Grouper Users - Open Discussion List

[Chris Hyzer <>]

True, we should add that capability... I assume you have a way so that 
nefarious users don't set their cookie value to act as other users... :)

This is what you need to do:

1. in the web.xml declare your filter:

<filter>
    <filter-name>Your Filter</filter-name>
    <filter-class>com.path.whatever.YourFilter</filter-class>
  </filter>


Note, this part Im not sure about... I think you can just protect everything 
(*), though you could pick and choose URL patterns like the existing config 
does...    Note, this part has to be above the existing filter mappings in 
the web.xml so it is outside the other filters.

<filter-mapping>
        <filter-name>Your Filter</filter-name>
        <url-pattern>* </url-pattern>
  </filter-mapping>

2. Make a Java class called that, and do this: here is a simple example


/*
 * @author mchyzer
 * $Id: WebsecFilter.java,v 1.3 2009-11-25 20:01:26 mchyzer Exp $
 */
package com.path.whatever;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;


/**
 *
 */
public class YourFilter implements Filter {

  /**
   * @see javax.servlet.Filter#destroy()
   */
  public void destroy() {
  }

  /**
   * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, 
javax.servlet.ServletResponse, javax.servlet.FilterChain)
   */
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain 
filterChain)
      throws IOException, ServletException {
    
    HttpServletRequest request  = (HttpServletRequest)req;
    
    String username = cookieValue(request, "someCookieName");
    
    //do some decryption or something?  :)
    
    request.setAttribute("REMOTE_USER", username);
    
    filterChain.doFilter(request, res);
  }

  /**
   * get a cookie value by name, null if not there
   * @param httpServletRequest 
   * @param name
   * @return the cookie value or null if not there
   */
  public static String cookieValue(HttpServletRequest httpServletRequest, 
String name) {
    Cookie cookie = findCookie(httpServletRequest, name);
    return cookie == null ? null : cookie.getValue();
  }

  /**
   * find a cookie or null if cant find
   * @param httpServletRequest 
   * @param name
   * @return the cookie or null if not found
   */
  public static Cookie findCookie(HttpServletRequest httpServletRequest, 
String name) {
    //no nulls
    if (name != null) {
      Cookie[] cookies = httpServletRequest.getCookies();
      //go through all cookies and find the cookie by name
      int cookiesLength = cookies == null ? 0 : cookies.length;
      for (int i=0;i<cookiesLength;i++) {
        if (name.equals(cookies[i].getName())) {
          return cookies[i];
        }
      }
    }
    return null;
  }

  
  /**
   * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
   */
  public void init(FilterConfig arg0) throws ServletException {
  }

}



-----Original Message-----
From: Martin Feller 
[mailto:]
 
Sent: Monday, February 14, 2011 4:44 PM
To: Chris Hyzer
Cc: 

Subject: Re: [grouper-users] lite ui and authentication mechanism

I try to integrate the light UI into an existing webpage. After logging into 
that webpage information about
the user (like username) is stored in a cookie. I don't want an additional 
basic authentication step when the group
management page is rendered, but rather have the Grouper UI servlet use the 
information from the cookie to get the user id.
All works fine, I see the cookies, but I think I need to do changes in the 
filter code to accomplish this.
Having a declarative option, like in grouper-ws, would be cleaner, I guess

Thanks,

Martin

On 2/14/11 3:28 PM, Chris Hyzer wrote:
> What authentication mechanism do you want to use?
> 
> Thanks,
> Chris
> 
> -----Original Message-----
> From: 
> 
>  
> [mailto:]
>  On Behalf Of Martin Feller
> Sent: Monday, February 14, 2011 4:27 PM
> To: 
> 
> Subject: [grouper-users] lite ui and authentication mechanism
> 
> Hi,
> 
> Can somebody please confirm the following?
> 
> I was trying to write a custom authentication mechanism and hook it into 
> the Prototype Lite UI, as described
> here: https://spaces.internet2.edu/display/Grouper/Authentication
> 
> But I think this won't work, because the mechanisms described there are 
> only for grouper-ws.
> The lite UI servlet that handles the AJAX calls from grouper.html, or 
> rather the service logic classes used by the
> lite UI servlet, call a static method of the GrouperUI filter to get the 
> remote user though.
> 
> So there's no configuration-only way to change the authentication mechanism 
> for this UI, right?
> 
> Thanks!
> 
> Martin