Requirements
by Joseph Bank,
Joel Aufrecht
Introduction
Gatekeeper allows an OpenACS installation to provide users
authenticated access to other web sites. This is particularly
useful for dealing with "mounting" another legacy website on our
own site, while adding a security layer. We can then only allow
access to the legacy website from the main ACS server.
System/Application Overview
Gatekeeper provides an application for managing seamless
remote viewing of other web pages with optional security layers.
It consists of the following components:
A web interface for retrieving foreign urls.
An API for adding security restrictions.
Use-cases and User Scenarios
Jane Webmaster wants to build an ACS site that provides paid
access to a currently existing web site. This other site uses
significantly different technology, so full integration would
require a great deal of effort.
Jane creates an instance of the gatekeeper package which points to the existing site.
She sets up a security restriction for the gatekeeper instance using
ACS permissions by only allowing read access for a newly created
user group.
She modifies the ACS Ecommerce system to insert and remove users from the new user group based on their subscription payments.
She modifies the existing site to only serve requests from her ACS server's IP address.
--------------------------------------------
Use case
--------------------------------------------
Integration of an external web mail client: Squirrelmail (PHP-based) and
IMAP-Server.
Administrator
--------------------------------------------
The institution has to have an IMAP server up and running. OpenACS must
be installed using the external authentication via pam-imap/ldap/passwd
(etc.) to authenticate and synchronize openacs users.
The administrator has to have a webmail client like IMP or Squirrelmail
installed on Apache+PHP. The AOLServer has to have access to Apache for
instance over localhost.
The administrator has successfully installed the external authentication
package using pam.
The administrator has to do the following to integrate the external
webmail client squirrelmail using the gatekeeper.
1. Create a new Gatekeeper Instance: Name: Squirrelmail
2. Indicate the required parameters for the gatekeeper instance:
- URL to guard:
http://localhost/squirrel/
- Gatekeeper Type:
requires external authentication
- Path to an optional header/footer template
/www/service0/packages/dotlrn/dotlrn-master.adp
- Name of the authority used (local, pam, ldap...) or database table
with account informations:
pam
- used login form input field:
login_username
- used password form input field:
secretkey
- logout/sign-out path:
http:/localhost/squirrel/src/signout.php
- request method:
post
- form action:
http:/localhost/squirrel/redirect.php
- where to add the startpage of the webmail in openacs:
/dotlrn/?&page-num=3
The timeout of squirrelmail has to be set to a higher value than that of
OpenACS to make sure that the webmail session is valid as long as the
OpenACS session is valid.
Gatekeeper
--------------------------------------------
The Gatekeeper Instance registers itself for auto logon on to that
authority. Thus after a successful login the login information is also
used to login to the webmail client and the cookies are forwarded to the
users browser. Thus the authentication package has to be extended for
post-login and logout procedure-calls. On request the gatekeeper checks
the content type (html, xhtml, compressed or not, usage of frames or
not) and rewrites the links appropriately. As soon as the user logs out
the webmail client is also logged out.
User
--------------------------------------------
The user simply logs into the system once and is served a link where he
can access the webmail-client. In this case over My Space-->My Mails as
Page three under dotLRN. The documentation of the webmail client has to
be made accessible to the user.
The current Gatekeeper has to be improved by the following:
- allow usage of templates (done already)
- allow xml, xhtml
- allow compressed data
- auto-check of frames --> if frames are used then the template is
useless or the frame has to be embedded inside another frameset.
- cookies forwarding for external application (not sure if that already
exists)
Restrictions
--------------------------------------------
- Different locale between OpenACS and Webmail
- Different designs (depending on the webmail client this can be changed
via templates).
- no true integration into MySpace possible to notify user that she/he
has new unread emails.
--------------------------------------------
Other Use-Case:
--------------------------------------------
Integration of PHPWiki (xhtml) via Gatekeeper and LDAP/PAM/SQL...
Username Inputfield: auth[userid]
Password Inputfield: auth[passwd]
Form action: HomePage?action=browse
For OpenACS-Authority: PAM
PHPWiki can use many different types of authentication: LDAP, IMAP,
PASSWD, DB,...
--------------------------------------------
Other Use-Case:
--------------------------------------------
Integration of an external website protected by http basic authencation (via the .htaccess file from Apache)
Set up a gatekeeper instance that points to the URL that should be
password-protected if not accessed from OpenACS or .LRN.
Then edit the .htaccess file in question. It should read something like this:
AuthUserFile /home/www/dirkgomez/.htpasswd
AuthGroupFile /dev/null
AuthName "Dirk Gomez' downright secret stuff"
AuthAuthoritative On
AuthType Basic
Satisfy Any
<Limit GET POST>
order deny,allow
deny from all
#allow from foobar.dirkgomez.de
allow from 123.123.123.123
require user dirk ramiro
</Limit>
Related Links
Lots of other web sites do related things. For example, anonymizer sites allow
you to surf the web while doing seamless translation of the page.
Anonymizer Site
Functional Requirements
Req #
Priority
Status in 5.0
Description
10.0
A
?
Seamless
Viewing. The gatekeeper should provide seamless viewing of URLs. This means
that the URLs should look like they belong to the ACS site, not the
original site.
Does this refer to web pages or to URL? Ie, does this mean that "user can click on a link and see (password-protected) web pages from a remote site, within the OpenACS site's look and feel," or does it mean, "user can click URLs that look like http://myopenacssite.test/foo/bar"?
20.0
A
?
Restricted Browsing.
A given instance of the gatekeeper package should only provide access
to a single site. The user must not be able to modify the URL so that
arbitrary sites can be retrieved through the server.
30.0
A
?
Link Translation.
All links from the gatekeeper page to the given site should be
translated to use the gatekeeper.
40.0
A
?
User Tracking.
The ability to track all pages viewed via the gatekeeper should exist.
50.0 Flexible Restrictions
50.1 ACS Permissions
The gatekeeper package should support standard ACS permissioning. Access can thus
be limited by setting up limited read access to an instance of the gatekeeper package.
50.2 Callbacks
The gatekeepers should be provide access control via registered callbacks.
60.0 Full HTTP Support
The gatekeeper should support the entire HTTP specification.
60.1 POST Support
POST form submission must be supported.
60.2 Non-HTML Pages
Retrieval of non-HTML pages, such as GIFs and JPEGs, must be supported.
60.3 Cookie Support
The system should have the ability to store and respond with cookies sent
from the guarded site.
Revision History
Document Revision #
Action Taken, Notes
When?
By Whom?
1
Creation
23 Nov 2000
Joseph Bank
2
Revised to add Nima Mazloumi's use case.
13 Jan 2004
Joel Aufrecht