Wiki source code of User Authentication

Version 96.1 by Vincent Massol on 2017/10/02

version	line-number	content
94.4	1	{{box cssClass="floatinginfobox" title="Contents"}}
34.2	2	{{toc/}}
94.4	3	{{/box}}
34.1	4
94.4	5	XWiki supports several different authentication mechanisms for authenticating users.
	6
34.1	7	{{info}}
64.2	8	XWiki currently allows only one method of authentication to be enabled at a time. This will probably be improved in the future.
34.1	9	{{/info}}
1.1	10
72.1	11	Also note that XWiki requires cookies to be enable in order to track your session and to keep you logged in between pages.
	12
34.2	13	= Form Authentication =
1.1	14
38.2	15	Form authentication is the default way to get authenticated within a Wiki. It requires a user and a password.
1.1	16
46.1	17	= Basic Authentication =
	18
64.2	19	XWiki supports [[basic access authentication>>http://en.wikipedia.org/wiki/Basic_access_authentication]], a method designed to allow a web browser or other client programs to provide credentials - in the form of a user name and password - when making a request. You can get authenticated against an XWiki server with the basic authentication protocol using the following URL scheme:
46.1	20
	21	{{code}}
	22	http://username:password@mywiki.xwiki.com/xwiki/bin/view/Main/WebHome?basicauth=1
	23	{{/code}}
	24
	25	{{warning}}
64.2	26	Be careful that if you use the ##HTTP## protocol your password will be sent in clear over the network and is thus very unsafe. When using basic authentication you should make sure your wiki is configured to use ##HTTPS##.
46.1	27	{{/warning}}
	28
70.1	29	= Container Authentication =
	30
	31	Delegates authentication to the Servlet Container. If it fails it falls back to the standard XWiki authentication.
	32
	33	To configure XWiki to use it, specify:
	34
79.1	35	{{code language="properties"}}
70.1	36	xwiki.authentication.authclass=com.xpn.xwiki.user.impl.xwiki.AppServerTrustedAuthServiceImpl
	37	{{/code}}
	38
79.1	39	For users to be actually created and not just set as context user you must set in ##xwiki.cfg## configuration file (if the property does not already exist, create it):
	40
	41	{{code language="properties"}}
	42	xwiki.authentication.createuser=empty
	43	{{/code}}
	44
62.1	45	= Social Login =
58.1	46
64.2	47	See the [[Social Login Application>>extensions:Extension.Social Login Application]].
58.1	48
34.2	49	= LDAP Authentication =
1.1	50
96.1	51	== Active Directory ==
87.1	52
96.1	53	If you're looking to connect XWiki to an Active Directory server, you have 2 options:
95.1	54
96.1	55	* Using the manual and generic approach listed below
	56	* Using the dedicated [[Active Directory Application>>https://store.xwiki.com/xwiki/bin/view/Extension/ActiveDirectoryApplication]] which is a paying application dedicated to simplifying the integration of Active Directory with XWiki.
	57
	58	== Generic LDAP configuration ==
	59
	60	It's recommended to use the [[LDAP Authenticator extension>>extensions:Extension.LDAP.Authenticator]] instead of the core LDAP authenticator.
	61
87.1	62	The following documentation is for the core LDAP authenticator which has been removed in 8.3.
	63
96.1	64	If you are going to use the [[LDAP Admin Extension>>extensions:Extension.LDAP.Application]], which makes it easier to configure LDAP, then you only need to uncomment ##xwiki.authentication.authclass## property and //nothing// else. Unlike editing ##xwiki.cfg##, which requires you to redeploy the XWiki webapp, LDAP Extension allows you to make changes without restarting.
