Authentication
From HiWiki
PING Discovery: Pilot implementasjon og utforskning av PING -> Security -> Authentication
This section will explain how the authentication of the users is handled in PING. Authentication of a person means to verify the person’s identity. (If you want a more thorough explanation of what authentication actually is, you can take a look at this page).
Log into the system
If we first assume that the user want to log in to the system, he or she has to send an AuthenticateActionType document (a request) to the PING server. When a request is sent to the server, the doPost() method in the PingServlet class is called. It will call the processRequest() method in the PingResponder class. In this method, the ActorTicket will be revealed from the request. Since the user is not already logged in, this ActorTicket (which is a String) will be null. Users will get an ActorTicket consisting of 128 random bits when they log into the system. The ActorTicket is a Universally Unique Identifier (UUID). The ActorTicket will be included in following requests from the client to the server and will be used to identify the user. An ActorTicket is valid for 24 hours. The client can decide whether an ActorTicket is valid for only a session or for multiple sessions by the use of the boolean parameter singelTicket.
The (empty) actorTicket will be used as input parameter when the getActorSession() method is called. Since the actorTicket is null, the method will return an empty AuthenticateResultType object. This AuthenticateResultType object is used as input parameter when the processAction() method in the DefaultActionResponder class is called. From this method, the authorize() method is called which will return true if the username is valid. It will then call the process() method in the DefaultAuthenticateActionResponder class.
The process method will check if the password in the request is the same as the password in the database. The password is stored in a credential document in the patient’s record. If the passwords are equal, a new AuthenticateResultType object is made and many of the attributes are set (actor id, actor ticket, expiration date, creation date and so on). The AuthenticateResultType is wrapped into the result_wrapper object which is returned from the processAction() method in the DefaultActionResponder class.
Authentication when the user is already logged on
As explained before, the user will get an ActorTicket when the authentication is successful. The ActorTicket identifies the user and makes it unnecessary to authenticate with username and password each time a request is sent to the PING server. After the authentication is done, the user gets the ActorTicket which will be included in the following requests.
When the request which contains the ActorTicket is sent to the PING server, it will be handled as explained above. The difference is that the ActorTicket (represented as a String) which is used as parameter in the getActorSession() method in the PingResponder class is not null.
The PingResponder has a reference to a Map object which contains the active ActorTickets. What happens in the getActorSession() method is that the Map object will be checked to see if the ActorTicket already exists. If it exists, an AuthenticateResultType will be returned. If the ActorTicket is older than 24 hours, it is no longer valid and can not be used. The AuthenticateResultType will not be null as in the previous example, and will be used to identify the user when the processAction method in the DefaultActionResponder is called.
How the password is stored in the database
When a new record is created, three default documents will be created and stored in the database. These documents are:
- Credential document
- Actor attribute document
- Access policy document
The Credential document contains the user's password. The user has to log in with a username and password. This password is compared with the password in the Credentials document. This is done in the process method in the DefaultAuthenticateActionResponder class.
