As we're still in the process of migrating the JSF/struts components of RHQ to use GWT/SmartGWT, the following outlines the session management and user login/logout process in place while portal.war is still being used. The JAAS login process, leveraged by the jboss container in portal.war, is still being used on the server side even though the UI elements have been converted to SmartGWT.
Portal.war session review
The legacy struts login process is initiated by a regular form login request, triggering the AuthenticateUserAction.execute() action where:
-
SubjectManagerBean.login(user,password) is called to get a valid subject.
-
a new Http session instance is created
-
a new WebUser is created based off the valid Subject
-
the WebUser instance is stored in the session object.
The JAAS login process correctly handles authentication requests via JDBCLoginModule and LDAPLoginModule logic. See here for more details
Coregui.war session review
The coregui.war continues to use the portal.war session management mechanism described above. Migrating the login UI to GWT has the following additional side effects:
-
client side timer mechanism UserSessionManager.sessionTimer is required for responsive session monitoring behavior(Login dialog on session timeout)
-
asynchronous nature of GWT calls necessitates 'call-chaining' logic in UserSessionManager to achieve synchronous and serial order of operations for interactive login process.
-
greater security concerns for all login/session logic that now exists client side(ex. SubjectManagerBean.processSubjectForLdap()) as javascript only clients can and now initiate requests that were encapsulated server-side before.
During a typical login request to coregui the following steps occur:
-
LoginView.login() is called to initiate a login request to the portal.war logic
-
UserSessionManager.checkLoginStatus() is called to correctly process valid subject logins to portal war and correctly process requests to the SessionAccessServlet.
Diagram of Login logic including LDAP authz processing
RHQ classes used in session/login management
These are classes that are involved in user session management for the user interface:
-
org.rhq.enterprise.gui.coregui.client.UserSessionManager
-
org.rhq.enterprise.gui.coregui.client.SearchGUI
-
org.rhq.enterprise.gui.coregui.client.LoginView
-
org.rhq.enterprise.gui.coregui.client.util.rpc.TrackingRemoteServiceProxy
-
org.rhq.enterprise.gui.coregui.client.util.preferences.UserPreferences
-
org.rhq.enterprise.gui.authentication.SessionAccessServlet
-
this is in portal-war
-
-
org.rhq.enterprise.gui.authentication.AuthenticateUserAction
-
this is in portal-war
-
-
org.rhq.enterprise.gui.legacy.WebUser
-
org.rhq.enterprise.server.auth.SubjectManagerBean