Commit 3b969b91 authored by Frank Bergmann's avatar Frank Bergmann

Initial Import

parents
<?xml version="1.0"?>
<!-- Generated by the OpenACS Package Manager -->
<package key="acs-authentication" url="http://openacs.org/repository/apm/packages/acs-authentication" type="apm_service">
<package-name>Authentication</package-name>
<pretty-plural>Authentication</pretty-plural>
<initial-install-p>t</initial-install-p>
<singleton-p>t</singleton-p>
<version name="5.1.5" url="http://openacs.org/repository/download/apm/acs-authentication-5.1.5.apm">
<owner url="mailto:lars@collaboraid.biz">Lars Pind</owner>
<summary>Authentication, account management, and related functionality.</summary>
<release-date>2004-02-28</release-date>
<maturity>3</maturity>
<vendor url="http://www.collaboraid.biz">Collaboraid</vendor>
<description format="text/html">Implements authentication-related security functions for OpenACS, including password, account and session management, bulk account creation etc. Provides a contract based interface for different authentication methods such as PAM or LDAP based authentication.</description>
<provides url="acs-authentication" version="5.1.4"/>
<requires url="acs-kernel" version="5.0"/>
<requires url="acs-service-contract" version="5.0.0"/>
<callbacks>
<callback type="after-install" proc="auth::package_install"/>
<callback type="after-upgrade" proc="auth::after_upgrade"/>
<callback type="before-uninstall" proc="auth::package_uninstall"/>
</callbacks>
<parameters>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="AcknowledgementFileName" default="{acs_root_dir}/batch-sync-ack-{authority}-{ansi_date}.xml" description="Full file path to where we should drop the acknowledgement file for batch syncs. You can use these special values: {acs_root_dir} will get replaced with the root directory for this OpenACS installation, e.g. '/var/lib/aolserver/service0' (no trailing slash). {ansi_date} will get replaced with today's date in ANSI format, e.g. '2003-10-29'. {authority} will get replaced with the short_name of the authority, e.g. 'rz_pam'." section_name="Batch Synchronization"/>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="KeepBatchLogDays" default="0" description="The number of days to keep the log for a batch user synchronization job around. Say 0 if you want to keep the log forever." section_name="Batch Synchronization"/>
<parameter datatype="string" min_n_values="1" max_n_values="1" name="RegisterAuthority" default="local" description="The short name of the authority in which users are registered. Is best set in the Authentication admin UI."/>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="SyncAddUsersToDotLrnP" default="0" description="Should we add users to .LRN? This requires .LRN to be installed, and has serious performance implications." section_name="Batch Synchronization"/>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="SyncDotLrnAccessLevel" default="1" description=".LRN access level (if .LRN is installed). 1 = Full access user, 0 = Limited access user" section_name="Batch Synchronization"/>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="SyncDotLrnReadPrivateDataP" default="1" description=".LRN user is guest (if .LRN is installed). 1 = Not a guest , 0 = Guest" section_name="Batch Synchronization"/>
<parameter datatype="string" min_n_values="1" max_n_values="1" name="SyncDotLrnUserType" default="student" description=".LRN user type for new user (if .LRN is installed)" section_name="Batch Synchronization"/>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="SyncEmailConfirmationP" default="0" description="Send out email confirmation when batch sync is complete. 1 = Yes, 0 = No." section_name="Batch Synchronization"/>
<parameter datatype="number" min_n_values="1" max_n_values="1" name="AllowSelfRegister" default="1" description="Does the user can self register? 1 = Yes, 0 = No." section_name="acs-authentication"/>
</parameters>
</version>
</package>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="ar_LB" charset="utf-8">
<msg key="Invalid_username_or_password">الاسم او كلمة السر غير صحيحة</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="ca_ES" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Usuari o contrasenya erroni </msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="da_DK" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Ugyldigt brugernavn eller kodeord</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="de_DE" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Benutzeridentifikation oder Passwort ist falsch</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="en_AU" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Invalid username or password</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="en_US" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Invalid username or password</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="es_CO" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Usuario o contrasea invalido</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="es_ES" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Usuario o contrasea erroneo</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="es_GT" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Usuario o contrasea invalido</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="eu_ES" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">izen edo pasahitz okerra</msg>
</message_catalog>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="fa_IR" charset="utf-8">
<msg key="Invalid_username_or_password">نام کاربری یا کلمه عبور صحیح نیست</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="fr_FR" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Nom d'utilisateur ou mot de passe incorrect</msg>
