Pre-Login hook : pre-authentication & LDAP bind, possible ?

[M. Garcia，修改在12 年前。]

Hello,

I'm trying to build a pre-login hook which would basically, using JNDI :

• get the user/pwd from the Liferay login form (possible with session.store.password=true)
• authentify the user with this credentials on a remote AD/ADAM
• push/update user's info from this AD/ADAM into an LDAP server used by Liferay for authentication

So I created my pre-login Action (login.events.pre=com.engis.auth.MyAuthentificationAction), expecting this hook to be run AND THEN Liferay to authenticate on the LDAP with the freshly pushed user information.

But right now, if I create a user in my remote ADAM and try to log in Liferay, the hook is not run and I just get the double message in the login portlet "You have entered invalid data. Please try again." + "Authentication failed. Please try again.".

It seems to me that Liferay wants to log the user in before the hook does the user's authentication on the remote AD and pushes information on the LDAP used by Liferay.

NB :

• the hook works well when the user is already created in the LDAP used by Liferay : remote authentication, LDAP attributes update.
• i'm raised LDAP authentication errors from Liferay BEFORE my hook runs....

Can anyone confirm me that Liferay actually DOES authenticate BEFORE running so-called "pre-login events/actions" ?

Thanks a lot !

[David H Nebinger，修改在12 年前。]

Yep, that's pretty much it.

You're going to have to pursue a different path, basically hooking the authentication process to do what you are looking for.

Is there some reason you're not letting Liferay import the LDAP/AD stuff automagically? OOTB it should be able to import your AD stuff on it's own rather than trying to do it on demand manually...

[M. Garcia，修改在12 年前。]

Thanks David,

Well you're right we could import from ADs for Liferay login. The thing is we need to build a centralized LDAP from those ADs for other servers/softwares which we can't configure to use several LDAPs.

So, Liferay could use the several ADs for authentication, and the hook I'm making should only export to a centralized AD post/pre-login.

I would like to understand, if authentication is done before pre-login events, what's the difference between pre and post login in Liferay ?

Thanks