RemoteSSO?

[Migrated From Jforum.net]

The code should read something like

HttpSession session = request.getSession();
session.setAttribute("password", person.getPassword());
session.setAttribute("email", person.getEmail());

Hope it helps,
Diego
[originally posted on jforum.net by andune76]

[Migrated From Jforum.net]

andune76 wrote:The code should read something like

HttpSession session = request.getSession();
session.setAttribute("password", person.getPassword());
session.setAttribute("email", person.getEmail());

Hope it helps,
Diego

Ok, trying to use it directly, instead of a subclass, never know if anything is done which obscure the parameters..

[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

Hmm that did not help.. BTW.. My application of course is in another application context, is this a problem. Should I specify anything? I saw somebody mention a crosscontext thing?

The user is being picked up as annoynmus...

I am using tomcat with apache as a front proxy..
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

Hows it supposed to work?

I've added the attributtes in my application.. But they are not being picked up in jforum..?

this.setAttribute("password", person.getPassword());
this.setAttribute("email", person.getEmail());

Is it because they are in different contexts? Whats the normal approach to this?


regards Nino
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

Yes, you need to enable cross-context sessions or SSO in Tomcat. There is a SSOValve configuration in server.xml
[originally posted on jforum.net by andune76]

[Migrated From Jforum.net]

andune76 wrote:Yes, you need to enable cross-context sessions or SSO in Tomcat. There is a SSOValve configuration in server.xml

So I just need to uncomment this:

<Valve className="org.apache.catalina.authenticator.SingleSignOn" />

and that should be it?

Or do I have to say in my web.xml that its crosscontext too somehow?


EDIT, uncommented the valve, but still no luck:/

EDIT: I modified this too:
<Context crossContext="true">


Are there any simpler ways of making this work, rebuilding jforum does not sound like a easy way..
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

andune76 wrote:It worked for me, I did not even have to modify my web.xml.

I assume you have configured sso in SystemGlobals.properties, if you have not, then that is what is troubling you.

This is what I have in systemGlobals.properties under sso:
#############################
# SSO / User authentication
#############################
# Auhentication type: use one of the following options
#
# sso: SSO based authentication. The called class will be the one
# specified by the key "sso.implementation", whic must be an implementation
# of net.jforum.sso.SSO
#
# default: Non-SSO authentication, which relies on the key
# "login.authenticator" to validate users. For more information, please see
# net.jforum.sso.LoginAuthenticator and the default implementation.
#authentication.type = default
authentication.type = sso
# The above key will be used when "authentication.type" is set to "default"
# Can be any implementation of net.jforum.sso.LoginAuthenticator
#
# For LDAP authentication, set the value to net.jforum.sso.LDAPAuthenticator. Also,
# see the LDAP section below
login.authenticator = net.jforum.sso.DefaultLoginAuthenticator

# automatic logged in when they come back to the forum
auto.login.enabled = true

# The above key will be be used then "authentication.type" is set to "sso"
# The default implementation (used here) only checks if request.getRemoteUser()
# is not null. This may be enough for many situations.
sso.implementation = net.jforum.sso.RemoteUserSSO

# Special attributes used when creating a new user
# Only if auhentication.type = sso
# The attribute name to search in the session for the password.
sso.password.attribute = password

# Same as above
sso.email.attribute = email

# The default email to use if sso.email.attribute is empty
sso.default.email = sso@user

# The default password to use if sso.password.attribute is empty
sso.default.password = sso

# Optional redirect for SSO
#
# If a value is set, the user will be redirected to the defined
# URL, using the following logic:
#
# ${sso.redirect}?returnUrl=${forum.link} + <the original JForum URL>
#
# The value MUST start with the protocol (http:// or https://)
#
sso.redirect =

Isnt it okay?
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

It worked for me, I did not even have to modify my web.xml.

I assume you have configured sso in SystemGlobals.properties, if you have not, then that is what is troubling you.
[originally posted on jforum.net by andune76]

[Migrated From Jforum.net]

I thikn the SSO valve of tomcat allows a user to login against the tomcat security mechanism, and then it holds a user object at any request - which would pretty much work alogn with the sample RemoteSSO example that ships with jforum.

If you have your own sso implementation this is probably not sufficient - you rather have to enable the cross context entry. Another approach would be to use URL authentication for instance. This is independent from sessions or context sharing. But without url encryption it'd be high risk!
[originally posted on jforum.net by Sid]

[Migrated From Jforum.net]

Sid wrote:I thikn the SSO valve of tomcat allows a user to login against the tomcat security mechanism, and then it holds a user object at any request - which would pretty much work alogn with the sample RemoteSSO example that ships with jforum.