</message_catalog>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="hu_HU" charset="utf-8">
<msg key="Invalid_username_or_password">Érvénytelen felhasználónév vagy jelszó</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="it_IT" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Nome utente o password non sono corretti</msg>
</message_catalog>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="ms_MY" charset="utf-8">
<msg key="Invalid_username_or_password">Nama pengguna atau kata laluan tidak sah</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="nl_NL" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Ongeldige gebruikersnaam of wachtwoord</msg>
</message_catalog>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="pl_PL" charset="utf-8">
<msg key="Invalid_username_or_password">Nieprawidłowe hasło lub nazwa użytkownika</msg>
</message_catalog>
<?xml version="1.0" encoding="ISO-8859-1"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="pt_BR" charset="ISO-8859-1">
<msg key="Invalid_username_or_password">Nome ou senha invlidos</msg>
</message_catalog>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="zh_CN" charset="utf-8">
<msg key="Invalid_username_or_password">错误的用户名或密码</msg>
</message_catalog>
<?xml version="1.0" encoding="utf-8"?>
<message_catalog package_key="acs-authentication" package_version="5.1.2d2" locale="zh_TW" charset="utf-8">
<msg key="Invalid_username_or_password">無效的使用者名稱或密碼</msg>
</message_catalog>
--
-- Data model for acs-authentication
--
-- $Id$
--
@@ batch-job-tables-create.sql
--
-- Drop script for acs-authentication
--
-- $Id$
--
@@ batch-job-tables-drop.sql
create sequence auth_batch_jobs_job_id_seq;
create table auth_batch_jobs (
job_id integer
constraint auth_batch_jobs_pk
primary key,
job_start_time date default sysdate,
job_end_time date,
interactive_p char(1)
constraint auth_batch_jobs_interactive_ck
check (interactive_p in ('t', 'f'))
constraint auth_batch_jobs_interactive_nn
not null,
snapshot_p char(1)
constraint auth_batch_jobs_snapshot_ck
check (snapshot_p in ('t', 'f')),
authority_id integer
constraint auth_batch_jobs_auth_fk
references auth_authorities(authority_id)
on delete cascade,
message varchar2(4000),
-- if interactive, by which user
creation_user integer
constraint auth_batch_job_user_fk
references users(user_id)
on delete set null,
-- status information for the GetDocument operation
doc_start_time date,
doc_end_time date,
doc_status varchar2(4000),
doc_message varchar2(4000),
document clob
);
create index auth_batch_jobs_user_idx on auth_batch_jobs(creation_user);
create index auth_batch_jobs_auth_idx on auth_batch_jobs(authority_id);
create sequence auth_batch_job_entry_id_seq;
create table auth_batch_job_entries (
entry_id integer
constraint auth_batch_job_entries_pk
primary key,
job_id integer
constraint auth_batch_job_entries_job_fk
references auth_batch_jobs(job_id)
on delete cascade,
entry_time date default sysdate,
operation varchar(100)
constraint auth_batch_jobs_entries_op_ck
check (operation in ('insert', 'update', 'delete')),
username varchar(100),
user_id integer
constraint auth_batch_job_entries_user_fk
references users(user_id) on delete set null,
success_p char(1)
constraint auth_batch_jobs_ent_success_ck
check (success_p in ('t', 'f'))
constraint auth_batch_jobs_ent_success_nn
not null,
message varchar2(4000),
element_messages clob
);
create index auth_batch_job_ent_job_idx on auth_batch_job_entries(job_id);
create index auth_batch_job_ent_user_idx on auth_batch_job_entries(user_id);
drop sequence auth_batch_jobs_job_id_seq;
drop sequence auth_batch_job_entry_id_seq;
drop table auth_batch_job_entries;
drop table auth_batch_jobs;
--
-- Data model for acs-authentication
--
-- $Id$
--
\i batch-job-tables-create.sql
--
-- Drop script for acs-authentication
--
-- $Id$
--
\i batch-job-tables-drop.sql
create sequence auth_batch_jobs_job_id_seq;
create table auth_batch_jobs (
job_id integer
constraint auth_batch_jobs_pk
primary key,
job_start_time timestamptz default current_timestamp,
job_end_time timestamptz,
interactive_p boolean
constraint auth_batch_jobs_interactive_nn
not null,
snapshot_p boolean,
authority_id integer
constraint auth_batch_jobs_auth_fk
references auth_authorities(authority_id)
on delete cascade,
message text,
-- if interactive, by which user
creation_user integer
constraint auth_batch_job_user_fk
references users(user_id)
on delete set null,
-- status information for the GetDocument operation
doc_start_time timestamptz,
doc_end_time timestamptz,
doc_status text,
doc_message text,
document text
);
create index auth_batch_jobs_user_idx on auth_batch_jobs(creation_user);
create index auth_batch_jobs_auth_idx on auth_batch_jobs(authority_id);
create sequence auth_batch_job_entry_id_seq;
create table auth_batch_job_entries (
entry_id integer
constraint auth_batch_job_entries_pk
primary key,
job_id integer
constraint auth_batch_job_entries_job_fk
references auth_batch_jobs(job_id)
on delete cascade,
entry_time timestamptz default current_timestamp,
operation varchar(100)
constraint auth_batch_jobs_entries_op_ck
check (operation in ('insert', 'update', 'delete')),
username varchar(100),
user_id integer
constraint auth_batch_job_entries_user_fk
references users(user_id) on delete set null,
success_p boolean not null,
message text,
element_messages text
);
create index auth_batch_job_ent_job_idx on auth_batch_job_entries(job_id);
create index auth_batch_job_ent_user_idx on auth_batch_job_entries(user_id);
drop sequence auth_batch_jobs_job_id_seq;
drop sequence auth_batch_job_entry_id_seq;
drop table auth_batch_job_entries;
drop table auth_batch_jobs;
This diff is collapsed.
