topic Re: External SSO in alfresco share in Alfresco Archive

External SSO in alfresco share

ramjoy22 — Thu, 18 Apr 2013 04:50:58 GMT

I need to test external sso in alfresco share I followed the steps 1. renamed alfresco-4.2.c/tomcat/shared/classes/alfresco/web-extension/share-config-custom.xml.sample as share-config-custom.xml.2. Uncommentd both the <config evaluator="string-compare" and the condition="Remote"> ‍ sections.

Re: External SSO in alfresco share

afaust — Fri, 19 Apr 2013 08:01:12 GMT

Hello,

you can't simply link from your JSP to Alfresco and expect external authentication to work. Your test inside the JSP works because you are directly manipulating an URLConnection. Unless you provide a way for new connections (irregardless if redirected or pointed directly at Alfresco) to be authenticated and a HTTP header added transparently, external authentication will not work. You can't manipulate the HTTP headers of a request that is the result of a redirect.

For linking from an application to Alfresco without having a CAS (central authentication service) to provide real external authentication, I would evaluate the use of login tickets. I.e. have your application access Alfresco like you did in your test and obtain a ticket. Append that dynamically to the redirect URL to pass it to the client. This ticket will automatically login the user with the same context used in your JSP. You may have to provide a special SSO filter that is able to pass the ticket to the Alfresco Repository though - last I checked the default SSOAuthenticationFilter was not capable of passing a ticket.

Regards
Axel

Re: External SSO in alfresco share

ramjoy22 — Fri, 19 Apr 2013 09:10:00 GMT

Thank you for the reply.
I would like to have some clarification ,
1, when i am trying to connect using hhtp url connection or urlconnection, how the ticket get created?
2, when i make request through url connection will it return any ticket
3, how can i get ticket without giving password?

Thank you
Ram

Re: External SSO in alfresco share

shibu — Fri, 19 Apr 2013 11:11:13 GMT

Can you please tell, how to provide a special SSO filter that is able to pass the ticket to the Alfresco Repository?

Re: External SSO in alfresco share

afaust — Fri, 19 Apr 2013 13:39:55 GMT

Hello,

you develop a Java class that implements the Java Servlet API interface "Filter" and register it in the web.xml of Share. In that class, the doFilter method needs to take care of passing a ticket from the request URI to the backend Repository to verify / validate. Please take a look at the Alfresco class SSOAuthenticationFilter for an example of a similar filter available by default.

Regards
Axel

Re: External SSO in alfresco share

afaust — Fri, 19 Apr 2013 13:46:04 GMT

Hello,

1) and 2) You need to implement a web script that generates a returns the ticket for the current user. This web script is addressed by the URI you use to setup a URLConncetion. The ticket should be contained in the response body, which you need to evaluate in your JSP (or Java code) to extract the ticket. This can be done by a simple JavaScript / FreeMarker web script, using the JavaScript session root scope object to retrieve the ticket, i.e.

session.getTicket()‍

3) By using the external authentication approach you've already shown in your original post for the request to retrieve the ticket.

Regards
Axel

Re: External SSO in alfresco share

shibu — Mon, 22 Apr 2013 13:30:08 GMT

I just created a web script to get the ticket of Alfresco Share. Steps which I done are;


 1. Created getticket.get.desc.xml

    <webscript>
      <shortname>Get User Ticket</shortname>
      <description>Personalized greeting</description>
      <url>/getticket</url>
      <authentication>user</authentication>
      <negotiate accept="text/html">html</negotiate>
      <negotiate accept="application/json">json</negotiate>
    </webscript>

   2. created getticket.get.html.ftl (Plain Text)

         ${session.getTicket()}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Next I tried to get it in the jsp code,


<%
 
URL url1 = new URL("http://localhost:8080/alfresco/service/getticket"); 
URLConnection conn = url1.openConnection(); 
conn.setRequestProperty("SsoUserHeader", "admin"); 
for (int i = 0;; i++) { 
   String headerName = conn.getHeaderFieldKey(i);  
   String headerValue = conn.getHeaderField(i);   
   System.out.println(headerName + "===");  
   System.out.println(headerValue);  
   if (headerName == null && headerValue == null) {     break;   } 
}

%>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Output;


null===
HTTP/1.1 401 Unauthorized
Server===
Apache-Coyote/1.1
WWW-Authenticate===
Basic realm="Alfresco"
Content-Type===
text/html;charset=utf-8
Content-Length===
951
Date===
Mon, 22 Apr 2013 13:23:58 GMT
null===
null
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

1)How can I get the ticket here? Its telling unautherized. Can't provide password as it is external SSO.

