Quantcast
Channel: Experiencing Adobe Experience Manager (AEM, CQ)
Viewing all articles
Browse latest Browse all 525
↧

AEM 65 sp10 - Simple Token Based Authentication

October 5, 2021, 3:44 pm
$
0
0

Goal

AEM Cloud Services provides OAuth 2 based authentication documented here. For OAuth 2 based authentication in AEM 65 check this post. The solution discussed here is a more simple non standard token based authentication....

Demo | Package Install | GitHub


User for Token Auth


Configure Token Key

                    http://localhost:4502/apps/eaem-simple-token-based-auth/extensions/simple-token-auth/token-config.html/conf/global/settings/dam/experience-aem


Access AEM using Token



Solution

1) Create an overlay for the tools nav item /apps/cq/core/content/nav/tools/experience-aem/experience-aem-config

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
    jcr:description="Token Configuration for Simple Readonly Auth"
    jcr:primaryType="nt:unstructured"
    jcr:title="Token Configuration"
    href="/apps/eaem-simple-token-based-auth/extensions/simple-token-auth/token-config.html/conf/global/settings/dam/experience-aem"
    icon="asset"
    id="experience-aem-config"
    size="XL"/>


2) Create the Token Auth Config page /apps/eaem-simple-token-based-auth/extensions/simple-token-auth/token-config accessed using http://localhost:4502/apps/eaem-simple-token-based-auth/extensions/simple-token-auth/token-config.html/conf/global/settings/dam/experience-aem

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:granite="http://www.adobe.com/jcr/granite/1.0" xmlns:cq="http://www.day.com/jcr/cq/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
    jcr:primaryType="cq:Page">
<jcr:content
        jcr:mixinTypes="[sling:VanityPath]"
        jcr:primaryType="nt:unstructured"
        jcr:title="Token Configuration"
        sling:resourceType="granite/ui/components/coral/foundation/page">
<head jcr:primaryType="nt:unstructured">
<favicon
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/page/favicon"/>
<viewport
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/admin/page/viewport"/>
<clientlibs
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/includeclientlibs"
                categories="[coralui3,granite.ui.coral.foundation,granite.ui.shell,dam.gui.admin.coral]"/>
</head>
<body
            jcr:primaryType="nt:unstructured"
            sling:resourceType="granite/ui/components/coral/foundation/page/body">
<items jcr:primaryType="nt:unstructured">
<content
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="granite/ui/components/coral/foundation/form"
                    action="/conf/global/settings/dam/experience-aem"
                    foundationForm="{Boolean}true"
                    maximized="{Boolean}true"
                    method="post"
                    novalidate="{Boolean}true"
                    style="vertical">
<successresponse
                        jcr:primaryType="nt:unstructured"
                        jcr:title="Success"
                        sling:resourceType="granite/ui/components/coral/foundation/form/responses/openprompt"
                        open="/assets.html"
                        redirect="/apps/eaem-simple-token-based-auth/extensions/simple-token-auth/token-config.html/conf/global/settings/dam/experience-aem"
                        text="Configuration saved"/>
<items jcr:primaryType="nt:unstructured">
<type
                            jcr:primaryType="nt:unstructured"
                            sling:resourceType="granite/ui/components/coral/foundation/form/hidden"
                            name="./jcr:primaryType"
                            value="nt:unstructured"/>
<wizard
                            jcr:primaryType="nt:unstructured"
                            jcr:title="Configuration"
                            sling:resourceType="granite/ui/components/coral/foundation/wizard">
<items jcr:primaryType="nt:unstructured">
<area
                                    jcr:primaryType="nt:unstructured"
                                    jcr:title="Configure Thumbnails"
                                    sling:resourceType="granite/ui/components/coral/foundation/container"
                                    maximized="{Boolean}true">
<items jcr:primaryType="nt:unstructured">
<columns
                                            jcr:primaryType="nt:unstructured"
                                            sling:resourceType="granite/ui/components/coral/foundation/fixedcolumns"
                                            margin="{Boolean}true">
<items jcr:primaryType="nt:unstructured">
<column
                                                    jcr:primaryType="nt:unstructured"
                                                    sling:resourceType="granite/ui/components/coral/foundation/container">
<items jcr:primaryType="nt:unstructured">
<token-key
                                                                jcr:primaryType="nt:unstructured"
                                                                sling:resourceType="/apps/eaem-simple-token-based-auth/extensions/simple-token-auth/generate-key"
                                                                fieldDescription="Enter the token key"
                                                                fieldLabel="Token Key"
                                                                name="./tokenKey"/>
</items>
</column>
</items>
</columns>
</items>
<parentConfig jcr:primaryType="nt:unstructured">
<prev
                                            granite:class="foundation-wizard-control"
                                            jcr:primaryType="nt:unstructured"
                                            sling:resourceType="granite/ui/components/coral/foundation/anchorbutton"
                                            href="/aem/start.html"
                                            text="Cancel">
<granite:data
                                                jcr:primaryType="nt:unstructured"
                                                foundation-wizard-control-action="cancel"/>
</prev>
<next
                                            granite:class="foundation-wizard-control"
                                            jcr:primaryType="nt:unstructured"
                                            sling:resourceType="granite/ui/components/coral/foundation/button"
                                            text="Save"
                                            type="submit"
                                            variant="primary">
<granite:data
                                                jcr:primaryType="nt:unstructured"
                                                foundation-wizard-control-action="next"/>
</next>
</parentConfig>
</area>
</items>
</wizard>
</items>
</content>
</items>
</body>
</jcr:content>
</jcr:root>


