You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by George Christman <gc...@cardaddy.com> on 2012/02/22 19:00:03 UTC
tapestry-security w/ Remote Login
Hello, our company has decided to build a sso service for all our
applications. Up until now, I've always used the tapestry-security project,
however I was just directed to add a filter to my web.xml which would handle
authorization and role management. The remote login just redirects the user
to an external login form and then redirects the user back to the
application.
My concerns/questions. I love the goodies provided to me by the
tapestry-security project such as securing methods, role management etc.
Would there be away I could continue to use the tapestry-security project
with this custom remote login? Since I'm not managing login, I wouldn't have
any credentials to pass into SimpleAuthenticationInfo, the only thing
returned from the remote login is a username, roles, and whether or not they
are authorized.
This is my realm classed currently used to handle authorization
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken
token) throws AuthenticationException {
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
String email = upToken.getUsername();
ApplicationUser applicationUser = (ApplicationUser)
session.createCriteria(ApplicationUser.class)
.add(Restrictions.eq("email", email))
.uniqueResult();
if (applicationUser == null) {
throw new UnknownAccountException();
}
return buildAuthenticationInfo(applicationUser.getId(),
applicationUser.getPassword());
}
private AuthenticationInfo buildAuthenticationInfo(Long userId, String
password) {
return new SimpleAuthenticationInfo(userId, password, getName());
}
Thanks in advance.
--
View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5505792.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by George Christman <gc...@cardaddy.com>.
Thanks so much Kalle. I've come up with some free time outside of work, so
I'm going to take advantage of it and start playing with the facebook
integration using the federate project. Hopefully that goes much smoother
than my work related stuff. :)
--
View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5679368.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by Kalle Korhonen <ka...@gmail.com>.
On Tue, May 1, 2012 at 10:12 AM, George Christman
<gc...@cardaddy.com> wrote:
> Hello Kalle, I've finally got this to work :) Our other developer ended up
> rewriting his code to be much friendlier to work with. Anyhow I have one
> last question, he's returning a list of roles to me which I need to populate
> SimpleAuthorizationInfo with. Could you explain how I would get the list of
> roles into the doGetAuthorization method?
Since I'm lazy, I'm just copying Les Hazlewood's response to a similar
question on a thread titled "Shiro and LDAP authentication" on
shiro-user list:
On Fri, Dec 16, 2011 at 11:20 AM, Les Hazlewood <lh...@apache.org> wrote:
> On Dec 16, 2011, at 8:03 AM, seme wrote:
>
>> Here is my scenario, user gets authenticated via cas and has authorization
>> info in attributes from CAS ldap.
>> I want to take those attributes and build permissions for authorization, I
>> am trying to extend AuthorizingRealm, but I can't find away to pass those
>> attributes.
>> Also, I am using shiro for authorization only, when does
>> doGetAuthorizationInfo gets called?
>
> It is called the very first time that an authorization operation occurs (e.g. a permission or role check). If caching is enabled/configured, the AuthorizationInfo will be cached at that time to avoid further continuous 'hits' on the back-end data store.
>
> For Realms that lookup both authentication and authorization information, you could preemptively construct and cache an AuthorizationInfo object during authentication so there is only one perceived 'hit' during login. You would do this by calling the getAuthorizationInfo(PrincipalCollection principals) method from within your doGetAuthenticationInfo method.
>
So.. you'd enable authorizationcache (your roles aren't gonna change
after authentication right?), then stick your roles in
doGetAuthenticationInfo() into your authorization cache and call
getAuthorizationInfo() and verify that your doGetAuthorizationInfo()
is never called. Or alternatively, you could create a secondary
principal of your choice that carries the roles or put them in a
threadlocal or just redo your remote authentication in
doGetAuthorizationInfo() in case your roles may dynamically change
(but consider the performance implications).
