[Design of JBoss Portal] - Re: Identity model
by olivwalt
Hello bdaw,
finally i could get through all discussion about LDAP and portal. Even if i`m not 100% up to date, with current status, i want to make some considerations here.
In real life, (anyway in our company), we store only application independent data in LDAP. This means we get the following scenario:
A. Datastore
------------------------------
LDAP Store
- Basic user data
- Basic group data
- User -> group assignmrent
Portal DB
- User/group -> role assignment
- Role -> content assignment
- Portal user data
This leads to 3 problems
1. LDAP doesn`t have portal related attributes, therefor we need
- Attribute based data partitioning
Base User data -> LDAP (e.g uid, password, mail, status, a.s.o)
Portal User data -> Portal DB (theme, lastlogin, a.s.o)
2. LDAP doesn`t know default Portal Users (admin, user, a.s.o), so we need
- User based data partitioning
Company user employee -> LDAP
Portal user "admin" -> Portal DB, this should still work, even if LDAP is configured (e.g. emergency access, initial setup, system users, a.s.o)
3. LDAP doesn`t know default portal Groups, so we need
- Group based data partitioning (same as user based part.)
B. Operations in Portal
------------------------------------------------
1. Read,create,update,delete Users
2. Read,create,update,delete Groups
3. Assign/revoke Users to Groups
4. Assign/revoke Users/Groups to Portal Roles
Depending on the user persistence store configuration, this would lead into the following scenarios:
Read-write LDAP configartion
1. Read,create,update,delete Users from LDAP
2. Read,create,update,delete Groups from LDAP
3. Assign/revoke LDAP Users to LDAP Groups
4. Assign/revoke LDAP Users to Portal DB Groups
5. Assign/revoke LDAP Users/Groups to Portal Roles
6. Read,update,delete Users from Portal DB
7. Read,update,delete Groups from Portal DB
8. Assign/revoke Portal DB Users/Groups to Portal Roles
Read-only LDAP configartion
1. Read Users from LDAP
2. Read Groups from LDAP
3. Assign/revoke LDAP Users to Portal DB Groups
4. Assign/revoke LDAP Users/Groups to Portal Roles
5. Read,create,update,delete Users from Portal DB
6. Read,create,update,delete Groups from Portal DB
7. Assign/revoke Portal DB Users/Groups to Portal Roles
No LDAP configuration
1. Read,create,update,delete Users
2. Read,create,update,delete Groups
3. Assign/revoke Users to Groups
4. Assign/revoke Users/Groups to Portal Roles
C. Principals
--------------
I would do a different implementation, then in your post http://jboss.org/index.html?module=bb&op=viewtopic&t=92487
1. MembershipModule makes no sense to me, you always should work with Objects of type principal
2. The missing Group portal functionality mentioned by bvogt is really a pain for larger projects
Here is what would suggest, based on your draft and on SAP`s implemtation of the User Management Engine.
UserModuleUserModule - provides functionality to get User objects by providing required information.
| - instantiate user objects
| - create new users (possibly by copying the data of an existing one)
| - delete users
| - search for users based on different criteria
UserUser -- provides read and write acces to principals of type User.
| - Get and set User attributes
| - Perform Group operations dd and revoke Users to Group
| - Perform Role operations dd and revoke Users to Role
| - Authorization checks isMemberOf Group or Role
GroupModuleGroupModule - provides functionality to get Group objects by providing required information.
| - instantiate group objects
| - create new groups
| - delete groups
| - search for groups based on different criteria
GroupGroup - read and write access to principals of type Group.
| - Perform User operation add and revoke Users to Group
| - Perform Role operations add and revoke Group to Role
| - Get and Set Group attributes
RoleModuleRoleModule - provides functionality to get Role objects by providing required information.
| - instantiate Role objects
| - create new Roles
| - delete Roles
| - search for Roles based on different criteria
RoleRole - read and write access to principals of type Role.
| - Perform User operation add and revoke Users to Role
| - Perform Group operations add and revoke Group to Role
| - Get and Set Group attributes
D. Persistence configuration
----------------------------
I checked your idendity draft under http://anonsvn.jboss.org/repos/portal/trunk/identity/src/resources/draft/.
As bvogt already mentioned i would merge the config files into one.
- standardidentity-config.xml -> Maps all information to default Portal DB
- ldapidendity-config.xml -> overwrites configured options to LDAP, not configured attributes/principals are still mapped over the standardidendity-config.xml to Portal DB
Therefor the options section in ldapidendity-config.xml wolud look like<options>
| <module type=UserModule>
| <property>
| <name>portal.user.realEmail</name>
| <type>java.lang.String</type>
| <access-mode>read-write</access-mode> <!-- Why at attribute scope, imho this should be global setting -->
| <usage>optional</usage>
| <display-name xml:lang="EN">Real Email</display-name> <!-- Why here? -->
| <description xml:lang="EN">The real email</description> <!-- Why here? -->
| <mapping>
| <type>attribute</type>
| <value>mail</value>
| </mapping>
| </property>
| </property>
| </option />
What do think think about that, bdaw?
Regards Oliver
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3988389#3988389
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3988389
19 years, 4 months
[Design of JBoss Portal] - Accessing UserModule with MyFaces
by djmacpac
Hi,
i have a MyFaces Portlet with a managed Bean. The Portlet works fine. Now I want to access the UserModule in the managed Bean but it won't work.
The Portlet.XML looks like this:
| <portlet id="tree_example">
| <portlet-name>tree_example</portlet-name>
| <display-name>Tree</display-name>
| <portlet-class>org.apache.myfaces.portlet.MyFacesGenericPortlet</portlet-class>
| <init-param>
| <name>default-view</name>
| <value>/tree2.jsp</value>
| </init-param>
| <supports>
| <mime-type>text/html</mime-type>
| <portlet-mode>VIEW</portlet-mode>
| </supports>
| <supported-locale>en</supported-locale>
| <portlet-info>
| <title>Tree-Navigation</title>
| <short-title>The world's simplest tree</short-title>
| </portlet-info>
| </portlet>
|
I try to access the UserModule on this way:
| PortletSession session = (PortletSession)FacesContext.getCurrentInstance().getExternalContext().getSession(true);
| UserModule userModule = (UserModule) session.getPortletContext().getAttribute("UserModule");
| RoleModule roleModule = (RoleModule) session.getPortletContext().getAttribute("RoleModule");
|
But it seems that the UserModule is NULL (probably because of the FacesContext???)
Accessing the UserModule via
| UserModule userModule = (UserModule)new InitialContext().lookup ("java:portal/UserModule");
|
doesn't work because of a ClassCastException...
Can anybody help me?
I'm using JBoss Portal 2.4 and JBoss 4
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3988379#3988379
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3988379
19 years, 4 months