Add a parallel authentication routine - Revision history

Pm705 at 12:45, 20 March 2010

2010-03-20T12:45:49Z

Pm705 at 12:03, 8 February 2010

2010-02-08T12:03:25Z

Tdb01r at 11:55, 12 August 2009

2009-08-12T11:55:16Z

Kiz at 12:43, 15 January 2009

2009-01-15T12:43:41Z

Kiz: /* Explanation in more detail */

2008-09-26T08:05:12Z

‎Explanation in more detail

Kiz: /* authenticate_user */

2008-09-26T07:36:06Z

‎authenticate_user

Kiz: /* authenticate_user */

2008-09-26T07:34:38Z

‎authenticate_user

Kiz: /* Task 1: registration */

2008-05-06T08:30:31Z

‎Task 1: registration

Kiz: /* Task 1: registration */

2008-05-06T08:28:40Z

‎Task 1: registration

Kiz at 14:17, 5 May 2008

2008-05-05T14:17:56Z

@@ Line 1: / Line 1: @@
 [[Category:Manual]]
-[[Category:Howto]]
+[[Category:Authentication]]
 ==WORK IN PROGRESS==

← Older revision		Revision as of 12:03, 8 February 2010
Line 1:		Line 1:
		+	[[Category:Manual]]
		+	[[Category:Howto]]
	==WORK IN PROGRESS==		==WORK IN PROGRESS==

← Older revision		Revision as of 11:55, 12 August 2009
Line 535:		Line 535:
	}		}
	</pre>		</pre>
		+
		+	[[Category:Authentication]]

@@ Line 91: / Line 91: @@
    my $authorise;
    my $uid;
-   my $orgid;
+   my $inst;
 AUTHO_TYPE:
@@ Line 109: / Line 109: @@
+     }
      $puid  = $authorise->{'userID'};
-     $orgid = $authorise->{'orgID'};
+     $inst  = $authorise->{'institution'};
      last AUTHO_TYPE;
    };
@@ Line 125: / Line 125: @@
+     }
      $puid  = $authorise->{'userID'};
-     $orgid = $authorise->{'orgID'};
+     $inst  = $authorise->{'institution'};
      last AUTHO_TYPE;
    };
@@ Line 141: / Line 141: @@
+     }
      $puid  = $authorise->{'userID'};
-     $orgid = $authorise->{'orgID'};
+     $inst  = $authorise->{'institution'};
      last AUTHO_TYPE;
    };
@@ Line 169: / Line 169: @@
 Having got an acceptable set of details for the new user, we need to add the new details to the user object.. so just before we create the user object, there is a bit more code (insert just before <code>my $user_dataset = $session->get_repository->get_dataset( "user" );</code>:
 <pre>
    $user_data->{puid} = $puid;
@@ Line 179: / Line 180: @@
 			$fieldlist,
 			$v,
-			{email=>$session->make_text( $orgid )} );
+			{email=>$session->make_text( $inst )} );
+	}
    $user_data->{org} = $inst;

← Older revision		Revision as of 08:05, 26 September 2008
Line 25:		Line 25:

	Much of the new code we will be creating will be in a file in <code>archives/''ARCHIVEID''/cfg/cfg.d/</code>. Call it something sensible and meaningful. In this example, I'll call it <code>MyCode.pl</code>		Much of the new code we will be creating will be in a file in <code>archives/''ARCHIVEID''/cfg/cfg.d/</code>. Call it something sensible and meaningful. In this example, I'll call it <code>MyCode.pl</code>
		+
		+	===The flow===
		+
		+	EPrints authentication Handler is called:
		+
		+	* Do we have a current eprints session cookie? (looks in ticket table)
		+	** N - Bounce the user off to get authenticated.
		+	*** user authenticates.
		+	**** Set an eprints session cookie
		+	**** Store an identifier on the "new" auth table
		+	*** bounce user back to their original page
		+	** Y - Can we get user from EPrints ticket table?
		+	*** Y - Get user details, and log them in
		+	*** N - Can we get details from the auth table?
		+	**** N - Bounce user over to manual login pages
		+	**** Y - Can we get a user based on identifier in auth table
		+	***** N - Bounce user over to manual login pages
		+	***** Y - Create record in ticket table
		+	****** bounce user to their original page