<?xml version="1.0"?>
<queryset>
<rdbms><type>oracle</type><version>8.1.6</version></rdbms>
<fullquery name="auth::get_user_secret_token.select_secret_token">
<querytext>
select rowid from users where user_id = :user_id
</querytext>
</fullquery>
</queryset>
<?xml version="1.0"?>
<queryset>
<rdbms><type>postgresql</type><version>7.1</version></rdbms>
<fullquery name="auth::get_user_secret_token.select_secret_token">
<querytext>
select oid from users where user_id = :user_id
</querytext>
</fullquery>
</queryset>
This diff is collapsed.
<?xml version="1.0"?>
<queryset>
<rdbms><type>oracle</type><version>8.1.6</version></rdbms>
<fullquery name="auth::authority::create.create_authority">
<querytext>
begin
:1 := authority.new(
authority_id => :authority_id,
short_name => :short_name,
pretty_name => :pretty_name,
enabled_p => :enabled_p,
sort_order => :sort_order,
auth_impl_id => :auth_impl_id,
pwd_impl_id => :pwd_impl_id,
forgotten_pwd_url => :forgotten_pwd_url,
change_pwd_url => :change_pwd_url,
register_impl_id => :register_impl_id,
register_url => :register_url,
help_contact_text => :help_contact_text,
creation_user => :creation_user,
creation_ip => :creation_ip,
context_id => :context_id
);
end;
</querytext>
</fullquery>
<fullquery name="auth::authority::delete.delete_authority">
<querytext>
begin
:1 := authority.del(
delete_authority_id => :authority_id
);
end;
</querytext>
</fullquery>
</queryset>
<?xml version="1.0"?>
<queryset>
<rdbms><type>postgresql</type><version>7.1</version></rdbms>
<fullquery name="auth::authority::create.create_authority">
<querytext>
select authority__new(
:authority_id,
null, -- object_type
:short_name,
:pretty_name,
:enabled_p,
:sort_order,
:auth_impl_id,
:pwd_impl_id,
:forgotten_pwd_url,
:change_pwd_url,
:register_impl_id,
:register_url,
:help_contact_text,
:creation_user,
:creation_ip,
:context_id
);
</querytext>
</fullquery>
<fullquery name="auth::authority::delete.delete_authority">
<querytext>
select authority__del(
:authority_id
);
</querytext>
</fullquery>
</queryset>
This diff is collapsed.
<?xml version="1.0"?>
<queryset>
<fullquery name="auth::authority::get_authority_options.select_authorities">
<querytext>
select pretty_name, authority_id
from auth_authorities
where enabled_p = 't'
and auth_impl_id is not null
order by sort_order
</querytext>
</fullquery>
<fullquery name="auth::authority::get_id_not_cached.select_authority_id">
<querytext>
select authority_id
from auth_authorities
where short_name = :short_name
</querytext>
</fullquery>
</queryset>
<?xml version="1.0"?>
<queryset>
<rdbms><type>oracle</type><version>8.1.6</version></rdbms>
<fullquery name="auth::driver::set_parameter_value.update_parameter">
<querytext>
update auth_driver_params
set value = empty_clob()
where authority_id = :authority_id
and impl_id = :impl_id
and key = :parameter
returning value into :1
</querytext>
</fullquery>
<fullquery name="auth::driver::set_parameter_value.insert_parameter">
<querytext>
insert into auth_driver_params (authority_id, impl_id, key, value)
values (:authority_id, :impl_id, :parameter, empty_clob())
returning value into :1
</querytext>
</fullquery>
</queryset>
<?xml version="1.0"?>
<queryset>
<rdbms><type>postgresql</type><version>7.1</version></rdbms>
<fullquery name="auth::driver::set_parameter_value.update_parameter">
<querytext>
update auth_driver_params
set value = :value
where authority_id = :authority_id
and impl_id = :impl_id
and key = :parameter
</querytext>
</fullquery>
<fullquery name="auth::driver::set_parameter_value.insert_parameter">
<querytext>
insert into auth_driver_params (authority_id, impl_id, key, value)
values (:authority_id, :impl_id, :parameter, :value)
</querytext>
</fullquery>
</queryset>
ad_library {
Procs for driver paramaters service contract implementations.