So this is exactly what I am trying.. I got the idea that if there user werent created, it would be by using the values from email and username field...

Sid wrote:
If you have your own sso implementation this is probably not sufficient - you rather have to enable the cross context entry. Another approach would be to use URL authentication for instance. This is independent from sessions or context sharing. But without url encryption it'd be high risk!

As you can see from the config file, i am using the remoteSSO by jforum... I am linking from my application via an iframe to jforum...


regards Nino
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

So is there anything wrong with my approach?


Could someone paste their code examples?
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

I'm not sure exactly what you're trying to do here. The Tomcat SSO implimentation is designed to work with Tomcat's Realm definition and the Java Servlet spec's security mechanisms.

So, besides just turning this on, you need to have a Realm implimentation defined as well, e.g. a DataSourceReam or the like. Then for each web app you are protecting, you will need to define the security constraints and other security descriptors in the WebApp's web.xml file. (See the spec for details).

Once you've done this, you should only get challenged for an id/password on the first secured webapp (in the same Realm) you hit. All this is based on the Spec level security.

At the application level, all you get from this is that you can use the request.getUserPrincipal() method to get limited info about the logged in user (basically the user name). Or you can use the request.isUserInRole(Role) method to check if the logged in user is in the specified role (as defined by the Tomcat Realm implimentation).

It also follows the HTTP spec in setting the REMOTE_USER environmental variable to the same name as the principal.

The SSO implimentation does not pass any objects back and forth beween webapps. It just uses some special cookies to identify the user principal object which is stored at the container level and shared among webapps.

In this case, JForum's RemoteUserSSO says, if the request returns a valid principal or REMOTE_USER user id, I will trust that the webserver or container has already validated that user id.

If the user id does not exist in the Jforum user tables, it will create one using the defaults in the config file for e-mail, etc. For the profile and other information to be correct for the user, the user will need to manually edit that.

E.g., you go to secured1 and login in. then you go to secured2.
[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

monroe wrote:I'm not sure exactly what you're trying to do here. The Tomcat SSO implimentation is designed to work with Tomcat's Realm definition and the Java Servlet spec's security mechanisms.

So, besides just turning this on, you need to have a Realm implimentation defined as well, e.g. a DataSourceReam or the like. Then for each web app you are protecting, you will need to define the security constraints and other security descriptors in the WebApp's web.xml file. (See the spec for details).

Once you've done this, you should only get challenged for an id/password on the first secured webapp (in the same Realm) you hit. All this is based on the Spec level security.

Okay, this is not what I wanted. What I wanted was to specify a user and password in session context

monroe wrote:
At the application level, all you get from this is that you can use the request.getUserPrincipal() method to get limited info about the logged in user (basically the user name). Or you can use the request.isUserInRole(Role) method to check if the logged in user is in the specified role (as defined by the Tomcat Realm implimentation).

It also follows the HTTP spec in setting the REMOTE_USER environmental variable to the same name as the principal.

The SSO implimentation does not pass any objects back and forth beween webapps. It just uses some special cookies to identify the user principal object which is stored at the container level and shared among webapps.

In this case, JForum's RemoteUserSSO says, if the request returns a valid principal or REMOTE_USER user id, I will trust that the webserver or container has already validated that user id.

If the user id does not exist in the Jforum user tables, it will create one using the defaults in the config file for e-mail, etc. For the profile and other information to be correct for the user, the user will need to manually edit that.

E.g., you go to secured1 and login in. then you go to secured2.

So what you describe above is something like what I want.

The user goes to my application and logs in (using my own security mechanism). At some point the user decides to go to jforum. So I set two session properties, user and password and on the otherside (jforum application) checks for those two. Sees that the user are not created in the database so it goes forward and creates the user using the name and password. Could be nice to define more properties in session context, like a picture etc.

So the above scenario is possible and should work with the default remoteSSO right? So what I need is to turn off the SSO valve and just leave the cross context on right?

Another thing I have to mention is that I have apache2 infront of tomcat, but that should not mess anything up, I guess.
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

I think you are misunderstanding the way the Specs define how a Servlet Container should act. Cross Context does not mean that there is some "shared session" object available across all webapps. This means that one web app context is able to make Requests via the dispatcher calls to another. Even there, the sessions objects are different.

If you're looking for a shared object available across multiple webapps, you'll need to do that at the container level. E.g. write your own variation of the Tomcat SSO valve. But then your app will be tied tightly to the Tomcat platform and not as portable.

You might be able to do something with a cross context call to set up a remote session prior to making a direct URL reference to it. The only thing I'm not sure of is if the session created by the cross context call will be "connected" to the end user's browser. I.e., is there a Session cookie returned to the browser so Tomcat can match the browser to the session?


