This is a very simple authentication system for a Ruby on Rails server
in
the same internet domain. It will allow you to get back the username of
the
person hitting your server provided they already have authenticated with
an
IBM Lotus/Domino or Websphere server that uses multi-server based
session
authentication.
IBM Domino/Websphere authentication works by placing an encrypted cookie
for
a given domain. There are a number of ways to find out what this cookie
means.
For instance, you could either:
- Decrypt the cookie using the secret key in the domino directory; or
- Pass that cookie along to a live domino server and get back the
username.
In this example, we are going to use the second option. This means we
take
that cookie and then pass it to an IBM server to check the
authentication.
The cookie is stored in as LTPA token. Here is the ruby on rails code:
require ‘open-uri’
module DominoAuthenication
public
accesses the current user from the session.
overwrite this to set how the current user is retrieved from the
session.
To store just the whole user model in the session:
def current_user
session[:user]
end
def current_user
if session[:user]
@current_user ||= session[:user]
else
begin
tokenstring = “LtpaToken=”
tokenstring = tokenstring + cookies[:LtpaToken] if cookies[:LtpaToken]
OpenURI.open_uri(‘http://[your domino server here]/[your database]/[some
page that returns the username]’,
“Cookie” => tokenstring) do |http|
@current_user = http.read.strip
end
#rescue
end
end
end
end
On the domino side, you just need to create a database and then a page
within the database that has a field returning @username().
This will then return the full username. If you are using QuickPlace for
instance, you will get back something like
“CN=user/OU=placename/OU=QP/O=certifier” and you can deal with this as
you
like in your ruby code.