3) Create a custom widget to generate random tokens and provide button to copy /apps/eaem-simple-token-based-auth/extensions/simple-token-auth/generate-key/generate-key.jsp

<%@include file="/libs/granite/ui/global.jsp" %>

<%@page session="false"
        import="org.apache.commons.lang3.StringUtils,
                  com.adobe.granite.ui.components.AttrBuilder,
                  com.adobe.granite.ui.components.Config,
                  com.adobe.granite.ui.components.Tag" %>
<%@ page import="apps.experienceaem.assets.core.services.SimpleTokenAuthService" %>
<%
    Config cfg = cmp.getConfig();

    SimpleTokenAuthService tokenService = sling.getService(SimpleTokenAuthService.class);
    String ssoKey = tokenService.getTokenKey();

    String name = cfg.get("name", String.class);

    Tag tag = cmp.consumeTag();

    AttrBuilder attrs = tag.getAttrs();
    cmp.populateCommonAttrs(attrs);

    attrs.add("name", name);

    String fieldLabel = cfg.get("fieldLabel", String.class);
    String fieldDesc = cfg.get("fieldDescription", String.class);
%>

<div class="coral-Form-fieldwrapper">
<label class="coral-Form-fieldlabel"><%=fieldLabel%></label>
<input is="coral-textfield" name="<%=name%>" value="<%=ssoKey%>" style="width: 100%;">
<coral-icon class="coral-Form-fieldinfo" icon="infoCircle" size="S"></coral-icon>
<coral-tooltip target="_prev" placement="left" class="coral3-Tooltip" variant="info" role="tooltip" style="display: none;">
<coral-tooltip-content><%=fieldDesc%></coral-tooltip-content>
</coral-tooltip>
</div>
<div style="text-align: right; width: 100%; margin: 15px 0 15px 0">
<button is="coral-button" iconsize="S" id="<%=name%>Gen">Generate</button>
<button is="coral-button" iconsize="S" id="<%=name%>Copy">copy</button>
</div>

<script>
    function addCopyListener(selector){
        var $widget = $("[name='" + selector + "']"),
            $widgetCopy = $("[id='" + selector + "Copy']"),
            $widgetGen = $("[id='" + selector + "Gen']");

