Metacat

an external LDAP server. You may choose the authentication mechanism during initial configuration.

If neither of these choices is suitable for your deployment, a custom authentication mechanism can be built.

File-Based Authentication

This is the default authentication mechanism in Metacat. The password file

path can be specified during initial configuration. The Tomcat user should have 

write/read permission to access the file. The password file follows this form:

  <?xml version="1.0" encoding="UTF-8"?>

  <subjects>

  	<users>

		<user dn="uid=john,o=NCEAS,dc=ecoinformatics,dc=org">

			<password>csilPspPJdMx8zt7L9XKXeUxZjkPgKZd.o7TTPC0oJOFmT2kQ/E92</password>

			<email>foo@foo.com</email>

			<surName>Smith</surName>

			<givenName>John</givenName>

			<organization>NCEAS</organization>

			<memberof>cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org</memberof>

		</user>

		<user dn="uid=brand,o=NCEAS,dc=ecoinformatics,dc=org">

			<password>$2a$10$j8eGWJBEpj5MubdaqOeJje7oYw6JNc2aq2U7buoRw16kthwOEcWkC</password>

		</user>

	</users>

	<groups>

		<group name="cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org">

			<description>Developers at NCEAS</description>

		</group>

	</groups>

  </subjects> 

The password stored in the file is hashed using Bcrypt algorithm.  If you have the "-i" in the 

the file. You may also get the hash of a password from any online tool, 

such as https://www.dailycred.com/blog/12/bcrypt-calculator (we don't have any guaranty on the security of those tools), 

then use the "-h" to pass the hashed password to the file by the utility.

You can edit the password file manually or use Metacat's command line utility 

for managing users and groups. The utility is located in the deployed Metacat webapp::

  $METACAT/WEB-INF/scripts/bash/authFileManager.sh.

./authFileManager.sh useradd -i -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>] 

./authFileManager.sh useradd -h <hashed-password> -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]

./authFileManager.sh groupadd -g <group-name> [-d <description>] 

./authFileManager.sh usermod -password -dn <user-distinguish-name> -i 

./authFileManager.sh usermod -password -dn <user-distinguish-name> -h <new-hashed-password> 

./authFileManager.sh usermod -group -a -dn <user-distinguish-name> -g <added-group-name> 

./authFileManager.sh usermod -group -r -dn <user-distinguish-name> -g <removed-group-name> 

.. Note:: 

  Metacat currently uses Bcrypt algorithm to hash the password. The hashed password following the "-h" should be generated by a Bcrypt algorithm. 

  The hash string usually contains $ signs which can interfere with the command line arguments. You should use two SINGLE quotes to wrap the entire hashed string.

  The <user-distinguish-name> must look like "uid=john,o=something,dc=something,dc=something" and the group-name must look like "cn=dev,o=something,dc=something,dc=something".

  If an option value has spaces, the value should be enclosed in double quotes.

  The "-d <description>" option in the "groupadd" command is optional; 

  "-g <groupname> -e <email-address> -s <surname> -f <given-name> -o <organizationName>" in the "useradd" command are optional as well.

LDAP-Based Authentication

Before the Metacat 2.4.0 release, LDAP was the default authentication mechanism and was configured to use 

the NCEAS LDAP server. We are now restricting access to the server to only trusted partners who can 

guarantee secure communication with their clients and the LDAP server. 

If you are not on the list, you can contact us for more information or you may use the password file authentication

(for a small group of users) or set up your own LDAP server (for a big group of users).

.. Note:: 

  If the metacat.properties file has many custom settings, it should be manually 

  backed up before any Metacat upgrade as deploying a new Metacat war file will overwrite

  the existing file.

Metacat uses either an internal password file or LDAP as its authentication mechanism.

We will only allow trusted partners to access the NCEAS LDAP server to ensure the security of our user base.

  ::

    Authentication Class

    Metacat Administrators

    Users Management URL

    Password File Path.

Required configuration values for LDAP authentication are:

  ::

    Authentication Class

    Metacat Administrators

    Users Management URL

    Authentication URL

    Authentication Secure URL. 

will not be allowed to continue with configuration if this is missing. Multiple 

accounts can be entered, separated by the colon (:) character.

.. Note:: 

  To create an account on the password file, please see the section called :doc:`authinterface`.

  To create an LDAP account on the KNB LDAP server (specified as the default LDAP server), 

  go to https://identity.nceas.ucsb.edu and select the "create a new user account" link.