首页 > 代码库 > Liferay7 BPM门户开发之32: 实现自定义认证登陆（定制Authentication Hook）

Liferay7 BPM门户开发之32: 实现自定义认证登陆（定制Authentication Hook）

2024-08-20 06:20:10   213人阅读

优秀的平台必然松耦合、易扩展  -- 王昕

第一步：修改liferay-hook.xml

<?xml version="1.0"?><!DOCTYPE hook PUBLIC "-//Liferay//DTD Hook 6.2.0//EN" "http://www.liferay.com/dtd/liferay-hook_6_2_0.dtd"><hook><portal-properties>portal.properties</portal-properties></hook>

 

如果是liferay7则不需要这一步，只需要注解：

@Component(immediate = true, property = {"key=auth.pipeline.pre"},service = Authenticator.class)

 


第二步：配置认证属性portal.properties

auth.pipeline.pre=com.proliferay.YourAuthenticator


配置auth.pipeline.post 还将进行密码检查，liferay的内部机制是2级检查，一级是身份认证，二级是密码检查，实际上可以通过SKIP_LIFERAY_CHECK来统一处理

 

第三步：开发定制的认证类

import java.util.Map;import com.liferay.portal.security.auth.AuthException;import com.liferay.portal.security.auth.Authenticator; public class YourAuthenticator implements Authenticator {     @Override    public int authenticateByEmailAddress(long companyId, String emailAddress,            String password, Map<String, String[]> headerMap,            Map<String, String[]> parameterMap) throws AuthException {                 /**         * 这里是认证的逻辑         */                 return SKIP_LIFERAY_CHECK;    }     @Override    public int authenticateByScreenName(long companyId, String screenName,            String password, Map<String, String[]> headerMap,            Map<String, String[]> parameterMap) throws AuthException {         return DNE;    }     @Override    public int authenticateByUserId(long companyId, long userId,            String password, Map<String, String[]> headerMap,            Map<String, String[]> parameterMap) throws AuthException {        return DNE;    } }

 


常数定义：

  • public static final int DNE = 0; //用户不存在
  • public static final int FAILURE = -1;//认证失败
  • public static final int SKIP_LIFERAY_CHECK = 2;
  • public static final int SUCCESS = 1;

要注意SKIP_LIFERAY_CHECK和SUCCESS的区别，通过SKIP_LIFERAY_CHECK来统一处理身份认证，跳过门户的密码检查，如果返回SUCCESS，则必须配合auth.pipeline.post来进行密码检查。
通过图来说明：

 技术分享


一个具体的例子：

集成Apache Shiro的认证登陆

import com.liferay.portal.kernel.log.Log;import com.liferay.portal.kernel.log.LogFactoryUtil;import com.liferay.portal.kernel.security.auth.AuthException;import com.liferay.portal.kernel.security.auth.Authenticator;import java.util.Map;import org.apache.shiro.SecurityUtils;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.UsernamePasswordToken;import org.apache.shiro.config.IniSecurityManagerFactory;import org.apache.shiro.mgt.SecurityManager;import org.apache.shiro.subject.Subject;import org.apache.shiro.util.Factory;import org.osgi.service.component.annotations.Activate;import org.osgi.service.component.annotations.Component;@Component(    immediate = true, property = {"key=auth.pipeline.pre"},    service = Authenticator.class)public class ShiroAuthenticatorPre implements Authenticator {    @Activate    public void activate() {        Factory<SecurityManager> factory = new IniSecurityManagerFactory(            "classpath:userauth.ini"); //shiro配置文件        SecurityUtils.setSecurityManager(factory.getInstance());        if (_log.isInfoEnabled()) {            _log.info("activate");        }    }    @Override    public int authenticateByEmailAddress(            long companyId, String emailAddress, String password,            Map<String, String[]> headerMap, Map<String, String[]> parameterMap)        throws AuthException {        if (_log.isInfoEnabled()) {            _log.info("authenticateByEmailAddress");        }        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(            emailAddress, password);        Subject currentUser = SecurityUtils.getSubject();        try {            //shiro的代理登陆            currentUser.login(usernamePasswordToken);            boolean authenticated = currentUser.isAuthenticated();            if (authenticated) {                if (_log.isInfoEnabled()) {                    _log.info("authenticated");                }                return SKIP_LIFERAY_CHECK; //认证通过            }            else {                return FAILURE;            }        }        catch (AuthenticationException ae) {            _log.error(ae.getMessage(), ae);            throw new AuthException(ae.getMessage(), ae);        }    }    @Override    public int authenticateByScreenName(            long companyId, String screenName, String password,            Map<String, String[]> headerMap, Map<String, String[]> parameterMap)        throws AuthException {        if (_log.isInfoEnabled()) {            _log.info("authenticateByScreenName  - not implemented ");        }        return SUCCESS;    }    @Override    public int authenticateByUserId(            long companyId, long userId, String password,            Map<String, String[]> headerMap, Map<String, String[]> parameterMap)        throws AuthException {        if (_log.isInfoEnabled()) {            _log.info("authenticateByScreenName  - not implemented ");        }        return SUCCESS;    }    private static final Log _log = LogFactoryUtil.getLog(        ShiroAuthenticatorPre.class);}

 

 apache shiro框架结构

技术分享

apache shiro是一套非常著名的安全框架，提供了认证、授权、加密和会话管理功能
了解更多apache shiro的知识：http://www.infoq.com/cn/articles/apache-shiro

Authentication的Token令牌机制
了解更多Authentication Token：https://web.liferay.com/zh/community/wiki/-/wiki/Main/Authentication+Token

Token令牌是为了避免CSRF跨站伪造。
了解更多CSRF：https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

 

定义认证失败的扩展处理

import com.liferay.portal.kernel.exception.PortalException;import com.liferay.portal.kernel.log.Log;import com.liferay.portal.kernel.log.LogFactoryUtil;import com.liferay.portal.kernel.model.User;import com.liferay.portal.kernel.security.auth.AuthException;import com.liferay.portal.kernel.security.auth.AuthFailure;import com.liferay.portal.kernel.service.UserLocalServiceUtil;import java.util.Map;import org.osgi.service.component.annotations.Component;@Component(    immediate = true, property = {"key=auth.failure"},    service = AuthFailure.class)public class LogAuthFailure implements AuthFailure {    @Override    public void onFailureByEmailAddress(            long companyId, String emailAddress,            Map<String, String[]> headerMap, Map<String, String[]> parameterMap)        throws AuthException {        try {            User user = UserLocalServiceUtil.getUserByEmailAddress(                companyId, emailAddress);            int failures = user.getFailedLoginAttempts();            if (_log.isInfoEnabled()) {                _log.info(                    "onFailureByEmailAddress: " + emailAddress +                        " has failed to login " + failures + " times");            }        }        catch (PortalException pe) {        }    }    @Override    public void onFailureByScreenName(            long companyId, String screenName, Map<String, String[]> headerMap,            Map<String, String[]> parameterMap)        throws AuthException {        try {            User user = UserLocalServiceUtil.getUserByScreenName(                companyId, screenName);            int failures = user.getFailedLoginAttempts();            if (_log.isInfoEnabled()) {                _log.info(                    "onFailureByScreenName: " + screenName +                        " has failed to login " + failures + " times");            }        }        catch (PortalException pe) {        }    }    @Override    public void onFailureByUserId(            long companyId, long userId, Map<String, String[]> headerMap,            Map<String, String[]> parameterMap)        throws AuthException {        try {            User user = UserLocalServiceUtil.getUserById(userId);            int failures = user.getFailedLoginAttempts();            if (_log.isInfoEnabled()) {                _log.info(                    "onFailureByUserId: userId " + userId +                        " has failed to login " + failures + " times");            }        }        catch (PortalException pe) {        }    }    private static final Log _log = LogFactoryUtil.getLog(LogAuthFailure.class);}

 

Liferay7 BPM门户开发之32: 实现自定义认证登陆（定制Authentication Hook）


联系
我们