I have a ColdFusion application being hosted on my IIS server. I added the Shibboleth service to my web IIS, and the CGI/Filters are setup to use it. I added my application to the testshib federation and was able to login successfully. Now I'm trying to get the session variable into the ColdFusion code.
When I dump the CGI scope, I see the shibboleth session is saved under HTTP_COOKIE, but REMOTE_USER is an empty string. This is because REMOTE_USER cannot be used according to the docs. Instead the request header variable should be named HTTP_REMOTE_USER, but I don't see that in the CGI dump. Does anyone why this is? Do I have to set that up my shibboleth attribute-map or in ColdFusion ?
index.cfm
CGI dUMP
<cfdump var = "#cgi#" >
<br>HTTP_REMOTE_USER
<cfdump var="#CGI.HTTP_REMOTE_USER#">
<br>Get Request
<cfset x = GetHttpRequestData()>
<cfdump var="x">
Dump result
HTTP_COOKIE:_shibsession_64656487474733a2f2f6465736f6d2f73686962626f6c657468=_ecb60f7e4bf7616ab3522;
Session
Miscellaneous
Session Expiration (barring inactivity): 479 minute(s)
Client Address: 224.61.30.228
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://idp.testshib.org/idp/shibboleth
Authentication Time: 2017-11-30T14:48:48.255Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)
Attributes
affiliation: 2 value(s)
entitlement: 1 value(s)
eppn: 1 value(s)
persistent-id: 1 value(s)
unscoped-affiliation: 2 value(s)
I believe that ColdFusion doesn't expose every possible CGI variable in the <cfdump>, only the most common ones. That doesn't mean you can't access what appear to be missing CGI variables directly. Try changing your dump to specifically target the one you need, like:
<cfdump var="#CGI.HTTP_REMOTE_USER#">
If it still isn't being written to the CGI scope, you might be able to access that specific request header variable through the the page request using getHTTPRequestData().
Related
I implemented a Rest service that creates an Employee. In the response message I want to dynamically set the HTTP Location header with the newly created Employee resource Uri.
The below code is working fine and I am able to see the value in Location header as expected. However I have the Uri hardcoded in the EmpService and I want it to be dynamic. How do I extract/pass Uri information to the EmpService bean?
Config.xml
<int-http:inbound-gateway
request-channel="httpPostChannel"
reply-channel="responseChannel"
path="/emp"
supported-methods="POST"
message-converters="converters"
request-payload-type="com.samples.jaxb.Employee"/>
<int:service-activator ref="empService" method="post"
input-channel="httpPostChannel" output-channel="responseChannel"/>
EmpService.java
public Message<Employee> post (Message<Employee> msg) {
Employee emp = empDao.createEmployee(msg.getPayload());
return MessageBuilder.withPayload(emp)
.setHeader(org.springframework.http.HttpHeaders.LOCATION, "http://localhost:8080/RestSample/emp/" + emp.getEmpId())
.build();
}
Actually even right now your URI is dynamic:
"http://localhost:8080/RestSample/emp/" + emp.getEmpId()
OTOH you always can inject it via setter or #Value property during application start from some external property.
Or you even can do that extracting some property/header from the incoming Message.
However I guess you would like to know the host and port you are ran on.
The host you can know via InetAddress.getLocalHost().
The port you can extract via an appropriate ServletContainer vendor API, e.g. for Tomcat: Get the server port number from tomcat with out a request.
With Spring Boot you can just use #LocalServerPort:
* Annotation at the field or method/constructor parameter level that injects the HTTP
* port that got allocated at runtime. Provides a convenient alternative for
* <code>#Value("${local.server.port}")</code>.
Although... I guess this one should be enough for:
.setHeader(org.springframework.integration.http.HttpHeaders.REQUEST_URL,
request.getURI().toString())
I mean that your incoming Message after <int-http:inbound-gateway> has header set. In my test case with Spring Boot and random Tomcat port it looks like:
"http_requestUrl" -> "http://localhost:64476/service/?name=foo"
I'm trying to set up OpenAM with CDSSO, but I cann't find the right setup.
