Is there any way to get username and password in post/pre login event?

[Antonio Javier Ortega Pérez, modificado 6 Anos atrás.]

Hi, I’m woking with Liferay 7 CE and I need to integrate my portal with an external system and I need the credentials used in login. I made pre and post login event but I couldn’t find any way to get the plain password.

I would prefer not to store username and password in session with the property “session.store.password=true” because I will only need once.

¿Is there any way to achieve this?

Thanks in advance.

[David H Nebinger, modificado 6 Anos atrás.]

The password is never retained after successful authentication w/o that property setting. It is seen as a security violation and an attack vector.

It sounds more like you need some sort of auth verifier implementation instead.










Come meet me at 2017 LSNA!

[Antonio Javier Ortega Pérez, modificado 6 Anos atrás.]

Hi David, thanks for the answer, is what I supposed, and yes, storing username / password in memory is a security risk.

What I am trying to do is to assign roles or groups after user login, querying information in another system, and to access that system I need the login and password.

I will do an auth verifier.

Thanks!

[David H Nebinger, modificado 6 Anos atrás.]

Antonio Javier Ortega Pérez:

What I am trying to do is to assign roles or groups after user login, querying information in another system, and to access that system I need the login and password.

Normally for this kind of thing you want one system (Liferay) to have a set of credentials so it can log into another system (your other system of record). We rarely want to use the actual user credentials to form that bridge.








Come meet me at 2017 LSNA!

[Jagan Mohan Jayaraman, modificado 6 Anos atrás.]

Antonio Javier Ortega Pérez:

What I am trying to do is to assign roles or groups after user login, querying information in another system, and to access that system I need the login and password.

I will do an auth verifier.

Hi Antonio,

Either you will have to set up some kind of SSO between the two systems, so that once the user is authenticated in Liferay, he/she is also automatically authenticated to the downstream system so that you can query it.

If you own the downstream system too, then you could consider having a web service there that will return the information you want when you send it a user name/email/screen name.

Otherwise you will need to have some fixed set of credentials in your portal that you will use to authenticate every request to the downstream system, as David has suggested.