Permission-sensitive caching enables you to cache secured pages. Dispatcher checks users' access permissions for a page before delivering the cached page.
Dispatcher includes the AuthChecker module that implements permission-sensitive caching. When the module is activated, the render calls an AEM servlet to perform user authentication and authorization for the requested content. The servlet response determines whether the content is delivered to the web browser.
Because the methods of authentication and authorization are specific to the AEM deployment, you are required to create the servlet.
The servlet recieves only HEAD requests from the render, so you only need to implement the doHead method.
The render includes the URI of the requested resource as a parameter of the HTTP request. For example, an authorization servlet is accessed via /bin/permissioncheck. To perform a security check on the /content/geometrixx-outdoors/en.html page, the render includes the following URL in the HTTP request:
/bin/permissioncheck?uri=/content/geometrixx-outdoors/en.html
The servlet response message must contain the following HTTP status codes:
- 200: Authentication and authorization passed.
package
com.adobe.example;
import
org.apache.felix.scr.annotations.Component;
import
org.apache.felix.scr.annotations.Service;
import
org.apache.felix.scr.annotations.Property;
import
org.apache.sling.api.SlingHttpServletRequest;
import
org.apache.sling.api.SlingHttpServletResponse;
import
org.apache.sling.api.servlets.SlingSafeMethodsServlet;
import
org.slf4j.Logger;
import
org.slf4j.LoggerFactory;
import
javax.jcr.Session;
@Component
(metatype=
false
)
public
class
AuthcheckerServlet
extends
SlingSafeMethodsServlet {
@Property
(value=
"/bin/permissioncheck"
)
static
final
String SERVLET_PATH=
"sling.servlet.paths"
;
private
Logger logger = LoggerFactory.getLogger(
this
.getClass());
public
void
doHead(SlingHttpServletRequest request, SlingHttpServletResponse response) {
try
{
//retrieve the requested URL
String uri = request.getParameter(
"uri"
);
//obtain the session from the request
Session session = request.getResourceResolver().adaptTo(javax.jcr.Session.
class
);
//perform the permissions check
try
{
session.checkPermission(uri, Session.ACTION_READ);
logger.info(
"authchecker says OK"
);
response.setStatus(SlingHttpServletResponse.SC_OK);
}
catch
(Exception e) {
logger.info(
"authchecker says READ access DENIED!"
);
response.setStatus(SlingHttpServletResponse.SC_FORBIDDEN);
}
}
catch
(Exception e){
logger.error(
"authchecker servlet exception: "
+ e.getMessage());
}
}
}
Configure Dispatcher for permission-sensitive caching
The auth_checker section of the dispatcher.any file controls the behavior of permission-sensitive caching. The auth_checker section includes the following subsections:
- url: The value of the sling.servlet.paths property of the servlet that performs the security check.
- filter: Filters that specify the folders to which permission-sensitive caching is applied. Typically, a deny filter is applied to all folders, and allow filters are applied to secured folders.
- headers: Specifies the HTTP headers that the authorization servlet includes in the response.
When Dispatcher starts, the Dispatcher log file includes the following debug-level message:
AuthChecker: initialized with URL 'configured_url'.
The following example auth_checker section configures Dispatcher to use the servlet of the prevoius topic. The filter section causes permission checks to be performed only on secure HTML resources.
Example configuration
|