How do I use autologin in liferay?

Question

I want to login my users automatically from our application. I know liferay has an auto login feature, but I don't know how to use it. I didn't find much valuable information on the web. What do I need to do to make autologin work?

I want to login a user automaticaly when he clicks a link, without him having to enter name and password. The name and password is saved on our application database.

Answer 1

What exactly do you mean by "autologin"? If you want Liferay to check wheter the user is already authenticated by some external entity (like a single sign-on server as CAS), you can just enable that in the portal.properties. There it's already preconfigured for the liferay supported authentication mechanisms. Otherwise you might need to implement your own autologin hook (as indicated in this post for example

Answer 2

I believe the OP has no use for an answer now. Nonetheless, this deserves a comprehensive answer. In fact, I am surprised that it does not have one yet.

First of all, this is a bad idea: such an arrangement as the one proposed by the OP is really too insecure. Nevertheless, a solution to the described problem can be a good prototype for someone creating an autologin for Liferay.

Now, let us say you want to automatically log in any user whose screen name is sent in a query string parameter. For example, if one access http://localhost:8080/web/guest/home?insecurely_login_user=juju then the Liferay in the juju user should be logged in. How to do that? Follow the steps below:

Create the autologin class

Firstly, create a hook plugin. In its docroot/WEB-INF/src directory, creates a class implementing the com.liferay.portal.security.auth.AutoLogin interface. In my example, I will call it br.brandizzi.adam.liferay.insecure.InsecureAutoLogin.

The AutoLogin interface has only one method, called login(), which expects two parameters (an HttpServletRequest and an HttpServletResponse instances) and returns an array of strings. So, my class will look like this without implementation:

public class InsecureAutoLogin implements AutoLogin {

    @Override
    public String[] login(HttpServletRequest request,
            HttpServletResponse response) throws AutoLoginException {
        // TODO Auto-generated method stub
        return null;
    }

}

The AutoLogin.login() method will try to retrieve the information necessary to the authentication from many sources, mainly the request object. If it decides that the user should be logged in, it returns an array with relevant data for authentication; if it decides to not log the user in, it can just return null.

In our case, we try to get the name of the user from the the insecurely_login_user parameter from the request. If there is such parameter, we will proceed with the login; if there is no such parameter, it just returns null:

String screenName = request.getParameter("insecurely_login_user");
if (screenName == null || screenName.isEmpty()) {
    return null;
}

So we have the screen name. What to do now? Let us get a user from the database with the same screen name.

long companyId = PortalUtil.getCompanyId(request);
User user = UserLocalServiceUtil.getUserByScreenName(companyId,
        screenName);

If a user wich such a screen name exists, it will be retrieved and attributed to the user variable. In this case, the authentication should be successful and the autologin class should return an array of three strings - the credentials. Those are the values to be returned as credentials, in the order they should appear in the array:

• the user id as a string
• the password of the user, which can be encrypted or not;
• a boolean value, cast to string, indicating if the password is encrypted.

So here is the line:

return new String[] {
    String.valueOf(user.getUserId()),
    user.getPassword(),
    String.valueOf(user.isPasswordEncrypted())
};

If a user is not found, however, an exception will be thrown. So, we have to surround the code above with a try/catch construction. If an exception is thrown, just return null:

try {
    long companyId = PortalUtil.getCompanyId(request);
    User user = UserLocalServiceUtil.getUserByScreenName(companyId,
            screenName);
    return new String[] { String.valueOf(user.getUserId()),
            user.getPassword(),
            String.valueOf(user.isPasswordEncrypted()) };
} catch (Exception e) {
    return null;
}

In the end, this is my InsecureAutoLogin class:

public class InsecureAutoLogin implements AutoLogin {
    public String[] login(HttpServletRequest request,
            HttpServletResponse response) throws AutoLoginException {

        String screenName = request.getParameter("insecurely_login_user");
        if (screenName == null || screenName.isEmpty())
            return null;

        try {
            long companyId = PortalUtil.getCompanyId(request);
            User user = UserLocalServiceUtil.getUserByScreenName(companyId,
                    screenName);
            return new String[] { String.valueOf(user.getUserId()),
                    user.getPassword(),
                    String.valueOf(user.isPasswordEncrypted()) };
        } catch (Exception e) {
            return null;
        }

    }
}

Registering the autologin class

Now our hook should register this class as an autologin processor. That is really easy.

First, edit the file docroot/WEB-INF/liferay-hook.xml adding a portal-properties element with the value portal.properties:

<?xml version="1.0"?>
<!DOCTYPE hook PUBLIC "-//Liferay//DTD Hook 6.1.0//EN" "http://www.liferay.com/dtd/liferay-hook_6_1_0.dtd">

<hook>
    <portal-properties>portal.properties</portal-properties>
</hook>

Now, create a file named portal.properties at docroot/WEB-INF/src. It should contain a property named auto.login.hooks whose value should be the name of our class:

auto.login.hooks=br.brandizzi.adam.liferay.insecure.InsecureAutoLogin

And that is it. Deploy this hook and your autologin will work.

Conclusion

As I have said, you should not use such an unsafe "authentication" method. It is too easy to bypass it, getting even administration permissions! However, if you follow these steps, you have a skeleton to create a better autologin feature. Also, I know some people really want to do something like this insecure "authentication" method and sometimes we have to suspend our judgments and just help one to shoot one's feet...

The source code of this project can be found here and you can download the WAR here.

Answer 3

Step 1: Create a class CustomLoginFilter and implements from AutoLogin interface.Override login method. Code as follows.

public String[] login(HttpServletRequest req, HttpServletResponse response)throws AutoLoginException {

//Get the login parameter

String loginEmailId = ParamUtil.getString(req, “_58_login”);

String password = req.getParameter(“_58_password”);

String[] credentials = new String[3];

credentials[0] = userId

credentials[1] = loginEmailId;

credentials[2] = password;

//Write your business logic Here and return String[].

}

Step 2: Write below code in portal-ext.properties

// you get full control from this custom class.

auto.login.hooks=com.bolog.portal.login.security.CustomLoginFilter

//Override Liferay Authentication pipeline

auth.pipeline.enable.liferay.check=false

auth.pipeline.pre=com.bolog.portal.login.security.CustomLoginAuthenticator

Step 3: Create class CustomLoginAuthenticator and implements from Authenticator.

Override  authentication methods.

public int authenticateByEmailAddress(long arg0, String arg1, String arg2,

Map<String, String[]> arg3, Map<String, String[]> arg4)

throws AuthException {

//Write Your business login here and if authentication success then return 1 otherwise return 0;

return 0;

}

public int authenticateByScreenName(long arg0, String arg1, String arg2,

Map<String, String[]> arg3, Map<String, String[]> arg4)
throws AuthException {

//Write Your business login here and if authentication success then return 1 otherwise return 0;
return 0;
}

public int authenticateByUserId(long arg0, long arg1, String arg2,
Map<String, String[]> arg3, Map<String, String[]> arg4)
throws AuthException {

//Write Your business login here and if authentication success then return 1 otherwise return 0;
return 0;
}

Step 4: If authentication fail then you can also redirect any page by following code

if(Validator.isNull(credentials) || credentials[0]==null){

req.setAttribute(AutoLogin.AUTO_LOGIN_REDIRECT, “Your Login page path”);

}

Answer 4

Well found it. Step 1: Click on add iframe and let the configuration view pop up. Step 2: Provide the url and if there are any variables like (www.mysite.com/Action=Login&User . . . .), add the Action=Login in hidden variables text field. Step 3: Click authenticate and select form based authentication. In this, make usre that the user field name and password field name are given correctly, and the values will be '@screen_name@','@password@'.

For example, suppose the url is something like www.mysite.com/Action=Login?User=aj&Password=aj. User Name (field)=User Password (field)=Password User Name (Value)=aj Password (Value)=aj Hidden variables(field)=Action=Login

Now, whenever any user logs into the liferay applicaiton, if his/her account exists in the site specified(in the url), it will log into that site automatically(acts like a single sign on).

This is working !!! -Aj