Re: [Ala-portal] Cas Authentication - Hubs-Webapp - ALA-Portal

newer
biocache-service - not deployed

Re: [Ala-portal] Cas Authentication - Hubs-Webapp

older
Cas Authentication - Hubs-Webapp

Suelane G. Fontes

17 Apr 2014 17 Apr '14

21:45

Attachments:

Hubs_IMage_CAS.rar (application/x-rar-compressed — 93.8 KB)
attachment.html (text/html — 35.2 KB)

Show replies by date

Nick.Dosremedios＠csiro.au

22 Apr 22 Apr

04:05

New subject: [Ala-portal] Cas Authentication - Hubs-Webapp

Hi Suelane,

There are many variables to getting CAS working its hard to tell what the problem is from your screen shots alone. One thing I can suggest is that you compare the web.xml file you are using with hubs-webapp to the generated web.xml in the Collectory grails app and try to work out what CAS settings are different that might be causing your issue.

Also does your casServerName and loginUrl settings both start with “https”? Have you set the correct “contextPath” value (/hubs-webapp)?

Regards Nick -- Nick dos Remedios Atlas of Living Australia http://www.ala.org.au/

From: "Suelane G. Fontes" <suelane@uol.com.brmailto:suelane@uol.com.br> Date: Friday, 18 April 2014 7:45 am To: Nick <nick.dosremedios@csiro.aumailto:nick.dosremedios@csiro.au> Cc: "ala-portal@lists.gbif.orgmailto:ala-portal@lists.gbif.org" <ala-portal@lists.gbif.orgmailto:ala-portal@lists.gbif.org>, "support@ala.org.aumailto:support@ala.org.au" <support@ala.org.aumailto:support@ala.org.au> Subject: Re: Cas Authentication - Hubs-Webapp

Hi Nick, I did what you suggested and we integrated ala-hubs with jasig-cas. Now, The Log in button (see image attached) redirects the hubs-webapp page to jasig-cas authentication page. nevertheless, The search button in the same page can be accessed even if the user do not perform the log in operation. We would like to know how to enforce this authentication before the user has access to perform a search in ala-hubs. Thanks! Regards. ________________________________

De: Nick.Dosremedios@csiro.aumailto:Nick.Dosremedios@csiro.au Enviada: Quinta-feira, 17 de Abril de 2014 00:16 Para: suelane@uol.com.brmailto:suelane@uol.com.br,ala-portal@lists.gbif.orgmailto:ala-portal@lists.gbif.org,support@ala.org.aumailto:support@ala.org.au Assunto: Cas Authentication - Hubs-Webapp

Hi Suelane,

I’d suggest you try these 2 minor changes to the web.xml file:

1. Change the serverName section - from:

serverName

http://143.107.102.247:8080/hubs-webapp/

to:

serverName

http://143.107.102.247:8080 http://143.107.102.247:8080/hubs-webapp/

contextpath

<param-value>/hubs-webappparam-value>

2. Change the server uriFilterPattern to:

uriFilterPattern

I also note you are missing a few filter settings that we use in our version of hub-webapp. I’ve attached a sample “web.xml” file that you should look at, to check against, if the above changes do not work.

Regards

Nick -- Nick dos Remedios Atlas of Living Australia http://www.ala.org.au/

From: "Suelane G. Fontes" <suelane@uol.com.br../undefined/compose?to=suelane@uol.com.br> Date: Thursday, 17 April 2014 5:22 am To: "ala-portal@lists.gbif.org../undefined/compose?to=ala-portal@lists.gbif.org" <ala-portal@lists.gbif.org../undefined/compose?to=ala-portal@lists.gbif.org>, "support@ala.org.au../undefined/compose?to=support@ala.org.au" <support@ala.org.au../undefined/compose?to=support@ala.org.au> Subject: Cas Authentication - Hubs-Webapp

Hi all,

We need to enforce the users to authenticate before have access to ALA-PORTAL..

We found a authentication enforcement in ala-collectory module, when the user tries to access the “admin” page, using JASIG Cas server.

We performed the following steps to test the authentication:

We deployed an instance of JASIG Cas server (http://www.jasig.org/cas) in server: http://143.107.102.247:65002/cas-server-webapp-3.4.12.1 http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Flogin&sa=D&sntz=1&usg=AFQjCNH3vG0Ka4sLQzPoHwActqlfWHpv0g.

