Introduction
The module-mylutece-database
provides a front office user authentication implementation
for MyLutece based on local users stored in a database table.
This module enables comprehensive user account lifecycle management, including:
- User account creation and modification
- Secure authentication with password management (encryption, history, expiration)
- User groups and roles management
- Account lifetime management (expiration, reactivation, anonymization)
- Lost password recovery
- User import/export (XML, CSV)
- Protection against malicious login attempts (IP blocking, CAPTCHA)
The module integrates into Lutece's security architecture and uses the MyLutece system for
front office authentication, while providing a complete administration interface for
user management.
Usage
Administration Rights
The module defines the following administration rights :
- DATABASE_MANAGEMENT_USERS : Database user management
- DATABASE_GROUPS_MANAGEMENT : User groups management
RBAC Resources
The module defines the following RBAC resources:
- DatabaseResourceIdService (resource type: DATABASE)
- Permission MANAGE: Advanced parameters management
- Permission IMPORT_EXPORT_DATABASE_USERS: User import/export
- GroupResourceIdService (resource type: GROUP_TYPE)
- Permission ASSIGN_GROUP: Assign groups to users
Roles
The following roles are defined (core_admin_role and core_admin_role_resource tables):
- mylutece_database_manager : MyLutece database manager
- assign_groups : Group assignment
Exposed Java Services
DatabaseService
Main service for database user management. Primary methods:
- getService(): Retrieves the singleton service instance
- doCreateUser(DatabaseUser user, String strPassword, Plugin plugin): Creates a new user
- doModifyPassword(DatabaseUser user, String strPassword, Plugin plugin): Modifies a user's password
- doUpdateUser(DatabaseUser user, Plugin plugin): Updates user information
- checkPassword(String strUserGuid, String strPassword, Plugin plugin): Verifies password validity
- isUserActive(String strUserName, Plugin plugin): Checks if a user is active
- getFilteredUsersInterface(DatabaseUserFilter duFilter, boolean bIsSearch, List<DatabaseUser> listUsers, HttpServletRequest request): Filters users based on criteria
- updateUserExpirationDate(int nIdUser, Plugin plugin): Updates user expiration date
- updateUserLastLoginDate(String strLogin, Plugin plugin): Updates last login date
- getXmlFromUser(DatabaseUser user, boolean bExportRoles, boolean bExportGroups, boolean bExportAttributes, List<IAttribute> listAttributes, Locale locale, Plugin plugin): Generates XML from a user
- doAutoLoginDatabaseUser(HttpServletRequest request, DatabaseUser databaseUser, Plugin plugin): Performs automatic login
BaseAuthentication
Database-based authentication implementation. Inherits from PortalAuthentication.
- Manages front office user authentication
- Supports password recovery
- Manages login attempts and IP blocking
- CAPTCHA integration for security
GroupService
User group management service.
DatabaseAccountLifeTimeService
Account lifecycle management service (expiration, notifications, reactivation).
DatabaseAnonymizationService
Service for anonymizing expired account data.
DatabaseUserKeyService
Service for managing user activation and reset keys.
ImportDatabaseUserService
Service for importing users from XML or CSV files.
DatabaseUserParameterService
Service for managing user parameters (account lifetime, password expiration, etc.).
Notification Templates
The module uses the following templates for email notifications:
- mylutece_database_first_alert_mail: First account expiration warning
- mylutece_database_other_alert_mail: Subsequent expiration warnings
- mylutece_database_expiration_mail: Account expiration notification
- mylutece_database_account_reactivated_mail: Account reactivation confirmation
- mylutece_database_unblock_user: IP unblocking
- mylutece_database_password_expired: Password expiration notification
- mylutece_database_mailLostPassword: Lost password recovery email
- mylutece_database_mailPasswordEncryptionChanged: Password encryption change notification
XSL Export
The module provides two predefined XSL exports:
- CSV User Export : Exports users to CSV format with their attributes, roles and groups
- XML User Export : Exports users to XML format with all their data
