How do I integrate with nuxeo-platform-login-portal-sso in my portal?

I want to use nuxeo-platform-login-portal-sso for authentication, but how do I communicate the client authentication info exactly?

1 votes

1 answers



First, note that nuxeo-platform-login-portal-sso is a bit of a misnomer, what this module really does is establish a shared-secret method of authenticating between the Nuxeo server and a client.


On the server side, you establish it using something like:

  <authenticationPlugin name="PORTAL_AUTH">
      <parameter name="secret">MySharedSecret</parameter>
      <parameter name="maxAge">60</parameter>

<!-- Include Portal Auth into authentication chain -->
      <!--  Keep basic Auth at top of Auth chain to support RSS access via BasicAuth -->

Here we've chosen to name this authentication method PORTAL_AUTH. Note that the secret parameter contains the shared secret that the client will have to know.


On the client side, you could use one of the existing clients:

Using nuxeo-http-client

nuxeo-http-client is a sample Java client to do REST calls to Nuxeo. You can configure it connect to a server that uses nuxeo-platform-login-portal-sso by doing:

NuxeoServer nxServer = new NuxeoServer("");
nxServer.setSharedSecretAuthentication("Administrator", "MySharedSecret");

See src/test/java/org/nuxeo/ecm/http/client/remote/tests/ in nuxeo-http-client for more.

Using nuxeo-automation-client

nuxeo-automation-client is a more modern Nuxeo Java client using high-level Document abstractions. You can configure it to connect to a server that uses platform-login-portal-sso by doing:

HttpAutomationClient client = new HttpAutomationClient("http://localhost:8080/nuxeo/site/automation");
client.setRequestInterceptor(new PortalSSOAuthInterceptor("MySharedSecret", "Administrator"));
Session session = client.getSession();

See src/test/java/org/nuxeo/ecm/automation/client/jaxrs/test/ in nuxeo-automation-client for more.

Manual HTTP calls

If you want to do all the calls to Nuxeo yourself, you'll have to decide which HTTP requests to make, and in addition you'll have to send some specific headers to authenticate. The HTTP headers are:

  • NX_TS: the timestamp, in milliseconds since epoch, when you're generating the request.
  • NX_RD: a few some random characters.
  • NX_USER: the user as whom you want to authenticate.
  • NX_TOKEN: a token proving authentication generated using the algorithm BASE64_MD5(timestamp + ":" + random + ":" + secret + ":" + user)

The token contains the secret but in a hashed form which cannot be reversed by an eavesdropper to generate new requests. The timestamp is used to avoid replay attacks (the delta with the real time on the server cannot be more than the maxAge specified on the server). The random characters are used to avoid pre-computed dictionary attacks.

The following Java code can be used:

import javax.xml.bind.DatatypeConverter;

public String makeToken(String timestamp, String random, String secret,
        String user) throws Exception {
    String clearToken = timestamp + ":" + random + ":" + secret + ":"
            + user;
    byte[] md5 = MessageDigest.getInstance("MD5").digest(
    return DatatypeConverter.printBase64Binary(md5);

As a validation of your code, check that makeToken("1324572561000", "qwertyuiop", "secret", "bob") returns 8y4yXfms/iKge/OtG6d2zg==

2 votes

With Nuxeo DM 5.5, I tried to use <i>nuxeo-platform-login-portal-sso</i> for authentication using <i>nuxeo-http-client</i> but I have always 401 reponse when calling <i>client.getSession()</i>. Inside server.log, I have this lines : <pre> <code> DEBUG [org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter] Entering Nuxeo Authentication Filter DEBUG [org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter] Principal not found inside Request via getUserPrincipal DEBUG [org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter] Try getting authentication from cache DEBUG [org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter] Trying to retrieve userIdentification using plugin AUTOMATION_BASIC_AUTH DEBUG [org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter] Trying to retrieve userIdentification using plugin ANONYMOUS_AUTH DEBUG [org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter] user/password not found in request, try into identity cache </code> </pre>

It was like there was another authenticationChain declaring <i>AUTOMATION_BASIC_AUTH</i>.

When searching in nuxeo sources, I found this in <i>nuxeo-automation-server/OSGI-INF/auth-contrib.xml </i>: <pre> <code> <extension target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService" point="specificChains">

&lt;specificAuthenticationChain name=&quot;Automation&quot;&gt;


</extension> </code> </pre>

Then, I extended the "specificChains" point instead of "chain" point to add <i>PORTAL_AUTH</i> and it works fine.


How does that integrate with other SSO uses? Like if I want to authenticate nuxeo through REMOTE_USER-like environment variable, but still connecting clients to it like you described above?

Does this approach work if I do not have the user's name/password in LDAP, SQL, or a config file or do I need to have the user name defined somewhere? Is there a need for a "user" entity for documentation ownership, ACls, etc?

This (the first long comment) was posted as an answer but is not an answer. Please ask questions as new questions.

mike: you'll need the user to be known to Nuxeo (it needs to know its group membership and full name at least).