Authenticator - Revision history

Craig at 18:15, 12 March 2025

2025-03-12T18:15:38Z

← Older revision		Revision as of 18:15, 12 March 2025
Line 6:		Line 6:
	=== Implementation of a Custom Authenticator ===		=== Implementation of a Custom Authenticator ===
	'''<code>com.carfey.suite.security.User authenticate(String username, String pass) throws com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>'''		'''<code>com.carfey.suite.security.User authenticate(String username, String pass) throws com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>'''

			As of Obsidian 6.1.1, you may optionally implement REST authentication distinctly. Defaults to standard authentication when not implemented.
			'''<code>com.carfey.suite.security.User authenticateREST(String username, String pass) throws com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>'''

	This method authenticates and returns a user with roles defined. Given a user name and a password either return a valid <code>com.carfey.suite.security.User</code> object or throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.		This method authenticates and returns a user with roles defined. Given a user name and a password either return a valid <code>com.carfey.suite.security.User</code> object or throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.

Craig: /* Putting it All Together */

2021-07-31T15:45:28Z

Putting it All Together

@@ Line 120: / Line 120: @@
+}
 </pre>
 == Customizing our LDAP Authenticator ==

Craig: /* Roles */

2021-07-31T15:35:25Z

Roles

← Older revision		Revision as of 15:35, 31 July 2021
Line 34:		Line 34:

	=== Roles ===		=== Roles ===
	There are convenience constants that you should use in defining your role memberships. They can be found at <code>com.carfey.ops.Constant</code>. The constants are <code>ADMIN_ROLE</code>, <code>WRITE_ROLE</code>, <code>LIMITED_READ_ROLE</code> and <code>API_ROLE</code>. ''Default'' rights are assumed for any authenticated user. Therefore, if someone authenticates that should not have access, throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.		There are convenience constants that you should use in defining your role memberships. They can be found at <code>com.carfey.ops.Constant</code>. The constants are <code>ADMIN_ROLE</code>, <code>WRITE_ROLE</code>, <code>LIMITED_READ_ROLE</code> and <code>API_ROLE</code>. As of ''5.0.0'', you can also use <code>OPERATOR_ROLE</code> and <code>AUTHOR_ROLE</code>. ''Default'' rights are assumed for any authenticated user. Therefore, if someone authenticates that should not have access, throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.

	When assigning the user's <code>com.carfey.suite.security.Role</code>s, use the constructor <code>public Role(String roleId, String roleName)</code> using the appropriate constant for both the <code>roleId</code> and <code>roleName</code>. Role meanings are defined in [[Admin_User_Management#User_Rights \| User Rights]].		When assigning the user's <code>com.carfey.suite.security.Role</code>s, use the constructor <code>public Role(String roleId, String roleName)</code> using the appropriate constant for both the <code>roleId</code> and <code>roleName</code>. Role meanings are defined in [[Admin_User_Management#User_Rights \| User Rights]].

Craig: /* Specialization points */

2018-10-02T11:25:37Z

Specialization points

← Older revision		Revision as of 11:25, 2 October 2018
Line 141:		Line 141:
	====<code>protected boolean isMemberOfGroup(DirContext authContext, String groupName, String dn) throws NamingException</code>====		====<code>protected boolean isMemberOfGroup(DirContext authContext, String groupName, String dn) throws NamingException</code>====

	Checks the authenticated <code>DirContext</code> for group membership. Used to determine ''Default'' rights to Obsidian, in addition to its defined rights [[Admin_User_Management#User_Rights\|roles]]. Currently queries <code>"uniquemember"</code>,<code>"uniqueMember"</code>,<code>"member"</code>,<code>"roleOccupant"</code> and <code>"~~memberOf~~"</code> attributes for any match on the ''dn''.		Checks the authenticated <code>DirContext</code> for group membership. Used to determine ''Default'' rights to Obsidian, in addition to its defined rights [[Admin_User_Management#User_Rights\|roles]]. Currently queries <code>"uniquemember"</code>,<code>"uniqueMember"</code>,<code>"member"</code>,<code>"roleOccupant"</code>, <code>"memberOf"</code> and <code>"MemberOf"</code> attributes for any match on the ''dn''.

	== Deploying your Authenticator ==		== Deploying your Authenticator ==
	Once your authenticator class is written, you need to deploy the compiled class and any dependent libraries to your admin web application instances as JAR files. These should be placed under the <code>/WEB-INF/lib</code> directory of either the Obsidian web application directory or WAR file.		Once your authenticator class is written, you need to deploy the compiled class and any dependent libraries to your admin web application instances as JAR files. These should be placed under the <code>/WEB-INF/lib</code> directory of either the Obsidian web application directory or WAR file.