65.1	65
34.1	66	In order to enable the LDAP support you have to change the authentication method in //WEB-INF/xwiki.cfg// as follows:
	67
54.1	68	{{code language="properties"}}
50.1	69	#-# LDAP authentication service
	70	# xwiki.authentication.authclass=com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl
7.1	71
50.1	72	#-# Turn LDAP authentication on - otherwise only XWiki authentication
	73	#-# - 0: disable
	74	#-# - 1: enable
90.1	75	#-# The default is 0
50.1	76	# xwiki.authentication.ldap=1
34.1	77	{{/code}}
18.1	78
64.2	79	You can setup the LDAP configuration in the xwiki.cfg file by filling the following properties:
1.2	80
54.1	81	{{code language="properties"}}
83.1	82	#-# Turn LDAP authentication on - otherwise only XWiki authentication
	83	#-# - 0: disable
	84	#-# - 1: enable
	85	#-# The default is 0
	86	# xwiki.authentication.ldap=1
	87
36.1	88	#-# LDAP Server (Active Directory, eDirectory, OpenLDAP, etc.)
	89	xwiki.authentication.ldap.server=127.0.0.1
1.1	90	xwiki.authentication.ldap.port=389
6.1	91
36.1	92	#-# LDAP login, empty = anonymous access, otherwise specify full dn
50.1	93	#-# {0} is replaced with the user name, {1} with the password
1.1	94	xwiki.authentication.ldap.bind_DN=cn={0},department=USER,department=INFORMATIK,department=1230,o=MP
	95	xwiki.authentication.ldap.bind_pass={1}
6.1	96
50.1	97	#-# The Base DN used in LDAP searches
	98	xwiki.authentication.ldap.base_DN=
12.1	99
50.1	100	#-# LDAP query to search the user in the LDAP database (in case a static admin user is provided in
	101	#-# xwiki.authentication.ldap.bind_DN)
	102	#-# {0} is replaced with the user uid field name and {1} with the user name
	103	#-# The default is ({0}={1})
55.1	104	# xwiki.authentication.ldap.user_search_fmt=({0}={1})
50.1	105
73.1	106	#-# Only members of the following group can authenticate.
	107	#-# The following kind of groups are supported:
	108	#-# * LDAP static groups (users/subgroups are listed statically in the group object)
	109	#-# * [Since 3.3M1] LDAP organization units (users/subgroups are sub object of the provided organization unit)
	110	#-# * [Since 3.3M1] LDAP filter (users/groups are object found in a search with the provided filter)
36.1	111	# xwiki.authentication.ldap.user_group=cn=developers,ou=groups,o=MegaNova,c=US
6.1	112
50.1	113	#-# [Since 1.5RC1, XWikiLDAPAuthServiceImpl]
73.1	114	#-# Only users not member of the following group can authenticate.
	115	#-# The following kind of groups are supported:
	116	#-# * LDAP static groups (users/subgroups are listed statically in the group object)
	117	#-# * [Since 3.3M1] LDAP organization units (users/subgroups are sub object of the provided organization unit)
	118	#-# * [Since 3.3M1] LDAP filter (users/groups are object found in a search with the provided filter)
36.1	119	# xwiki.authentication.ldap.exclude_group=cn=admin,ou=groups,o=MegaNova,c=US
22.1	120
50.1	121	#-# Specifies the LDAP attribute containing the identifier to be used as the XWiki name
	122	#-# The default is cn
36.1	123	# xwiki.authentication.ldap.UID_attr=cn
6.1	124
50.1	125	#-# [Since 1.5M1, XWikiLDAPAuthServiceImpl]
36.1	126	#-# The potential LDAP groups classes. Separated by commas.
74.1	127	# xwiki.authentication.ldap.group_classes=group,groupOfNames,groupOfUniqueNames,dynamicGroup,dynamicGroupAux,groupWiseDistributionList,posixGroup,apple-group
36.1	128
50.1	129	#-# [Since 1.5M1, XWikiLDAPAuthServiceImpl]
