Hello everyone !
This one is really interesting.
You may come across a scenario where you do not want to use alfresco's username and password based authentication. Instead you are having some custom property set on user for example PIN number and want to do user's authentication against this PIN OR you do not want to use any authentication subsystem and want to do the user authentication against a database table. Authentication based on custom property is not available out-of-the-box in alfresco.
Here I am providing the details about the implementation approach in case you ever come across such scenario.
Okay ! here it goes !
Consider a scenario, wherein you want to do the authentication based on username and PIN (user's custom property) instead of password and retrive the ticket for further webscript calls.
This is not possible out-of-the-box in alfresco.
In out-of-the-box, you can use login webscript passing username and password to get the ticket.
Also, unless user is authenticated, you can not get user's metadata.
Following is the implementation detail to achieve user authentication without password.
1. Create a custom login webscript, which will take username and PIN as the input parameter.
2. Make sure you have set the <authentication>none</authentication> in the description file of this webcript.
3. Now, in your webscript controller (either java/javascript), first set the authentication to system user and search for the user with the given name. Once user is retrieved, get the PIN number of the user. Clear the system user authentication.
4. Match the retrived PIN with the webscript input parameter PIN. If both matches then here comes the main step. Using AuthenticationUtil.setRunAsUser(username), set the authentication for current user.
5. In order to retrieve the ticket, use following - authenticationService.getCurrentTicket() and populate the model object to return ticket as webscript response.
6. Then next step is to clear the security context using below - AuthenticationUtil.clearCurrentSecurityContext();
By implementing above, you should retrieve the ticket for the given user.
You can also validate the ticket by calling out-of-the-box loginticket webscript to determine that if the ticket belongs to the given user only or not.
Hope this one will be helpful to you.
Thanks,
This one is really interesting.
You may come across a scenario where you do not want to use alfresco's username and password based authentication. Instead you are having some custom property set on user for example PIN number and want to do user's authentication against this PIN OR you do not want to use any authentication subsystem and want to do the user authentication against a database table. Authentication based on custom property is not available out-of-the-box in alfresco.
Here I am providing the details about the implementation approach in case you ever come across such scenario.
Okay ! here it goes !
Consider a scenario, wherein you want to do the authentication based on username and PIN (user's custom property) instead of password and retrive the ticket for further webscript calls.
This is not possible out-of-the-box in alfresco.
In out-of-the-box, you can use login webscript passing username and password to get the ticket.
Also, unless user is authenticated, you can not get user's metadata.
Following is the implementation detail to achieve user authentication without password.
1. Create a custom login webscript, which will take username and PIN as the input parameter.
2. Make sure you have set the <authentication>none</authentication> in the description file of this webcript.
3. Now, in your webscript controller (either java/javascript), first set the authentication to system user and search for the user with the given name. Once user is retrieved, get the PIN number of the user. Clear the system user authentication.
4. Match the retrived PIN with the webscript input parameter PIN. If both matches then here comes the main step. Using AuthenticationUtil.setRunAsUser(username), set the authentication for current user.
5. In order to retrieve the ticket, use following - authenticationService.getCurrentTicket() and populate the model object to return ticket as webscript response.
6. Then next step is to clear the security context using below - AuthenticationUtil.clearCurrentSecurityContext();
By implementing above, you should retrieve the ticket for the given user.
You can also validate the ticket by calling out-of-the-box loginticket webscript to determine that if the ticket belongs to the given user only or not.
Hope this one will be helpful to you.
Thanks,
