Shibboleth and Liferay Part 5: Extending Liferay

This is part 5 of a series of blog posts detailing an approach to using Shibboleth for Web SSO with Liferay.

This is the fun part if you like writing code.

If you've created Ext plugins for Liferay before this will be a piece of cake. If you haven't, check out this post on how to create an Ext plugin project.

So, create your Ext project. I called mine shibauthentication-ext.

Now, within that project, create a folder structure to match Liferay. We're going after the WEB-INF/ext-impl/src/com/liferay/portal/security/auth folder. That'll be in the docroot folder of your project. Now, if you look at the corresponding folder in your Liferay source code you'll notice a series of auto login classes corresponding to the various Web SSO providers Liferay is designed to interact with out of the box. We're going to build one just like them for Shibboleth.

Your new ShibbolethAutoLogin class should be of package com.liferay.portal.security.auth and it should implement AutoLogin.

Here's the code:

public class ShibbolethAutoLogin implements AutoLogin {

private static Log _log = LogFactoryUtil.getLog(ShibbolethAutoLogin.class);

Note the class we're getting the log from. This will be set in the Liferay Admin screen later.

public String[] login(HttpServletRequest req, HttpServletResponse res)

throws AutoLoginException {

String[] credentials = null;

String userEmail = (String) req.getAttribute("[ATTRIBUTE_FROM_IDP]");

_log.info("User Login received:" + userEmail);

The IdP will send the user meta data by a series of header or attribute names. This is the tricky part because depending on how your IdP is configured, it could come in as either Attributes or Headers. Also, this code is assuming you're getting an E-mail address. It could be a username or user ID depending on your IdP. You'll also need to know the name of the attribute itself.

Sometimes people like to iterate through the Enumeration of Attribues or Headers that come in from the HTTP request to see what's coming in. That's fine, but there's a quirk in the servlet running this that will not show the added Attribute from Shibboleth. You need to specify the name in order to access it, which means you have to get your IdP team to tell you what it is or view the Shibboleth Status page to see the list of what's coming in.

if (Validator.isNull(userEmail) || userEmail.length() < 1) {

_log.error("Did not receive user login information from Shibboleth");

_log.error("Data returned from attribute:" + userEmail);

return credentials;

}

try {

credentials = new String[3];

_log.debug("Company:" + PortalUtil.getCompany(req).getCompanyId());

User user = UserLocalServiceUtil.getUserByEmailAddress(PortalUtil

.getCompany(req).getCompanyId(), userEmail);

_log.debug("UserId:" + String.valueOf(user.getUserId()));

credentials[0] = String.valueOf(user.getUserId());

credentials[1] = user.getPassword();

credentials[2] = Boolean.TRUE.toString();

The credentials array is what gets passed to Liferay with the information about the user to be logged in.

_log.info("Logging in user " + userEmail);

return credentials;

} catch (NoSuchUserException e) {

} catch (Exception e) {

_log.error(StackTraceUtil.getStackTrace(e));

throw new AutoLoginException(e);

}

return credentials;

}

}

Again, your situation may be a little different so it's important to understand how this code works so you can adjust it to fit your needs.

Now, there's one more thing that needs to happen before this will work. You have to go into your portal-ext.properties file and tell it to use this module.

#Shibboleth Auto Login Setup

auto.login.hooks=com.liferay.portal.security.auth.ShibbolethAutoLogin, com.liferay.portal.security.auth.RememberMeAutoLogin

auth.pipeline.enable.liferay.check=false

Last, it's nice to get logging from this module so from in Liferay, logged in as an Admin, go to the Control Panel and then go into "Server Administration." Click "Log Levels."

Click "Add Category."

In the box, add com.liferay.portal.security.auth.ShibbolethAutoLogin and click "save."

I'm still working on a hook that would allow the user to select Shibboleth from the Authentication configuration menu just like any other SSO provider. Once it's finished I'll post it here as a final step to make this solution truly integrated.

---

This project incorporates tools whose development was funded in part by the NIH through the NHLBI grant: The Cardiovascular Research Grid (R24HL085343)