You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-user@portals.apache.org by Raj M <mo...@gmail.com> on 2006/10/03 18:59:43 UTC
SSO/Authentication
Greetings,
First, I am working of the 2.1-dev trunk. I am looking for ideas or pointers to
where I should look for a 'stackable' authentication mechanism. Basically,
we have different authentication domains accessing the 'portal', One
authentication domain has a 'cookie' based authentication. Essentially
it, the browser sends a 'externally' authenticated token as a Cookie
value. And i have java libraries to extract the principal/subject id and
verify the authentication. How can I integrate this with j2 security
architecture?
Second, question to support multiple authentication mechanisms, can the
LoginPortlet be 'enhanced' to suport 'PAM' like architecture to support
multiple 'entry' points?
Third, is the security prinicpal/roles/groups available as programattic
API to do 'auto-register' type functions (like the cookie case above?).
Thanks
RM
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO/Authentication
Posted by David Sean Taylor <da...@bluesunrise.com>.
Raj M wrote:
> David,
> Thanks. I guess I have my work cut out :).
> I was able to reuse my JAAS LoginModule with the login.conf, I stacked the
> J2 one and mine. It appears to work !. My only problem is, if the principal
> is not in the J2 DB, I get permission denied to the resource. Is there a
> quick configuration to assign 'guest' role/permission to authenticated
> non J2/DB principals?
Currently you have to write a custom security valve and create and add
your own subject and the mock roles into the subject. Look at the
default security valve as an example. If we could find a generalized way
to get the Subject in a Jetspeed valve, but I don't know of one
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO/Authentication
Posted by Raj M <mo...@gmail.com>.
David,
Thanks. I guess I have my work cut out :).
I was able to reuse my JAAS LoginModule with the login.conf, I stacked the
J2 one and mine. It appears to work !. My only problem is, if the principal
is not in the J2 DB, I get permission denied to the resource. Is there a
quick configuration to assign 'guest' role/permission to authenticated
non J2/DB principals?
Thanks
Raj
On 10/3/06, David Sean Taylor <da...@bluesunrise.com> wrote:
> Raj M wrote:
> > Greetings,
> > First, I am working of the 2.1-dev trunk. I am looking for ideas or
> > pointers to
> > where I should look for a 'stackable' authentication mechanism. Basically,
> > we have different authentication domains accessing the 'portal', One
> > authentication domain has a 'cookie' based authentication. Essentially
> > it, the browser sends a 'externally' authenticated token as a Cookie
> > value. And i have java libraries to extract the principal/subject id and
> > verify the authentication. How can I integrate this with j2 security
> > architecture?
>
> Yes. The first level of integration is at the SecurityValve. Recommend
> writing a custom SecurityValve.
> Take a look at getting the Subject required by Jetspeed created in your
> SecurityValve. This may be enough integration for your requirements.
> More deep integration involves writing custom Jetspeed security components.
>
> >
> > Second, question to support multiple authentication mechanisms, can the
> > LoginPortlet be 'enhanced' to suport 'PAM' like architecture to support
> > multiple 'entry' points?
>
> We have a jaas login module that comes as the default
>
> http://portals.apache.org/jetspeed-2/multiproject/jetspeed-security/login-module.html
>
> Of course you can use your own login module
>
> Additionally, i have integrated with federated solutions like Athens
> Eduserv, Cams. Im still trying to authenticate with Shibboleth, but the
> configuration is killer. Once i have a sample sp/idp running here,
> integration should go quickly
>
> >
> > Third, is the security prinicpal/roles/groups available as programattic
> > API to do 'auto-register' type functions (like the cookie case above?).
>
> Yes. Its all there.
> See the security documentation
>
> http://portals.apache.org/jetspeed-2/guides/guide-security.html
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org
Re: SSO/Authentication
Posted by David Sean Taylor <da...@bluesunrise.com>.
Raj M wrote:
> Greetings,
> First, I am working of the 2.1-dev trunk. I am looking for ideas or
> pointers to
> where I should look for a 'stackable' authentication mechanism. Basically,
> we have different authentication domains accessing the 'portal', One
> authentication domain has a 'cookie' based authentication. Essentially
> it, the browser sends a 'externally' authenticated token as a Cookie
> value. And i have java libraries to extract the principal/subject id and
> verify the authentication. How can I integrate this with j2 security
> architecture?
Yes. The first level of integration is at the SecurityValve. Recommend
writing a custom SecurityValve.
Take a look at getting the Subject required by Jetspeed created in your
SecurityValve. This may be enough integration for your requirements.
More deep integration involves writing custom Jetspeed security components.
>
> Second, question to support multiple authentication mechanisms, can the
> LoginPortlet be 'enhanced' to suport 'PAM' like architecture to support
> multiple 'entry' points?
We have a jaas login module that comes as the default
http://portals.apache.org/jetspeed-2/multiproject/jetspeed-security/login-module.html
Of course you can use your own login module
Additionally, i have integrated with federated solutions like Athens
Eduserv, Cams. Im still trying to authenticate with Shibboleth, but the
configuration is killer. Once i have a sample sp/idp running here,
integration should go quickly
>
> Third, is the security prinicpal/roles/groups available as programattic
> API to do 'auto-register' type functions (like the cookie case above?).
Yes. Its all there.
See the security documentation
http://portals.apache.org/jetspeed-2/guides/guide-security.html
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org