Carfey at 00:32, 16 March 2018

2018-03-16T00:32:36Z

← Older revision		Revision as of 00:32, 16 March 2018
Line 142:		Line 142:

	Checks the authenticated <code>DirContext</code> for group membership. Used to determine ''Default'' rights to Obsidian, in addition to its defined rights [[Admin_User_Management#User_Rights\|roles]]. Currently queries <code>"uniquemember"</code>,<code>"uniqueMember"</code>,<code>"member"</code>,<code>"roleOccupant"</code> and <code>"memberOf"</code> attributes for any match on the ''dn''.		Checks the authenticated <code>DirContext</code> for group membership. Used to determine ''Default'' rights to Obsidian, in addition to its defined rights [[Admin_User_Management#User_Rights\|roles]]. Currently queries <code>"uniquemember"</code>,<code>"uniqueMember"</code>,<code>"member"</code>,<code>"roleOccupant"</code> and <code>"memberOf"</code> attributes for any match on the ''dn''.

			== Deploying your Authenticator ==
			Once your authenticator class is written, you need to deploy the compiled class and any dependent libraries to your admin web application instances as JAR files. These should be placed under the <code>/WEB-INF/lib</code> directory of either the Obsidian web application directory or WAR file.

Craig: /* Roles */

2016-01-15T16:50:00Z

Roles

← Older revision		Revision as of 16:50, 15 January 2016
Line 36:		Line 36:
	There are convenience constants that you should use in defining your role memberships. They can be found at <code>com.carfey.ops.Constant</code>. The constants are <code>ADMIN_ROLE</code>, <code>WRITE_ROLE</code>, <code>LIMITED_READ_ROLE</code> and <code>API_ROLE</code>. ''Default'' rights are assumed for any authenticated user. Therefore, if someone authenticates that should not have access, throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.		There are convenience constants that you should use in defining your role memberships. They can be found at <code>com.carfey.ops.Constant</code>. The constants are <code>ADMIN_ROLE</code>, <code>WRITE_ROLE</code>, <code>LIMITED_READ_ROLE</code> and <code>API_ROLE</code>. ''Default'' rights are assumed for any authenticated user. Therefore, if someone authenticates that should not have access, throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.

	When assigning the user's <code>com.carfey.suite.security.Role</code>s, use the constructor <code>public Role(String roleId, String roleName)</code> using the appropriate constant for both the <code>roleId</code> and <code>roleName</code>.		When assigning the user's <code>com.carfey.suite.security.Role</code>s, use the constructor <code>public Role(String roleId, String roleName)</code> using the appropriate constant for both the <code>roleId</code> and <code>roleName</code>. Role meanings are defined in [[Admin_User_Management#User_Rights \| User Rights]].

	=== Putting it All Together ===		=== Putting it All Together ===

Carfey at 18:57, 6 January 2016

2016-01-06T18:57:25Z

← Older revision		Revision as of 18:57, 6 January 2016
Line 1:		Line 1:
	Obsidian includes two authentication providers out-of-the-box: native authentication, which is managed in the database, and LDAP-supported authentication. But you also have the option to implement your own authenticator or even customize our LDAP authenticator. Below you'll find directions on how to do both. If you are having problems or have some questions, feel free to reach out to us either through our Free Live Chat Support link to the left, or by [[Contact_Carfey_Software\|contacting us]]. Before you get started, we recommend you are familiar with the [[Admin_User_Management#User_Rights\|Roles]] that Obsidian ~~defines to allow assignment of~~ access ~~restrictions~~.		Obsidian includes two authentication providers out-of-the-box: native authentication, which is managed in the database, and LDAP-supported authentication. But you also have the option to implement your own authenticator or even customize our LDAP authenticator. Below you'll find directions on how to do both. If you are having problems or have some questions, feel free to reach out to us either through our Free Live Chat Support link to the left, or by [[Contact_Carfey_Software\|contacting us]]. Before you get started, we recommend you are familiar with the [[Admin_User_Management#User_Rights\|Roles]] that Obsidian uses for access control.

