Oracle9iAS Portal Developer Kit (PDK)
Understanding Basic Authentication for URL-Based Portlets

Introduction

Using the PDK, you can portletize the contents of any third party application which is authenticated by basic authentication. The process is very similar to creating a standard external application portlet.  This article describes the fundamental principles behind building a portlet that renders third party content secured by a basic authentication.

Setup

The first thing you must do to create basic authentication portlets is to install the PDK Release 2 framework.  After you have installed the framework, you can create a new provider that will access your basic authentication application.  The new provider must have the following tags (they should be inserted after the <providerInstanceClass> tags but before the <portlet> tags):

<authentication class="oracle.portal.provider.v2.security.Authentication">
  <authType>basic</authType>
</authentication>

By including the above tags in your provider.xml file, you are indicating that your provider will be mapped to an external application which uses basic authentication as it's authentication mechanism.  In other words, your portlet will retrieve login credentials from the SSO Server and use these credentials to authenticate against the URL you specify in the <pageUrl> tag.

You may wish to setup a provider that not only logs into a basic authentication application, but also retrieves and passes along additional fields from the SSO Server to the basic authentication application.  For example, suppose you want to create a portlet to return MetaLink query results for "PDK".  You would have to create a basic authentication application to login to MetaLink (which uses basic authentication).  You would also have to tell that application that you want to pass "PDK" as the string to be queried.  In this case, you would simply create the external application, give it the appropriate login URL, specify basic authentication, and, in the additional fields section of the external application, provide the field name and field value corresponding to the desired extra field (in this case, field name would be "p_text" and field value would be "PDK").  Then in the provider.xml for your provider, you would need to use the following tag lines:

<provider class="oracle.portal.provider.v2.http.URLProviderDefinition">
  <providerInstanceClass="oracle.portal.provider.v2.http.BasicURLProviderInstance">
  ...
  <authentication class="oracle.portal.provider.v2.security.Authentication">
    <authType>basic</authType>
  </authentication>
  ...
  <portlet class="oracle.portal.provider.v2.http.URLPortletDefinition">
    ...
    <renderer class="oracle.portal.provider.v2.render.RenderManager">
    <showPage class="oracle.portal.provider.v2.render.http.BasicURLRenderer">
      ... 

Once you have created your provider.xml file, you must deploy your provider on OC4J as described in the How to Build a URL-Based Portlet article.

Configuring the Web Provider

After deploying your web provider on OC4J, you will need to create an external application in the SSO Server for your basic authentication application.  The process will look something like this:

1. Application Name : urlservices_basic_authentication

2. Login URL:  <basic authenticated url> 

   This is the URL that prompts the authentication pop-up window.

3. User Name/ID Field Name:  <leave blank>

4. Password Field Name:  <leave blank>

5. Type of Authentication Used: BASIC AUTHENTICATION

6. Click OK.

7. Click on the External Application link "urlservices_basic_authentication" and provide your username and password when prompted.

At this point, you will want to register your provider.  The process is the same as registering any web provider, however you must tell the provider to map the Portal user's identity to a different name in the web provider's application.  You can do this by selecting the appropriately labeled radio button.  You must then select the external application which this provider will map to.

Once you have registered your provider, you can start adding the basic authentication portlet to a page.

Limitations

In order to authenticate deep links existing in URL Content, user information is attached to the URL, in-line. 

Example :

Deep links points to : http://my.server.com/site/myindex.html
After authenticating it : http://<username>:<password>@my.server.com/site/myindex.html

This way the user is automatically authenticated through each link, but the user information is also exposed outside (in the URL).

In order to suppress this deep link authentication mechanism, you will need to set <useAuthLinks> to false in provider.xml

Example:

<filter class="oracle.portal.provider.v2.render.HtmlFilter">
<useAuthLinks>false</useAuthLinks>
. . . 
</filter>