Logging In With Credentials From a File

Before you start, prepare IG and the sample application as described in Getting Started Guide.

1. On your system, add the following data in a comma-separated value file called /tmp/userfile (on Windows C:\Temp\userfile):

   username,password,fullname,email
   george,C0stanza,George Costanza,george@example.com
   kramer,N3wman12,Kramer,kramer@example.com
   bjensen,H1falutin,Babs Jensen,bjensen@example.com
   demo,Ch4ng31t,Demo User,demo@example.com
   kvaughan,B5ibery12,Kirsten Vaughan,kvaughan@example.com
   scarter,S9rain12,Sam Carter,scarter@example.com

2. Add the following route to IG, to serve .css and other static resources for the sample application:

   $HOME/.openig/config/routes/static-resources.json

   %appdata%\OpenIG\config\routes\static-resources.json

   {
     "name" : "sampleapp_resources",
     "baseURI" : "http://app.example.com:8081",
     "condition": "${matches(request.uri.path,'^/css')}",
     "handler": "ReverseProxyHandler"
   }

3. Add the following route to IG:

   $HOME/.openig/config/routes/02-file.json

   %appdata%\OpenIG\config\routes\02-file.json

   {
     "name": "02-file",
     "condition": "${matches(request.uri.path, '^/profile')}",
     "capture": "all",
     "handler": {
       "type": "Chain",
       "baseURI": "http://app.example.com:8081",
       "config": {
         "filters": [
           {
             "type": "PasswordReplayFilter",
             "config": {
               "loginPage": "${matches(request.uri.path, '^/profile/george') and (request.method == 'GET')}",
               "credentials": {
                 "type": "FileAttributesFilter",
                 "config": {
                   "file": "/tmp/userfile",
                   "key": "email",
                   "value": "george@example.com",
                   "target": "${attributes.credentials}"
                 }
               },
               "request": {
                 "method": "POST",
                 "uri": "http://app.example.com:8081/login",
                 "form": {
                   "username": [
                     "${attributes.credentials.username}"
                   ],
                   "password": [
                     "${attributes.credentials.password}"
                   ]
                 }
               }
             }
           }
         ],
         "handler": "ReverseProxyHandler"
       }
     }
   }
   

   Notice the following features of the route:

   • The route matches requests to /profile.

   • The PasswordReplayFilter specifies a loginPage page property:

     • When a request is an HTTP GET, and the request URI path is /profile/george, the expression resolves to true. The request is directed to a login page.

       The FileAttributesFilter looks up the key and value in /tmp/userfile, and stores them in the context.

       The request object retrieves the username and password from the context, and replaces the browser's original HTTP GET request with an HTTP POST login request, containing the credentials to authenticate.

     • For other requests, the expression resolves to false. The request passes to the ReverseProxyHandler, which directs it to the profile page of the sample app.

1. Go to http://openig.example.com:8080/profile/george.

   Because the property loginPage resolves to true, the PasswordReplayFilter processes the request to obtain the login credentials. The sample app returns the profile page for George.

2. Go to http://openig.example.com:8080/profile/bob, or to any other URI starting with http://openig.example.com:8080/profile.

   Because the property loginPage resolves to false, the PasswordReplayFilter passes the request directly to the ReverseProxyHandler. The sample app returns the login page.