Re: External SSO in alfresco share

afaust — Wed, 24 Apr 2013 21:55:10 GMT

Hello,

you need to use "wcservice" not "service" in your URL, otherwise SSO will not be procesed ("/service/" and "/s/" never have SSO enabled).

Regards
Axel

Re: External SSO in alfresco share

shibu — Thu, 25 Apr 2013 04:40:00 GMT

Yes, I tried with wcservice.


<%
URL url1 = new URL("http://localhost:8080/alfresco/wcservice/getticket"); 
HttpURLConnection conn = (HttpURLConnection) url1.openConnection();
conn.setRequestProperty("SsoUserHeader", "admin"); 
for (int i = 0;; i++) { 
   String headerName = conn.getHeaderFieldKey(i);  
   String headerValue = conn.getHeaderField(i);   
   System.out.println(headerName + "===");  
   System.out.println(headerValue);  
   if (headerName == null && headerValue == null) {     break;   } 
}
‍‍‍‍‍‍‍‍‍‍‍‍‍

Its giving Internal Server error. SSO is not happening.


null===
HTTP/1.1 500 Internal Server Error
Server===
Apache-Coyote/1.1
Content-Type===
text/html;charset=UTF-8
Transfer-Encoding===
chunked
Date===
Thu, 25 Apr 2013 04:39:39 GMT
Connection===
close
null===
null
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

What I have to do here to get the ticket?

Re: External SSO in alfresco share

afaust — Sat, 27 Apr 2013 19:39:16 GMT

Hello,

what is the precise error in the logs?

Regards
Axel

Re: External SSO in alfresco share

shibu — Mon, 29 Apr 2013 11:22:20 GMT

Thanx for the reply.
Error logs are posting here…


16:50:15,424 ERROR [org.springframework.extensions.webscripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 03290003 Invalid mediatype:  *; q=.2 does not consists of type and subtype
org.springframework.extensions.webscripts.WebScriptException: 03290003 Invalid mediatype:  *; q=.2 does not consists of type and subtype
   at org.springframework.extensions.webscripts.MediaType.<init>(MediaType.java:49)
   at org.springframework.extensions.webscripts.NegotiatedFormat.negotiateFormat(NegotiatedFormat.java:77)
   at org.springframework.extensions.webscripts.WebScriptRequestImpl.getFormat(WebScriptRequestImpl.java:153)
   at org.alfresco.repo.web.scripts.RepositoryContainer$BufferedRequest.getFormat(RepositoryContainer.java:1128)
   at org.springframework.extensions.webscripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:50)
   at org.alfresco.repo.web.scripts.RepositoryContainer$3.execute(RepositoryContainer.java:433)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:433)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecute(RepositoryContainer.java:495)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecuteAs(RepositoryContainer.java:533)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:349)
   at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:377)
   at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:209)
   at org.springframework.extensions.webscripts.servlet.WebScriptServlet.service(WebScriptServlet.java:118)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
   at org.alfresco.repo.web.filter.beans.NullFilter.doFilter(NullFilter.java:68)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
   at java.lang.reflect.Method.invoke(Method.java:601)
   at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:116)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
   at $Proxy237.doFilter(Unknown Source)
   at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:82)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
   at org.alfresco.web.app.servlet.WebScriptSSOAuthenticationFilter.doFilter(WebScriptSSOAuthenticationFilter.java:140)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
   at java.lang.reflect.Method.invoke(Method.java:601)
   at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:103)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
   at $Proxy237.doFilter(Unknown Source)
   at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:82)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
   at org.alfresco.web.app.servlet.GlobalLocalizationFilter.doFilter(GlobalLocalizationFilter.java:61)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
   at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
   at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:929)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
   at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1002)
   at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
   at org.apache.tomcat.util.net.AprEndpoint$SocketWithOptionsProcessor.run(AprEndpoint.java:1771)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
   at java.lang.Thread.run(Thread.java:722)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: External SSO in alfresco share

afaust — Tue, 30 Apr 2013 15:43:34 GMT

Hello,

Well, your request is missing some parameters that the web script requires to negotiate the response format. Simplest way to fix this would probably be to change your web script to a set response format instead of allowing negotiation. Otherwise you should provide the necessary HTTP headers in your request for the negotiation.

