cancel
Showing results for 
Search instead for 
Did you mean: 

Authentication via client certificate

aleksandarm
Champ in-the-making
Champ in-the-making
Hello,

we have a requirement that the users should be able to authenticate using 
client certificates. Users only have access to Share application.

To accomplish this, so far, we have done the following customizations/extensions:

1. A custom share page is defined, with authentication set to none, in order to bypass standard user-name/password login page.
2. Server(Tomcat) is configured to trigger authentication via CLIENT-CERT authentication method, when this page is accessed.
3. Root certificate is imported into .truststore, so all client certificates can be validated and accepted.
4. Each of these client certificates maps to username that exists in Alfresco repository.

Now, when username is available, is it possiblile, and how would you suggest to authenticate user using only a username.
Is there some API that is available within share application contex, (some equivalent of AuthenticationUtil avaliable in repo)
that can be used to authenticate user using only a username.

If anyone had similar use case, any suggestion or advice would be much appreciated.
3 REPLIES 3

angelborroy
Community Manager Community Manager
Community Manager
We've done something similar by extending SSO mechanism and passing username to SSOAuthenticationFilter.

It would be a way to accomplish your development.
Hyland Developer Evangelist

Thanks for the reply,
I'l follow your suggestion and look into this mechanism.

aleksandarm
Champ in-the-making
Champ in-the-making
Angel Borroy, thanks again for your suggestion, it was very useful

In case that someone ever find it useful, we ended up doing the following:
5. Custom share filter is defined, which adds HttpRequest header containing user name extracted from certificate,
  and passes it further down the filter chain. In a way, this filter within share appliication acts like an external
  authentication system 
6. External authentication is configured on the repo, and the way how Share passes authentication
  information to the Repo is customized according to  https://devcon.alfresco.com/sanjose/sessions/unlocking-secrets-alfresco-authentication