How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Florent_Guillau — Thu, 22 Dec 2011 17:10:35 GMT

I want to use nuxeo-platform-login-portal-sso for authentication, but how do I communicate the client authentication info exactly?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Florent_Guillau — Thu, 22 Dec 2011 17:58:46 GMT

First, note that nuxeo-platform-login-portal-sso is a bit of a misnomer, what this module really does is establish a shared-secret method of authenticating between the Nuxeo server and a client.

Server

On the server side, you establish it using something like:

<extension
    target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
    point="authenticators">
  <authenticationPlugin name="PORTAL_AUTH">
    <loginModulePlugin>Trusting_LM</loginModulePlugin>
    <parameters>
      <parameter name="secret">MySharedSecret</parameter>
      <parameter name="maxAge">60</parameter>
    </parameters>
  </authenticationPlugin>
</extension>

<!-- Include Portal Auth into authentication chain -->
<extension
    target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
    point="chain">
  <authenticationChain>
    <plugins>
      <!--  Keep basic Auth at top of Auth chain to support RSS access via BasicAuth -->
      <plugin>BASIC_AUTH</plugin>
      <plugin>PORTAL_AUTH</plugin>
      <plugin>FORM_AUTH</plugin>
    </plugins>
  </authenticationChain>
</extension>

Here we've chosen to name this authentication method PORTAL_AUTH. Note that the secret parameter contains the shared secret that the client will have to know.

Client

On the client side, you could use one of the existing clients:

Using nuxeo-http-client

nuxeo-http-client is a sample Java client to do REST calls to Nuxeo. You can configure it connect to a server that uses nuxeo-platform-login-portal-sso by doing:

NuxeoServer nxServer = new NuxeoServer("http://127.0.0.1:8080/nuxeo");
nxServer.setAuthType(NuxeoServer.AUTH_TYPE_SECRET);
nxServer.setSharedSecretAuthentication("Administrator", "MySharedSecret");

See src/test/java/org/nuxeo/ecm/http/client/remote/tests/RemoteTests.java in nuxeo-http-client for more.

Using nuxeo-automation-client

nuxeo-automation-client is a more modern Nuxeo Java client using high-level Document abstractions. You can configure it to connect to a server that uses platform-login-portal-sso by doing:

HttpAutomationClient client = new HttpAutomationClient("http://localhost:8080/nuxeo/site/automation");
client.setRequestInterceptor(new PortalSSOAuthInterceptor("MySharedSecret", "Administrator"));
Session session = client.getSession();

See src/test/java/org/nuxeo/ecm/automation/client/jaxrs/test/SampleSSOPortal.java in nuxeo-automation-client for more.

Manual HTTP calls

If you want to do all the calls to Nuxeo yourself, you'll have to decide which HTTP requests to make, and in addition you'll have to send some specific headers to authenticate. The HTTP headers are:

NX_TS: the timestamp, in milliseconds since epoch, when you're generating the request.
NX_RD: a few some random characters.
NX_USER: the user as whom you want to authenticate.
NX_TOKEN: a token proving authentication generated using the algorithm BASE64_MD5(timestamp + ":" + random + ":" + secret + ":" + user)

The token contains the secret but in a hashed form which cannot be reversed by an eavesdropper to generate new requests. The timestamp is used to avoid replay attacks (the delta with the real time on the server cannot be more than the maxAge specified on the server). The random characters are used to avoid pre-computed dictionary attacks.

The following Java code can be used:

import java.security.MessageDigest;
import javax.xml.bind.DatatypeConverter;

public String makeToken(String timestamp, String random, String secret,
        String user) throws Exception {
    String clearToken = timestamp + ":" + random + ":" + secret + ":"
            + user;
    byte[] md5 = MessageDigest.getInstance("MD5").digest(
            clearToken.getBytes());
    return DatatypeConverter.printBase64Binary(md5);
}

As a validation of your code, check that makeToken("1324572561000", "qwertyuiop", "secret", "bob") returns 8y4yXfms/iKge/OtG6d2zg==

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

hachicha_ — Tue, 31 Jan 2012 14:39:47 GMT

With Nuxeo DM 5.5, I tried to use nuxeo-platform-login-portal-sso for authentication using nuxeo-http-client but I have always 401 reponse when calling client.getSession(). Inside server.log, I have this lines

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

OlivierM_ — Wed, 01 Feb 2012 16:38:04 GMT

How does that integrate with other SSO uses? Like if I want to authenticate nuxeo through REMOTE_USER-like environment variable, but still connecting clients to it like you described above?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

mike_frey — Sat, 25 Aug 2012 01:19:46 GMT

Does this approach work if I do not have the user's name/password in LDAP, SQL, or a config file or do I need to have the user name defined somewhere? Is there a need for a "user" entity for documentation ownership, ACls, etc?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Florent_Guillau — Thu, 30 Aug 2012 19:45:53 GMT

This (the first long comment) was posted as an answer but is not an answer. Please ask questions as new questions.

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Florent_Guillau — Thu, 30 Aug 2012 19:47:29 GMT

mike

topic Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal? in Nuxeo Forum

How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Server

Client

Using nuxeo-http-client

Using nuxeo-automation-client

Manual HTTP calls

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?

Re: How do I integrate with nuxeo-platform-login-portal-sso in my portal?