<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>10. Metacat Authentication Mechanism — Metacat 2.8.1 documentation</title>
<link rel="stylesheet" href="_static/bootstrap.min.css" type="text/css" />
<link rel="stylesheet" href="_static/font-awesome/css/font-awesome.min.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="_static/metacatui.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: './',
VERSION: '2.8.1',
COLLAPSE_MODINDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true
};
</script>
<script type="text/javascript" src="_static/jquery.js"></script>
<script type="text/javascript" src="_static/underscore.js"></script>
<script type="text/javascript" src="_static/doctools.js"></script>
<link rel="top" title="Metacat 2.8.1 documentation" href="index.html" />
<link rel="prev" title="9. Modifying and Creating Themes" href="themes.html" />
<link rel="next" title="11. Metacat’s Use of Geoserver" href="geoserver.html" />
</head>
<body>
<div id="metacatDocs">
<div class="banner">
<a href="index.html"><img class="logo" src="_static/metacat-logo-white.png" /></a>
<a href="index.html"><h1 class="title">Metacat: Metadata and Data Management Server</h1></a>
<img class="logo-right" src="_static/nceas-logo-white.png" />
</div>
<div class="related">
<h3>Navigation</h3>
<ul>
<li class="right">
<span id="searchbox" style="display: none;">
<form class="search" action="search.html" method="get">
<input type="text" name="q" size="18" />
<input type="submit" value="Go" class="icon-search"/>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</span>
</li>
<script type="text/javascript">$('#searchbox').show(0);</script>
<li class="right">
<a href="genindex.html" title="General Index"
accesskey="I">index</a>
</li>
<li class="right">
<a href="geoserver.html" title="11. Metacat’s Use of Geoserver"
accesskey="N">next</a>
</li>
<li class="right">
<a href="themes.html" title="9. Modifying and Creating Themes"
accesskey="P">previous</a>
</li>
<li class="breadcrumb first"><a href="index.html">Metacat 2.8.1 documentation</a> »</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body">
<div class="section" id="metacat-authentication-mechanism">
<h1>10. Metacat Authentication Mechanism<a class="headerlink" href="#metacat-authentication-mechanism" title="Permalink to this headline">¶</a></h1>
<p>Metacat supports either an internal password file authentication or the use of LDAP
as an external authentication mechanism. It does this by supplying two classes
(<code class="docutils literal"><span class="pre">AuthFile</span></code> or <code class="docutils literal"><span class="pre">AuthLDAP</span></code>) that implement authentication via a password file or
an external LDAP server. You may choose the authentication mechanism during initial configuration.</p>
<p>If neither of these choices is suitable for your deployment, a custom authentication mechanism can be built.
Metacat is written such that this Authentication provider is replaceable with
another class that implements the same interface (<code class="docutils literal"><span class="pre">AuthInterface</span></code>). As
an Administrator, you have the choice to provide an alternative implementation
of <code class="docutils literal"><span class="pre">AuthInterface</span></code> and then configuring <code class="docutils literal"><span class="pre">metacat.properties</span></code> to use that
class for authentication instead of LDAP or the internal password file.</p>
<div class="section" id="file-based-authentication">
<h2>10.1. File-Based Authentication<a class="headerlink" href="#file-based-authentication" title="Permalink to this headline">¶</a></h2>
<p>This is the default authentication mechanism in Metacat. The password file
path can be specified during initial configuration. The Tomcat user should have
write/read permission to access the file. The password file follows this form:</p>
<div class="highlight-python"><div class="highlight"><pre><?xml version="1.0" encoding="UTF-8"?>
<subjects>
<users>
<user dn="uid=john,o=NCEAS,dc=ecoinformatics,dc=org">
<password>csilPspPJdMx8zt7L9XKXeUxZjkPgKZd.o7TTPC0oJOFmT2kQ/E92</password>
<email>foo@foo.com</email>
<surName>Smith</surName>
<givenName>John</givenName>
<organization>NCEAS</organization>
<memberof>cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org</memberof>
</user>
<user dn="uid=brand,o=NCEAS,dc=ecoinformatics,dc=org">
<password>$2a$10$j8eGWJBEpj5MubdaqOeJje7oYw6JNc2aq2U7buoRw16kthwOEcWkC</password>
</user>
</users>
<groups>
<group name="cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org">
<description>Developers at NCEAS</description>
</group>
</groups>
</subjects>
</pre></div>
</div>
<p>The format of the DN must look like uid=john,o=NCEAS,dc=ecoinformatics,dc=org.</p>
<p>The format of the group name must look like cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org.</p>
<p>The password stored in the file is hashed using Bcrypt algorithm. If you have the “-i” in the
“useradd” or “usermod” commands when you run the command line utility (see the following section),
you will be prompted to input the password and the utility will hash the password and store it in
the file. You may also get the hash of a password from any online tool,
such as <a class="reference external" href="https://www.dailycred.com/blog/12/bcrypt-calculator">https://www.dailycred.com/blog/12/bcrypt-calculator</a> (we don’t have any guaranty on the security of those tools),
then use the “-h” to pass the hashed password to the file by the utility.</p>
</div>
<div class="section" id="utility-for-password-file-based-authentication">
<h2>10.2. Utility for Password File Based Authentication<a class="headerlink" href="#utility-for-password-file-based-authentication" title="Permalink to this headline">¶</a></h2>
<p>You can edit the password file manually or use Metacat’s command line utility
for managing users and groups. The utility is located in the deployed Metacat webapp:</p>
<div class="highlight-python"><div class="highlight"><pre>$METACAT/WEB-INF/scripts/bash/authFileManager.sh.
</pre></div>
</div>
<p>You must be in the directory - $METACAT/WEB-INF/scripts/bash/ to run the file:</p>
<div class="highlight-python"><div class="highlight"><pre>cd $METACAT/WEB-INF/scripts/bash/
</pre></div>
</div>
<p>In order to run the file, you must make the file executable:</p>
<div class="highlight-python"><div class="highlight"><pre>chmod u+x authFileManager.sh
</pre></div>
</div>
<p>You run the command as the owner of the file:</p>
<div class="highlight-python"><div class="highlight"><pre>./authFileManager.sh [options]
</pre></div>
</div>
<p>Usage of the utility:</p>
<p>./authFileManager.sh useradd -i -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]</p>
<p>./authFileManager.sh useradd -h <hashed-password> -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]</p>
<p>./authFileManager.sh groupadd -g <group-name> [-d <description>]</p>
<p>./authFileManager.sh usermod -password -dn <user-distinguish-name> -i</p>
<p>./authFileManager.sh usermod -password -dn <user-distinguish-name> -h <new-hashed-password></p>
<p>./authFileManager.sh usermod -group -a -dn <user-distinguish-name> -g <added-group-name></p>
<p>./authFileManager.sh usermod -group -r -dn <user-distinguish-name> -g <removed-group-name></p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p>Metacat currently uses Bcrypt algorithm to hash the password. The hashed password following the “-h” should be generated by a Bcrypt algorithm.
The hash string usually contains $ signs which can interfere with the command line arguments. You should use two SINGLE quotes to wrap the entire hashed string.</p>
<p>The <user-distinguish-name> must look like “uid=john,o=something,dc=something,dc=something” and the group-name must look like “cn=dev,o=something,dc=something,dc=something”.</p>
<p>If an option value has spaces, the value should be enclosed in double quotes.
For example: ./authFileManager.sh groupadd -g cn=dev,o=something,dc=something,dc=something -d “Developers at NCEAS”</p>
<p class="last">The “-d <description>” option in the “groupadd” command is optional;
“-g <groupname> -e <email-address> -s <surname> -f <given-name> -o <organizationName>” in the “useradd” command are optional as well.</p>
</div>
</div>
<div class="section" id="ldap-based-authentication">
<h2>10.3. LDAP-Based Authentication<a class="headerlink" href="#ldap-based-authentication" title="Permalink to this headline">¶</a></h2>
<p>Before the Metacat 2.4.0 release, LDAP was the default authentication mechanism and was configured to use
the NCEAS LDAP server. We are now restricting access to the server to only trusted partners who can
guarantee secure communication with their clients and the LDAP server.
If you are not on the list, you can contact us for more information or you may use the password file authentication
(for a small group of users) or set up your own LDAP server (for a big group of users).</p>
</div>
</div>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
<div class="footerNav">
<div class="related">
<h3>Navigation</h3>
<ul>
<li class="right">
<span id="searchbox" style="display: none;">
<form class="search" action="search.html" method="get">
<input type="text" name="q" size="18" />
<input type="submit" value="Go" class="icon-search"/>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</span>
</li>
<script type="text/javascript">$('#searchbox').show(0);</script>
<li class="right">
<a href="genindex.html" title="General Index"
>index</a>
</li>
<li class="right">
<a href="geoserver.html" title="11. Metacat’s Use of Geoserver"
>next</a>
</li>
<li class="right">
<a href="themes.html" title="9. Modifying and Creating Themes"
>previous</a>
</li>
<li class="breadcrumb first"><a href="index.html">Metacat 2.8.1 documentation</a> »</li>
</ul>
</div>
</div>
<div class="small-print">
© Copyright 2012, Regents of the University of California.
Created using <a href="http://sphinx.pocoo.org/">Sphinx</a> 1.3.1.
</div>
</div>
</div>
</body>
</html>