Page Comparison

...

One of the challenges you may face in this integration is the LDAP Users/Groups import. You can connect an LDAP to the Liferay. However, however, to authenticate users to Liferay against the underlying LDAP, it has to import all the users and groups to Liferay's underlying database, which is by default running on Hypersonic.

Since , we you only need to keep the user data in a single LDAP , we wanted to avoid this duplication. However, it was not as easy as we thought. If you need to avoid that, then we this is not straightforward as you need to write the complete persistence layer. To understand this better, I guess I need to elaborate more this. Let's take a step back and see how in fact Authentication and Authorization work in Liferay.

Liferay has a chain of authenticators. When you enter your username/password, the chain of authenticators will get are invoked. This is the place where we plugged in the WSO2ISAuthenticator.

The above configuration (which should be in the liferay_home/tomcat/webapps/ROOT/WEB-INF/classes/portal-ext.properties file) tells Liferay to load our custom authenticator. Also, the second entry says, once loaded our authenticatorindicates that once the authenticator is loaded, do not invoke the rest in the chain. Otherwise, the default Liferay authenticator will is also get invoked. Third entry points to the AuthenticationAdmin service running in WSO2 Identity Server.

Now, the username /password go in to and password goes into the WSO2ISAuthenticator and it will talk to communicates with WSO2 Identity Server over SOAP to authenticate the user. Once authentication is done, the control is once again will be passed in to into the Liferay container.

Now is the tricky part. Liferay has it's own permission model - who should be able to see portlets, who should be able to add portlets likewisewhich enables you to view or add portlets depending on your permissions. For this, it needs to find which Liferay roles are attached to the logged in user or which Liferay roles are attached to any group the logged in user belongs to. To get these details, it needs to talk to communicate with the underlying persistence layer - which will load loads details from Liferay's underlying database. This is why we wanted it is useful to have users imported here from the LDAP.

Even - though it 's is possible, we it was decided not to write a persistence layer - but only to override authentication and authorization as that is sufficient for this scenario.

Even in the case of authorization - ; there are two types.

1. The authorization model governed by Liferay to display/add portlets to the portal.
2. The authorization model used within the Portlet

...

1. itself to display content within the portlet.

The first type is done by assigning portlet management permissions to a given Liferay role and assigning members [(groups/users] ) to that role from the underlying LDAP. We did not want to do that . Because, that is very much on as that has more to do with the portal administration side - and as a result, much more specific to Liferay. But - However, the second model - is the one that directly deals with the business functions. That is what we wanted to do in a findIt was decided that this is a better option and it is used in a fine-grained manner.

Let's dig more deep in to this...

Even the second model can be done with Liferay's roles and permission. Whenever you want to render something in the portlet that requires some restricted audience, then before rendering that you need to call req.isUserInRole("roleNme"). This is compliant with the JSR too. But The following are the disadvantages are..:

1. Our business functionalities in an SOA deployment should not be governed by Liferay roles. Liferay could only be a single channel to access the business functions.
2. We can achieve only the role based access control with this model.

Liferay, also has it's own way of permission checking, which is within a portlet via the PermissionChecker API. See here for further more details on the PermissionChecker.

Our approach was to write a utility function called hasPermission(). If you extend your portlet from org.wso2.liferay.xacml.connector.SecuredGenericPortlet then this is automatically available for to you. Alternatively you can directly call it through AuthzChecker.hasPermission(). These functions are available from the org.wso2.liferay.xacml.connector.jar file.

...