The document discusses authentication in Blackboard Learn and provides an example of extending authentication capabilities by creating a custom filter. It begins by explaining the different types of authentication providers in Blackboard Learn, including remote, delegated credential, and fully delegated providers. It then discusses changes in Service Pack 8, supported providers, and how the framework is built for extension. The document concludes by walking through a sample implementation of a custom filter that limits login attempts to prevent password guessing.
Scaling API-first – The story of a global engineering organization
Code your Own: Authentication Provider for Blackboard Learn
1. Code Your Own
Learn Authentication Plugin
#Authcode
Alex Varju
Architect
Blackboard Product Development
Dan Rinzel
Design Manager
Blackboard Product Development
2. Q’s we will try to A
• How does internal authentication work in Blackboard
Learn™?
• What’s a remote authentication provider?
• What’s a delegated credential provider?
• What’s a fully delegated or redirect provider?
• What changed in Blackboard Learn 9.1 SP8?
• What providers are supported?
• How can I extend this framework?
3. Blackboard Learn Default Authentication
• Standard Username & Password combination
• Passwords transmitted and stored as encrypted
hashes (MD5 or SHA)
• Usernames & Passwords can be SOURCED
externally, but must be stored in local Learn database
4. Remote Authentication Provider
• In conjunction or instead, Blackboard Learn can be
incorporated with authentication services hosted
elsewhere.
• Passwords are stored and managed
remotely, according to policies enforced by the remote
provider
• Usernames are matched or at least correlated
5. Delegated Credential Provider
• Users log in via a Blackboard Learn screen
• Credentials are checked programmatically via the
remote provider and results relayed back to the user
via Blackboard Learn
Browser Blackboard Learn Credential Provider
6. Fully Delegated Provider
• Users log in directly to the remote provider
• The user is redirected to Blackboard Learn with a valid
session, vouched for by the provider
Browser Credential Provider Blackboard Learn
9. What Changed in Service Pack 8?
Expanded customization
capabilities for login page
10. What Changed in Service Pack 8?
Enhanced Logging for Authentication
events
11. What Changed in Service Pack 8?
New command-line emergency login URL generator
12. Provider Support in Service Pack 8
Updated Shibboleth
support to version 2 –
including support for
Apache 2
Official CAS Support
for the first time
Automatic update for
existing LDAP
configurations
Continued support
for other custom
configurations via
Legacy provider
13. Built for Extension
Core authentication classes:
AuthenticationProviderHandler
The entry point for all authentication providers. This provides
us with the information needed to invoke your code at the right
times.
UsernamePasswordValidator
For delegated credential providers, this is responsible for
validating the username/password typed into the Blackboard
Learn login box
14. Built for Extension
AuthenticationListener
For listening for authentication events.
PostLoginUrlInterceptor
To allow system to redirect through an alternate URL after login.
UsernamePasswordAuthenticationProviderFilter
To allow runtime checking of whether each authentication provider in the chain
should be run.
UsernamePasswordPreValidationCheck
For pre-validation checks to be run before any authentication providers'
validation has been invoked.
UsernamePasswordPostValidationCheck
For post-validation checks to be run on the User that is returned from validation.
15. Built for Extension
AuthenticationManager
Search for users, redirect them back to the main page after
successful login.
SessionManager
Grant the user a session once you've confirmed their identity.
AuthenticationProviderManager
Manage authentication provider instances. Useful if you need
to save per-provider settings.
AuthenticationLogger
Record custom events in the authentication logs.
AuthenticationProvider
An administrator-created authentication instance
17. Delegated credential provider
• User submits password from the login screen
• See if a UsernamePasswordPreValidationCheck wants
to stop the login
• Load sorted list of AuthenticationProviders
• For each provider:
• Do any UsernamePasswordAuthenticationProviderFilter
extensions this provider to be skipped?
• Call this provider's UsernamePasswordValidator
• Validator can return Yes, No, or I Don't Know.
• If a provider accepted this login, see if any
UsernamePasswordPostValidationCheck extensions
want to stop the login
18. Working Example
Today we’re going to walk through building a filter which
limits prevents dictionary password guessing.
Extension points we will make use of:
• UsernamePasswordPreValidationCheck
• UsernamePasswordPostValidationCheck
19. Working Example
Basic design:
• Intercept the login request before any password
validation is performed.
• If the same username has been seen too many times
recently, block the login.
• After a user has successfully logged in, reset the login
counter so that they can log in and out multiple times.
