OpenACS Authentication

Fisheye: Tag 1.5 refers to a dead (removed) revision in file `openacs-4/packages/acs-authentication/www/doc/acs-authentication.htm'. Fisheye: No comparison available. Pass `N' to diff? Index: openacs-4/packages/acs-authentication/www/doc/acs-authentication.html =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-authentication/www/doc/acs-authentication.html,v diff -u --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ openacs-4/packages/acs-authentication/www/doc/acs-authentication.html 29 Dec 2017 10:09:01 -0000 1.1 @@ -0,0 +1,138 @@ + + + + +OpenACS Authentication + + + + +

+ + + + + + +

Prev	Introduction	Next

acs-authentication +

This document aims to help you understand how it works and how you can use it for your own purpouses. By Rocael Hernández R.

Main functionality: It is used to authenticate any user in an openacs installations.

So far, you can use it to authenticate against LDAP & PAM, and of course, locally. You can implement your own based on your needs, processes, etc.

Definition: SC = service-contract

Authorities

acs-authentication can have multiple authorities, each one represent an specific configuration of authenticatication. For instance, in your openacs installation you can have users related to different authorities, some of them might authenticate locally since they are external or invited, others belongs to your corporate network and already have users, so might authenticate against LDAP and others in your own work office might use PAM for authentication because your local system authentication. Plus you might define an specific implementation (using the set of SC) to connect to your client DB, which is in another DB, and allow your clients login to certain parts of your website. Then, this is right way to handle all those set of users, that already might have an account in another place and you just want them to authenticate against that external system.
+

The idea is: each user belongs to a given authority, and just one .

To add an authority in your installation go to /acs-admin/auth/ and click on "Create new authority".

When adding the authority you need to configure:

Authentication method (where to authenticate, i.e. check user/password)
Password Management (where to update passwords)
Account Registration (where to create new accounts)
On-Demand Sync (to get user info from the source in real time)

Those configurations simply will perform the tcl proc that is defined in the SC above described for the given SC implementation that you choose. In other words:

For using LDAP, you need to install auth-ldap, on its installation, this package will create an implementation of the above mentioned SC definitions (look at "specs" that define which proc needs to be called for each alias).
PAM package is auth-pam.
Probably, for any new authentication method you'll need to create your own package in the same style of auth-ldap or auth-pam.

Note: "Batch Synchronization" will not be administered there anymore in the future, everything will go to ims-ent.

Also, depending on each implementation, it has a set of parameters that will require for the configuration to work. And those parameters are set independently by authority / authentication method, so for LDAP you'll be able to configure the next set of parameters:

DNPattern
UsernameAttribute
Elements
BaseDN
Attributes
PasswordHash

Then you can enter your specific values for your server, is likely that the recomemded ones will work fine.

Hint: nssha (SSHA) doesn't work well with LDAP use ns_passwd or another encryption method (MD5...)

You can make your users to loging using the email or username, by changing the paramenter at the kernel named: UseEmailForLoginP under Security section. If username is used for loging, it will ask for the authority to use, since username is unique by authority but not for the entire openacs installation (can exists several identic usernames but each one belongs to a different authority).

acs-authentication defines a set of SC to interact with the different authentication implementations (LDAP or PAM):

auth_authentication "Authenticate users and retrieve their account status.", with the operations:

Authenticate
GetParameters

auth_password "Update, reset, and retrieve passwords for authentication.", with the operations: +
- CanChangePassword
- ChangePassword
- CanRetrievePassword
- RetrievePassword
- CanResetPassword
- ResetPassword
- GetParameters
+
auth_registration "Registering accounts for authentication", with the operations:

GetElements
Register
GetParameters

auth_sync_retrieve
auth_sync_process
auth_user_info +
- GetUserInfo
- GetParameters
+

Note: #4 & #5 will be taken out from authentication and moved to the package ims-ent.

The SC definitions are quite straightforward, then worth to look at them for better understanding.

In an openacs site the login is managed through acs-authentication. It happens like this:
+

The user enters the email/user & password
It will search the user in the users table and return the authority_id
With that authority_id it will find the respective SC implementation which contains the adequate tcl proc for the authentication process
That proc will check the identity of the user based on the password (right now could be locally, pam or ldap authenticated, though this model supports N methods of authentication)

+ + + + + + + + + + + +

Prev	Home	Next
	Up	Installation

+ docs@openacs.org +

+ +