55.1	130	#-# The potential names of the LDAP groups fields containings the members. Separated by commas.
74.1	131	# xwiki.authentication.ldap.group_memberfields=member,uniqueMember,memberUid
36.1	132
	133	#-# retrieve the following fields from LDAP and store them in the XWiki user object (xwiki-attribute=ldap-attribute)
	134	xwiki.authentication.ldap.fields_mapping=last_name=sn,first_name=givenName,email=mail
	135
50.1	136	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
	137	#-# On every login update the mapped attributes from LDAP to XWiki otherwise this happens only once when the XWiki
	138	#-# account is created.
	139	#-# - 0: only when creating user
	140	#-# - 1: at each authentication
54.1	141	#-# The default is 0
	142	xwiki.authentication.ldap.update_user=1
6.1	143
83.1	144	#-# [Since 8.1M2, XWikiLDAPAuthServiceImpl]
	145	#-# On every login update photo from LDAP to XWiki avatar otherwise photo will not be updated.
	146	#-# - 0: never
	147	#-# - 1: at each authentication
	148	#-# The default is 0
	149	# xwiki.authentication.ldap.update_photo=0
	150
	151	#-# [Since 8.1M2, XWikiLDAPAuthServiceImpl]
	152	#-# Profile attachment name which will be used to save LDAP photo.
	153	#-# The default is ldapPhoto
	154	# xwiki.authentication.ldap.photo_attachment_name=ldapPhoto
	155
	156	#-# [Since 8.1M2, XWikiLDAPAuthServiceImpl]
	157	#-# Specifies the LDAP attribute containing the binary photo
	158	#-# The default is thumbnailPhoto
	159	# xwiki.authentication.ldap.photo_attribute=thumbnailPhoto
	160
50.1	161	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
73.1	162	#-# Maps XWiki groups to LDAP groups, separator is "\|".
	163	#-# The following kind of groups are supported:
50.1	164	#-# * LDAP static groups (users/subgroups are listed statically in the group object)
	165	#-# * [Since 3.3M1] LDAP organization units (users/subgroups are sub object of the provided organization unit)
	166	#-# * [Since 3.3M1] LDAP filter (users/groups are object found in a search with the provided filter),
55.1	167	#-# \| character in the filter need to be escaped with backslash (\).
50.1	168	#-#
	169	#-# Here is an example:
	170	# xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=AdminRole,ou=groups,o=domain,c=com\|\
55.1	171	# XWiki.LDAPUsers=ou=groups,o=domain,c=com\|\
	172	# XWiki.Organisation=(cn=testers)
6.1	173
50.1	174	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
	175	#-# Time in s after which the list of members in a group is refreshed from LDAP
	176	#-# The default is 21600 (6 hours)
	177	# xwiki.authentication.ldap.groupcache_expiration=21600
6.1	178
50.1	179	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
36.1	180	#-# - create : synchronize group membership only when the user is first created
	181	#-# - always: synchronize on every login
50.1	182	#-# The default is always
36.1	183	# xwiki.authentication.ldap.mode_group_sync=always
6.1	184
77.1	185	#-# [Since 7.2M3, XWikiLDAPAuthServiceImpl]
	186	#-# Indicate groups members should be resolved in case they are subgroups.
	187	#-# Doing so can be very expensive so it should be disabled if you know there is no subgroups
	188	#-# (or if you don't care about them).
	189	#-# If the group is actually a filter it will always be resolved since it does not make sense left alone.
	190	#-# - 0: disable
	191	#-# - 1: enable
	192	#-# The default is 1
	193	# xwiki.authentication.ldap.group_sync_resolve_subgroups=0
	194
50.1	195	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
