510, solely for the use of
> the
> >
> > > > intended recipient, and may
> contain legally privileged material.
> If
> > you
> > >
> > > > are not the intended recipient,
> please return or destroy it
> > > immediately.
> > > > Thank you.
> > >
> > >
> > >
> > >
> > >
> ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for
> viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean
> (mailgw2:8B67A1E701.EB059).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are
> confidential, protected
> by
> > > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
>
> > > intended recipient, and may contain
> legally privileged material. If
> you
> >
> > > are not the intended recipient,
> please return or destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> >
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean
> (mailgw2:AB8841E700.50A86).
> >
> >
> >
> >
> > This communication and any attachments are
> confidential, protected by
> > Communications Privacy Act 18 USCS § 2510,
> solely for the use of the
> > intended recipient, and may contain legally
> privileged material. If you
>
> > are not the intended recipient, please return or
> destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:C70BC1E6FE.B6E38).
>
>
>
>
> This communication and any attachments are confidential,
> protected by
> Communications Privacy Act 18 USCS § 2510, solely for the
> use of the
> intended recipient, and may contain legally privileged
> material. If you
> are not the intended recipient, please return or destroy it
> immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
OK, finally got my simple case to work. I was able to set my src to
customers.htm and my SSO url to login.htm and it works great now. However,
this was a simple case and not the solution I need. I am now trying to
login into a url which requires form auth with User & Password fields, and
also has 3 or 4 hidden fields it is expecting. The sso doc in the
deployment guide refers to sso.form.Args, but this doesn't seem to work.
Should it, or is there another way to accomplish. The net result is
reverse proxy is rendering my url but it doesn't log me in.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/18/2010 05:28 PM
Subject:
Re: SSO IFrame form authentication
Did you configure `emptySessionPath="true"' for the Connector in
$CATALINA_HOME/conf/server.xml?
Because all the SSO credentials are shared via session between the portlet
and
reverse proxy service servlet, the option above is necessary. The option
name is
case-sensitive and tomcat must be restarted. (Sometimes, you should check
if the
process is still running after trying to stop tomcat.)
Also, are you using j2-admin's reverse proxy service servlet
(/j2-admin/rproxy
or ${contextPath}/rproxy) with j2-admin's SSOReveseProxyIFramePortlet?
Session can be shared inside the same web application.
By the way, can you test it after refreshing the session? I've just found
that
the SSO credentials information are initialized when there's no existing
one in
the session.
And, when you right-click in the iframe, is the page properly
reverse-proxied?
The page should be from /j2-admin/rproxy/.... Otherwise, the reverse proxy
configuration could be wrong.
-Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 1:47:59 PM
> Subject: Re: SSO IFrame form authentication
>
> Well, that surprises me, as the SSO doc refers to an sso.form.Action
> property. And this works fine in the sso webcontent portlet in 2.2.0 I
> successfully configured it to post my login form, using sso.form.Action,
> log me in, then navigate to the SRC url. Works great, except
webcontent
> has problems rendering the page properly. Thats why I want to use SSO
> IFrame. The makes no distinction between IFrame and Webcontent
portlets
> as it relates to form based auth. At any rate, I have went thru your
> previous responses, tried using login.htm in the src, but I still never
> get a post . It simply does a get on the login.htm and renders the
page.
> I have been very careful to assure my SSO Admin properties are synced
with
> my portlet properties, so it should map to a set of credentials, but
they
> never get posted. The best I can do with the proxy portlets is get it
to
> do basic auth, which of course will not work with my target url.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 02:12 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Unfortunately, the portlet or any other SSO-related portlet does not
> provide
> different form auth URL from the navigating URL.
> So, the SRC URL must be the form auth target URL. It's up to the form
auth
>
> target URL to redirect to other contents.
> The SSOReverseProxyIFramePortlet is responsible only for sending
> credentials
> information to the target form auth page with specified parameter names
in
> POST
> method.
> This limitation is because it could be complicated if it should manage
> some
> states in a general way to check if the target site has authenticated
or
> not.
> On the other hand, it would be easier to add or customize a form auth
> target
> page; it can do authentication, store some session attributes and
redirect
> to
> other pages.
> SSOReverseProxyIFramePortlet remembers the last visited page; so when
you
> visit
> the page back, it will remember the navigation states during the
session.
> Also, you could choose basic authentication if you don't want to add or
> customize the form auth target page.
>
> Here are some details on SSO configurations.
> There are two places to configure SSO configs.
> Firstly, the system administrator should register SSO SITEs in
j2-admin's
> SSO
> Admin portlet. [1]
> Secondly, each user should register the SSO credentials information in
> my-account.psml which can be navigated by a link in the login portlet
> after
> authenticated.
> Thirdly, SSOReverseProxyIFramePortlet retrieves the SSO SITE
information
> and the
> user's SSO credentials information, determining those from the SRC url.
>
> In your example, you need to register an SSO SITE with
> http://host.domainname.com:8090/ATGAdmin/ or
> http://host.domainname.com:8090/
> with proper authentication mechanism.
> If the SSO SITE needs form authentication, you should provide proper
form
> auth
> parameters for username and password.
> When you visit a portal page including the sso reverse proxy iframe
> portlet, the
> portlet will find the best matched SSO SITE from the current navigation
> url.
> So, if the current proxied url
> is http://host.domainname.com:8090/ATGAdmin/login.jsp, then the portlet
> will
> retrieve the SSO SITE and credentials information for the user.
> If it is form-auth for the SSO SITE, the portlet will send the
credentials
>
> information with the specified parameter names in POST method to the
> target form
> auth page.
>
> [1]
> http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
>
> HTH,
>
> Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 11:37:23 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Thanks for the much needed documentaton. However, I still can't seem
to
>
> > tie the SSO configuration to the portlet. I can use the SSO Reverse
> Proxy
> > portlet to render the remote content, but I do not see how to get the
> > portlet to preemptively log into the site. My src is
> > http://host.domainname.com:8090/ATGAdmin/customers.htm, however, SSO
> > should be logging into
> http://host.domainname.com:8090/ATGAdmin/login.htm
> > I don't see how the SSO config knows that, and in my case, it
certainly
> > does not do it. To net it out, I can get the SSO portlet to render
the
> > site, but the login never happens.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:28 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > For the preferences of the portlet, you can refer to this
> documentation:
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > For URL related stuffs, there are three: SRC, PROXYREMOTEURL and
> > PROXYLOCALPATH.
> > The SRC preference is the same as the default IFrame portlet.
> > The PROXYREMOTEURL preference is for configuring the remote proxy
target
>
> > url
> > base path.
> > The PROXYLOCALPATH preference is for configuring the local proxy
pass
> base
> > path.
> > So, for example, if SRC is
http://www.yourcompany.com/foo/bar/test.html
>
> > and your
> > reverse proxy service (servlet) is configured to map
> /j2-admin/rproxy/foo/
> > to
> > http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
> > to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
> > to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
> > Also, please see the following documentation on how to configure
> reverse
> > proxy
> > service:
> > http://portals.apache.org/applications/webcontent/rproxy.html
> >
> > Regards,
> >
> > Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 7:22:38 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > I was able to successfully get form-based auth to work with your
> example
> >
> > > scenario, however, my own test case does not. I still simply go
> > directly
> > > to the login screen. I'm sure it has to do with the
proxyremoteurl
> and
> >
> > > proxylocalpath args, but I have not seen any detailed doc on how
> they
> > > work.
