You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "Felix Meschberger (JIRA)" <ji...@apache.org> on 2009/10/14 08:41:31 UTC
[jira] Created: (JCR-2355) Support easy pre-authenticated login
Support easy pre-authenticated login
------------------------------------
Key: JCR-2355
URL: https://issues.apache.org/jira/browse/JCR-2355
Project: Jackrabbit Content Repository
Issue Type: Improvement
Components: jackrabbit-core
Affects Versions: 2.0-alpha11
Reporter: Felix Meschberger
Fix For: 2.0-alpha12
Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
Re: [jira] Created: (JCR-2355) Support easy pre-authenticated login
Posted by Felix Meschberger <fm...@gmail.com>.
Hi,
I attached a patch to this issue. Is there anyone against me applying
this patch ?
Thanks and Regards
Felix
Felix Meschberger (JIRA) schrieb:
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
>
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
>
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
>
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
>
> As a starter we might just check for the presence of the attribute.
>
[jira] Commented: (JCR-2355) Support easy pre-authenticated login
Posted by "Felix Meschberger (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12766020#action_12766020 ]
Felix Meschberger commented on JCR-2355:
----------------------------------------
I agree that the security might be hampered with when this is used unknowningly.
Still, it must explicitly be enabled on a repository configuration level and the default is, that it is not enabled.
I am perfectly ok to raise the requirements for the attribute above the basic presence. For example, we could say, the attribute must be set to a session which has certain access rights. This would limit the use of this functionality to code, which already has access to the repository at a certain level.
On another you raised your veto. Do you stand by this veto ? In this case, since you are a member of the PMC, I would have to remove the code again.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2355) Support easy pre-authenticated login
Posted by "Alexander Klimetschek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12766042#action_12766042 ]
Alexander Klimetschek commented on JCR-2355:
--------------------------------------------
Ok, I thought it would be enabled by default. Hence I revert my -1 vote.
I would note that one should see this attribute like a password, that then must be set on both the client code and the repository configuration.
> It should rather be easy to write a special login module that can be set by configuration and handles SSO things and co.
As Felix pointed out to me, certain login mechanisms like openID, which involve multiple http requests, cannot be easily done by a jackrabbit loginmodule.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2355) Support easy pre-authenticated login
Posted by "Alexander Klimetschek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12766015#action_12766015 ]
Alexander Klimetschek commented on JCR-2355:
--------------------------------------------
Ahem, this can be a security breach! This attribute "trust_credentials_attribute" on SimpleCredentials basically works as a (very simple) master password. Hence this patch implicitly trusts the calling code, but if the repository is available eg. via RMI, anyone could connect to it and log in as any user, because that attribute can be set over RMI (afaik).
A big -1. It should rather be easy to write a special login module that can be set by configuration and handles SSO things and co.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2355) Support easy pre-authenticated login
Posted by "Felix Meschberger (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12766047#action_12766047 ]
Felix Meschberger commented on JCR-2355:
----------------------------------------
Thanks for reverting your veto. So We keep this change committed.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2355) Support easy pre-authenticated login
Posted by "Jukka Zitting (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12765563#action_12765563 ]
Jukka Zitting commented on JCR-2355:
------------------------------------
+0 This approach seems a bit hacky to me (a separate SingleSignOnCredentials class would feel cleaner, or perhaps an out-of-band approach often used by JAAS implementations), but it's probably the most straightforward and easy to implement solution to the described use case.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (JCR-2355) Support easy pre-authenticated login
Posted by "Felix Meschberger (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger updated JCR-2355:
-----------------------------------
Attachment: JCR-2355.patch
Patch extending the AbstractLoginModule with support for pre-authentication.
This patch adds the following:
* Support for a configuration parameter declaring a SimpleCredentials attribute for pre-authentication
* Add an isPreAuthenticated(Credentials) method used by the login() method
The isPreAuthenticated method is protected and can be overwritten by AbstractLoginModule implementations to either switch pre authentication off completely or to apply different and more elaborate checks on the credentials.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (JCR-2355) Support easy pre-authenticated login
Posted by "Felix Meschberger (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2355?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger resolved JCR-2355.
------------------------------------
Resolution: Fixed
After having received the ok from Angela, I commit this patch in Rev. 825125.
> Support easy pre-authenticated login
> ------------------------------------
>
> Key: JCR-2355
> URL: https://issues.apache.org/jira/browse/JCR-2355
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-core
> Affects Versions: 2.0-alpha11
> Reporter: Felix Meschberger
> Fix For: 2.0-alpha12
>
> Attachments: JCR-2355.patch
>
>
> Some applications authenticate users themselves and just need to access the repository on behalf of these pre-authenticated users.
> Examples of such pre-authentications include SSO solutions or web applications using a web-based authentication protocol not easily implementable in a JAAS LoginModule, for example OpenID or similar.
> In such situations a password may not be provided in SimpleCredentials and thus regular login with user name and password is not possible.
> Therefore I propose the enhancement of the AbstractLoginModule to allow for setting a specific attribute in the SimpleCredentials attribute map. If this attribute is set, authentication and login succeeds and a session for the user named in the SimpleCredentials is created.
> As a starter we might just check for the presence of the attribute.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.