Integrating an existing account system by using CAS

If you already have your own user account system and want to connect it directly to iPortal without making new accounts, then iPortal provides you with a CAS-based approach to integrate existing user account system.

This section uses MySQL as the database for the sample user account system to introduce the configuration process:

• Add account type field
• Install and configure CAS
• Enable CAS login
• Other optional configurations
• Implementing SSO with iPortal and user application system

Add account type field

In the database of your application account system, add a new field "usertype" (other name can also be used) and set a value for this field of each account record. You can use the SQL statement to set the usertype in batches which is more convenient and fast. The value can be cas_ADMIN, cas_USER, cas_PUBLISHER or a custom value.  By default, cas_ADMIN is mapped to the administrative role in iPortal, iServer or iEdge; cas_USER corresponds to the common user role and cas_PUBLISHER corresponds to the publisher role in iServer or iEdge. To use the accounts in iPortal, it's recommended to use a custom value and you need to configure the mapping relationships in iPortal to bind to built-in roles defined by iPortal.

Install and configure CAS

For the installation and configuration of CAS, please refer to: CAS installation and configuration. Note: since you already have your own database, skip the steps of creating database, and use your database connection information when configuring the related steps.

Enable CAS login

Log in iPortal with your administrator account, click Management>Security>Login Configuration>CAS Configuration. On the CAS Configuration page, select "Enable", then set the user attribute field in CAS and the address of the CAS service, then click "Save". Descriptions of the configuration items:

• "Built-in account login" refers to whether the users created with the account system offered by iPortal can log in iPortal when enabling CAS login. If enabled, both iPortal users and the CAS users can log in to iPortal. If disabled, the iPortal can only be accessed by the CAS users.
• "CAS attribute field" refers to the "usertype" you created in the above step. Used to associate the roles offered in iPortal.
• "CAS access address" is the address of the configured CAS server.

The CAS Configuration page lists the default mapping relationships between CAS user type and built-in roles. For normally using iPortal, click "Add attribute role configuration" in the "Attribute role associated information configuration" area, the required "Attribute" marked with red "*" on the dialog should be inputted the custom value you set when "Add account type field", then specify roles provided in iPortal. The CAS users associated with ADMIN, PORTAL_USER or PORTAL_VIEWER roles can log in to iPortal successfully. Otherwise, the unregistered status will be displayed on the iPortal home page.

After finishing the above configurations, the logged CAS users can only browse maps, services, etc., while cannot perform operations like creating maps, registering services. To make these operations available to user, additional configurations are required. Open shiro.ini file which locates in [SuperMap iPortal installation directory]\webapps\iportal\WEB-INF folder with a text editor, add casRealm.backRealm parameter for casRealm variable as shown in the following bold codes. After finishing the edit, restart iPortal service.

...

casRealm = com.supermap.iportal.security.IportalCasRealm

casRealm.attributeRuleMapping = iserver_att={cas_SYSTEM=[SYSTEM,ADMIN],cas_PUBLISHER=[PUBLISHER],cas_USER=[USER]}

...

usernamepasswordrealm = com.supermap.services.security.BuiltInTokenSupportedRealm

casRealm.backRealm = $usernamepasswordrealm

...

Note：

• The shiro.ini file does not exist before the iPortal service is started for the first time. Please edit the file after the iPortal service is first started.
• When the account of a user application system logs in to iPortal through CAS, the user is recorded in the iPortal user table. Therefore, if an account in the user application system is deleted, the user recorded in iPortal needs to be deleted synchronously. Otherwise, users also take up one user license for iPortal.
• If the CAS user has the same name as the iPortal user, since the iPortal user name is unique, even if the above configuration is performed, the CAS user can only have the right to browse maps, services, etc., but cannot create maps, register services, etc. Therefore, please note that when setting up CAS users, try to avoid duplicate name with existing iPortal user.

Other optional configurations

If you need to set the CAS server login and logout address different from the CAS server authentication address (for example, the CAS server is running in a dual network card or multiple network card environment, the CAS server login and logout addresses are different from the CAS server authentication address, i.e., IP), based on the above configuration, add the casRealm.casLoginLogoutPrefix parameter in the shiro.ini file (located under [SuperMap iPortal installation directory]\webapps\iserver\WEB-INF) to configure the CAS Server login and logout address shown as following in the bold code:

casRealm.enabled = false

casRealm.reserveSystemAccount = true

casRealm.casServerUrlPrefix = http://{ip}:{port}/cas

casRealm.casLoginLogoutPrefix=http://{ip}:{port}/cas

...

Implementing SSO with iPortal and user application system

After configuring the user application system according to the above steps, the user can login to the iPortal, make maps and do other operations. However, the user application system and the iPortal did not achieve SSO. Only logging in to iPortal is implemented. In order to realize the SSO between user application system and iPortal, you need to modify the web.xml of your application system to enable CAS login authentication when logging in to user application system. However, this modification can only implement login validation. If user application system requires more detailed permission validation, e.g., some URLs, that can only be accessed by some users and for this, CAS extension development is required.

The Personal Center -> My information will block the function of modifying personal information when user login to iPortal via CAS. If the user needs to modify account information, e.g., modifying the nickname, you need to open the blocked "My Information" page or make extension development to the page to modify the user's nickname, and then by calling iPortal's modified nickname resource. Note that you needs to synchronize the nickname in the user account information of the CAS connection with the user nicknames recorded in the iPortal user table to make them consistent.