topic Web Script Authentication in Alfresco Archive

Web Script Authentication

tleblanc — Mon, 14 Apr 2008 14:41:38 GMT

We are new at working with web scripts and just when we think we are making progress, we get confused. We are trying to integrate ALfresco into third party applications. We would like to either past the username / password or a ticket no with query parameters. We are not sure what is the best method

Re: Web Script Authentication

pmonks — Mon, 14 Apr 2008 18:46:14 GMT

I'd suggest using HTTP basic authentication (http://en.wikipedia.org/wiki/Basic_access_authentication) which is used for authenticating Web Scripts accessed via /alfresco/service (see http://wiki.alfresco.com/wiki/Web_Scripts#Invoking_a_Web_Script).

HTTP Basic Auth supports pre-emptive authentication (where the username / password is sent in every request) thereby ensuring optimal performance (no duplicate HTTP calls are required), and also making the caller-side state management code simpler (no need to obtain and preserve a "ticket" or "session id" or anything like that). Most modern languages also have support for HTTP Basic Authentication, although some (eg. Java) only support pre-emptive authentication via an extended library (in the case of Java, I'd recommend the commons-httpclient library - http://hc.apache.org/httpclient-3.x/).

Cheers,
Peter

Re: Web Script Authentication

tleblanc — Mon, 14 Apr 2008 21:07:07 GMT

Peter:

Could you give me an example of the sample code that we would need to add to the doclist webscript?

Terry

Re: Web Script Authentication

pmonks — Mon, 14 Apr 2008 21:24:02 GMT

The Web Script itself does not need to be modified - authentication is handled on behalf of all Web Scripts by the Web Script framework. Rather, the calling applications need to be configured or modified to send through the authentication information in the HTTP request to the Web Script.

If (as I'd suggest) you choose to use HTTP Basic Authentication, this means including the username and password in the appropriate HTTP Headers - detailed information on this is available at http://www.faqs.org/rfcs/rfc2617.html.

Cheers,
Peter

Re: Web Script Authentication

mikewaters — Sat, 31 May 2008 09:57:41 GMT

Thanks for your reply to this Peter

My question is how to authenticate a web script when we don't have the user's password?

I am also attempting to integrate with third party applications, and unfortunately in my case the end user's password is not available to include in the web script request. The systems use CAS SSO to authenticate, so the password is held in LDAP and inaccessible to the app.

One option might be to authenticate the web script by implementing CAS SSO over the top of the
alternative web client based service ( /alfresco/wcservice ) ?

Is this possible? Are there any other approaches?

cheers

-Mike

Re: Web Script Authentication

pmonks — Sat, 31 May 2008 14:27:12 GMT

Two approaches spring to mind:

Implement some kind of SSO (NTLM, CAS, Siteminder, what-have-you) across both Alfresco and the third party applications, then ensure that all Web Scripts are called via /alfresco/wcservice (which uses whatever authentication mechanism the Web Client has been configured with ie. SSO. /alfresco/service always uses HTTP basic auth).

Implement the Web Script in Java with authentication set to "none" or "guest", then internally have the code call the AuthenticationUtil.runAs() method (http://dev.alfresco.com/resource/docs/java/repository/org/alfresco/repo/security/authentication/AuthenticationUtil.html) with a different user id to change the authenticated context mid-stream (this API doesn't require knowledge of the password). Note that with this option you may have to figure out how to pass the user id to the Web Script in a way that can't be spoofed by users of the Web Script.

#2 is a bit more involved on the development front, but may be easier to configure than a full SSO solution (which is not difficult for Alfresco, but is fundamentally dependent on having all applications in the ecosystem able to be configured to use SSO - often a tall order! :wink.

Cheers,
Peter

Re: Web Script Authentication

mikewaters — Sat, 31 May 2008 16:10:41 GMT

I had a go at #1 - using CAS Client to filter /wcservice by following http://wiki.alfresco.com/wiki/Central_Authentication_Service_Configuration and adding some filter-mappings on /wcservice

I made a bit of progress, SSO is working fine for the web client but not for web scripts.

Webscript requests do get redirected to CAS and back but then the Alfresco login page is displayed, and even then I can't log in. I just get redirected back to the same page (even carefully typing the creds).