[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

monroe wrote:I think you are misunderstanding the way the Specs define how a Servlet Container should act. Cross Context does not mean that there is some "shared session" object available across all webapps. This means that one web app context is able to make Requests via the dispatcher calls to another. Even there, the sessions objects are different.

Okay thanks for clarifying this bit. So the http://www.jforum.net/doc/SSORemote on the wiki are meant to run somewhere within jforum?

monroe wrote:
If you're looking for a shared object available across multiple webapps, you'll need to do that at the container level. E.g. write your own variation of the Tomcat SSO valve. But then your app will be tied tightly to the Tomcat platform and not as portable.

Okay this is not what I wanted todo.. And it would probably also clutter the session somewhat..

monroe wrote:
You might be able to do something with a cross context call to set up a remote session prior to making a direct URL reference to it. The only thing I'm not sure of is if the session created by the cross context call will be "connected" to the end user's browser. I.e., is there a Session cookie returned to the browser so Tomcat can match the browser to the session?

Usually the webcontainer does one of two things:

*Sets a session cookie
*Urlrewrite (appends jsessionid)


So I guess the final thing to ask are:
Is there a way to signin a user from another java(using cookies, special urls etc) application by using the default implementations provided by Jforum?

If no, then how hard is it todo this?
I guess I would need to create my own implementation of the remote sso class and recompile jforum? Can the implementation request that a user has to be created or does that happen on default?
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

Nino Martinez wrote:
Usually the webcontainer does one of two things:

*Sets a session cookie
*Urlrewrite (appends jsessionid)

Yes, but with a cross context call, you call WebAppA which internally calls WebAppB. The request and response is shared, but you have two sessions involve with one URL, so which session id does jsessionid get set to? Also, some browsers might deny cookies with URLs that don't match the called URL for security reasons. Bottom line is that you'd need to determine the behaviour here.

Nino Martinez wrote:
So I guess the final thing to ask are:
Is there a way to signin a user from another java(using cookies, special urls etc) application by using the default implementations provided by Jforum?

If no, then how hard is it todo this?
I guess I would need to create my own implementation of the remote sso class and recompile jforum? Can the implementation request that a user has to be created or does that happen on default?

Unfortunately, there are no SSO standards that one can build a generic implimentation to. The closest one is to being a standard is to use HTTP authentication at the web server or container level. Which is what the RemoteUser class caters to.

However, the basic SSO interface is fairly flexible and folks have managed to implement it in lots of environments. Have you looked at the SSO section in the documents? It's not the best written but it covers the basics. There are also a lot of theads here around that.

FWIW, here's a fairly complete sample of an SSO implementation that uses Cookies. I haven't really tested this a lot since I use another method. But it should be a good starting point.

package net.jforum.sso;

/*
 * The author licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.StringTokenizer;

import javax.servlet.http.Cookie;

import net.jforum.ControllerUtils;
import net.jforum.context.RequestContext;
import net.jforum.context.SessionContext;
import net.jforum.dao.DataAccessDriver;
import net.jforum.dao.UserDAO;
import net.jforum.entities.User;
import net.jforum.entities.UserSession;
import net.jforum.repository.SecurityRepository;
import net.jforum.util.preferences.ConfigKeys;
import net.jforum.util.preferences.SystemGlobals;

import org.apache.log4j.Logger;

/*
 * An example of doing jForum SSO with Cookies.  The name of this class should  
 * be referenced in the sso.implementation config setting.<p>
 * 
 * This SSO implementation assumes that the calling app will be setting 
 * a cookie with the name define by SSO_COOKIE_NAME that has the format
 * defined by the makeSSOCookieValue method.  It supports creating jForum
 * users from the information passed via a cookie set by another application.
 * <p>
 * 
 * @author Monroe 
 */
public class CookieSSO implements SSO {  

 // init logging
    static final Logger logger = Logger.getLogger(CookieSSO.class.getName()); 

    static final String md5Salt = "someWeirdStringSharedByTheApps";
    
    /** Database group id number for the normal (general) group */
    static final int JFORUM_NORMAL_GROUP_ID = 1;
    /** Database group id number for the admin group */
    static final int JFORUM_ADMIN_GROUP_ID = 2;
    /** Database group id number for a moderators group */
    static final int JFORUM_MODERATOR_GROUP_ID = 3;
    