@author Simon Carstensen (simon@collaobraid.biz)
@creation-date 2003-08-27
@cvs-id $Id$
}
namespace eval auth {}
namespace eval auth::driver {}
#####
#
# auth::driver
#
#####
ad_proc -public auth::driver::get_parameters {
{-impl_id:required}
} {
Returns a list of names of parameters for the driver
@author Simon Carstensen (simon@collaboraid.biz)
@creation-date 2003-08-27
} {
if { [empty_string_p $impl_id] } {
return {}
}
set parameters {}
with_catch errmsg {
set parameters [acs_sc::invoke \
-error \
-impl_id $impl_id \
-operation GetParameters]
} {
global errorInfo
ns_log Error "Error getting parameters for impl_id $impl_id: $errmsg\n$errorInfo"
}
return $parameters
}
ad_proc -public auth::driver::get_parameter_values {
{-authority_id:required}
{-impl_id:required}
} {
Gets a list of parameter values ready to be passed to a service contract implementation.
If a parameter doesn't have a value, the value will be the empty string.
@author Simon Carstensen (simon@collaboraid.biz)
@creation-date 2003-08-27
} {
array set param [list]
db_foreach select_values {
select key, value
from auth_driver_params
where impl_id = :impl_id
and authority_id = :authority_id
} {
set param($key) $value
}
# We need to ensure that the driver gets all the parameters it is asking for, and nothing but the ones it is asking for
set params [list]
foreach { name desc } [get_parameters -impl_id $impl_id] {
if { [info exists param($name)] } {
lappend params $name $param($name)
} else {
lappend params $name {}
}
}
return $params
}
ad_proc -public auth::driver::set_parameter_value {
{-authority_id:required}
{-impl_id:required}
{-parameter:required}
{-value:required}
} {
Updates the parameter value in the database.
@author Simon Carstensen (simon@collaboraid.biz)
@creation-date 2003-08-27
} {
set exists_p [db_string param_exists_p {}]
if { $exists_p } {
db_dml update_parameter {} -clobs [list $value]
} else {
db_dml insert_parameter {} -clobs [list $value]
}
}
ad_proc -public auth::driver::GetParameters {
{-impl_id:required}
} {
Returns a list of names of parameters for the driver
@author Simon Carstensen (simon@collaboraid.biz)
@creation-date 2003-08-27
} {
return [acs_sc::invoke \
-error \
-impl_id $impl_id \
-operation GetParameters]
}
<?xml version="1.0"?>
<queryset>
<fullquery name="auth::driver::set_parameter_value.param_exists_p">
<querytext>
select count(*)
from auth_driver_params
where impl_id = :impl_id
and authority_id = :authority_id
and key = :parameter
</querytext>
</fullquery>
</queryset>
This diff is collapsed.
This diff is collapsed.
ad_library {
Set up scheduled procs for running nightly batch sync, and for purging old logs.
@cvs-id $Id$
@author Lars Pind (lars@collaboraid.biz)
@creation-date 2003-09-09
}
# Schedule old job log purge
ad_schedule_proc \
-thread t \
-schedule_proc ns_schedule_daily \
[list 0 30] \
auth::sync::purge_jobs
# Schedule batch sync sweeper
ad_schedule_proc \
-thread t \
-schedule_proc ns_schedule_daily \
[list 1 0] \
auth::sync::sweeper
<?xml version="1.0"?>
<queryset>
<rdbms><type>oracle</type><version>8.1.6</version></rdbms>
<fullquery name="auth::sync::job::get.select_job">
<querytext>
select job_id,
to_char(job_start_time, 'YYYY-MM-DD HH24:MI:SS') as job_start_time,
to_char(job_end_time, 'YYYY-MM-DD HH24:MI:SS') as job_end_time,
interactive_p,
snapshot_p,
authority_id,
(select aa.pretty_name from auth_authorities aa where aa.authority_id = j.authority_id) as authority_pretty_name,
message,
creation_user,
to_char(doc_start_time, 'YYYY-MM-DD HH24:MI:SS') as doc_start_time,
to_char(doc_end_time, 'YYYY-MM-DD HH24:MI:SS') as doc_end_time,
doc_status,
doc_message,
round((j.job_end_time - j.job_start_time) * 24*60*60) as run_time_seconds,
(select count(e1.entry_id)
from auth_batch_job_entries e1
where e1.job_id = j.job_id) as num_actions,
(select count(e2.entry_id)
from auth_batch_job_entries e2
where e2.job_id = j.job_id
and e2.success_p = 'f') as num_problems
from auth_batch_jobs j
where j.job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::start_get_document.update_doc_start_time">
<querytext>
update auth_batch_jobs
set doc_start_time = sysdate
where job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::end_get_document.update_doc_end">
<querytext>
update auth_batch_jobs
set doc_end_time = sysdate,
doc_status = :doc_status,
doc_message = :doc_message,
document = empty_clob(),
snapshot_p = :snapshot_p
where job_id = :job_id
returning document into :1
</querytext>
</fullquery>
<fullquery name="auth::sync::job::end.update_job_end">
<querytext>
update auth_batch_jobs
set job_end_time = sysdate,
message = :message
where job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::create_entry.insert_entry">
<querytext>
insert into auth_batch_job_entries
(entry_id, job_id, operation, username, user_id, success_p, message, element_messages)
values
(:entry_id, :job_id, :operation, :username, :user_id, :success_p_db, :message, empty_clob())
returning element_messages into :1
</querytext>
</fullquery>
<fullquery name="auth::sync::purge_jobs.purge_jobs">
