Chapter 10. Security

This chapter is all about security from both an authentication and an authorization perspective. By the end of this chapter, you'll know how to configure Alfresco to authenticate against LDAP, how to set up Single Sign-On (SSO), and how to work with Alfresco's security services. Specifically, you are going to learn how to:

• Install a basic OpenLDAP implementation

• Configure Alfresco to authenticate against LDAP, including "chaining" LDAP with Alfresco authentication

• Configure LDAP synchronization

• Install and configure a popular open source SSO solution from JA-SIG called CAS

• Establish SSO between Alfresco and two of Tomcat's sample servlets

• Create users and groups with the Alfresco API

• Understand the out-of-the-box permissions

• Define a custom permission group or role, which you will then leverage to refactor how the SomeCo Web Enable/Disable links work

Authenticating and synchronizing with LDAP

Most production Alfresco implementations use something other than Alfresco to authenticate. That's because many enterprises already have a central user directory, and it makes a lot of sense to have Alfresco take advantage of that. There are almost as many different approaches to authentication as there are applications. Microsoft shops will often run NTLM or Kerberos authentication, both of which are supported by Alfresco. Most of the time, though, companies store users in one or more LDAP directories and then configure applications to authenticate against those directories.

In this chapter, the directions refer to OpenLDAP. There are other open source LDAP servers available such as Fedora Directory Server and Apache Directory. Proprietary directory servers also work with Alfresco. The most common one is Microsoft Active Directory, but others such as Sun ONE Directory Server and Novell eDirectory are known to work with Alfresco as well.

Step-by-step...

Setting up Single Sign-On (SSO)

If multiple applications in the enterprise use the same LDAP server to authenticate, why force your users to re-enter the same username and password just because they are moving from one application to another? The answer, as usual, is time and money. However, implementing a Single Sign-On (SSO) solution and configuring Alfresco to leverage it may be easier than you think.

There are many SSO providers available and specific implementations can vary dramatically from company to company. In the next exercise, you'll install an open source SSO server called CAS from JA-SIG, and then configure Alfresco to use it. This should give you just enough of a taste of SSO to determine if it makes sense in your organization and what might be involved for a full production rollout, whether using CAS or some other SSO package.

Step-by-step - implementing SSO

This exercise involves downloading, installing, and configuring a base install of CAS, then installing and configuring...

Working with security services

The first part of this chapter was about authentication, or knowing who the user is. This section is about authorization, which is about specifying what the user can do once he/she is authenticated. First, you'll see how to secure the admin user and give additional users admin rights. Then you'll learn how to use Alfresco's security services classes to create users and groups with the API. And finally, you'll see how to declare your own custom permission groups when the out-of-the-box permission groups don't meet your needs.

Securing the admin user

As you and everyone else in the world knows, the default password for Alfresco's admin account is admin. If you use the installer, it will prompt you for a password. If you are using Alfresco for authentication (and even if you aren't), you should change the password for the admin user after you set up your Alfresco instance. If you use LDAP or some other source for authentication and create an entry in the directory...

Summary

When you started out the chapter, you had an Alfresco server that only knew about the users stored in its repository. By now, your server is not only authenticating against an external LDAP directory, but can also share a session with other web applications through the magic of Single Sign-On (SSO).

You saw some sample code for working with three of Alfresco's security services classes (AuthenticationService, AuthorityService, and PersonService) and also learned where Alfresco keeps its permission definitions (and how to extend them).

Specifically, you learned how to:

• Install a basic OpenLDAP implementation

• Configure Alfresco to authenticate against LDAP, including "chaining" LDAP with Alfresco authentication

• Configure LDAP synchronization

• Install and configure a popular open source SSO solution from JA-SIG called CAS

• Establish SSO between Alfresco and two of Tomcat's sample servlets

• Create users and groups with the Alfresco API

• Understand the out-of-the-box permissions

• Define a custom permission...