54.1	196	#-# If ldap authentication fails for any reason, try XWiki DB authentication with the same credentials
	197	#-# - 0: disable
	198	#-# - 1: enable
	199	#-# The default is 0
6.1	200	xwiki.authentication.ldap.trylocal=1
8.1	201
50.1	202	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
36.1	203	#-# SSL connection to LDAP server
50.1	204	#-# - 0: normal
	205	#-# - 1: SSL
	206	#-# The default is 0
36.1	207	# xwiki.authentication.ldap.ssl=0
8.1	208
50.1	209	#-# [Since 1.3M2, XWikiLDAPAuthServiceImpl]
36.1	210	#-# The keystore file to use in SSL connection
	211	# xwiki.authentication.ldap.ssl.keystore=
	212
50.1	213	#-# [Since 1.5M1, XWikiLDAPAuthServiceImpl]
36.1	214	#-# The java secure provider used in SSL connection
50.1	215	#-# The default is com.sun.net.ssl.internal.ssl.Provider
36.1	216	# xwiki.authentication.ldap.ssl.secure_provider=com.sun.net.ssl.internal.ssl.Provider
50.1	217
	218	#-# Bypass standard LDAP bind validation by doing a direct password comparison.
	219	#-# If you don't know what you do, don't use that. It's covering very rare and bad use cases.
	220	#-# - 0: disable
	221	#-# - 1: enable
	222	#-# The default is 0
	223	# xwiki.authentication.ldap.validate_password=0
	224
	225	#-# [Since 1.5M1, XWikiLDAPAuthServiceImpl]
	226	#-# Specifies the LDAP attribute containing the password to be used "when xwiki.authentication.ldap.validate_password"
	227	#-# is set to 1
	228	# xwiki.authentication.ldap.password_field=userPassword
55.1	229
	230	#-# [Since 4.3M1, XWikiLDAPAuthServiceImpl]
	231	#-# The maximum number of milliseconds the client waits for any operation under these constraints to complete.
	232	#-# The default is 1000
	233	# xwiki.authentication.ldap.timeout=1000
75.1	234
	235	#-# [Since 6.3M1, XWikiLDAPAuthServiceImpl]
	236	#-# The maximum number of search results to be returned from a search operation.
	237	#-# The default is 1000
	238	# xwiki.authentication.ldap.maxresults=1000
34.1	239	{{/code}}
3.1	240
34.1	241	{{info}}
64.2	242	You can also setup the LDAP configuration in the XWiki.XWikiPreferences page by going to the object editor. Simply replace xwiki.authentication.ldap. with ldap_. For example ##xwiki.authentication.ldap.base_DN## becomes ##ldap_base_DN##.
34.1	243	{{/info}}
9.1	244
80.1	245	== LDAP clients ==
	246
1.19	247	For testing purposes, you may wish to omit the "ldap.fields_mapping" field, to test the authentication first, and then add it later to get the mappings right.
	248
64.2	249	Here are some LDAP clients for checking your configuration:
1.19	250
81.1	251	Extensions:
	252
94.4	253	* [[LDAP query snippet>>snippets:Extension.LDAP Query]]
81.1	254
52.1	255	Java based and Open Source:
56.1	256
34.1	257	* [[Apache Directory Studio>>http://directory.apache.org/studio/]]
64.2	258	* [[JXplorer>>http://jxplorer.org/]]
1.19	259
52.1	260	Windows only:
56.1	261
64.2	262	* [[Softerra LDAP Browser>>http://www.ldapbrowser.com/info_softerra-ldap-browser.htm]]
52.1	263
34.2	264	== Detailed use cases ==
12.1	265
94.5	266	See the [[LDAP configuration uses cases>>Documentation.AdminGuide.LDAPAuthenticationUseCases]] for some detailed use cases.
25.1	267
34.2	268	== Enable LDAP debug log ==
34.1	269
94.5	270	See [[Documentation.AdminGuide.Logging]].
34.1	271
45.1	272	The specific packages to track for LDAP are ##com.xpn.xwiki.plugin.ldap## and ##com.xpn.xwiki.user.impl.LDAP##.
27.1	273