<querytext>
delete from auth_batch_jobs
where job_end_time < sysdate - :num_days
</querytext>
</fullquery>
</queryset>
<?xml version="1.0"?>
<queryset>
<rdbms><type>postgresql</type><version>7.1</version></rdbms>
<fullquery name="auth::sync::job::get.select_job">
<querytext>
select job_id,
to_char(job_start_time, 'YYYY-MM-DD HH24:MI:SS') as job_start_time,
to_char(job_end_time, 'YYYY-MM-DD HH24:MI:SS') as job_end_time,
interactive_p,
snapshot_p,
authority_id,
(select aa.pretty_name from auth_authorities aa where aa.authority_id = j.authority_id) as authority_pretty_name,
message,
creation_user,
to_char(doc_start_time, 'YYYY-MM-DD HH24:MI:SS') as doc_start_time,
to_char(doc_end_time, 'YYYY-MM-DD HH24:MI:SS') as doc_end_time,
doc_status,
doc_message,
trunc(extract(epoch from (j.job_end_time - j.job_start_time))) as run_time_seconds,
(select count(e1.entry_id)
from auth_batch_job_entries e1
where e1.job_id = j.job_id) as num_actions,
(select count(e2.entry_id)
from auth_batch_job_entries e2
where e2.job_id = j.job_id
and e2.success_p = 'f') as num_problems
from auth_batch_jobs j
where j.job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::start_get_document.update_doc_start_time">
<querytext>
update auth_batch_jobs
set doc_start_time = current_timestamp
where job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::end_get_document.update_doc_end">
<querytext>
update auth_batch_jobs
set doc_end_time = current_timestamp,
doc_status = :doc_status,
doc_message = :doc_message,
document = :document,
snapshot_p = :snapshot_p
where job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::end.update_job_end">
<querytext>
update auth_batch_jobs
set job_end_time = current_timestamp,
message = :message
where job_id = :job_id
</querytext>
</fullquery>
<fullquery name="auth::sync::job::create_entry.insert_entry">
<querytext>
insert into auth_batch_job_entries
(entry_id, job_id, operation, username, user_id, success_p, message, element_messages)
values
(:entry_id, :job_id, :operation, :username, :user_id, :success_p_db, :message, :element_messages)
</querytext>
</fullquery>
<fullquery name="auth::sync::purge_jobs.purge_jobs">
<querytext>
delete from auth_batch_jobs
where job_end_time < current_timestamp - interval '$num_days days'
</querytext>
</fullquery>
</queryset>
This diff is collapsed.
<?xml version="1.0"?>
<queryset>
<fullquery name="auth::sync::entry::get.select_entry">
<querytext>
select e.entry_id,
to_char(e.entry_time, 'YYYY-MM-DD HH24:MI:SS') as entry_time,
e.operation,
a.authority_id,
a.pretty_name as authority_pretty_name,
e.job_id,
e.username,
e.user_id,
e.success_p,
e.message,
e.element_messages
from auth_batch_job_entries e,
auth_authorities a,
auth_batch_jobs j
where e.entry_id = :entry_id
and e.job_id = j.job_id
and j.authority_id = a.authority_id
</querytext>
</fullquery>
</queryset>
<?xml version="1.0"?>
<queryset>
<rdbms><type>oracle</type><version>8.1.6</version></rdbms>
<fullquery name="auth::test::get_admin_user_id.select_user_id">
<querytext>
select q.user_id from
(select user_id
from users
where acs_permission.permission_p(:context_root_id, user_id, 'admin') = 't') q where rownum = 1
</querytext>
</fullquery>
<fullquery name="auth::test::get_password_vars.select_vars">
<querytext>
select q.* from
(select u.user_id,
aa.authority_id,
u.username
from users u,
auth_authorities aa
where u.authority_id = aa.authority_id
and aa.short_name = 'local') q where rownum = 1
</querytext>
</fullquery>
</queryset>
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>OpenACS Authentication</title><style type="text/css"><!--.style1 { font-size: 24px; font-weight: bold;}.style2 { font-size: 18px; font-weight: bold;}--></style></head> <body><div class="navheader"><a href="http://openacs.org"><img src="/doc/images/alex.jpg" border="0" alt="Alex logo"></a> <table width="100%" summary="Navigation header" border="0"> <tr> <td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td> <th width="60%" align="center">Introduction</th> <td width="20%" align="right"><a accesskey="n" href="ext-auth-install.html">Next</a></td> </tr> </table> <hr></div><p class="style1">acs-authentication</p><p>This document aims to help you understand how it works and how you can use it for your own purpouses. By <a href="mailto:roc@viaro.net">Rocael Hern&aacute;ndez R.</a> </p><p><strong>Main functionality:</strong> It is used to authenticate any user in an openacs installations.