Regards
Axel

Re: External SSO in alfresco share

shibu — Thu, 02 May 2013 09:50:00 GMT

Got the ticket.
Now I am trying to redirect to user dash board by appending the ticket with the URL from JSP page;


/************************Getting Ticket************************************/
URL url1 = new URL("http://localhost:8080/alfresco/wcservice/qdriveticket.json"); 
HttpURLConnection conn = (HttpURLConnection) url1.openConnection();
HttpURLConnection.setFollowRedirects(false);
conn.setRequestProperty("x-alfresco-remote-user", "admin"); 
BufferedReader dis = new BufferedReader( 
        new InputStreamReader(
            conn.getInputStream()));
String ticket;
String tkt=null;
while ((ticket = dis.readLine()) != null)
{
   tkt = ticket;
}  

/*************************************************************************************************/
 url1 = new URL("http://localhost:8080/share/page"); 
 conn = (HttpURLConnection) url1.openConnection();
 conn.setRequestProperty("x-alfresco-remote-user", "admin"); 
 conn.connect();
 dis = new BufferedReader(new InputStreamReader(conn.getInputStream()));
 
 conn.setInstanceFollowRedirects(false);  //you still need to handle redirect manully.
 HttpURLConnection.setFollowRedirects(false); 
 HttpURLConnection.setFollowRedirects(false);

 String newUrl = conn.getHeaderField("Location");


 // open the new connnection again
 conn = (HttpURLConnection) new URL(newUrl+"?ticket="+tkt).openConnection();

 conn.setRequestProperty("x-alfresco-remote-user", "admin");
 
 response.sendRedirect(newUrl+"?ticket="+tkt);

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Redirection happend to;


http://localhost:8080/share/page/user/admin/dashboard?ticket=TICKET_4be43a906429fa148af2f2fb4097d2b60500bda1
‍‍‍

But the log in page is coming.
Is it the problem of not providing a special SSO filter that is able to pass the ticket to the Alfresco Repository?

Re: External SSO in alfresco share

shibu — Mon, 06 May 2013 11:23:40 GMT

Please give me reply…

Re: External SSO in alfresco share

afaust — Tue, 07 May 2013 22:54:43 GMT

<cite>Is it the problem of not providing a special SSO filter that is able to pass the ticket to the Alfresco Repository?</cite>
Yes, that is precisely the problem now. A simple filter should be sufficient that extracts the ticket from the request URL and puts it in the remote connector session as alfTicket parameter. That parameter is already used by the standard code of Share / Surf to enhance requests to the repository. By setting alfTicket yourself, you can reuse the existing code with the least amount of effort and least amount of complex code duplication.

Regards
Axel

Re: External SSO in alfresco share

shibu — Tue, 14 May 2013 09:23:42 GMT

Got basics of Filter and now I am trying to implement in alfresco. The steps which I followed are;
1. Created a simple Jave project in Eclipse.
2. Created a class which implements Filter interface and written code for extracting the ticket from the request URL and puts it in the remote connector session as alf_ticket parameter.
3. Exported it as a jar file and copied into share/WEB-INF/lib.
4. Modified share/WEB-INF/web.xml and registered the same before existing "Authentication Filter".


<!– Special SSO–>
   <filter>
      <description>Share Special SSO authentication support filter.</description>
      <filter-name>Special SSO Authentication Filter</filter-name>
      <filter-class>in.dms.filter.SpecialSSOFilter</filter-class>
   </filter> 

   <filter-mapping>
      <filter-name>Special SSO Authentication Filter</filter-name>
      <url-pattern>/page/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Special SSO Authentication Filter</filter-name>
      <url-pattern>/p/*</url-pattern>
   </filter-mapping>
 <!– Special SSO–>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Java Code which I written is;


public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
                 
       HttpServletRequest httpServletRequest = (HttpServletRequest) req; 
            
       String ticket = httpServletRequest.getParameter("ticket");

       HttpSession session = httpServletRequest.getSession();
    
       if (ticket != null) { 
          
          session.setAttribute("alf_ticket", ticket);
             }
              
       chain.doFilter(req,res); 
   }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Please let me know, What else I have to do here to make it work?

Re: External SSO in alfresco share

afaust — Fri, 17 May 2013 14:13:50 GMT

Hello,

you are currently not setting alf_ticket in the connector session, rather in the "normal" HTTP session which does not help you.