64.4	274	Starting with XWiki 4.2 we added a new [[Logging UI>>extensions:Extension.Logging Application]] from the Administration section, which allows logging to be enabled at runtime, directly from the UI, without the need to restart the wiki.
64.3	275
49.1	276	In XWiki 3.4 you need to add the following in ##WEB-INF/classes/logback.xml##:
	277
	278	{{code}}
	279	<!-- LDAP debugging -->
	280	<logger name="com.xpn.xwiki.plugin.ldap" level="trace"/>
	281	<logger name="com.xpn.xwiki.user.impl.LDAP" level="trace"/>
	282	{{/code}}
	283
42.1	284	Before 3.1, add the following to the log4j configuration file:
	285
44.1	286	{{code}}
	287	log4j.logger.com.xpn.xwiki.plugin.ldap=trace
	288	log4j.logger.com.xpn.xwiki.user.impl.LDAP=trace
	289	{{/code}}
	290
34.2	291	= Custom Authentication =
1.1	292
	293	This allows plugging to any existing authentication mechanism such as SiteMinder, etc. To configure a custom authentication do the following:
	294
47.2	295	1. Implement the {{scm path="xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiAuthService.java"}}XWikiAuthService{{/scm}} interface.
34.1	296	1. Edit the //WEB-INF/xwiki.cfg// file and add a //xwiki.authentication.authclass// property pointing to your class. For example:
	297
56.1	298	{{code language="properties"}}
1.1	299	xwiki.authentication.authclass = com.acme.MyCustomAuthenticationService
34.1	300	{{/code}}
1.1	301
78.1	302	You can find various authenticators examples in [[sandbox>>https://github.com/xwiki-contrib/sandbox/tree/master/authenticators]] or [[extensions>>http://extensions.xwiki.org/xwiki/bin/view/Main/WebHome#\|t=extensions&p=1&l=30&s=doc.creationDate&d=desc&name=authenticator]].
56.1	303
34.1	304	Here's a [[tutorial on implementing a custom authentication class for authenticating against Oracle's SSO>>http://bodez.wordpress.com/2008/10/15/xwiki-user-authentication-with-oracle-sso/]].
27.2	305
89.1	306	Note that it's also possible to customize the right management system, see [[extensions:Extension.Security Module]] for more details.
34.1	307
34.2	308	== Custom Authentication using a Groovy script in a wiki page ==
28.1	309
	310	Start by specifying you want to use the Groovy Authenticator:
	311
57.1	312	{{code language="properties"}}
28.1	313	xwiki.authentication.authclass = com.xpn.xwiki.user.impl.xwiki.GroovyAuthServiceImpl
34.1	314	{{/code}}
28.1	315
	316	Then add another configuration parameter to specify in which wiki page the authenticator is:
	317
57.1	318	{{code language="properties"}}
28.1	319	xwiki.authentication.groovy.pagename = MySpace.MyPage
34.1	320	{{/code}}
28.1	321
64.2	322	Then put some Groovy code in a wiki page that returns a XWikiAuthService object.
28.1	323
37.1	324	= Authentication parameters =
1.14	325
	326	You can set each of these parameters by setting:
	327
34.1	328	{{code}}
89.2	329	xwiki.authentication.<param_name>=<param_value>
34.1	330	{{/code}}
1.14	331
34.1	332	\|=Name\|=Optional\|=Allowed values\|=Default value\|=Description
	333	\|encryptionKey\|No(1)\|?\|n/a\|Set the Encryption Key used to create a secret key, the secret key is passed to the Cipher object to be used during encryption and decryption of cookie values.
	334	\|validationKey\|No(2)\|?\|n/a\|Set the Validation Key used to generate hash value; the hash value is stored with the cookie and used to verify that the cookie has not been tampered with.
	335	\|cookiedomains\|Yes\|String\|Server host name\|Which host(s) should your cookies be sent to; use only if you want to share cookies across domains, otherwise should be commented out
	336	\|cookielife\|Yes\|Number\|14\|Number of days cookies take to expire
