Re: Http authentication using BasicSecurityFilter
Helen <[email protected]> Thu, 30 Aug 2007 16:55:31 -0700
| Newsgroups | gmane.comp.java.xplanner.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============0165326079== Content-Type: multipart/alternative; boundary="------------070204030805040504070004" This is a multi-part message in MIME format. --------------070204030805040504070004 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi Jacques. Thanks for trying to figure out my problem. I think I still don't see an answer, though. The problem is that I don't really see a way to pass 2 different sets of credentials to the XPlanner server using the SOAP API -- one for XPlanner, and one for the server http authentication. The way it is now, the XPlanner server just uses the http authentication credentials to look up an XPlanner user, which, of course fails, if the credentials for http authentication are different than the XPlanner ones -- this is using BasicSecurityFilter. So, in the BasicSecurityFilter.isChallengeAuthenticated() method, the passed in credentials are used to find an XPlanner person. In the case of an http authenticated server, these credentials are the server credentials, not the XPlanner credentials -- if these happen to be the same, the authentication works. It seems like there should be (and maybe there is, and I am just not finding it) some way for the credentials that are passed to that method to be the XPlanner credentials, and not the server http authentication credentials. Basically, what settings to I need to set on the client side for the server to see two different sets of credentials by the time BasicSecurityFilter is called? Thanks a lot -Helen Jacques Morel wrote: >I see now what you are talking about. >You are surprised that the account used to communicate to xplanner is >not a system "trusted" account used between 2 systems in the same >trust region. Is that it? >There isn't anything that prevent you from creating system account for >doing this. In the end, this model ensures that client programs don't >have to enforce security policy checks. >If they are interactive like an enhanced clients (IDE plugin, >dashboad...) they should query the user credentials. If they are >batched, create a system account with sysadmin priviledge (I realize >that there should be a role with global readership but no authorship) >to access all projects. > >Jacques > >On 8/24/07, Helen <[email protected]> wrote: > > >> Hi Jacques. Thanks for your reply. >> >> I was talking about credentials configured for a server set up to do http >>authentication. So these would be username/password necessary to just get >>to the server itself before being able to even communicate with XPlanner. I >>am not sure how else to do it, other than configuring additional settings >>for xplanner username/password somehow. It just looked confusing to me to >>be able to do this from a browser with different sets of credentials, and >>using the SOAP API only having them be the same. >> >> Thanks >> -Helen >> >> >> Jacques Morel wrote: >> I haven't had the time to research this deeply so I am answering with >>the best of my memory. >>I am not sure what you are refering with http credentials. If they are >>the userid and password used to connection through SOAP, they have to >>match a user id in xplanner database. How do you suggest the mapping >>be done if it wasn't like that? >>Something tells me I did not understand your question ;-) >> >>Jacques >> >>On 8/17/07, Helen <[email protected]> wrote: >> >> >> Hi. I am trying to connect to XPlanner (.7b7) using the SOAP API, and >>everything works fine until I try to use Http Authentication. It actually >>works if the http username/password are the same as the XPlanner user >>name/password, but if these are different, the user is not found. I traced >>it to the BasicSecurityFilter implementation, which uses the http >>credentials to search for and XPlanner Person -- if these are different, it >>obviously doesn't work, since the Person is not found. Is it the design to >>have the http authentication credentials be the same as the XPlanner >>credentials? >> >>BTW, When connecting through a browser, the FormSecurityFilter takes effect >>on the server side, which does allow the http authentication credentials to >>be different from the XPlanner credentials. >> >>Could anyone help me figure out if I am not setting something up correctly, >>or if this is the design of the http authentication implementation for SOAP >>in XPlanner? >> >>Thanks a lot >>-Helen >>------------------------------------------------------------------------- >>This SF.net email is sponsored by: Splunk Inc. >>Still grepping through log files to find problems? Stop. >>Now Search log events and configuration files using AJAX and a browser. >>Download your FREE copy of Splunk now >> http://get.splunk.com/ >>_______________________________________________ >>Xplanner-devel mailing list >>[email protected] >>https://lists.sourceforge.net/lists/listinfo/xplanner-devel >> >> >> >>------------------------------------------------------------------------- >>This SF.net email is sponsored by: Splunk Inc. >>Still grepping through log files to find problems? Stop. >>Now Search log events and configuration files using AJAX and a browser. >>Download your FREE copy of Splunk now >> http://get.splunk.com/ >>_______________________________________________ >>Xplanner-devel mailing list >>[email protected] >>https://lists.sourceforge.net/lists/listinfo/xplanner-devel >> >> >> >> >>------------------------------------------------------------------------- >>This SF.net email is sponsored by: Splunk Inc. >>Still grepping through log files to find problems? Stop. >>Now Search log events and configuration files using AJAX and a browser. >>Download your FREE copy of Splunk now >> http://get.splunk.com/ >>_______________________________________________ >>Xplanner-devel mailing list >>[email protected] >>https://lists.sourceforge.net/lists/listinfo/xplanner-devel >> >> >> >> > >------------------------------------------------------------------------- >This SF.net email is sponsored by: Splunk Inc. >Still grepping through log files to find problems? Stop. >Now Search log events and configuration files using AJAX and a browser. >Download your FREE copy of Splunk now >> http://get.splunk.com/ >_______________________________________________ >Xplanner-devel mailing list >[email protected] >https://lists.sourceforge.net/lists/listinfo/xplanner-devel > > > --------------070204030805040504070004 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Hi Jacques. Thanks for trying to figure out my problem. I think I still don't see an answer, though.