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com>
wrote:
> > > > How did your testing go? I compared SSO Webcontent (which
works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method for preemptive login
in
> the
> > > > webcontent class but no reference at all in the SSO IFrame
class.
> > Does
> > > > this just mean it is being done differently, or is something
amiss
> in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one, SSOReverseProxyIFramePortlet as it
> gives
> > > you features not available in the older SSOIFramePortlet such as
> > > auto-resizing and form-based authentication (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and it worked in the
> > > example that comes with Jetspeed, but it takes a little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting, then restart your server
> > >
> > > I took these steps to verify SSO with the example form-based
login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration space, SSO Management
> page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the portlet on the right
side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote credential was added for the
admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change Passwords", a remote
site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the Reverse Proxy Iframe
> Portlet
> > > by searching on "iframe" and then selecting it from there and
adding
> > > to a page. To make things simple, I just added a page and then
added
> > > the Reverse Proxy Iframe Portlet there. At first this portlet
seems
> to
> > > want to use Basic Authentication, so just hit cancel when
challenged.
> > > I then switched to edit mode (pencil icon), and entered the
following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something like:
> > >
> > > "Hello, admin. You have been authorized by form-based
authentication
>
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move on to your
specific
> > > IFrame source and let us know how it goes...
> > >
> > >
---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are confidential, protected
> by
> > > Communications Privacy Act 18 USCS § 2510, solely for the use of
the
>
> > > intended recipient, and may contain legally privileged material.
If
> you
> >
> > > are not the intended recipient, please return or destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:8B67A1E701.EB059).
> >
> >
> >
> >
> > This communication and any attachments are confidential, protected
by
> > Communications Privacy Act 18 USCS § 2510, solely for the use of the
> > intended recipient, and may contain legally privileged material. If
you
>
> > are not the intended recipient, please return or destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:AB8841E700.50A86).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it
immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:C70BC1E6FE.B6E38).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Did you configure `emptySessionPath="true"' for the Connector in
$CATALINA_HOME/conf/server.xml?
Because all the SSO credentials are shared via session between the portlet and
reverse proxy service servlet, the option above is necessary. The option name is
case-sensitive and tomcat must be restarted. (Sometimes, you should check if the
process is still running after trying to stop tomcat.)
Also, are you using j2-admin's reverse proxy service servlet (/j2-admin/rproxy
or ${contextPath}/rproxy) with j2-admin's SSOReveseProxyIFramePortlet?
Session can be shared inside the same web application.
By the way, can you test it after refreshing the session? I've just found that
the SSO credentials information are initialized when there's no existing one in
the session.
And, when you right-click in the iframe, is the page properly reverse-proxied?
The page should be from /j2-admin/rproxy/.... Otherwise, the reverse proxy
configuration could be wrong.
-Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 1:47:59 PM
> Subject: Re: SSO IFrame form authentication
>
> Well, that surprises me, as the SSO doc refers to an sso.form.Action
> property. And this works fine in the sso webcontent portlet in 2.2.0 I
> successfully configured it to post my login form, using sso.form.Action,
> log me in, then navigate to the SRC url. Works great, except webcontent
> has problems rendering the page properly. Thats why I want to use SSO
> IFrame. The makes no distinction between IFrame and Webcontent portlets
> as it relates to form based auth. At any rate, I have went thru your
> previous responses, tried using login.htm in the src, but I still never
> get a post . It simply does a get on the login.htm and renders the page.
> I have been very careful to assure my SSO Admin properties are synced with
> my portlet properties, so it should map to a set of credentials, but they
> never get posted. The best I can do with the proxy portlets is get it to
> do basic auth, which of course will not work with my target url.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 02:12 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Unfortunately, the portlet or any other SSO-related portlet does not
> provide
> different form auth URL from the navigating URL.
> So, the SRC URL must be the form auth target URL. It's up to the form auth
>
> target URL to redirect to other contents.
> The SSOReverseProxyIFramePortlet is responsible only for sending
> credentials
> information to the target form auth page with specified parameter names in
> POST
> method.
> This limitation is because it could be complicated if it should manage
> some
> states in a general way to check if the target site has authenticated or
> not.
> On the other hand, it would be easier to add or customize a form auth
> target
> page; it can do authentication, store some session attributes and redirect
> to
> other pages.
> SSOReverseProxyIFramePortlet remembers the last visited page; so when you
> visit
> the page back, it will remember the navigation states during the session.
> Also, you could choose basic authentication if you don't want to add or
> customize the form auth target page.
>
> Here are some details on SSO configurations.
> There are two places to configure SSO configs.
> Firstly, the system administrator should register SSO SITEs in j2-admin's
> SSO
> Admin portlet. [1]
> Secondly, each user should register the SSO credentials information in
> my-account.psml which can be navigated by a link in the login portlet
> after
> authenticated.
> Thirdly, SSOReverseProxyIFramePortlet retrieves the SSO SITE information
> and the
> user's SSO credentials information, determining those from the SRC url.
>
> In your example, you need to register an SSO SITE with
> http://host.domainname.com:8090/ATGAdmin/ or
> http://host.domainname.com:8090/
> with proper authentication mechanism.
> If the SSO SITE needs form authentication, you should provide proper form
> auth
> parameters for username and password.
> When you visit a portal page including the sso reverse proxy iframe
> portlet, the
> portlet will find the best matched SSO SITE from the current navigation
> url.
> So, if the current proxied url
> is http://host.domainname.com:8090/ATGAdmin/login.jsp, then the portlet
> will
> retrieve the SSO SITE and credentials information for the user.
> If it is form-auth for the SSO SITE, the portlet will send the credentials
>
> information with the specified parameter names in POST method to the
> target form
> auth page.
>
> [1]
> http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
>
> HTH,
>
> Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 11:37:23 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > Thanks for the much needed documentaton. However, I still can't seem to
>
> > tie the SSO configuration to the portlet. I can use the SSO Reverse
> Proxy
> > portlet to render the remote content, but I do not see how to get the
> > portlet to preemptively log into the site. My src is
> > http://host.domainname.com:8090/ATGAdmin/customers.htm, however, SSO
> > should be logging into
> http://host.domainname.com:8090/ATGAdmin/login.htm
> > I don't see how the SSO config knows that, and in my case, it certainly
> > does not do it. To net it out, I can get the SSO portlet to render the
> > site, but the login never happens.
> >
> >
> >
> > From:
> > Woonsan Ko <wo...@yahoo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/18/2010 12:28 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > Hi,
> >
> > For the preferences of the portlet, you can refer to this
> documentation:
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > For URL related stuffs, there are three: SRC, PROXYREMOTEURL and
> > PROXYLOCALPATH.
> > The SRC preference is the same as the default IFrame portlet.
> > The PROXYREMOTEURL preference is for configuring the remote proxy target
>
> > url
> > base path.
> > The PROXYLOCALPATH preference is for configuring the local proxy pass
> base
> > path.
