Disabling WSRP Complex Producer security

Question

Hello all,
We are using WebLogic 10 Portal in combination with Workshop 10. We got Complex WSRP producer up and running, everything is going/flowing ok.
Is there a way to remove authentication information that is being passes in WSRP message exchanges, so anonymous users are able to perform all operations, including PortletPreferences.store()?
In documentation it clearly states user must be not be anonymous in order to store preferences, is this a configurable option?
We know there are two ways user identity is transfered from consumer to producer:User Name and SAML token runtime propagation, and we have tried to disable security at least temporary, but could not find the magic turn-off switch.
Any tips, pointers to relevant information is appreciated.
Thanks in advance

Answer 1

Veljko,
Is PortletPreferences.store() only operation from the JSR 168 (Java Portlet Specification) affected by security restrictions, such as that anonymous user is not able to perform it?Yes this is the only (JSR-168 specified) operation that requires
authentication.
As for working around authentication you have several options (in rough
order of preference):
1. Propagate the user's identity from the consumer to the producer, WLP
supports:
* SAML
* UNT
* Basic Auth
* Other (Requires you to write an Identity Asserter)
2. Have your portlet detect when there is no logged in user, and log
them in as a made up user (e.g. create a wsrpAnon user)
* See code snippet below
3. Edit the ejb-jar.xml to allow anonymous users access to the relevant
methods
* You'll need to slog through each method that throws and exception and
open them one by one
Code:
//Note: In non-wsrp cases login/logout should ALWAYS happen
// in processAction and send a redirect
     public void doView(RenderRequest request, RenderResponse response)
               throws PortletException, IOException {
          if (request.getUserPrincipal() == null) {
               PortletRequestDispatcher requestDispatcher =
getPortletContext().getRequestDispatcher("/login.jsp");
               requestDispatcher.include(request, response);
Veljko Zivkovic wrote:
Hello Nathan,
Thanks for the reply.
The scenario we have is that some of the WSRP consumers of our WebLogic WSRP Complex Producer are not BEA consumers and they do not support SAML as authentication mechanism.
If we understood WSRP specification correctly, for each user session in "end user-consumer" communication scenario, WSRP consumer is in the background keeping N more session where N is the number of WSRP producers end user is accessing thru consumer. (Consumer is shielding end user from this complexity).
Q: What we need in ideal case is following: when end user authenticates on consumer in some way, and his session is created on consumer, we want producer to trust consumer that user is valid to do anything on producer since he has session, and we do not want producer to authenticate user again.
When user authenticates on consumer, consumer is then sending user id and session data to the producer, so producer knows trusted user is in question, and so on.
Using User Name Token Security is not a viable option, since we can not use two-way encrypted (reversible) method due to various reasons that are out of our control.
Can you just confirm if it is possible or not to do what I have described above in Q, to not use neither SAML not User token, but still be able to treat user as authenticated on producer, since he has valid session on consumer, and consumer is passing session id and user name to the producer.
Thanks in advance