[
https://issues.apache.org/jira/browse/JSPWIKI-1315?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132774#comment-18132774
]
Arturo Bernal commented on JSPWIKI-1315:
----------------------------------------
Update after the discussion on
[[email protected]|mailto:[email protected]] on 26 and 27 October.
Alex O'Ree has code that uses pac4j for OpenID Connect and suggested looking
into it, and says the implementation was not hard. Jerry Andrews said that
authentication is and should be JAAS, that the documentation of it is weak, and
asked for a reference implementation.
Plan for this issue: first, document the container managed and the JAAS set
ups, including the roles and the policy; second, verify OpenID Connect through
a container as described above; third, if the container is not enough, consider
an optional module as a reference implementation, possibly based on pac4j.
Before that, the licence and the dependencies of any library would have to be
checked. It would be good if Alex could attach his code or a description of it
here.
> Verify and document OpenID Connect single sign-on through the servlet
> container
> -------------------------------------------------------------------------------
>
> Key: JSPWIKI-1315
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1315
> Project: JSPWiki
> Issue Type: New Feature
> Reporter: Arturo Bernal
> Priority: Major
>
> Scope changed after the discussion on [email protected]: enterprise
> authentication such as OpenID Connect should be left to the servlet container
> and the directory behind it, and JSPWiki should not reimplement it. The
> original proposal of a login module inside JSPWiki is withdrawn. It would
> only be reconsidered if the container turns out not to be enough.
>
> What exists today: JSPWiki supports container managed authentication through
> WebContainerLoginModule in org.apache.wiki.auth.login, and the roles come
> from the container. The closed issue JSPWIKI-1176 describes this set up with
> JBoss EAP and roles from Active Directory, where the reporter needed a role
> mapper in the container to map the directory roles to the roles Admin and
> Authenticated that JSPWiki expects.
>
> Proposal: set up OpenID Connect in a container (for example WildFly with
> Keycloak as the provider, and one other container) and check that login, the
> roles, the permission checks in jspwiki.policy, logout and session expiry
> work with JSPWiki. Write the results down in the administrator documentation,
> with the web.xml and role mapping needed for each container that was tested.
> Fix what does not work, and open separate issues for the individual problems.
> It is not known yet whether anything fails, so this issue may end up being
> documentation only.
>
> Related issues: JSPWIKI-1176 (closed), JSPWIKI-861 and JSPWIKI-94 (older
> requests for OAuth and OpenID).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
