Getting started with the user management
Posted by Giampiero Granatella
on 29th January, 2010
This is the first tutorial of the user management series in Portofino. Any real information system has users and permissions. Users are the real people who will access the system's data. Permissions are the set of rules that determine that access to data. Overall, this is called user management. In this tutorial we are going to model users in Portofino and configure the portofino-custom.properties to activate them.
Since version 3.0, Portofino adds new functionality in this area, including more detailed profiles, more flexible authentication and improved communication through automatic emails.
Managing users and authentication requires a data model. At the very least, we should have a class to store user credentials (username and password). Also, groups and group membership should be stored somewhere.
We could start modeling such classes from scratch, but to make life easier, Portofino can create a predefined model at the press of a button. Specifically, you have to do the following steps:
- go upstairs,
- click on the "Meta user groups" tab,
- click on "create user model" link.
Portofino takes you to a page where it points out the operations it performs.
Portofino created the following classes:
- "User", to store user credentials (login, password and email attributes) and user life-cycle information (state, creation date, etc).
- "UserGrp" and "User_UserGrp" classes, to store Portofino groups and to associate them to users.
- "OldPwd", to store old passwords and avoid password reuse.
- "EmailQueue", to store the outgoing email queue.
And it sets the permissions on these so that, for example, a user cannot modify another user's profile unless he is an administrator.
Portofino creates the default user "admin" with password "admin" and the default groups: "Users" and "User administrators".
Since 3.0, for greater security, passwords are saved encrypted in the database.
Class listeners are an advanced feature. This section is for expert Portofino users. If you click on the "Classes" tab and inspect the newly created model, in the class "User" you'll find two class listeners:
- "add to User group", used to automatically associate a user to the "User" group
- "check email and login", used to avoid duplication of login or email for different users.
Once you've create the user data model, you still have to configure the system to use it properly. Locate the
portofino-custom.propeties file you used during the installation and follow the instructions below.
Add or edit the following line:
As an optional configuration you may want to disable anonymous access to the system:
This will force users to log onto the system before they can start using it.
Save the file, then restart the application server to make the changes effective.
Since 3.0 Portofino has a new set of parameters to configure the desired level of security.
Some parameters set the password strength and the account usage properties. For example we could set:
model.users.pwd.minlength=6 model.users.pwd.expiry.days=60 model.users.pwd.keep.old.number=2 model.users.pwd.attempts.maxnumber=3 model.users.pwd.inactivity.maxdays=30
With these parameters we'll have passwords that:
- have, at least, six characters,
- expire after 60 days (afterwards users have to change them)
- cannot be the same as the user's previous two password (in this way, password are not reused too frequently).
Moreover a user's account is suspended if:
- if the user enters a wrong password three times in a row during login, or
- if a user doesn't log in for more than 30 days.
Portofino uses email to send automatic notifications to users. For example let's configure Portofino for an email account on Gmail.
mail.smtp.host=smtp.gmail.com mail.smtp.port=465 firstname.lastname@example.org mail.smtp.password=your_password mail.smtp.ssl.enabled=true email@example.com
Notice that we've chosen this example because Gmail uses SSL and an unusual port number. You can and should customize the setting for your specific account.
With the just created portofino-custom.properties we have enabled a considerable set of functionality (see a complete list in the reference), these are:
- Change password
- Password recovery
- Insert User
- Manage user state
- Reset password
- Users and groups
For now, you can experiment with the functionality on your own.
Read the next tutorial "Basic use cases for User Management".
As a further reading I suggest: