11:42 a.m.
Author: bdaw
Date: 2006-12-19 12:42:51 -0500 (Tue, 19 Dec 2006)
New Revision: 5903
Added:
trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java
Modified:
trunk/core/src/resources/portal-core-sar/conf/login-config.xml
Log:
- dummy extension of DatabaseServerLoginModule class that inject
"additionalRole" to anable authenticate against portal DB while using LDAP
modules with IdentityLoginModules
Modified: trunk/core/src/resources/portal-core-sar/conf/login-config.xml
===================================================================
--- trunk/core/src/resources/portal-core-sar/conf/login-config.xml 2006-12-19 17:29:13 UTC
(rev 5902)
+++ trunk/core/src/resources/portal-core-sar/conf/login-config.xml 2006-12-19 17:42:51 UTC
(rev 5903)
@@ -35,6 +35,21 @@
<application-policy name="portal">
<authentication>
+ <!--Uncomment this if you want to fall down to users kept in DB after LDAP
authentication fails
+ This may be usefull if you want to use Admin user provided with portal
database schema-->
+ <!--Note that this may lead to the security risk - with LDAP when storing
user profile information
+ that are not mapped as attribute you may have LDAP user synchronized into DB
with no password set.
+ Please see HibernateUserProfileImpl module options
"synchronizeNonExistingUsers", "acceptOtherImplementations"
+ "defaultSynchronizePassword" or
"randomSynchronizePassword" to manage this behaviour-->
+ <!--<login-module code =
"org.jboss.portal.identity.auth.DBIdentityLoginModule"
flag="sufficient">
+ <module-option
name="dsJndiName">java:/PortalDS</module-option>
+ <module-option name="principalsQuery">SELECT jbp_password
FROM jbp_users WHERE jbp_uname=?</module-option>
+ <module-option name="rolesQuery">SELECT jbp_roles.jbp_name,
'Roles' FROM jbp_role_membership INNER JOIN jbp_roles ON
jbp_role_membership.jbp_rid = jbp_roles.jbp_rid INNER JOIN jbp_users ON
jbp_role_membership.jbp_uid = jbp_users.jbp_uid WHERE
jbp_users.jbp_uname=?</module-option>
+ <module-option
name="hashAlgorithm">MD5</module-option>
+ <module-option name="hashEncoding">HEX</module-option>
+ <module-option
name="additionalRole">Authenticated</module-option>
+ </login-module>
+-->
<login-module
code="org.jboss.portal.identity.auth.IdentityLoginModule"
flag="required">
<module-option
name="unauthenticatedIdentity">guest</module-option>
<module-option
name="userModuleJNDIName">java:/portal/UserModule</module-option>
Added: trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java
===================================================================
---
trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java 2006-12-19
17:29:13 UTC (rev 5902)
+++
trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java 2006-12-19
17:42:51 UTC (rev 5903)
@@ -0,0 +1,85 @@
+/*
+* JBoss, a division of Red Hat
+* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated
+* by the @authors tag. See the copyright.txt in the distribution for a
+* full listing of individual contributors.
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/
+package org.jboss.portal.identity.auth;
+
+import org.jboss.security.auth.spi.DatabaseServerLoginModule;
+
+import javax.security.auth.Subject;
+import javax.security.auth.login.LoginException;
+import javax.security.auth.callback.CallbackHandler;
+import java.util.Map;
+import java.util.Collections;
+import java.util.Arrays;
+import java.security.Principal;
+import java.security.acl.Group;
+
+/**
+ * @author <a href="mailto:boleslaw dot dawidowicz at jboss.org">Boleslaw
Dawidowicz</a>
+ * @version $Revision: 1.1 $
+ */
+public class DBIdentityLoginModule extends DatabaseServerLoginModule
+{
+ private String additionalRole;
+
+ public void initialize(Subject subject, CallbackHandler callbackHandler, Map
sharedState, Map options)
+ {
+ super.initialize(subject, callbackHandler, sharedState, options);
+
+ // Get data
+ additionalRole = (String)options.get("additionalRole");
+
+ // Some info
+ log.trace("additionalRole = " + additionalRole);
+ }
+
+
+ protected Group[] getRoleSets() throws LoginException
+ {
+ Group[] rolesGroup = super.getRoleSets();
+ if (additionalRole != null)
+ {
+ try
+ {
+ for (int i = 0; i < rolesGroup.length; i++)
+ {
+ Group group = rolesGroup[i];
+ if (group.getName().equals("Roles"))
+ {
+ group.addMember(createIdentity(additionalRole));
+ }
+ }
+ }
+ catch (Exception e)
+ {
+ //just a try
+ log.error("Error when adding additional role: ", e);
+ }
+ }
+ return rolesGroup;
+ }
+
+ /** Subclass to use the PortalPrincipal to make the username easier to retrieve by the
portal. */
+ protected Principal createIdentity(String username) throws Exception
+ {
+ return new UserPrincipal(username);
+ }
+}