topic Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal in Alfresco Archive

Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

jfrench — Fri, 25 Aug 2006 16:49:06 GMT

Alfresco gurus:I'm trying to implement single sign on between JBoss Portal and Alfresco running as a portlet in the same tomcat servlet container (no cluster). I have Tomcat's SingleSignOn value operational and single sign on works between web applications that use container based authentication jus

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

sebastien_marin — Thu, 31 Aug 2006 08:05:21 GMT

Alfresco gurus:

I'm trying to implement single sign on between JBoss Portal and Alfresco running as a portlet in the same tomcat servlet container (no cluster). I have Tomcat's SingleSignOn value operational and single sign on works between web applications that use container based authentication just fine. I have tried a few hacks to try and propagate the JBoss Portal authenticated user credentials to the Alfresco portlet, but I feel like I'm back to square one.

Can anyone be of service here? I have a good understanding of container based authentication, but only a moderate understanding of Acegi (but I'm reading more right now!).

Environment:
JBoss Portal 1.2.1
Alfresco 1.3 community

Any help would be greatly appreciated!

Hello, I want to do the same thing with a Liferay Portal. So can anyone help us ?

Thank you.

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

jfrench — Thu, 31 Aug 2006 16:17:01 GMT

I think I have a solution via JOSSO. http://www.josso.org/. It is requiring a bit of integration work with Alfresco. Specifically I'm having to write an Authentication Filter patterned off of NTLMAuthenticationFilter.

I'll post my work if it works. (Maybe by next week?)

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

sebastien_marin — Mon, 18 Sep 2006 08:02:52 GMT

I think I have a solution via JOSSO. http://www.josso.org/. It is requiring a bit of integration work with Alfresco. Specifically I'm having to write an Authentication Filter patterned off of NTLMAuthenticationFilter.

I'll post my work if it works. (Maybe by next week?)

Hello, do you perform your implementation ?

Thank you

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

jfrench — Mon, 18 Sep 2006 14:03:57 GMT

I'm still refining it, but, yes, it seems to work. I'm using a PortletFilter as defined by the Apache portals project here:

http://portals.apache.org/bridges/multiproject/portals-bridges-portletfilter/index.html

to create the necessary session environment for single sign on in Alfresco.

I hate to put you off, but I'm not ready to post quite yet as my code is still a bit of a mess.

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

jfrench — Wed, 20 Sep 2006 20:45:52 GMT

OK. Here is my solution.

[1] Install JOSSO 1.4 into your container http://www.josso.org. I followed the JBoss 4 instructions and didn't have any problems. The one modification you will have to make to the JOSSO code is to implement the currently un-implemented WebserviceSSOSessionManager#getSession(String) method:

    public SSOSession getSession(String sessionId)
            throws NoSuchSessionException, SSOSessionException {
        try {
            final org.josso.gateway.session.service.ws.impl.SSOSession session = 
                _wsSSOSessionManager.getSession(sessionId);

            if (session == null) {
                throw new org.josso.gateway.session.exceptions.NoSuchSessionException(null);
            }

            return new org.josso.gateway.session.SSOSession(){
                 public void fireSessionEvent(String type, Object data){
                     throw new UnsupportedOperationException("Not supported by this implementation");
                 }
                 public long getAccessCount(){
                     return session.getAccessCount();
                 }
                 public long getCreationTime(){
                     return session.getCreationTime();
                 }
                 public String getId(){
                     return session.getId();
                 }
                 public long getLastAccessTime(){
                     return session.getLastAccessTime();
                 }
                 public int getMaxInactiveInterval(){
                     return session.getMaxInactiveInterval();
                 }
                 public String getUsername(){
                     return session.getUsername();
                 }
                 public boolean isValid(){
                     return session.isValid();
                 }
                 public void setMaxInactiveInterval(int interval) {
                     session.setMaxInactiveInterval(interval);
                 }
            };

        } catch (java.rmi.RemoteException e) {
            _errorCount++;
            throw new SSOSessionException(e.getMessage(), e);
        } finally {
            _processedCount++;
        }
    }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Once you make this change, make sure you re-install JOSSO.

Note I have submitted a patch to JOSSO with this method implemented at:http://sourceforge.net/tracker/index.php?func=detail&aid=1557480&group_id=116854&atid=676234 so in future versions of JOSSO, it may already be included.

[2] The next thing you want to do is get JBoss Portal authenticating against JOSSO. Since JBoss Portal uses container based authentication, this shouldn't be to hard. However, here are some info that might help…

I put all my josso-*.xml configuration files in $JBOSS_HOME/server/default/conf.

josso-config.xml:

<configuration>
    <hierarchicalXml fileName="josso-gateway-config.xml"/>
    <hierarchicalXml fileName="josso-agent-config.xml"/>
</configuration>


‍‍‍‍‍‍‍

interesting parts of josso-gateway-config.xml:


…
<authentication-scheme>
                <name>basic-authentication</name>
                <class>org.josso.auth.scheme.BindUsernamePasswordAuthScheme</class>
…
                <credential-store>
                    <class>gov.doi.usgs.josso.JBossAuthenticationManagerCredentialStore</class>
                    <authenticationManagerJndiName>java:jaas/portal</authenticationManagerJndiName>
                </credential-store>

…
            <class>gov.doi.usgs.josso.JBossPortalIdentityStore</class>
                <additionalRole>Authenticated</additionalRole>
                <userModuleJdniName>java:/portal/UserModule</userModuleJdniName>
        </sso-identity-store>
…
        <sso-session-store>

            <class>org.josso.gateway.session.service.store.db.DataSourceSessionStore</class>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I've chopped up the josso-gateway-config.xml quite a bit. Here is what I think you need to know:

[a] Use the DataSourceSessionStore so different web applications contacting JOSSO will see the same session information.

JBossAuthenticationManagerCredentialStore performs JOSSO authentication based on a configured JBossAuthenticationManager. This should probably be the AuthenticationManager you already have set up for jboss-portal (in login-config.xml). Here is the code:


package gov.doi.usgs.josso;

import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;

import org.josso.gateway.identity.exceptions.SSOIdentityException;
import org.josso.auth.exceptions.SSOAuthenticationException;
import org.josso.auth.Credential;
import org.josso.auth.CredentialKey;
import org.josso.auth.BindableCredentialStore;
import org.josso.auth.scheme.AuthenticationScheme;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import org.jboss.security.AuthenticationManager;
import org.jboss.security.SimplePrincipal;

/**
 * BindableCredentialStore that authenticates from a JBoss AuthenticationManager
 * loaded from JNDI.
 *
 * @author Jon French
 */
public class JBossAuthenticationManagerCredentialStore implements BindableCredentialStore {

    private static final Log LOG = LogFactory.getLog(JBossAuthenticationManagerCredentialStore.class);

    private String fAuthenticationManagerJndiName = null;

    private AuthenticationScheme fAuthScheme;

    private AuthenticationManager fAuthManager;

    public void setAuthenticationManagerJndiName(String name){
        fAuthenticationManagerJndiName=name;
    }

    /**
     * Sets the Authentication Scheme
     *
     * @param as the authentication scheme
     */
    public void setAuthenticationScheme(AuthenticationScheme as) {
        fAuthScheme = as;
    }

    /**
     * Retrieves the configured Authentication Scheme.
     *
     * @return the authentication scheme.
     */
    protected AuthenticationScheme getAuthenticationScheme() {
        return fAuthScheme;
    }

    public boolean bind(String username, String password) throws SSOAuthenticationException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("userName: " + username + " , " + password);
        }

        if (fAuthManager == null) {
            try{
                Context initContext =   new InitialContext();

                fAuthManager =  (AuthenticationManager) initContext.lookup(fAuthenticationManagerJndiName);
            } catch(NamingException e){
                throw new SSOAuthenticationException("Problem obtaining AuthenticationManager",e);
            }
        }