        $widgetCopy.click(function(event){
            event.preventDefault();
            $widget[0].select();
            document.execCommand("copy");
        });

        $widgetGen.click(function(event){
            event.preventDefault();
            $widget.val([...Array(25)].map( i => (~~(Math.random()*36)).toString(36)).join(''));
        });
    }

    $(document).on("foundation-contentloaded", function(){
        addCopyListener("<%=name%>");
    });
</script>


4) Add a simple service to apps.experienceaem.assets.core.services.impl.SimpleTokenAuthServiceImpl read the token saved by the config page in path /conf/global/settings/dam/experience-aem

package apps.experienceaem.assets.core.services.impl;

import apps.experienceaem.assets.core.services.SimpleTokenAuthService;
import org.apache.sling.api.resource.LoginException;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.ResourceResolverFactory;
import org.osgi.service.component.annotations.Component;
import org.osgi.service.component.annotations.Reference;
import org.osgi.service.metatype.annotations.Designate;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.util.HashMap;
import java.util.Map;

@Component(service = SimpleTokenAuthService.class)
public class SimpleTokenAuthServiceImpl implements SimpleTokenAuthService{
    protected final static Logger log = LoggerFactory.getLogger(SimpleTokenAuthServiceImpl.class);

    private static final String EAEM_SERVICE_USER = "eaem-service-user";

    public String CONFIG_PATH = "/conf/global/settings/dam/experience-aem";

    @Reference
    private ResourceResolverFactory resourceResolverFactory;

    @Override
    public String getTokenKey() {
        String tokenKey = "";
        final String configPath = CONFIG_PATH;
        final ResourceResolver resourceResolver = getServiceResourceResolver(resourceResolverFactory);

        final Resource configRes = resourceResolver.getResource(configPath);

        if (configRes == null) {
            return tokenKey;
        }

        tokenKey = configRes.getValueMap().get("tokenKey", String.class);

        if (tokenKey == null) {
            tokenKey = "";
        }

        return tokenKey;
    }

    public static ResourceResolver getServiceResourceResolver(ResourceResolverFactory resourceResolverFactory) {
        Map<String, Object> subServiceUser = new HashMap<>();
        subServiceUser.put(ResourceResolverFactory.SUBSERVICE, EAEM_SERVICE_USER);
        try {
            return resourceResolverFactory.getServiceResourceResolver(subServiceUser);
        } catch (LoginException ex) {
            log.error("Could not login as SubService user {}", EAEM_SERVICE_USER, ex);
            return null;
        }
    }
}

5) Add an authentication handler apps.experienceaem.assets.core.services.TokenAuthHandler to validate the token and provide access impersonating as user eaem-readonly-user

package apps.experienceaem.assets.core.services;

import static org.osgi.framework.Constants.SERVICE_RANKING;

import java.io.IOException;

import javax.jcr.RepositoryException;
import javax.jcr.Session;
import javax.jcr.SimpleCredentials;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang3.StringUtils;
import org.apache.sling.auth.core.spi.AuthenticationHandler;
import org.apache.sling.auth.core.spi.AuthenticationInfo;
import org.apache.sling.jcr.api.SlingRepository;
import org.apache.sling.jcr.resource.api.JcrResourceConstants;
import org.osgi.service.component.annotations.Activate;
import org.osgi.service.component.annotations.Component;
import org.osgi.service.component.annotations.Reference;
import org.osgi.service.metatype.annotations.AttributeDefinition;
import org.osgi.service.metatype.annotations.AttributeType;
import org.osgi.service.metatype.annotations.Designate;
import org.osgi.service.metatype.annotations.ObjectClassDefinition;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@Component(
        service = { AuthenticationHandler.class },
        immediate = true,
        property = {
                SERVICE_RANKING + ":Integer=" + 9999,
                AuthenticationHandler.PATH_PROPERTY + "=/",
"service.description=Experience AEM Token Auth Handler",
"sling.filter.scope=REQUEST"
        })
@Designate(ocd = TokenAuthHandler.Configuration.class)
public class TokenAuthHandler implements AuthenticationHandler {
    private static final Logger log = LoggerFactory.getLogger(TokenAuthHandler.class);