	337	\|cookiepath\|Yes\|String\|/\|The webapp path that XWiki cookies should be sent to; if you have anything else running on your web server, this should be set to ///xwiki//
	338	\|default_page\|Yes\|String\|/bin/view/ Main/WebHome\|Page to redirect to if xredirect parameter is not set
	339	\|encryptionalgorithm\|Yes\|?\|?\|Set the Encryption Algorithm used to encrypt and decrypt cookies
	340	\|encryptionmode\|Yes\|?\|?\|Set the Encryption Mode used to encrypt and decrypt cookies
	341	\|encryptionpadding\|Yes\|?\|?\|Set the Encryption Padding used to encrypt and decrypt cookies
	342	\|errorpage\|Yes\|String\|/bin/loginerror/ XWiki/XWikiLogin\|Page to redirect to if there is an error logging in
	343	\|loginpage\|Yes\|String\|/bin/login/ XWiki/XWikiLogin\|Page to redirect to when not logged in
35.1	344	\|loginsubmitpage\|Yes\|String\|/loginsubmit/ XWiki/XWikiLogin\|The URL where the username and password are posted to when logging in.
34.1	345	\|logoutpage\|Yes\|String\|/bin/logout/ XWiki/XWikiLogout\|Page to redirect to after logged out
	346	\|realmname\|Yes\|String\|XWiki\|Sets the realm name
	347	\|protection\|Yes\|all, validation, encryption, none\|all\|Protection level for the "remember me" cookie functionality
35.1	348	\|unauthorized_code\|Yes\|Number\|401\|The HTTP status code to return when the login has failed.
34.1	349	\|useip\|Yes\|true / false\|true\|Specify to use the IP address when encrypting the cookie data; if IP address changes will need to re-login.
1.16	350
34.1	351	1. Only required if protection = encryption or all (default)
	352	1. Only required if protection = validation or all (default)
1.17	353
34.2	354	= Kerberos SSO Authentication =
21.1	355
34.1	356	{{warning}}
94.1	357	This implementation of SSO is currently under review see: https://jira.xwiki.org/browse/XWIKI-2496 . The class which is described in this segment of documentation, AppServerTrustedKerberosAuthServiceImpl, is not part of the default XWiki distribution!
34.1	358	{{/warning}}
	359
64.2	360	The following is an example of mod_auth_kerb for Apache being used to easily implement XWiki authentication of users via HTTP Negotiate on a linux server. This example assumes you already have a working Apache2 HTTPD and Apache Tomcat setup with mod_jk.
1.18	361
20.1	362	First of all you need to create a principal and keytab for the webserver:
34.1	363
	364	{{code}}
20.1	365	# kadmin
	366	kadmin> addprinc -randkey HTTP/wiki.example.com
	367	kadmin> ktadd -k /etc/apache2/ssl/wiki.keytab HTTP/wiki.example.com
	368	kadmin> quit
34.1	369	{{/code}}
10.1	370
20.1	371	Make sure the keytab has the right permissions and ownership:
34.1	372
	373	{{code}}
20.1	374	chown www-data:www-data /etc/apache2/ssl/wiki.keytab
	375	chmod 400 /etc/apache2/ssl/wiki.keytab
34.1	376	{{/code}}
11.1	377
64.2	378	Install mod_auth_kerb in your linux installation. On Debian or Ubuntu this would be achieved by running:
34.1	379
	380	{{code}}
20.1	381	aptitude install libapache2-mod-auth-kerb
34.1	382	{{/code}}
	383
20.1	384	Of course the installation procedure varies per Linux distribution.
	385
	386	If your xwiki installation is mounted in Apache HTTPD under /xwiki, add the following to the virtual host configuration:
34.1	387
	388	{{code}}
20.1	389	<Location /xwiki/>
	390	AuthType Kerberos
	391	AuthName "Kerberos Login"
	392	KrbAuthRealms EXAMPLE.COM
	393	Krb5Keytab "/etc/apache2/ssl/wiki.keytab"
	394	KrbMethodK5Passwd off
	395	KrbMethodNegotiate on
