WaveMaker Visual AJAX Studio 4.0 Training

Authentication

2

How to enable authentication

● Users can be authenticated in many ways depending on the particular environment

● Out of the box there are 2 primary authentications methods for production applications

– Database Authentication

– User names and pass words are stored in a DB

– LDAP or Active Directory Authentication

– User names and pass words are stored in a Directory Server

● A Demo authentication mechanism is provided for prototype and non-production use

● Additionally the underlying architecture (ACEGI) is an extensible security model

3

How to enable authentication

● Open Security editor

● Select Security Provider – Demo

– Database

– LDAP

● Check Enable Security

● Check Show Login Page

● Click Save Security Settings

4

Using Database authentication

● Database which stores username/password must be imported.

● Username and Password must stored as different columns in the same table

● Roles will be discussed later

5

Using Database authentication

● Security Provider: Set to Database

● Enable Security: Allows you to turn authentication on and off during development

● Show Login Page: Allows use of generated login page or you can use API’s to authenticate users behind the scenes (i.e. Using Cookies or other SSO)

● Username Field: Used at Login time

● Username ID Field: The ID field for the username can be used to query for additional information

● Password Field: Password field

● Roles Field: More on this later

6

Using Database authentication

● Once you save the settings a few things happen– An internal security service is

added to the application (more on this in a moment)

– A log in page is created and added to your project.

– Do not change the page name

– You can change the fields, style etc of the page

7

Using Database authentication

● Test Run your application

● Users must enter a valid Username / Password combination– Authentication errors are handled

by the login page by default.

– Login button executed JavaScript to call the Login function.

– Can edit the script via source tab to change the error messages

8

Using LDAP or AD authentication

● LDAP Connection parameters: These can be tricky, work with your LDAP Admin

– LDAP URL – specify the host name and port number of the LDAP server

– Manager DN - distinguished name for LDAP access account

– Manager Password – password for LDAP access account

– User DN Pattern – pattern used to create a distinguished name for the user; should be the name relative to the root DN; argument {0} will contain the username

9

Using Demo authentication

● Use the Demo data source for non-production authentication

● Quickly add and remove usernames/passwords for testing

● Before deployment, change to a more secure authentication data source

10

Calling the Security Service

● If security is enabled, WaveMaker adds the Security Service to the project

● You can access the Security Service and it’s common operations using ServiceVariables – getUserName – returns the current user that is

logged in

– getUserRoles – returns a list of all user roles in the project

– isAuthenticated – takes a username as the argument and returns a Boolean

– logout – logs out the current user and terminates the session

11

Adding a Logout Button

● Create a Logout Button– Add a Button to your page

– Create a New ServiceVariable

– name: logout

– service: securityService

– operation: logout

– Set the Button’s onclick event to logout

● When the Button is clicked, the user will be logged out and the session ended BUT the application will be open on the same page with functionality disabled

● To return to the login page you can set the LogoutServices onResult event to go to the Login page using a Navigation Service Call.

12

Calling the Login Page

● Once a user has logged out you will want to reload the login page

– Add a New Navigation: gotoLoginPage

– The logoutService has an event called onResult set it to gotoLoginPage

13

FYI: Live Layout disable with authentication

● Live Layout cannot run if security is enabled

● Enable security just before a test run of the project

● Disable security while designing

14

Questions?

15

Exercise 10

● Enable security

● Add Roles and Users

● Test Authentication

● Add Logout Button