    /** Name of the cookie being used to do SSO */
    static final String SSO_COOKIE_NAME = "sso-auto-login";
    /** The session attribute name that stores the last authenticated user */
    static final String SSO_USER_SESSION_ATTR = "sso-auto-login-user";
    
    static SimpleDateFormat dateFormatter = 
                            new SimpleDateFormat("yyyyMMddHHmm");
    static final long COOKIE_TIME_WINDOW = 300000l; //5 minutes in milliseconds
    /**
     * This is what jForum will call to authenticate a user ( e.g. the user 
     * session is invalid). 
     * Assume cookie of format: userId/e-mail/group_info/timestamp/md5-hash.
     * <P>
     *  
     * Where:<br> 
     *  userId = Remote apps's authenticated user id.<br>
     *  e-mail = E-mail address of remote user's app<br>
     *  group_info = an id for determining the default set of groups to use if 
     *               the user needs to be created.<br>
     *  timestamp =  The time the cookie was created.
     *  
     */
    public String authenticateUser(RequestContext request) 
    { 
        Cookie myCookie = ControllerUtils.getCookie( SSO_COOKIE_NAME ); 
        
        if ( myCookie == null ) {  // No Cookie, so just return a null.
            return null;
        }

        // Verify that cookie is valid and get info from it.
        String[] values = validateCookie( myCookie );
        if ( values == null ) {
            return null;
        }
            
        String userId = values[0];
        String email = values[1];
        String group_info = values[2];

        SessionContext session = request.getSessionContext();
        
        // If lastSSOUser is set and matches, then it's valid so just 
        // return the name and save looking up the user, etc.
        String lastSSOUser = 
                  (String) session.getAttribute(SSO_USER_SESSION_ATTR);
        if ( lastSSOUser != null && lastSSOUser.equals(userId)) {
            return lastSSOUser;
        }
        
        // Create the jForum user entry if needed.
        // If you need to transfer more information than user, password, email
        // then implement your own variation of registerUser.
        SSOUtils utils = new SSOUtils();

        String password = null;  // Could set a password here if desired.
        if ( ! utils.userExists(userId) ) {

            if (email == null || email.equals("")) {
                email = SystemGlobals.getValue(ConfigKeys.SSO_DEFAULT_EMAIL);
            }

            if (password == null) {
                password = 
                       SystemGlobals.getValue(ConfigKeys.SSO_DEFAULT_PASSWORD);
            }

            utils.register(password, email);
        }
        User user = utils.getUser();
        
        session.setAttribute(SSO_USER_SESSION_ATTR, userId);
        
        // Make sure user group info is current with each "login" since
        // the user's status might have changed.
        
        UserDAO um = DataAccessDriver.getInstance().newUserDAO();
        
        int[] disallowedGroups = null;
        int[] allowedGroups = null;

        if ( group_info.equals("admin")) 
        {
            allowedGroups = new int[3];
            allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
            allowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
            allowedGroups[2] = JFORUM_ADMIN_GROUP_ID;
        }
        else if ( group_info.equals("moderator" )){
            disallowedGroups = new int[1];
            disallowedGroups[0] = JFORUM_ADMIN_GROUP_ID;
            allowedGroups = new int[2];
            allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
            allowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
        }
        else 
        {
            disallowedGroups = new int[2];
            disallowedGroups[0] = JFORUM_ADMIN_GROUP_ID;
            disallowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
            allowedGroups = new int[1];
            allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
        } 
        if ( disallowedGroups != null ) 
        {
            um.removeFromGroup(user.getId(), disallowedGroups);
        }
        um.addToGroup(user.getId(), allowedGroups);
        SecurityRepository.remove(user.getId());

        // Save the SSO authenticated user in the session
        session.setAttribute(SSO_USER_SESSION_ATTR, user.getName());

        return userId; 
    }
    
    /**
     * This method is called by every request to jForum to validate the current
     * user status.  E.g., have they logged off or a different user logged in?
     */
    public boolean isSessionValid( UserSession userSession, 
                                   RequestContext request) 
    {
        // Get the last SSO logged in user id.
        SessionContext session = request.getSessionContext();
        String remoteUser = 
                  (String) session.getAttribute(SSO_USER_SESSION_ATTR);

        Cookie ssoCookie = ControllerUtils.getCookie( SSO_COOKIE_NAME );
        String cookieUser = getUserFromCookie(ssoCookie);
        
        // Check to see if SSO Request user has changed.
        if ( cookieUser != null && ! cookieUser.equals(remoteUser) ) {
            return false;
        }
        
        // User has not been authenticated by SSO yet and IS NOT 
        // the anonymous user
        if( remoteUser == null && userSession.getUserId() != 
                    SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) 
        {
            return false;
        } 
        // User has not been authenticated by SSO yet and IS the anonymous user
        else if( remoteUser != null && userSession.getUserId() == 
                    SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) 
        {
            return false;
            