</p><p>So far, you can use it to authenticate against LDAP &amp; PAM, and of course, locally. You can implement your own based on your needs, processes, etc. </p><p>Definition: SC = <a href="http://cvs.openacs.org/cvs/*checkout*/openacs-4/packages/acs-service-contract/www/doc/index.html?rev=1.2">service-contract</a></p><p class="style2">&nbsp;</p><p class="style2">Authorities</p><p>acs-authentication can have multiple authorities, each one represent an specific configuration of authenticatication. For instance, in your openacs installation you can have users related to different authorities, some of them might authenticate locally since they are external or invited, others belongs to your corporate network and already have users, so might authenticate against LDAP and others in your own work office might use PAM for authentication because your local system authentication. Plus you might define an specific implementation (using the set of SC) to connect to your client DB, which is in another DB, and allow your clients login to certain parts of your website. Then, this is right way to handle all those set of users, that already might have an account in another place and you just want them to authenticate against that external system.<br></p><p>The idea is: <strong>each user belongs to a given authority, and just one </strong>. </p><p><strong>To add an authority</strong> in your installation go to /acs-admin/auth/ and click on &quot;Create new authority&quot;.</p><p>When adding the authority you need to configure: </p><ul> <li>Authentication method (where to authenticate, i.e. check user/password) </li> <li>Password Management (where to update passwords) </li> <li>Account Registration (where to create new accounts) </li> <li>On-Demand Sync (to get user info from the source in real time) </li></ul><p>Those configurations simply will perform the tcl proc that is defined in the SC above described for the given SC implementation that you choose. In other words:</p><ul> <li>For using LDAP, you need to install <a href="http://cvs.openacs.org/cvs/openacs-4/packages/auth-ldap/">auth-ldap</a>, on its installation, this package will create an <a href="http://cvs.openacs.org/cvs/*checkout*/openacs-4/packages/auth-ldap/tcl/auth-ldap-procs.tcl?rev=1.8">implementation</a> of the above mentioned SC definitions (look at &quot;specs&quot; that define which proc needs to be called for each alias).</li> <li>PAM package is <a href="http://cvs.openacs.org/cvs/openacs-4/packages/auth-pam/">auth-pam</a>. </li> <li>Probably, for any new authentication method you'll need to create your own package in the same style of auth-ldap or auth-pam.</li></ul><p>&nbsp;</p><p>Note: &quot;Batch Synchronization&quot; will not be administered there anymore in the future, everything will go to <a href="http://cvs.openacs.org/cvs/openacs-4/packages/ims-ent/%27">ims-ent</a>. </p><p>Also, depending on each implementation, it has a set of parameters that will require for the configuration to work. And those parameters are set independently by authority / authentication method, so for LDAP you'll be able to configure the next set of parameters:</p><ul> <li>DNPattern</li> <li>UsernameAttribute</li> <li>Elements</li> <li>BaseDN</li> <li>Attributes</li> <li>PasswordHash </li></ul><p>Then you can enter your specific values for your server, is likely that the recomemded ones will work fine. </p><p>Hint: nssha (SSHA) doesn't work well with LDAP use ns_passwd or another encription method (MD5...)</p><p>You can make your users to loging using the email or username, by changing the paramenter at the kernel named: UseEmailForLoginP under Security section. If username is used for loging, it will ask for the authority to use, since username is unique by authority but not for the entire openacs installation (can exists several identic usernames but each one belongs to a different authority). </p><p class="style2">&nbsp;</p><p class="style2"><strong>acs-authentication defines a set of SC to interact with the different authentication implementations (LDAP or PAM):</strong></p><ol> <li>auth_authentication &quot;Authenticate users and retrieve their account status.&quot;, with the operations: </li> <ul> <li>Authenticate</li> <li>GetParameters</li> </ul> <li> auth_password &quot;Update, reset, and retrieve passwords for authentication.&quot;, with the operations: <ul> <li>CanChangePassword</li> <li>ChangePassword</li> <li>CanRetrievePassword</li> <li>RetrievePassword</li> <li>CanResetPassword</li> <li>ResetPassword</li> <li>GetParameters</li> </ul> </li> <li>auth_registration &quot;Registering accounts for authentication&quot;, with the operations: </li> <ul> <li>GetElements</li> <li>Register</li> <li>GetParameters</li> </ul> <li>auth_sync_retrieve</li> <li>auth_sync_process</li> <li>auth_user_info <ul> <li>GetUserInfo</li> <li>GetParameters</li> </ul> </li></ol><p>Note: #4 &amp; #5 will be taken out from authentication and moved to the package <a href="http://cvs.openacs.org/cvs/openacs-4/packages/ims-ent/">ims-ent</a>. </p><p>The SC definitions are quite straightforward, then worth to look <a href="http://cvs.openacs.org/cvs/openacs-4/packages/acs-authentication/tcl/apm-callback-procs.tcl?rev=1.13&only_with_tag=HEAD&view=auto">at them</a> for better understanding.