Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.
Difference between revisions of "CDO/Net4j Authentication"
m (Use CDO Net4J Authentification moved to CDO/Net4j Authentication) |
|||
Line 1: | Line 1: | ||
− | In most enterprise application a user has to authenticate against the webserver, CDO application are not different in this aspect. So naturally CDO and | + | In most enterprise application a user has to authenticate against the webserver, [[CDO]] application are not different in this aspect. So naturally CDO and [[Net4j]] provide a possibility to authenticate. The source code shown in this section is part of a big [http://tom-eclipse-dev.blogspot.com/2008/09/exploring-new-technologies-part-of.html example project] exploiting [[RCP]] + [[EMF]] + [[Databinding]] features. |
==Server== | ==Server== | ||
Line 6: | Line 6: | ||
If you are configuring your server using cdo-server.xml and providing authentication against a simple text file is as simple as uncommenting the following lines: | If you are configuring your server using cdo-server.xml and providing authentication against a simple text file is as simple as uncommenting the following lines: | ||
− | + | <source lang="xml"> | |
− | + | <acceptor type="tcp" listenAddr="0.0.0.0" port="2036"> | |
− | + | <negotiator type="challenge" description="/tmp/users.db"/> | |
+ | </acceptor> | ||
+ | </source> | ||
The value is the path to the user/password-File the authentication is done against. In this simple case the file is a Property-File and looks like this: | The value is the path to the user/password-File the authentication is done against. In this simple case the file is a Property-File and looks like this: | ||
tom=myverysecretpassword | tom=myverysecretpassword | ||
+ | |||
+ | ===CDO 3.0=== | ||
+ | Note that in CDO 3.0 we have an additional, superior athentication | ||
+ | mechanism per CDOSession (not only on Net4j IConnector level). Search | ||
+ | this newgroup for "authen..." if you need hints. | ||
+ | |||
+ | Using the IConnector based authentication is not the recommended way anymore. The new CDOSession based approach envolves settingan IUserManager into the ISessionManager of the IRepository. Unfortunately (IIRC) you currently need to use internal code to do this. I'll change this if you filea bugzilla. On the client side you need to set an ICredentialsProvider into the CDOAuthenticator of the CDOSessionConfiguration. Bothe the IUserManager and the ICredentialsProvider can be the same implementations that you used with the Net4j based approach before. | ||
+ | |||
+ | CDO 3.0 does not have permission based security / Access Control List. But you might be able to implement your own using custom <tt>IRepository.ReadAccessHandler</tt> and <tt>IRepository.WriteAccessHandler</tt>. | ||
+ | |||
+ | ===CDO 4.0=== | ||
+ | |||
+ | See [https://bugs.eclipse.org/bugs/show_bug.cgi?id=277075 Bugzilla 277075: Access Control system in CDO]. | ||
==Client== | ==Client== | ||
===IManagedContainer-Setup=== | ===IManagedContainer-Setup=== | ||
The standard code to retrieve the session in an IManagedContainer looks like this: | The standard code to retrieve the session in an IManagedContainer looks like this: | ||
− | + | <source lang="java"> | |
− | + | public CDOSessionProvider { | |
− | + | public CDOSession openSession(String id, String host, String port) { | |
− | + | IConnector connector = TCPUtil.getConnector(IPluginContainer.INSTANCE, host + ":" + port ); | |
− | + | CDOSessionConfiguration configuration = CDOUtil.createSessionConfiguration(); | |
− | + | configuration.setConnector(connector); | |
− | + | configuration.setRepositoryName(id); | |
− | + | ||
− | + | return configuration.openSession(); | |
} | } | ||
+ | } | ||
+ | </source> | ||
And use it in our code like this: | And use it in our code like this: | ||
− | + | <source lang="java"> | |
− | + | CDOSessionProvider pv = new CDOSessionProvider(); | |
+ | pv.openSession("MyRep","localhost","2036"); | ||
+ | </source> | ||
The authentication negotiation has to be configured before the connection to the server is establish which happens here in the TCPUtil.getConnector()-method. So we somehow have to configure the system in between the call. | The authentication negotiation has to be configured before the connection to the server is establish which happens here in the TCPUtil.getConnector()-method. So we somehow have to configure the system in between the call. | ||
Line 37: | Line 56: | ||
The only thing we need to do is to register a PostProcessor for the IPluginContainer.INSTANCE. This has to done only once for a IManagedContainer so the best part is a static block in the CDOSessionProvider. | The only thing we need to do is to register a PostProcessor for the IPluginContainer.INSTANCE. This has to done only once for a IManagedContainer so the best part is a static block in the CDOSessionProvider. | ||