> > So, for example, if SRC is http://www.yourcompany.com/foo/bar/test.html
>
> > and your
> > reverse proxy service (servlet) is configured to map
> /j2-admin/rproxy/foo/
> > to
> > http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
> > to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
> > to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
> > Also, please see the following documentation on how to configure
> reverse
> > proxy
> > service:
> > http://portals.apache.org/applications/webcontent/rproxy.html
> >
> > Regards,
> >
> > Woonsan
> >
> >
> > ----- Original Message ----
> > > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > > To: Jetspeed Users List <je...@portals.apache.org>
> > > Sent: Wed, August 18, 2010 7:22:38 AM
> > > Subject: Re: SSO IFrame form authentication
> > >
> > > I was able to successfully get form-based auth to work with your
> example
> >
> > > scenario, however, my own test case does not. I still simply go
> > directly
> > > to the login screen. I'm sure it has to do with the proxyremoteurl
> and
> >
> > > proxylocalpath args, but I have not seen any detailed doc on how
> they
> > > work.
> > >
> > >
> > >
> > > From:
> > > David Sean Taylor <d....@onehippo.com>
> > > To:
> > > Jetspeed Users List <je...@portals.apache.org>
> > > Date:
> > > 08/17/2010 07:19 PM
> > > Subject:
> > > Re: SSO IFrame form authentication
> > >
> > >
> > >
> > > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > > > How did your testing go? I compared SSO Webcontent (which works,
> > sort
> > > of)
> > > > to SSO IFrame classes and I see a method for preemptive login in
> the
> > > > webcontent class but no reference at all in the SSO IFrame class.
> > Does
> > > > this just mean it is being done differently, or is something amiss
> in
> >
> > > the
> > > > SSO IFrame class?
> > >
> > > There are two SSOIFrame classes:
> > >
> > > 1. SSOIFramePortlet
> > > 2. SSOReverseProxyIFramePortlet
> > >
> > > Suggest using the second one, SSOReverseProxyIFramePortlet as it
> gives
> > > you features not available in the older SSOIFramePortlet such as
> > > auto-resizing and form-based authentication (what you are after)
> > >
> > > I tested with SSOReverseProxyIFramePortlet and it worked in the
> > > example that comes with Jetspeed, but it takes a little bit of
> > > configuration.
> > >
> > > First, ensure your Tomcat will need this attribute set in the
> > > <Connector> element of server.xml:
> > >
> > > emptySessionPath="true"
> > >
> > > more detail here:
> > >
> > > http://portals.apache.org/applications/webcontent/index.html
> > >
> > > If you had to change server.xml setting, then restart your server
> > >
> > > I took these steps to verify SSO with the example form-based login
> > > that comes with Jetspeed:
> > >
> > > 1. login as admin
> > > 2. navigate to the Jetspeed Administration space, SSO Management
> page,
> > > or just go here:
> > >
> > > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> > >
> > > Add a new Site with following parameters:
> > >
> > > Site Name: Form Example
> > > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > > Field name for User ID: user
> > > Field name For Password value: pass
> > >
> > > Press Save
> > >
> > > Add a new credential for this site in the portlet on the right side
> > > (SSO Details):
> > >
> > > Portal Principal: admin
> > > Remote Principal: admin
> > > Remote Credential: admin
> > >
> > > Press Add
> > >
> > > You can verify that the remote credential was added for the admin
> > > user by going here:
> > >
> > > http://localhost:8080/jetspeed/ui/my-account.psml
> > >
> > > see the portlet on the right "SSO Change Passwords", a remote site
> > > entry should be there named "Form Example"
> > >
> > > Next, you can use the Toolbox to find the Reverse Proxy Iframe
> Portlet
> > > by searching on "iframe" and then selecting it from there and adding
> > > to a page. To make things simple, I just added a page and then added
> > > the Reverse Proxy Iframe Portlet there. At first this portlet seems
> to
> > > want to use Basic Authentication, so just hit cancel when challenged.
> > > I then switched to edit mode (pencil icon), and entered the following
> > > preferences:
> > >
> > > TITLE: My SSO Test
> > > SRC: http://localhost:$
> {serverPort}${contextPath}/examples/formauth.jsp
> > >
> > > Press Save
> > >
> > > You should see in your portlet content something like:
> > >
> > > "Hello, admin. You have been authorized by form-based authentication
>
> > !!!"
> > >
> > > Give that a try and see if it works. Then, move on to your specific
> > > IFrame source and let us know how it goes...
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > > For additional commands, e-mail:
> jetspeed-user-help@portals.apache.org
> > >
> > >
> > > --
> > > This message has been scanned for viruses and
> > > dangerous content by MailScanner, and is
> > > believed to be clean (mailgw2:E659D1E6FC.D1395).
> > >
> > >
> > >
> > >
> > > This communication and any attachments are confidential, protected
> by
> > > Communications Privacy Act 18 USCS § 2510, solely for the use of the
>
> > > intended recipient, and may contain legally privileged material. If
> you
> >
> > > are not the intended recipient, please return or destroy it
> > immediately.
> > > Thank you.
> >
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:8B67A1E701.EB059).
> >
> >
> >
> >
> > This communication and any attachments are confidential, protected by
> > Communications Privacy Act 18 USCS § 2510, solely for the use of the
> > intended recipient, and may contain legally privileged material. If you
>
> > are not the intended recipient, please return or destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:AB8841E700.50A86).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Well, that surprises me, as the SSO doc refers to an sso.form.Action
property. And this works fine in the sso webcontent portlet in 2.2.0 I
successfully configured it to post my login form, using sso.form.Action,
log me in, then navigate to the SRC url. Works great, except webcontent
has problems rendering the page properly. Thats why I want to use SSO
IFrame. The makes no distinction between IFrame and Webcontent portlets
as it relates to form based auth. At any rate, I have went thru your
previous responses, tried using login.htm in the src, but I still never
get a post . It simply does a get on the login.htm and renders the page.
I have been very careful to assure my SSO Admin properties are synced with
my portlet properties, so it should map to a set of credentials, but they
never get posted. The best I can do with the proxy portlets is get it to
do basic auth, which of course will not work with my target url.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/18/2010 02:12 PM
Subject:
Re: SSO IFrame form authentication
Unfortunately, the portlet or any other SSO-related portlet does not
provide
different form auth URL from the navigating URL.
So, the SRC URL must be the form auth target URL. It's up to the form auth
target URL to redirect to other contents.
The SSOReverseProxyIFramePortlet is responsible only for sending
credentials
information to the target form auth page with specified parameter names in
POST
method.
This limitation is because it could be complicated if it should manage
some
states in a general way to check if the target site has authenticated or
not.
On the other hand, it would be easier to add or customize a form auth
target
page; it can do authentication, store some session attributes and redirect
to
other pages.
SSOReverseProxyIFramePortlet remembers the last visited page; so when you
visit
the page back, it will remember the navigation states during the session.
Also, you could choose basic authentication if you don't want to add or
customize the form auth target page.
Here are some details on SSO configurations.
There are two places to configure SSO configs.
Firstly, the system administrator should register SSO SITEs in j2-admin's
SSO
Admin portlet. [1]
Secondly, each user should register the SSO credentials information in
my-account.psml which can be navigated by a link in the login portlet
after
authenticated.
