Problems writing an SSO plugin for Alfresco Share 3.3g

metadaddy — Fri, 08 Oct 2010 03:36:09 GMT

I am writing an OpenSSO plugin for Alfresco Share. My spec is to check for the presence and validity of an SSO token in a cookie; if the cookie is not there, or is expired, the user should login to Share in the normal way, but if the cookie is present, and contains a valid token, then the user shoul

Re: Problems writing an SSO plugin for Alfresco Share 3.3g

afaust — Sat, 16 Oct 2010 16:41:13 GMT

Using OpenSSO for authentication or any other method for that matter is totally doable if the basics are understood properly.

a) Share never ever fully authenticates a user. All that authentication plugins can do is forward credentials to the underlying repository and that repository is responsible for the authentication. (Note: NOT the web client, although it provides some of the hooks.)
b) SSO filters of Share have to work in conjunction with endpoint connectors to allow SSO and normal login behaviour depending on the entry point of the user. A SSO filter alone will not work if the endpoint connector (including its authenticator) can't retain the authenticated session on the repository.
c) Authentication filters of the repository / web client applications have to allow for the possibility of SSO and password logins. Usually the documentation/tutorials on that matter follow a SSO-only or login-only approach where both methods can not co-exist. I can not speak to the SourceSense plugin though.

What you need should be these components (based on my experience with the matter of backporting some SPNEGO fixes from 3.3 to 3.2 and enabling co-existence of SSO and login):

a) A filter for Alfresco Share that takes the SSO token, authenticates against the repository by passing it in a call to "/touch" and sets the external authentication flag in the session. Use the SSOAuthenticationFilter as a rough guideline for your implementation.
b) An authenticator for Alfresco Share endpoint connections that checks both the ticket in the connector session and the external authentication flag when determining if a user has already been authenticated. Simply extend the AlfrescoAuthenticator here. (Only this authenticator will later allow your users to both use SSO or normal login.)

You should not need to explicitly call authenticate or login on the UserFactory or the AuthenticationUtil at all for this to work.

topic Problems writing an SSO plugin for Alfresco Share 3.3g in Alfresco Archive

Problems writing an SSO plugin for Alfresco Share 3.3g

Re: Problems writing an SSO plugin for Alfresco Share 3.3g