	== Developing an Authenticator ==		== Developing an Authenticator ==

Carfey at 18:57, 6 January 2016

2016-01-06T18:57:10Z

← Older revision		Revision as of 18:57, 6 January 2016
Line 1:		Line 1:
	Obsidian includes two authentication providers out-of-the-box: native authentication, which is managed in the database, and LDAP-supported authentication. But you also have the option to implement your own authenticator or even customize our LDAP authenticator. Below you'll find directions on how to do both. If ~~after working through the instructions~~ you are having problems or ~~otherwise~~ have some questions, feel free to reach out to us either through our Free Live Chat Support link to the left, or by [[Contact_Carfey_Software\|contacting us]]. Before you get started, we recommend you are familiar with the [[Admin_User_Management#User_Rights\|Roles]] that Obsidian defines to allow assignment of access restrictions.		Obsidian includes two authentication providers out-of-the-box: native authentication, which is managed in the database, and LDAP-supported authentication. But you also have the option to implement your own authenticator or even customize our LDAP authenticator. Below you'll find directions on how to do both. If you are having problems or have some questions, feel free to reach out to us either through our Free Live Chat Support link to the left, or by [[Contact_Carfey_Software\|contacting us]]. Before you get started, we recommend you are familiar with the [[Admin_User_Management#User_Rights\|Roles]] that Obsidian defines to allow assignment of access restrictions.

	== Developing an Authenticator ==		== Developing an Authenticator ==

Craig: /* Implementation of a Custom Authenticator */

2015-11-02T22:15:49Z

Implementation of a Custom Authenticator

← Older revision		Revision as of 22:15, 2 November 2015
Line 13:		Line 13:

	'''<code>public boolean supportsRememberMe()</code>'''		'''<code>public boolean supportsRememberMe()</code>'''
	~~From~~ <code>com.carfey.suite.security.remember.Authenticator</code> available as of Obsidian 3.5.0.
			from <code>com.carfey.suite.security.remember.Authenticator</code> available as of Obsidian 3.5.0.

	This method, from <code>com.carfey.suite.security.remember.Authenticator</code>, indicates whether the Authenticator supports Obsidian's remember me feature available in the Web Admin login. This is primarily used to ensure the remember me feature is not exposed in environments where the user could be disabled, made inactive or otherwise invalidated while allowing a lookup to succeed - as may be the case in directory authentication implementations such as LDAP.		This method, from <code>com.carfey.suite.security.remember.Authenticator</code>, indicates whether the Authenticator supports Obsidian's remember me feature available in the Web Admin login. This is primarily used to ensure the remember me feature is not exposed in environments where the user could be disabled, made inactive or otherwise invalidated while allowing a lookup to succeed - as may be the case in directory authentication implementations such as LDAP.

Craig: /* Developing an Authenticator */

2015-11-02T22:15:24Z

Developing an Authenticator

← Older revision		Revision as of 22:15, 2 November 2015
Line 2:		Line 2:

	== Developing an Authenticator ==		== Developing an Authenticator ==
	Obsidian uses any valid implementation of the <code>com.carfey.suite.security.Authenticator</code> interface.		Obsidian uses any valid implementation of the <code>com.carfey.suite.security.Authenticator</code> or <code>com.carfey.suite.security.remember.Authenticator</code> interface.

	=== Implementation of a Custom Authenticator ===		=== Implementation of a Custom Authenticator ===
	<code>com.carfey.suite.security.User authenticate(String username, String pass) throws com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>		'''<code>com.carfey.suite.security.User authenticate(String username, String pass) throws com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>'''

	This method authenticates and returns a user with roles defined. Given a user name and a password either return a valid <code>com.carfey.suite.security.User</code> object or throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.		This method authenticates and returns a user with roles defined. Given a user name and a password either return a valid <code>com.carfey.suite.security.User</code> object or throw a <code>com.carfey.suite.security.Authenticator.AuthenticationFailedException</code>.
Line 11:		Line 11:

	If authentication is successful, the <code>com.carfey.suite.security.User</code> returned must have all its role memberships defined. This is done using the <code>com.carfey.suite.security.Role</code> class. The assignment of <code>Role</code>s to a <code>User</code> can be done using any of the public constructors/setters or logical combination thereof defined below.		If authentication is successful, the <code>com.carfey.suite.security.User</code> returned must have all its role memberships defined. This is done using the <code>com.carfey.suite.security.Role</code> class. The assignment of <code>Role</code>s to a <code>User</code> can be done using any of the public constructors/setters or logical combination thereof defined below.

			'''<code>public boolean supportsRememberMe()</code>'''
			From <code>com.carfey.suite.security.remember.Authenticator</code> available as of Obsidian 3.5.0.

			This method, from <code>com.carfey.suite.security.remember.Authenticator</code>, indicates whether the Authenticator supports Obsidian's remember me feature available in the Web Admin login. This is primarily used to ensure the remember me feature is not exposed in environments where the user could be disabled, made inactive or otherwise invalidated while allowing a lookup to succeed - as may be the case in directory authentication implementations such as LDAP.

			=== Users ===

	<pre>		<pre>