How to add a user to a particular group in SSO mode?

[Migrated From Jforum.net]

Hey guys

Firstly, I want to inform that I am not a JAVA guy.

I downloaded Jforum for integrating with one of our existing web applications (of course not in JAVA).

I implemented SSO using a sample code from the internet. But, the new user gets created in the GENERAL group.

Does any of you guys have code / techniques to add a new user to a PARTICULAR group instead on GENERAL group?

Please help me out!
[originally posted on jforum.net by ranga]

[Migrated From Jforum.net]

The default group every new user gets added to is defined by the "defaultUserGroup" configuration parameter. You can a line like the one below to your custom config file (in the WEB-INF/config directory) to use a different group:

defaultUserGroup = 5

The number is the group_id key field of the group in the jforum_groups table. I think it's also part of the URL when you edit a group's permissions as well.
[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

Thanks Monroe for the quick respone.

What if I wanted to assign a user to a group based on the role of the user in the existing application? Do I need to write a customized code for it?

Thanks again!
[originally posted on jforum.net by ranga]

[Migrated From Jforum.net]

I assume you are trying to link you existing application groups to jForum. In that case, yes you will have to do some custom work.

How work is needed depends on your needs.

Basically, the user membership is in the jforum_user_groups table that maps it jforum_users user_id key to the jforum_groups group_id key. If it's a one time thing or can be done via a cron job, then the right set of SQL scripts might work OK.

Or, you could add code to your main application to create a Jforum user id entry and matching group membership when a user is created.

Another possible option is to replace the jforum_users table and the jforum_user_groups table with an SQL view that mixes your application's info with the info required by JForum.

Finally, it is possible with a fair amount of customization to have jForum use group information from another source.
[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

Hey monroe, thanks again!

I was not able to check the post as I was occupied in something else.

My applications has three types of user for which I have a corresponding group created on JForum.

I understand from your post that the changes in my application or customization are the two possiblities that will resolve my problem.

What changes do you think I need to make on my application for the JForum understand that this user needs to be created in this forum?

or

Do you have a written code to create a user on a particular group?

Thanks
Ranga
[originally posted on jforum.net by ranga]

[Migrated From Jforum.net]

I can't speak to your specific application, but the way to do it using jForum would be to have a SSO authenticateUser(request) implimentation that would take information from your application (like via a cookie or URL parameters).

Validate the request in some form, e.g. an MD5 hash of the user info that your app can generate and the jForum SSO code can recreate to verify.

If it's a valid request, then check to see if the user exists in the jForum DB. If they don't, create a matching one. (See SSOUtils.register() code).

Then you can get the information about which group this user needs to be in. This could be done by passing the info via that cookie or have the code to look up this information from your apps repostitory (e.g. a database table, LDAP server, and the like). The user could then be placed in the matching jForum group based on this.

To see the some jForum specific code for adding a user to one or more group see the UserAction.groupSave() method. This is what processes the admin add a user to a group form.

You can write this to be either a "set once" method (e.g., create user / add to current group category(ies) and doesn't change). Or it can be done to check each time a user is authenticated what group they are in and modify thier entries. (Takes more time/cpu to do this...)
[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

I have currently managed to pass the userinfo in the cookie and create and login a user if the user is not already created or login the user if the user is already created.

The example given at http://www.jforum.net/doc/ImplementSSO, takes three parameters from the existing application: userid, password and the email. But, when I tried to compile the code, I get the following error message:

"SSOCookie.java:40: cannot find symbol
symbol : method getRequest()
location: class net.jforum.JForum
HttpSession session = JForum.getRequest().getSession();
^
1 error"

I understand that when this error is resolved, I will be able to pass the password and the email address of the user from cookie and have it create them on jForum. But, how do I associate a user to a group?

authenticateUser method returns just the userID and stores the password and email in the session from which, the jForum application creates the user.

So, now where do I call the UserAction.groupSave() method from? ( i have not myself looked at the source yet). Even if I look at it, a little is what I am going to understand.

So, if you have done something similar to my requirement please let me know.

Thanks
Ranga
[originally posted on jforum.net by ranga]

[Migrated From Jforum.net]

This code is totally untested but should come close to what you want:

package net.jforum.sso;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.StringTokenizer;

import javax.servlet.http.Cookie;

import net.jforum.ControllerUtils;
import net.jforum.JForumExecutionContext;
import net.jforum.context.RequestContext;
import net.jforum.context.SessionContext;
import net.jforum.dao.DataAccessDriver;
import net.jforum.dao.UserDAO;
import net.jforum.entities.User;
import net.jforum.entities.UserSession;
import net.jforum.repository.SecurityRepository;
import net.jforum.util.preferences.ConfigKeys;
import net.jforum.util.preferences.SystemGlobals;

import org.apache.log4j.Logger;

public class CookieSSO implements SSO {  // you must implement met.jforum.sso.SSO

    static final Logger logger = Logger.getLogger(CookieSSO.class.getName()); // init logging

    static final String md5Salt = "someWeirdStringSharedByTheApps";
    static final int JFORUM_NORMAL_GROUP_ID = 1;
    static final int JFORUM_ADMIN_GROUP_ID = 2;
    static final int JFORUM_MODERATOR_GROUP_ID = 3;
    /**
     *  Assume cookie of format:  userId/e-mail/group_info/md5-hash.<P>
     *  
     *  Where:<br> 
     *  userId = Remote apps's authenticated app.<br>
     *  e-mail = E-mail address of remote user's app<br>
     *  group_info = Group info. 
     *  
     */
    public String authenticateUser(RequestContext request) { //  required method
        Cookie myCookie = ControllerUtils.getCookie("auto-login"); // my app login cookie
        
        if (myCookie == null) {  // No Cookie, so just return a null.
            return null;
        }
            
