[xwiki-users] Container authentication
I'm wanting to use container (tomcat) authentication with XWiki so that I can use a single sign on solution, using the instructions found here: http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Authentication#HContaine... I managed to get something basic set up and the authentication is working (the container challenges me for username/password) but when the XWiki page displays it is completely unstyled (though I see my username in the content so the authentication is being picked up) and it displays an "Error. You are not allowed to view this document or perform this action" error message in the page. So its looking like XWiki is not picking up (or generating) some resources it needs for that authenticated user (presumably because it did not go through the user registration process). Or is it expected some specific role to be assigned to the user? What's the trick to get this working correctly? And on a related topic, is there a way to get XWiki to understand additional user credentials such as their real name e.g. from the authentication token or whatever? Thanks Tim
On Thu, Aug 20, 2015 at 10:13 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
I'm wanting to use container (tomcat) authentication with XWiki so that I can use a single sign on solution, using the instructions found here: http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Authentication#HContaine...
I managed to get something basic set up and the authentication is working (the container challenges me for username/password) but when the XWiki page displays it is completely unstyled (though I see my username in the content so the authentication is being picked up) and it displays an "Error. You are not allowed to view this document or perform this action" error message in the page.
So its looking like XWiki is not picking up (or generating) some resources it needs for that authenticated user (presumably because it did not go through the user registration process). Or is it expected some specific role to be assigned to the user?
What's the trick to get this working correctly?
Sounds like your user is not added in the right group(s) (which mean it does not have any right).
And on a related topic, is there a way to get XWiki to understand additional user credentials such as their real name e.g. from the authentication token or whatever?
You can write your own custom authenticator (you could for example extend the one you are using right now and add some user properties sync) or find one that fit your need in http://extensions.xwiki.org/xwiki/bin/view/Main/WebHome#|t=extensions&p=1&l=30&s=doc.creationDate&d=desc&name=authenticator or https://github.com/xwiki-contrib/sandbox/tree/master/authenticators.
Thanks Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
The minimum group is XWiki.XWikiAllGroup. On Mon, Aug 24, 2015 at 1:50 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
On 24/08/2015 04:24, Thomas Mortagne wrote:
Sounds like your user is not added in the right group(s) (which mean it does not have any right).
Quite likely. But what groups are needed?
Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
Note that an authenticator is supposed to use com.xpn.xwiki.XWiki#createUser API which automatically add the user in the minimum groups. On Mon, Aug 24, 2015 at 4:11 PM, Thomas Mortagne <thomas.mortagne@xwiki.com> wrote:
The minimum group is XWiki.XWikiAllGroup.
On Mon, Aug 24, 2015 at 1:50 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
On 24/08/2015 04:24, Thomas Mortagne wrote:
Sounds like your user is not added in the right group(s) (which mean it does not have any right).
Quite likely. But what groups are needed?
Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
-- Thomas Mortagne
So it looks like the AppServerTrustedAuthServiceImpl class is calling createUser(): https://github.com/xwiki/xwiki-platform/blob/dd5152e8ff39e6358c20becb4c99256... But that should mean that my externally authenticated user should be being added and should get the XWiki.XWikiAllGroup. But that doesn't seem to be happening in my case as I'm being although I'm authenticated I'm denied access. Have I misunderstood the situation? Tim On 24/08/2015 10:15, Thomas Mortagne wrote:
Note that an authenticator is supposed to use com.xpn.xwiki.XWiki#createUser API which automatically add the user in the minimum groups.
On Mon, Aug 24, 2015 at 4:11 PM, Thomas Mortagne <thomas.mortagne@xwiki.com> wrote:
The minimum group is XWiki.XWikiAllGroup.
On Mon, Aug 24, 2015 at 1:50 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
On 24/08/2015 04:24, Thomas Mortagne wrote:
Sounds like your user is not added in the right group(s) (which mean it does not have any right).
Quite likely. But what groups are needed?
Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
On Tue, Aug 25, 2015 at 5:04 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
So it looks like the AppServerTrustedAuthServiceImpl class is calling createUser(): https://github.com/xwiki/xwiki-platform/blob/dd5152e8ff39e6358c20becb4c99256...
But that should mean that my externally authenticated user should be being added and should get the XWiki.XWikiAllGroup.
But that doesn't seem to be happening in my case as I'm being although I'm authenticated I'm denied access.
It's easy to check in the administration who is part of XWikiAllGroup.
Have I misunderstood the situation?