I had a look at the code in the SVN HEAD, but it seems that the AuthenticationHelper code is called differently from the web client. ie not from the filter but from deep within WebScriptServlet.java.This might be where the authenticaton is failing, causing a redirect to the login page…

I'm happy to keep digging with this, but it would be good to get some pointers into the documentation, if there are any wiki pages describing the authentication architecture at this level of detail, and should I be reconfiguring the Spring framework to modify the behaviour or just go in and fix the existing code?

thanks

-Mike

Re: Web Script Authentication

ebell — Mon, 02 Jun 2008 20:22:11 GMT

Does someone have an example of an implementation using option 2?

Re: Web Script Authentication

jdestremps — Tue, 08 Jul 2008 17:55:10 GMT

I tried #2 but I could not get it to work. I'm using 2.9B

Re: Web Script Authentication

alrice — Fri, 08 Aug 2008 17:44:18 GMT

Interesting thread; permit me to revive it! ops: I am trying to figure out how authentication can work in my Java backed web-scripts. Most of my Javascript work in Web Scripts is authenticating as "guest", so I would like to do that in Java backed web script too. Can someone explain what I am observing below?
In a regular Javascript webscript, I can access this repository space which is open to the guest user. Here is the 1 line of Javascript code that returns a valid noderef.

model.nodeTest =  companyhome.childByNamePath( "/Projects/Applications/sessions/1234.txt" );‍

In a Java backed webscript, that extends AbstractWebScript , similar code fails with
Exception net.sf.acegisecurity.BadCredentialsException: Bad credentials presented. It fails on the call to resolveNamePath().

NodeRef companyHomeRef = getRepositoryContext().getCompanyHome();
FileInfo fi = getServiceRegistry().getFileFolderService().resolveNamePath(companyHomeRef,  pathElements);‍‍

Why doesn't the Java-backed web script understand the security context in the same way as the Javascript does?
Would DeclarativeWebScript behave any differently than AbstractWebScript? Thanks for any insight you can shed on this!

Re: Web Script Authentication

pmonks — Fri, 08 Aug 2008 20:40:16 GMT

That sounds like a bug. Which version are you using, and which authentication mechanism (HTTP Basic vs Web Client vs JSR168) are you using to access the Web Script?

Cheers,
Peter

Re: Web Script Authentication

alrice — Fri, 08 Aug 2008 21:35:05 GMT

Peter, Enterprise Network v2.1.3 and using Basic http auth. I tried it with user authentication as well as guest, and same problem.

Re: Web Script Authentication

pmonks — Mon, 11 Aug 2008 02:03:56 GMT

I've implemented what I believe is an identical test case here and tested it on Enterprise 2.1.3, and I'm unable to reproduce the behaviour you describe - I see identical behaviour for both the Java and JS versions of my test Web Script. The behaviour I'm seeing: if I create the file "/Projects/Applications/sessions/1234.txt" as admin, I'm unable to see it via either the JS or Java versions of the Web Script if I authenticate as guest. However as soon as I explicitly permission that file to the "guest" user (eg. by inviting the "guest" user to be a "Consumer" of the "/Projects" space) both the JS and Java versions of the Web Script are able to see the file. I tested via both "/alfresco/wcservice" (Web Client authentication) and "/alfresco/service" (HTTP Basic Authentication) and the behaviour was the same in both cases.

One possible explanation for the behaviour you saw is if you're testing your Web Scripts via "/alfresco/wcservice" - in this case it's easy to use the wrong credentials (eg. "admin" when the intention is to use "guest") since the browser will reuse credentials from prior logins to the Web Client. For this reason it may be better to test using "/alfresco/service" (which always authenticates via HTTP Basic Auth) and tell your browser to drop authenticated sessions in between each test run (thereby forcing the browser to prompt for credentials again, which makes it easier to keep track of which user you're testing with). I ran into this problem myself. ops:

Cheers,
Peter

Re: Web Script Authentication

alrice — Wed, 13 Aug 2008 19:39:27 GMT

Peter, thanks much for your reply & testing!
I can confirm it's working OK now too. Still haven't tracked down the cause of the exception, but I simplified my code and it's working now. In addition, Safari was doing some strange authentication when i was not expecting it. Instead I started using curl from the command line. It gives you exact control over the authentication, cookies, etc. and is good for testing basic scripts.