    private static String AUTH_TYPE_TOKEN_AUTH = "EXPERIENCE_AEM_TOKEN_AUTH";

    private static String TOKEN_PARAM = "tokenKey";

    private static final String SESSION_REQ_ATTR = TokenAuthHandler.class.getName() + ".session";

    private static final String REQUEST_URL_SUFFIX = "/j_security_check";

    private static final String LOGIN_URL = "/libs/granite/core/content/login.html";

    private static final String REQUEST_METHOD_POST = "POST";

    private static final String USER_NAME = "j_username";

    private static final String LOGIN_TOKEN = "login-token";

    private String readOnlyUser = "";

    @Reference
    private SlingRepository repository;

    @Reference
    private SimpleTokenAuthService tokenAuthService;

    //for crx on localhost two different session ids are returned, one ends with -org.apache.sling and other -org.osgi.service.http
    @java.lang.SuppressWarnings("AEM Rules:AEM-3")
    private Session localhostSession = null;

    @Reference(target = "(service.pid=com.day.crx.security.token.impl.impl.TokenAuthenticationHandler)")
    private AuthenticationHandler wrappedAuthHandler;

    @Activate
    protected void activate(final Configuration config) {
        readOnlyUser = config.read_only_user();
        localhostSession = null;
    }

    @Override
    public AuthenticationInfo extractCredentials(HttpServletRequest request, HttpServletResponse response) {
        Session userSession = (Session)request.getSession().getAttribute(SESSION_REQ_ATTR);
        AuthenticationInfo authInfo = new AuthenticationInfo(AUTH_TYPE_TOKEN_AUTH);

        if(isLogout(request)){
            request.getSession().removeAttribute(SESSION_REQ_ATTR);
            localhostSession = null;

            try {
                removeLoginTokenCookie(request, response);
                response.sendRedirect(LOGIN_URL);
                return authInfo;
            }catch (Exception e){
                log.error("Error redirecting to login url", e);
            }
        }

        if(userSession != null){
            authInfo.put(JcrResourceConstants.AUTHENTICATION_INFO_SESSION, userSession);
            return authInfo;
        }else if(isLocalHost(request)){
            if(localhostSession != null){
                authInfo.put(JcrResourceConstants.AUTHENTICATION_INFO_SESSION, localhostSession);
                return authInfo;
            }
        }

        try{
            if ((REQUEST_METHOD_POST.equals(request.getMethod())) && (request.getRequestURI().endsWith(REQUEST_URL_SUFFIX))
&& StringUtils.isNotEmpty(USER_NAME)) {
                //constant not created for "j_password" to pass sonar checks
                SimpleCredentials creds = new SimpleCredentials(request.getParameter(USER_NAME),
                        request.getParameter("j_password").toCharArray());
                userSession = this.repository.login(creds);
            }else{
                String tokenKeyInRequest = request.getParameter(TOKEN_PARAM);
                String tokenKeyConfigured = tokenAuthService.getTokenKey();

                if(StringUtils.isEmpty(tokenKeyInRequest) || !tokenKeyInRequest.equals(tokenKeyConfigured)){
                    authInfo = wrappedAuthHandler.extractCredentials(request, response);
                    return authInfo;
                }