Kalle
>
> this is my code used to set my custom token
>
> page.class
>
> //hri crowd authentication
> HRILoginClient client = new HRILoginClient();
> HRISubject authenticate = client.authenticate(username,
> password);
>
> //tapestry security authentication
> Subject currentUser = SecurityUtils.getSubject();
> HRIAuthenticationToken token = new
> HRIAuthenticationToken(authenticate.getUsername());
>
> //Need to pass these roles into EPRSRealm
> System.out.println("roles" + authenticate.getRoles());
>
> currentUser.login(token);
>
>
> AuthorizationInfo in EPRSRealm.class
>
> //Not sure how to pass roles into this method.
> protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection
> principals) {
>
> Set<RoleNames> roleNames;
> return new SimpleAuthorizationInfo(roleNames);
> }
>
> Thanks Kalle.
>
>
>
>
> --
> View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5678498.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by George Christman <gc...@cardaddy.com>.
Hello Kalle, I've finally got this to work :) Our other developer ended up
rewriting his code to be much friendlier to work with. Anyhow I have one
last question, he's returning a list of roles to me which I need to populate
SimpleAuthorizationInfo with. Could you explain how I would get the list of
roles into the doGetAuthorization method?
this is my code used to set my custom token
page.class
//hri crowd authentication
HRILoginClient client = new HRILoginClient();
HRISubject authenticate = client.authenticate(username,
password);
//tapestry security authentication
Subject currentUser = SecurityUtils.getSubject();
HRIAuthenticationToken token = new
HRIAuthenticationToken(authenticate.getUsername());
//Need to pass these roles into EPRSRealm
System.out.println("roles" + authenticate.getRoles());
currentUser.login(token);
AuthorizationInfo in EPRSRealm.class
//Not sure how to pass roles into this method.
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection
principals) {
Set<RoleNames> roleNames;
return new SimpleAuthorizationInfo(roleNames);
}
Thanks Kalle.
--
View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5678498.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by Kalle Korhonen <ka...@gmail.com>.
On Thu, Apr 19, 2012 at 9:10 AM, George Christman
<gc...@cardaddy.com> wrote:
> Hi Kalle, I know it's been some time since we last spoke about this project.
> I'm getting started with it again and had a question for you. When you said
> I could call Subject.login in my isAuthorized method, were you referring to
> something like this?
> @Override
> protected boolean isAuthorized(HRIPrinciple hrip, String urlPath) {
> Subject currentUser = SecurityUtils.getSubject();
> HRIAuthenticationToken token = new
> HRIAuthenticationToken(hrip.getUid());
> currentUser.login(token);
> return currentUser.isAuthenticated();
> }
Yes, perhaps.
> I'm not entirely sure why I would need to access Tapestry's machinery. "I
> don't know anything about Tapestry IOC". Would you further explain that
> please and possibly point me to the tapestry security source location?
Mastering Tapestry IoC is a key to understanding and being productive
with Tapestry. If you just wanted to use Shiro alone, you could
perhaps get the above working by configuring your custom filter and
Shiro outside of Tapestry using the standard servlet configuration
(i.e. web.xml) mechanism. Tapestry security initializes and invokes
Shiro within Tapestry's servlet request pipeline, and replaces Shiro's
standard filters with its own. There are multiple benefits with these
approach, one of the keys ones is that you can use any other services
in your security filters, realms, etc. I would assume that
initializing your custom filter within tapestry-security context would
be the path of least (less?) resistance to get this working for you.
The tapestry-security source code is essential reading for you. You
could start with
http://svn.codehaus.org/tynamo/trunk/tapestry-security/src/main/java/org/tynamo/security/services/impl/SecurityFilterChainFactoryImpl.java.
Map the chain concept to "Contributing security configuration" section
on http://tynamo.org/tapestry-security+guide and it should be fairly
straight-forwarded to add your filter to the chain (you can just
construct the object manually for your chains, no factory required).
