topic Re: correct way to provide the ticket in Alfresco Archive

correct way to provide the ticket

tim-erwin — Tue, 26 Feb 2008 15:29:10 GMT

Hi,the way I chose to handle authentification is:get the ticket from AuthenticationUtils.startSession(username, password); during the first requestin the subsequent requests pass the ticket (saved in the session) to the AuthenticationCallbackHandler; all webservice calls will get the ticket from th

Re: correct way to provide the ticket

rwetherall — Thu, 06 Mar 2008 13:58:16 GMT

Hi,

I've had a look at this issue and I can see your problem.

At the moment the AuthenticationUtils callback method assumes that the ticket will come from the ThreadLocal held in that class. If this is not the case it becomes tricky.

I think the correct way to resolve this is to create an interface called TicketProvider with one method getTicket(). The AuthenticationUtils class could then be provided with a ticket provider and it would use that implementation to get the ticket in the callback method. (instead of the method on AuthenticationUtils)

The default ticketProvider would be implemented to retrieve the ticket in the current manner, but if you wanted a different mechanism you could implement the interface and set your implemenation as the ticket provider to be used instead.

I've created a JIRA issue relating to this change. If you get to it before I do then please feel free to make the change locally and add details of the changes to the JIRA ticket. This will help to speed up the process of getting the change into the main build.

Cheers,
Roy

PS: You can find the JIRA issue here … http://issues.alfresco.com/browse/AR-2150

Re: correct way to provide the ticket

mcirwin — Tue, 06 May 2008 11:50:15 GMT

Does this mean there is no way to resolve the ticket issue in the current release without modifying Alfresco code?

If so - how can we use the Web Services?

I am struggling with this issue right now.

Thanks.

Re: correct way to provide the ticket

tim-erwin — Tue, 06 May 2008 21:33:06 GMT

Hi McIrwin,

there is a way. It just means to re-implement some code. It's mainly copy and paste, however. As mentioned above there is the way sylvian78 did it. That however means that you have to provide either the ticket or ticketified services throughout your application.

I implemented my own ticket callback handler (again, mainly copy and paste from AuthenticationUtils). Provide the services with the correct WS_SECURITY_INFO (containing your callback handler and remove the cookie handler) and you are done.

@Roy: Did not have time to fully implement that small thing, started it, but may still take some time…

Regards and good luck,
Tim-Erwin

Hey, I replied to your post before you even wrote it, nice, uh?

Re: correct way to provide the ticket

mcirwin — Wed, 07 May 2008 10:20:52 GMT

Thanks Tim, I'll give that a try.

One thing I did was implement my own AuthenticationUtils and give that a "setAuthenticationDetails" method. I then saved my authenticationDetails from a successful login.

If I call that set method immediately before trying anything,it works.

repositoryService = WebServiceFactory.getRepositoryService();
repositoryService.setPassword(m_ticket);

try
{
   Reference spacesStoreRef = new Reference();
   spacesStoreRef.setStore(m_spacesStore);
   spacesStoreRef.setPath("/");

   AuthenticationUtils.setAuthenticationDetails(m_authDetails);
   QueryResult qr = repositoryService.queryChildren(spacesStoreRef);

   return getObjectImp(qr);
}
catch (RemoteException re)
{
   m_log.error("Remote exception", re);
   throw new RException(0,re);
}‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