IdentitySession in Activiti 5.5

[zeroone]

Hey,

I wanted to integrate Spring Security into Activit's IdentitySession, but I was uanble to find the IdentitySession-Interface.
Could It be, that it is no longer available under the FQN: org.activiti.engine.impl.cfg.IdentitySession?

Ciao,

Christoph

[auzreal]

something like this:


package org.grails.activiti.springsecurity;

import org.activiti.engine.impl.interceptor.Session;
import org.activiti.engine.impl.interceptor.SessionFactory;

class SpringSecurityUserManagerFactory implements SessionFactory {
   public Class<?> getSessionType() {
      return org.activiti.engine.impl.persistence.entity.UserManager.class;  // original UserManager
   }

   public Session openSession() {
      return new UserManager(); // Customized UserManger extended from org.activiti.engine.impl.persistence.entity.UserManager
   }
}


[limcheekin]

I guess you should return org.activiti.engine.impl.persistence.entity.UserManager instead of the one in package org.grails.activiti.springsecurity. In this way, the custom SessionFactory can override original UserManager settings.

Hi Auzreal,

Great! You spot my mistake and save me many hours of debugging.

Thank you very much!

Warmest regards,
Chee Kin

[p4w3l]

I was able to replace User / Group Manager with mine own impl. and now I can't login into Explorer nor Rest. You can see the trace below. I know that my LDAP implementation connects to LDAP server and all required findXXX methods are tested. I.e. when I type wrong username I have a message about it. But when I type correct username / password I have error. UserManager doesn't implement checkPassword so, … Question: how login can be delegated to customised managers ?

19:35:28,432  ERROR [extensions.webscripts.AbstractRuntime] Exception from execu
teScript - redirecting to status template error: 04270000 Username and password
does not match.
org.springframework.extensions.webscripts.WebScriptException: 04270000 Username
and password does not match.
        at org.activiti.rest.api.identity.LoginPost.executeWebScript(LoginPost.j
ava:75)
        at org.activiti.rest.util.ActivitiWebScript.executeImpl(ActivitiWebScrip
t.java:68)
        at org.springframework.extensions.webscripts.DeclarativeWebScript.execut
e(DeclarativeWebScript.java:64)
        at org.springframework.extensions.webscripts.PresentationContainer.execu
teScript(PresentationContainer.java:69)
        at org.springframework.extensions.webscripts.AbstractRuntime.executeScri
pt(AbstractRuntime.java:333)
        at org.springframework.extensions.webscripts.AbstractRuntime.executeScri
pt(AbstractRuntime.java:189)
        at org.springframework.extensions.webscripts.servlet.WebScriptServlet.se
rvice(WebScriptServlet.java:118)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:298)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:859)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.proce
ss(Http11Protocol.java:588)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:48
9)
        at java.lang.Thread.run(Thread.java:662)
2011-05-27 19:35:28 org.springframework.extensions.webscripts.connector.Authenti
catingConnector handshake
SEVERE: An exception occurred while attempting authentication handshake for endp
oint: http://localhost:8080/activiti-rest/service
org.springframework.extensions.surf.exception.AuthenticationException: 04270000
Username and password does not match.
        at org.activiti.surf.ActivitiRESTAuthenticator.authenticate(ActivitiREST
Authenticator.java:97)
        at org.springframework.extensions.webscripts.connector.AuthenticatingCon
nector.handshake(AuthenticatingConnector.java:403)
        at org.activiti.surf.ActivitiUserFactory.authenticate(ActivitiUserFactor
y.java:141)
        at org.springframework.extensions.surf.mvc.LoginController.handleRequest
Internal(LoginController.java:67)
        at org.springframework.web.servlet.mvc.AbstractController.handleRequest(
AbstractController.java:153)
        at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.ha
ndle(SimpleControllerHandlerAdapter.java:48)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(Dispatch
erServlet.java:771)
        at org.springframework.web.servlet.DispatcherServlet.doService(Dispatche
rServlet.java:716)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(Frame
workServlet.java:647)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServ
let.java:563)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206)
        at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDisp
atcher.java:646)
        at org.apache.catalina.core.ApplicationDispatcher.processRequest(Applica
tionDispatcher.java:436)
        at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationD
ispatcher.java:374)
        at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDis
patcher.java:302)
        at org.tuckey.web.filters.urlrewrite.NormalRewrittenUrl.doRewrite(Normal
RewrittenUrl.java:195)
        at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.j
ava:159)
        at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:14
1)
        at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewri
ter.java:90)
        at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewrit
eFilter.java:417)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:298)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:859)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.proce
ss(Http11Protocol.java:588)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:48
9)
        at java.lang.Thread.run(Thread.java:662)

[limcheekin]

something like this:


package org.grails.activiti.springsecurity;

import org.activiti.engine.impl.interceptor.Session;
import org.activiti.engine.impl.interceptor.SessionFactory;

class SpringSecurityUserManagerFactory implements SessionFactory {
   public Class<?> getSessionType() {
      return org.activiti.engine.impl.persistence.entity.UserManager.class;  // original UserManager
   }

   public Session openSession() {
      return new UserManager(); // Customized UserManger extended from org.activiti.engine.impl.persistence.entity.UserManager
   }
}


Is your custom UserManagerFactory return org.activiti.engine.impl.persistence.entity.UserManager.class in getSessionType()? Please see sample code from Auzreal above.

Best regards,
Chee Kin

[p4w3l]

Yes, I followed this thread and my objects are in place. I.e. when I put wrong username in Explorer then I see exception about that my method findUserById returns null. So my objects are being called. Unfortunately I cannot login into Explorer nor Rest application. Can you with your objects?

[limcheekin]

Yes, I followed this thread and my objects are in place. I.e. when I put wrong username in Explorer then I see exception about that my method findUserById returns null. So my objects are being called. Unfortunately I cannot login into Explorer nor Rest application. Can you with your objects?

I not sure as I didn't tried it and couldn't find time to try it at the moment. Perhaps other developers here can help you.

Best regards,
Chee Kin

[p4w3l]

Somebody please tell me what is returned by:

ProcessEngines.getProcessEngine(engineName).getIdentityService()
in relation to customised UserManager and GroupManager ?!

It looks like returned object contains method:

boolean checkPassword(userId, password)
and I don't see coresponding one in customised UserManager and GroupManager. Even if I implemented one in UserManager it is not called  :x

[p4w3l]

Ok, I found it but still need team advice to fully hack it. The problem with my LDAP is that it stores password hash instead of passwords themself. My customised UserManager.findUserById returns then UserEntity object with empty password property so then CheckPassword 'command' verifies user/pass negative.

I need to replace one or even both of below clases in configuration:

org.activiti.engine.impl.cmd.CheckPassword
org.activiti.engine.impl.IdentityServiceImpl

My customised CheckPassword will try to login into LDAP backend to verify given user/pass pair instead of compare them with User object.

Is it possible to configure activiti.cfg.xml or somewhere else to change CheckPassword command or if not then whole IdentityServiceImpl ?

[bl4cky]

Is anywhere a good explained Tutorial for Ldap integration. I read the whole thread but dont get it.
Can anyone publish his classes? That would be great.

[mtr3691]

Is anywhere a good explained Tutorial for Ldap integration. I read the whole thread but dont get it.
Can anyone publish his classes? That would be great.

I second this post!…a tutorial would be great…