− | + | <source lang="java"> | |
− | + | static { | |
− | + | PasswordCredentialsProvider credentialsProvider = new PasswordCredentialsProvider("tom", "blabla"); | |
− | + | IPluginContainer.INSTANCE.addPostProcessor(new ConnectorCredentialsInjector("localhost:2036",credentialsProvider)); | |
+ | } | ||
+ | </source> | ||
Now your client authenticates against your CDO-Server and you'll receive a "org.eclipse.net4j.connector.ConnectorException" if you try to access session informations. | Now your client authenticates against your CDO-Server and you'll receive a "org.eclipse.net4j.connector.ConnectorException" if you try to access session informations. | ||
+ | |||
+ | |||
+ | ==Resources== | ||
+ | # [https://bugs.eclipse.org/bugs/show_bug.cgi?id=277075 Bugzilla 277075: Access Control system in CDO] | ||
+ | # [http://www.eclipse.org/forums/index.php?t=msg&th=164519 Authentication OK, but what about authorization] | ||
+ | # [http://dev.eclipse.org/newslists/news.eclipse.tools.emf/msg43230.html CDO authentication ] | ||
+ | |||
+ | [[Category:CDO]] [[Category:Net4j]] [[Category:EMF]] [[Category:Authentication]] [[Category:Security]] [[Category:Authorization]] |
Revision as of 10:29, 30 December 2010
In most enterprise application a user has to authenticate against the webserver, CDO application are not different in this aspect. So naturally CDO and Net4j provide a possibility to authenticate. The source code shown in this section is part of a big example project exploiting RCP + EMF + Databinding features.
Contents
Server
Server configuration with cdo-server.xml
Property-File based Authentication
If you are configuring your server using cdo-server.xml and providing authentication against a simple text file is as simple as uncommenting the following lines:
<acceptor type="tcp" listenAddr="0.0.0.0" port="2036"> <negotiator type="challenge" description="/tmp/users.db"/> </acceptor>
The value is the path to the user/password-File the authentication is done against. In this simple case the file is a Property-File and looks like this:
tom=myverysecretpassword
CDO 3.0
Note that in CDO 3.0 we have an additional, superior athentication mechanism per CDOSession (not only on Net4j IConnector level). Search this newgroup for "authen..." if you need hints.
Using the IConnector based authentication is not the recommended way anymore. The new CDOSession based approach envolves settingan IUserManager into the ISessionManager of the IRepository. Unfortunately (IIRC) you currently need to use internal code to do this. I'll change this if you filea bugzilla. On the client side you need to set an ICredentialsProvider into the CDOAuthenticator of the CDOSessionConfiguration. Bothe the IUserManager and the ICredentialsProvider can be the same implementations that you used with the Net4j based approach before.
CDO 3.0 does not have permission based security / Access Control List. But you might be able to implement your own using custom IRepository.ReadAccessHandler and IRepository.WriteAccessHandler.
CDO 4.0
See Bugzilla 277075: Access Control system in CDO.
Client
IManagedContainer-Setup
The standard code to retrieve the session in an IManagedContainer looks like this:
public CDOSessionProvider { public CDOSession openSession(String id, String host, String port) { IConnector connector = TCPUtil.getConnector(IPluginContainer.INSTANCE, host + ":" + port ); CDOSessionConfiguration configuration = CDOUtil.createSessionConfiguration(); configuration.setConnector(connector); configuration.setRepositoryName(id); return configuration.openSession(); } }
And use it in our code like this:
CDOSessionProvider pv = new CDOSessionProvider(); pv.openSession("MyRep","localhost","2036");
The authentication negotiation has to be configured before the connection to the server is establish which happens here in the TCPUtil.getConnector()-method. So we somehow have to configure the system in between the call.
The only thing we need to do is to register a PostProcessor for the IPluginContainer.INSTANCE. This has to done only once for a IManagedContainer so the best part is a static block in the CDOSessionProvider.
static { PasswordCredentialsProvider credentialsProvider = new PasswordCredentialsProvider("tom", "blabla"); IPluginContainer.INSTANCE.addPostProcessor(new ConnectorCredentialsInjector("localhost:2036",credentialsProvider)); }
Now your client authenticates against your CDO-Server and you'll receive a "org.eclipse.net4j.connector.ConnectorException" if you try to access session informations.