Custom Authentication Module
There are two types of custom authentication modules, which can be provided by plugins: credentials authentication modules and HTTP authentication modules. The first ones are used to check the credentials user typed in login form on the login page. The second ones are used to authenticate a user by HTTP request without showing login page at all.
Credentials Authentication Module
Credentials authentication modules API is based on Sun JAAS API. To provide your own credentials authentication module you should provide a login module class which must implement the interface javax.security.auth.spi.LoginModule and register it in the jetbrains.buildServer.serverSide.auth.LoginConfiguration.
To make the authentication module active its type name can then be used during Configuring Authentication Settings.
For example:
public class CustomLoginModule implements javax.security.auth.spi.LoginModule {
private Subject mySubject;
private CallbackHandler myCallbackHandler;
private Callback[] myCallbacks;
private NameCallback myNameCallback;
private PasswordCallback myPasswordCallback;
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
// We should remember callback handler and create our own callbacks.
// TeamCity authorization scheme supports two callbacks only: NameCallback and PasswordCallback.
// From these callbacks you will receive username and password entered on the login page.
myCallbackHandler = callbackHandler;
myNameCallback = new NameCallback("login:");
myPasswordCallback = new PasswordCallback("password:", false);
// remember references to newly created callbacks
myCallbacks = new Callback[]{myNameCallback, myPasswordCallback};
// Subject is a place where authorized entity credentials are stored.
// When user is successfully authorized, the jetbrains.buildServer.serverSide.auth.ServerPrincipal
// instance should be added to the subject. Based on this information the principal server will know a real name of
// the authorized entity and realm where this entity was authorized.
mySubject = subject;
}
public boolean login() throws LoginException {
// invoke callback handler so that username and password were added
// to the name and password callbacks
try {
myCallbackHandler.handle(myCallbacks);
}
catch (Throwable t) {
throw new jetbrains.buildServer.serverSide.auth.TeamCityLoginException(t);
}
// retrieve login and password
final String login = myNameCallback.getName();
final String password = new String(myPasswordCallback.getPassword());
// perform authentication
if (checkPassword(login, password)) {
// create ServerPrincipal and put it in the subject
mySubject.getPrincipals().add(new ServerPrincipal(null, login));
return true;
}
throw new jetbrains.buildServer.serverSide.auth.TeamCityFailedLoginException();
}
private boolean checkPassword(final String login, final String password) {
return true;
}
public boolean commit() throws LoginException {
// simply return true
return true;
}
public boolean abort() throws LoginException {
return true;
}
public boolean logout() throws LoginException {
return true;
}
}
Now we should register this module in the server. To do so, we create a login module descriptor:
public class CustomLoginModuleDescriptor extends jetbrains.buildServer.serverSide.auth.LoginModuleDescriptorAdapter {
// Spring framework will provide reference to LoginConfiguration when
// the CustomLoginModuleDescriptor is instantiated
public CustomLoginModuleDescriptor(LoginConfiguration loginConfiguration) {
// register this descriptor in the login configuration
loginConfiguration.registerLoginModule(this);
}
public String getName() {
// return unique name of this module type. e.g. a derivative id will then be used in "auth-config.xml" file
return "custom";
}
@Override
public String getDisplayName() {
// return presentable name of this plugin
return "My custom authentication plugin";
}
@Override
public String getDescription() {
// return human-readable description of this module type
return "Authentication via custom login module";
}
public Class<? extends LoginModule> getLoginModuleClass() {
// return our custom login module class
return CustomLoginModule.class;
}
@Override
public Map<String, ?> getJAASOptions(final Map<String, String> properties) {
// return options which can be passed to our custom login module
// for example, we could store reference to SBuildServer instance here
return null;
}
}
Finally we should create build-server-plugin-ourUserAuth.xml
and zip archive with plugin classes as it is described Plugins Packaging and write there CustomLoginModuleDescriptor
bean:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<beans default-autowire="constructor">
<bean id="customLoginModuleDescriptor" class="some.package.CustomLoginModuleDescriptor"/>
</beans>
Now you should be able to Configuring Authentication Settings to your authentication module.
HTTP Authentication Module
To provide your own HTTP authentication module you should provide a class which must implement the interface jetbrains.buildServer.controllers.interceptors.auth.HttpAuthenticationScheme and register it in the jetbrains.buildServer.serverSide.auth.LoginConfiguration.
To make the authentication module active its type name can then be used during Configuring Authentication Settings.
For example:
public class CustomHttpAuthenticationScheme extends jetbrains.buildServer.controllers.interceptors.auth.HttpAuthenticationSchemeAdapter {
// Spring framework will provide reference to LoginConfiguration when
// the CustomLoginModuleDescriptor is instantiated
public CustomHttpAuthenticationScheme(final LoginConfiguration loginConfiguration) {
// register this scheme in the login configuration
loginConfiguration.registerAuthModuleType(this);
}
@Override
protected String doGetName() {
// return unique name of this module type. e.g. a derivative id will then be used in "auth-config.xml" file
return "custom";
}
@Override
public String getDisplayName() {
// return presentable name of this plugin
return "My custom HTTP authentication plugin";
}
@Override
public String getDescription() {
// return human-readable description of this module type
return "Authentication via custom HTTP scheme";
}
// main method to process HTTP authentication
@Override
public HttpAuthenticationResult processAuthenticationRequest(final HttpServletRequest request,
final HttpServletResponse response,
final Map<String, String> properties) throws IOException {
if (!isAttemptToAuthenticateViaThisHTTPScheme(request)) {
return HttpAuthenticationResult.notApplicable();
}
// perform authentication
final String username = authenticate(request);
if (username == null) {
return HttpAuthUtil.sendUnauthorized(request, response, "Failed to authenticate user", this, properties);
}
return HttpAuthenticationResult.authenticated(new ServerPrincipal(null, username), true);
}
}
Finally we should create build-server-plugin-ourUserAuth.xml
and zip archive with plugin classes as it is described Plugins Packaging and write there CustomHttpAuthenticationScheme
bean:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<beans default-autowire="constructor">
<bean id="customHttpAuthenticationScheme" class="some.package.CustomHttpAuthenticationScheme"/>
</beans>
Now you should be able to Configuring Authentication Settings to your authentication module.
Last modified: 21 April 2019