        SimplePrincipal userNameP = new SimplePrincipal(username);

        return fAuthManager.isValid(userNameP,password);
    }

    public Credential[] loadCredentials(CredentialKey key) throws SSOIdentityException {

        throw new UnsupportedOperationException();
    }

}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

JBossPortalIdentityStore gets JOSSO authorization information from JBossPortal Daos:


package gov.doi.usgs.josso;

import java.util.Iterator;
import java.util.List;
import java.util.LinkedList;
import java.util.Set;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;

import org.josso.gateway.identity.service.store.IdentityStore;
import org.josso.gateway.identity.service.store.UserKey;
import org.josso.gateway.identity.service.store.SimpleUserKey;
import org.josso.gateway.identity.service.BaseUser;
import org.josso.gateway.identity.service.BaseRole;
import org.josso.gateway.identity.service.BaseRoleImpl;
import org.josso.gateway.identity.service.BaseUserImpl;
import org.josso.gateway.identity.exceptions.NoSuchUserException;
import org.josso.gateway.identity.exceptions.SSOIdentityException;
import org.josso.gateway.SSONameValuePair;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import javax.transaction.TransactionManager;

import org.jboss.portal.common.transaction.Transactions;
import org.jboss.portal.core.modules.UserModule;
import org.jboss.portal.core.model.User;
                                               
/**
 * Identity Store that retrieves role information from JBossPortal Daos
 * 
 * @author Jon French
 */
public class JBossPortalIdentityStore implements IdentityStore {

    private static final Log LOG = LogFactory.getLog(JBossPortalIdentityStore.class);

    private String fAdditionalRole,fUserModuleJNDIName;

    private UserModule fUserModule;

    public void setAdditionalRole(String role){
        fAdditionalRole=role;
    }

    public void setUserModuleJdniName(String name){
        fUserModuleJNDIName=name;
    }

    /**
     * This method allows user attributes to be loaded into an object which is 
     * then available to other application via the web service methods. At this point,
     * the method is not fully implemented because I have no need to load these properties
     * at this point
     *
     * @return the user instance with the provided userid
     * @throws NoSuchUserException if the user does not exist
     * @throws SSOIdentityException a fatal exception loading the requested user
     */
    public BaseUser loadUser(final UserKey key) throws NoSuchUserException, SSOIdentityException {

        if (!(key instanceof SimpleUserKey)) {
            throw new SSOIdentityException("Unsupported key type : " + key.getClass().getName());
        }

        /*
        TODO: This should be changed to contact the MyUSGS biz layer in the future 
        */
        try
        {
           TransactionManager tm = (TransactionManager)new InitialContext().lookup("java:/TransactionManager");

           return (BaseUser)Transactions.required(tm, new Transactions.Runnable()
           {
              public Object run() throws Exception
              {
                 try
                 {
                    UserModule module = getUserModule();

                    String uid = ((SimpleUserKey) key).getId();

                    if (LOG.isDebugEnabled()) {
                        LOG.debug("[loadUser] user id: "+ uid);
                    }

                    User user = null;
                    try {
                        user = module.findUserByUserName(uid);
                    }catch(org.jboss.portal.core.model.NoSuchUserException e){
                        LOG.error("No user found for id: " + uid,e);
                        throw new NoSuchUserException(key);
                    }

                    BaseUser bu = new BaseUserImpl();

                    bu.setName(uid);

                    List userProperties = new LinkedList();

                    userProperties.add(new SSONameValuePair("first name", user.getGivenName()));
                    userProperties.add(new SSONameValuePair("last name", user.getFamilyName()));

                    SSONameValuePair[] props = (SSONameValuePair[])
                            userProperties.toArray(new SSONameValuePair[userProperties.size()]);

                    bu.setProperties(props);

                    return bu;
                 }
                 catch (org.jboss.portal.core.modules.ModuleException e)
                 {                      
                    LOG.error("Error retreiving user",e);
                    throw new SSOIdentityException(e);
                 }
              }
           });
        }
        catch (NamingException e)
        {
           throw new SSOIdentityException(e);
        }
    }

    /**
     * Returns the roles associated with a given user key. This implementation
     * pulls info from JBoss Portal.
     * <p>
     * Note that if the <tt>additionalRole</tt> parameter is set, that role
     * will be added to the array of roles for every user
     */ 
    public BaseRole[] findRolesByUserKey(final UserKey key)
            throws SSOIdentityException 
    {
       try
       {
          TransactionManager tm = (TransactionManager)new InitialContext().lookup("java:/TransactionManager");

          return (BaseRole[])Transactions.required(tm, new Transactions.Runnable()
          {
             public Object run() throws Exception
             {
                try
                {
                   UserModule module = getUserModule();

                   User user = module.findUserByUserName(((SimpleUserKey)key).getId());
                   Set roleNames = user.getRoleNames();

                   List roles = new LinkedList();

                   for (Iterator iterator = roleNames.iterator(); iterator.hasNext();)
                   {
                      String roleName = (String)iterator.next();
                      try
                      {
                         BaseRole role = new BaseRoleImpl();
                         role.setName(roleName);
                         roles.add(role);
                      }
                      catch (Exception e)
                      {
                         LOG.warn("Failed to create role:" + roleName, e);
                      }
                   }
                   if (fAdditionalRole != null) {
                       BaseRole role = new BaseRoleImpl();
                       role.setName(fAdditionalRole);
                       roles.add(role);
                   }

                   return (BaseRole[]) roles.toArray(new BaseRole[roles.size()]);
                }
                catch (Exception e)
                {
                   LOG.fatal("Error assigning roles",e);
                   throw new SSOIdentityException(e);
                }
             }
          });
       }
       catch (Exception e)
       {
          throw new SSOIdentityException(e);
       }
    }

    public boolean userExists(UserKey key) throws SSOIdentityException {
        try {
            return loadUser(key) != null;
        } catch (NoSuchUserException e) {
            return false;
        }
    }

    private UserModule getUserModule()
    throws Exception{

        if (fUserModule == null)
        {
           fUserModule = (UserModule)new InitialContext().lookup(fUserModuleJNDIName);
        }
        return fUserModule;
    }
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[3] Now that you have JBoss Portal authenticating JBoss Portal, you need to get Alfresco to recognize your JOSSO authentication cookie and load the Alfresco portlet session environment to mimic a user login. To accomplish this, I wrote a PortletFilter that sits in front of every request to the Alfresco portlet:


package gov.doi.usgs.alfresco.security;

import java.io.IOException;

import javax.portlet.ActionRequest;
import javax.portlet.ActionResponse;
import javax.portlet.PortletException;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;
import javax.portlet.PortletRequest;
import javax.portlet.PortletSession;

import javax.servlet.http.Cookie;

import javax.transaction.UserTransaction;

import org.apache.portals.bridges.portletfilter.PortletFilter;
import org.apache.portals.bridges.portletfilter.PortletFilterChain;
import org.apache.portals.bridges.portletfilter.PortletFilterConfig;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import org.springframework.web.context.WebApplicationContext;

import org.alfresco.model.ContentModel;
import org.alfresco.repo.security.authentication.AuthenticationComponent;
import org.alfresco.service.ServiceRegistry;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.service.transaction.TransactionService;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.LoginBean;
import org.alfresco.web.bean.repository.User;

import org.josso.Lookup;
import org.josso.gateway.Constants;
import org.josso.gateway.session.SSOSession;
import org.josso.gateway.session.service.SSOSessionManager;

