Code your Own: Authentication Provider for Blackboard Learn
•Télécharger en tant que PPTX, PDF•
1 j'aime•31,498 vues
The document discusses authentication in Blackboard Learn and provides an example of extending authentication capabilities by creating a custom filter. It begins by explaining the different types of authentication providers in Blackboard Learn, including remote, delegated credential, and fully delegated providers. It then discusses changes in Service Pack 8, supported providers, and how the framework is built for extension. The document concludes by walking through a sample implementation of a custom filter that limits login attempts to prevent password guessing.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (7)
Similaire à Code your Own: Authentication Provider for Blackboard Learn
Similaire à Code your Own: Authentication Provider for Blackboard Learn (20)
Dernier
Dernier (20)
Code your Own: Authentication Provider for Blackboard Learn
- 1. Code Your Own Learn Authentication Plugin #Authcode Alex Varju Architect Blackboard Product Development Dan Rinzel Design Manager Blackboard Product Development
- 2. Q’s we will try to A • How does internal authentication work in Blackboard Learn™? • What’s a remote authentication provider? • What’s a delegated credential provider? • What’s a fully delegated or redirect provider? • What changed in Blackboard Learn 9.1 SP8? • What providers are supported? • How can I extend this framework?
- 3. Blackboard Learn Default Authentication • Standard Username & Password combination • Passwords transmitted and stored as encrypted hashes (MD5 or SHA) • Usernames & Passwords can be SOURCED externally, but must be stored in local Learn database
- 4. Remote Authentication Provider • In conjunction or instead, Blackboard Learn can be incorporated with authentication services hosted elsewhere. • Passwords are stored and managed remotely, according to policies enforced by the remote provider • Usernames are matched or at least correlated
- 5. Delegated Credential Provider • Users log in via a Blackboard Learn screen • Credentials are checked programmatically via the remote provider and results relayed back to the user via Blackboard Learn Browser Blackboard Learn Credential Provider
- 6. Fully Delegated Provider • Users log in directly to the remote provider • The user is redirected to Blackboard Learn with a valid session, vouched for by the provider Browser Credential Provider Blackboard Learn
- 7. What Changed in Service Pack 8? What didn’t change?
- 8. What Changed in Service Pack 8? What didn’t change?
- 9. What Changed in Service Pack 8? Expanded customization capabilities for login page
- 10. What Changed in Service Pack 8? Enhanced Logging for Authentication events
- 11. What Changed in Service Pack 8? New command-line emergency login URL generator
- 12. Provider Support in Service Pack 8 Updated Shibboleth support to version 2 – including support for Apache 2 Official CAS Support for the first time Automatic update for existing LDAP configurations Continued support for other custom configurations via Legacy provider
- 13. Built for Extension Core authentication classes: AuthenticationProviderHandler The entry point for all authentication providers. This provides us with the information needed to invoke your code at the right times. UsernamePasswordValidator For delegated credential providers, this is responsible for validating the username/password typed into the Blackboard Learn login box
- 14. Built for Extension AuthenticationListener For listening for authentication events. PostLoginUrlInterceptor To allow system to redirect through an alternate URL after login. UsernamePasswordAuthenticationProviderFilter To allow runtime checking of whether each authentication provider in the chain should be run. UsernamePasswordPreValidationCheck For pre-validation checks to be run before any authentication providers' validation has been invoked. UsernamePasswordPostValidationCheck For post-validation checks to be run on the User that is returned from validation.
- 15. Built for Extension AuthenticationManager Search for users, redirect them back to the main page after successful login. SessionManager Grant the user a session once you've confirmed their identity. AuthenticationProviderManager Manage authentication provider instances. Useful if you need to save per-provider settings. AuthenticationLogger Record custom events in the authentication logs. AuthenticationProvider An administrator-created authentication instance
- 17. Delegated credential provider • User submits password from the login screen • See if a UsernamePasswordPreValidationCheck wants to stop the login • Load sorted list of AuthenticationProviders • For each provider: • Do any UsernamePasswordAuthenticationProviderFilter extensions this provider to be skipped? • Call this provider's UsernamePasswordValidator • Validator can return Yes, No, or I Don't Know. • If a provider accepted this login, see if any UsernamePasswordPostValidationCheck extensions want to stop the login
- 18. Working Example Today we’re going to walk through building a filter which limits prevents dictionary password guessing. Extension points we will make use of: • UsernamePasswordPreValidationCheck • UsernamePasswordPostValidationCheck
- 19. Working Example Basic design: • Intercept the login request before any password validation is performed. • If the same username has been seen too many times recently, block the login. • After a user has successfully logged in, reset the login counter so that they can log in and out multiple times.