Thirdly, SSOReverseProxyIFramePortlet retrieves the SSO SITE information
and the
user's SSO credentials information, determining those from the SRC url.
In your example, you need to register an SSO SITE with
http://host.domainname.com:8090/ATGAdmin/ or
http://host.domainname.com:8090/
with proper authentication mechanism.
If the SSO SITE needs form authentication, you should provide proper form
auth
parameters for username and password.
When you visit a portal page including the sso reverse proxy iframe
portlet, the
portlet will find the best matched SSO SITE from the current navigation
url.
So, if the current proxied url
is http://host.domainname.com:8090/ATGAdmin/login.jsp, then the portlet
will
retrieve the SSO SITE and credentials information for the user.
If it is form-auth for the SSO SITE, the portlet will send the credentials
information with the specified parameter names in POST method to the
target form
auth page.
[1]
http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
HTH,
Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 11:37:23 AM
> Subject: Re: SSO IFrame form authentication
>
> Thanks for the much needed documentaton. However, I still can't seem to
> tie the SSO configuration to the portlet. I can use the SSO Reverse
Proxy
> portlet to render the remote content, but I do not see how to get the
> portlet to preemptively log into the site. My src is
> http://host.domainname.com:8090/ATGAdmin/customers.htm, however, SSO
> should be logging into
http://host.domainname.com:8090/ATGAdmin/login.htm
> I don't see how the SSO config knows that, and in my case, it certainly
> does not do it. To net it out, I can get the SSO portlet to render the
> site, but the login never happens.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 12:28 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Hi,
>
> For the preferences of the portlet, you can refer to this
documentation:
> http://portals.apache.org/applications/webcontent/index.html
>
> For URL related stuffs, there are three: SRC, PROXYREMOTEURL and
> PROXYLOCALPATH.
> The SRC preference is the same as the default IFrame portlet.
> The PROXYREMOTEURL preference is for configuring the remote proxy target
> url
> base path.
> The PROXYLOCALPATH preference is for configuring the local proxy pass
base
> path.
> So, for example, if SRC is http://www.yourcompany.com/foo/bar/test.html
> and your
> reverse proxy service (servlet) is configured to map
/j2-admin/rproxy/foo/
> to
> http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
> to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
> to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
> Also, please see the following documentation on how to configure
reverse
> proxy
> service:
> http://portals.apache.org/applications/webcontent/rproxy.html
>
> Regards,
>
> Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 7:22:38 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > I was able to successfully get form-based auth to work with your
example
>
> > scenario, however, my own test case does not. I still simply go
> directly
> > to the login screen. I'm sure it has to do with the proxyremoteurl
and
>
> > proxylocalpath args, but I have not seen any detailed doc on how
they
> > work.
> >
> >
> >
> > From:
> > David Sean Taylor <d....@onehippo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/17/2010 07:19 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > > How did your testing go? I compared SSO Webcontent (which works,
> sort
> > of)
> > > to SSO IFrame classes and I see a method for preemptive login in
the
> > > webcontent class but no reference at all in the SSO IFrame class.
> Does
> > > this just mean it is being done differently, or is something amiss
in
>
> > the
> > > SSO IFrame class?
> >
> > There are two SSOIFrame classes:
> >
> > 1. SSOIFramePortlet
> > 2. SSOReverseProxyIFramePortlet
> >
> > Suggest using the second one, SSOReverseProxyIFramePortlet as it
gives
> > you features not available in the older SSOIFramePortlet such as
> > auto-resizing and form-based authentication (what you are after)
> >
> > I tested with SSOReverseProxyIFramePortlet and it worked in the
> > example that comes with Jetspeed, but it takes a little bit of
> > configuration.
> >
> > First, ensure your Tomcat will need this attribute set in the
> > <Connector> element of server.xml:
> >
> > emptySessionPath="true"
> >
> > more detail here:
> >
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > If you had to change server.xml setting, then restart your server
> >
> > I took these steps to verify SSO with the example form-based login
> > that comes with Jetspeed:
> >
> > 1. login as admin
> > 2. navigate to the Jetspeed Administration space, SSO Management
page,
> > or just go here:
> >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> >
> > Add a new Site with following parameters:
> >
> > Site Name: Form Example
> > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > Field name for User ID: user
> > Field name For Password value: pass
> >
> > Press Save
> >
> > Add a new credential for this site in the portlet on the right side
> > (SSO Details):
> >
> > Portal Principal: admin
> > Remote Principal: admin
> > Remote Credential: admin
> >
> > Press Add
> >
> > You can verify that the remote credential was added for the admin
> > user by going here:
> >
> > http://localhost:8080/jetspeed/ui/my-account.psml
> >
> > see the portlet on the right "SSO Change Passwords", a remote site
> > entry should be there named "Form Example"
> >
> > Next, you can use the Toolbox to find the Reverse Proxy Iframe
Portlet
> > by searching on "iframe" and then selecting it from there and adding
> > to a page. To make things simple, I just added a page and then added
> > the Reverse Proxy Iframe Portlet there. At first this portlet seems
to
> > want to use Basic Authentication, so just hit cancel when challenged.
> > I then switched to edit mode (pencil icon), and entered the following
> > preferences:
> >
> > TITLE: My SSO Test
> > SRC: http://localhost:$
{serverPort}${contextPath}/examples/formauth.jsp
> >
> > Press Save
> >
> > You should see in your portlet content something like:
> >
> > "Hello, admin. You have been authorized by form-based authentication
> !!!"
> >
> > Give that a try and see if it works. Then, move on to your specific
> > IFrame source and let us know how it goes...
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail:
jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:E659D1E6FC.D1395).
> >
> >
> >
> >
> > This communication and any attachments are confidential, protected
by
> > Communications Privacy Act 18 USCS § 2510, solely for the use of the
> > intended recipient, and may contain legally privileged material. If
you
>
> > are not the intended recipient, please return or destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:8B67A1E701.EB059).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it
immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:AB8841E700.50A86).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Unfortunately, the portlet or any other SSO-related portlet does not provide
different form auth URL from the navigating URL.
So, the SRC URL must be the form auth target URL. It's up to the form auth
target URL to redirect to other contents.
The SSOReverseProxyIFramePortlet is responsible only for sending credentials
information to the target form auth page with specified parameter names in POST
method.
This limitation is because it could be complicated if it should manage some
states in a general way to check if the target site has authenticated or not.
On the other hand, it would be easier to add or customize a form auth target
page; it can do authentication, store some session attributes and redirect to
other pages.
SSOReverseProxyIFramePortlet remembers the last visited page; so when you visit
the page back, it will remember the navigation states during the session.
Also, you could choose basic authentication if you don't want to add or
customize the form auth target page.
Here are some details on SSO configurations.
There are two places to configure SSO configs.
Firstly, the system administrator should register SSO SITEs in j2-admin's SSO
Admin portlet. [1]
Secondly, each user should register the SSO credentials information in
my-account.psml which can be navigated by a link in the login portlet after
authenticated.
Thirdly, SSOReverseProxyIFramePortlet retrieves the SSO SITE information and the
user's SSO credentials information, determining those from the SRC url.