/**
 * Filters every request for the Alfresco portlet and makes sure that the correct
 * user PortletSession environment exists so that the user is not asked to re-authenticate
 * 
 * @author Jon French
 */ 
public class AuthenticationPortletFilter implements PortletFilter {

    private static final Log LOG = LogFactory.getLog(AuthenticationPortletFilter.class);

    private AuthenticationService fAuthService;
    private AuthenticationComponent fAuthComponent;
    private PersonService fPersonService;
    private NodeService fNodeService;
    private TransactionService fTransactionService;
    
    public void init(PortletFilterConfig filterConfig) throws PortletException{

        WebApplicationContext ctx = (WebApplicationContext)filterConfig.getPortletConfig().getPortletContext().getAttribute(
              WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE);

        ServiceRegistry serviceRegistry = (ServiceRegistry) ctx.getBean(ServiceRegistry.SERVICE_REGISTRY);
        fNodeService = serviceRegistry.getNodeService();
        fTransactionService = serviceRegistry.getTransactionService();

        fAuthService = (AuthenticationService) ctx.getBean("authenticationService");
        fAuthComponent = (AuthenticationComponent) ctx.getBean("authenticationComponent");
        fPersonService = (PersonService) ctx.getBean("personService");

        if (LOG.isDebugEnabled()) {
            LOG.debug(getClass().getName() + " initialized");
        }
    }

    public void renderFilter(RenderRequest request, RenderResponse response, PortletFilterChain chain)
            throws PortletException, IOException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("here in renderFilter");
        }

        ensureLogin(request);

        chain.renderFilter(request,response);
    }

    public void processActionFilter(ActionRequest request, ActionResponse response, PortletFilterChain chain)
            throws PortletException, IOException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("here in renderFilter.");
        }

        ensureLogin(request);

        chain.processActionFilter(request,response);
    }

    public void destroy(){
    }

    private void ensureLogin(PortletRequest request)
    throws PortletException,IOException {

        PortletSession session = request.getPortletSession();

        User user = (User) session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER);

        if (user == null)
        {
            if (LOG.isDebugEnabled()) {
                LOG.debug("session user attirbute is null.");
            }

            String ssosessionId = retreiveSSOId(request);

            if (ssosessionId == null) {
                /* If the a SSO session id is not stored as a cookie, something is
                wrong since the user should always have to go through JOSSO to get to 
                this filter. */
                throw new PortletException("SSO session cookie is not present");
            }

            SSOSession ssoSession = retrieveSSOSession(ssosessionId);
  
            if (ssoSession == null || !ssoSession.isValid()) {
                throw new PortletException("SSO Session not valid");
            }

            /* Make sure the user is loaded into the PortletSession environment.
            The code below is modeled on the Alfresco org.alfresco.web.app.servlet.NTLMAuthenticationFilter */

            UserTransaction tx = fTransactionService.getUserTransaction();
            NodeRef homeSpaceRef = null;
  
            try
            {
                tx.begin();
  
                // Get user details for the authenticated user
                fAuthComponent.setCurrentUser(ssoSession.getUsername().toLowerCase());
  
                // The user name used may be a different case to the NTLM supplied user name, read the current
                // user and use that name
                String userName = fAuthComponent.getCurrentUserName();
  
                // Setup User object and Home space ID etc.
                NodeRef personNodeRef = fPersonService.getPerson(userName);
                String currentTicket = fAuthService.getCurrentTicket();
                user = new User(userName, currentTicket, personNodeRef);
  
                homeSpaceRef = (NodeRef) fNodeService.getProperty(
                        personNodeRef,
                        ContentModel.PROP_HOMEFOLDER);
                user.setHomeSpaceId(homeSpaceRef.getId());
  
                tx.commit();
            }
            catch (Throwable ex)
            {
                try
                {
                    tx.rollback();
                }
                catch (Exception ex2)
                {
                    LOG.error("Failed to rollback transaction", ex2);
                }
                if(ex instanceof RuntimeException)
                {
                    throw (RuntimeException)ex;
                }
                else if(ex instanceof IOException)
                {
                    throw (IOException)ex;
                }
                else if(ex instanceof PortletException)
                {
                    throw (PortletException)ex;
                }
                else
                {
                    throw new RuntimeException("Authentication setup failed", ex);
                }
            }
  
            // Store the user
  
            session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user);

            /* I'm not sure if this parameter is necessary? */
            session.setAttribute(LoginBean.LOGIN_EXTERNAL_AUTH, Boolean.TRUE);

            // Note! If you wanted to do any fancy Locale stuff, you should do it here.

  
            if ( LOG.isDebugEnabled()){
                LOG.debug("User logged on via JOSSO");
            }
  
            return;
        }
    }

    /**
     * Retreives the JOSSO single sign on cookie from the PortletRequest
     */
    private String retreiveSSOId(PortletRequest request){

        String ssosessionId = null;

        String cookies1 = request.getProperty("cookie"); 

        String[] cookies2 = StringUtils.split(cookies1,";");

        if (cookies2 != null) {

            for (int i = 0;i<cookies2.length;i++) {

                String[] c = StringUtils.split(cookies2[i],"=");

                if (Constants.JOSSO_SINGLE_SIGN_ON_COOKIE.equals(c[0].trim())) {
                    ssosessionId = c[1];
                    break;
                }
            }
        }

        if (LOG.isDebugEnabled()) {
            LOG.debug("SSO cookie found. value: " + ssosessionId);
        }

        return ssosessionId;
    }

    /**
     * Retreive the JOSSO session from JOSSO. 
     */
    private SSOSession retrieveSSOSession(String ssosessionId)
    throws PortletException{

        try{
            SSOSessionManager manager = Lookup.getInstance().lookupSecurityDomain().getSessionManager();

            return manager.getSession(ssosessionId);
        }catch(Exception e){
            throw new PortletException("Problem obtaining SSOSession",e);
        }
    }
}

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

And the requisite changes to alfresco.war/WEB-INF/portlet.xml to make sure the FilterPortlet is deployed:


<?xml version="1.0" encoding="UTF-8"?>
<portlet-app xmlns="http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd" version="1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd">
    <portlet>
        <description>Alfresco Client Portlet</description>
        <portlet-name>AlfrescoClient</portlet-name>
        <portlet-class>org.alfresco.web.app.portlet.AlfrescoFacesPortlet</portlet-class>


        <init-param>
            <name>default-view</name>
            <value>/jsp/login.jsp</value>
        </init-param>

        <supports>
            <mime-type>text/html</mime-type>
            <portlet-mode>VIEW</portlet-mode>
            <portlet-mode>HELP</portlet-mode>
        </supports>

        <portlet-info>
            <title>Alfresco Client Portlet</title>
            <short-title>alfresco-client-portlet</short-title>
        </portlet-info>
    </portlet>

    <portlet id="FilteredAlfresco">
        <portlet-name>FilteredAlfresco</portlet-name>
        <display-name>Filtered Alfresco</display-name>
        <portlet-class>org.apache.portals.bridges.portletfilter.FilterPortlet</portlet-class>
        <init-param>
            <name>portlet-class</name>
            <value>org.alfresco.web.app.portlet.AlfrescoFacesPortlet</value>
        </init-param>
        <!– Important! The default view is where the MyFacesPortlet will take the user
        in absence of any species view id in the users session. This should be the browse page,
        not the login page –>
        <init-param>
            <name>default-view</name>
            <value>/jsp/browse/browse.jsp</value>
        </init-param>
        <init-param>
            <name>portlet-filters</name>
            <value>gov.doi.usgs.alfresco.security.AuthenticationPortletFilter</value>
        </init-param>
        <expiration-cache>-1</expiration-cache>
        <supports>
            <mime-type>text/html</mime-type>
            <portlet-mode>VIEW</portlet-mode>
        </supports>
        <supported-locale>en</supported-locale>
        <supported-locale>ja</supported-locale>
        <portlet-info>
            <title>Filtered Alfresco</title>
            <short-title>This is a filtered portlet for alfresco</short-title>
        </portlet-info>
    </portlet>
</portlet-app>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[4] You need to make sure that the josso*.jar files are in the requisite places to get this all to work. Note that josso-1.4.jar is in the alfresco.war/WEB-INF/lib directory.


