Enabling Security in Magnify With Lucene

Topics: Lucene Security Settings in WebFOCUS Administration Console

How to: Configure the SimpleSecurity Plug-in Sample Authenticate Users Using the SimpleSecurity Plug-in

Magnify secures each search result independently based on user authentication and various authorization levels. By allowing a user the ability to exit Magnify and execute external programs, security rules can be highly customized, scalable, and applied at the most granular control.

Security plug-ins allow for the execution of one program, which can perform stand-alone processing or initiate the execution of another program. The results can then either be passed along and/or evaluated by the Security plug-in and returned to Magnify. This allows Magnify to integrate into your established set of security rules.

Each Security plug-in must be configured using the WebFOCUS Administration Console.

The Security plug-in will:

• Authenticate the user. This confirms the user identity through some unique piece of information known only to the user and the authentication system. Though Magnify does not authenticate its users, this can be done through an authentication method used in your enterprise. Typically, the authentication information is a user ID and password that can be verified through a mechanism such as LDAP, Microsoft Active Directory, or a mainframe system call. Magnify obtains authentication information in one of the following ways:
  • Browser session. The getUserid() method retrieves the authentication information submitted by the user when prompted for a user ID and password. For an example on authenticating users, see Authenticate Users Using the SimpleSecurity Plug-in.
  • WebFOCUS Administration Console parameters. You can pass Magnify the authentication information specified by the Userid and Password parameters using the getSecurityPluginUserid() and getSecurityPluginPassword() methods. These provide administrative access to security information.

• Authorize the requested data. Once the user is authenticated, the plug-in then determines if that user has permission to access the data.

When implementing a Security plug-in for Magnify, the following classes and methods are used:

• run() method. Used to execute the Security plug-in. The run() method is part of the standard Java Development Kit software.
• ibi.search.api.SecurityPlugin interface. Used to implement the Security plug-in Java class specified by the Security Plug-in Name parameter in the WebFOCUS Administration Console. This value must match the value specified by the SECURITY_PLUGIN field in the Lucene index for each record.
• ibi.search.api.SecurityPlugin.getRecords() method. Retrieves the records from the Lucene index. Once the records are retrieved, the Security plug-in must act on each record. For example, the record content can be displayed, hidden, or replaced with a different string.

If you are using any of the e-mail alert features, the following methods may be implemented:

• ibi.search.api.SecurityPluginEnvironment.getSecurityExitEmailNotification(). Retrieves the value of the Notification Email Address(es) parameter in the WebFOCUS Administration Console. This parameter is optional and enables the Security plug-in to notify certain users about special access requirements, possible password attacks, or queries for inappropriate content.
• ibi.search.api.SecurityPluginEnvironment.getSecurityExitemailReplyTo(). Retrieves the value of the Reply to Email Address parameter in the WebFOCUS Administration Console.
• ibi.search.api.SecurityExitEnvironment.getEMailContentType(). Retrieves the e-mail format.

Magnify provides the following Security plug-in samples that illustrate how to implement some of the functionality available in the Magnify Security API:

• ManagedReporting. Authenticates against the Managed Reporting repository to access WebFOCUS reports.
• ReportLibrary. Authenticates against ReportCaster to access information stored in the ReportCaster Library.
• ReturnAllRecords. Illustrates the SECURITY_PLUGIN meta tag that is required when implementing record-level security. This sample plug-in returns records without requiring authentication or authorization.
• LDAPPlugin. Validates a user credentials against an LDAP server and verifies whether the user has access to the group in which the record is assigned.
• SimpleSecurity. Authenticates users against the magnify_security.xml file.

  The ibi.search.securityplugin.SimpleSecurity class enables Magnify to display secure search results based on a user role. The user credentials and role are stored in the following file.

  \ibi\WebFOCUSxx\config\magnify\magnify_security.xml

  Note: The SimpleSecurity java class is not for production use.

The Security plug-in samples are located in the \ibi\WebFOCUSxx\webapps\webfocus\WEB-INF\classes\ibi\search\securityplugins folder of the WebFOCUS Web application. To compile the samples, Information Builders recommends using JDK 1.6 or higher.

Note: Information Builders offers sample Security plug-ins as a learning tool. Most are not intended for production use. Licensed users are welcome to alter or extend these samples and deploy them in other environments as they see fit. Information Builders will support the documented functionality of its API classes and methods. However, Information Builders is not responsible for functionality or behavior of products built with its API, unless the documented or expected behavior of its discrete classes and methods is different than the actual results.

private final void promptForPassword(){
  final boolean noAccountCheckbox=this.securitycallback.
        getNoAccountCheckbox(this.realmName);
  if (!noAccountCheckbox)
  {
    this.securitycallback.promptForPasswords(this.realmName);
    this.securitycallback.
         setRealmRequestJSP("search/jsp/passwordPrompt.jsp",
    this.realmName);
  }
}

public String getUserid(){
  return this.userid;
}

public void setUserid(String userid)
{
  this.userid = userid;
}

private final boolean isAuthenticated(final String username,
  final String password, final String SecurityPluginName_param)
{
  final Map <String,NamedNodeMap>
        usernameMap =  getUserNameMap(SecurityPluginName_param);
  if (usernameMap != null && username != null)
  {
    if (usernameMap.containsKey(username))
    {
       final NamedNodeMap attMap=usernameMap.get(username);
       final Node passwordNode=attMap.getNamedItem("password");
       if (passwordNode.getNodeValue().equalsIgnoreCase(password))
       {
         this.rolesSet=new TreeSet<String>();
         final Node rolesNode=attMap.getNamedItem("roles");
         final String rolesString=rolesNode.getNodeValue();
         if (rolesString != null)
         {
           final String [] rolesList=rolesString.split(",");
           final int nRoles=rolesList.length;
             for (int roleIndex=0;roleIndex<nRoles;roleIndex++)
             {
               this.rolesSet.add(rolesList[roleIndex]);
             }
          }
          return true;
       }
     }
  }
  return false;
}