在Activiti BPM rest-webapp中设置自定义rest-authenticator

Question

we want to implement SSO in the Activiti BPM REST-API 5.15. I followed exactly the description of the Activiti documentation to disable the build in basic authentication: http://www.activiti.org/userguide/#N12F8B The goal is to replace the build in basic authentication of the REST-API with our own SSO-Logic.

Therefore, we need to disable the build in rest basic authentication. To achieve this, I created a subclass of org.activiti.rest.service.application.ActivitiRestServicesApplication that implements the method boolean requestRequiresAuthentication(Request request) of the custom org.activiti.rest.common.filter.RestAuthenticator interface. Always returning false disables the basic authentication in theory. I addition, I read this post: http://forums.activiti.org/content/issue-custom-restauthenticator-using-rest-513

Here is my class:

package org.activiti.rest.service.application;

import org.restlet.Request;
import org.restlet.data.Form;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESedeKeySpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

import org.activiti.engine.identity.User;
import org.activiti.engine.impl.identity.Authentication;
import org.apache.commons.codec.binary.Base64;

import java.security.Key;
import java.security.MessageDigest;
import java.security.spec.KeySpec;
import java.util.Arrays;
import java.util.Date;

import org.activiti.rest.common.api.ActivitiUtil;
import org.activiti.rest.common.filter.RestAuthenticator;

public class CustomActivitiRestServicesApplication extends ActivitiRestServicesApplication implements RestAuthenticator {

    protected String ltpaKey;
    protected String ltpaPassword;

    private static final String AES_DECRIPTING_ALGORITHM = "AES/CBC/PKCS5Padding";
    private static final String DES_DECRIPTING_ALGORITHM = "DESede/ECB/PKCS5Padding";
    private static final String LTPA_COOKIE_NAME = "LtpaToken2";
    String ltpaToken = null;

    @Override
    public boolean requestRequiresAuthentication(Request request) {

           //LTPA-Encrypt-Logic
          //Authentication.setAuthenticatedUserId(user.getId());
        return false;
    }

    @Override
    public boolean isRequestAuthorized(Request request) {
        // TODO Auto-generated method stub
        return false;
    }
}

In addition, I altered the web.xml of the activiti-webapp-rest2, that it points to my custom implementation:

<!-- Restlet adapter -->  
  <servlet>  
    <servlet-name>RestletServlet</servlet-name>  
    <servlet-class>org.restlet.ext.servlet.ServerServlet</servlet-class>
    <init-param>
      <!-- Application class name -->
      <param-name>org.restlet.application</param-name>
      <param-value>org.activiti.rest.service.application.CustomActivitiRestServicesApplication</param-value>
    </init-param>
  </servlet>

The Problem is, that this takes no effekt. After redeploying, the rest-api still wants to have basic credentials and I have no idea, why.

Any reply is appreciated. I googled a lot but without success.

UPDATE: Maybe, this class could be helpful to set the custom REST-Authenticator: org.activiti.rest.common.application.ActivitiRestApplication

there you can find the method:

// Set authenticator as a NON-optional filter. If certain request require no authentication, a custom RestAuthenticator
// should be used to free the request from authentication.
authenticator = new ChallengeAuthenticator(null, true, ChallengeScheme.HTTP_BASIC,
      "Activiti Realm") {

  @Override
  protected boolean authenticate(Request request, Response response) {

    // Check if authentication is required if a custom RestAuthenticator is set
    if(restAuthenticator != null && !restAuthenticator.requestRequiresAuthentication(request)) {
      return true;
    }

    if (request.getChallengeResponse() == null) {
      return false;
    } else {
      boolean authenticated = super.authenticate(request, response);
      if(authenticated && restAuthenticator != null) {
        // Additional check to see if authenticated user is authorised. By default, when no RestAuthenticator
        // is set, a valid user can perform any request.
        authenticated = restAuthenticator.isRequestAuthorized(request);
      }
      return authenticated;
    }
  }
};
authenticator.setVerifier(verifier);

}

But I still do not understand how to "set" my custom rest authenticator. Any help is more than welcome Thanks a lot, Ben

Answer 1

I believe your problem is that you still have the authentication filter defined in the createInboundRoot() method (since it doesnt appear as though you overrode that method).

@Override public synchronized Restlet createInboundRoot() { initializeAuthentication();

Router router = new Router(getContext());
router.attachDefault(DefaultResource.class);
RestServicesInit.attachResources(router);

JsonpFilter jsonpFilter = new JsonpFilter(getContext());
**authenticator.setNext(jsonpFilter);
jsonpFilter.setNext(router);**

// Get hold of JSONConverter and enable ISO-date format by default
List<ConverterHelper> registeredConverters = Engine.getInstance().getRegisteredConverters();
for(ConverterHelper helper : registeredConverters) {
  if(helper instanceof JacksonConverter) {
    JacksonConverter jacksonConverter = (JacksonConverter) helper;
    jacksonConverter.getObjectMapper().configure(SerializationConfig.Feature.WRITE_DATES_AS_TIMESTAMPS, false);
  }
}
**return authenticator;**

}

You should remove the authentication filter, or, better still, create your own filter for use with Websphere (since you are using LTPA tokens, I assume you are using Websphere as the container).

Let me know if I can be of any further help.

Thanks, Greg Harley - BP3

Answer 2

I solved it this way:

1.) Create the class org.activiti.rest.common.filter.RestAuthenticatorImpl.java which implements the method public boolean requestRequiresAuthentication(Request request)

2.) Set your custom RestAuthenticator in org.activiti.rest.common.application.ActivitiRestApplication.java like this:

In the Constructor public ActivitiRestApplication(), add these lines of code:

restAuthenticator = new RestAuthenticatorImpl();
setRestAuthenticator(restAuthenticator);

Greg, thanks for your suggestions!