        // The SSO user does not match the current jForum User.
        } else if(remoteUser != null && 
                    ! remoteUser.equals(userSession.getUsername())) 
        {
            return false;
        }
        return true; // The SSO user and forum user are the same
    }
    /**
     * Validate and parse the SSO cookie.
     * 
     * @param myCookie
     * @return null if Cookie is not valid or a String[3] array with 
     *         userId, email, and group_info values.
     */ 
    protected String[] validateCookie( Cookie myCookie ) 
    {
        //Parse the cookie into it's parts.
        StringTokenizer st = new StringTokenizer(myCookie.getValue(),"/");
        String userId = null;
        String email = null;
        String group_info = null;
        String timeStamp = null;
        String md5String = null;
        try {
            userId = st.nextToken();
            email = st.nextToken();
            group_info = st.nextToken();
            timeStamp = st.nextToken();
            md5String = st.nextToken();
        } catch ( Exception e ) {
            logger.warn("Found SSO Cookie, but could not parse it! "+
                    "userId='"+userId+"' md5='"+md5String+"'",e);
            return null;
        }
        // Validate that the cookie has not expired
       Date ts = null;
        try {
            ts = dateFormatter.parse(timeStamp);
        } catch ( Exception e ) {
            logger.warn("Found invalid timestamp on cookie!");
            return null;
        }
        Date now = new Date();
        Date window = new Date(now.getTime() - COOKIE_TIME_WINDOW );
        if ( ts.before(window)) {
            logger.warn("Called with expired cookie!");
            return null;
        }
        
        //Validate the cookie's MD5 Hash
        try {
            if (! makeMD5Token(userId, email, group_info, timeStamp )
                    .equals(md5String)) {
                logger.warn("Found SSO cookie with invalid MD5 security hash!");
                return null;
            }
        } catch ( Exception e ) {
            logger.warn("Error validating md5String for cookie: '" + 
                        myCookie.getValue() + "'");
            return null;
        }
        String[] values = new String[3];
        values[0] = userId;
        values[1] = email;
        values[2] = group_info;
        return values;
    }
    /**
     * Return just the user name from the SSO Cookie.
     * 
     * @param ssoCookie The SSO cookie to use, can be null.
     * @return The user name or null if it can't be found.
     */
    public String getUserFromCookie( Cookie ssoCookie ) 
    {
        if ( ssoCookie == null ) {
            return null;
        }
        String value = ssoCookie.getValue();
        int l = value.indexOf("/");
        if ( l < 1 ) {  // Invalid cookie format.
            return null;
        }
        return value.substring( 0, value.indexOf("/"));
    }
    /**
     * Makes the MD5 token used for authentication in cookies.
     *
     * @param userName The user id used for encryption.
     * @param email The user's email (or "" if none).
     * @param groupInfo The category of groups the user is to be allowed 
     *                  access to.
     * @param timestamp A yyyyddMMhhmm representation of when the cookie
     *                  was created.
     * @return The hex string representation of the MD5 digested string.
     * @exception NoSuchAlgorithException If for some reason, MD5 is
     *                not available?
     */    
    protected String makeMD5Token (String userName, String email, 
                                 String groupInfo, String timestamp ) 
                                        throws NoSuchAlgorithmException {
        MessageDigest md;
        byte[] sig;
        String plainText;
        StringBuffer encryptedText = new StringBuffer();

        plainText = md5Salt + "/" + userName + "/"+ email + "/"+groupInfo + 
                    "/" + timestamp;
        md = MessageDigest.getInstance("MD5");

        sig = md.digest(plainText.getBytes());

        for ( int i = 0; i < sig.length; i++ ) {
            encryptedText.append(Integer.toString(( sig[i] & 0xff ) + 
                                                  0x100, 16 ).substring(1));
        }
        return encryptedText.toString();
    }
    /*
     * Makes the value to be used in the SSO cookie.  The calling 
     * webapp can use this method to create the SSO 
     */
    public String makeSSOCookieValue(String userName, String email, 
                                     String groupInfo )
                                        throws NoSuchAlgorithmException 
    {
        String timestamp = dateFormatter.format(new Date());
        return userName + "/" + email + "/" + groupInfo + "/" +
               makeMD5Token(userName, email, groupInfo, timestamp );
    }
}

[originally posted on jforum.net by monroe]

[Migrated From Jforum.net]

monroe wrote:
... code example ...

Actually the example you provided could pretty easily be genericallyfied.. If all the properties you used could be bundled in a property file instead. You could specify the MD5hash, cookie properties there instead, not having to recompile. I think that would great to bundle such a thing with jforum.

WDYT?
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

Sorry for the thread necro, but I'm working on an approach and Monroe's code snippet is very helpful. I was wondering if it would be feasible to actually retrieve the user entity during the SSO process, update fields, and then update it, allowing you to populate any field on the user object (IM, web site, location, etc).

If so, that would be pretty powerful. Using reflection, you could take a set of name/value pairs in a cookie formatted in something like YAML or JSON and look up the setter method on the User entity.

That would be pretty useful for the single sign-on approach I am looking for, where users have an account for another web app that authenticates with an archaic legacy system. I can't set up a Tomcat realm (plus I don't really want to tie the app to one container), but I can cookie any values I would need to pass any user profile data to jforum.
[originally posted on jforum.net by msernatinger]

[Migrated From Jforum.net]

yeah something like that would be really cool.. but I wonder if the team would support rest instead...
[originally posted on jforum.net by Nino Martinez]

[Migrated From Jforum.net]

Did anyone get Monroe's example to work out of the box? I've been working on it for two days and all the code seems right but every time I go to the forum I'm not logged in.
[originally posted on jforum.net by NingDynasty]

[Migrated From Jforum.net]

NingDynasty wrote:Did anyone get Monroe's example to work out of the box? I've been working on it for two days and all the code seems right but every time I go to the forum I'm not logged in.

It should work heres what I have :

package zeuzgroup.application.utils;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.StringTokenizer;

import javax.servlet.http.Cookie;

import net.jforum.ControllerUtils;
import net.jforum.context.RequestContext;
import net.jforum.context.SessionContext;
import net.jforum.dao.DataAccessDriver;
import net.jforum.dao.UserDAO;
import net.jforum.entities.User;
import net.jforum.entities.UserSession;
import net.jforum.repository.SecurityRepository;
import net.jforum.util.preferences.ConfigKeys;
import net.jforum.util.preferences.SystemGlobals;

import org.apache.log4j.Logger;

import zeuzgroup.core.Person;
import zeuzgroup.core.user.UserType;

/*
 * An example of doing jForum SSO with Cookies.  The name of this class should  
 * be referenced in the sso.implementation config setting.<p>
 * 
 * This SSO implementation assumes that the calling app will be setting 
 * a cookie with the name define by SSO_COOKIE_NAME that has the format
 * defined by the makeSSOCookieValue method.  It supports creating jForum
 * users from the information passed via a cookie set by another application.
 * <p>
 * 
 * @author Monroe, nmwael 
 */
public class CookieSSO implements SSO {

	// init logging
	static final Logger logger = Logger.getLogger(CookieSSO.class.getName());

	static final String md5Salt = "somethingobscure";

	/** Database group id number for the normal (general) group */
	static final int JFORUM_NORMAL_GROUP_ID = 1;
	/** Database group id number for the admin group */
	static final int JFORUM_ADMIN_GROUP_ID = 2;
	/** Database group id number for a moderators group */
	static final int JFORUM_MODERATOR_GROUP_ID = 3;
	/** Database group id number for DK group */
	static final int JFORUM_DK_GROUP_ID = 4;
	/** Database group id number for EN group */
	static final int JFORUM_EN_GROUP_ID = 5;

	/** Name of the cookie being used to do SSO */
	static final String SSO_COOKIE_NAME = "sso-auto-login";
	/** The session attribute name that stores the last authenticated user */
	static final String SSO_USER_SESSION_ATTR = "sso-auto-login-user";

	static SimpleDateFormat dateFormatter = new SimpleDateFormat("yyyyMMddHHmm");
	static final long COOKIE_TIME_WINDOW = 300000l; // 5 minutes in milliseconds

	/**
	 * This is what jForum will call to authenticate a user ( e.g. the user
	 * session is invalid). Assume cookie of format:
	 * userId/e-mail/group_info/timestamp/md5-hash.
	 * <P>
	 * 
	 * Where:<br>
	 * userId = Remote apps's authenticated user id.<br>
	 * e-mail = E-mail address of remote user's app<br>
	 * group_info = an id for determining the default set of groups to use if
	 * the user needs to be created.<br>
	 * timestamp = The time the cookie was created.
	 * 
	 */
	public String authenticateUser(RequestContext request) {
		Cookie myCookie = ControllerUtils.getCookie(SSO_COOKIE_NAME);

		if (myCookie == null) { // No Cookie, so just return a null.
			logger.error("No cookie found");
			return null;
		}

		// Verify that cookie is valid and get info from it.
		String[] values = validateCookie(myCookie);
		if (values == null) {
			logger.error("Could not validate content of cookie:"
					+ myCookie.toString());
			return null;
		}

