Adobe CQ. Restrict access to site with login/password popup window - authentication

I've faced with a problem. I wanna to show user the popup window when he enters my site. I mean, only specific group of users are able to visit it. How can i do it with CQ? I have investigated alot, but still nothing works. I was thinking to do it with the help of Day CQ HTTP Header Authentication Handler. I added specific path in it's config but nothing changed. Now I am trying to write my own login service. Can you help with ideas? Maybe there is something I have missed? Thank you.

First, you need a Closed User Group on the publish instance.
Second, you need to determine if you need a popup instead of initial page load, or load a default page that runs JavaScript to create the popup if the user doesn't have an active session.

Related

Selenium Chromedriver call to logout page not working

I want to write an automated test with Selenium using Chromedriver and Behat.
This scenario in question should go to a page, register a user, logout and register another user.
Now the problem is, on the website in question, after registration you get an annoying overlay, so that the logout button is not reachable anymore. I can either make the test fill out the overlay and complete it properly, which will take much more effort, or try to logout some other way.
My idea was to simply go to the domain again with /?event=logout added which normally works to log out the current user. However when I do this in the automation it fails, apparently because of a bad http response code.
Is it not possible to use a url like this with Selenium? Anyone have an idea?
You can achieve this with Selenium using a site that makes GET requests. So you can go to URL http://requestmaker.com/, fill the www.website.com in the Request URL, and 'event=logout' in the Request data, then click "Submit".
It's a bit hacky, so I would prefer using a GET request directly in the code, depending on your programming language... Something like so:
https://www.mkyong.com/java/how-to-send-http-request-getpost-in-java/
Some options would be:
Navigate to URL to logout and try to hide the modal via jQuery/javascript
After registration navigate to homepage and see if the modal is there and if you can logout as you should
Clear session and navigate to the page you need
Pick one of them.

Showing file selection UI : Integrating Dropbox with OAuth 2

I am trying to create a web page which will allow my user to upload a file to my S3 storage. For choosing the file user can use Google Drive, Dropbox and also local system. Am facing issues while implementing the Dropbox part of this.
Am using this technique for integration(using core API and OAuth 2).
First when user chooses Dropbox i am opening an HTML page in an IFrame. Here I have an authorize button which will open the authorize endpoint mentioned in the above link. This link shows me X-FRAME-Options error inside the Iframe so i had to open this link as a popup to work.
Is there a way around this? I'd like the authorize URL to open in the same iframe by using location.href.
Also when i open it as a popup, after the user logs in successfully the redirect_uri which i pass i getting opened in the popup. I had to do some unconventional setInterval coding to go around this. Can someone suggest a solution for this as well?
I also tried using CSRF tokens as mentioned in Smarx's blog but this also gives me the same error.
EDIT :
#smarx i tried using dropbox.js and it works fine. Stuck at one place
I used the OAuth popup driver and have a button which says sign-in.
First on load i create the client and then the popup driver as below
client = new Dropbox.Client({ key: client_id });
client.authDriver(new Dropbox.AuthDriver.Popup({
receiverUrl: "http://localhost/uploadCare/dbcallback.html"
});
);
And in the call back html i am writing
Dropbox.AuthDriver.Popup.oauthReceiver()
as mentioned in the docs.
But this does not take me back to the original page and show me the list of files.
I particularly did not understand this part of the explanation
"To use the popup driver, create a page on your site that contains the receiver code, change the code to reflect the location of dropbox.js on your site, and point the Dropbox.AuthDriver.Popup constructor to it."
Could you please help me out here.
You definitely can't put dropbox.com into an iframe, for security reasons (e.g. clickjacking).
A few suggestions:
Can you just use the Chooser for your use case? That would certainly be easier for you and your users.
If you can't use the Chooser, is there a reason you're not using dropbox.js? It has a popup auth driver that will pretty much just take care of all this for you. The redirect will definitely happen in the same window as auth, so communication between the windows (usually via localStorage) is generally necessary. This is already done in dropbox.js.

Login to Google from iFrame

I have seen that it is not possible to display any Google page from an iframe. An error message is displayed: cannot display, open in a new window.
I need to login to Google (OpenId authentication) from an iFrame in Joomla (cannot change this). Is there a workaround for this? I thought I could open the authentication page in a new window, and then try to kill that window and reload the original one, but I am not sure I can do that.
Thanks
Well you can just get the form (html code) and put it in your iframe but this will get very messy, for example, there maybe certain JS files that you need to include as well.
Redirecting to Google is best way to implement it.As Using IFrame Sometime does not allowed by some Companies Due to Security.

How can I capture user's last login and display the next time they login to the website in XPages?

I am working on developing a custom user portal using XPages. I would like to capture a user's last login/signin information and display it on the portal when the user logs in on the banner page.
Does anyone know how I can accomplish this for an XPages app?
Any help or insight into this is greatly appreciated.
Thank you!
Shabana.
My Portal Link: http://bit.ly/OJmanJ
I do this with a User document and just save the information of the last login there. Then I set a flag in sessionScope to know that I saved it already.
I don't think this information is logged automatically anywhere. So you need to log it yourself and then display this logged information on your portal.

How to detect if user has switched Rails 3

A user logs into my application in a tab in a browser
They get an email and click a link which opens a new tab in the same browser and logs them in under a different email say.
If they go back to the first tab they are no longer the same user and I want the page to automatically detect this and then reload or redirect them if they are unauthorized to view the page.
Anyway to do this?
Or, if you really want to know when user is switched the tab, try this library:
visibility.js
As stated by #Hck:
add javascript code to reload page periodically (for example once per 30 seconds) – Hck
JavaScript is pretty much the only way to make pages do stuff after they're loaded. Note that in pretty much any user authentication system, a given browser will only be logged in as one user at a time, so as soon as the second tab opens, that browser will be acting as the second user - they can still see the current content of the first tab, but links (for instance) will no longer work unless the second user was also authorized to use them.
There are some JQuery plugins that do this sort of thing, like PeriodicalUpdater, or you can write your own (an example).