<br> The problem is that I don't really see a way to pass 2 different sets of credentials to the XPlanner server using the SOAP API -- one for XPlanner, and one for the server http authentication. The way it is now, the XPlanner server just uses the http authentication credentials to look up an XPlanner user, which, of course fails, if the credentials for http authentication are different than the XPlanner ones -- this is using BasicSecurityFilter. So, in the BasicSecurityFilter.isChallengeAuthenticated() method, the passed in credentials are used to find an XPlanner person. In the case of an http authenticated server, these credentials are the server credentials, not the XPlanner credentials -- if these happen to be the same, the authentication works. It seems like there should be (and maybe there is, and I am just not finding it) some way for the credentials that are passed to that method to be the XPlanner credentials, and not the server http authentication credentials. <br> Basically, what settings to I need to set on the client side for the server to see two different sets of credentials by the time BasicSecurityFilter is called?<br> <br> Thanks a lot<br> -Helen<br> <br> Jacques Morel wrote: <blockquote cite="mid2ae5715c0708250209x70e7d99fla2d42f7674314c42-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org" type="cite"> <pre wrap="">I see now what you are talking about. You are surprised that the account used to communicate to xplanner is not a system "trusted" account used between 2 systems in the same trust region. Is that it? There isn't anything that prevent you from creating system account for doing this. In the end, this model ensures that client programs don't have to enforce security policy checks. If they are interactive like an enhanced clients (IDE plugin, dashboad...) they should query the user credentials. If they are batched, create a system account with sysadmin priviledge (I realize that there should be a role with global readership but no authorship) to access all projects. Jacques On 8/24/07, Helen <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a> wrote: </pre> <blockquote type="cite"> <pre wrap=""> Hi Jacques. Thanks for your reply. I was talking about credentials configured for a server set up to do http authentication. So these would be username/password necessary to just get to the server itself before being able to even communicate with XPlanner. I am not sure how else to do it, other than configuring additional settings for xplanner username/password somehow. It just looked confusing to me to be able to do this from a browser with different sets of credentials, and using the SOAP API only having them be the same. Thanks -Helen Jacques Morel wrote: I haven't had the time to research this deeply so I am answering with the best of my memory. I am not sure what you are refering with http credentials. If they are the userid and password used to connection through SOAP, they have to match a user id in xplanner database. How do you suggest the mapping be done if it wasn't like that? Something tells me I did not understand your question ;-) Jacques On 8/17/07, Helen <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a> wrote: Hi. I am trying to connect to XPlanner (.7b7) using the SOAP API, and everything works fine until I try to use Http Authentication. It actually works if the http username/password are the same as the XPlanner user name/password, but if these are different, the user is not found. I traced it to the BasicSecurityFilter implementation, which uses the http credentials to search for and XPlanner Person -- if these are different, it obviously doesn't work, since the Person is not found. Is it the design to have the http authentication credentials be the same as the XPlanner credentials? BTW, When connecting through a browser, the FormSecurityFilter takes effect on the server side, which does allow the http authentication credentials to be different from the XPlanner credentials. Could anyone help me figure out if I am not setting something up correctly, or if this is the design of the http authentication implementation for SOAP in XPlanner? Thanks a lot -Helen ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> <a class="moz-txt-link-freetext" href="http://get.splunk.com/">http://get.splunk.com/</a> _______________________________________________ Xplanner-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/xplanner-devel">https://lists.sourceforge.net/lists/listinfo/xplanner-devel</a> ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> <a class="moz-txt-link-freetext" href="http://get.splunk.com/">http://get.splunk.com/</a> _______________________________________________ Xplanner-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/xplanner-devel">https://lists.sourceforge.net/lists/listinfo/xplanner-devel</a> ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> <a class="moz-txt-link-freetext" href="http://get.splunk.com/">http://get.splunk.com/</a> _______________________________________________ Xplanner-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/xplanner-devel">https://lists.sourceforge.net/lists/listinfo/xplanner-devel</a> </pre> </blockquote> <pre wrap=""><!----> ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> <a class="moz-txt-link-freetext" href="http://get.splunk.com/">http://get.splunk.com/</a> _______________________________________________ Xplanner-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/xplanner-devel">https://lists.sourceforge.net/lists/listinfo/xplanner-devel</a> </pre> </blockquote> <br> </body> </html> --------------070204030805040504070004-- --===============0165326079== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ --===============0165326079== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xplanner-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/xplanner-devel --===============0165326079==--