Kalle
> View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5652188.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by George Christman <gc...@cardaddy.com>.
Hi Kalle, I know it's been some time since we last spoke about this project.
I'm getting started with it again and had a question for you. When you said
I could call Subject.login in my isAuthorized method, were you referring to
something like this?
@Override
protected boolean isAuthorized(HRIPrinciple hrip, String urlPath) {
Subject currentUser = SecurityUtils.getSubject();
HRIAuthenticationToken token = new
HRIAuthenticationToken(hrip.getUid());
currentUser.login(token);
return currentUser.isAuthenticated();
}
I'm not entirely sure why I would need to access Tapestry's machinery. "I
don't know anything about Tapestry IOC". Would you further explain that
please and possibly point me to the tapestry security source location?
Thanks,
George
--
View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5652188.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by Kalle Korhonen <ka...@gmail.com>.
On Thu, Feb 23, 2012 at 7:14 AM, George Christman
<gc...@cardaddy.com> wrote:
> Hi Kalle, I spent sometime this morning reading over
> tynamo-federatedaccounts, however I noticed the majority of the links were
> broken. It doesn't appear to be very clear to me how closely related the
2/21 links by my count were broken and I fixed the two.
> facebook/twitter samples would be to me. I'd like to show you a sample of
> what I've been given to work with and perhaps you could point me in the
> right direction.
You are not showing me enough not to make any informed suggestions, so
I'm guessing where I need to fill in the blanks. Basically, you'll
have to do the point where your authorization filter decides the user
is authenticated, and call Subject.login at that point. You mentioned
the filter adds attributes to the session - can you use
Session.isNew()? If so, you could extend doFilter() and call
Subject.login from there. Does HRIPrinciple have something like
isNew()? If so, you could login in isAuthorized(). Note that while
this is a standard filter, you could make a Tapestry wrapper around it
(see the source of tapestry-security for examples) if you want/need it
to be able to Tapestry's machinery (IoC etc..).
Kalle
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by George Christman <gc...@cardaddy.com>.
Hi Kalle, I spent sometime this morning reading over
tynamo-federatedaccounts, however I noticed the majority of the links were
broken. It doesn't appear to be very clear to me how closely related the
facebook/twitter samples would be to me. I'd like to show you a sample of
what I've been given to work with and perhaps you could point me in the
right direction.
I have the following and not sure how to get it to work with my realm.
public class EPRSAuthorizationFilter extends AuthorizationFilter {
@Override
protected boolean isAuthorized(HRIPrinciple hrip, String urlPath) {
return true;
}
@Override
protected boolean isProtected(String urlPath) {
return true;
}
}
public abstract class AuthorizationFilter implements Filter {
private String apptoken;
private String loginUrl;
private String accessDeniedUrl;
public AuthorizationFilter() {
//compiled code
throw new RuntimeException("Compiled Code");
}
protected String getLoginUrl() {
//compiled code
throw new RuntimeException("Compiled Code");
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain fc) throws IOException, ServletException {
//compiled code
throw new RuntimeException("Compiled Code");
}
protected String getTarget(ServletRequest request) {
//compiled code
throw new RuntimeException("Compiled Code");
}
public void destroy() {
//compiled code
throw new RuntimeException("Compiled Code");
}
public void init(FilterConfig fc) throws ServletException {
//compiled code
throw new RuntimeException("Compiled Code");
}
protected abstract boolean isAuthorized(HRIPrinciple hrip, String
string);
protected abstract boolean isProtected(String string);
protected boolean handleUnauthorized(ServletRequest sr, ServletResponse
sr1) throws IOException {
//compiled code
throw new RuntimeException("Compiled Code");
}
}
--
View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5508307.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by Kalle Korhonen <ka...@gmail.com>.
