Solving the Authentication Handler Credential Validation ProblemPage edited by Felix MeschbergerChanges (2)
Full ContentSolving the Authentication Handler Credential Validation ProblemStatus: DRAFT ProblemThere does not currently exist a good and transparent way for an Authentication Handler to signal to the ResourceResovlerFactory, that the identity of a user has been established and validated and that no further checks are required. For example an SSO authentication handler will get the identity of a user provided by the SSO handler or an OAuth 2 authentication handler proves the identity of the user by with the help of the OAuth 2 provider. ProposalA new predefined property of the AuthenticationInfo map is defined which can be set by the authentication handler to indicate that the user's identity has been verified and can be guaranteed: public interface ResourceResolverFactory { .... /** * Name of the authentication information property used to indicate that the * identity of the user indicated by the {@link #USER} property has already * been validated by other means such as OAuth2, OpenID or similar SSO * functionality. As a consequence password-less access to a * {@link ResourceResolver} should be granted. * <p> * The non-empty string value of this property identifies the party having * validated the user's identity. It may be used by implementations of this * and the {@link ResourceProviderFactory} interfaces in log messages. * <p> * The type of this property, if present, is <code>String</code>. * * @since 2.4 (bundle version 2.5.0) */ String IDENTIFIED = "user.identified"; .... }
Abstract Sling RepositoryThe Abstract Sling Repository implementation will need to fix the "null Credentials" problem: Due to a misunderstanding the Abstract Sling Repository assumes anonymous access to the repository if the Credentials to the login method is null or missing. While this has been implemented like this in Jackrabbit it is actually not foreseen by the specification. Rather missing or null Credentials indicate access to the repository using pre-authentication where the Subject identifies the owner of the Session to create. So the Abstract Sling Repository implementation of the login(String, String) method must be fixed along these lines: if (credentials == null) { if (Subject.getSubject(AccessController.getContext()) != null) { return getRepository().login(null, workspace); } else { // TODO: getAnonCredentials(this.anonUser) should not be used for anonymous access return getRepository().login(new GuestCredentials(), workspace); } } else { return getRepository().login(credentials, workspace); }
Stop watching space
|
Change email notification preferences
View Online
|
View Changes
|
Add Comment
|
[CONF] Apache Sling > Solving the Authentication Handler Credential Validation Problem
Felix Meschberger (Confluence) Fri, 27 Sep 2013 06:45:19 -0700
- [CONF] Apache Sling > Solving the Au... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Angela Schreiber (Confluence)
- [CONF] Apache Sling > Solving t... Angela Schreiber (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Antonio Sanso (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Felix Meschberger (Confluence)
- [CONF] Apache Sling > Solving t... Alexander Klimetschek (Confluence)
- [CONF] Apache Sling > Solving t... Alexander Klimetschek (Confluence)
- [CONF] Apache Sling > Solving t... Chetan Mehrotra (Confluence)
- [CONF] Apache Sling > Solving t... Chetan Mehrotra (Confluence)