|
|
OPS User Guide
|
Authentication1. IntroductionMost Web applications require some sort of authentication, either just to access an "administrative" section, or for the whole application. OPS Web applications use the standard authentication mechanism provided by your J2EE application server. This section provides an overview of the standard J2EE authentication mechanism. 2. Restricting Access using web.xmlAccess control is provided by adding three sections to the
3. Mapping Roles to Users
In the
Usually the process is straightforward. For example, with Tomcat using the memory
realm, you can declare the users and their role in
<tomcat-users> <user name="root" password="olleh" roles="administrator"/> <user name="jdoh" password="olleh" roles="administrator"/> </tomcat-users>
For more information on how to setup users and assign roles to users, see your application server documentation. Links are provided below for Tomcat and WebLogic. 4. Accessing Security Information From the ApplicationThe Request Security processor extracts information about the currently logged user from the client request. Its configuration contains a list of roles the application developer is interested in. Only those roles will be listed in the processor's output if the role is present. For instance, the output of the Request Security processor could be:
<request-security> <auth-type>FORM</auth-type> <secure>true</secure> <remote-user>scott</remote-user> <role>user</role> </request-security>
The
<p:processor name="oxf:request-security" xmlns:p="http://www.orbeon.com/oxf/pipeline"> <p:input name="config"> <config> <role>user</role> <role>admin</role> </config> </p:input> <p:output name="data" id="request-security"/> </p:processor>
5. LogoutIn order to log the current user out, the Session Invalidator processor must be used:
<p:processor name="oxf:session-invalidator" xmlns:p="http://www.orbeon.com/oxf/pipeline"/>
The Session Invalidator processor does not take any configuration or other inputs and outputs. It must be included in a pipeline or branch of pipeline executed when the action of logging out the user is requested. |