I am settig up a local Adobe CQ 5.6.1 author and publish instances for development. I want to password protect the publish instance, since the customer demands that. As of now, I do not have SSO or any other authentication mechanism. Is it possible to have authentication for the publish instance just the way it is avalable for the author instance? Thanks in advance.
Yes it is possible, it is called Closed User Group. You can find the documentation here:
http://docs.adobe.com/docs/en/cq/current/howto/create_apply_cug.html
Another option is to have a proxy in front of your CQ instance which protects the page.
Related
May u know any possibility to secure access to dashboard of jobrunr? As inside dashboard there are many critical operation can be done, it need be protected with user name and password. At the moment it seems it open for anyone who can access the dashboard's url.
thanks in advance
I don't recommend a setup where the dashboard can be accessed via the internet, I would only allow access via internal IP's.
If you also want to protect for internal IP's, there is a way to do so. Search the issues and the discussions for it (I'm not writing the answer here as I don't like to promote that solution).
Update regarding JobRunr 6
JobRunr Pro 6 will support OpenID Authentication.
I've just integrated my app with IBM's SSO via Cloud Directory. The idea here is that I want access to be very secure and only authorized users (pre-approved) can access the application (e.g. website in this case).
However, I've just realised now that anyone that goes to the app's webpage can, instead of logging in, just select "Register New User" and fill in some details and he's given access? Is there a way to:
1) EITHER keep that registration form, but require one of the admins to approve it before access is given? (better solution)
2) OR completely remove the self-registration option?
As the current situation is far from secure for what I need.
Thanks a lot!
I talked with the support team and that is the best (only) way to do it, just remove the links from the HTML templates.
I am developing a Rest service with Web API. The service only requires one login credential as it is used by an application developed by a third party. If I use the project template with "Individual User Accounts", I have to have a SQL server running(?), which is an overkill to support a single username and password. How about the LocalDB comes with VS 2013 ?
"Windows Authentication" cannot be used because the service is accessed from the Internet.
What is the proper way to authenticate ?. Are there any "in memory" or config file providers that come with Web API ? I know there is Asp.net Identity package, but It uses entity framework as a provider. Can anyone please suggest ?
You can create a custom store for ASP.NET Identity and it could be memory or a config file. Here is a tutorial on creating a custom store in ASP.NET Identity. I would not put it in memory because you will most likely want to change the password and that would require a recompile and redeploy. Personally I would just use SQL Express or SQL Compact as they take minimal resources and rewriting the data store seems like a lot of work for little benefit in this scenario.
No matter how do you want to authorize the call, the users has to be present in a database or cache to check the validity of the provided user. Microsoft will offer you out of the box a solution based on SQL server or some of their own products.
If you want to implement you own user check, you will probably have to take care of the authentication by yourself. This means that you will have to check the HTTP header by yourself and reject or accept the request by yourself.
My question is, why do you want to use some "in memory" provider? The users has to be somewhere. Why not a SQL express?
I am building 3 new websites and want to use WIF4.5 for SSO across these 3 different domains. I have read tons of materials about the WIF, while I understand the principles and purpose of WIF I am still very confused about how it works in real life, please help me understand the following questions, many thanks.
All my sites will be hosted using shared hosting services.
Everyone is saying that there's no need to build you own STS, but if that's case where can I found external services I can use to sign in my users and what about normal user registration interface for new users? and What about my existing users?
If i only need to build claim based web applications, where do I get user identities from in a real production environment? Do I have to pay them or do they need to go through my sites to approve them?
Is it correct that its no longer possible to let user register on my websites if I use STS?
Do I need to enable SSL and buy X507 certs for all my sites if I want them to be claim based websites?
I want to have a shared user database to store all our users, old and new, does that mean I have to build my own STS?
What exactly does it take to build my own STS, can I pcik one of my websites to be my own STS provider for my own websites?
What does it take and cost to build a STS? like SSL, certs, other stuff?
Can I enable social sign-in like facebook/Google/Yahoo if my sites are claim based?
Thank you guys.
You definitely CAN write your own sts.
You can allow your users to register in your sts or federate with an external identity provider (google/facebook)
No, an sts is just a asp.net web app, users CAN register there.
No, although ssl is recommended when usernames/passwords are involved.
No, you can use an existing sts like the IdentityServer which allows you to use a custom MembershipProvider against your own database http://thinktecture.github.io/
Yes. http://netpl.blogspot.com/2011/08/quest-for-customizing-adfs-sign-in-web.html
X509 certs for token signing can be created with free tools like portecle or makecert
Yes.
Microsoft has the Access Control Service (ACS) which supports Windows Live ID, Google, Yahoo!, and Facebook logins. Unless you need to option for users to register accounts at your site that might be a good option.
If you want a (1) free solution as an STS or (2) want to have your own Id store, Thinktecture's identity server is the way to go.
I have some written some tutorials on how to do it.
http://claudioasanchez.blogspot.com/2011/09/setting-up-thinktectures-identity.html
A customer of ours has just purchased CQ5 and would like to externalize all of its security. We'd like to use an STS server for SSO and then leverage a custom authorization/attribute provider instead of the CQ5 repository. Ultimately, we do not want to use LDAP in any way.
Here is how we envision this (some pieces already working):
User browses to CQ5 Dispatcher running in Apache
Apache filter redirects user to STS site where login is completed.
User is redirected back to Apache with SAML Claims.
User ID token is placed as cookie into browser. (everything is working up to here)
CQ5 captures that cookie based on the SSO configuration (working)
Problem starts here: From here, we want to call a custom authorization provider for the user's attributes, roles, groups etc...
We have tried to figure out how to do this and can't seem to find the missing link.
Do we need to create a custom login module? Do we need to create a custom principal provider? Do we somehow use the existing LDAP capability in CQ5 but have it call a custom class which leverages the external auth source?
If anyone here has any idea how to do this, their karma quotient would be full for the year if they could share it. I'm not sure if this is a basic thing you do with JAAS or even where to put my classes after I've created them.
We've worked really hard on this so far and seem to be close, but we keep hitting dead-ends.
Thanks so much if you have an idea where to begin!!
-joe
Recent versions of AEM now include the SAMLAuthenticationHandler which allows you to:
Redirect users to SSO to simulate IDP initiated login, or
Allow AEM to perform SP initiated login with IDP
Specify attributes to take from the SAML Assertion and add to the user's profile node (not sure if you can use this for groups)
Specify which groups users should be added to
Set a cookie called request-path that will store the URL the user arrived at, and then redirect them to that location when they're authenticated (ie. deep linking)
This makes relying on the SAMLAuthenticationHandler better than using Apache to redirect. The current version of the handler bundled with AEM 6.2 does not properly set the cookie when using the redirect method, but Adobe does have an updated version that they can provide that will fix that problem.
I normally recommend that clients do not have their own authentication handlers developed inside AEM.
When not using LDAP, this does create an issue where users will not exist until they've logged in. Additionally, when your architecture includes more than one load balanced publisher, it is possible that a user may exist on one server user synchronization.
Try searching the google group for SSO details. Here's one useful post:
http://groups.google.com/group/day-communique/browse_thread/thread/72c235c83a501252/fba4d08a90487156?lnk=gst&q=SSO#fba4d08a90487156
It seems that you will have to implement a custom LoginModule, more information here: http://dev.day.com/docs/en/crx/current/deploying/custom-login-modules.html