Skip to content

Commit 33eb38a

Browse files
author
Vladimir Kotal
authored
move content to wiki
1 parent 56cf806 commit 33eb38a

File tree

1 file changed

+4
-166
lines changed

1 file changed

+4
-166
lines changed

‎plugins/README.md

Lines changed: 4 additions & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -1,169 +1,7 @@
11
# Authorization plugins
22

3-
This directory contains various authorization plugins:
4-
5-
- FalsePlugin - denies everything
6-
- TruePlugin - allows everything
7-
- HttpBasicAuthorizationPlugin - sample plugin to utilize HTTP Basic auth
8-
- LdapPlugin - set of plugins to perform authorization based on LDAP
9-
- UserPlugin - extract user information from HTTP headers
10-
- this plugin can have multiple header decoders, the default is for Oracle SSO
11-
12-
## Debugging
13-
14-
In general, it should be possible to increase log level in Tomcat's
15-
`logging.properties` file to get more verbose logging.
16-
17-
### UserPlugin
18-
19-
Has a special property called "fake" that allows to insert custom headers
20-
with the "fake-" prefix that would be evaluated instead of the usual SSO headers.
21-
22-
Header insertion can be done e.g. using the Modify headers Firefox plugin.
23-
24-
25-
```xml
26-
<!-- get user cred from HTTP headers -->
27-
<void method="add">
28-
<object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
29-
<void property="name">
30-
<string>opengrok.auth.plugin.UserPlugin</string>
31-
</void>
32-
<void property="flag">
33-
<string>REQUISITE</string>
34-
</void>
35-
36-
<!-- set fake parameter to true to allow insertion of custom headers -->
37-
<void property="setup">
38-
<void method="put">
39-
<string>fake</string>
40-
<boolean>true</boolean>
41-
</void>
42-
</void>
43-
</object>
44-
</void>
45-
46-
```
47-
48-
## Example configuration
49-
50-
The following snippet configures global authorization stack with 2 REQUISITE
51-
plugins and a sub-stack with 1 SUFFICIENT and 1 REQUIRED plugin.
52-
53-
There is a config file `ldap-plugin-config.xml` specified globally that will be
54-
used by LdapPlugin. See LdapPlugin directory for sample of this config file.
55-
56-
This snippet can be put info read-only configuration that is passed to the
57-
indexer via the -R option.
58-
59-
60-
```xml
61-
<!-- Authorization config begin -->
62-
63-
<void property="pluginStack">
64-
<!-- The setup will be inherited to all sub-stacks -->
65-
<void property="setup">
66-
<void method="put">
67-
<string>configuration</string>
68-
<string>/opengrok/auth/config/ldap-plugin-config.xml</string>
69-
</void>
70-
</void>
71-
72-
<void property="stack">
73-
<!-- get user cred from HTTP headers -->
74-
<void method="add">
75-
<object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
76-
<void property="name">
77-
<string>opengrok.auth.plugin.UserPlugin</string>
78-
</void>
79-
<void property="flag">
80-
<string>REQUISITE</string>
81-
</void>
82-
</object>
83-
</void>
84-
85-
<!-- get email, ou and uid -->
86-
<void method="add">
87-
<object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
88-
<void property="name">
89-
<string>opengrok.auth.plugin.LdapUserPlugin</string>
90-
</void>
91-
<void property="flag">
92-
<string>REQUISITE</string>
93-
</void>
94-
95-
<void property="setup">
96-
<void method="put">
97-
<string>objectclass</string>
98-
<string>posixAccount</string>
99-
</void>
100-
</void>
101-
</object>
102-
</void>
103-
104-
<!-- Authorization stacks follow -->
105-
106-
<void method="add">
107-
<object class="org.opengrok.indexer.authorization.AuthorizationStack">
108-
<void property="forProjects">
109-
<void method="add">
110-
<string>foo</string>
111-
</void>
112-
</void>
113-
<void property="forGroups">
114-
<void method="add">
115-
<string>mygroup</string>
116-
</void>
117-
</void>
118-
<void property="name">
119-
<string>substack for some source code</string>
120-
</void>
121-
<void property="flag">
122-
<string>REQUIRED</string>
123-
</void>
124-
<void property="stack">
125-
<void method="add">
126-
<object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
127-
<void property="name">
128-
<string>opengrok.auth.plugin.LdapAttrPlugin</string>
129-
</void>
130-
<void property="flag">
131-
<string>SUFFICIENT</string>
132-
</void>
133-
<void property="setup">
134-
<void method="put">
135-
<string>attribute</string>
136-
<string>mail</string>
137-
</void>
138-
<void method="put">
139-
<string>file</string>
140-
<string>/opengrok/auth/config/whitelists/mycode-whitelist-mail.txt</string>
141-
</void>
142-
</void>
143-
</object>
144-
</void>
145-
<void method="add">
146-
<object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
147-
<void property="name">
148-
<string>opengrok.auth.plugin.LdapFilterPlugin</string>
149-
</void>
150-
<void property="flag">
151-
<string>REQUIRED</string>
152-
</void>
153-
<void property="setup">
154-
<void method="put">
155-
<string>filter</string>
156-
<string>(&amp;(objectclass=posixGroup)(cn=my_src*)(memberUid=%uid%))</string>
157-
</void>
158-
</void>
159-
</object>
160-
</void>
161-
</void>
162-
</object>
163-
</void>
164-
</void>
165-
166-
<!-- Authorization config end -->
167-
</object>
168-
```
3+
This directory contains various authorization plugins and supporting pieces.
1694

5+
For documentation look at:
6+
- https://github.com/oracle/opengrok/wiki/Authorization
7+
- https://github.com/oracle/opengrok/wiki/Authorization-plugins

0 commit comments

Comments
 (0)