alfresco share check authentication

0
votes

How does share know that user is not connected (and redirect him to login page)?

Even if a user is connected i'd like to check if he has some permission and redirect him to login page if not. So i'd like to know how Share manage authenticated user from session.

Can i use a filter, or listener or servlet or any other mecanism to intercept ALL url on share and check if connected user has require permission.

I'm using alfresco 5.0.d.

Thank you in advance for your help.

1
authenticationsharealfrescodisconnected

1 Answers

2
votes

Depending on the authentication method being used and which services of Share are accessed (pages, proxy servlet or web scripts), there are multiple places where checks against the current user are made:

  • class SSOAuthenticationFilter - a servlet filter handling what it says in its name, Single Sign-On (SSO), e.g. Kerberos, NTLM or CAS / external authentication
  • class PageView - part of the Surf framework that checks if the current user has the required privileges for the current page (limited differentiation of guest, user, admin as defined by the page XML definition)
  • class SlingshotPageView - an enhancement / specialisation of the PageView class
  • class EndpointProxyServlet - handling authentication for any backend ReST API calls proxied via Share
  • classes PresentationContainer and instances of Authenticator interface - handling direct calls to any web scripts outside of normal page rendition cycles

Technically you can use a filter to intercept all servlet invocations on Share, but I it is not ideal from a maintenance point of view (web.xml is not easily extensible and overriden on upgrades). If all you are interested in are page rendition requests, you can use Surf extension modules to inject post-processing code that is able to generate redirection responses if user permissions are lacking. Via the root-scoped "status" object you can send the HTTP redirect responses and define a target location.