This document discusses various aspects of profile management in ATG including: - The DAF servlet pipeline and how it handles requests - Tracking both anonymous and registered users through profiles and sessions - Security status values and how they control access - Password management features like expiration, hashing, and rules

1. Kate Soglaeva
ADVANCED
ATG PROFILE
MANAGEMENT

2.  DAF Servlet Pipeline
 Tracking users
 Security status
 Access control
 Auto login
 Profile markers
 Password management
AGENDA

3. DAF SERVLET PIPELINE

5.  PageFilter starts the DAF servlet pipeline by calling
DynamoHandler
PAGEFILTER

6. startRequestServletName

7. TRACKING USERS

8. Users
anonymous registered
USERS
8

9. •Transient profile
•Transient order
Session
started
•Persistent profile
•Persistent order
Registration
USERS
9

10. 1. Store anonymous users
# /atg/userprofiling/ProfileRequestServlet
persistAfterLogout=true
persistentAnonymousProfiles=true
2. Update required properties
TRACKING ANONYMOUS USERS
10

11. Set up auto-login
CookieManager
 sendProfileCookies=true
ProfileRequestServlet
 verifyBasicAuthentication=false
TRACKING REGISTERED USERS
11

13. PROFILEREQUESTSERVLET
creates an instance of the atg/userprofiling/Profile
create a cookie containing the Profile ID of the current guest
user
Auto-logs in
maintain persistent
information: persistentAnonymousProfiles=true

14. 14
SECURITY STATUS

15. Value Login method used
0 Anonymous
1 Auto Login by URL parameter
2 Auto Login by Cookie
3 Login by HTTP basic auth
4 Explicit login or registration by http
5 Explicit login or registration by https
6 Certificate provided
Group Explanation
0 The user is unknown
1,2 Auto login. Personalization is fine by restricted access to sensitive pages.
4,5 Explicit login. Full access
3,6 Project specific
SECURITY STATUS VALUES

16.  Extract profile by DYN_USER_ID
PROFILEREQUEST
16

17. <dsp:droplet name="Compare">
<dsp:param bean="Profile.securityStatus" name="obj1"/>
<dsp:param bean="PropertyManager.securityStatusLogin"
name="obj2"/>
<dsp:oparam name="lessthan">
<!-- send the user to the login form -->
<dsp:include page="login_form.jsp"></dsp:include>
</dsp:oparam>
<dsp:oparam name="default">
<!-- allow the user to proceed to the protected content -->
<dsp:include page="protected_content.jsp"></dsp:include>
</dsp:oparam>
</dsp:droplet>
SECURITY STATUS USAGE
17

18.  provides authentication using the Basic HTTP authentication
mechanism
AUTHENTICATIONSERVLET

19. 19
ACCESS CONTROL

21. 21

22. ACCESSCONTROLLER
22

23. <ruleset>
<accepts>
<rule op=eq>
<valueof target="Gender">
<valueof constant="female">
</rule>
</accepts>
</ruleset>
RULEACCESSCONTROLLER.
RULESETSERVICE
23

24. 25
PASSWORD EXPIRATION

26. /atg/userprofiling/ExpiredPasswordService
enabled=true
passwordValidForNumDays=30
redirectPath=expirePassword.jsp
/atg/dynamo/servlet/pipeline/ExpiredPasswordServlet
localUrlsToAllow=/style/css/style1.jsp
PASSWORD EXPIRATION
27

27. PASSWORD EXPIRATION
Confidential 28

28. PASSWORD EXPIRATION
Confidential 29

29. INSERTING SERVLETS IN
THE PIPELINE

30. STEPS TO CREATE PIPELINE SERVLET
Add the servlet to /atg/dynamo/servlet/Initial.initialServices
Set the new servlet’s nextServlet property
Reset the previous servlet’s nextServlet property
Define global scope component
Extend atg.servlet.pipeline.PipelineableServletImpl

31. PIPELINEBLESERVLET

32. INSERTABLESERVLET

33. 1. Disable unnecessary servlets
2. Add new servlets if required
Ex. Reprice order functionality
HOW TO USE?

34. 35Confidential
PROFILE MARKERS

35. USER PROFILE MARKERS

36. 37Confidential
PASSWORD

37. Confidential 38

38.  ATG 10.0
/atg/userprofiling/PropertyManager/
 ATG 10.1 /atg/userprofiling/InternalPropertyManager/
PASSWORD HASHING
Confidential 39

39.  SHA-256
algorithm with a random salt, and iteratively rehashes the
result.
ATG 10.1 OOTB PASSWORD HASHING
Confidential 40

40.  MD5
algorithm and then encodes the result using base 16 encoding
ATG 10.0 OOTB PASSWORD HASHING
Confidential 41

41.  passwords will be stored and compared in clear text
DISABLE PASSWORD HASHING
Confidential 42

42. PASSWORDRULECHECKER
Confidential 43

43. THANK YOU!
QUESTIONS?