	==Foundation==		==Foundation==

@@ Line 434: / Line 434: @@
 === authenticate_user ===
-######################################################################
+use: $user = $session->get_repository->call( 'authenticate_user', $session )
 Returns the user object having authenticated them in some manner.
@@ Line 449: / Line 445: @@
+   }
+<pre>
 $c->{authenticate_user} = sub {
    my ($session, $response) = @_;
@@ Line 463: / Line 455: @@
      my $password = $session->param( "login_password" );
      my $pre_auth = $session->param( "login_pre_auth" );
      my $cookie = EPrints::Apache::AnApache::cookie( $response, "eprints_session" );
      my %opts = ();
@@ Line 477: / Line 468: @@
        return DONE;
+     }
-      # Authority token passed in
+       my $puid = $session->puid_from_cookie;
        if (defined $puid )
+       {
@@ Line 498: / Line 488: @@
      elsif ( defined $username )
+     {
        if( $session->valid_login( $username, $password ) )
+       {
@@ Line 526: / Line 515: @@
     return DONE;
+}

@@ Line 433: / Line 433: @@
 == Full code ==
 === authenticate_user ===
 ######################################################################
 =pod
@@ Line 449: / Line 451: @@
 =cut
 ######################################################################
 $c->{authenticate_user} = sub {
    my ($session, $response) = @_;
@@ Line 475: / Line 479: @@
        # Authority token passed in
        my $puid = $session->puid_from_cookie;
        if (defined $puid )
+       {
@@ Line 500: / Line 503: @@
          my $user = EPrints::DataObj::User::user_with_username( $session, $username );
          $session->login( $user );
          my @time = localtime;
          $session->get_repository->log(  scalar (gmtime(time())).
                                          " Login user (".
@@ Line 507: / Line 509: @@
                                          ") locally"
                                       );
          my $loginparams = $session->param("loginparams");
          my $c = $response->connection;
          $c->notes->set( loginparams=>$loginparams );
          # Declined to render the HTML, not declined the
          # request.
          return DECLINED;
+       }
        $problems = $session->html_phrase( "cgi/login:failed" );
     } ## end of elsif (username) {}
     my $page=$session->make_doc_fragment();
     $page->appendChild( EPrints::Apache::Login::input_form( $session, $problems ) );
     my $title = $session->make_text( "Login" );
     $session->build_page( $title, $page, "login" );
     $session->send_page( %opts );
     $session->terminate;
     return DONE;
+}

@@ Line 89: / Line 89: @@
        );
+     }
-     $puid  = $authorise->{'PersistenUserID'};
+     $puid  = $authorise->{'userID'};
-     $orgid = $authorise->{'OrganisationID'};
+     $orgid = $authorise->{'orgID'};
      last AUTHO_TYPE;
    };
@@ Line 142: / Line 142: @@
 The core information in this code is
-* that there is a parameter called <code>foo</code>, which is used to indicate with external authentication system was used,
+* that there is a parameter called <code>auth_service</code>, which is used to indicate with external authentication system was used,
 * that each authentication method returns a reference to a hash,
 * the returned hash contains the PUID (and could contain other information),

@@ Line 64: / Line 64: @@
 </pre>
-'''NOTE''' Simply by adding <code>foo</code> to the end of the <code>@sysfields</code> list, it will be displayed in the registration form, using the phrases defined in <code><archives/''ARCHIVEID''/cfg/lang/en/phrases/user_fields.xml/code> (see below)
+'''NOTE''' Simply by adding <code>auth_service</code> to the end of the <code>@sysfields</code> list, it will be displayed in the registration form, using the phrases defined in <code><archives/''ARCHIVEID''/cfg/lang/en/phrases/user_fields.xml/code> (see below)
 * Between the ''do we have the required fields'' section and the ''does the email exist'' section, we add our authentication check:

