LiveCycle Authentication with ColdFusion

Here's a snippet of ColdFusion code that will allow you to athenticate a LiveCycle user using the AuthenticationManagerService service that's shipped with LCES 8.2. You can then use the results to pull the user's oid, userId, full name, etc, from the authenticateResponse.

More importantly, you can use the assertion string to implement SSO with SAML. Once you have the assertion, you can call validateAssertion on the same service to validate the user and get their information. In other words, you can perform the authentication using ColdFusion, and then for example, pass the assertion to your flex app so that you don't force the user to authenticate again.

<cfset username = "administrator">
<cfset password = toBase64('password')>

<cfsavecontent variable="xml">
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<SOAP-ENV:Body>
<m:authenticate xmlns:m="http://adobe.com/idp/services">
<m:username><cfoutput>#username#</cfoutput></m:username>
<m:password><cfoutput>#password#</cfoutput></m:password>
</m:authenticate>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
</cfsavecontent>

<cfhttp url="http://servername:portnumber/soap/services/AuthenticationManagerService?wsdl" method="post">
<cfhttpparam type="cgi" name="SOAPAction" value="authenticate">
<cfhttpparam type="xml" name="authenticateRequest" value="#xml#">
</cfhttp>

<cfset xml = xmlParse(cfhttp.filecontent)>
<cfset assertion = xmlSearch(xml, "//*[local-name()='assertion']")>
<cfoutput>#htmleditformat(assertion[1].xmltext)#</cfoutput>

Authentication with Flex Remoting in Workspace

If you're getting the following error, it probably means that you have a RemoteObject call within your flex application that's loaded up as a workspace task (process / form / etc). You won't see this error if you're using the same credentials to log into workspace as what you're using for your remoting call, but it'll pop up if you try to log into workspace with another random user.

That being said, you should not authenticate your endpoints in flex and simply ensure that all users who need access to your workspace task have both "Services User" and "LiveCycle Workspace User" roles assigned to them.

fault = (mx.rpc::Fault)#2
errorID = 0
faultCode = "Channel.Authentication.Error"
faultDetail = "Cannot re-authenticate in the same session."
faultString = "warn"
message = "faultCode:Channel.Authentication.Error faultString:'warn' faultDetail:'Cannot re-authenticate in the same session.'"
name = "Error"
rootCause = (mx.messaging.messages::ErrorMessage)#3

Configuring a livecycle workspace process / task for all users

We created a flex application that we in turn wanted to load up within the Adobe Livecycle Workspace ES (8.2). When originally deployed, only the super administrator was able to view it, but no other workspace enabled users. Here are the steps to configure your task properly.

• Log into the Adobe LiveCycle Administration Console
• Click on Services
• Click on Applications and Services
• Click on Service Management
• Find and click on your applicable service
• Click the security tab
• Click on "Add Principal"
• Click on "All Principals", or the user(s) / group(s) in question
• Select the "INVOKE_PERM" permission
• Make sure to save your changes

If the user in question can't login to workspace at all, make sure they have the "LiveCycle Workspace User" role assigned to them.

Flex DocumentReference and LiveCycle 8.2

If you plan to use a DocumentReference to send a file to LiveCycle, such as an xml file, you need to ensure that you're using the latest adobe-remoting-provider.swc found xxx\LiveCycle8.2\LiveCycle_ES_SDK\misc\DataServices\Client-Libraries.

Previous versions of the DocumentReference allow for xml, but with 8.2, you need to send your document within the text property.

Look at "LCDS-325" at http://help.adobe.com/en_US/livecycle/8.2/lcds_releasenotes.html if you want more details or plan to fix this change on the LiveCycle side, but at the end of the day, it's easier to simply update your swc and text property.

Get current user for a workspace enabled flex application

Here is a sample code snippet if you have to pull user information or user credentials from the signed-in workspace user when a flex application is loaded as a process/form in workspace.

import lc.core.ISessionManager;
import lc.domain.SessionMap;
import mx.utils.ObjectUtil;

var session : SessionMap = SessionMap( Application.application.session );
var sessionManager : ISessionManager = ISessionManager( session.getObject( "lc.core.ISessionManager" ) );

trace( ObjectUtil.toString( sessionManager.authenticatedUser ) );

You'll see that authenticated user is mapped to lc.domain.User. You'll need the latest fds.swk and fds_rb.swc for this. Below is an example of what you'll get back.

(lc.domain::User)#0
address = (null)
description = (null)
displayName = "Super Administrator"
domain = (null)
email = ""
emailAliases = (null)
firstName = (null)
groups = (null)
initials = (null)
isOutOfOffice = false
lastName = (null)
locale = (null)
oid = "8D1446F6-A3DD-F4C2-378B-1B46089140AA"
session = (null)
telephone = ""
timezone = (null)
userid = "administrator"