0

A customer of ours has just purchased CQ5 and would like to externalize all of its security. We'd like to use an STS server for SSO and then leverage a custom authorization/attribute provider instead of the CQ5 repository. Ultimately, we do not want to use LDAP in any way.

Here is how we envision this (some pieces already working):

  1. User browses to CQ5 Dispatcher running in Apache
  2. Apache filter redirects user to STS site where login is completed.
  3. User is redirected back to Apache with SAML Claims.
  4. User ID token is placed as cookie into browser. (everything is working up to here)
  5. CQ5 captures that cookie based on the SSO configuration (working)
  6. Problem starts here: From here, we want to call a custom authorization provider for the user's attributes, roles, groups etc...

We have tried to figure out how to do this and can't seem to find the missing link.

Do we need to create a custom login module? Do we need to create a custom principal provider? Do we somehow use the existing LDAP capability in CQ5 but have it call a custom class which leverages the external auth source?

If anyone here has any idea how to do this, their karma quotient would be full for the year if they could share it. I'm not sure if this is a basic thing you do with JAAS or even where to put my classes after I've created them.

We've worked really hard on this so far and seem to be close, but we keep hitting dead-ends.

Thanks so much if you have an idea where to begin!!

-joe

4

3 回答 3

2

AEM 的最新版本现在包括SAMLAuthenticationHandler，它允许您：

  • 将用户重定向到 SSO 以模拟 IDP 发起的登录，或
  • 允许 AEM 使用 IDP 执行 SP 发起的登录
  • 指定要从 SAML 断言中获取的属性并添加到用户的配置文件节点（不确定是否可以将其用于组）
  • 指定应将用户添加到哪些组
  • 设置一个名为的 cookie ，该 cookierequest-path将存储用户到达的 URL，然后在通过身份验证时将它们重定向到该位置（即深度链接）

这使得依赖 SAMLAuthenticationHandler 比使用 Apache 重定向更好。与 AEM 6.2 捆绑的当前版本的处理程序在使用重定向方法时未正确设置 cookie，但 Adob​​e 确实有他们可以提供的更新版本来解决该问题。

我通常建议客户端不要在 AEM 中开发自己的身份验证处理程序。

不使用 LDAP 时，这确实会产生用户在登录之前不存在的问题。此外，当您的体系结构包含多个负载平衡发布者时，用户可能存在于一台服务器上用户同步。

于 2017-05-03T14:32:06.110 回答
0

看来你将不得不实现一个自定义的 LoginModule，更多信息在这里：http ://dev.day.com/docs/en/crx/current/deploying/custom-login-modules.html

于 2012-10-22T21:38:11.567 回答
0

尝试在 google 组中搜索 SSO 详细信息。这是一篇有用的帖子：

http://groups.google.com/group/day-communique/browse_thread/thread/72c235c83a501252/fba4d08a90487156?lnk=gst&q=SSO#fba4d08a90487156

于 2012-03-21T16:03:44.947 回答