Authentication methods - Revision history

Mollik: /* Database based */

2019-09-24T09:22:45Z

‎Database based

Mollik: /* Authentication Methods */

2019-09-24T09:21:50Z

‎Authentication Methods

Mollik: /* Authentication Methods */

2019-09-24T09:09:00Z

‎Authentication Methods

Mollik: /* Authentication Methods */

2019-09-24T09:06:47Z

‎Authentication Methods

Mollik: Created page with "=Authentication Methods= OS.bee offers 2 ways to manage user authentication: database based and LDAP based authentication. Both methods use the user_account table to contro..."

2019-09-24T08:59:01Z

Created page with "=Authentication Methods= OS.bee offers 2 ways to manage user authentication: database based and LDAP based authentication. Both methods use the user_account table to contro..."

New page

=Authentication Methods=

OS.bee offers 2 ways to manage user authentication: database based and LDAP based authentication.

Both methods use the user_account table to control the users, manage access rights and store user settings.

The difference is in the way, the users password is checked (and stored).

For the database based method, the password is stored in the user_account in the "shiro" encrypted way. For the LDAP based method, no password is stored in the database. The user is authenticated against the LDAP server, which needs to be accessable during runtime of course.

Both methods can be mixed, the database based method is always activated.

LDAP needs to be configured in the preferences file or via the perferences dialog:

{{
shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/contextFactoryUrl=ldap\://ldap.company.com\:389
shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/userDnTemplate=CN\={0},CN\=Users,DC\=company,DC\=com
}}

@@ Line 12: / Line 12: @@
 The username, email and password are stored in the userAccount entity. The password is encrypted in the "shiro" way.
 The existence of an activated, non locked entry with the username in the userAccount entity and the match of the entered and the stored password leads to a successful login to the application.
 == LDAP based ==

@@ Line 6: / Line 6: @@
 The difference is in the way, the users password is checked and stored.
 Both methods can be mixed, the database based method is always activated. This allows to manage users based on an LDAP or Active directory as well as application specific users.
-'''LDAP''' needs to be configured in the preferences file or via the perferences dialog:
+The '''LDAP''' settings need to be configured in the preferences file or via the perferences dialog:
 <code>shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/contextFactoryUrl=ldap\://ldap.company.com\:389
@@ Line 19: / Line 25: @@
 shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/userDnTemplate=CN\={0},CN\=Users,DC\=company,DC\=com</code>
-To facilitate the user management, the user record for a LDAP based user is created automatically when the user tries to login the first time with the correct password. The Admin needs to enable the user after he assigned either a role or a user group (with an assigned role) to the user. This has to be done through the user adminstration perspective in the application.
+The cn and mail LDAP attributes are used for the username and email entries in the userAccount. The password is '''not''' stored in the database.
 Another way might be to add a bpm process which automates the user enablement based on some criteria, eg. the users email domain leads to a template user for the domain and then, the user will have the settings from the template user.

@@ Line 9: / Line 9: @@
 For the database based method, the password is stored in the user_account in the "shiro" encrypted way. For the LDAP based method, no password is stored in the database. The user is authenticated against the LDAP server, which needs to be accessable during runtime of course.
-Both methods can be mixed, the database based method is always activated.
+Both methods can be mixed, the database based method is always activated. This allows to manage users based on an LDAP or Active directory as well as application specific users.
 <code>shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/contextFactoryUrl=ldap\://ldap.company.com\:389
 shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/userDnTemplate=CN\={0},CN\=Users,DC\=company,DC\=com</code>
 To facilitate the user management, the user record for a LDAP based user is created automatically when the user tries to login the first time with the correct password. The Admin needs to enable the user after he assigned either a role or a user group (with an assigned role) to the user. This has to be done through the user adminstration perspective in the application.
 Another way might be to add a bpm process which automates the user enablement based on some criteria, eg. the users email domain leads to a template user for the domain and then, the user will have the settings from the template user.

@@ Line 1: / Line 1: @@
 =Authentication Methods=
-OS.bee offers 2 ways to manage user authentication:  database based and LDAP based authentication.
+OS.bee offers 2 ways to manage user authentication:  '''database based''' and '''LDAP based''' authentication.
-Both methods use the user_account table to control the users, manage access rights and store user settings.
+Both methods use the userAccount and userGroup entities to control the users, manage access rights and store user settings.
-The difference is in the way, the users password is checked (and stored).
+The difference is in the way, the users password is checked and stored.
 For the database based method, the password is stored in the user_account in the "shiro" encrypted way. For the LDAP based method, no password is stored in the database. The user is authenticated against the LDAP server, which needs to be accessable during runtime of course.
@@ Line 11: / Line 11: @@
 Both methods can be mixed, the database based method is always activated.
-LDAP needs to be configured in the preferences file or via the perferences dialog:
+'''LDAP''' needs to be configured in the preferences file or via the perferences dialog:
-{{
-shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/contextFactoryUrl=ldap\://ldap.company.com\:389
+<code>shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/contextFactoryUrl=ldap\://ldap.company.com\:389
 shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/userDnTemplate=CN\={0},CN\=Users,DC\=company,DC\=com
-}}
+shiro/org.eclipse.osbp.authentication.shiro.extensions.LDAPRealm/userDnTemplate=CN\={0},CN\=Users,DC\=company,DC\=com</code>