admin/Facilitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FSN#24078 Authenticatie flow.

Browse Source 
svn path=/Website/trunk/; revision=12257
This commit is contained in:
Jos Groot Lipman
2012-08-29 10:40:08 +00:00
parent 52391db079
commit 75d106a1ad
9 changed files with 73 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
APPL/API/api.inc
View File

@@ -36,7 +36,8 @@
APIname: APIname,
APIKEY: APIKEY,
file: oRs("fac_api_filepath").Value,
no_session: oRs("fac_api_no_session").Value,
// niet meer gebruikt. API=machine2machine is nooit session
// no_session: oRs("fac_api_no_session").Value,
prs_perslid_key: oRs("prs_perslid_key").Value,
loglevel: oRs("fac_api_loglevel").Value,
usrrap_key: oRs("fac_usrrap_key").Value,
@@ -44,8 +45,9 @@
import_app_key: oRs("fac_import_app_key").Value,
options: eval("("+oRs("fac_api_options_json").Value+")"),
viewmapping: eval("("+oRs("fac_api_viewmapping_json").Value+")")
}
oRs.Close();
// We doen niets met eventuele prs_perslid_key; dat doet loginTry.asp maar voor ons
}
oRs.Close();
// We doen niets met eventuele prs_perslid_key; dat doet loginTry.asp maar voor ons
}
%>

12
APPL/API/shorturl.asp
View File

@@ -28,7 +28,10 @@
// dat is hier safer dan Request.QueryString
rest = rest.substring(("u="+u).length+1);
var sql = "SELECT fac_bookmark_path, fac_bookmark_query"
var sql = "SELECT fac_bookmark_path,"
+ " fac_bookmark_query,"
+ " prs_perslid_key_auth,"
+ " fac_bookmark_unauth_url"
+ " FROM fac_bookmark"
+ " WHERE fac_bookmark_id = " + safe.quoted_sql(u)
+ " AND (fac_bookmark_expire IS NULL OR fac_bookmark_expire > SYSDATE)";
@@ -40,6 +43,13 @@
}
var url = oRs("fac_bookmark_path").Value;
if (oRs("prs_perslid_key_auth").Value)
{
Session("fallback_user_key") = oRs("prs_perslid_key_auth").Value; // wordt opgepikt door loginTry.asp
}
else
Session("unauth_url") = oRs("fac_bookmark_unauth_url").Value; // wordt opgepikt door common.asp
if (oRs("fac_bookmark_query").Value)
{
url += "?" + oRs("fac_bookmark_query").Value + (rest?"&"+rest:"");

9
APPL/FAC/fac_edit_bookmark.asp
View File

@@ -30,6 +30,8 @@ var bkm_query;
var bkm_naam;
var bkm_aanmaak;
var bkm_prskey;
var bkm_prskey_auth;
var bkm_unauth_url;
if (bkm_id != "")
{
@@ -37,6 +39,8 @@ if (bkm_id != "")
+ " , fac_bookmark_query"
+ " , fac_bookmark_naam"
+ " , fac_bookmark_aanmaak"
+ " , prs_perslid_key_auth"
+ " , fac_bookmark_unauth_url"
+ " , prs_perslid_key"
+ " FROM fac_bookmark"
+ " WHERE fac_bookmark_id = " + safe.quoted_sql(bkm_id);
@@ -46,6 +50,8 @@ if (bkm_id != "")
bkm_query = oRs("fac_bookmark_query").value;
bkm_naam = oRs("fac_bookmark_naam").value;
bkm_aanmaak = oRs("fac_bookmark_aanmaak").value;
bkm_prskey_auth = oRs("prs_perslid_key_auth").value;
bkm_unauth_url = oRs("fac_bookmark_unauth_url").value;
bkm_prskey = oRs("prs_perslid_key").value;
oRs.close();
}
@@ -93,6 +99,9 @@ else
RWFIELDTR("naam", "fldfac_name", L("lcl_fac_bookmark"), bkm_naam, { required: true, maxlength: 60 });
RWFIELDTR("path", "fldfac_path", L("lcl_fac_bookmarkpath"), bkm_path, { required: true, maxlength: 1000 });
RWFIELDTR("query", "fldfac_query", L("lcl_fac_bookmarkquery"), bkm_query, { maxlength: 1000 });
RWFIELDTR("prskey_auth", "fld", L("lcl_bkm_prskey_auth"), bkm_prskey_auth);
RWFIELDTR("unauth_url", "fld", L("lcl_bkm_unauth"), bkm_unauth_url, { maxlength: 1000 });
FCLTpersoonselector("sgPers",
"sgPers",
{ perslidKey: bkm_id != ""? bkm_prskey : user_key,