</p><p class="style2">&nbsp;</p><p class="style2">Login process</p><p>In an openacs site the login is managed through acs-authentication. It happens like this:<br></p><ol> <li>The user enters the email/user &amp; password</li> <li> It will search the user in the users table and return the authority_id </li> <li>With that authority_id it will find the respective SC implementation <em>which contains the adecuate tcl proc for the authentication process</em></li> <li>That proc will check the identity of the user based on the password (right now could be locally, pam or ldap authenticated, though this model supports N methods of authentication)</li></ol><div class="navfooter"> <hr> <table width="100%" summary="Navigation footer"> <tr> <td width="40%" align="left"><a accesskey="p" href="index.html">Prev</a> </td> <td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td> <td width="40%" align="right"><a accesskey="n" href="ext-auth-install.html">Next</a></td> </tr> <tr> <td width="40%" align="left"></td> <td width="20%" align="center"><a accesskey="u" href="index.html">Up</a></td> <td width="40%" align="right"> Installation </td> </tr> </table> <hr> <address> <a href="mailto:docs@openacs.org">docs@openacs.org</a> </address></div><p>&nbsp;</p></body></html>
\ No newline at end of file
This diff is collapsed.
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Design</title><meta name="generator" content="DocBook XSL Stylesheets V1.64.1"><link rel="home" href="index.html" title="External Authentication"><link rel="up" href="index.html" title="External Authentication"><link rel="previous" href="configure-batch-sync.html" title="Configure Batch Synchronization"><link rel="next" href="ims-sync-driver-design.html" title="IMS Sync driver design"><link rel="stylesheet" href="openacs.css" type="text/css"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><a href="http://openacs.org"><img src="/doc/images/alex.jpg" border="0" alt="Alex logo"></a><table width="100%" summary="Navigation header" border="0"><tr><td width="20%" align="left"><a accesskey="p" href="configure-batch-sync.html">Prev</a> </td><th width="60%" align="center"></th><td width="20%" align="right"> <a accesskey="n" href="ims-sync-driver-design.html">Next</a></td></tr></table><hr></div><div class="article" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ext-auth-design"></a>Design</h2></div></div><div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ims-sync-driver-design.html">IMS Sync driver design</a></span></dt></dl></div><div class="authorblurb">
by <a href="mailto:joel@aufrecht.org" target="_top">Joel Aufrecht</a>
OpenACS docs are written by the named authors, and may be edited
by OpenACS documentation staff.
</div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="configure-batch-sync.html">Prev</a> </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right"> <a accesskey="n" href="ims-sync-driver-design.html">Next</a></td></tr><tr><td width="40%" align="left">Configure Batch Synchronization </td><td width="20%" align="center"><a accesskey="u" href="index.html">Up</a></td><td width="40%" align="right"> IMS Sync driver design</td></tr></table><hr><address><a href="mailto:docs@openacs.org">docs@openacs.org</a></address></div><a name="comments"></a><center><a href="http://openacs.org/doc/ext-auth-design.html#comments">View comments on this page at openacs.org</a></center></body></html>
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Installation</title><meta name="generator" content="DocBook XSL Stylesheets V1.64.1"><link rel="home" href="index.html" title="External Authentication"><link rel="up" href="index.html" title="External Authentication"><link rel="previous" href="index.html" title="External Authentication"><link rel="next" href="ext-auth-pam-install.html" title="Installing PAM support"><link rel="stylesheet" href="openacs.css" type="text/css"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><a href="http://openacs.org"><img src="/doc/images/alex.jpg" border="0" alt="Alex logo"></a><table width="100%" summary="Navigation header" border="0"><tr><td width="20%" align="left"><a accesskey="p" href="acs-authentication.htm">Prev</a> </td><th width="60%" align="center"></th><td width="20%" align="right"> <a accesskey="n" href="ext-auth-pam-install.html">Next</a></td></tr></table><hr></div><div class="article" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ext-auth-install"></a>Installation</h2></div></div><div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ext-auth-pam-install.html">Installing PAM support</a></span></dt><dt><span class="sect1"><a href="ext-auth-ldap-install.html">Installing LDAP support</a></span></dt><dt><span class="sect1"><a href="configure-batch-sync.html">Configure Batch Synchronization</a></span></dt></dl></div><div class="authorblurb"><p> by <a href="mailto:joel@aufrecht.org" target="_top">Joel Aufrecht</a> </p> OpenACS docs are written by the named authors, and may be edited by OpenACS documentation staff. </div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="acs-authentication.htm">Prev</a> </td> <td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right"> <a accesskey="n" href="ext-auth-pam-install.html">Next</a></td></tr><tr><td width="40%" align="left">External Authentication </td><td width="20%" align="center"><a accesskey="u" href="index.html">Up</a></td> <td width="40%" align="right"> Installing PAM support</td></tr></table><hr><address><a href="mailto:docs@openacs.org">docs@openacs.org</a></address></div><a name="comments"></a><center><a href="http://openacs.org/doc/ext-auth-install.html#comments">View comments on this page at openacs.org</a></center></body></html>
