Web Script Authentication

[tleblanc]

We are new at working with web scripts and just when we think we are making progress, we get confused. We are trying to integrate ALfresco into third party applications. We would like to either past the username / password or a ticket no with query parameters. We are not sure what is the best method or if this is the proper approach. We would like to call the existing doclist web script as an example and just display the associated doc based on our query definition. Can some one help us with the doclist updates that will allow us to authentication from any third party application. We know that the doclist web script has many options within it and we would change some of its functions, but we cannot get past the basic authentication requirements.

Thanks for any help.

Terry

[pmonks]

I'd suggest using HTTP basic authentication (http://en.wikipedia.org/wiki/Basic_access_authentication) which is used for authenticating Web Scripts accessed via /alfresco/service (see http://wiki.alfresco.com/wiki/Web_Scripts#Invoking_a_Web_Script).

HTTP Basic Auth supports pre-emptive authentication (where the username / password is sent in every request) thereby ensuring optimal performance (no duplicate HTTP calls are required), and also making the caller-side state management code simpler (no need to obtain and preserve a "ticket" or "session id" or anything like that).  Most modern languages also have support for HTTP Basic Authentication, although some (eg. Java) only support pre-emptive authentication via an extended library (in the case of Java, I'd recommend the commons-httpclient library - http://hc.apache.org/httpclient-3.x/).

Cheers,
Peter

[tleblanc]

Peter:

Could you give me an example of the sample code that we would need to add to the doclist webscript?

Terry

[pmonks]

The Web Script itself does not need to be modified - authentication is handled on behalf of all Web Scripts by the Web Script framework.  Rather, the calling applications need to be configured or modified to send through the authentication information in the HTTP request to the Web Script.

If (as I'd suggest) you choose to use HTTP Basic Authentication, this means including the username and password in the appropriate HTTP Headers - detailed information on this is available at http://www.faqs.org/rfcs/rfc2617.html.

Cheers,
Peter

[mikewaters]

Thanks for your reply to this Peter

My question is how to authenticate a web script when we don't have the user's password?

I am also attempting to integrate with third party applications, and unfortunately in my case the end user's password is not available to include in the web script request. The systems use CAS SSO to authenticate, so the password is held in LDAP and inaccessible to the app.

One option might be to authenticate the web script by implementing CAS SSO over the top of the
alternative web client based service ( /alfresco/wcservice ) ?

Is this possible?  Are there any other approaches?

cheers

-Mike

[pmonks]

Two approaches spring to mind:

1. Implement some kind of SSO (NTLM, CAS, Siteminder, what-have-you) across both Alfresco and the third party applications, then ensure that all Web Scripts are called via /alfresco/wcservice (which uses whatever authentication mechanism the Web Client has been configured with ie. SSO.  /alfresco/service always uses HTTP basic auth).


2. Implement the Web Script in Java with authentication set to "none" or "guest", then internally have the code call the AuthenticationUtil.runAs() method (http://dev.alfresco.com/resource/docs/java/repository/org/alfresco/repo/security/authentication/Auth...) with a different user id to change the authenticated context mid-stream (this API doesn't require knowledge of the password).  Note that with this option you may have to figure out how to pass the user id to the Web Script in a way that can't be spoofed by users of the Web Script.

#2 is a bit more involved on the development front, but may be easier to configure than a full SSO solution (which is not difficult for Alfresco, but is fundamentally dependent on having all applications in the ecosystem able to be configured to use SSO - often a tall order!  :wink.

Cheers,
Peter

[mikewaters]

I had a go at #1 - using CAS Client to filter /wcservice by following http://wiki.alfresco.com/wiki/Central_Authentication_Service_Configuration and adding some filter-mappings on /wcservice

I made a bit of progress, SSO is working fine for the web client but not for web scripts.

Webscript requests do get redirected to CAS and back but then the Alfresco login page is displayed, and even then I can't log in. I just get redirected back to the same page (even carefully typing the creds).

I had a look at the code in the SVN HEAD, but it seems that the AuthenticationHelper code is called differently from the web client. ie not from the filter but from deep within WebScriptServlet.java.This might be where the authenticaton is failing, causing a redirect to the login page…

I'm happy to keep digging with this, but it would be good to get some pointers into the documentation, if there are any wiki pages describing the authentication architecture at this level of detail, and should I be reconfiguring the Spring framework to modify the behaviour or just go in and fix the existing code?

thanks

-Mike

[ebell]

Does someone have an example of an implementation using option 2?

[jdestremps]

I tried #2 but I could not get it to work.  I'm using 2.9B

[alrice]

Interesting thread; permit me to revive it!  ops:  I am trying to figure out how authentication can work in my Java backed web-scripts. Most of my Javascript work in Web Scripts   is authenticating as "guest", so I would like to do that in Java backed web script too.   Can someone explain what I am observing below?
In a regular Javascript webscript, I can access this repository space which is open to the guest user. Here is the 1 line of Javascript code that returns a valid noderef.

model.nodeTest =  companyhome.childByNamePath( "/Projects/Applications/sessions/1234.txt" );‍

In a Java backed webscript, that extends AbstractWebScript , similar code fails with
Exception net.sf.acegisecurity.BadCredentialsException: Bad credentials presented. It fails on the call to resolveNamePath().

NodeRef companyHomeRef = getRepositoryContext().getCompanyHome();
FileInfo fi = getServiceRegistry().getFileFolderService().resolveNamePath(companyHomeRef,  pathElements);‍‍

Why doesn't the Java-backed web script understand the security context in the same way as the Javascript does?
Would DeclarativeWebScript behave any differently than AbstractWebScript?  Thanks for any insight you can shed on this!