In your example, you need to register an SSO SITE with
http://host.domainname.com:8090/ATGAdmin/ or http://host.domainname.com:8090/
with proper authentication mechanism.
If the SSO SITE needs form authentication, you should provide proper form auth
parameters for username and password.
When you visit a portal page including the sso reverse proxy iframe portlet, the
portlet will find the best matched SSO SITE from the current navigation url.
So, if the current proxied url
is http://host.domainname.com:8090/ATGAdmin/login.jsp, then the portlet will
retrieve the SSO SITE and credentials information for the user.
If it is form-auth for the SSO SITE, the portlet will send the credentials
information with the specified parameter names in POST method to the target form
auth page.
[1] http://portals.apache.org/jetspeed-2/adminguide/sso.html#SSO_Management
HTH,
Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 11:37:23 AM
> Subject: Re: SSO IFrame form authentication
>
> Thanks for the much needed documentaton. However, I still can't seem to
> tie the SSO configuration to the portlet. I can use the SSO Reverse Proxy
> portlet to render the remote content, but I do not see how to get the
> portlet to preemptively log into the site. My src is
> http://host.domainname.com:8090/ATGAdmin/customers.htm, however, SSO
> should be logging into http://host.domainname.com:8090/ATGAdmin/login.htm
> I don't see how the SSO config knows that, and in my case, it certainly
> does not do it. To net it out, I can get the SSO portlet to render the
> site, but the login never happens.
>
>
>
> From:
> Woonsan Ko <wo...@yahoo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/18/2010 12:28 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> Hi,
>
> For the preferences of the portlet, you can refer to this documentation:
> http://portals.apache.org/applications/webcontent/index.html
>
> For URL related stuffs, there are three: SRC, PROXYREMOTEURL and
> PROXYLOCALPATH.
> The SRC preference is the same as the default IFrame portlet.
> The PROXYREMOTEURL preference is for configuring the remote proxy target
> url
> base path.
> The PROXYLOCALPATH preference is for configuring the local proxy pass base
> path.
> So, for example, if SRC is http://www.yourcompany.com/foo/bar/test.html
> and your
> reverse proxy service (servlet) is configured to map /j2-admin/rproxy/foo/
> to
> http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
> to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
> to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
> Also, please see the following documentation on how to configure reverse
> proxy
> service:
> http://portals.apache.org/applications/webcontent/rproxy.html
>
> Regards,
>
> Woonsan
>
>
> ----- Original Message ----
> > From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> > To: Jetspeed Users List <je...@portals.apache.org>
> > Sent: Wed, August 18, 2010 7:22:38 AM
> > Subject: Re: SSO IFrame form authentication
> >
> > I was able to successfully get form-based auth to work with your example
>
> > scenario, however, my own test case does not. I still simply go
> directly
> > to the login screen. I'm sure it has to do with the proxyremoteurl and
>
> > proxylocalpath args, but I have not seen any detailed doc on how they
> > work.
> >
> >
> >
> > From:
> > David Sean Taylor <d....@onehippo.com>
> > To:
> > Jetspeed Users List <je...@portals.apache.org>
> > Date:
> > 08/17/2010 07:19 PM
> > Subject:
> > Re: SSO IFrame form authentication
> >
> >
> >
> > On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > > How did your testing go? I compared SSO Webcontent (which works,
> sort
> > of)
> > > to SSO IFrame classes and I see a method for preemptive login in the
> > > webcontent class but no reference at all in the SSO IFrame class.
> Does
> > > this just mean it is being done differently, or is something amiss in
>
> > the
> > > SSO IFrame class?
> >
> > There are two SSOIFrame classes:
> >
> > 1. SSOIFramePortlet
> > 2. SSOReverseProxyIFramePortlet
> >
> > Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> > you features not available in the older SSOIFramePortlet such as
> > auto-resizing and form-based authentication (what you are after)
> >
> > I tested with SSOReverseProxyIFramePortlet and it worked in the
> > example that comes with Jetspeed, but it takes a little bit of
> > configuration.
> >
> > First, ensure your Tomcat will need this attribute set in the
> > <Connector> element of server.xml:
> >
> > emptySessionPath="true"
> >
> > more detail here:
> >
> > http://portals.apache.org/applications/webcontent/index.html
> >
> > If you had to change server.xml setting, then restart your server
> >
> > I took these steps to verify SSO with the example form-based login
> > that comes with Jetspeed:
> >
> > 1. login as admin
> > 2. navigate to the Jetspeed Administration space, SSO Management page,
> > or just go here:
> >
> > http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
> >
> > Add a new Site with following parameters:
> >
> > Site Name: Form Example
> > Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> > Field name for User ID: user
> > Field name For Password value: pass
> >
> > Press Save
> >
> > Add a new credential for this site in the portlet on the right side
> > (SSO Details):
> >
> > Portal Principal: admin
> > Remote Principal: admin
> > Remote Credential: admin
> >
> > Press Add
> >
> > You can verify that the remote credential was added for the admin
> > user by going here:
> >
> > http://localhost:8080/jetspeed/ui/my-account.psml
> >
> > see the portlet on the right "SSO Change Passwords", a remote site
> > entry should be there named "Form Example"
> >
> > Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> > by searching on "iframe" and then selecting it from there and adding
> > to a page. To make things simple, I just added a page and then added
> > the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> > want to use Basic Authentication, so just hit cancel when challenged.
> > I then switched to edit mode (pencil icon), and entered the following
> > preferences:
> >
> > TITLE: My SSO Test
> > SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
> >
> > Press Save
> >
> > You should see in your portlet content something like:
> >
> > "Hello, admin. You have been authorized by form-based authentication
> !!!"
> >
> > Give that a try and see if it works. Then, move on to your specific
> > IFrame source and let us know how it goes...
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> > For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean (mailgw2:E659D1E6FC.D1395).
> >
> >
> >
> >
> > This communication and any attachments are confidential, protected by
> > Communications Privacy Act 18 USCS § 2510, solely for the use of the
> > intended recipient, and may contain legally privileged material. If you
>
> > are not the intended recipient, please return or destroy it
> immediately.
> > Thank you.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:8B67A1E701.EB059).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
Thanks for the much needed documentaton. However, I still can't seem to
tie the SSO configuration to the portlet. I can use the SSO Reverse Proxy
portlet to render the remote content, but I do not see how to get the
portlet to preemptively log into the site. My src is
http://host.domainname.com:8090/ATGAdmin/customers.htm, however, SSO
should be logging into http://host.domainname.com:8090/ATGAdmin/login.htm
I don't see how the SSO config knows that, and in my case, it certainly
does not do it. To net it out, I can get the SSO portlet to render the
site, but the login never happens.
From:
Woonsan Ko <wo...@yahoo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/18/2010 12:28 PM
Subject:
Re: SSO IFrame form authentication
Hi,
For the preferences of the portlet, you can refer to this documentation:
http://portals.apache.org/applications/webcontent/index.html
For URL related stuffs, there are three: SRC, PROXYREMOTEURL and
PROXYLOCALPATH.
The SRC preference is the same as the default IFrame portlet.
The PROXYREMOTEURL preference is for configuring the remote proxy target
url
base path.