You need something in the line of:


ApplicationContext context = WebApplicationContextUtils.getRequiredWebApplicationContext(getServletContext());
ConnectorService connectorService = (ConnectorService) context.getBean("connector.service");
ConnectorSession connectorSession = connectorService.getConnectorSession(session, "alfresco");
connectorSession.setParameter("alfTicket", ticket);
‍‍‍‍‍‍

Regards
Axel

Re: External SSO in alfresco share

shibu — Mon, 20 May 2013 10:24:00 GMT

Added needed jar files and rewritten the code as ;


 public void init(FilterConfig args) throws ServletException
    {
        if (logger.isDebugEnabled())
            logger.debug("Initializing the SSOAuthenticationFilter.");
        this.servletContext = args.getServletContext();
    }
 public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
        throws IOException, ServletException
    {
        HttpServletRequest httpServletRequest = (HttpServletRequest) req; 
         String ticket = httpServletRequest.getParameter("ticket");
    HttpSession session = httpServletRequest.getSession();
    logger.debug("Initializing the SpecialSSOFilter. Ticket : "+ticket);
    
         if (ticket != null) { 
      ApplicationContext context = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
ConnectorService connectorService = (ConnectorService) context.getBean("connector.service");
ConnectorSession connectorSession = connectorService.getConnectorSession(session, "alfresco");
         connectorSession.setParameter("alfTicket", ticket);
         connectorSession.setParameter("alf_ticket", ticket);    
         } 
    chain.doFilter(req,resp);
    }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

For creating this filter I just followed the steps;
1. Created a simple Jave project in Eclipse.
2. Created a class which implements Filter and CallbackHandler interfaces and written above code.
3. Exported it as a jar file and copied into share/WEB-INF/lib.
4. Modified share/WEB-INF/web.xml and registered the same before existing "Authentication Filter" as mentioned in the last post.

***Should I need to provide any XML for giving bean details with this project? Don't know about "connector.service" more.

***I din do more than anyhing mentioned in th steps above. So please let me know the reason for not working SSO here.

Re: External SSO in alfresco share

afaust — Sun, 26 May 2013 10:21:29 GMT

Hello,

it would be good to know which part of that code is not working. Do you get the log statement that prints out the ticket? Have you tried debugging the filter with Eclipse as a Remote Java Application?

Regards
Axel

Re: External SSO in alfresco share

shibu — Tue, 28 May 2013 10:03:00 GMT

Code:


 public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
        throws IOException, ServletException
    {
       System.out.println("FILTER IS EXECUTING-PRE");
   HttpServletRequest httpServletRequest = (HttpServletRequest) req; 
   String ticket = httpServletRequest.getParameter("ticket");
   HttpSession session = httpServletRequest.getSession();
   System.out.println("Initializing the SpecialSSOFilter. Ticket : "+ticket);        
       
   if (ticket != null) { 
ApplicationContext context = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
ConnectorService connectorService = (ConnectorService) context.getBean("connector.service");
ConnectorSession connectorSession = connectorService.getConnectorSession(session, "alfresco");
      System.out.println("connectorService : "+connectorService);   
      System.out.println("connectorSession : "+connectorSession);
      connectorSession.setParameter("alfTicket", ticket);
      connectorSession.setParameter("alf_ticket", ticket);
System.out.println("ALF_TICKET  "+ connectorSession.getParameter("alfTicket"));               
    } 
    
    chain.doFilter(req,resp);
    System.out.println("FILTER IS EXECUTING-POST");
   }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

After Clicking link(URL appended with the Ticket) to reach user dashboard ;
<strong> "catalina.out" </strong> displays printed statements which I have mentioned in my Special SSO Filter class as;


FILTER IS EXECUTING-PRE
Initializing the SpecialSSOFilter. Ticket : TICKET_817097a9588838bbf40c26f7d3c5aebc737a0907
connectorService : org.springframework.extensions.webscripts.connector.ConnectorService@6a09865e
connectorSession : org.springframework.extensions.webscripts.connector.ConnectorSession@1cf5c34b
ALF_TICKET  TICKET_817097a9588838bbf40c26f7d3c5aebc737a0907
FILTER IS EXECUTING-POST
‍‍‍‍‍‍‍‍

In each click I can see new entries in "catalina.out" with new ticket.
Hope filter is executing perfectly.
But asking for authentication again here if I click the link.