On Wed, Feb 22, 2012 at 11:50 AM, George Christman
<gc...@cardaddy.com> wrote:
> Hi Kalle, I apologize, I misspoke in my previous post. Our remote sso
> doesn't serve as an authorization protocol, I meant to say it serves as a
Well, it's partly an authorization protocol if it returns you roles
specific to the local application.
> Authentication protocol. We are using web.xml filters to trigger
> Authentication. Once the user has been authenticated, the service returns a
> user Id and list of roles while populating the application session. Where I
> need some help is getting the user info into the Authorization Manager. The
> sso service was built custom by one of our in house developers, so would
> tynamo-federatedaccounts still be a good candidate for this?
Absolutely. Short cutting that, you could extend the ready-made
filter, and call Subject.login after the original filter has already
populated the session (I'd argue that it's doing too much, but that's
semantics) and have a corresponding realm just for authorizing the sso
users. Any solution for this you build would probably start looking
more and more like federatedaccounts. You have to study the code a
bit. The basic difference is that if you don't want your local
application to participate in the remote authentication process in
anyway (for example, if you don't have a need to ban individual users
accessing your application), you can just have an authorizing realm
and do there whatever else you need to do to transfer the role names
from the session to your authorizationInfo.
Kalle
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by George Christman <gc...@cardaddy.com>.
Hi Kalle, I apologize, I misspoke in my previous post. Our remote sso
doesn't serve as an authorization protocol, I meant to say it serves as a
Authentication protocol. We are using web.xml filters to trigger
Authentication. Once the user has been authenticated, the service returns a
user Id and list of roles while populating the application session. Where I
need some help is getting the user info into the Authorization Manager. The
sso service was built custom by one of our in house developers, so would
tynamo-federatedaccounts still be a good candidate for this?
--
View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5506055.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: tapestry-security w/ Remote Login
Posted by Kalle Korhonen <ka...@gmail.com>.
Federatedaccounts (http://tynamo.org/tynamo-federatedaccounts+guide)
is exactly for these use cases. You would have to implement your own
authentication provider. It's interesting that your remote SSO service
serves as an authorization protocol as well, I'd probably handle it as
a merged local authorization. If the sso service you are using is one
of the more common ones, I'd be happy to work with you to have an
official support for it as a Tynamo federatedaccounts sub-module.
Kalle
On Wed, Feb 22, 2012 at 10:00 AM, George Christman
<gc...@cardaddy.com> wrote:
> Hello, our company has decided to build a sso service for all our
> applications. Up until now, I've always used the tapestry-security project,
> however I was just directed to add a filter to my web.xml which would handle
> authorization and role management. The remote login just redirects the user
> to an external login form and then redirects the user back to the
> application.
>
> My concerns/questions. I love the goodies provided to me by the
> tapestry-security project such as securing methods, role management etc.
> Would there be away I could continue to use the tapestry-security project
> with this custom remote login? Since I'm not managing login, I wouldn't have
> any credentials to pass into SimpleAuthenticationInfo, the only thing
> returned from the remote login is a username, roles, and whether or not they
> are authorized.
>
> This is my realm classed currently used to handle authorization
>
> protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken
> token) throws AuthenticationException {
> UsernamePasswordToken upToken = (UsernamePasswordToken) token;
> String email = upToken.getUsername();
>
> ApplicationUser applicationUser = (ApplicationUser)
> session.createCriteria(ApplicationUser.class)
> .add(Restrictions.eq("email", email))
> .uniqueResult();
>
> if (applicationUser == null) {
> throw new UnknownAccountException();
> }
>
> return buildAuthenticationInfo(applicationUser.getId(),
> applicationUser.getPassword());
> }
>
> private AuthenticationInfo buildAuthenticationInfo(Long userId, String
> password) {
> return new SimpleAuthenticationInfo(userId, password, getName());
> }
>
> Thanks in advance.
>
> --
> View this message in context: http://tapestry.1045711.n5.nabble.com/tapestry-security-w-Remote-Login-tp5505792p5505792.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org