The PROXYLOCALPATH preference is for configuring the local proxy pass base
path.
So, for example, if SRC is http://www.yourcompany.com/foo/bar/test.html
and your
reverse proxy service (servlet) is configured to map /j2-admin/rproxy/foo/
to
http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
Also, please see the following documentation on how to configure reverse
proxy
service:
http://portals.apache.org/applications/webcontent/rproxy.html
Regards,
Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 7:22:38 AM
> Subject: Re: SSO IFrame form authentication
>
> I was able to successfully get form-based auth to work with your example
> scenario, however, my own test case does not. I still simply go
directly
> to the login screen. I'm sure it has to do with the proxyremoteurl and
> proxylocalpath args, but I have not seen any detailed doc on how they
> work.
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/17/2010 07:19 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > How did your testing go? I compared SSO Webcontent (which works,
sort
> of)
> > to SSO IFrame classes and I see a method for preemptive login in the
> > webcontent class but no reference at all in the SSO IFrame class.
Does
> > this just mean it is being done differently, or is something amiss in
> the
> > SSO IFrame class?
>
> There are two SSOIFrame classes:
>
> 1. SSOIFramePortlet
> 2. SSOReverseProxyIFramePortlet
>
> Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> you features not available in the older SSOIFramePortlet such as
> auto-resizing and form-based authentication (what you are after)
>
> I tested with SSOReverseProxyIFramePortlet and it worked in the
> example that comes with Jetspeed, but it takes a little bit of
> configuration.
>
> First, ensure your Tomcat will need this attribute set in the
> <Connector> element of server.xml:
>
> emptySessionPath="true"
>
> more detail here:
>
> http://portals.apache.org/applications/webcontent/index.html
>
> If you had to change server.xml setting, then restart your server
>
> I took these steps to verify SSO with the example form-based login
> that comes with Jetspeed:
>
> 1. login as admin
> 2. navigate to the Jetspeed Administration space, SSO Management page,
> or just go here:
>
> http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
>
> Add a new Site with following parameters:
>
> Site Name: Form Example
> Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> Field name for User ID: user
> Field name For Password value: pass
>
> Press Save
>
> Add a new credential for this site in the portlet on the right side
> (SSO Details):
>
> Portal Principal: admin
> Remote Principal: admin
> Remote Credential: admin
>
> Press Add
>
> You can verify that the remote credential was added for the admin
> user by going here:
>
> http://localhost:8080/jetspeed/ui/my-account.psml
>
> see the portlet on the right "SSO Change Passwords", a remote site
> entry should be there named "Form Example"
>
> Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> by searching on "iframe" and then selecting it from there and adding
> to a page. To make things simple, I just added a page and then added
> the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> want to use Basic Authentication, so just hit cancel when challenged.
> I then switched to edit mode (pencil icon), and entered the following
> preferences:
>
> TITLE: My SSO Test
> SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
>
> Press Save
>
> You should see in your portlet content something like:
>
> "Hello, admin. You have been authorized by form-based authentication
!!!"
>
> Give that a try and see if it works. Then, move on to your specific
> IFrame source and let us know how it goes...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E659D1E6FC.D1395).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it
immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:8B67A1E701.EB059).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by Woonsan Ko <wo...@yahoo.com>.
Hi,
For the preferences of the portlet, you can refer to this documentation:
http://portals.apache.org/applications/webcontent/index.html
For URL related stuffs, there are three: SRC, PROXYREMOTEURL and PROXYLOCALPATH.
The SRC preference is the same as the default IFrame portlet.
The PROXYREMOTEURL preference is for configuring the remote proxy target url
base path.
The PROXYLOCALPATH preference is for configuring the local proxy pass base path.
So, for example, if SRC is http://www.yourcompany.com/foo/bar/test.html and your
reverse proxy service (servlet) is configured to map /j2-admin/rproxy/foo/ to
http://www.yourcompany.com/foo/, then PROXYREMOTEURL should be set
to http://www.yourcompany.com/foo/ and PROXYLOCALPATH should be set
to /j2-admin/rproxy/foo/ or $[contextPath}/rproxy/foo/.
Also, please see the following documentation on how to configure reverse proxy
service:
http://portals.apache.org/applications/webcontent/rproxy.html
Regards,
Woonsan
----- Original Message ----
> From: "mballard@oreillyauto.com" <mb...@oreillyauto.com>
> To: Jetspeed Users List <je...@portals.apache.org>
> Sent: Wed, August 18, 2010 7:22:38 AM
> Subject: Re: SSO IFrame form authentication
>
> I was able to successfully get form-based auth to work with your example
> scenario, however, my own test case does not. I still simply go directly
> to the login screen. I'm sure it has to do with the proxyremoteurl and
> proxylocalpath args, but I have not seen any detailed doc on how they
> work.
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/17/2010 07:19 PM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> > How did your testing go? I compared SSO Webcontent (which works, sort
> of)
> > to SSO IFrame classes and I see a method for preemptive login in the
> > webcontent class but no reference at all in the SSO IFrame class. Does
> > this just mean it is being done differently, or is something amiss in
> the
> > SSO IFrame class?
>
> There are two SSOIFrame classes:
>
> 1. SSOIFramePortlet
> 2. SSOReverseProxyIFramePortlet
>
> Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
> you features not available in the older SSOIFramePortlet such as
> auto-resizing and form-based authentication (what you are after)
>
> I tested with SSOReverseProxyIFramePortlet and it worked in the
> example that comes with Jetspeed, but it takes a little bit of
> configuration.
>
> First, ensure your Tomcat will need this attribute set in the
> <Connector> element of server.xml:
>
> emptySessionPath="true"
>
> more detail here:
>
> http://portals.apache.org/applications/webcontent/index.html
>
> If you had to change server.xml setting, then restart your server
>
> I took these steps to verify SSO with the example form-based login
> that comes with Jetspeed:
>
> 1. login as admin
> 2. navigate to the Jetspeed Administration space, SSO Management page,
> or just go here:
>
> http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
>
> Add a new Site with following parameters:
>
> Site Name: Form Example
> Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
> Field name for User ID: user
> Field name For Password value: pass
>
> Press Save
>
> Add a new credential for this site in the portlet on the right side
> (SSO Details):
>
> Portal Principal: admin
> Remote Principal: admin
> Remote Credential: admin
>
> Press Add
>
> You can verify that the remote credential was added for the admin
> user by going here:
>
> http://localhost:8080/jetspeed/ui/my-account.psml
>
> see the portlet on the right "SSO Change Passwords", a remote site
> entry should be there named "Form Example"
>
> Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
> by searching on "iframe" and then selecting it from there and adding
> to a page. To make things simple, I just added a page and then added
> the Reverse Proxy Iframe Portlet there. At first this portlet seems to
> want to use Basic Authentication, so just hit cancel when challenged.
> I then switched to edit mode (pencil icon), and entered the following
> preferences:
>
> TITLE: My SSO Test
> SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
>
> Press Save
>
> You should see in your portlet content something like:
>
> "Hello, admin. You have been authorized by form-based authentication !!!"