[jfrench:/usr/local/jboss/server/default]$find . -name "josso*jar"
./deploy/jbossweb-tomcat55.sar/josso-1.4.jar
./deploy/jbossweb-tomcat55.sar/josso-common-1.4.jar
./deploy/jbossweb-tomcat55.sar/josso-tomcat55-plugin-1.4.jar
./deploy/jbossweb-tomcat55.sar/josso-jboss4-plugin-1.4.jar
./deploy/alfresco.sar/alfresco-1.3.0.war/WEB-INF/lib/josso-1.4.jar
./deploy/josso.ear/josso.war/WEB-INF/lib/josso-1.4.jar
‍‍‍‍‍‍‍‍‍

[5] Other thoughts:

You probably want to comment out the "Login/logout" link of the Alfresco portlet, because you don't want users using alfresco controls for these actions anymore. I haven't done this yet, so I'm not sure where that link is located in the Alfresco jsps.

I haven't thoroughly tested this configuration yet, but I'm sure there are weird corner cases that haven't yet been vetted, but it seems to be producing single sign on thus far…

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

sebastien_marin — Thu, 21 Sep 2006 10:11:17 GMT

Hello, it seems to be a good job that you have done !!!

So i have not enought time to try your solution but i am very interested by it.

So, thank you very much, it will be nice for all the community.

Thank you very much.

    public SSOSession getSession(String sessionId)
            throws NoSuchSessionException, SSOSessionException {
        try {
            final org.josso.gateway.session.service.ws.impl.SSOSession session = 
                _wsSSOSessionManager.getSession(sessionId);

            if (session == null) {
                throw new org.josso.gateway.session.exceptions.NoSuchSessionException(null);
            }

            return new org.josso.gateway.session.SSOSession(){
                 public void fireSessionEvent(String type, Object data){
                     throw new UnsupportedOperationException("Not supported by this implementation");
                 }
                 public long getAccessCount(){
                     return session.getAccessCount();
                 }
                 public long getCreationTime(){
                     return session.getCreationTime();
                 }
                 public String getId(){
                     return session.getId();
                 }
                 public long getLastAccessTime(){
                     return session.getLastAccessTime();
                 }
                 public int getMaxInactiveInterval(){
                     return session.getMaxInactiveInterval();
                 }
                 public String getUsername(){
                     return session.getUsername();
                 }
                 public boolean isValid(){
                     return session.isValid();
                 }
                 public void setMaxInactiveInterval(int interval) {
                     session.setMaxInactiveInterval(interval);
                 }
            };

        } catch (java.rmi.RemoteException e) {
            _errorCount++;
            throw new SSOSessionException(e.getMessage(), e);
        } finally {
            _processedCount++;
        }
    }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

<configuration>
    <hierarchicalXml fileName="josso-gateway-config.xml"/>
    <hierarchicalXml fileName="josso-agent-config.xml"/>
</configuration>


‍‍‍‍‍‍‍

interesting parts of josso-gateway-config.xml:


…
<authentication-scheme>
                <name>basic-authentication</name>
                <class>org.josso.auth.scheme.BindUsernamePasswordAuthScheme</class>
…
                <credential-store>
                    <class>gov.doi.usgs.josso.JBossAuthenticationManagerCredentialStore</class>
                    <authenticationManagerJndiName>java:jaas/portal</authenticationManagerJndiName>
                </credential-store>

…
            <class>gov.doi.usgs.josso.JBossPortalIdentityStore</class>
                <additionalRole>Authenticated</additionalRole>
                <userModuleJdniName>java:/portal/UserModule</userModuleJdniName>
        </sso-identity-store>
…
        <sso-session-store>

            <class>org.josso.gateway.session.service.store.db.DataSourceSessionStore</class>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍


package gov.doi.usgs.josso;

import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;

import org.josso.gateway.identity.exceptions.SSOIdentityException;
import org.josso.auth.exceptions.SSOAuthenticationException;
import org.josso.auth.Credential;
import org.josso.auth.CredentialKey;
import org.josso.auth.BindableCredentialStore;
import org.josso.auth.scheme.AuthenticationScheme;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import org.jboss.security.AuthenticationManager;
import org.jboss.security.SimplePrincipal;

/**
 * BindableCredentialStore that authenticates from a JBoss AuthenticationManager
 * loaded from JNDI.
 *
 * @author Jon French
 */
public class JBossAuthenticationManagerCredentialStore implements BindableCredentialStore {

    private static final Log LOG = LogFactory.getLog(JBossAuthenticationManagerCredentialStore.class);

    private String fAuthenticationManagerJndiName = null;

    private AuthenticationScheme fAuthScheme;

    private AuthenticationManager fAuthManager;

    public void setAuthenticationManagerJndiName(String name){
        fAuthenticationManagerJndiName=name;
    }

    /**
     * Sets the Authentication Scheme
     *
     * @param as the authentication scheme
     */
    public void setAuthenticationScheme(AuthenticationScheme as) {
        fAuthScheme = as;
    }

    /**
     * Retrieves the configured Authentication Scheme.
     *
     * @return the authentication scheme.
     */
    protected AuthenticationScheme getAuthenticationScheme() {
        return fAuthScheme;
    }

    public boolean bind(String username, String password) throws SSOAuthenticationException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("userName: " + username + " , " + password);
        }

        if (fAuthManager == null) {
            try{
                Context initContext =   new InitialContext();

                fAuthManager =  (AuthenticationManager) initContext.lookup(fAuthenticationManagerJndiName);
            } catch(NamingException e){
                throw new SSOAuthenticationException("Problem obtaining AuthenticationManager",e);
            }
        }

        SimplePrincipal userNameP = new SimplePrincipal(username);

        return fAuthManager.isValid(userNameP,password);
    }

    public Credential[] loadCredentials(CredentialKey key) throws SSOIdentityException {

        throw new UnsupportedOperationException();
    }

}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

JBossPortalIdentityStore gets JOSSO authorization information from JBossPortal Daos:


package gov.doi.usgs.josso;

import java.util.Iterator;
import java.util.List;
import java.util.LinkedList;
import java.util.Set;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;

import org.josso.gateway.identity.service.store.IdentityStore;
import org.josso.gateway.identity.service.store.UserKey;
import org.josso.gateway.identity.service.store.SimpleUserKey;
import org.josso.gateway.identity.service.BaseUser;
import org.josso.gateway.identity.service.BaseRole;
import org.josso.gateway.identity.service.BaseRoleImpl;
import org.josso.gateway.identity.service.BaseUserImpl;
import org.josso.gateway.identity.exceptions.NoSuchUserException;
import org.josso.gateway.identity.exceptions.SSOIdentityException;
import org.josso.gateway.SSONameValuePair;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import javax.transaction.TransactionManager;

import org.jboss.portal.common.transaction.Transactions;
import org.jboss.portal.core.modules.UserModule;
import org.jboss.portal.core.model.User;
                                               