- 20. Working Example public interface LoginAttemptCounter { /** * Determines whether to block the login attempt for this username. Also * records the login attempt for future use. * * @return true if the request should be blocked, false if it may proceed */ public boolean shouldBlock(String username); /** * Indicates that this user logged in successfully, and that any previous * records associated with them may be removed. */ public void successfulLogin(String username); /** * Indicates what time the account will be unlocked. * * @return Time in millis, or 0 if account is not locked */ public long lockedUntil(String username); }
- 21. Working Example public class BeforeLogin extends AbstractUsernamePasswordPreValidationCheck { private final LoginAttemptCounter counter = LoginAttemptCounter.Factory.getInstance(); private final AuthenticationLogger logger = AuthenticationLogger.Factory.getInstance(); @Override public ValidationResult preValidationChecks(String username, String password) { ValidationResult result = new ValidationResult(null); if (counter.shouldBlock(username)) { result.setStatus(ValidationStatus.UserDenied); long now = Calendar.getInstance().getTimeInMillis(); long lockedForMillis = counter.lockedUntil(username) - now; long lockedForSeconds = Math.round(lockedForMillis / 1000.0); result.setMessage(String.format("Account locked for %d seconds.", lockedForSeconds)); AuthenticationEvent event = buildAuthFailedEvent(username); logger.logAuthenticationEvent(event); } else { result.setStatus(ValidationStatus.Continue); } return result; } private AuthenticationEvent buildAuthFailedEvent(String username) { return new AuthenticationEvent(EventType.Error, new Date(), username, "Too many login attempts", null, null); } }
- 22. Working Example public class AfterLogin extends AbstractUsernamePasswordPostValidationCheck { private final LoginAttemptCounter counter = LoginAttemptCounter.Factory.getInstance(); @Override public ValidationResult postValidationChecks(User user) { counter.successfulLogin(user.getUserName()); ValidationResult result = new ValidationResult(null); result.setStatus(ValidationStatus.Continue); return result; } }
- 23. Working Example = = = <webapp-type value="javaext" /> = = = = = = <extension-defs> <definition namespace="blackboard.sample.auth.filter"> <extension id="beforeLogin” point="blackboard.platform.authUserPassPreValidation” class="blackboard.sample.auth.filter.BeforeLogin” singleton="true" /> <extension id="afterLogin” point="blackboard.platform.authUserPassPostValidation” class="blackboard.sample.auth.filter.AfterLogin” singleton="true" /> </definition> </extension-defs> = = =
- 24. Working Example
- 25. Working Example
- 26. Sample code LDAP delegated credential provider http://tinyurl.com/BbLearnLDAP Requires Behind the Blackboard credential Sample code - login rate limiter (github) http://tinyurl.com/BbSampleAuthFilter
- 27. Resources Blackboard Learn Help Center http://help.blackboard.com Shibboleth http://shibboleth.net/ CAS http://www.jasig.org/cas alex.varju@blackboard.com dan.rinzel@blackboard.com This presentation will be available via http://edugarage.com at some point after the 27 conference ends.
Notes de l'éditeur
- Agenda for the presentation.
- Password transmission is hashed regardless of SSL encryption of the whole HTTP requestGetting the user credentials INTO Learn can be accomplished in a number of ways – go check out Jim Riecken’s presentation after this one
- This is your LDAP/Active Directory/Atlassian Crowd modelThe “thumbs up” is received by Learn from the credential provider and the user is granted access (or not)
- This is your CAS, Shibboleth or OpenID modelAs with the prior model, the remote server vouches for the user
- Went from back end config file incantation with service restart prior to verification, to GUI-enabled real-time configuration, testing, enabling and chainingSimilar in many ways to the transition from banging on an old IBM typewriter, busting out the whiteout or starting completely over when you found a typo.To our modern word processor experience where you can move and make corrections with (relative) ease.You still have to get the writing right – you still have to successfully connect and properly configure, and your user data still has to be useful in both Learn and in the provider
- Went from back end config file incantation with service restart prior to verification, to GUI-enabled real-time configuration, testing, enabling and chainingSimilar in many ways to the transition from banging on an old IBM typewriter, busting out the whiteout or starting completely over when you found a typo.To our modern word processor experience where you can move and make corrections with (relative) ease.You still have to get the writing right – you still have to successfully connect and properly configure, and your user data still has to be useful in both Learn and in the provider
- Multiple fully delegated providers can be “lined up” on one login pageDelegated or credential providers can be restricted to only particular login hostnamesDifferent custom login pages can be built for different hostnames (requires Community license)
- All login attempts, successful logins, logouts and session expirations are recorded in a dedicated log file in the logs directory of the application server, as well as in a database table that supports the searching & filtering UI shown here. The database table is purged periodically by a database job, and can also be purged manually from this UI.
