I do a lot of work with Vignette's VAP (AKA - Epicentric) & the blending of .Net with it. The most important module I see them having that I haven't seen anywhere else is what is called a webconnector module (portlet). We use this to pull in disparate applications into the one view. I have seen an HTML clip and there is the IFRAME option, but neither of these can do the "Autologon" behind the scenes. Has anyone seen a module for DNN that would do this?

Requirement would be something like - Pull in a secure application into DNN without the user having to login a second time.

In my humble opinion, this seems to be the most useful module we use in an enterprise model. I would say 3/4 of the portlets we use are off of the webconnector portlet.

Thx,
Michael

Michael,

I am curious -- is the premise that the authentication for disparate systems is somehow in sync? Or is there a mechanism that portlets use for passing authentication from the portal to other systems.

Nik

Nik,

No, actually completely not in sync. IE - there are several existing websystems that are existing & potentially using their own authentication systems. VAP has a webconnector module that passes credentials for either post, or get pages. In addition, they support windows level security (if sent in cleartext).

I was hoping that someone has either thought about this, or developed this. If so, I think DNN can be a serious player in the enterprise portal market.

Thx,
Michael

A lot of people bounced some ideas around 6 months ago or so. I don't think that they came up with anything better than putting the username and password combo in the URL call i.e. http://user:password@externalapp.com

However, Microsoft has just released an IE patch that will invalidate this type of URL so it can't really be used reliably. That's just as well, since sending your username and password in clear text is just asking for problems!

I would be very interested if anybody can give you a good answer to this. I'm interested in it for a non-DNN project and I haven't found any really good way that it can be done without significantly compromising website security.

Good luck!

mike.

Well, there is one way... Vignette.. ugghh.. but that is a very pricey option...

Michael

When you say portlet in Vignette are we talking WSRP?

Yes. One additon they have though is the auto logon capability, which I think is the key to bringing in disparate systems.

Thx,
michael

Do you have any concept or documentation as to how the auto-login?

I am wondering if they do a "key-box" concept where their application houses usernames and passwords to other systems for each users. When the user calls to the other system, the Key-Box is opened and the proper credentials sent.

Or

Are they sending user/pass in the url, form post, etc.... not particularly secure. If we can get a better handle on this, there is certainly room within DNN for this type of integration.

Yeah, I emailed you the user doc for the module.

I think they do the second option. straight form post or they also support windows authentication as long as the user id & pw are sent in clear text.

Thx,
Michael

Did you ever get an answer as to whether anyone is developing a module similar to webconnector?

I am not aware of one however I did just have a thought. I know it's hard to believe. ;)

Xmod module allows for, I believe, "tokens" for Username and password of the currently logged in user. It also allows for the Xmod form to be HTTP Posted with that information to any URL or values passed via the URL line to any URL. While the security risk associated with doing this is something for the implementor to deal with, the ability to do that may already exist.

the only thing that would not exist, again just my understanding so far, is that the form could not be made to automatically submit to a URL. However with some clever javascripting I believe you could cause an automated submit ofo the form to occur upon loading the form.

Just a thought and nothing more but perhaps worth investigating further if true security "integration" is not an option and instead passing the credentials, albeit nont secure in my mind, might help some folks out.

mm

I am thinking out loud here but in theory it should work. How about you make a modified iframe module that nor directly uses the iframe , does an xmlhttpcal and in that call pass username and password and url and refering url ( javascript function to get the referrer, or the ip of the user that is browsing)

In the xmlhttp call ( to another aspx page or whatever ) you check if the username and password match and if the referer is correct ( so you can only call it from that dnn page or machine ip or iprange) and then you fill the iframe with the content you just received so another url is loaded on the iframe and the login password credential are passed

The external app ofcourse needs the same type of check also so if username and password match and the dnnpage or user iprange is allowed as being able to call thispage then do autologin based on url credentials

Then you have an iframe filled with external app and passed user credentials, this hould work I think ;)

Gmail uses this in there compose email and spell checking functionality

I also work with the Vignette Portal at work. And one of the nice features that the WebConnector has that no one is talking about is the ability to pull tables from other sites into your own portal and look seemless. So in a sense its like having an RSS feed, but its not an RSS, just pulling table tags and its content and throwing everything else out. This would be a great feature to add as well.

Also, here are a few other modules that Vignette has that would be really nice in DNN in an enterprise enviroment...

-Outlook Email Module (All Pulled From Exchange Server)
-Outlook Calendar Module
-Outlook Task Module
-Outlook Note Module
-Outlook Contacts Module
-Weather Module
-Content Management System
-This has many modules that tie together.
-Content Viewer Module
-Site Map Module

There are one or two commercial modules that do HTML scraping like that as well as the free one that we updated to run on DNN 2.1.2 called HTMLFeed. I think it may do the basics of what you are talking about.

The others you mention could be nice. Just note:

Weather modules already exist for DNN (Various developers)
SiteMap already exists (Speerio)
Content Managment (Possibly through Advanced Publishing system from Byte on Snowcovered)

Outlook stuff (Exchange) not a bad idea.

Any thoughts to updating HTMLFeed to run under DNN 3.x? I tried to upload it under 3.0.11 and got the following message:

Resource Upload Logs

StartJob Starting Installation
StartJob Reading files
Info Loading icon_htmlfeed_32px.gif
Info File icon_htmlfeed_32px.gif read successfully
Info Loading HtmlFeed.ascx
Info File htmlfeed.ascx read successfully
Info Loading HtmlFeed.dnn
Info File htmlfeed.dnn read successfully
Info Loading EditHtmlFeed.ascx
Info File edithtmlfeed.ascx read successfully
Info Loading HTMLFeed.dll
Info File htmlfeed.dll read successfully
EndJob Reading files done.

Failure ExceptionSystem.NullReferenceException: Object reference not set to an instance of an object. at DotNetNuke.Modules.Admin.ResourceInstaller.PaInstaller.Install()


Then if I run the Module Definition Validator on HtmlFeed.dnn, it pops back with the following error:

A critical error has occurred.
Value cannot be null. Parameter name: path2