You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@jackrabbit.apache.org by Micah Whitacre <mk...@gmail.com> on 2008/06/04 20:55:51 UTC

JSR 283 and PrincipalProviders

Hey all,
  For a project I'm trying to make use of the JSR 283 Access Control
(6.11) API.  I know the implementations are currently in flux and it
is caveat emptor as far as consuming the available API/impl.  But I do
have some questions about what is currently available specifically
concerning Principals and implementing/configuring a
PrincipalProvider.  Currently in my repository.xml file I have the
<Security/> section configured to use the DefaultAccessManager,
DefaultLoginModule, and DefaultSecurityManager.  I do this because of
the available AccessControlManager impls, DefaultAccessManager is the
only one to support the API for things like
addAccessControlEntry(...)/getACE(...)/hasPrivileges(...) and similar
API.
  I'm using the AccessControlManager/ACE API to control access to an
unknown number of Principals which will not have a predictable "name".
 Therefore defining id's in the repository.xml file such as "adminId",
"anonymousId", and "defaultUserId" isn't really an option.  However if
I don't define ids in the repository.xml file I get messages saying
the "LoginModule ignored the credentials".  Looking through the code I
came to the conclusion I'd need to write a PrincipalProvider that
would support the multiple Principals with various names.  Is that a
correct assumption?
  The next question I have is what is the proper way to configure
usage of my custom PrincipalProvider?  In the repository.xml file I
have the following:

    <Security appName="Jackrabbit">
        <AccessManager
            class="org.apache.jackrabbit.core.security.DefaultAccessManager">
        </AccessManager>
        <LoginModule
            class="org.apache.jackrabbit.core.security.authentication.DefaultLoginModule">
            <param name="principalprovider"
value="com.foo.BasicPrincipalProvider"/>
        </LoginModule>
      <SecurityManager
class="org.apache.jackrabbit.core.DefaultSecurityManager">
      </SecurityManager>
    </Security>

And running a test that calls RepositoryImpl.login(Credentials) gives
me the following stack trace:

javax.jcr.LoginException:
org.apache.jackrabbit.core.security.authentication.DefaultLoginModule
does not support 'principalprovider:
org.apache.jackrabbit.core.security.authentication.DefaultLoginModule
does not support 'principalprovider:
org.apache.jackrabbit.core.security.authentication.DefaultLoginModule
does not support 'principalprovider
	at org.apache.jackrabbit.core.RepositoryImpl.login(RepositoryImpl.java:1353)
	at org.apache.jackrabbit.commons.AbstractRepository.login(AbstractRepository.java:53)
       ...
Caused by: javax.security.auth.login.LoginException:
org.apache.jackrabbit.core.security.authentication.DefaultLoginModule
does not support 'principalprovider
	at org.apache.jackrabbit.core.security.authentication.LocalAuthContext.login(LocalAuthContext.java:68)
	at org.apache.jackrabbit.core.RepositoryImpl.login(RepositoryImpl.java:1346)
	... 22 more
javax.security.auth.login.LoginException:
org.apache.jackrabbit.core.security.authentication.DefaultLoginModule
does not support 'principalprovider
	at org.apache.jackrabbit.core.security.authentication.LocalAuthContext.login(LocalAuthContext.java:68)
	at org.apache.jackrabbit.core.RepositoryImpl.login(RepositoryImpl.java:1346)
	at org.apache.jackrabbit.commons.AbstractRepository.login(AbstractRepository.java:53)

Do none of the available LoginModules (default and simple) support
setting a custom PrincipalProvider?  I see how it is used in the
AbstractLoginModule.initialize(...) method but this exception is
thrown before it ever gets to that method.

Thanks in advance for you help,
Micah

Re: JSR 283 and PrincipalProviders

Posted by Micah Whitacre <mk...@gmail.com>.

Thanks for the help.  I went and logged JCR-1640[1] for the stacktrace.