We configured the ala-collectoy to enforce authentication in file: ala-collectory-0.1.0/ala-collectory/grails-app/conf/config.groovy , using the following code:

/******************************************************************************\

* SECURITY ******************************************************************************/ if (!security.cas.uriFilterPattern) { security.cas.uriFilterPattern = "/admin.*,/collection.*,/institution.*,/contact.*,/reports.*," + "/providerCode.*,/providerMap.*,/dataProvider.*,/dataResource.*,/dataHub.*,/manage/.*" } if (!security.cas.loginUrl) { security.cas.loginUrl = "http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/login http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Flogin&sa=D&sntz=1&usg=AFQjCNH3vG0Ka4sLQzPoHwActqlfWHpv0g" } if (!security.cas.logoutUrl) { security.cas.logoutUrl = "http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/logout http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Flogout&sa=D&sntz=1&usg=AFQjCNHehugoZZSv8DVSUX-3YHdqFzEY6A" } if (!security.apikey.serviceUrl) { security.apikey.serviceUrl = "http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/apikey/ws/check?apik...http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Fapikey%2Fws%2Fcheck%3Fapikey%3D&sa=D&sntz=1&usg=AFQjCNGqC95eT2XCTZg-6Vh_63edJG7VyA" } if(!security.cas.appServerName){ security.cas.appServerName = "http://143.107.102.247:65002 http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002&sa=D&sntz=1&usg=AFQjCNH5k83H3rCfxq9G6357RoRk2vu4yA" } if(!security.cas.casServerName){ security.cas.casServerName = "http://143.107.102.247:8080 http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A8080&sa=D&sntz=1&usg=AFQjCNHNS4B3AfRd4bnMHSoxOVwzDisprw" } if(!security.cas.uriExclusionFilterPattern){ security.cas.uriExclusionFilterPattern = '/images.*,/css.*,/js.*,/less.*' } if(!security.cas.authenticateOnlyIfLoggedInPattern){ security.cas.authenticateOnlyIfLoggedInPattern = "" // pattern for pages that can optionally display info about the logged-in user } if(!security.cas.casServerUrlPrefix){ security.cas.casServerUrlPrefix = 'http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/'http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2F%27&sa=D&sntz=1&usg=AFQjCNGRqmrqERZlp6oeLUpeJlC8LhUNqA } if(!security.cas.bypass){ security.cas.bypass = true } if(!disableAlertLinks){ disableAlertLinks = false }

if(!disableOverviewMap){ disableOverviewMap = false }

then, we tried to access the admin section of ala-collectory browser. Which worked perfectly: the ala-collectory redirected the call to CAS server login page, and after the user provides correct username and password the user is redirected again to admin-section of ala-collectory.

We would like to enforce the same authentication in ala-hubs, as shown in the figure adapted from wiki (attached).

We followed the steps in wiki:

https://code.google.com/p/ala-bie/wiki/Authentication#Example_web.xml_config... .

In pom.xml of hubs-webapp directory we included the following code:

org.jasig.cas

cas-client-core

3.1.10

jar

compile

au.org.ala

ala-cas-client

2.0-SNAPSHOT

jar

compile

javax.servlet

servlet-api

In web.xml file we included the following code:

serverName

http://143.107.102.247:8080/hubs-webapp/

casServerName

http://143.107.102.247:8080 http://143.107.102.247:8080/

uriFilterPattern

/, /occurrences/\d+, /occurrences/search, /explore/your-area

CAS Authentication Filter

au.org.ala.cas.client.UriFilter

filterClass

org.jasig.cas.client.authentication.AuthenticationFilter

casServerLoginUrl

http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/login

gateway

true

CAS Validation Filter

au.org.ala.cas.client.UriFilter

filterClass

org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter

casServerUrlPrefix

http://143.107.102.247:65002/cas-server-webapp-3.4.12.1

CAS HttpServletRequest Wrapper Filter

au.org.ala.cas.client.UriFilter

filterClass

au.org.ala.cas.client.AlaHttpServletRequestWrapperFilter

CAS Authentication Filter

CAS Validation Filter

CAS HttpServletRequest Wrapper Filter

then we deployed the hubs-webapp.war in tomcat server. Unfornatelly, when the user access ala-webapp no autentication is asked by ala-portal.

What we need to do in order to enforce all the users to autenticate in jasig cas before have access to hubs-webapp?

Regards,

Suelane/Silvio

sama

24 Apr 24 Apr

07:03

New subject: [Ala-portal] issues with the Collectory module.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

My name is Santiago Martínez de la Riva. I'm member of node of Gbif Spain. We have installed the data portal of ALA and we have a problem with the collectory module.

We can't create new collections or institutions. When we try to add collections or institutions, the Portal shows the next message:

http://193.146.75.144:8080/collectory/dataResource/uploadGBIFFile

Could be an error caused by problems with permissions in the directory /data/collectory/upload? Because It seems that the server doesn't create the temporal file.

- -------------------------------------- An unexpected error has occurred.

If this is the first time this page has appeared, try the refresh button in your browser.

If this fails, try to return to the home page and start again.

If this page is still displayed, please report the incident to ALA support. Click here to email ALA support.

The following is useful information that helps us discover what has happened. Please copy it into emails requesting support.

You might also like to expand the more detailed information by clicking on 'Show stack trace' and copying that text to us as well.