20. Working Example
public interface LoginAttemptCounter {
/**
* Determines whether to block the login attempt for this username. Also
* records the login attempt for future use.
*
* @return true if the request should be blocked, false if it may proceed
*/
public boolean shouldBlock(String username);
/**
* Indicates that this user logged in successfully, and that any previous
* records associated with them may be removed.
*/
public void successfulLogin(String username);
/**
* Indicates what time the account will be unlocked.
*
* @return Time in millis, or 0 if account is not locked
*/
public long lockedUntil(String username);
}
21. Working Example
public class BeforeLogin extends AbstractUsernamePasswordPreValidationCheck {
private final LoginAttemptCounter counter = LoginAttemptCounter.Factory.getInstance();
private final AuthenticationLogger logger = AuthenticationLogger.Factory.getInstance();
@Override
public ValidationResult preValidationChecks(String username, String password) {
ValidationResult result = new ValidationResult(null);
if (counter.shouldBlock(username)) {
result.setStatus(ValidationStatus.UserDenied);
long now = Calendar.getInstance().getTimeInMillis();
long lockedForMillis = counter.lockedUntil(username) - now;
long lockedForSeconds = Math.round(lockedForMillis / 1000.0);
result.setMessage(String.format("Account locked for %d seconds.",
lockedForSeconds));
AuthenticationEvent event = buildAuthFailedEvent(username);
logger.logAuthenticationEvent(event);
} else {
result.setStatus(ValidationStatus.Continue);
}
return result;
}
private AuthenticationEvent buildAuthFailedEvent(String username) {
return new AuthenticationEvent(EventType.Error, new Date(), username,
"Too many login attempts", null, null);
}
}
22. Working Example
public class AfterLogin extends AbstractUsernamePasswordPostValidationCheck {
private final LoginAttemptCounter counter = LoginAttemptCounter.Factory.getInstance();
@Override
public ValidationResult postValidationChecks(User user) {
counter.successfulLogin(user.getUserName());
ValidationResult result = new ValidationResult(null);
result.setStatus(ValidationStatus.Continue);
return result;
}
}
27. Resources
Blackboard Learn Help Center http://help.blackboard.com
Shibboleth http://shibboleth.net/
CAS http://www.jasig.org/cas
alex.varju@blackboard.com dan.rinzel@blackboard.com
This presentation will be available via
http://edugarage.com at some point after the
27
conference ends.
Notes de l'éditeur
Agenda for the presentation.
Password transmission is hashed regardless of SSL encryption of the whole HTTP requestGetting the user credentials INTO Learn can be accomplished in a number of ways – go check out Jim Riecken’s presentation after this one
This is your LDAP/Active Directory/Atlassian Crowd modelThe “thumbs up” is received by Learn from the credential provider and the user is granted access (or not)
This is your CAS, Shibboleth or OpenID modelAs with the prior model, the remote server vouches for the user
Went from back end config file incantation with service restart prior to verification, to GUI-enabled real-time configuration, testing, enabling and chainingSimilar in many ways to the transition from banging on an old IBM typewriter, busting out the whiteout or starting completely over when you found a typo.To our modern word processor experience where you can move and make corrections with (relative) ease.You still have to get the writing right – you still have to successfully connect and properly configure, and your user data still has to be useful in both Learn and in the provider
Went from back end config file incantation with service restart prior to verification, to GUI-enabled real-time configuration, testing, enabling and chainingSimilar in many ways to the transition from banging on an old IBM typewriter, busting out the whiteout or starting completely over when you found a typo.To our modern word processor experience where you can move and make corrections with (relative) ease.You still have to get the writing right – you still have to successfully connect and properly configure, and your user data still has to be useful in both Learn and in the provider
Multiple fully delegated providers can be “lined up” on one login pageDelegated or credential providers can be restricted to only particular login hostnamesDifferent custom login pages can be built for different hostnames (requires Community license)
All login attempts, successful logins, logouts and session expirations are recorded in a dedicated log file in the logs directory of the application server, as well as in a database table that supports the searching & filtering UI shown here. The database table is purged periodically by a database job, and can also be purged manually from this UI.
Because so many configuration options are available now from the User Interface, we needed to design a fallback mechanism to allow an administrator to access the system regardless of it’s current configuration state – the solution is the command-line emergency login URL generator.It requires back-end access (or a Managed Hosting ticket), and generates a one-time-use URL with an expiration time, allowing access to the system to revert any broken configuration.
