Problems with AutoLogin

[Karthik Baskaran, geändert vor 11 Jahren.]

Hi All,

I have implemented AutoLogin in Liferay 6.0.1. My use-case is to validate the user id which is set in http header (authenticated by an external ldap) and then automtically login the user into liferay without validating the users credentials (password). The code works fine, however I was not able to logout after AutoLogin and also not able to login directly into liferay. Below is my code...

public class AutoLoginAction implements AutoLogin {

	public String[] login(HttpServletRequest request,
			HttpServletResponse response) throws AutoLoginException {
		String[] credentials = new String[3];
		String screenName = null;
		String role = null;
		long userId = 0;
		long companyId = 0;

		screenName = request.getHeader("REMOTE_USER");
		role = request.getHeader("REMOTE_USER_ROLE");
		
		HttpSession httpSession = request.getSession();
		httpSession.setAttribute("USER_ROLE", role);

		try {
			Company company = CompanyLocalServiceUtil.getCompanyByWebId("liferay.com");
			Role adminRole = RoleLocalServiceUtil.getRole(company.getCompanyId(), "Administrator");
			List<user> adminUsers = UserLocalServiceUtil.getRoleUsers(adminRole.getRoleId());
			PermissionChecker permissionChecker = PermissionCheckerFactoryUtil.create(adminUsers.get(0), true);
			PermissionThreadLocal.setPermissionChecker(permissionChecker);

			companyId = company.getCompanyId();
			userId = UserServiceUtil.getUserIdByScreenName(companyId, screenName);
		} catch (Exception e) {
			e.printStackTrace();
		}

		credentials[0] = String.valueOf(userId);
		credentials[1] = "undefined";
		credentials[2] = Boolean.FALSE.toString();

		return credentials;
	}
}</user>

liferay-hook.xml

<hook>
	<portal-properties>portal.properties</portal-properties>
</hook>

portal.properties

auto.login.hooks=com.login.AutoLoginAction

Thanks
Karthik

[Siby Mathew, geändert vor 11 Jahren.]

Hi Karthik,
You can create a LogoutFilter for this.
Create a class extending com.liferay.portal.kernel.servlet.BaseFilter
Override processFilter() method and do a session invalidate :

 @Override
    protected void processFilter(final HttpServletRequest request, final HttpServletResponse response,
            final FilterChain filterChain) throws Exception {
         request.getSession().invalidate();
}

Add the following in your liferay-hook.xml

	<servlet-filter>
		<servlet-filter-name>My Logout Filter</servlet-filter-name>
		<servlet-filter-impl>com.mycompany.portal.servlet.filters.MyLogoutFilter</servlet-filter-impl>
	</servlet-filter>
	<servlet-filter-mapping>
		<servlet-filter-name>My Logout Filter</servlet-filter-name>
		<url-pattern>/c/portal/logout</url-pattern>
		<dispatcher>FORWARD</dispatcher>
		<dispatcher>REQUEST</dispatcher>
	</servlet-filter-mapping>

Hope that helps !

Thanks,
Siby Mathew

[Karthik Baskaran, geändert vor 11 Jahren.]

Hi,

I tried the filter approach. Now i get a blank page on clicking the logout link in liferay. So not able to test the other issue i had of trying to login normally into liferay.

Thanks
Karthik

[Siby Mathew, geändert vor 11 Jahren.]

Hi Karthik,
Can you try adding a response.sendRedirect(yourloginpage) to the method ?

Thanks,
Siby

[Karthik Baskaran, geändert vor 11 Jahren.]

Yes adding response.sendRedirect(yourloginpage) to the LogoutFilter did the trick.

Thanks
Karthik

[Siby Mathew, geändert vor 11 Jahren.]

Great Karthik !
Please mark as answer and change title to SOLVED.

Thanks,
Siby

[Bart Simpson, geändert vor 11 Jahren.]

You were able to logout , but since the autologin gets called a number of time in a request, your code

screenName = request.getHeader("REMOTE_USER");

find the screenName and logs the user in again.
So you probably have to think of a better approach on how to achieve this.

[Karthik Baskaran, geändert vor 11 Jahren.]

Hi Simpson,

Bart Simpson:

You were able to logout , but since the autologin gets called a number of time in a request, your code

screenName = request.getHeader("REMOTE_USER");

find the screenName and logs the user in again.
So you probably have to think of a better approach on how to achieve this.

Can you suggest me a feasible approach to this ?

Thanks
Karthik

[Karthik Baskaran, geändert vor 11 Jahren.]

Hi All,

Can any one please suggest me a better approach to this problem ?

Thanks
Karthik

[Bart Simpson, geändert vor 11 Jahren.]

If you have to do it via a header value, may be you could set another parameter in request or session once you are done with logout, and each autologin could check this value if present then don't login.
Another approach could be to use the cookies for pass the 'remote user' and then remove cookie on logout (perhaps in properties hook for logout.events.pre=)

Let me know if you need any help in following these.