Thanks for your patience. Error 500: Executing action [uploadGBIFFile] of controller [au.org.ala.collectory.DataResourceController] caused exception: Runtime error executing action Servlet: grails URI: /collectory/grails/dataResource/uploadGBIFFile.dispatch Exception Message: /data/collectory/upload/tmp/1398257201760 (No such file or directory) Caused by: /data/collectory/upload/tmp/1398257201760 (No such file or directory) Class: ProviderGroupController At Line: [522] Code Snippet: Show stack trace Stack Trace

java.io.FileNotFoundException: /data/collectory/upload/tmp/1398257201760 (No such file or directory)

at java.io.FileOutputStream.<init>(FileOutputStream.java:221)

at java.io.FileOutputStream.<init>(FileOutputStream.java:171)

at org.apache.commons.fileupload.disk.DiskFileItem.write(DiskFileItem.java:449)

at au.org.ala.collectory.GbifService.createGBIFResourceFromMultipart(GbifService.groovy:211)

at au.org.ala.collectory.ProviderGroupController$_closure22.doCall(ProviderGroupController.groovy:522)

at grails.plugin.cache.web.filter.PageFragmentCachingFilter.doFilter(PageFragmentCachingFilter.java:195)

- -----------------------------

We have realized too that in the demo portal of ala shows another error which is related to updated process of one resource. When we try to modify the information of one resource. For example, for this resource:

http://ala-ono.it.csiro.au/collectory/dataResource/show/dr172

If we try to modify some field: the name, the url.., and we try to update the resource, the portal shows the next error message:

- -------------------

An unexpected error has occurred.

If this is the first time this page has appeared, try the refresh button in your browser.

If this fails, try to return to the home page and start again.

If this page is still displayed, please report the incident to ALA support. Click here to email ALA support.

The following is useful information that helps us discover what has happened. Please copy it into emails requesting support.

You might also like to expand the more detailed information by clicking on 'Show stack trace' and copying that text to us as well.

Thanks for your patience. Error 500: Executing action [updateBase] of controller [au.org.ala.collectory.DataResourceController] caused exception: Runtime error executing action Servlet: grails URI: /collectory/grails/dataResource/updateBase.dispatch Exception Message: No signature of method: static au.org.ala.collectory.BaseCommand.get() is applicable for argument types: (java.lang.String) values: [173] Possible solutions: getAt(java.lang.String), getId(), grep(), grep(java.lang.Object), wait(), any() Caused by: No signature of method: static au.org.ala.collectory.BaseCommand.get() is applicable for argument types: (java.lang.String) values: [173] Possible solutions: getAt(java.lang.String), getId(), grep(), grep(java.lang.Object), wait(), any() Class: Unknown At Line: [-1] Code Snippet: Show stack trace Stack Trace

groovy.lang.MissingMethodException: No signature of method: static au.org.ala.collectory.BaseCommand.get() is applicable for argument types: (java.lang.String) values: [173] Possible solutions: getAt(java.lang.String), getId(), grep(), grep(java.lang.Object), wait(), any()

at grails.plugin.cache.web.filter.PageFragmentCachingFilter.doFilter(PageFragmentCachingFilter.java:195)

at grails.plugin.cache.web.filter.AbstractFilter.doFilter(AbstractFilter.java:63)

at au.org.ala.cas.client.UriFilter.doFilter(UriFilter.java:200)

- -------

Kind regards. Santi. - ------------------------------------------------------------ Santiago Martínez de la Riva Vivanco GBIF.ES, Unidad de Coordinación Real Jardín Botánico CSIC Plaza de Murillo, 2 28014 Madrid, Spain Tel: +34 91 4293917 x 273 - sama@gbif.es - www.gbif.es - https://twitter.com/smr_sama

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTWLdbAAoJEMV2/tf+QnQDHAEH/1plB+89+ZP8C3hUJ+j4Gr2K 7Cw5pZfNUprVXbATNKfDZYvh3V6bFApEyBGBxGsecEGmWTMSCDezrqa7bjVrHw8U IX8/THLC1MlwSiiAIW/vRpLmAkWulXnb/WGZnhqUjuEnvljOAwAZp0Pjaa7WEpvW 72yNYFQcJVtdgHVqFXZd0/GNvPW6fYsfznvQkloXO/rLL6p5tqYmBIMH8FA4ftSp plTtIArcEvdlQgoUFFybdLDLSu9juoEJLlC7fs4CRNg1Z77yPOP2YZP9mJx4cSvh zG+hFbw3EDGm38L9jv5pIGhbgAsZTIdnJwa/cKf3cSjrEbfHGYw9JedA3kkZWPQ= =K44p -----END PGP SIGNATURE-----

David.Martin＠csiro.au

10:24

New subject: [Ala-portal] issues with the Collectory module.

Thanks for posting Santiago.

There is a new build of the collectory that should fix the problems you mentioned with the manual GBIF file upload and editing the data resource:

http://maven.ala.org.au/repository/au/org/ala/collectory/1.0/collectory-1.0....

This is now deployed on the demo server (http://ala-demo.gbif.org).

Hope this helps.

Dave Martin ALA

________________________________________ From: ala-portal-bounces@lists.gbif.org [ala-portal-bounces@lists.gbif.org] on behalf of sama [sama@gbif.es] Sent: 24 April 2014 17:03 To: ala-portal@lists.gbif.org Subject: Re: [Ala-portal] issues with the Collectory module.