My environment looks like this:
OpenAM:
version: 10.0.0
few tomcat
behind loadbalancer 10.10.10.10:8000
availble by http://abc.xxx.com which redirects to http://sso.yyy.com or by http://sso.yyy.com
Apache with web agent
apache version: Apache/2.2.15
web agent version: Version: 3.0-04, Revision: 9150
host have access to 10.10.10.10:8000, but not to http://abc.xxx.com or http://sso.yyy.com
accessed via http://efg.xxx.com
End user / browser
have access to http://sso.yyy.com, but not to 10.10.10.10:8000
Tested configurations
Try 1
In web agent configuration I setup
com.sun.identity.agents.config.cdsso.cdcservlet.url[0]=http://10.10.10.10:8000/opensso/cdcservlet
in browser I have redirect to 10.10.10.10:8000/opensso/cdcservlet
Location: http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fefg.xxx.com%3A80%2F&
in web agent log is
am_web_do_cookie_domain_set(): setting cookie iPlanetDirectoryPro=;Path=/.
is_server_alive(): Connection timeout set to 2
am_web_get_url_to_redirect: The goto_url and url before appending cdsso elements: [http://efg.xxx.com:80/] [http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fefg.xxx.com%3A80%2F]
process_access_redirect(): get redirect url returned AM_SUCCESS, redirect url [http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fhttp://efg.xxx.com%3A80%2F&].
process_access_redirect(): returning web result AM_WEB_RESULT_REDIRECT.
process_request(): returning web result AM_WEB_RESULT_REDIRECT, data [http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fhttp://efg.xxx.com%3A80%2F&]
am_web_process_request(): Rendering web result AM_WEB_RESULT_REDIRECT
am_web_process_request(): render result function returned AM_SUCCESS.
Try 2
In web agent configuration I setup
com.sun.identity.agents.config.cdsso.cdcservlet.url[0]=http://sso.yyy.com/opensso/cdcservlet
in browser I have
403, You don't have permission to access /
in web agent logs is
am_web_do_cookie_domain_set(): setting cookie iPlanetDirectoryPro=;Path=/.
am_web_get_url_to_redirect: unable to find active Access Manager Auth server.
process_access_redirect(): get redirect url returned AM_FAILURE, redirect url [NULL].
process_access_redirect(): returning web result AM_WEB_RESULT_FORBIDDEN.
process_request(): returning web result AM_WEB_RESULT_FORBIDDEN, data []
am_web_process_request(): Rendering web result AM_WEB_RESULT_FORBIDDEN
am_web_process_request(): render result function returned AM_SUCCESS.
Questions
Is it possible to perform such a configuration?
In newer version of OpenAM (12.0.0 › OpenAM Administration Guide) I find
OpenAM Conditional Login URL (Not yet in OpenAM console)
CDSSO examples: com.forgerock.agents.conditional.login.url[0]= login.example.com|http://openam1.example.com/openam/cdcservlet, http://openam2.example.com/openam/cdcservlet, com.forgerock.agents.conditional.login.url[1]= signin.example.com|http://openam3.example.com/openam/cdcservlet, http://openam4.example.com/openam/cdcservlet
what does it mean "Not yet in OpenAM console". Can I set this directry in OpenDJ?
Is this configuration will work on older versions of OpenAM?
Is for web agent work failover similat to https://docs.oracle.com/cd/E19636-01/819-6101/auto20/index.html?
Thanks in advance
kawu
Answer to 1) Yes that's possible. I don't see why you would need conditional login URL feature, 3.0-04 agent might not even support this feature (question 3) If agents can not access CDCServlet or LoginURL feature you need to disable the probing for it ... see OPENAM-3294 You are using LB for OpenAM, so no need for Agent failover.
IOwinContext does not appear to have the HTTP Referrer in it, and I need to grab it. What is the right way to get that particular variable? IOwinContext has several Typed PEMs but I don't see referer in particular.
The system I am working is self-hosted.
Thanks.
The OwinContext doesn't have 'HTTP Referer' as item in Request header. This has been renamed in Owin self host context. It's now known as 'Referer'. So once you have object of owin context you can get the information by using:
context.Request.Headers["Referer"]
My softwares are:
Liferay 6.0.6 with Tomocat 6.0.29, OpenSSO 9.5.2_RC1 Build 563 with tomcat 6.0.35, CentOS 6.2 Operating system
Setup:
I have setup both liferay and opensso on the same CenOS machine, making sure that both of its tomcat run on very different port, I have installed and configured OpenSSO with Liferay as per the guidelines availaible on liferay forums
Problem:
when i hit my application URL i get redirected to Opensso login page which is what i want, when i login with proper authentication details it trys to redirect to my application which is exactly how it should behave, however this redirect goes in a loop and i don't see my application dashboard. The conclusion i come to is that the redirect is trying to authenticate in liferay but somehow it does not get what it is looking for and goes back to opensso and this repeats infinitely. I can find similar issues been reported here. Unfortunetly, it did not work.
Later i decided to debug the liferay code and i put a break point on com.liferay.portal.servlet.filters.sso.opensso.OpenSSOUtil and com.liferay.portal.servlet.filters.sso.opensso.OpenSSOFilter. The way i understand this code is written is it first goes to the OpenSSOUtil.processFilter() method which get's the openSSO setting information that i have configured on liferay and later checks if it is authenticated by calling the method OpenSSOUtil.isAuthenticated(). This particular implementation basically reads the cookie information sent and tries to set the cookie property on liferay by calling the method OpenSSOUtil._setCookieProperty(). This is where it fails, it tries to read the cookie with name [iPlanetDirectoryPro] from the liferay class com.liferay.util.CookieUtil using the HttpServletRequest object but all it get's a NULL. this value set's the authenticate status to false and hence the loop executes.