		String domain = values[0];
		String userId = values[1];
		String email = values[2];
		String group_info = values[3];

		SessionContext session = request.getSessionContext();

		// If lastSSOUser is set and matches, then it's valid so just
		// return the name and save looking up the user, etc.
		String lastSSOUser = (String) session
				.getAttribute(SSO_USER_SESSION_ATTR);
		if (lastSSOUser != null && lastSSOUser.equals(userId)) {
			return lastSSOUser;
		}

		// Create the jForum user entry if needed.
		// If you need to transfer more information than user, password, email
		// then implement your own variation of registerUser.
		SSOUtils utils = new SSOUtils();

		String password = null; // Could set a password here if desired.
		if (!utils.userExists(userId)) {

			if (email == null || email.equals("")) {
				email = SystemGlobals.getValue(ConfigKeys.SSO_DEFAULT_EMAIL);
			}

			if (password == null) {
				password = SystemGlobals
						.getValue(ConfigKeys.SSO_DEFAULT_PASSWORD);
			}

			utils.register(password, email);
		}
		User user = utils.getUser();

		session.setAttribute(SSO_USER_SESSION_ATTR, userId);

		// Make sure user group info is current with each "login" since
		// the user's status might have changed.

		UserDAO um = DataAccessDriver.getInstance().newUserDAO();

		int[] disallowedGroups = null;
		int[] allowedGroups = null;

		int localeId = -1;
		if (domain.endsWith("EU")) {
			localeId = JFORUM_EN_GROUP_ID;
		} else {
			// default to dk!
			localeId = JFORUM_DK_GROUP_ID;
		}

		if (group_info.equals("admin")) {
			logger.info("user is Admin");
			allowedGroups = new int[4];
			allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
			allowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
			allowedGroups[2] = JFORUM_ADMIN_GROUP_ID;
			allowedGroups[3] = localeId;
		} else if (group_info.equals("moderator")) {
			logger.info("user is Moderator");
			disallowedGroups = new int[1];
			disallowedGroups[0] = JFORUM_ADMIN_GROUP_ID;
			allowedGroups = new int[3];
			allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
			allowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
			allowedGroups[2] = localeId;
		} else {
			logger.info("user is normal user");
			disallowedGroups = new int[2];
			disallowedGroups[0] = JFORUM_ADMIN_GROUP_ID;
			disallowedGroups[1] = JFORUM_MODERATOR_GROUP_ID;
			allowedGroups = new int[2];
			allowedGroups[0] = JFORUM_NORMAL_GROUP_ID;
			allowedGroups[1] = localeId;
		}
		if (disallowedGroups != null) {
			um.removeFromGroup(user.getId(), disallowedGroups);
		}
		um.addToGroup(user.getId(), allowedGroups);
		SecurityRepository.remove(user.getId());

		// Save the SSO authenticated user in the session
		session.setAttribute(SSO_USER_SESSION_ATTR, user.getName());

		return userId;
	}

	/**
	 * This method is called by every request to jForum to validate the current
	 * user status. E.g., have they logged off or a different user logged in?
	 */
	public boolean isSessionValid(UserSession userSession,
			RequestContext request) {
		// Get the last SSO logged in user id.
		SessionContext session = request.getSessionContext();
		String remoteUser = (String) session
				.getAttribute(SSO_USER_SESSION_ATTR);

		Cookie ssoCookie = ControllerUtils.getCookie(SSO_COOKIE_NAME);
		String cookieUser = getUserFromCookie(ssoCookie);

		// Check to see if SSO Request user has changed.
		if (cookieUser != null && !cookieUser.equals(remoteUser)) {
			return false;
		}

		// User has not been authenticated by SSO yet and IS NOT
		// the anonymous user
		if (remoteUser == null
				&& userSession.getUserId() != SystemGlobals
						.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {

			return false;
		}
		// User has not been authenticated by SSO yet and IS the anonymous user
		else if (remoteUser != null
				&& userSession.getUserId() == SystemGlobals
						.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
			logger.error("User are Anonymous");
			return false;

			// The SSO user does not match the current jForum User.
		} else if (remoteUser != null
				&& !remoteUser.equals(userSession.getUsername())) {
			return false;
		}
		return true; // The SSO user and forum user are the same
	}

