Win a copy of Node.js Design Patterns: Design and implement production-grade Node.js applications using proven patterns and techniques this week in the Server-Side JavaScript and NodeJS forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
  • Campbell Ritchie
  • Ron McLeod
  • Rob Spoor
  • Tim Cooke
  • Junilu Lacar
  • Henry Wong
  • Liutauras Vilda
  • Jeanne Boyarsky
Saloon Keepers:
  • Jesse Silverman
  • Tim Holloway
  • Stephan van Hulst
  • Tim Moores
  • Carey Brown
  • Al Hobbs
  • Mikalai Zaikin
  • Piet Souris

All categories for a closed group

Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I want to install JForum for a closed user group which is authenticated by a CAS-Server.

It's better to protect the whole /jforum Directory with .htaccess (and mod_auth_cas) and use the casified jforum
or its better to define all categories on jforum for this special user group?

Experiences what solution is better? Thanx, melx
[originally posted on by melx]
Migrated From
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
For the best security and user experience, you'll probably want to go with the secured directory approach to determine that all files can only be accessed by authorized users.

Only thing I'm not sure of is how the mod_auth_cas and your JVM application engine (e.g. Tomcat) will interact. You might want to consider the Java WebApp CAS filter / authentication code instead.

This should make writing your own JForum SSO implimenation easy. Just use the request object's getPrincipal() method to determine who the user is.

The hard part is the need for jForum to know more about the user than just his/her netId. You will have to figure out what basic information can be set by defaults and/or needs to come from another source. One quick option is to check if this is the first time a user has connected and redirect them to a "please supply this info" form.

Also, it will be complex if you want to try to map CAS groups to Jforum groups for rights. It might be possible with a "CAS-ified" DAO implimentation. I'd suggest just using the normal jForum groups for various forum access control.

E.g., use CAS and CAS groups for the entry level access control, but jForum Groups which map to jForum Users that are based on CAS netIds for finer level access.
[originally posted on by monroe]
Stop it! You're embarassing me! And you are embarrassing this tiny ad!
Building a Better World in your Backyard by Paul Wheaton and Shawn Klassen-Koop
    Bookmark Topic Watch Topic
  • New Topic