Author: bdaw Date: 2006-12-19 12:42:51 -0500 (Tue, 19 Dec 2006) New Revision: 5903 Added: trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java Modified: trunk/core/src/resources/portal-core-sar/conf/login-config.xml Log: - dummy extension of DatabaseServerLoginModule class that inject "additionalRole" to anable authenticate against portal DB while using LDAP modules with IdentityLoginModules Modified: trunk/core/src/resources/portal-core-sar/conf/login-config.xml =================================================================== --- trunk/core/src/resources/portal-core-sar/conf/login-config.xml 2006-12-19 17:29:13 UTC (rev 5902) +++ trunk/core/src/resources/portal-core-sar/conf/login-config.xml 2006-12-19 17:42:51 UTC (rev 5903) @@ -35,6 +35,21 @@ <application-policy name="portal"> <authentication> + <!--Uncomment this if you want to fall down to users kept in DB after LDAP authentication fails + This may be usefull if you want to use Admin user provided with portal database schema--> + <!--Note that this may lead to the security risk - with LDAP when storing user profile information + that are not mapped as attribute you may have LDAP user synchronized into DB with no password set. + Please see HibernateUserProfileImpl module options "synchronizeNonExistingUsers", "acceptOtherImplementations" + "defaultSynchronizePassword" or "randomSynchronizePassword" to manage this behaviour--> + <!--<login-module code = "org.jboss.portal.identity.auth.DBIdentityLoginModule" flag="sufficient"> + <module-option name="dsJndiName">java:/PortalDS</module-option> + <module-option name="principalsQuery">SELECT jbp_password FROM jbp_users WHERE jbp_uname=?</module-option> + <module-option name="rolesQuery">SELECT jbp_roles.jbp_name, 'Roles' FROM jbp_role_membership INNER JOIN jbp_roles ON jbp_role_membership.jbp_rid = jbp_roles.jbp_rid INNER JOIN jbp_users ON jbp_role_membership.jbp_uid = jbp_users.jbp_uid WHERE jbp_users.jbp_uname=?</module-option> + <module-option name="hashAlgorithm">MD5</module-option> + <module-option name="hashEncoding">HEX</module-option> + <module-option name="additionalRole">Authenticated</module-option> + </login-module> +--> <login-module code="org.jboss.portal.identity.auth.IdentityLoginModule" flag="required"> <module-option name="unauthenticatedIdentity">guest</module-option> <module-option name="userModuleJNDIName">java:/portal/UserModule</module-option> Added: trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java =================================================================== --- trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java 2006-12-19 17:29:13 UTC (rev 5902) +++ trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java 2006-12-19 17:42:51 UTC (rev 5903) @@ -0,0 +1,85 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.portal.identity.auth; + +import org.jboss.security.auth.spi.DatabaseServerLoginModule; + +import javax.security.auth.Subject; +import javax.security.auth.login.LoginException; +import javax.security.auth.callback.CallbackHandler; +import java.util.Map; +import java.util.Collections; +import java.util.Arrays; +import java.security.Principal; +import java.security.acl.Group; + +/** + * @author <a href="mailto:boleslaw dot dawidowicz at jboss.org">Boleslaw Dawidowicz</a> + * @version $Revision: 1.1 $ + */ +public class DBIdentityLoginModule extends DatabaseServerLoginModule +{ + private String additionalRole; + + public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) + { + super.initialize(subject, callbackHandler, sharedState, options); + + // Get data + additionalRole = (String)options.get("additionalRole"); + + // Some info + log.trace("additionalRole = " + additionalRole); + } + + + protected Group[] getRoleSets() throws LoginException + { + Group[] rolesGroup = super.getRoleSets(); + if (additionalRole != null) + { + try + { + for (int i = 0; i < rolesGroup.length; i++) + { + Group group = rolesGroup[i]; + if (group.getName().equals("Roles")) + { + group.addMember(createIdentity(additionalRole)); + } + } + } + catch (Exception e) + { + //just a try + log.error("Error when adding additional role: ", e); + } + } + return rolesGroup; + } + + /** Subclass to use the PortalPrincipal to make the username easier to retrieve by the portal. */ + protected Principal createIdentity(String username) throws Exception + { + return new UserPrincipal(username); + } +}