>
> Give that a try and see if it works. Then, move on to your specific
> IFrame source and let us know how it goes...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E659D1E6FC.D1395).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
I was able to successfully get form-based auth to work with your example
scenario, however, my own test case does not. I still simply go directly
to the login screen. I'm sure it has to do with the proxyremoteurl and
proxylocalpath args, but I have not seen any detailed doc on how they
work.
From:
David Sean Taylor <d....@onehippo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/17/2010 07:19 PM
Subject:
Re: SSO IFrame form authentication
On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> How did your testing go? I compared SSO Webcontent (which works, sort
of)
> to SSO IFrame classes and I see a method for preemptive login in the
> webcontent class but no reference at all in the SSO IFrame class. Does
> this just mean it is being done differently, or is something amiss in
the
> SSO IFrame class?
There are two SSOIFrame classes:
1. SSOIFramePortlet
2. SSOReverseProxyIFramePortlet
Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
you features not available in the older SSOIFramePortlet such as
auto-resizing and form-based authentication (what you are after)
I tested with SSOReverseProxyIFramePortlet and it worked in the
example that comes with Jetspeed, but it takes a little bit of
configuration.
First, ensure your Tomcat will need this attribute set in the
<Connector> element of server.xml:
emptySessionPath="true"
more detail here:
http://portals.apache.org/applications/webcontent/index.html
If you had to change server.xml setting, then restart your server
I took these steps to verify SSO with the example form-based login
that comes with Jetspeed:
1. login as admin
2. navigate to the Jetspeed Administration space, SSO Management page,
or just go here:
http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
Add a new Site with following parameters:
Site Name: Form Example
Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
Field name for User ID: user
Field name For Password value: pass
Press Save
Add a new credential for this site in the portlet on the right side
(SSO Details):
Portal Principal: admin
Remote Principal: admin
Remote Credential: admin
Press Add
You can verify that the remote credential was added for the admin
user by going here:
http://localhost:8080/jetspeed/ui/my-account.psml
see the portlet on the right "SSO Change Passwords", a remote site
entry should be there named "Form Example"
Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
by searching on "iframe" and then selecting it from there and adding
to a page. To make things simple, I just added a page and then added
the Reverse Proxy Iframe Portlet there. At first this portlet seems to
want to use Basic Authentication, so just hit cancel when challenged.
I then switched to edit mode (pencil icon), and entered the following
preferences:
TITLE: My SSO Test
SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
Press Save
You should see in your portlet content something like:
"Hello, admin. You have been authorized by form-based authentication !!!"
Give that a try and see if it works. Then, move on to your specific
IFrame source and let us know how it goes...
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:E659D1E6FC.D1395).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by David Sean Taylor <d....@onehippo.com>.
On Tue, Aug 17, 2010 at 1:40 PM, <mb...@oreillyauto.com> wrote:
> How did your testing go? I compared SSO Webcontent (which works, sort of)
> to SSO IFrame classes and I see a method for preemptive login in the
> webcontent class but no reference at all in the SSO IFrame class. Does
> this just mean it is being done differently, or is something amiss in the
> SSO IFrame class?
There are two SSOIFrame classes:
1. SSOIFramePortlet
2. SSOReverseProxyIFramePortlet
Suggest using the second one, SSOReverseProxyIFramePortlet as it gives
you features not available in the older SSOIFramePortlet such as
auto-resizing and form-based authentication (what you are after)
I tested with SSOReverseProxyIFramePortlet and it worked in the
example that comes with Jetspeed, but it takes a little bit of
configuration.
First, ensure your Tomcat will need this attribute set in the
<Connector> element of server.xml:
emptySessionPath="true"
more detail here:
http://portals.apache.org/applications/webcontent/index.html
If you had to change server.xml setting, then restart your server
I took these steps to verify SSO with the example form-based login
that comes with Jetspeed:
1. login as admin
2. navigate to the Jetspeed Administration space, SSO Management page,
or just go here:
http://localhost:8080/jetspeed/ui/Administrative/sso-admin.psml
Add a new Site with following parameters:
Site Name: Form Example
Site URL: http://localhost:8080/j2-admin/examples/formauth.jsp
Field name for User ID: user
Field name For Password value: pass
Press Save
Add a new credential for this site in the portlet on the right side
(SSO Details):
Portal Principal: admin
Remote Principal: admin
Remote Credential: admin
Press Add
You can verify that the remote credential was added for the admin
user by going here:
http://localhost:8080/jetspeed/ui/my-account.psml
see the portlet on the right "SSO Change Passwords", a remote site
entry should be there named "Form Example"
Next, you can use the Toolbox to find the Reverse Proxy Iframe Portlet
by searching on "iframe" and then selecting it from there and adding
to a page. To make things simple, I just added a page and then added
the Reverse Proxy Iframe Portlet there. At first this portlet seems to
want to use Basic Authentication, so just hit cancel when challenged.
I then switched to edit mode (pencil icon), and entered the following
preferences:
TITLE: My SSO Test
SRC: http://localhost:${serverPort}${contextPath}/examples/formauth.jsp
Press Save
You should see in your portlet content something like:
"Hello, admin. You have been authorized by form-based authentication !!!"
Give that a try and see if it works. Then, move on to your specific
IFrame source and let us know how it goes...
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
How did your testing go? I compared SSO Webcontent (which works, sort of)
to SSO IFrame classes and I see a method for preemptive login in the
webcontent class but no reference at all in the SSO IFrame class. Does
this just mean it is being done differently, or is something amiss in the
SSO IFrame class?
From:
David Sean Taylor <d....@onehippo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/11/2010 05:21 PM
Subject:
Re: SSO IFrame form authentication
I'm out of office today- I will test form auth tomorrow, make sure it's
not completely broken in 2.2.1 - it should at least be posting, one
obvious problem could be user specific prefs overriding defaults..
Sent from my pretentious iPhone
On Aug 11, 2010, at 9:58 AM, mballard@oreillyauto.com wrote:
> I have perused that doc many times. I have placed SSI IFrame on a page.
I
> then went to Admin->PAM pages to set properties for the SSO IFrame
> portlet. I have configured the following parms.
>
> sso.type form
> sso.form.Principal user
> sso.form.Credential password
> sso.form.Action http://webb2c1/Login.htm
>
> Set in the edit preferences dialog
> SRC http://webb2c1/mywebapp/Customers.htm
> SSO Principal mballard (my id on the remote webapp)
> SSO Credential xxxxxxx (my password on the remote webapp)
>
> I have also set this up or verified this in the sso-admin portlet.
>
> Once I set all this up, I log out and back in, then go to my SSO IFrame
> page and I get the login screen for the remote app. I have traced this
> with Wireshark and all I see is the GET for the SRC url, then a 301
> redirect to the login page. I see no attempt to ever post the login.htm
> with the login form.
>
> Again, I have googled for two days to figure out what I'm doing wrong,
but
> I do not see it how to make it preemptively send my login before
accessing
> SRC url.
>
>
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/11/2010 10:57 AM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Wed, Aug 11, 2010 at 6:37 AM, <mb...@oreillyauto.com> wrote:
>> I am attempting to use SSO IFrame in Jetspeed 2.2.1 with no success. I
>> feel like I get the concept and have configured to authenticate to an
>> internal webapp using simple form based posting, however, when I access
>> the site via the SSO IFrame portlet, the authentication process never
>> seems to be invoked. I instead see the login page for the remote site.