	396	KrbSaveCredentials on
	397	require valid-user
	398	</Location>
34.1	399	{{/code}}
20.1	400
64.2	401	Make sure Apache Tomcat uses the authentication performed by Apache HTTPD with the "tomcatAuthentication" property in the connector description (which is in the server.xml file of Apache Tomcat):
34.1	402
	403	{{code}}
20.1	404	<Connector port="8009" address="127.0.0.1" enableLookups="false" tomcatAuthentication="false" redirectPort="8443" protocol="AJP/1.3" />
34.1	405	{{/code}}
20.1	406
64.2	407	Place the authkerb.jar jar in the ##WEB-INF/lib## directory of XWiki in Apache Tomcat.
20.1	408
64.2	409	Have Xwiki use the authentication module by changing the "xwiki.authentication.authclass" property in the ##WEB-INF/lib/xwiki.cfg## file.
34.1	410
	411	{{code}}
20.1	412	xwiki.authentication.authclass=com.xpn.xwiki.user.impl.xwiki.AppServerTrustedKerberosAuthServiceImpl
34.1	413	{{/code}}
20.1	414
64.2	415	If you use Firefox, do not forget to whitelist the xwiki URL for HTTP Negotiate in about:config with the "network.negotiate-auth.trusted-uris" property. Possible values for this property include: //https:~/~/// for all secured connections or example.com for all example.com subdomains.
20.1	416
64.2	417	When I used JBoss SPNEGO (Kerberos in combination with LDAP) I changed the code of the XWikiLDAPAuthServiceImpl to be able to detect the sso user. The authenication already happend by using the SPNEGO module (JAAS). After that I'm using the ldap synchronisation feature to make sure that the user is up to date. The combination leads to an automatic login in XWiki and the user rights are controlled in the Active Directory server. I hope you can adopt this code or that you can use it for your own projects.
29.1	418
34.2	419	The configuration of ldap:
29.1	420
34.1	421	{{code}}
29.1	422	xwiki.authentication.authclass=com.wiki.sso.SSOLdapAuthenicationImpl
	423	xwiki.authentication.ldap=1
	424	xwiki.authentication.ldap.server=<ad-server>
	425	xwiki.authentication.ldap.port=389
	426	xwiki.authentication.ldap.base_DN=<OU=Users,...............>
	427	#use a fixed user to attach to the ldap database,
	428	#the password is not provided with the SSOLdapAuthenicationImpl
	429	xwiki.authentication.ldap.bind_DN=<domain>\\<user>
	430	xwiki.authentication.ldap.bind_pass=<password>
	431	#Microsoft AD configuration
	432	xwiki.authentication.ldap.UID_attr=sAMAccountName
	433	xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,mail=mail,ldap_dn=dn
	434	xwiki.authentication.ldap.group_memberfields=member,uniqueMember
	435	#LDAP group mapping
	436	xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=CN=WIKI_Admin,............\|\
	437	XWiki.XWikiAllGroup=CN=WIKI_User,...........
34.1	438	{{/code}}
29.1	439
64.2	440	The java code:
34.1	441
	442	{{code}}
29.1	443	package com.wiki.sso;
	444
	445
	446	import org.apache.commons.logging.Log;
	447	import org.apache.commons.logging.LogFactory;
	448
	449	import com.xpn.xwiki.XWikiContext;
	450	import com.xpn.xwiki.XWikiException;
	451	import com.xpn.xwiki.user.api.XWikiUser;
	452	import com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl;
	453
	454	import java.security.Principal;
	455
	456	public class SSOLdapAuthenicationImpl extends XWikiLDAPAuthServiceImpl {
	457	/**
	458	* Logging tool.
	459	*/
	460	private static final Log LOG = LogFactory.getLog(SSOLdapAuthenicationImpl.class);
	461
	462
64.3	463	public XWikiUser checkAuth(XWikiContext context) throws XWikiException {
	464	String user = getRemoteUser(context);