/**
 * Identity Store that retrieves role information from JBossPortal Daos
 * 
 * @author Jon French
 */
public class JBossPortalIdentityStore implements IdentityStore {

    private static final Log LOG = LogFactory.getLog(JBossPortalIdentityStore.class);

    private String fAdditionalRole,fUserModuleJNDIName;

    private UserModule fUserModule;

    public void setAdditionalRole(String role){
        fAdditionalRole=role;
    }

    public void setUserModuleJdniName(String name){
        fUserModuleJNDIName=name;
    }

    /**
     * This method allows user attributes to be loaded into an object which is 
     * then available to other application via the web service methods. At this point,
     * the method is not fully implemented because I have no need to load these properties
     * at this point
     *
     * @return the user instance with the provided userid
     * @throws NoSuchUserException if the user does not exist
     * @throws SSOIdentityException a fatal exception loading the requested user
     */
    public BaseUser loadUser(final UserKey key) throws NoSuchUserException, SSOIdentityException {

        if (!(key instanceof SimpleUserKey)) {
            throw new SSOIdentityException("Unsupported key type : " + key.getClass().getName());
        }

        /*
        TODO: This should be changed to contact the MyUSGS biz layer in the future 
        */
        try
        {
           TransactionManager tm = (TransactionManager)new InitialContext().lookup("java:/TransactionManager");

           return (BaseUser)Transactions.required(tm, new Transactions.Runnable()
           {
              public Object run() throws Exception
              {
                 try
                 {
                    UserModule module = getUserModule();

                    String uid = ((SimpleUserKey) key).getId();

                    if (LOG.isDebugEnabled()) {
                        LOG.debug("[loadUser] user id: "+ uid);
                    }

                    User user = null;
                    try {
                        user = module.findUserByUserName(uid);
                    }catch(org.jboss.portal.core.model.NoSuchUserException e){
                        LOG.error("No user found for id: " + uid,e);
                        throw new NoSuchUserException(key);
                    }

                    BaseUser bu = new BaseUserImpl();

                    bu.setName(uid);

                    List userProperties = new LinkedList();

                    userProperties.add(new SSONameValuePair("first name", user.getGivenName()));
                    userProperties.add(new SSONameValuePair("last name", user.getFamilyName()));

                    SSONameValuePair[] props = (SSONameValuePair[])
                            userProperties.toArray(new SSONameValuePair[userProperties.size()]);

                    bu.setProperties(props);

                    return bu;
                 }
                 catch (org.jboss.portal.core.modules.ModuleException e)
                 {                      
                    LOG.error("Error retreiving user",e);
                    throw new SSOIdentityException(e);
                 }
              }
           });
        }
        catch (NamingException e)
        {
           throw new SSOIdentityException(e);
        }
    }

    /**
     * Returns the roles associated with a given user key. This implementation
     * pulls info from JBoss Portal.
     * <p>
     * Note that if the <tt>additionalRole</tt> parameter is set, that role
     * will be added to the array of roles for every user
     */ 
    public BaseRole[] findRolesByUserKey(final UserKey key)
            throws SSOIdentityException 
    {
       try
       {
          TransactionManager tm = (TransactionManager)new InitialContext().lookup("java:/TransactionManager");

          return (BaseRole[])Transactions.required(tm, new Transactions.Runnable()
          {
             public Object run() throws Exception
             {
                try
                {
                   UserModule module = getUserModule();

                   User user = module.findUserByUserName(((SimpleUserKey)key).getId());
                   Set roleNames = user.getRoleNames();

                   List roles = new LinkedList();

                   for (Iterator iterator = roleNames.iterator(); iterator.hasNext();)
                   {
                      String roleName = (String)iterator.next();
                      try
                      {
                         BaseRole role = new BaseRoleImpl();
                         role.setName(roleName);
                         roles.add(role);
                      }
                      catch (Exception e)
                      {
                         LOG.warn("Failed to create role:" + roleName, e);
                      }
                   }
                   if (fAdditionalRole != null) {
                       BaseRole role = new BaseRoleImpl();
                       role.setName(fAdditionalRole);
                       roles.add(role);
                   }

                   return (BaseRole[]) roles.toArray(new BaseRole[roles.size()]);
                }
                catch (Exception e)
                {
                   LOG.fatal("Error assigning roles",e);
                   throw new SSOIdentityException(e);
                }
             }
          });
       }
       catch (Exception e)
       {
          throw new SSOIdentityException(e);
       }
    }

    public boolean userExists(UserKey key) throws SSOIdentityException {
        try {
            return loadUser(key) != null;
        } catch (NoSuchUserException e) {
            return false;
        }
    }

    private UserModule getUserModule()
    throws Exception{

        if (fUserModule == null)
        {
           fUserModule = (UserModule)new InitialContext().lookup(fUserModuleJNDIName);
        }
        return fUserModule;
    }
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍


package gov.doi.usgs.alfresco.security;

import java.io.IOException;

import javax.portlet.ActionRequest;
import javax.portlet.ActionResponse;
import javax.portlet.PortletException;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;
import javax.portlet.PortletRequest;
import javax.portlet.PortletSession;

import javax.servlet.http.Cookie;

import javax.transaction.UserTransaction;

import org.apache.portals.bridges.portletfilter.PortletFilter;
import org.apache.portals.bridges.portletfilter.PortletFilterChain;
import org.apache.portals.bridges.portletfilter.PortletFilterConfig;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import org.springframework.web.context.WebApplicationContext;

import org.alfresco.model.ContentModel;
import org.alfresco.repo.security.authentication.AuthenticationComponent;
import org.alfresco.service.ServiceRegistry;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.service.transaction.TransactionService;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.LoginBean;
import org.alfresco.web.bean.repository.User;

import org.josso.Lookup;
import org.josso.gateway.Constants;
import org.josso.gateway.session.SSOSession;
import org.josso.gateway.session.service.SSOSessionManager;

/**
 * Filters every request for the Alfresco portlet and makes sure that the correct
 * user PortletSession environment exists so that the user is not asked to re-authenticate
 * 
 * @author Jon French
 */ 
public class AuthenticationPortletFilter implements PortletFilter {

    private static final Log LOG = LogFactory.getLog(AuthenticationPortletFilter.class);

    private AuthenticationService fAuthService;
    private AuthenticationComponent fAuthComponent;
    private PersonService fPersonService;
    private NodeService fNodeService;
    private TransactionService fTransactionService;
    
    public void init(PortletFilterConfig filterConfig) throws PortletException{

        WebApplicationContext ctx = (WebApplicationContext)filterConfig.getPortletConfig().getPortletContext().getAttribute(
              WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE);

        ServiceRegistry serviceRegistry = (ServiceRegistry) ctx.getBean(ServiceRegistry.SERVICE_REGISTRY);
        fNodeService = serviceRegistry.getNodeService();
        fTransactionService = serviceRegistry.getTransactionService();

        fAuthService = (AuthenticationService) ctx.getBean("authenticationService");
        fAuthComponent = (AuthenticationComponent) ctx.getBean("authenticationComponent");
        fPersonService = (PersonService) ctx.getBean("personService");

        if (LOG.isDebugEnabled()) {
            LOG.debug(getClass().getName() + " initialized");
        }
    }

    public void renderFilter(RenderRequest request, RenderResponse response, PortletFilterChain chain)
            throws PortletException, IOException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("here in renderFilter");
        }

        ensureLogin(request);

        chain.renderFilter(request,response);
    }

    public void processActionFilter(ActionRequest request, ActionResponse response, PortletFilterChain chain)
            throws PortletException, IOException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("here in renderFilter.");
        }

        ensureLogin(request);

        chain.processActionFilter(request,response);
    }

    public void destroy(){
    }

    private void ensureLogin(PortletRequest request)
    throws PortletException,IOException {