	/**
	 * Validate and parse the SSO cookie.
	 * 
	 * @param myCookie
	 * @return null if Cookie is not valid or a String[3] array with userId,
	 *         email, and group_info values.
	 */
	protected String[] validateCookie(Cookie myCookie) {
		// Parse the cookie into it's parts.
		StringTokenizer st = new StringTokenizer(myCookie.getValue(), "/");
		String domain = null;
		String userId = null;
		String email = null;
		String group_info = null;
		String timeStamp = null;
		String md5String = null;
		try {
			domain = st.nextToken();
			userId = st.nextToken();
			email = st.nextToken();
			group_info = st.nextToken();
			timeStamp = st.nextToken();
			md5String = st.nextToken();
		} catch (Exception e) {
			logger.error("Found SSO Cookie, but could not parse it! "
					+ "userId='" + userId + "' md5='" + md5String + "'", e);
			return null;
		}
		// Validate that the cookie has not expired
		Date ts = null;
		try {
			ts = dateFormatter.parse(timeStamp);
		} catch (Exception e) {
			logger.error("Found invalid timestamp on cookie!");
			return null;
		}
		Date now = new Date();
		Date window = new Date(now.getTime() - COOKIE_TIME_WINDOW);
		if (ts.before(window)) {
			logger.error("Called with expired cookie!");
			return null;
		}

		// Validate the cookie's MD5 Hash
		try {
			if (!makeMD5Token(domain, userId, email, group_info, timeStamp)
					.equals(md5String)) {
				logger
						.error("Found SSO cookie with invalid MD5 security hash!");
				return null;
			}
		} catch (Exception e) {
			logger.error("Error validating md5String for cookie: '"
					+ myCookie.getValue() + "'");
			return null;
		}
		String[] values = new String[4];
		values[0] = domain;
		values[1] = userId;
		values[2] = email;
		values[3] = group_info;
		return values;
	}

	/**
	 * Return just the user name from the SSO Cookie.
	 * 
	 * @param ssoCookie
	 *            The SSO cookie to use, can be null.
	 * @return The user name or null if it can't be found.
	 */
	public String getUserFromCookie(Cookie ssoCookie) {
		if (ssoCookie == null) {
			return null;
		}
		String value = ssoCookie.getValue();
		int l = value.indexOf("/");
		if (l < 1) { // Invalid cookie format.
			return null;
		}
		return value.substring(0, value.indexOf("/"));
	}

	/**
	 * Makes the MD5 token used for authentication in cookies.
	 * 
	 * @param userName
	 *            The user id used for encryption.
	 * @param email
	 *            The user's email (or "" if none).
	 * @param groupInfo
	 *            The category of groups the user is to be allowed access to.
	 * @param timestamp
	 *            A yyyyddMMhhmm representation of when the cookie was created.
	 * @return The hex string representation of the MD5 digested string.
	 * @exception NoSuchAlgorithException
	 *                If for some reason, MD5 is not available?
	 */
	protected static String makeMD5Token(String domain, String userName, String email,
			String groupInfo, String timestamp) throws NoSuchAlgorithmException {
		MessageDigest md;
		byte[] sig;
		String plainText;
		StringBuffer encryptedText = new StringBuffer();

		plainText = md5Salt + "/" + domain + "/" + userName + "/" + email + "/"
				+ groupInfo + "/" + timestamp;
		md = MessageDigest.getInstance("MD5");

		sig = md.digest(plainText.getBytes());

		for (int i = 0; i < sig.length; i++) {
			encryptedText.append(Integer.toString((sig[i] & 0xff) + 0x100, 16)
					.substring(1));
		}
		return encryptedText.toString();
	}

	/*
	 * Makes the value to be used in the SSO cookie. The calling webapp can use
	 * this method to create the SSO
	 */
	public static String makeSSOCookieValue(String domain, String userName,
			String email, String groupInfo) throws NoSuchAlgorithmException {
		String timestamp = dateFormatter.format(new Date());
		return domain + "/" + userName + "/" + email + "/" + groupInfo + "/"+ timestamp +"/"
				+ makeMD5Token(domain, userName, email, groupInfo, timestamp);
	}

	public static Cookie CreateCookie(Person person, String domain, String lang)
			throws NoSuchAlgorithmException {
		String groupInfo = "normal";

//		String language = domain.substring(domain.length() - 2);
		String language = lang;

		if (person.getUserType().compareTo(UserType.Admin) == 0) {
			groupInfo = "admin";
		}
		if (person.getUserType().compareTo(UserType.Power) == 0) {
			groupInfo = "moderator";
		}
		String encrypted = makeSSOCookieValue(language, person.getAlias(),
				person.getEmail(), groupInfo);
		Cookie cookie = new Cookie(SSO_COOKIE_NAME, encrypted);
		// 10 hours in seconds
		cookie.setMaxAge(120000);
		cookie.setDomain(domain);

		return cookie;

	}
}

Although I think this solution actually creates or recreates a user each time. But im not sure.
[originally posted on jforum.net by Nino Martinez]