8
APPL/FAC/fac_edit_bookmark_save.asp
View File

@@ -30,9 +30,11 @@ var path = getFParam("path");
if (path.substring(0, rooturl.length).toUpperCase() == rooturl.toUpperCase())
path = path.substring(rooturl.length);
var fields = [ { dbs: "fac_bookmark_naam", typ: "varchar", frm: "naam", len: 60 },
{ dbs: "fac_bookmark_path", typ: "varchar", val: path, len: 1000 },
{ dbs: "fac_bookmark_query", typ: "varchar", frm: "query", len: 1000 }
var fields = [ { dbs: "fac_bookmark_naam", typ: "varchar", frm: "naam", len: 60 },
{ dbs: "fac_bookmark_path", typ: "varchar", val: path, len: 1000 },
{ dbs: "fac_bookmark_query", typ: "varchar", frm: "query", len: 1000 },
{ dbs: "prs_perslid_key_auth", typ: "key", frm: "prskey_auth" },
{ dbs: "fac_bookmark_unauth_url", typ: "varchar", frm: "unauth_url", len: 1000 }
];
var warning = "";

4
APPL/FAC/fac_show_api.asp
View File

@@ -120,9 +120,9 @@ function prettyJson(j)
var proto = (Request.ServerVariables("SERVER_PORT") == "443")? "https" : "http";
var sitenoroot = proto + "://" + Request.ServerVariables("SERVER_NAME");
var site = sitenoroot + rooturl;
var deep = site + "?API="+oRs("fac_api_name").Value+"&APIKEY="+oRs("fac_api_apikey").Value;
var deep = site + "/?API="+oRs("fac_api_name").Value+"&APIKEY="+oRs("fac_api_apikey").Value;
ROFIELDTR("fldtxt",L("lcl_fac_api_sample"), deep);
var deep = site + "?fac_id="+customerId+"&API="+oRs("fac_api_name").Value+"&APIKEY="+oRs("fac_api_apikey").Value;
var deep = site + "/?fac_id="+customerId+"&API="+oRs("fac_api_name").Value+"&APIKEY="+oRs("fac_api_apikey").Value;
ROFIELDTR("fldtxt",L("lcl_fac_api_of"), deep);
BLOCK_END();
%>

16
APPL/FAC/fac_show_bookmark.asp
View File

@@ -31,6 +31,8 @@ var sql = "SELECT fac_bookmark_path"
+ " , fac_bookmark_query"
+ " , fac_bookmark_naam"
+ " , fac_bookmark_aanmaak"
+ " , prs_perslid_key_auth"
+ " , fac_bookmark_unauth_url"
+ " , prs_perslid_key"
+ " FROM fac_bookmark"
+ " WHERE fac_bookmark_id = " + safe.quoted_sql(bkm_id);
@@ -40,6 +42,8 @@ var bkm_path = oRs("fac_bookmark_path").value;
var bkm_query = oRs("fac_bookmark_query").value;
var bkm_naam = oRs("fac_bookmark_naam").value;
var bkm_aanmaak = oRs("fac_bookmark_aanmaak").value;
var bkm_prskey_auth = oRs("prs_perslid_key_auth").value;
var bkm_unauth_url = oRs("fac_bookmark_unauth_url").value;
var bkm_prskey = oRs("prs_perslid_key").value;
oRs.close();
%>
@@ -93,6 +97,8 @@ oRs.close();
ROFIELDTR("fldtxt", L("lcl_fac_bookmark"), bkm_naam);
ROFIELDTR("fldtxt", L("lcl_fac_bookmarkpath"), bkm_path);
ROFIELDTR("fldfac_query", L("lcl_fac_bookmarkquery"), bkm_query);
ROFIELDTR("fld", L("lcl_bkm_prskey_auth"), bkm_prskey_auth);
ROFIELDTR("fld", L("lcl_bkm_unauth"), bkm_unauth_url);
FCLTpersoonselector("sgPers",
"sgPers",
{ perslidKey: bkm_prskey,
@@ -102,6 +108,16 @@ oRs.close();
});
ROFIELDTR("flddatetime", L("lcl_fac_bookmarkcreate"), toDateTimeString(bkm_aanmaak));
BLOCK_END();
BLOCK_START("apiSample", L("lcl_fac_bookmark")+" "+L("lcl_fac_api_sample"));
var proto = (Request.ServerVariables("SERVER_PORT") == "443")? "https" : "http";
var sitenoroot = proto + "://" + Request.ServerVariables("SERVER_NAME");
var site = sitenoroot + rooturl;
var deep = site + "/?u=" + bkm_id;
ROFIELDTR("fldtxt",L("lcl_fac_api_sample"), deep);
var deep = site + "/?fac_id="+customerId+"&u=" + bkm_id;
ROFIELDTR("fldtxt",L("lcl_fac_api_of"), deep);
BLOCK_END();
%>
</form>
<iframe src="../Shared/empty.html" name="hidFrameSubmit" style="display:none"></iframe>