Apache 2 is supported, but doesn’t ship inside the SP8 installer. Once Learn is installed, you can configure your instance to point to an Apache 2 serverCentral Authentication Service – originally built by Yale and supported by Jasig (Java in Administration Special Interest Group) since 2004LDAP – lightweight directory access protocol – used by Microsoft’s Active Directory product among others
The new framework is built using extension points, allowing Building Blocks to interact with the platform. If you are writing a custom authentication plugin, these are the two classes you will be working with.
These are some more extension points that the platform exposes, allowing you to intercept and modify the behaviour of the core system.AuthenticationListener receives notification whenever anything interesting happens related to authentication. Sample events include Login, Logout, SessionExpiry, and Failed Login.PostLoginUrlInterceptor could be used to alter the standard destination after a user logs in. For example, you could use this to send the user to the change password page when they log in for the very first time.UsernamePasswordAuthenticationProviderFilter allows you to disable individual authentication providers based on the current request context. We use this internally to implement the restricted hostnames feature, only allowing a provider to be used if the request was sent to a specific hostname.UsernamePasswordPreValidationCheck and UsernamePasswordPostValidationCheck allow you to abort a login request either before or after the password validation has occurred. We’ll be using these today to implement a filter that temporarily locks an account if too many bad login attempts are received in a short period of time.
In addition to the interfaces that you can implement within your Building Block, the new authentication framework includesa number of helper classes that you can call.Worth highlighting here is AuthenticationProvider. Building Blocks can supply AuthenticationProviderHandler implementations, telling the framework how to do your type of authentication. AuthenticationProvider represents a deployed instance of your handler. Administrators can deploy multiple instances of a single handler, each with their own properties. Each instance of fully delegated providers shows up as another link on the login screen, and each delegated credential provider gets called until one approves or denies the password-based login request.
This sequence diagram shows what happens during a fully delegated login. When the user logs in:Your handler provides the URL where you want the user to be sent to start the authentication processThe user is then sent to this URL and you can do whatever is necessary to confirm that the user is authentic. For example, with the CAS handler we bounce the user over to the CAS server, have them log in there, and then they get bounced back to our Building Block where we can validate the CAS responseOnce we know the user is authentic, we figure out which Blackboard Learn account to connect them with (either by username or batch_uid), and activate their session.
Delegated credential authentication is driven by Learn. Within this process, there are a number of places you can inject extensions to alter the system behaviour.
This is the interface for our helper class that we’ll use to keep track of login attempts.shouldBlock will be called before each login attemptsuccessfulLogin will be called after a login succeedslockedUntil provides information when reporting errorsI won’t go into the implementation of this class during today’s presentation. The essence of the implementation is a HashMap keyed by username storing all recent login attempts.Note: Some of the code shown here has been tweaked slightly to make the slides easier to read. The full code will be made available afterwards.
This is our first extension point.If the login counter indicates there have been too many attempts for this username, return UserDenied along with an informative error that will be shown to the end user
This is our second extension point. Since we know that the user entered a valid password, we’ll clear any previous login attempts. This ensures that users with valid credentials can log in and out as many times as they want.
Now it’s time to wire up our extension implementations. Most of this is boilerplate. A few things to notice, though:I’ve included a webapp-type element. This tells the platform that your Building Block includes extension implementations.The extension-defs element is where we register our specific extensions.First, we define our own namespace. This helps ensure that our extension IDs don’t collide with extensions from other Building Blocks.Next, we list the extensions themselves. Each extension has:A unique identifier.The identifier of the extension point being implemented. The fully qualified name of our implementation classA singleton flag, indicating that the platform may reuse the same instance of our extension each time
Here you can see the result after too many bad login attempts.
And here is what the administrator sees. The Error event is our custom event, which contains our “Too many login attempts” warning. Above this is the failed Login Attempt event that the framework logged because an extension point aborted the login, which includes the IP address of the attacker.
There are lots of things that you can do with the new authentication framework. To help you get started, we’ve released the source code for the LDAP provider which ships with the latest version of Blackboard Learn. We will also be making the full source code from today’s presentation available.The LDAP code is a compilable, runnable version of the shipping LDAP B2, in a separate namespace, so that they can be run in parallelThe sample code can be pulled from github, it is not intended to be run in production! It has several shortcuts and limitations as described in the readme file.
You can learn more about how the base features of the framework operate from the Learn Help CenterYou can learn more about Shibboleth and CAS from their own sites