Step-up authentication

I was going through What's new in the IBM WebSphere Portal 6.0.1 and 6.1 Programming Model, slides and it has couple of Step-up Authentication- Application Flow.



The basic idea is if your not logged in you see data but when you want to perform say write operation or operation that requires user be logged in then you ask user to log in.

By default portal has concept of Anonymous User and All Authenticated Users. If you want to display a public page or display portlet on public page you can assign anonymous user rights and it works.

In Portal 6.1 there is concept of Remember Me cookie, that can remember the user who logged in from that browser and give you access to his name even before he is logged in. Because of Remember Me cookie portal has one additional authentication state identified, which happens when user's id is stored as persistent cookie on the browser and when he accesses the portal page the portal can identify user even before he logs in.

You can use identified authentication level to display few portlets or pages to user even if he is not logged in but if portal can identify the user from the remember me cookie.

In order to try this feature i decided to create Remember Me page, on that page i did add Remember Me portlet, which reads user name and prints it to System.out,(You can change it to display it on screen). I wanted to display this to only identified user. I followed these steps to do that

• Assign Anonymous User - User access rights to both Remember Me page and Remember Me portlet


• Then use Resource Permission Portlet to change access level of the Remember Me page and Remember Me portlet, like this. On this screen click on Standard Link
  
  


• On the next page you will see three authentication levels like this
  
  Change the authentication Level to Authenticated. Assign authenticated level to both Remember Me page and Remember Me portlet
  

Now when you access portal and your not identified you wont see remember me page and portlet. But if your identified you will see that page.

This is list of authentication levels.

1. Standard: Default and context-related authentication level


2. Identified: User authentication using a persistent HTTP cookie


3. Authenticated:User authentication using username and password

When you try to access authenticated resource user would be redirected to the login page.

Sample Remember Me cookie Portlet

This sample Portlet demonstrate how to use Remember Me cookie service to find out userId for the user on anonymous page.

public class RememberMePortlet extends javax.portlet.GenericPortlet {
 PortletServiceHome psh;
 /**
  * @see javax.portlet.Portlet#init()
  */
 public void init() throws PortletException{
  super.init();
  try {
   javax.naming.Context ctx = new javax.naming.InitialContext();
   psh = (PortletServiceHome)ctx.lookup(RememberMeCookieService.JNDI_NAME);
  } catch (NamingException e) {
   // TODO Auto-generated catch block
   e.printStackTrace();
  }
 }

 public void doView(RenderRequest request, RenderResponse response) throws PortletException, IOException {
  // Set the MIME type for the render response
  response.setContentType(request.getResponseContentType());
  
  try {
   RememberMeCookieService rememberMeService = psh.getPortletService(RememberMeCookieService.class);
   if(rememberMeService.isRememberMeCookieEnabled()){
    System.out.println("RememberMeCookie is enabled");
    System.out.println("User Name " + rememberMeService.getUserID(request));
    System.out.println("Is Remember Me Cookie Set " + rememberMeService.isCookieSet(request));
    response.getWriter().println("Invalidate remember me cookie");
   }else{
    System.out.println("RememberMeCookie is disabled");
   }
  } catch (SecurityException e) {
   e.printStackTrace();
  }
 }
}

You can download this portlet from here

Enable Remember Me Cookie

You can follow these steps to Enable Stepup Authentication on your server

• Log into the WAS Administrative COnsole and go to Security > Secure administration, applications, and infrastructure > Web security > Single sign-on (SSO).
  Verify that both Interoperability Mode and Web inbound security attribute propagation are enabled
  


• 
  Open the wkplc.properties file and set values for following properties
  
# Defines the key which is used to encrypt the Cookie information
# sua_user does not need to match to a real user e.g use myname as value
# sua_serversecret_password will be used as the key
sua_user=remembermeuser
sua_serversecret_password=remembermepassword

#Defines if Rememberme should be enbled during enable-stepup-authenticatoin
#
#
enable_rememberme=true

  


• Execute the enable-stepup-authentication Configuration task by executing this command
  
ConfigEngine.bat enable-stepup-authentication -DWasUserid=wasadmin -DWasPassword=wasadmin

  


• Once the configuration task is completed successfully. Restart the server, when server is up again, you should be able to see the Remember Me on this Computer checkbox on the Login page
  
  Enter your user name, password and check the Remember Me checkbox and click on Login. When you do that one persistent cookie would be written to your browser. My persistent cookie looks like this
  
com.ibm.portal.RememberMe
7mNt_buvPqUrKCpE6DXBb9U7OwewlrnAKQvjT168RoQ8oNm6MUMun8M7uKiYfQr8XbSXYT4CJXf7ycMv_zlsq42UuqRW1wV7QQeFyZn9v0B4_qlyRlOXBouF9fSEvgj-
localhost/
1024
1327819264
29999016
630635760
29998815
*

  
  


• Now logout or close the browser window and open it again and it will show you name of the user that was used for logging and saving remember me cookie.
  
  

Rememeber Me Cookie

Step-up authentication provides authentication levels for pages and portlets. The Remember me cookie is an encrypted HTTP cookie that supports state-of-the-art authentication, which allows you to present personalized portlets and pages in a public area without asking the user to manually authenticate. Together, these two features allow remembered users to view anonymous pages and portlets with a standard or identified authentication level. By providing a valid Remember me cookie, a user can also be allowed to access protected pages and portlets that require the identified authentication level. If the authentication level is set to authenticated, the user will have to provide a user ID and password to view the page or portlet.

Important: The Remember me cookie does not extend the Portal Personalization feature to the public area because a user identified by the Remember me cookie in a public area is still considered anonymous from an access control point of view.
Restriction: Step-up authentication is not supported by the Web Content authoring portlet or when delivering content using a local or remote Web Content Viewer portlet.
Restriction: Step-up authentication requires the LtpaToken2 for single sign-on; see Implementing single sign-on to minimize Web user authentications for details.