Tim
On 24/08/2015 10:15, Thomas Mortagne wrote:
Note that an authenticator is supposed to use com.xpn.xwiki.XWiki#createUser API which automatically add the user in the minimum groups.
On Mon, Aug 24, 2015 at 4:11 PM, Thomas Mortagne <thomas.mortagne@xwiki.com> wrote:
The minimum group is XWiki.XWikiAllGroup.
On Mon, Aug 24, 2015 at 1:50 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
On 24/08/2015 04:24, Thomas Mortagne wrote:
Sounds like your user is not added in the right group(s) (which mean it does not have any right).
Quite likely. But what groups are needed?
Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
So its not working for me. I've made sure the external user has the XWiki.XWikiAllGroup role and its still not working. The user does not get the necessary rights and I get the "Error. You are not allowed to view this document or perform this action" error message. Also, that user is not added to the XWiki users. Are there any example sof how to get this working? Tim On 26/08/2015 02:51, Thomas Mortagne wrote:
On Tue, Aug 25, 2015 at 5:04 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
So it looks like the AppServerTrustedAuthServiceImpl class is calling createUser(): https://github.com/xwiki/xwiki-platform/blob/dd5152e8ff39e6358c20becb4c99256...
But that should mean that my externally authenticated user should be being added and should get the XWiki.XWikiAllGroup.
But that doesn't seem to be happening in my case as I'm being although I'm authenticated I'm denied access.
It's easy to check in the administration who is part of XWikiAllGroup.
Have I misunderstood the situation?
Tim
On 24/08/2015 10:15, Thomas Mortagne wrote:
Note that an authenticator is supposed to use com.xpn.xwiki.XWiki#createUser API which automatically add the user in the minimum groups.
On Mon, Aug 24, 2015 at 4:11 PM, Thomas Mortagne <thomas.mortagne@xwiki.com> wrote:
The minimum group is XWiki.XWikiAllGroup.
On Mon, Aug 24, 2015 at 1:50 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
On 24/08/2015 04:24, Thomas Mortagne wrote:
Sounds like your user is not added in the right group(s) (which mean it does not have any right).
Quite likely. But what groups are needed?
Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Seems to be some AppServerTrustedAuthServiceImpl specfic thing. When looking at the code it looks like by default it does not even create the user at all, just set it as context user. As far as I can see in the code to actually create the user (and then for it to be automatically added to the default group(s)) this authenticator seems to expect the undocumented xwiki.authentication.createuser parameter in xwiki.cfg to be set to "empty" as in xwiki.authentication.createuser=empty On Wed, Aug 26, 2015 at 6:13 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
So its not working for me.
I've made sure the external user has the XWiki.XWikiAllGroup role and its still not working. The user does not get the necessary rights and I get the "Error. You are not allowed to view this document or perform this action" error message. Also, that user is not added to the XWiki users.
Are there any example sof how to get this working?
Tim
On 26/08/2015 02:51, Thomas Mortagne wrote:
On Tue, Aug 25, 2015 at 5:04 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
So it looks like the AppServerTrustedAuthServiceImpl class is calling createUser():
https://github.com/xwiki/xwiki-platform/blob/dd5152e8ff39e6358c20becb4c99256...
But that should mean that my externally authenticated user should be being added and should get the XWiki.XWikiAllGroup.
But that doesn't seem to be happening in my case as I'm being although I'm authenticated I'm denied access.
It's easy to check in the administration who is part of XWikiAllGroup.
Have I misunderstood the situation?
Tim
On 24/08/2015 10:15, Thomas Mortagne wrote:
Note that an authenticator is supposed to use com.xpn.xwiki.XWiki#createUser API which automatically add the user in the minimum groups.
On Mon, Aug 24, 2015 at 4:11 PM, Thomas Mortagne <thomas.mortagne@xwiki.com> wrote:
The minimum group is XWiki.XWikiAllGroup.
On Mon, Aug 24, 2015 at 1:50 PM, Tim Dudgeon <tdudgeon@informaticsmatters.com> wrote:
On 24/08/2015 04:24, Thomas Mortagne wrote: > > > > Sounds like your user is not added in the right group(s) (which mean > it does not have any right).
Quite likely. But what groups are needed?
Tim
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
OK, so setting: xwiki.authentication.createuser=empty seems to do the trick. Now behaving as I would expect. Thanks Tim
participants (2)
-
Thomas Mortagne -
Tim Dudgeon