\ No newline at end of file
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Installing LDAP support</title><meta name="generator" content="DocBook XSL Stylesheets V1.64.1"><link rel="home" href="index.html" title="External Authentication"><link rel="up" href="ext-auth-install.html" title="Installation"><link rel="previous" href="ext-auth-pam-install.html" title="Installing PAM support"><link rel="next" href="configure-batch-sync.html" title="Configure Batch Synchronization"><link rel="stylesheet" href="openacs.css" type="text/css"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><a href="http://openacs.org"><img src="/doc/images/alex.jpg" border="0" alt="Alex logo"></a><table width="100%" summary="Navigation header" border="0"><tr><td width="20%" align="left"><a accesskey="p" href="ext-auth-pam-install.html">Prev</a> </td><th width="60%" align="center">Installation</th><td width="20%" align="right"> <a accesskey="n" href="configure-batch-sync.html">Next</a></td></tr></table><hr></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ext-auth-ldap-install"></a>Installing LDAP support</h2></div></div><div></div></div><p>...</p><div class="orderedlist"><ol type="1"><li><p><a name="ext-auth-ldap-setup"></a><b>Installing AOLserver LDAP support.</b>Forthcoming. (<a href="http://www.galileo.edu/obonilla/software/nsldap" target="_top">more information</a>)</p></li><li><p><b>Install auth-ldap OpenACS service package.</b><a href="/acs-admin/install/" target="_top">Install</a> <tt class="computeroutput">auth-ldap</tt> and restart the server.</p></li></ol></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ext-auth-pam-install.html">Prev</a> </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right"> <a accesskey="n" href="configure-batch-sync.html">Next</a></td></tr><tr><td width="40%" align="left">Installing PAM support </td><td width="20%" align="center"><a accesskey="u" href="ext-auth-install.html">Up</a></td><td width="40%" align="right"> Configure Batch Synchronization</td></tr></table><hr><address><a href="mailto:docs@openacs.org">docs@openacs.org</a></address></div><a name="comments"></a><center><a href="http://openacs.org/doc/ext-auth-ldap-install.html#comments">View comments on this page at openacs.org</a></center></body></html>
This diff is collapsed.
This diff is collapsed.
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>External Authentication</title><meta name="generator" content="DocBook XSL Stylesheets V1.64.1"><link rel="home" href="index.html" title="External Authentication"><link rel="next" href="ext-auth-install.html" title="Installation"><link rel="stylesheet" href="openacs.css" type="text/css"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><a href="http://openacs.org"><img src="/doc/images/alex.jpg" border="0" alt="Alex logo"></a><table width="100%" summary="Navigation header" border="0"><tr><td width="20%" align="left"> </td><th width="60%" align="center"></th><td width="20%" align="right"> <a accesskey="n" href="acs-authentication.htm">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="id2399399"></a>External Authentication</h1></div></div><div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl> <dt><span class="article"><a href="acs-authentication.htm">Introduction</a></span></dt> <dd>&nbsp;</dd> <dt><span class="article"><a href="ext-auth-design.html"></a></span></dt> <dt><span class="article"><a href="ext-auth-install.html">Installation</a></span></dt> <dd><span class="article"></span></dd> <dd> <dl> <dt><span class="sect1"><a href="ext-auth-pam-install.html">Installing PAM support</a></span></dt> <dt><span class="sect1"><a href="ext-auth-ldap-install.html">Installing LDAP support</a></span></dt> <dt><span class="sect1"><a href="configure-batch-sync.html">Configure Batch Synchronization</a></span></dt> </dl> </dd> <dt><span class="article"><a href="ext-auth-design.html"></a></span></dt> <dt><span class="article"><a href="ext-auth-design.html">Design</a></span></dt> <dd><dl><dt><span class="sect1"><a href="ims-sync-driver-design.html">IMS Sync driver design</a></span></dt></dl></dd></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"></td><td width="40%" align="right"> <a accesskey="n" href="acs-authentication.htm">Next</a></td></tr><tr><td width="40%" align="left"> </td><td width="20%" align="center"></td><td width="40%" align="right"> Introduction</td></tr></table><hr><address><a href="mailto:docs@openacs.org">docs@openacs.org</a></address></div><a name="comments"></a><center><a href="http://openacs.org/doc/index.html#comments">View comments on this page at openacs.org</a></center></body></html>
\ No newline at end of file
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment