Dear All,
I have a requirement where the user has to login to see the pages. I have implemented the way explained in the https://docs.adobe.com/docs/en/dispatcher/permissions-cache.html.
But its not really working. Our requirement is not that the user has access to the page or not as all users have access to all the pages. Only constraint I need to check is that the user has a valid session or not. If not I have to ask him to login via SAML. I have configured my dispacther as per the link above and wrote a permission check servlet. But after the first login and once the page is cached, the page is served from the cache though I dont login.
While serving from the cache, it doesnt even hit my servlet to authorize.
My dispatcher configuration is like this, I have removed some of the filter to hide identity but it should not matter. Yes this is my configuration.
/farms
{
/website
{
/clientheaders
{
"*"
}
/virtualhosts
{
"*"
#"https://*"
}
/renders
{
/rend01
{
/hostname "localhost"
/port "4503"
/ipv4 "1"
/always-resolve "1"
#/secure "1"
}
}
/auth_checker
{
# request is sent to this URL with '?uri=<page>' appended
/url "/bin/permissioncheck"
# only the requested pages matching the filter section below are checked,
# all other pages get delivered unchecked
/filter
{
/0000
{
/glob "*"
/type "deny"
}
/0001
{
/glob "/content/*.html"
/type "allow"
}
}
# any header line returned from the auth_checker's HEAD request matching
# the section below will be returned as well
/headers
{
/0000
{
/glob "*"
/type "deny"
}
/0001
{
/glob "Set-Cookie:*"
/type "allow"
}
}
}
/sessionmanagement
{
/header "Cookie:login-token"
/directory "C:/AEM/dispatcher_cache/httpd/.sessions"
}
/filter
{
/0001 { /type "allow" /glob "* /*" }
/0012 { /type "deny" /url "/system/*"}
/0013 { /type "deny" /glob "/system/*"}
/0014 { /type "deny" /url "/libs/*" }
/0015 { /type "deny" /glob "/libs/*" }
/0016 { /type "deny" /url "* /etc/*" }
/0017 { /type "allow" /url "* /etc/designs/*" }
/0018 { /type "allow" /url "* /etc/clientlib/*" }
/0019 { /type "allow" /url "* /etc/segmentation.segment.js*" }
/0020 { /type "deny" /url "* /etc/replication.xml*" }
/0021 { /type "deny" /url "* /etc/replication.infinity.json*" }
/0022 { /type "deny" /url "* /libs/opensocial/proxy*" }
/0023 { /type "allow" /url "/content*" } # disable this rule to allow mapped content only
/0024 { /type "deny" /url "/bin/crxde/logs"}
/0025 { /type "deny" /url "/content/geometrixx.sitemap.txt"}
/0026 { /type "deny" /url "/var/linkchecker.html"}
/0027 { /type "deny" /url "/etc/linkchecker.html"}
/0030 { /type "allow" /url "* /is/image*" }
/0031 { /type "allow" /url "* /is/content*" }
/0041 { /type "allow" /url "*.css" } # enable css
/0042 { /type "allow" /url "*.gif" } # enable gifs
/0043 { /type "allow" /url "*.ico" } # enable icos
/0044 { /type "allow" /url "*.js" } # enable javascript
/0045 { /type "allow" /url "*.png" } # enable png
/0046 { /type "allow" /url "*.swf" } # enable flash
/0047 { /type "allow" /url "*.jpg" } # enable jpg
/0048 { /type "allow" /url "*.jpeg" } # enable jpeg
/0049 { /type "allow" /url "*.woff" } # enable woff font
/0050 { /type "allow" /url "*.eot" } # enable eot
/0051 { /type "allow" /url "*.svg" } # enable svg
/0052 { /type "allow" /url "*.ttf" } # enable ttf
/0053 { /type "allow" /url "*.doc" } # enable doc
/0054 { /type "allow" /url "*.docx" } # enable docx
/0055 { /type "allow" /url "*.pdf" } # enable pdf
/0062 { /type "allow" /glob "/libs/cq/personalization/*" } # enable personalization
/0063 { /type "allow" /glob "POST /content/[.]*.form.html" } # allow POSTs to form selectors under content
/0064 { /type "allow" /glob "POST /content/[.]*.commerce.cart.json" } # allow POSTs to update
/0065 { /type "allow" /glob "/libs/wcm/stats/tracker.js" }
/0066 { /type "allow" /glob "/libs/cq/personalization/components/clickstreamcloud/content/config.json" }
#/0067 { /type "allow" /glob "/libs/cq/security/userinfo.json" }
/0095 { /type "deny" /url "*.infinity.json" }
/0096 { /type "deny" /url "*.tidy.json" }
/0097 { /type "deny" /url "*.sysview.xml" }
/0098 { /type "deny" /url "*.docview.json" }
/0099 { /type "deny" /url "*.docview.xml" }
/00100 { /type "deny" /url "*.*[0-9].json" }
#/00101 { /type "allow" /method "GET" /url "*.1.json" } # allow one-level json requests
/00102 { /type "deny" /url "GET *.feed*" }
/00103 { /type "deny" /url "GET /content*.json*" }
/00104 { /type "deny" /glob "GET /etc/*.json*" }
/00105 { /type "deny" /glob "GET *.feed*" }
/00106 { /type "deny" /url "GET *.xml*" }
/00107 { /type "deny" /glob "GET *.xml*" }
/00108 { /type "deny" /url "GET *.json*" }
/00109 { /type "deny" /glob "GET *.json*" }
/00119 { /type "allow" /url "/bin/permissioncheck" }
/00120 { /type "allow" /url "GET /bin/permissioncheck" }
}
/cache
{
/docroot "C:/AEM/dispatcher_cache" #environment specific
/statfileslevel "0"
/allowAuthorized "1"
#/allowAuthorized "0"
/serveStaleOnError "1"
/rules
{
/0000
{
/glob "*"
/type "allow"
#/type "deny"
}
/0001
{
/glob "/en.sitemap.xml"
/type "deny"
}
}
/invalidate
{
/0000
{
/glob "*"
/type "deny"
}
/0001
{
/glob "*.html"
/type "allow"
}
/0002
{
/glob "/etc/segmentation.segment.js"
/type "allow"
}
/0003
{
/glob "*/analytics.sitecatalyst.js"
/type "allow"
}
#/0004
#{
#/glob "/en.sitemap.xml"
#/type "allow"
#}
}
/allowedClients
{
/0000
{
/glob "*"
/type "deny"
}
/0001
{
/glob "127.0.*.*"
/type "allow"
}
}
/ignoreUrlParams
{
/0001 { /glob "*" /type "allow" }
/0002 { /glob "q" /type "deny" }
}
}
/statistics
{
/categories
{
/html
{
/glob "*.html"
}
/others
{
/glob "*"
}
}
}
/retryDelay "2"
/numberOfRetries "5"
/unavailablePenalty "5"
/failover "1"
}
}
My servlet code is
public void doHead(SlingHttpServletRequest request, SlingHttpServletResponse response) {
try{
//retrieve the requested URL
String uri = request.getParameter("uri");
//obtain the session from the request
Session session = request.getResourceResolver().adaptTo(javax.jcr.Session.class);
final SlingHttpServletRequest slingRequest = (SlingHttpServletRequest) request;
final SlingHttpServletResponse slingResponse = (SlingHttpServletResponse) response;
UserProperties userProps = slingRequest.adaptTo(UserProperties.class);
if(null != userProps && StringUtils.isNotEmpty(userProps.getAuthorizableID())){
logger.info("authchecker says OK");
logger.error("authchecker says OK and teh user is " + userProps.getAuthorizableID());
response.setStatus(SlingHttpServletResponse.SC_OK);
} else{
logger.info("AUTHCHECKSERVLET :: authchecker says NO USER ID");
logger.error("authchecker says OK and teh user is " + userProps.getAuthorizableID());
System.out.println("AUTH CHECKER SAYS FORBIDDEN::: " + userProps + " Session user id :: " + session.getUserID());
response.setStatus(SlingHttpServletResponse.SC_FORBIDDEN);
}
Please suggest on how to make sure the user is logged in before rendering from the cache.