10
APPL/Shared/Common.inc
View File

@@ -171,10 +171,10 @@ if (user_key < 0 && typeof ANONYMOUS_Allowed == "undefined")
Response.Write('{"warning":"'+L("lcl_session_expired").replace(/\n/g,"\\n").replace(/\"/g,"\\\"") +'","success":false}');
Response.End;
}
if (S("login_url").match(/^http/))
var url = S("login_url");
else
var url = rooturl + "/" + S("login_url"); // "appl/shared/login.asp";
var url = Session("unauth_url") || S("login_url"); // unauth_url uit shorturl.asp
if (!url.match(/^http/))
var url = rooturl + "/" + url; // "appl/shared/login.asp";
ret_page = String(Request.ServerVariables("SCRIPT_NAME"));
ret_page = ret_page.replace(/\/default.asp$/i, "/");
url = protectQS.create(url + "?querystring=" + Server.URLencode(Request.ServerVariables("QUERY_STRING"))
@@ -184,6 +184,8 @@ if (user_key < 0 && typeof ANONYMOUS_Allowed == "undefined")
if (user_key > 0)
{
Session.Contents.Remove("fallback_user_key"); // uit shorturl.asp. Ondertussen niet meer nodig
Session.Contents.Remove("unauth_url"); // uit shorturl.asp. Ondertussen niet meer nodig
Session("user_key") = user_key;
/* global */ user = new Perslid(user_key);

2
APPL/Shared/Shared.inc
View File

@@ -750,7 +750,7 @@ function determineCustomerId()
if ( typeof Session("customerId") == "undefined" ) // ASP-Sessie verlopen of nieuw binnen.
{
if (Request.QueryString("fac_id").Count>0 && Request.QueryString("api").Count>0)
if (Request.QueryString("api").Count>0 && Request.QueryString("apikey").Count>0)
{
Session.Abandon(); // Voorkom dat een session ontstaat doordat we een API-call doen.
// When the Abandon method is called, the current Session object is queued for deletion

23
APPL/Shared/loginTry.asp
View File

@@ -34,8 +34,15 @@ if (typeof Session("sso_sgf") == "string") // Vanuit SGF12-portal/ sso_sgf.asp
if (user_key < 0)
SimpleSSO(); // de base64 simple sso
if (user_key < 0 && S("os_logon"))
IntegratedSSO(); // Voor licentieklanten
if (user_key < 0)
{
if (getQParam("session", "")) // Ingscande QR-code
{
setUserFromSession(getQParam("session"));
if (user_key > 0)
makeSessionCookie(""); // Altijd 'definief' cookie plaatsen
}
}
if (user_key < 0) // Probeer de user_key uit een cookie te halen
{
@@ -57,16 +64,20 @@ if (user_key < 0)
}
}
if (user_key < 0 && S("os_logon"))
IntegratedSSO(); // Voor licentieklanten
if (user_key < 0)
{
if (getQParam("session", "")) // Ingscande QR-code
if (Session("fallback_user_key") > 0) // (QRC) bookmark met fallback user_key
{
setUserFromSession(getQParam("session"));
if (user_key > 0)
makeSessionCookie(""); // Altijd 'definief' cookie plaatsen
doLogin(Session("fallback_user_key"));// gezet in Shorturl.asp
Session.Contents.Remove("fallback_user_key");
}
}
// Pas h<><68>l laat api_user_key zetten om te voorkomen dat je
// bestaande sessie ongeldig wordt (Vinder/ telefoongids)
var APIname = getQParam("API", "");
var APIKEY = getQParam("APIKEY", "");
if (user_key < 0 && APIname && APIKEY)