        PortletSession session = request.getPortletSession();

        User user = (User) session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER);

        if (user == null)
        {
            if (LOG.isDebugEnabled()) {
                LOG.debug("session user attirbute is null.");
            }

            String ssosessionId = retreiveSSOId(request);

            if (ssosessionId == null) {
                /* If the a SSO session id is not stored as a cookie, something is
                wrong since the user should always have to go through JOSSO to get to 
                this filter. */
                throw new PortletException("SSO session cookie is not present");
            }

            SSOSession ssoSession = retrieveSSOSession(ssosessionId);
  
            if (ssoSession == null || !ssoSession.isValid()) {
                throw new PortletException("SSO Session not valid");
            }

            /* Make sure the user is loaded into the PortletSession environment.
            The code below is modeled on the Alfresco org.alfresco.web.app.servlet.NTLMAuthenticationFilter */

            UserTransaction tx = fTransactionService.getUserTransaction();
            NodeRef homeSpaceRef = null;
  
            try
            {
                tx.begin();
  
                // Get user details for the authenticated user
                fAuthComponent.setCurrentUser(ssoSession.getUsername().toLowerCase());
  
                // The user name used may be a different case to the NTLM supplied user name, read the current
                // user and use that name
                String userName = fAuthComponent.getCurrentUserName();
  
                // Setup User object and Home space ID etc.
                NodeRef personNodeRef = fPersonService.getPerson(userName);
                String currentTicket = fAuthService.getCurrentTicket();
                user = new User(userName, currentTicket, personNodeRef);
  
                homeSpaceRef = (NodeRef) fNodeService.getProperty(
                        personNodeRef,
                        ContentModel.PROP_HOMEFOLDER);
                user.setHomeSpaceId(homeSpaceRef.getId());
  
                tx.commit();
            }
            catch (Throwable ex)
            {
                try
                {
                    tx.rollback();
                }
                catch (Exception ex2)
                {
                    LOG.error("Failed to rollback transaction", ex2);
                }
                if(ex instanceof RuntimeException)
                {
                    throw (RuntimeException)ex;
                }
                else if(ex instanceof IOException)
                {
                    throw (IOException)ex;
                }
                else if(ex instanceof PortletException)
                {
                    throw (PortletException)ex;
                }
                else
                {
                    throw new RuntimeException("Authentication setup failed", ex);
                }
            }
  
            // Store the user
  
            session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user);

            /* I'm not sure if this parameter is necessary? */
            session.setAttribute(LoginBean.LOGIN_EXTERNAL_AUTH, Boolean.TRUE);

            // Note! If you wanted to do any fancy Locale stuff, you should do it here.

  
            if ( LOG.isDebugEnabled()){
                LOG.debug("User logged on via JOSSO");
            }
  
            return;
        }
    }

    /**
     * Retreives the JOSSO single sign on cookie from the PortletRequest
     */
    private String retreiveSSOId(PortletRequest request){

        String ssosessionId = null;

        String cookies1 = request.getProperty("cookie"); 

        String[] cookies2 = StringUtils.split(cookies1,";");

        if (cookies2 != null) {

            for (int i = 0;i<cookies2.length;i++) {

                String[] c = StringUtils.split(cookies2[i],"=");

                if (Constants.JOSSO_SINGLE_SIGN_ON_COOKIE.equals(c[0].trim())) {
                    ssosessionId = c[1];
                    break;
                }
            }
        }

        if (LOG.isDebugEnabled()) {
            LOG.debug("SSO cookie found. value: " + ssosessionId);
        }

        return ssosessionId;
    }

    /**
     * Retreive the JOSSO session from JOSSO. 
     */
    private SSOSession retrieveSSOSession(String ssosessionId)
    throws PortletException{

        try{
            SSOSessionManager manager = Lookup.getInstance().lookupSecurityDomain().getSessionManager();

            return manager.getSession(ssosessionId);
        }catch(Exception e){
            throw new PortletException("Problem obtaining SSOSession",e);
        }
    }
}

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

And the requisite changes to alfresco.war/WEB-INF/portlet.xml to make sure the FilterPortlet is deployed:


<?xml version="1.0" encoding="UTF-8"?>
<portlet-app xmlns="http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd" version="1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd">
    <portlet>
        <description>Alfresco Client Portlet</description>
        <portlet-name>AlfrescoClient</portlet-name>
        <portlet-class>org.alfresco.web.app.portlet.AlfrescoFacesPortlet</portlet-class>


        <init-param>
            <name>default-view</name>
            <value>/jsp/login.jsp</value>
        </init-param>

        <supports>
            <mime-type>text/html</mime-type>
            <portlet-mode>VIEW</portlet-mode>
            <portlet-mode>HELP</portlet-mode>
        </supports>

        <portlet-info>
            <title>Alfresco Client Portlet</title>
            <short-title>alfresco-client-portlet</short-title>
        </portlet-info>
    </portlet>

    <portlet id="FilteredAlfresco">
        <portlet-name>FilteredAlfresco</portlet-name>
        <display-name>Filtered Alfresco</display-name>
        <portlet-class>org.apache.portals.bridges.portletfilter.FilterPortlet</portlet-class>
        <init-param>
            <name>portlet-class</name>
            <value>org.alfresco.web.app.portlet.AlfrescoFacesPortlet</value>
        </init-param>
        <!– Important! The default view is where the MyFacesPortlet will take the user
        in absence of any species view id in the users session. This should be the browse page,
        not the login page –>
        <init-param>
            <name>default-view</name>
            <value>/jsp/browse/browse.jsp</value>
        </init-param>
        <init-param>
            <name>portlet-filters</name>
            <value>gov.doi.usgs.alfresco.security.AuthenticationPortletFilter</value>
        </init-param>
        <expiration-cache>-1</expiration-cache>
        <supports>
            <mime-type>text/html</mime-type>
            <portlet-mode>VIEW</portlet-mode>
        </supports>
        <supported-locale>en</supported-locale>
        <supported-locale>ja</supported-locale>
        <portlet-info>
            <title>Filtered Alfresco</title>
            <short-title>This is a filtered portlet for alfresco</short-title>
        </portlet-info>
    </portlet>
</portlet-app>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[4] You need to make sure that the josso*.jar files are in the requisite places to get this all to work. Note that josso-1.4.jar is in the alfresco.war/WEB-INF/lib directory.


[jfrench:/usr/local/jboss/server/default]$find . -name "josso*jar"
./deploy/jbossweb-tomcat55.sar/josso-1.4.jar
./deploy/jbossweb-tomcat55.sar/josso-common-1.4.jar
./deploy/jbossweb-tomcat55.sar/josso-tomcat55-plugin-1.4.jar
./deploy/jbossweb-tomcat55.sar/josso-jboss4-plugin-1.4.jar
./deploy/alfresco.sar/alfresco-1.3.0.war/WEB-INF/lib/josso-1.4.jar
./deploy/josso.ear/josso.war/WEB-INF/lib/josso-1.4.jar
‍‍‍‍‍‍‍‍‍

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

knocksuman — Mon, 09 Oct 2006 09:45:24 GMT

I'm trying to implement single sign on between JLiferay Portal and Alfresco running as a portlet in the same tomcat servlet container (no cluster). I have Tomcat's SingleSignOn value operational and single sign on works between web applications that use container based authentication just fine. I have tried a few hacks to try and propagate the Liferay Portal authenticated user credentials to the Alfresco portlet, but I feel like I'm back to square one.