- Because so many configuration options are available now from the User Interface, we needed to design a fallback mechanism to allow an administrator to access the system regardless of it’s current configuration state – the solution is the command-line emergency login URL generator.It requires back-end access (or a Managed Hosting ticket), and generates a one-time-use URL with an expiration time, allowing access to the system to revert any broken configuration.
- Apache 2 is supported, but doesn’t ship inside the SP8 installer. Once Learn is installed, you can configure your instance to point to an Apache 2 serverCentral Authentication Service – originally built by Yale and supported by Jasig (Java in Administration Special Interest Group) since 2004LDAP – lightweight directory access protocol – used by Microsoft’s Active Directory product among others
- The new framework is built using extension points, allowing Building Blocks to interact with the platform. If you are writing a custom authentication plugin, these are the two classes you will be working with.
- These are some more extension points that the platform exposes, allowing you to intercept and modify the behaviour of the core system.AuthenticationListener receives notification whenever anything interesting happens related to authentication. Sample events include Login, Logout, SessionExpiry, and Failed Login.PostLoginUrlInterceptor could be used to alter the standard destination after a user logs in. For example, you could use this to send the user to the change password page when they log in for the very first time.UsernamePasswordAuthenticationProviderFilter allows you to disable individual authentication providers based on the current request context. We use this internally to implement the restricted hostnames feature, only allowing a provider to be used if the request was sent to a specific hostname.UsernamePasswordPreValidationCheck and UsernamePasswordPostValidationCheck allow you to abort a login request either before or after the password validation has occurred. We’ll be using these today to implement a filter that temporarily locks an account if too many bad login attempts are received in a short period of time.
- In addition to the interfaces that you can implement within your Building Block, the new authentication framework includesa number of helper classes that you can call.Worth highlighting here is AuthenticationProvider. Building Blocks can supply AuthenticationProviderHandler implementations, telling the framework how to do your type of authentication. AuthenticationProvider represents a deployed instance of your handler. Administrators can deploy multiple instances of a single handler, each with their own properties. Each instance of fully delegated providers shows up as another link on the login screen, and each delegated credential provider gets called until one approves or denies the password-based login request.
- This sequence diagram shows what happens during a fully delegated login. When the user logs in:Your handler provides the URL where you want the user to be sent to start the authentication processThe user is then sent to this URL and you can do whatever is necessary to confirm that the user is authentic. For example, with the CAS handler we bounce the user over to the CAS server, have them log in there, and then they get bounced back to our Building Block where we can validate the CAS responseOnce we know the user is authentic, we figure out which Blackboard Learn account to connect them with (either by username or batch_uid), and activate their session.
- Delegated credential authentication is driven by Learn. Within this process, there are a number of places you can inject extensions to alter the system behaviour.
- This is the interface for our helper class that we’ll use to keep track of login attempts.shouldBlock will be called before each login attemptsuccessfulLogin will be called after a login succeedslockedUntil provides information when reporting errorsI won’t go into the implementation of this class during today’s presentation. The essence of the implementation is a HashMap keyed by username storing all recent login attempts.Note: Some of the code shown here has been tweaked slightly to make the slides easier to read. The full code will be made available afterwards.
- This is our first extension point.If the login counter indicates there have been too many attempts for this username, return UserDenied along with an informative error that will be shown to the end user
- This is our second extension point. Since we know that the user entered a valid password, we’ll clear any previous login attempts. This ensures that users with valid credentials can log in and out as many times as they want.
- Now it’s time to wire up our extension implementations. Most of this is boilerplate. A few things to notice, though:I’ve included a webapp-type element. This tells the platform that your Building Block includes extension implementations.The extension-defs element is where we register our specific extensions.First, we define our own namespace. This helps ensure that our extension IDs don’t collide with extensions from other Building Blocks.Next, we list the extensions themselves. Each extension has:A unique identifier.The identifier of the extension point being implemented. The fully qualified name of our implementation classA singleton flag, indicating that the platform may reuse the same instance of our extension each time
- Here you can see the result after too many bad login attempts.
- And here is what the administrator sees. The Error event is our custom event, which contains our “Too many login attempts” warning. Above this is the failed Login Attempt event that the framework logged because an extension point aborted the login, which includes the IP address of the attacker.
- There are lots of things that you can do with the new authentication framework. To help you get started, we’ve released the source code for the LDAP provider which ships with the latest version of Blackboard Learn. We will also be making the full source code from today’s presentation available.The LDAP code is a compilable, runnable version of the shipping LDAP B2, in a separate namespace, so that they can be run in parallelThe sample code can be pulled from github, it is not intended to be run in production! It has several shortcuts and limitations as described in the readme file.
- You can learn more about how the base features of the framework operate from the Learn Help CenterYou can learn more about Shibboleth and CAS from their own sites