Time Tracking application

2007-10-11T21:50:00.000-05:00

I recently launched an OpenSource project TimeTicker.
Check it out http://code.google.com/p/time-ticker/

JOSSO Automatic User Login filter.

2006-11-15T10:59:00.000-05:00

I believe that many of us came across the situation when system need to authorize a user based on some custom criteria.
One of use cases is when user has been referred from one portal to another and suddenly you need to allow such user access to certain parts of you system.
So I been exploring possibilities in search of a simple solution.
Requirements are simple - user has been referred to our system from another portal and need to gain access to the certain area.
First what came to my mind is a sort of a gateway that will check referrer and passed parameters and make a decision if this request indeed valid and user can be granted certain privileges or not. This gateway can use passed or preset credentials and authorize user within JOSSO.
A simple Filter can do this job for us quite well.


import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.IOException;
import java.util.*;

/**
* Simple filter that allow to examine incoming request and authorize user with JOSSO
* based on analisys.

* It is useful for the situation when you need to authorize a user that is came from
* some legacy application or from another webapp or portal.

*
* @author Ivan
* @version 0.1
*/
public class AutoLoginFilter implements Filter {

/** Referer URL */
protected String referer_url;
/** user name */
protected String josso_username;
/** password */
protected String josso_password;
/** backto URL */
protected String josso_back_to;

public void destroy() {
}

public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
ServletRequest myreq = req;
if (req instanceof HttpServletRequest) {
HttpServletRequest httpServletRequest = (HttpServletRequest) req;
if (null==httpServletRequest.getUserPrincipal()
&& httpServletRequest.getRequestURL().toString().matches(".+usernamePasswordLogin.do")
&& null!=httpServletRequest.getHeader("referer")
&& httpServletRequest.getHeader("referer").equalsIgnoreCase(referer_url)
&& httpServletRequest.getMethod().equalsIgnoreCase("GET")) {
if (isValid(httpServletRequest)) {
  // create new request wrapper
  GuestLoginServletRequestWrapper wrapper = new GuestLoginServletRequestWrapper(httpServletRequest);
  // add additional parameters
  wrapper.parametersMap.put("josso_cmd", "login");
  wrapper.parametersMap.put("josso_username", josso_username);
  wrapper.parametersMap.put("josso_password", josso_password);
  wrapper.parametersMap.put("josso_back_to", josso_back_to);
  // switch request to the wrapper
  myreq = wrapper;
}
}
}
chain.doFilter(myreq, resp);
}

public void init(FilterConfig config) throws ServletException {
referer_url = config.getInitParameter("referer_url");
if (null== referer_url || referer_url.trim().length()==0) config.getServletContext().log("ERROR: Initial parameter {referer_url} is not defined !");
josso_username = config.getInitParameter("josso_username");
if (null== josso_username || josso_username.trim().length()==0) config.getServletContext().log("ERROR: Initial parameter {josso_username) is not defined !");
josso_password = config.getInitParameter("josso_password");
if (null== josso_password || josso_password.trim().length()==0) config.getServletContext().log("ERROR: Initial parameter {josso_password) is not defined !");
josso_back_to = config.getInitParameter("josso_back_to");
if (null== josso_back_to || josso_back_to.trim().length()==0) config.getServletContext().log("ERROR: Initial parameter {josso_back_to) is not defined !");
}

/**
* Does actual request validation.
* Here we will perform more rigorous testing.
*
* @param request request
* @return true if request is valid and user can be logged in, false otherwise.
*/
private boolean isValid(HttpServletRequest request) {
return true;
}

/**
* Simple request wrapper.
* Allow to add josso parameters to the request
*/
class GuestLoginServletRequestWrapper extends HttpServletRequestWrapper {
protected Map parametersMap;

public GuestLoginServletRequestWrapper(HttpServletRequest httpServletRequest) {
super(httpServletRequest);
// create custom parameter map
parametersMap = new HashMap(httpServletRequest.getParameterMap());
}

public String getParameter(String s) {
Object value = parametersMap.get(s);
if (value instanceof String[]) {
return ((String[]) value)[0];
}
return (String) value;
}

public Enumeration getParameterNames() {
return new Hashtable(parametersMap).keys();
}

public String[] getParameterValues(String s) {
Object value = parametersMap.get(s);
if (value instanceof String) {
return new String[]{(String)value};
}
return (String[])value;
}

public Map getParameterMap() {
return parametersMap;
}

}

}

Now we should configure this filter:

<filter>
<filter-name>AutoLoginFilter</filter-name>
<filter-class>AutoLoginFilter</filter-class>
<init-param>
<param-name>referer_url</param-name>
<param-value>http://myserver.com/referer.html</param-value>
</init-param>
<init-param>
<param-name>josso_username</param-name>
<param-value>guest</param-value>
</init-param>
<init-param>
<param-name>josso_password</param-name>
<param-value>guest</param-value>
</init-param>
<init-param>
<param-name>josso_back_to</param-name>
<param-value>/guest</param-value>
</init-param>
</filter>

And map it:

<filter-mapping>
<filter-name>AutoLoginFilter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>

Here you should be careful, this filter should be configured in JOSSO web application and should be mapped to login.do action.
Please use extreme caution with this approach, since referrer url is very easy to fake. You should not rely only on referrer url, use some other meaningful verification algorithm. For instance you can pass encrypted user information with expiration time, etc.

Now you can customize implementation with your own isValid() method.

Just for starters ...

2006-09-28T13:35:00.000-05:00

Anything what we do has the beginning and has the end.
And any choice that we make along this journey bring us one step closer to the end.
So let's do this step and mark the beginning of this blog with a hope that the end is still far away.

Loud Thoughts

Time Tracking application

JOSSO Automatic User Login filter.

Just for starters ...