DFS and SSO? Creating a Context w/o a password?

Hello all,

I'm new to DFS and I have a question about the Context you have to create to get the ball rolling. I have a J2EE app the user logs into. Inside of that I want to provide access to data in Documentum.

The problem is that I don't know the logged in user's password - all the calls that create a context require a username, password, and repository name, AFAICT. Is there a way to effectively switch users from an administrator account to a specific user's account? Are there ways to use SSO (Kerberos or SAML) in the Context creation?

Thanks,

Bret

Find more posts tagged with

Comments

zhou_simonq

you can register you context to avoid passing the authentication info each time. for more info, pls refer to DFS dev guide.

DFS supports SSO with Netegrity and RSA SSO providers. kerberos support should be included in the next release.

bschuhma

That's great, but how do I get the password the FIRST time so I can create the initial Context object to register? My issue is that getService requires a repository (I have that), the username (I have that), and that user's Documentum password, which I *don't* have. I need some options to get the first context for that user... Thanks for the reply, though! :-)

zhou_simonq

i don't know how to access a repository without knowing the password for a user:)

to construct a service context, you must first initialize an identity, which is either RepositoryIdentity or SSOIdentity currently. in these two cases, password is a must.

- simon

bschuhma

Simon - things are starting to fall into place... Based on your last answer (SSOIdentity) and the previous (Netegrity/Siteminder, Kerberos, etc.) it looks like I can pass an SSO token to SSOIdentity instead of the password, based on this from the 6.5 Developer Guide:

{
SsoIdentity identity = new SsoIdentity();
identity.setUserName(username);
identity.setPassword(token);
identity.setSsoType("dm_rsa");

...

The customer doesn't have Siteminder, nor are they using a RSA ClearTrust server. They are implementing Kerberos, though... When you say "the next version" are you speaking of the next major (i.e. 7.0) or a point release (i.e. 6.6)? Any idea when that will be available?

Thanks again, Simon!

Bret

bschuhma

Along the lines of my orginal question, does anyone know if setIdentity(String userName), a DFC method, is available in DFS? This would get what I want...

Thanks,

Bret

zhou_simonq

SSO should be released in 6.5 SP3 but needs confirmation. Pls wait until then and check the release notes.

which class is setIdentity() in for DFC? what's the purpose of this function?

bschuhma

I don't know the class for setIdentity(), but I understand that it sets the identity of the user for the subsequent requests, allowing you to basically switch users. I thought I read about another method, called "assumeUser()", too...

Is there any commonality or similarity between the WDK authentication schemes (i.e. a list of authentication schemes that are tried in order until one succeeds) and DFS? By that I mean, does DFS allow other (or customizable) authentication schemes that would provide some flexibility? All I can find are methods that require username, password, and repository.

Maybe I'm approaching this wrong. Let me restate my goals and maybe you can suggest something:

I have a J2EE app that can invoke POJO code or web services. I need to get access to a Documentum 6.5 repository, but I don't have the logged in user's password. What's the best way to achieve this? WDK? DFC? DFS?

Thanks for staying with this, Simon!! :-)

Rgds,

Bret