Basically i want to enter to alfresco as soon as i provide user id password through Liferay

Please help me urgently

Environment:
Liferay Portal 4.0.0
Alfresco 1.3 community

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

jfrench — Tue, 10 Oct 2006 15:32:04 GMT

I have no experience with Liferay, but the JOSSO/PortletFilter scheme I outlined below should work for any application that seeks to integrate Alfresco with container based single sign on. You would of course need to provide a JOSSO Crendential/IdentityStore appropriate for your application.

Have you tried it yet???

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

knocksuman — Sun, 15 Oct 2006 06:20:26 GMT

Thanks a lot for reply

my new query is : can i know where does alfresco keeps usrId and password and how the flow goes once user provided appropriate credentials

thanks
suman

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

jfrench — Wed, 15 Nov 2006 16:08:57 GMT

Just to keep this thread going, I've made some modifications to the AuthenticationPortletFilter.java to address user logout and a Alfresco configuration parameter.

[1] Logout: I was having trouble with session expiration in Alfresco when someone would log in to JBP as user 1, go to the Alfresco portlet, logout of JBP, log in to JBP as user 2, and go the Alfresco portlet. In this case, the Alfresco portlet would still maintain their session as user 1. To fix this, I added some code to the PortletFilter to make sure the JOSSO session associated with their username is still valid.

[2] Alfresco configuration: Now the PortletFilter takes an initiation parameter to dynamically configure whether or not Alfresco thinks external authentication is occuring. This parameter controls whether or not Alfresco allows an administrative user to create new users (and maybe group associations?).

AuthenticationPortletFilter:

package gov.doi.usgs.alfresco.security;

import java.io.IOException;

import java.util.Map;

import javax.faces.context.FacesContext;

import javax.portlet.ActionRequest;
import javax.portlet.ActionResponse;
import javax.portlet.PortletException;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;
import javax.portlet.PortletRequest;
import javax.portlet.PortletSession;

import javax.servlet.http.Cookie;

import javax.transaction.UserTransaction;

import org.apache.portals.bridges.portletfilter.PortletFilter;
import org.apache.portals.bridges.portletfilter.PortletFilterChain;
import org.apache.portals.bridges.portletfilter.PortletFilterConfig;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import org.springframework.web.context.WebApplicationContext;

import org.alfresco.model.ContentModel;
import org.alfresco.repo.security.authentication.AuthenticationComponent;
import org.alfresco.service.ServiceRegistry;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.PersonService;
import org.alfresco.service.transaction.TransactionService;
import org.alfresco.web.app.servlet.AuthenticationHelper;
import org.alfresco.web.bean.LoginBean;
import org.alfresco.web.bean.repository.User;

import org.josso.Lookup;
import org.josso.gateway.Constants;
import org.josso.gateway.session.SSOSession;
import org.josso.gateway.session.service.SSOSessionManager;

/**
 * Filters every request for the Alfresco portlet and makes sure that the correct
 * user PortletSession environment exists so that the user is not asked to re-authenticate
 * 
 * <h5>Initialization Parameters</h5>
 * 
 * <b>alfrescoExternalAuth</b>: true/false [default true]. Configures Alfresco to use 
 * external authentication or not. If true, certain user controls are not available in Alfresco
 * 
 * @author Jon French
 */ 
public class AuthenticationPortletFilter implements PortletFilter {

    private static final Log LOG = LogFactory.getLog(AuthenticationPortletFilter.class);

    private AuthenticationService fAuthService;
    private AuthenticationComponent fAuthComponent;
    private PersonService fPersonService;
    private NodeService fNodeService;
    private TransactionService fTransactionService;

    private Boolean fAlfrescoExternalAuthentication = Boolean.TRUE;
    
    public void init(PortletFilterConfig filterConfig) throws PortletException{

        WebApplicationContext ctx = (WebApplicationContext)filterConfig.getPortletConfig().getPortletContext().getAttribute(
              WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE);

        ServiceRegistry serviceRegistry = (ServiceRegistry) ctx.getBean(ServiceRegistry.SERVICE_REGISTRY);
        fNodeService = serviceRegistry.getNodeService();
        fTransactionService = serviceRegistry.getTransactionService();

        fAuthService = (AuthenticationService) ctx.getBean("authenticationService");
        fAuthComponent = (AuthenticationComponent) ctx.getBean("authenticationComponent");
        fPersonService = (PersonService) ctx.getBean("personService");

        String alfrescoExternalAuth = filterConfig.getInitParameter("alfrescoExternalAuth"); 

        if (alfrescoExternalAuth != null) {
            fAlfrescoExternalAuthentication = Boolean.valueOf(alfrescoExternalAuth);
            if (LOG.isDebugEnabled()) {
                LOG.debug("Alfresco is configured to external authentication: " + fAlfrescoExternalAuthentication);
            }
        }

        if (LOG.isDebugEnabled()) {
            LOG.debug(getClass().getName() + " initialized");
        }
    }

    public void renderFilter(RenderRequest request, RenderResponse response, PortletFilterChain chain)
            throws PortletException, IOException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("here in renderFilter");
        }

        ensureLogin(request);

        chain.renderFilter(request,response);
    }

    public void processActionFilter(ActionRequest request, ActionResponse response, PortletFilterChain chain)
            throws PortletException, IOException{

        if (LOG.isDebugEnabled()) {
            LOG.debug("here in renderFilter.");
        }

        ensureLogin(request);

        chain.processActionFilter(request,response);
    }

    public void destroy(){
    }

    private void ensureLogin(PortletRequest request)
    throws PortletException,IOException {

        PortletSession session = request.getPortletSession();

        User user = (User) session.getAttribute(AuthenticationHelper.AUTHENTICATION_USER);

        String ssosessionId = retreiveSSOId(request);

        if (ssosessionId == null) {
            /* If the a SSO session id is not stored as a cookie, something is
            wrong since the user should always have to go through JOSSO to get to 
            this filter. */
            throw new PortletException("SSO session cookie is not present");
        }

        SSOSession ssoSession = retrieveSSOSession(ssosessionId);

        /* Case 1:

        The Alfresco user is NOT null, but the SSOSession is null or not valid.
        In this case, something happened (the user logged out, the SSOSession timed out) 
        which ended the SSOSession. 

        Case 2:

        The user name associated with the Alfresco session and SSOSession are NOT the same. 
        This can happen if the user logs out and logs in as a different user.
         
        In either case, I need to end the Alfresco user session.

        I copied the code to end the Alfresco user's sesseion from the 
        org.alfresco.web.bean.LoginBean.logout() method from Alfresco community 1.3

        */
        if (LOG.isDebugEnabled()) {
            LOG.debug("Determining if alfresco user is valid. \n" + 
                      "((ssoSession == null || !ssoSession.isValid()) && user != null): " + ((ssoSession == null || !ssoSession.isValid()) && user != null) + "\n" +
                      "(ssoSession != null && user != null && !user.getUserName().equals(ssoSession.getUsername())): " + (ssoSession != null && user != null && !user.getUserName().equals(ssoSession.getUsername()))
                      );
        }

        if (((ssoSession == null || !ssoSession.isValid()) && user != null) || // case 1
            (ssoSession != null && user != null && !user.getUserName().equals(ssoSession.getUsername()))) // case 2
        {

            LOG.debug("Disabling alfresco user.");

            // invalidate ticket and clear the Security context for this thread
            fAuthService.invalidateTicket(user.getTicket());
            fAuthService.clearCurrentSecurityContext();

            // remove all objects from our session by hand
            // we do this as invalidating the Portal session would invalidate all other portlets!

            if (FacesContext.getCurrentInstance() != null &&
                FacesContext.getCurrentInstance().getExternalContext() != null
                ) {
                Map sesMap = FacesContext.getCurrentInstance().getExternalContext().getSessionMap();

                for (Object key : sesMap.keySet())
                {
                   sesMap.remove(key);
                }
            }