@@ Line 44: / Line 44: @@
      },
 </pre>
 '''NOTE''' If you add (or, to a lesser extent, remove) fields to the user_fields.pl file, you need to rebuild the database, which means wiping and restarting (or doing clever stuff with SQL), so make sure you do all this before you start putting data into the repository
 ==Editing the registration system to authenticate==
-===/cgi/register===
+===Task 1: registration===
 We need to edit <code>cgi/register</code>:
 * We need to add "auth_service" to the <code>@sysfields</code> array.
@@ Line 63: / Line 64: @@
 </pre>
-'''NOTE''' Simply by adding <code>foo</code> to the end of the <code>@sysfields</code> list, it will be displayed in the registration form, using the phrases defined in <code><archives/''ARCHIVEID''/cfg/lang/en/phrases/user_fields.xml/code>.
+'''NOTE''' Simply by adding <code>foo</code> to the end of the <code>@sysfields</code> list, it will be displayed in the registration form, using the phrases defined in <code><archives/''ARCHIVEID''/cfg/lang/en/phrases/user_fields.xml/code> (see below)
 * Between the ''do we have the required fields'' section and the ''does the email exist'' section, we add our authentication check:
@@ Line 73: / Line 74: @@
    my $orgid;
-AUTHO_TYPE: {
+AUTHO_TYPE:
    /athens/ && do {
      $authorise = EPrints::YourOrg::Autho::athens_autho($session);
@@ Line 86: / Line 89: @@
        );
+     }
-     $v->{puid} = $authorise->{'PersistenUserID'};
+     $puid  = $authorise->{'PersistenUserID'};
      $orgid = $authorise->{'OrganisationID'};
      last AUTHO_TYPE;
    };
-   /shibboleth/ && do {
+   /shibboleth/ && do
      $authorise = EPrints::YourOrg::Autho::shibb_autho($session);
      unless ( $authorise )
@@ Line 101: / Line 105: @@
          );
+     }
-     $v->{puid} = $authorise->{'PersistentUserID'};
+     $puid  = $authorise->{'userID'};
-     $orgid = $authorise->{'OrganisationID'};
+     $orgid = $authorise->{'orgID'};
      last AUTHO_TYPE;
    };
-   /ldap/ && do {
+   /ldap/ && do
      $authorise = EPrints::YourOrg::Autho::ldap_autho($session);
      unless ( $authorise )
@@ Line 116: / Line 121: @@
          );
+     }
-     $v->{puid} = $authorise->{'PersistentUserID'};
+     $puid  = $authorise->{'userID'};
-     $orgid = $authorise->{'OrganisationID'};
+     $orgid = $authorise->{'orgID'};
      last AUTHO_TYPE;
    };
@@ Line 124: / Line 129: @@
    # has the puid already been registered
-   if( defined EPrints::DataObj::User::user_with_puid( $session, $v->{puid} ) )
+   if( defined EPrints::DataObj::User::user_with_puid( $session, $puid ) )
+   {
      return mk_err_page(
@@ Line 131: / Line 136: @@
        $fieldlist,
        $v,
-       {email=>$session->make_text( $v->{puid} )}
+       {email=>$session->make_text( $puid )}
      );
+   }
@@ Line 145: / Line 150: @@
 Having got an acceptable set of details for the new user, we need to add the new details to the user object.. so just before we create the user object, there is a bit more code (insert just before <code>my $user_dataset = $session->get_repository->get_dataset( "user" );</code>:
 <pre>
-   $user_data->{puid} = $v->{puid};
+   $user_data->{puid} = $puid;
    # has the puid already been registered