        //Parse the cookie into it's parts.
        StringTokenizer st = new StringTokenizer(myCookie.getValue(),"/");
        String userId = null;
        String email = null;
        String group_info = null;
        String md5String = null;
        try {
            userId = st.nextToken();
            email = st.nextToken();
            group_info = st.nextToken();
            md5String = st.nextToken();
        } catch ( Exception e ) {
            logger.warn("Found SSO Cookie, but could not parse it! "+
                    "userId='"+userId+"' md5='"+md5String+"'",e);
            return null;
        }
        
        //Validate the cookie's MD5 Hash
        try {
            if (!  makeMD5Token(userId, email, group_info).equals(md5String)) {
                logger.warn("Found SSO cookie with invalid MD5 security hash!");
                return null;
            }
        } catch ( Exception e ) {
            logger.warn("Error validating md5String for cookie: '" + 
                        myCookie.getValue());
            return null;
        }

        SessionContext session = request.getSessionContext();
        
        String lastSSOUser = (String) session.getAttribute("MY_SSO_USER");
        
        // If lastSSOUser is set and matches, then it's valid so just 
        // return the name and save looking up the user, etc.
        if ( lastSSOUser != null && lastSSOUser.equals(userId)) {
            return lastSSOUser;
        }
        
        // Create the jForum user entry if needed.
        SSOUtils utils = new SSOUtils();

        String password = null;  // Could set a password here if desired.
        if (!utils.userExists(userId)) {

            if (email == null || email.equals("")) {
                email = SystemGlobals.getValue(ConfigKeys.SSO_DEFAULT_EMAIL);
            }

            if (password == null) {
                password = SystemGlobals.getValue(ConfigKeys.SSO_DEFAULT_PASSWORD);
            }

            utils.register(password, email);
        }
        User user = utils.getUser();
        
        session.setAttribute("MY_SSO_USER", userId);
        
        // Make sure user group info is current with each "login".
        
        UserDAO um = DataAccessDriver.getInstance().newUserDAO();
        
        int[] disallowedGroups = null;
        int[] allowedGroups = null;

        if ( group_info.equals("admin")) {
            allowedGroups = new int[3];
            allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
            allowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
            allowedGroups[2] = JFORUM_ADMIN_GROUP_ID;
        } else if ( group_info.equals("moderator" )){
            disallowedGroups = new int[1];
            disallowedGroups[0] = JFORUM_ADMIN_GROUP_ID;
            allowedGroups = new int[2];
            allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
            allowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
        } else {
            disallowedGroups = new int[2];
            disallowedGroups[0] = JFORUM_ADMIN_GROUP_ID;
            disallowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
            allowedGroups = new int[1];
            allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
        } 
        if ( disallowedGroups != null ) {
            um.removeFromGroup(user.getId(), disallowedGroups);
        }
        um.addToGroup(user.getId(), allowedGroups);
        SecurityRepository.remove(user.getId());

        // User by isSessionValid.
        Cookie cookie = new Cookie("JforumSSO", userId);
        cookie.setMaxAge(myCookie.getMaxAge());
        cookie.setPath("/");
        JForumExecutionContext.getResponse().addCookie(cookie);

        return userId; 
    }
    
    public boolean isSessionValid(UserSession userSession, RequestContext request) {
        String      remoteUser  = null;
        Cookie SSOCookie = ControllerUtils.getCookie("JforumSSO");
        if (SSOCookie != null) remoteUser = SSOCookie.getValue(); //  jforum username
        
        // user has since logged out
        if(remoteUser == null && 
                userSession.getUserId() != SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
            return false;
            
         // user has since logged in
        } else if(remoteUser != null && 
                userSession.getUserId() == SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
            return false;
            
        // user has changed user
        } else if(remoteUser != null && !remoteUser.equals(userSession.getUsername())) {
            return false;
        }
        return true; // myapp user and forum user the same
    }
    /**
     * Makes the MD5 token used for authentication in cookies.
     *
     * @param userName The user id used for encryption.
     * @param email The user's email (or "" if none).
     * @return The hex string representation of the MD5 digested string.
     * @exception NoSuchAlgorithException If for some reason, MD5 is not available?
     */    
       private String makeMD5Token (String userName, String email, 
                                    String groupInfo ) 
                                           throws NoSuchAlgorithmException {
           MessageDigest md;
           byte[] sig;
           String plainText;
           StringBuffer encryptedText = new StringBuffer();

           plainText = md5Salt + "/" + userName + "/"+ email + "/"+groupInfo;
           md = MessageDigest.getInstance("MD5");

           sig = md.digest(plainText.getBytes());

           for ( int i = 0; i < sig.length; i++ ) {
               encryptedText.append(Integer.toString(( sig[i] & 0xff ) + 0x100, 16 ).substring(1));
           }
           return encryptedText.toString();
       }
}

[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

I guess the code snippet you gave will be a lot useful in integrating jforum with our application.

Thanks a lot!

Will get back to you if I have any problems
[originally posted on jforum.net by ranga]