I have made some progress on my spnego filter. I abandoned getting the filter to work at the tomcat level and figured if I was going to have to edit the spnego source that I might as well make it a servlet filter hook that can be easily deployed. I created a servlet filter hook and added the spnego source. Spnego relies on no 3rd party libraries so that made things easier. I got even luckier because the filter's main class SpnegoHttpFilter.java implements Filter which is exactly what you need when creating a servlet filter in 6.1. The old ext in 6.0 used BasePortalFilter.
I deployed this and of course got the same error as before. After a day of tracing through the code (slow and easily side tracked) I found that it is using a class SpnegoHttpServletRequest that extends HttpServletRequest. In there it is overriding getRemoteUser and returning the users AD user name (or whatever you were authenticating against). This is what is causing Liferay to fall to pieces.
1 public String getRemoteUser() {
2
3 if (null == this.principal) {
4 return super.getRemoteUser();
5
6 } else {
7 final String[] username = this.principal.getName().split("@", 2);
8 return username[0];
9 //System.out.println("User: " + this.principal.getRealm() + " - " + this.principal.getName());
10 }
11 }
I commented that garbage out and put in a print line. Liferay now executes the filter perfect and the users domain and username get printed out!
My next steps will be:
- To set some other request variable and then pull that request variable from an AutoLogin hook.
- Keep the servlet filter from executing like crazy on every page.
- Create an autologin hook that reads the variable, imports the user from AD if they don't exist (easy) and log them in.
That second task is a bit concerning. The filter executes the "doFilter" method at least 70 times per page and also gets to the getRemoteUser 6 or 7 times per page. That is a lot of wasted time I think. I need to figure out how to skip the filter if the user is already logged in maybe.
I am now setting a session variable for the domain and username and pulling that out in an autologin hook. All the "User:" lines is when it goes through the filter and authenticates. Clearly it doesn't need to do the handshake that many times for one page.
1User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
2User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
3#in AutoLogin
4Username: eqb9718
5Realm: HCADEV.CORPADDEV.NET
6User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
7#in AutoLogin
8Username: eqb9718
9Realm: HCADEV.CORPADDEV.NET
10User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
11User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
12User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
13User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
14User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
15User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
16User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
17User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
18User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
19User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
20User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
21User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
22User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
23User: HCADEV.CORPADDEV.NET - eqb9718@HCADEV.CORPADDEV.NET
Por favor, faça login para denunciar.