Following is the code from class com.liferay.util.CookieUtil
public static String get(HttpServletRequest request, String name) {
Cookie[] cookies = request.getCookies();
if (cookies == null) {
return null;
}
for (int i = 0; i < cookies.length; i++) {
Cookie cookie = cookies;
String cookieName = GetterUtil.getString(cookie.getName());
if (cookieName.equalsIgnoreCase(name)) {
return cookie.getValue();
}
}
return null;
}
Can anyone please let me know why liferay is not able to find the cookie that opensso sent. If its related to Opensso setting about enable cookie value, then i have done that already which is here
In OpenSSO go to: Configuration -> Servers and Sites -> -> Security -> Cookie -> check Encode Cookie Value (set to Yes)
What works:
when this loop is executing i open another tab and login to my application explicitly, from my application when i signout it get's signout from opensso also. This is strange to me.
For more information, while this redirect loop happens, following URL's give me these set of information
http://opensso.ple.com:9090/openam/identity/getCookieNameForToken
string=iPlanetDirectoryPro
http://opensso.ple.com:9090/openam/identity/isTokenValid
boolean=true
I am trying to use System.Net.WebClient in a WinForms application to upload a file to an IIS6 server which has Windows Authentication as
it only 'Authentication' method.
WebClient myWebClient = new WebClient();
myWebClient.Credentials = new System.Net.NetworkCredential(#"boxname\peter", "mypassword");
byte[] responseArray = myWebClient.UploadFile("http://localhost/upload.aspx", fileName);
I get a 'The remote server returned an error: (401) Unauthorized', actually it is a 401.2
Both client and IIS are on the same Windows Server 2003 Dev machine.
When I try to open the page in Firefox and enter the same correct credentials as in the code, the page comes up.
However when using IE8, I get the same 401.2 error.
Tried Chrome and Opera and they both work.
I have 'Enable Integrated Windows Authentication' enabled in the IE Internet options.
The Security Event Log has a Failure Audit:
Logon Failure:
Reason: An error occurred during logon
User Name: peter
Domain: boxname
Logon Type: 3
Logon Process: ÈùÄ
Authentication Package: NTLM
Workstation Name: boxname
Status code: 0xC000006D
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 127.0.0.1
Source Port: 1476
I used Process Monitor and Fiddler to investigate but to no avail.
Why would this work for 3rd party browsers but not with IE or System.Net.WebClient?
I have seen a similar issue, where the Integrated / NTLM security will only work if you are accessing the host by machine name or localhost. In fact, it is a [poorly] document feature in Windows that is designed to protect against "reflection attacks".
Basically, you need to create a registry key on the machine that is trying to access the server, and whitelist the domain you are trying to hit. Each host name / FQDN needs to be on it's own line - there are no wildcards and the name must match exactly. From the KB Article:
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Right-click MSV1_0, point to New, and then click Multi-String Value.
Type BackConnectionHostNames, and then press ENTER.
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
Exit Registry Editor, and then restart the computer.
http://support.microsoft.com/kb/956158/en-us
Have you tried ...
new NetworkCredential( "peter", "password", "boxname" );
You might also try ...
var credCache = new CredentialCache();
credCache.Add( new Uri ("http://localhost/upload.aspx"),
"Negotiate",
new NetworkCredential("peter", "password", "boxname"));
wc.Credentials = credCache;
Also, according to this it may be that IIS is configured wrong. Try replacing "Negotiate" with "Basic" in the above and checking your IIS config for the website. There's also a bunch of possible causes here.
Try going into IE's options and explicitly add the site to the Intranet Zone. Then re-run the program. You should also not run the program from an administrator login. This may trigger the Enhanced Security Configuration for Internet Explorer.
It could explain why you can hit the site with Firefox and Opera, but not with IE or WebClient.
Without knowing your IIS deployment, and assuming that you have the correct authorization rules for upload set in IIS (e.g. the right allow* ACL's on the right dirs you are trying to upload content to, etc), first thing I would try is to set UseDefaultCredentials to true instead of explicitly set Credential. (Maybe you think you are accessing the server with the Credentials you are setting but that's not the case? That would be possible if this works.)
This is a very common scenario, so I would focus on IIS authorization rules for the directory in which you are trying to upload the file, the actual ACL's on that directory. For ex. is your site impersonating or not? if it is, then you have to have actual ACL's on that dir, otherwise whatever account app pool is running on.