> I
>> have traced the flow via Wireshark and see no evidence that the IFrame
>> ever attempts to post the form url. I have tried several internal
sites
>> with similiar results. What am I missing?
>>
> The SSO IFrame and Web Content portlets are configured with a set of
> preferences. The documentation for these preferences is found here:
>
> http://portals.apache.org/jetspeed-2/deployguide/config-sso.html
>
> I would start there, and make sure the preferences are set correctly
> for your IFrame portlets. As the administrative user, you should be
> able to set these preferences in Edit Defaults mode for all users.
> Form based authentication is one of the preferences options, make sure
> it is set (sso.type=form)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E817D1E6FC.705AC).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:1D77C1E6FE.658BA).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by David Sean Taylor <d....@onehippo.com>.
I'm out of office today- I will test form auth tomorrow, make sure it's not completely broken in 2.2.1 - it should at least be posting, one obvious problem could be user specific prefs overriding defaults..
Sent from my pretentious iPhone
On Aug 11, 2010, at 9:58 AM, mballard@oreillyauto.com wrote:
> I have perused that doc many times. I have placed SSI IFrame on a page. I
> then went to Admin->PAM pages to set properties for the SSO IFrame
> portlet. I have configured the following parms.
>
> sso.type form
> sso.form.Principal user
> sso.form.Credential password
> sso.form.Action http://webb2c1/Login.htm
>
> Set in the edit preferences dialog
> SRC http://webb2c1/mywebapp/Customers.htm
> SSO Principal mballard (my id on the remote webapp)
> SSO Credential xxxxxxx (my password on the remote webapp)
>
> I have also set this up or verified this in the sso-admin portlet.
>
> Once I set all this up, I log out and back in, then go to my SSO IFrame
> page and I get the login screen for the remote app. I have traced this
> with Wireshark and all I see is the GET for the SRC url, then a 301
> redirect to the login page. I see no attempt to ever post the login.htm
> with the login form.
>
> Again, I have googled for two days to figure out what I'm doing wrong, but
> I do not see it how to make it preemptively send my login before accessing
> SRC url.
>
>
>
>
>
> From:
> David Sean Taylor <d....@onehippo.com>
> To:
> Jetspeed Users List <je...@portals.apache.org>
> Date:
> 08/11/2010 10:57 AM
> Subject:
> Re: SSO IFrame form authentication
>
>
>
> On Wed, Aug 11, 2010 at 6:37 AM, <mb...@oreillyauto.com> wrote:
>> I am attempting to use SSO IFrame in Jetspeed 2.2.1 with no success. I
>> feel like I get the concept and have configured to authenticate to an
>> internal webapp using simple form based posting, however, when I access
>> the site via the SSO IFrame portlet, the authentication process never
>> seems to be invoked. I instead see the login page for the remote site.
> I
>> have traced the flow via Wireshark and see no evidence that the IFrame
>> ever attempts to post the form url. I have tried several internal sites
>> with similiar results. What am I missing?
>>
> The SSO IFrame and Web Content portlets are configured with a set of
> preferences. The documentation for these preferences is found here:
>
> http://portals.apache.org/jetspeed-2/deployguide/config-sso.html
>
> I would start there, and make sure the preferences are set correctly
> for your IFrame portlets. As the administrative user, you should be
> able to set these preferences in Edit Defaults mode for all users.
> Form based authentication is one of the preferences options, make sure
> it is set (sso.type=form)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean (mailgw2:E817D1E6FC.705AC).
>
>
>
>
> This communication and any attachments are confidential, protected by
> Communications Privacy Act 18 USCS § 2510, solely for the use of the
> intended recipient, and may contain legally privileged material. If you
> are not the intended recipient, please return or destroy it immediately.
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO IFrame form authentication
Posted by mb...@oreillyauto.com.
I have perused that doc many times. I have placed SSI IFrame on a page. I
then went to Admin->PAM pages to set properties for the SSO IFrame
portlet. I have configured the following parms.
sso.type form
sso.form.Principal user
sso.form.Credential password
sso.form.Action http://webb2c1/Login.htm
Set in the edit preferences dialog
SRC http://webb2c1/mywebapp/Customers.htm
SSO Principal mballard (my id on the remote webapp)
SSO Credential xxxxxxx (my password on the remote webapp)
I have also set this up or verified this in the sso-admin portlet.
Once I set all this up, I log out and back in, then go to my SSO IFrame
page and I get the login screen for the remote app. I have traced this
with Wireshark and all I see is the GET for the SRC url, then a 301
redirect to the login page. I see no attempt to ever post the login.htm
with the login form.
Again, I have googled for two days to figure out what I'm doing wrong, but
I do not see it how to make it preemptively send my login before accessing
SRC url.
From:
David Sean Taylor <d....@onehippo.com>
To:
Jetspeed Users List <je...@portals.apache.org>
Date:
08/11/2010 10:57 AM
Subject:
Re: SSO IFrame form authentication
On Wed, Aug 11, 2010 at 6:37 AM, <mb...@oreillyauto.com> wrote:
> I am attempting to use SSO IFrame in Jetspeed 2.2.1 with no success. I
> feel like I get the concept and have configured to authenticate to an
> internal webapp using simple form based posting, however, when I access
> the site via the SSO IFrame portlet, the authentication process never
> seems to be invoked. I instead see the login page for the remote site.
I
> have traced the flow via Wireshark and see no evidence that the IFrame
> ever attempts to post the form url. I have tried several internal sites
> with similiar results. What am I missing?
>
The SSO IFrame and Web Content portlets are configured with a set of
preferences. The documentation for these preferences is found here:
http://portals.apache.org/jetspeed-2/deployguide/config-sso.html
I would start there, and make sure the preferences are set correctly
for your IFrame portlets. As the administrative user, you should be
able to set these preferences in Edit Defaults mode for all users.
Form based authentication is one of the preferences options, make sure
it is set (sso.type=form)
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean (mailgw2:E817D1E6FC.705AC).
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you
are not the intended recipient, please return or destroy it immediately.
Thank you.
Re: SSO IFrame form authentication
Posted by David Sean Taylor <d....@onehippo.com>.
On Wed, Aug 11, 2010 at 6:37 AM, <mb...@oreillyauto.com> wrote:
> I am attempting to use SSO IFrame in Jetspeed 2.2.1 with no success. I
> feel like I get the concept and have configured to authenticate to an
> internal webapp using simple form based posting, however, when I access
> the site via the SSO IFrame portlet, the authentication process never
> seems to be invoked. I instead see the login page for the remote site. I
> have traced the flow via Wireshark and see no evidence that the IFrame
> ever attempts to post the form url. I have tried several internal sites
> with similiar results. What am I missing?
>
The SSO IFrame and Web Content portlets are configured with a set of
preferences. The documentation for these preferences is found here:
http://portals.apache.org/jetspeed-2/deployguide/config-sso.html
I would start there, and make sure the preferences are set correctly
for your IFrame portlets. As the administrative user, you should be
able to set these preferences in Edit Defaults mode for all users.
Form based authentication is one of the preferences options, make sure
it is set (sso.type=form)
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org