                Session adminSession = repository.loginAdministrative(null);

                userSession = adminSession.impersonate(new SimpleCredentials(readOnlyUser, new char[0]));
            }

            request.getSession().setAttribute(SESSION_REQ_ATTR, userSession);

            if(isLocalHost(request)){
                localhostSession = userSession;
            }

            authInfo.put(JcrResourceConstants.AUTHENTICATION_INFO_SESSION, userSession);
        }catch(RepositoryException e){
            log.error("Error could not create session for  - " + AUTH_TYPE_TOKEN_AUTH, e);
            return AuthenticationInfo.FAIL_AUTH;
        }

        return authInfo;
    }

    private void removeLoginTokenCookie(HttpServletRequest request, HttpServletResponse response){
        Cookie[] cookies = request.getCookies();

        if(cookies == null){
            return;
        }

        for(Cookie cookie : cookies){
            if(!LOGIN_TOKEN.equals(cookie.getName())){
                continue;
            }

            cookie.setPath("/");
            cookie.setMaxAge(0);

            response.addCookie(cookie);
        }
    }

    private boolean isLogout(HttpServletRequest request){
        return request.getRequestURI().endsWith("/system/sling/logout.html");
    }

    private boolean isLocalHost(HttpServletRequest request){
        return request.getRequestURL().toString().startsWith("http://localhost:4502/");
    }

    @Override
    public boolean requestCredentials(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws IOException {
        return wrappedAuthHandler.requestCredentials(httpServletRequest, httpServletResponse);
    }

    @Override
    public void dropCredentials(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws IOException {
        wrappedAuthHandler.dropCredentials(httpServletRequest, httpServletResponse);
    }

    @ObjectClassDefinition(name = "Experience AEM Token Authentication Handler Configuration")
    public @interface Configuration {

        @AttributeDefinition(
                name = "Read only user",
                description = "Read only user for browse",
                type = AttributeType.STRING)
        String read_only_user() default "eaem-readonly-user";
    }
}



↧
Search
Viewing all articles
Browse latest Browse all 525

Trending Articles

Practice Sheet of Right form of verbs for HSC Students

September 22, 2019, 11:40 pm

Download: FK ft Shenky – Nakuyewa ”Prod by: Shenky”

February 16, 2017, 4:24 pm

How to win at Markstrat (Markstrat Tips and Tricks) – Vodites

January 5, 2014, 10:34 pm

Ominde Commission Report and Recommendations – Ominde Report of 1964

March 16, 2015, 5:14 am

Bureau of Internal Revenue: Regional Offices (Directory)

January 9, 2014, 11:06 pm

GO 53 on Enhancement of Ex-gratia upto 5 Lakhs Toddy Tappers in Telangana

March 26, 2017, 11:23 pm

Cakewalk CA-2A Leveling Amplifier v2.0.1.97 WiN, v2.0.1.96 OSX Incl Keygen

October 17, 2016, 7:20 am

Mp3 Download: Mdu - Kunjenjenjena

December 7, 2017, 8:16 am

How the kill the job , when DTP request running for long hours.

July 26, 2013, 2:41 am

Microsoft Intune から展開しているアプリのアップデートについて

October 17, 2016, 4:11 am

18-year-old girl was beaten for half an hour by two Northampton men in 'an...

September 1, 2017, 10:00 pm

Car crash in Dunton Bassett leaves driver in critical condition

October 7, 2014, 7:51 am

Macky 2, Two Others In Road Accident

March 29, 2015, 5:34 am

Application log 00000000000000089514: Could not convert queue DLVST90CLNT

May 14, 2015, 11:27 pm

Detroit mafia: D’Anna Brothers agree to plea deal

April 21, 2016, 6:56 am

Delivery block field greyed out using VA02

January 26, 2016, 2:52 pm

Muloraki Au

June 22, 2016, 1:44 am

【個人撮影】スマホのプライベート映像♪「中に出さないで///」カラオケ屋での生ハメ撮りが流出ｗ【リベンジポルノ】＠PornHub

October 12, 2017, 2:23 pm

BREAKING NEWS: Diamond Platnumz Is Reported Dead After Ghastly Car Accident

February 9, 2018, 4:56 am

FIAT 500 B0111 B0112

July 5, 2018, 10:31 am
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>