	465	if ((user != null) \|\| !user.equals("")) {
	466	if (LOG.isInfoEnabled())
	467	LOG.info("Launching create user for " + user);
	468	if ( authenticate(user, context) != null ) {
	469	if (LOG.isInfoEnabled())
	470	LOG.info("Create user done for " + user);
	471	user = "XWiki." + user;
	472	context.setUser(user);
	473	System.out.println("User is set to:" + user);
	474	return new XWikiUser(user);
	475	} else {
	476	LOG.error( "User " + user + " can't be authenticated against ldap" );
	477	}
	478	}
	479	return super.checkAuth(context);
	480	}
29.1	481
64.3	482	/**
	483	* We cannot authenticate locally since we need to trust the app server for
	484	* authentication
	485	*
	486	* @param username
	487	* @param password
	488	* @param context
	489	* @return
	490	* @throws XWikiException
	491	*/
	492	public XWikiUser checkAuth(String username, String password,
	493	String rememberme, XWikiContext context) throws XWikiException {
	494	String user = getRemoteUser(context);
	495	if ((user == null) \|\| user.equals("")) {
	496	return super.checkAuth(username, password, rememberme, context);
	497	}
	498	return checkAuth(context);
	499	}
29.1	500
64.3	501	private String getRemoteUser(XWikiContext context) {
	502	String userName = context.getRequest().getHttpServletRequest()
	503	.getRemoteUser();
	504	if (userName != null) {
	505	// only take the front of the username@domain
	506	String[] elements = userName.split("@", 2);
	507	userName = elements[0];
	508	}
	509	return userName;
	510	}
29.1	511
	512	public Principal authenticate(String login, XWikiContext context) throws XWikiException
	513	{
	514	if (LOG.isTraceEnabled()) {
	515	LOG.trace("Starting LDAP authentication");
	516	}
	517
	518	/*
	519	* TODO: Put the next 4 following "if" in common with XWikiAuthService to ensure coherence This method was
	520	* returning null on failure so I preserved that behaviour, while adding the exact error messages to the context
	521	* given as argument. However, the right way to do this would probably be to throw XWikiException-s.
	522	*/
	523
	524	if (login == null) {
	525	// If we can't find the username field then we are probably on the login screen
	526
	527	if (LOG.isDebugEnabled()) {
	528	LOG.debug("The provided user is null."
	529	+ " We don't try to authenticate, it probably means the user is in non logged mode.");
	530	}
	531
	532	return null;
	533	}
	534
	535	// Check for empty usernames
	536	if (login.equals("")) {
	537	context.put("message", "nousername");
	538
	539	if (LOG.isDebugEnabled()) {
	540	LOG.debug("LDAP authentication failed: login empty");
	541	}
	542
	543	return null;
	544	}
	545
	546	// If we have the context then we are using direct mode
	547	// then we should specify the database
	548	// This is needed for virtual mode to work
	549	Principal principal = null;
	550
	551	// Try authentication against ldap
	552	principal = ldapAuthenticate(login, "", context);
	553
	554	if (LOG.isDebugEnabled()) {
	555	if (principal != null) {
	556	LOG.debug("LDAP authentication succeed with principal [" + principal.getName() + "]");
	557	} else {
	558	LOG.debug("LDAP authentication failed for user [" + login + "]");
	559	}
	560	}
	561
	562	return principal;
	563	}
	564	}
34.1	565	{{/code}}

Wiki source code of User Authentication

Quick Links

Navigation

About

About

Support

Platform

User Guide

Admin Guide

Developer Guide

Projects

XWiki

Extensions

Other

Contribute

Status

Practices

Under the Hood

Get Involved

Get Connected