            // Set the user equal to null 

            user = null;
        }

        if (user == null)
        {
            if (LOG.isDebugEnabled()) {
                LOG.debug("session user attribute is null.");
            }
  
            if (ssoSession == null || !ssoSession.isValid()) {
                throw new PortletException("SSO Session not valid");
            }

            /* Make sure the user is loaded into the PortletSession environment.
            The code below is modeled on the Alfresco org.alfresco.web.app.servlet.NTLMAuthenticationFilter */

            UserTransaction tx = fTransactionService.getUserTransaction();
            NodeRef homeSpaceRef = null;
  
            try
            {
                tx.begin();
  
                // Get user details for the authenticated user
                fAuthComponent.setCurrentUser(ssoSession.getUsername().toLowerCase());
  
                // The user name used may be a different case to the NTLM supplied user name, read the current
                // user and use that name
                String userName = fAuthComponent.getCurrentUserName();
  
                // Setup User object and Home space ID etc.
                NodeRef personNodeRef = fPersonService.getPerson(userName);
                String currentTicket = fAuthService.getCurrentTicket();
                user = new User(userName, currentTicket, personNodeRef);
  
                homeSpaceRef = (NodeRef) fNodeService.getProperty(
                        personNodeRef,
                        ContentModel.PROP_HOMEFOLDER);
                user.setHomeSpaceId(homeSpaceRef.getId());
  
                tx.commit();
            }
            catch (Throwable ex)
            {
                try
                {
                    tx.rollback();
                }
                catch (Exception ex2)
                {
                    LOG.error("Failed to rollback transaction", ex2);
                }
                if(ex instanceof RuntimeException)
                {
                    throw (RuntimeException)ex;
                }
                else if(ex instanceof IOException)
                {
                    throw (IOException)ex;
                }
                else if(ex instanceof PortletException)
                {
                    throw (PortletException)ex;
                }
                else
                {
                    throw new RuntimeException("Authentication setup failed", ex);
                }
            }
  
            // Store the user
  
            session.setAttribute(AuthenticationHelper.AUTHENTICATION_USER, user);

            /* This parameter tells Alfresco if you are using external authentication. 

            If true, one thing it will do is remove the "create user" button

            Note that there seems to be a bug in Alfresco in that Alfresco only checks for
            the presence/absence of the the LoginBean.LOGIN_EXTERNAL_AUTH session attribute
            instead of its value. This means that the attribute can equal Boolean.FALSE but
            NOT display the "Create user" button. 
            */
            if (Boolean.TRUE.equals(fAlfrescoExternalAuthentication)) {
                session.setAttribute(LoginBean.LOGIN_EXTERNAL_AUTH,Boolean.TRUE);
            }

            // Note! If you wanted to do any fancy Locale stuff, you should do it here.

  
            if ( LOG.isDebugEnabled()){
                LOG.debug("User logged on via JOSSO");
            }
  
            return;
        }
        else{
            if (LOG.isDebugEnabled()) {
                LOG.debug("session user attribute is NOT null: \n\n" +
                          "username: " + user.getUserName() + "\n");
            }
        }
    }

    /**
     * Retreives the JOSSO single sign on cookie from the PortletRequest
     */
    private String retreiveSSOId(PortletRequest request){

        String ssosessionId = null;

        String cookies1 = request.getProperty("cookie"); 

        String[] cookies2 = StringUtils.split(cookies1,";");

        if (cookies2 != null) {

            for (int i = 0;i<cookies2.length;i++) {

                String[] c = StringUtils.split(cookies2[i],"=");

                if (Constants.JOSSO_SINGLE_SIGN_ON_COOKIE.equals(c[0].trim())) {
                    ssosessionId = c[1];
                    break;
                }
            }
        }

        if (LOG.isDebugEnabled()) {
            LOG.debug("SSO cookie found. value: " + ssosessionId);
        }

        return ssosessionId;
    }

    /**
     * Retreive the JOSSO session from JOSSO. 
     */
    private SSOSession retrieveSSOSession(String ssosessionId)
    throws PortletException{

        try{
            SSOSessionManager manager = Lookup.getInstance().lookupSecurityDomain().getSessionManager();

            return manager.getSession(ssosessionId);
        }catch(Exception e){
            throw new PortletException("Problem obtaining SSOSession",e);
        }
    }
}

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The configuration in portlet.xml:

    <portlet id="FilteredAlfresco">
        <portlet-name>FilteredAlfresco</portlet-name>
        <display-name>Document management</display-name>
        <portlet-class>org.apache.portals.bridges.portletfilter.FilterPortlet</portlet-class>
        <init-param>
            <name>portlet-class</name>
            <value>org.alfresco.web.app.portlet.AlfrescoFacesPortlet</value>
        </init-param>
        <!– Important! The default view is where the MyFacesPortlet will take the user
        in absence of any species view id in the users session. This should be the browse page,
        not the login page –>
        <init-param>
            <name>default-view</name>
            <value>/jsp/browse/browse.jsp</value>
        </init-param>
        <init-param>
            <name>portlet-filters</name>
            <value>gov.doi.usgs.alfresco.security.AuthenticationPortletFilter</value>
        </init-param>
        <init-param>
            <name>gov.doi.usgs.alfresco.security.AuthenticationPortletFilter:alfrescoExternalAuth</name>
            <value>false</value>
        </init-param>
        <expiration-cache>0</expiration-cache>
        <supports>
            <mime-type>text/html</mime-type>
            <portlet-mode>VIEW</portlet-mode>
        </supports>
        <supported-locale>en</supported-locale>
        <supported-locale>ja</supported-locale>
        <portlet-info>
            <title>Filtered Alfresco</title>
            <short-title>This is a filtered portlet for alfresco</short-title>
        </portlet-info>
    </portlet>
</portlet-app>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

nagkumar — Wed, 21 Mar 2007 15:00:43 GMT

Hello, I want to do the same thing with a Liferay Portal. So can anyone help us ?

Thank you.

We (http://www.tejasoft.com) has done liferay and josso integration. More details could be found at http://www.liferay.com/web/guest/devzone/forums/message_boards/message/18481

Regards,
Nagendra
C.T.O
http://www.tejasoft.com

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

hajop — Wed, 04 Apr 2007 18:03:17 GMT

I have the same problem and your solution sounds really great. When I tried to implement it a similar way, I found the following problem.

In your class gov.doi.usgs.josso.JBossPortalIdentityStore you use


import org.jboss.portal.core.modules.UserModule;
import org.jboss.portal.core.model.User;
‍‍‍‍

These classes aren't present in JBoss-Portal since version 2.4 - as far as I've seen. First I thought they simply moved to package org.jboss.portal.identity, but the interface User found there has no method getRoles().

Do you - or anybody else - know what happened there?

Regards,
Hajo

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

szimano — Sat, 08 Sep 2007 11:00:50 GMT

If you want sign on with jb portal and you don't need SSO or you want to modify this so it work on JB Portal 2.6 please refer to

http://forums.alfresco.com/viewtopic.php?p=28282

Many thanks to jfrench for this example, I based on.

Cheers,
Tomek

Re: Single Sign On (SSO) in JBoss / Tomcat / JBoss Portal

codeonjava — Thu, 29 Jul 2010 08:15:07 GMT

Idont know what happen to my AWPr .I am trying to implement AWPr on JBoss Portal ,Every thing goes fine but when portal is displayed only the header is shown no file list display some error shows in FireFox error console.

How can i slove that problem ,

Thanks in advance