You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Felix Meschberger (Created) (JIRA)" <ji...@apache.org> on 2011/11/11 12:56:51 UTC
[jira] [Created] (SLING-2280) Add support for non-browser
authentication
Add support for non-browser authentication
------------------------------------------
Key: SLING-2280
URL: https://issues.apache.org/jira/browse/SLING-2280
Project: Sling
Issue Type: New Feature
Components: Authentication
Affects Versions: Auth Core 1.0.6
Reporter: Felix Meschberger
Assignee: Felix Meschberger
If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
There are multiple options which are not all exclusive of each other:
(1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
(2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
(3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
(4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
(1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
Thinking about this options, I think I am going to implement the following:
(a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
(b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
(c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
(d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Reopened] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Reopened) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger reopened SLING-2280:
--------------------------------------
This change causes some integration tests to break which don't expect the new behavior of enforced HTTP Basic Authentication:
testXRequestedWithIncorrectCredentials(org.apache.sling.launchpad.webapp.integrationtest.auth.AuthenticationResponseCodeTest): expected:<403> but was:<401>
testWithAcceptHeaderIncorrectCredentials(org.apache.sling.launchpad.webapp.integrationtest.auth.AuthenticationResponseCodeTest): expected:<302> but was:<401>
testRedirectToSelectorLoginFormAfterLoginError(org.apache.sling.launchpad.webapp.integrationtest.login.RedirectOnLoginErrorTest): expected:<302> but was:<401>
testRedirectToOpenIDLoginFormAfterLoginError(org.apache.sling.launchpad.webapp.integrationtest.login.RedirectOnLoginErrorTest): expected:<302> but was:<401>
testRedirectToLoginFormAfterLoginError(org.apache.sling.launchpad.webapp.integrationtest.login.RedirectOnLoginErrorTest): expected:<302> but was:<401>
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Fix For: Auth Core 1.1.0
>
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13153161#comment-13153161 ]
Felix Meschberger commented on SLING-2280:
------------------------------------------
Implement Option 2 in Rev. 1203872: Support AuthenticationHandler service registration property to indicate that browser requests are supported only.
Option 3 (browser Check utility method) has already been implemented in Rev. 1202130 for SLING-2287.
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2280) Add support for non-browser
authentication
Posted by "Carsten Ziegeler (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13149574#comment-13149574 ]
Carsten Ziegeler commented on SLING-2280:
-----------------------------------------
Sounds good to me
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger resolved SLING-2280.
--------------------------------------
Resolution: Fixed
So this can be resolved again.
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Fix For: Auth Core 1.1.0
>
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13153157#comment-13153157 ]
Felix Meschberger commented on SLING-2280:
------------------------------------------
Implement Option 4 in Rev. 1203871: HTTP Basic Handler is fully enabled ignoring any conflicting configuration if anonymous access is disabled. This causes the HTTP Basic Handler to operate as a proper fallback for authentication. If anonymous access is allowed the HTTP Basic enablement configuration is still followed.
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13156247#comment-13156247 ]
Felix Meschberger commented on SLING-2280:
------------------------------------------
Same for RedirectOnLoginErrorTest: Caused by SLING-2299 and fixed in Rev. 1205563
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Fix For: Auth Core 1.1.0
>
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger updated SLING-2280:
-------------------------------------
Attachment: SLING-2280.patch
Proposed patch introducing two new classes: AuthConstants with constants and AuthUtil with utility methods.
PS: The intent is to consolidate a pile of constants distributed amongst interfaces and classes in the auth/core bundle into to the AuthConstants class and to consolidate a number of helper methods (particularly from the AbstractAuthenticationHandler) into the AuthUtil class. With these classes we have easier control of evolution in terms of versioning when we add constants and methods with respect to client's compatibility.
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13156245#comment-13156245 ]
Felix Meschberger commented on SLING-2280:
------------------------------------------
Actually the AuthenticationResponseCode tests failed due to the fixed browser recognition of the Sling Authenticator as of SLING-2299. Fixed in Rev. 1205559 and 1205562
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Fix For: Auth Core 1.1.0
>
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (SLING-2280) Add support for non-browser
authentication
Posted by "Felix Meschberger (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2280?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Felix Meschberger resolved SLING-2280.
--------------------------------------
Resolution: Fixed
Fix Version/s: Auth Core 1.0.8
All done.
> Add support for non-browser authentication
> ------------------------------------------
>
> Key: SLING-2280
> URL: https://issues.apache.org/jira/browse/SLING-2280
> Project: Sling
> Issue Type: New Feature
> Components: Authentication
> Affects Versions: Auth Core 1.0.6
> Reporter: Felix Meschberger
> Assignee: Felix Meschberger
> Fix For: Auth Core 1.0.8
>
> Attachments: SLING-2280.patch
>
>
> If Sling Authentication is configured to force authentication (thus anonymous access is not allowed), Sling calls the AuthenticationHandler.requestCredentials method on all authentication handlers applicable to the request path. This works perfectly and as intended and designed for browser clients.
> For non-browser clients such as for example WebDAV clients or Apache Http Client based applications, the fully Sling authentication mechanism by for example providing a login form does not work or makes no sense. For these situations we should implement functionality in the Sling Authenticator to force authentication.
> There are multiple options which are not all exclusive of each other:
> (1) each AuthenticationHandler is responsible itself for deciding whether to handle non-browser requests or not.
> (2) an AuthenticationHandler can register a service registration property indicating support or non-support for non-browser requests.
> (3) add a utility method for AuthenticationHandlers to check whether a request should be considered a browser or non-browser request.
> (4) Change the behavior of the built-in HTTP Basic Authentication handler: Currently we strictly follow configuration: If anonymous access is forbidden and the built-in HTTP Basic Authentication handler is disables or enabled for preemptive action, it may be that the Sling Authenticator replies 403/FORBIDDEN for a request for which no other authentication handler assumed responsibility. The change would be to ignore the HTTP Basic Authentication handler configuration and force it enabled if anonymous access is not allowed.
> (1) is how it is designed today. (2) is an extension and the default for this property (if absent) would be to assume (1), i.e. the AuthenticationHandler decides. This extension would allow to off-load the decision to the Sling Authentication mechanism. For example the Sling Login Selector, Form, and OpenID selector handlers are candidates for setting such a property. (3) would have to be done to support (2) anyway, so it could just as well be a side-effect of it. Number (4) provides a fallback for situations where authentication is required (due to not allowing anonymous access) without just sending back 403/FORBIDDEN.
> Thinking about this options, I think I am going to implement the following:
> (a) Add a new Util class to the o.a.s.auth.core exported package providing a new boolean isBrowserRequest(HttpServletRequest) method. (3)
> (b) increasing the export version of o.a.s.auth.core package to 1.1 (for the new class). This has no influence on backwards compatibility because the existing interface is implemented by the Auth Core bundle itself.
> (c) Change the configuration behavior of the HTTP Basic Authentication Handler: force it fully enabled if anonymous access is disabled (4)
> (d) Add support for a new service registration property for authentication handlers to indicate support for non-browser request authentication (2)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira