Wiki source code of Authentication

Version 30.1 by hexC0DE on 2009/12/01

version	line-number	content
1.1	1	1 User Authentication
	2
1.18	3	XWiki supports several different authentication mechanisms for authenticating users:
1.1	4	#toc("" "" "")
	5
	6	The form authentication is the default mechanism.
	7
17.2	8	#info("Note that currently XWiki allows only one method of authentication to be enabled at a time. This will probably be improved in the future.")
1.1	9
	10	1.1 Form Authentication
	11
	12	TODO
	13
	14	1.1 LDAP Authentication
	15
17.3	16	#warning("New LDAP implementation since XWiki Platform 1.3M2, see [previous LDAP authentication service documentation>AuthenticationLdapOld]")
	17
1.2	18	1.1.1 Generic LDAP configuration
1.1	19
1.2	20	In order to enable the LDAP support you have to change the authentication method in ~~WEB-INF/xwiki.cfg~~ as follows:
	21	{code}
7.1	22	## Turn LDAP authentication on - otherwise only XWiki authentication
	23	## 0 : disable
	24	## 1 : enable
1.2	25	xwiki.authentication.ldap=1
7.1	26
	27	## set LDAP as authentication service
18.1	28	xwiki.authentication.authclass=com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl
	29
1.2	30	{code}
	31
2.1	32	You can setup the LDAP configuration in the ~~xwiki.cfg~~ file by filling the following properties:
1.2	33
6.1	34	{code:none}
	35	## LDAP Server (Active Directory, eDirectory, OpenLDAP, etc.)
	36	xwiki.authentication.ldap.server=156.58.101.204
1.1	37	xwiki.authentication.ldap.port=389
6.1	38
	39	## LDAP login, empty = anonymous access, otherwise specify full dn
	40	## {0} is replaced with the username, {1} with the password
1.1	41	xwiki.authentication.ldap.bind_DN=cn={0},department=USER,department=INFORMATIK,department=1230,o=MP
	42	xwiki.authentication.ldap.bind_pass={1}
6.1	43
22.1	44	## Force to check password after LDAP connection
	45	## 0: disable
	46	## 1: enable
12.1	47	xwiki.authentication.ldap.validate_password=0
	48
6.1	49	## only members of the following group will be verified in the LDAP
	50	## otherwise only users that are found after searching starting from the base_DN
	51	xwiki.authentication.ldap.user_group=cn=developers,ou=groups,o=MegaNova,c=US
	52
22.1	53	## only users not member of the following group can autheticate
	54	xwiki.authentication.ldap.exclude_group=cn=admin,ou=groups,o=MegaNova,c=US
	55
6.1	56	## base DN for searches
	57	xwiki.authentication.ldap.base_DN=
	58	department=USER,department=INFORMATIK,department=1230,o=MP
	59
	60	## specifies the LDAP attribute containing the identifier to be used as the XWiki name (default=cn)
	61	xwiki.authentication.ldap.UID_attr=cn
	62
	63	## retrieve the following fields from LDAP and store them in the XWiki user object (xwiki-attribute=ldap-attribute)
27.1	64	xwiki.authentication.ldap.fields_mapping=last_name=sn,first_name=givenName,fullname=fullName,email=mail
6.1	65
	66	# on every login update the mapped attributes from LDAP to XWiki otherwise this happens only once when the XWiki account is created.
	67	xwiki.authentication.ldap.update_user=1
	68
	69	## maps XWiki groups to LDAP groups, separator is "\|"
	70	xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=AdminRole,ou=groups,o=MegaNova,c=US\|\
	71	XWiki.Organisation=cn=testers,ou=groups,o=MegaNova,c=US
	72
	73	## time in seconds after which the list of members in a group is refreshed from LDAP (default=3600*6)
	74	xwiki.authentication.ldap.groupcache_expiration=21800
	75
	76	## - create : synchronize group membership only when the user is first created
	77	## - always: synchronize on every login
	78	xwiki.authentication.ldap.mode_group_sync=always
	79
	80	## if ldap authentication fails for any reason, try XWiki DB authentication with the same credentials
	81	xwiki.authentication.ldap.trylocal=1
8.1	82
	83	## SSL connection to LDAP server
	84	## 0 : normal
	85	## 1 : SSL
	86	xwiki.authentication.ldap.ssl=1
	87
	88	## The keystore file to use in SSL connection
	89	xwiki.authentication.ldap.ssl.keystore=
1.1	90	{code}
3.1	91
23.1	92	#info("You can also setup the LDAP configuration in XWiki.XWikiPreferences page by going to the object editor. Simply replace \"xwiki.authentication.ldap.\" by \"ldap_\". For example <tt>xwiki.authentication.ldap.base_DN</tt> become <tt>ldap_base_DN</tt>")
9.1	93
1.3	94	1.1.1 LDAP Configuration for Active Directory
1.1	95
1.3	96	Here are values of the properties you need to set if your LDAP server implementation is Miscrosoft Active Directory:
	97	- ldap_server: name/IP of AD server machine
	98	- ldap_port: port ~~(e.g. 389)~~
	99	- ldap_base_DN: name of root DN ~~(e.g. dc=ad,dc=company,dc=com)~~
	100	- ldap_bind_DN: domain\{0\} ~~(e.g. ad\{0\} where \{0\} will be replaced by username during validation)~~
	101	- ldap_bind_pass: \{1\} ~~(where \{1\} will be replaced by password during validation)~~
	102	- ldap_UID_attr: sAMAccountName
30.1	103	- ldap_fields_mapping: name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,email=mail,ldap_dn=dn
1.3	104
1.19	105	Example:
	106	{code}
19.1	107	xwiki.authentication.authclass=com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl
1.19	108	xwiki.authentication.ldap=1
	109	xwiki.authentication.ldap.server=adserver
	110	xwiki.authentication.ldap.port=389
	111	xwiki.authentication.ldap.base_DN=dc=subdomain,dc=domain,dc=suffix
	112	xwiki.authentication.ldap.bind_DN=subdomain\\{0}
	113	xwiki.authentication.ldap.bind_pass={1}
	114	xwiki.authentication.ldap.UID_attr=sAMAccountName
30.1	115	xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,email=mail,ldap_dn=dn
1.19	116	{code}
1.3	117
1.19	118	The bind_DN and bind_pass fields contain the username and password for binding to the LDAP server in order to search, which will not necessarily be the same credentials as the user logging in.
	119
	120
	121	The exact details of this configuration will vary based on your server configuration. It may not be necessary to prefix the username (represented by {0}) with the subdomain.
	122
	123	For testing purposes, you may wish to omit the "ldap.fields_mapping" field, to test the authentication first, and then add it later to get the mappings right.
	124
	125	This java client, [LDAP Browser/Editor > http://www-unix.mcs.anl.gov/~gawor/ldap/] is a handy tool for checking your configuration.
	126
24.1	127	1.1.1 Detailed use cases
1.19	128
24.1	129	See [LDAP configuration uses cases>LDAPAuthenticationUseCases] for some detailed use cases.
12.1	130
25.1	131	1.1.1 Enable LDAP debug log
	132
26.1	133	See [AdminGuide.Logging]. The specific targets for LDAP authentication are:
25.1	134	{code}
	135	log4j.logger.com.xpn.xwiki.plugin.ldap=debug
	136	log4j.logger.com.xpn.xwiki.user.impl.LDAP=debug
	137	{code}
27.1	138
30.1	139
1.1	140	1.1 eXo Authentication
	141
	142	The eXo authentication is used automatically by adding/editing the ~~xwiki.exo=1~~ property in ~~WEB-INF/xwiki.cfg~~.
	143
	144	1.1 Custom Authentication
	145
	146	This allows plugging to any existing authentication mechanism such as SiteMinder, etc. To configure a custom authentication do the following:
27.3	147	# Implement the [XWikiAuthService>http://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/user/api/XWikiAuthService.java] interface.
1.1	148	# Edit the ~~WEB-INF/xwiki.cfg~~ file and add a ~~xwiki.authentication.authclass~~ property pointing to your class. For example:
	149
	150	{code}
	151	xwiki.authentication.authclass = com.acme.MyCustomAuthenticationService
	152	{code}
	153
27.2	154	Here's a [tutorial on implementing a custom authentication class for authenticating against Oracle's SSO>http://bodez.wordpress.com/2008/10/15/xwiki-user-authentication-with-oracle-sso/].
	155
27.3	156	Note, that you also can implement own right management service by implementing [XWikiRightService>http://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/user/api/XWikiRightService.java] interface:
4.1	157	{code}
5.1	158	xwiki.authentication.rightsclass = com.acme.MyCustomRightsService
4.1	159	{code}
	160
27.3	161	and Group Service by implementing [XWikiGroupService>http://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/user/api/XWikiGroupService.java]:
4.1	162
27.3	163	{code}
	164	xwiki.authentication.groupclass = com.acme.MyCustomGroupService
	165	{code}
4.1	166
28.1	167	1.1.1 Custom Authentication using a Groovy script in a wiki page
	168
	169	Start by specifying you want to use the Groovy Authenticator:
	170
	171	{code}
	172	xwiki.authentication.authclass = com.xpn.xwiki.user.impl.xwiki.GroovyAuthServiceImpl
	173	{code}
	174
	175	Then add another configuration parameter to specify in which wiki page the authenticator is:
	176
	177	{code}
	178	xwiki.authentication.groovy.pagename = MySpace.MyPage
	179	{code}
	180
	181	Then in a wiki page put some Groovy code that returns a XWikiAuthService object.
	182
1.14	183	1.1 Authentication parameters
	184
	185	You can set each of these parameters by setting:
	186
	187	{code}
	188	xwiki.authentication.~~param_name~~=~~param_value~~
	189	{code}
	190
	191	{table}
	192	Name \| Optional \| Allowed values \| Default value \| Description
1.15	193	encryptionKey \| No(1) \| ? \| n/a \| Set the Encryption Key used to create a secret key, the secret key is passed to the Cipher object to be used during encryption and decryption of cookie values.
	194	validationKey \| No(2) \| ? \| n/a \| Set the Validation Key used to generate hash value; the hash value is stored with the cookie and used to verify that the cookie has not been tampered with.
1.14	195	cookiedomains \| Yes \| String \| Server host name \| Which host(s) should your cookies be sent to; use only if you want to share cookies across domains, otherwise should be commented out
	196	cookielife \| Yes \| Number \| 14 \| Number of days cookies take to expire
	197	cookiepath \| Yes \| String \| / \| The webapp path that XWiki cookies should be sent to; if you have anything else running on your web server, this should be set to ~~/xwiki~~
1.17	198	default_page \| Yes \| String \| /bin/view/ Main/WebHome \| Page to redirect to if xredirect parameter is not set
1.15	199	encryptionalgorithm \| Yes \| ? \| ? \| Set the Encryption Algorithm used to encrypt and decrypt cookies
	200	encryptionmode \| Yes \| ? \| ? \| Set the Encryption Mode used to encrypt and decrypt cookies
	201	encryptionpadding \| Yes \| ? \| ? \| Set the Encryption Padding used to encrypt and decrypt cookies
1.17	202	errorpage \| Yes \| String \| /bin/loginerror/ XWiki/XWikiLogin \| Page to redirect to if there is an error logging in
	203	loginpage \| Yes \| String \| /bin/login/ XWiki/XWikiLogin \| Page to redirect to when not logged in
	204	loginsubmitpage \| Yes \| String \| /loginsubmit/ XWiki/XWikiLogin \| ?
	205	logoutpage \| Yes \| String \| /bin/logout/ XWiki/XWikiLogout \| Page to redirect to after logged out
15.2	206	realmname \| Yes \| String \| XWiki \| Sets the realm name
1.16	207	protection \| Yes \| all, validation, encryption, none \| all \| Protection level for the "remember me" cookie functionality
1.15	208	unauthorized_code \| Yes \| ? \| ? \| ?
1.14	209	useip \| Yes \| true / false \| true \| Specify to use the IP address when encrypting the cookie data; if IP address changes will need to re-login.
	210	{table}
1.15	211	# Only required if protection = encryption or all (default)
	212	# Only required if protection = validation or all (default)
1.16	213
20.1	214	1.1 Kerberos SSO Authentication
1.17	215
21.1	216	#warning("This implementation of SSO is currently under review see: http://jira.xwiki.org/jira/browse/XWIKI-2496 . The class which is described in this segment of documentation, AppServerTrustedKerberosAuthServiceImpl, is not part of the default XWiki distribution!")
	217
20.1	218	The following is an example of mod_auth_kerb for Apache being used to easily implement Xwiki authentication of users via by HTTP Negotiate on a linux server. This example assumes you already have a working Apache2 HTTPD and Apache Tomcat setup with mod_jk.
1.18	219
20.1	220	First of all you need to create a principal and keytab for the webserver:
	221	{code}
	222	# kadmin
	223	kadmin> addprinc -randkey HTTP/wiki.example.com
	224	kadmin> ktadd -k /etc/apache2/ssl/wiki.keytab HTTP/wiki.example.com
	225	kadmin> quit
	226	{code}
10.1	227
20.1	228	Make sure the keytab has the right permissions and ownership:
	229	{code}
	230	chown www-data:www-data /etc/apache2/ssl/wiki.keytab
	231	chmod 400 /etc/apache2/ssl/wiki.keytab
	232	{code}
11.1	233
20.1	234	Install mod_auth_kerb in your linux installation. On Debian or Ubuntu this would be achieved by running:
	235	{code}
	236	aptitude install libapache2-mod-auth-kerb
	237	{code}
	238	Of course the installation procedure varies per Linux distribution.
	239
	240	If your xwiki installation is mounted in Apache HTTPD under /xwiki, add the following to the virtual host configuration:
	241	{code}
	242	<Location /xwiki/>
	243	AuthType Kerberos
	244	AuthName "Kerberos Login"
	245	KrbAuthRealms EXAMPLE.COM
	246	Krb5Keytab "/etc/apache2/ssl/wiki.keytab"
	247	KrbMethodK5Passwd off
	248	KrbMethodNegotiate on
	249	KrbSaveCredentials on
	250	require valid-user
	251	</Location>
	252	{code}
	253
	254	Make sure Apache Tomcat uses the authentication performed by Apache HTTPD with the "tomcatAuthentication" property in the connector description (which is in the server.xml file of Apache Tomcat):
	255	{code}
	256	<Connector port="8009" address="127.0.0.1" enableLookups="false" tomcatAuthentication="false" redirectPort="8443" protocol="AJP/1.3" />
	257	{code}
	258
	259	Place the authkerb.jar jar in the WEB-INF/lib directory of Xwiki in Apache Tomcat.
	260
	261	Have Xwiki use the authentication module by changing the "xwiki.authentication.authclass" property in WEB-INF/lib/xwiki.cfg file.
	262	{code}
	263	xwiki.authentication.authclass=com.xpn.xwiki.user.impl.xwiki.AppServerTrustedKerberosAuthServiceImpl
	264	{code}
	265
	266	If you use Firefox, do not forget to whitelist the xwiki URL for HTTP Negotiate in about:config with the "network.negotiate-auth.trusted-uris" property. possible values for this propperty include (without the quotes): "https://" for all secured connections or "example.com" for all example.com subdomains.
	267
29.1	268
	269
	270	2 JBoss SPNEGO (Kerberos in combination with LDAP)
	271	I changed the code of the XWikiLDAPAuthServiceImpl to be able to detect the sso user.
	272	The authenication already happend by using the SPNEGO module (JAAS).
	273	After that I'm using the ldap synchronisation feature to make sure that the user is up to date.
	274	The combination leads to an automatic login in the xwiki and the user rights are controlled in the Active Directory server.
	275	I hope you can adopt this code or that you can use it for your own projects.
	276
	277	The configuration of ldap;
	278	{code}
	279	xwiki.authentication.authclass=com.wiki.sso.SSOLdapAuthenicationImpl
	280	xwiki.authentication.ldap=1
	281	xwiki.authentication.ldap.server=<ad-server>
	282	xwiki.authentication.ldap.port=389
	283	xwiki.authentication.ldap.base_DN=<OU=Users,...............>
	284	#use a fixed user to attach to the ldap database,
	285	#the password is not provided with the SSOLdapAuthenicationImpl
	286	xwiki.authentication.ldap.bind_DN=<domain>\\<user>
	287	xwiki.authentication.ldap.bind_pass=<password>
	288	#Microsoft AD configuration
	289	xwiki.authentication.ldap.UID_attr=sAMAccountName
	290	xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,mail=mail,ldap_dn=dn
	291	xwiki.authentication.ldap.group_memberfields=member,uniqueMember
	292	#LDAP group mapping
	293	xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=CN=WIKI_Admin,............\|\
	294	XWiki.XWikiAllGroup=CN=WIKI_User,...........
	295
	296	{code}
	297	The java code
	298	{code}
	299	package com.wiki.sso;
	300
	301
	302	import org.apache.commons.logging.Log;
	303	import org.apache.commons.logging.LogFactory;
	304
	305	import com.xpn.xwiki.XWikiContext;
	306	import com.xpn.xwiki.XWikiException;
	307	import com.xpn.xwiki.user.api.XWikiUser;
	308	import com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl;
	309
	310	import java.security.Principal;
	311
	312	public class SSOLdapAuthenicationImpl extends XWikiLDAPAuthServiceImpl {
	313	/**
	314	* Logging tool.
	315	*/
	316	private static final Log LOG = LogFactory.getLog(SSOLdapAuthenicationImpl.class);
	317
	318
	319	public XWikiUser checkAuth(XWikiContext context) throws XWikiException {
	320	String user = getRemoteUser(context);
	321	if ((user != null) \|\| !user.equals("")) {
	322	if (LOG.isInfoEnabled())
	323	LOG.info("Launching create user for " + user);
	324	if ( authenticate(user, context) != null ) {
	325	if (LOG.isInfoEnabled())
	326	LOG.info("Create user done for " + user);
	327	user = "XWiki." + user;
	328	context.setUser(user);
	329	System.out.println("User is set to:" + user);
	330	return new XWikiUser(user);
	331	} else {
	332	LOG.error( "User " + user + " can't be authenticated against ldap" );
	333	}
	334	}
	335	return super.checkAuth(context);
	336	}
	337
	338	/**
	339	* We cannot authenticate locally since we need to trust the app server for
	340	* authentication
	341	*
	342	* @param username
	343	* @param password
	344	* @param context
	345	* @return
	346	* @throws XWikiException
	347	*/
	348	public XWikiUser checkAuth(String username, String password,
	349	String rememberme, XWikiContext context) throws XWikiException {
	350	String user = getRemoteUser(context);
	351	if ((user == null) \|\| user.equals("")) {
	352	return super.checkAuth(username, password, rememberme, context);
	353	}
	354	return checkAuth(context);
	355	}
	356
	357	private String getRemoteUser(XWikiContext context) {
	358	String userName = context.getRequest().getHttpServletRequest()
	359	.getRemoteUser();
	360	if (userName != null) {
	361	// only take the front of the username@domain
	362	String[] elements = userName.split("@", 2);
	363	userName = elements[0];
	364	}
	365	return userName;
	366	}
	367
	368	public Principal authenticate(String login, XWikiContext context) throws XWikiException
	369	{
	370	if (LOG.isTraceEnabled()) {
	371	LOG.trace("Starting LDAP authentication");
	372	}
	373
	374	/*
	375	* TODO: Put the next 4 following "if" in common with XWikiAuthService to ensure coherence This method was
	376	* returning null on failure so I preserved that behaviour, while adding the exact error messages to the context
	377	* given as argument. However, the right way to do this would probably be to throw XWikiException-s.
	378	*/
	379
	380	if (login == null) {
	381	// If we can't find the username field then we are probably on the login screen
	382
	383	if (LOG.isDebugEnabled()) {
	384	LOG.debug("The provided user is null."
	385	+ " We don't try to authenticate, it probably means the user is in non logged mode.");
	386	}
	387
	388	return null;
	389	}
	390
	391	// Check for empty usernames
	392	if (login.equals("")) {
	393	context.put("message", "nousername");
	394
	395	if (LOG.isDebugEnabled()) {
	396	LOG.debug("LDAP authentication failed: login empty");
	397	}
	398
	399	return null;
	400	}
	401
	402	// If we have the context then we are using direct mode
	403	// then we should specify the database
	404	// This is needed for virtual mode to work
	405	Principal principal = null;
	406
	407	// Try authentication against ldap
	408	principal = ldapAuthenticate(login, "", context);
	409
	410	if (LOG.isDebugEnabled()) {
	411	if (principal != null) {
	412	LOG.debug("LDAP authentication succeed with principal [" + principal.getName() + "]");
	413	} else {
	414	LOG.debug("LDAP authentication failed for user [" + login + "]");
	415	}
	416	}
	417
	418	return principal;
	419	}
	420	}
	421	{code}
	422

Wiki source code of Authentication

Quick Links

Navigation

About

About

Support

Platform

User Guide

Admin Guide

Developer Guide

Projects

XWiki

Extensions

Other

Contribute

Status

Practices

Under the Hood

Get Involved

Get Connected