[1] -https://issues.apache.org/jira/browse/JCR-1640

On Thu, Jun 5, 2008 at 1:57 AM, Angela Schreiber <an...@day.com> wrote:
> hi micah
>
> first of all: principal discovery and/or user management is not
> covered by JSR 283 and left to the implementation.
>
> what jackrabbit core currently does:
>> retrieve adminId and anonymousId from the config in order to
>  initialize those users (if missing some internal default
>  id value is used).
>> it's not meant that other users must be configured in the
>  repository.xml
>> instead you should be able to obtain the UserManager from the
>  JackrabbitSession in order to create additional users/groups
>  as you need them.
>> the default principal provider obtains principals from
>  the user manager.
>
>> Looking through the code I
>> came to the conclusion I'd need to write a PrincipalProvider that
>> would support the multiple Principals with various names.  Is that a
>> correct assumption?
>
> see above. it's not required unless you want the principals
> not to be obtained from the user manager.
>
>> And running a test that calls RepositoryImpl.login(Credentials) gives
>> me the following stack trace:
>
> that's probably a bug. can you open an issue for that?
>
> regards
> angela
>
>

Re: JSR 283 and PrincipalProviders

Posted by Micah Whitacre <mk...@gmail.com>.

Angela,
  Thinking about it some more doesn't using the UserManager require
that a user already be logged into a session?  So an admin user would
have to log into a session to obtain the UserManager and create users
prior to other users logging into a session and expecting a non
anonymous principal from being associated with the session.
  I'm not sure if that will work in my situation as I won't know all
usernames/password to add to the UserManager ahead of time.  In my
situation actually I'll already have a principal before I'll call
Repository.login(Credentials).  So I'm already translating that
principal into credentials and ideally the subject of the session
would have a principal that is the same or at least has the same name.
 So in this situation would I think I would want a PrincipalProvider.
Am I correct in that assumption?

I think I misunderstood in your previous response what use case you
wanted me to log an issue for.  I have logged another issue[1] with
respect to the the available login modules not supporting custom
PrincipalProviders.

Thanks in advance for you help,
Micah

[1] - https://issues.apache.org/jira/browse/JCR-1641

On Thu, Jun 5, 2008 at 1:57 AM, Angela Schreiber <an...@day.com> wrote:
> hi micah
>
> first of all: principal discovery and/or user management is not
> covered by JSR 283 and left to the implementation.
>
> what jackrabbit core currently does:
>> retrieve adminId and anonymousId from the config in order to
>  initialize those users (if missing some internal default
>  id value is used).
>> it's not meant that other users must be configured in the
>  repository.xml
>> instead you should be able to obtain the UserManager from the
>  JackrabbitSession in order to create additional users/groups
>  as you need them.
>> the default principal provider obtains principals from
>  the user manager.
>
>> Looking through the code I
>> came to the conclusion I'd need to write a PrincipalProvider that
>> would support the multiple Principals with various names.  Is that a
>> correct assumption?
>
> see above. it's not required unless you want the principals
> not to be obtained from the user manager.
>
>> And running a test that calls RepositoryImpl.login(Credentials) gives
>> me the following stack trace:
>
> that's probably a bug. can you open an issue for that?
>
> regards
> angela
>
>

Re: JSR 283 and PrincipalProviders

Posted by Angela Schreiber <an...@day.com>.

hi micah

first of all: principal discovery and/or user management is not
covered by JSR 283 and left to the implementation.

what jackrabbit core currently does:
 > retrieve adminId and anonymousId from the config in order to
   initialize those users (if missing some internal default
   id value is used).
 > it's not meant that other users must be configured in the
   repository.xml
 > instead you should be able to obtain the UserManager from the
   JackrabbitSession in order to create additional users/groups
   as you need them.
 > the default principal provider obtains principals from
   the user manager.

> Looking through the code I
> came to the conclusion I'd need to write a PrincipalProvider that
> would support the multiple Principals with various names.  Is that a
> correct assumption?

see above. it's not required unless you want the principals
not to be obtained from the user manager.

> And running a test that calls RepositoryImpl.login(Credentials) gives
> me the following stack trace:

that's probably a bug. can you open an issue for that?

regards
angela