|
1
19
20 package com.sslexplorer.security;
21
22 import java.io.IOException  ;
23
24 import javax.servlet.http.HttpServletRequest ;
25 import javax.servlet.http.HttpServletResponse ;
26
27 import org.apache.commons.logging.Log;
28 import org.apache.commons.logging.LogFactory;
29 import org.apache.struts.action.ActionForward;
30 import org.apache.struts.action.ActionMapping;
31
32 import com.maverick.crypto.encoders.Base64;
33 import com.sslexplorer.core.RequestParameterMap;
34 import com.sslexplorer.core.UserDatabaseManager;
35
36
43 public abstract class AbstractHTTPAuthenticationModule extends AbstractPasswordAuthenticationModule {
44
45 final static Log log = LogFactory.getLog(AbstractHTTPAuthenticationModule.class);
46
47
49 protected String defaultRealm;
50
51
58 public AbstractHTTPAuthenticationModule(String module, boolean required, String defaultRealm) {
59 super(module, required);
60 this.defaultRealm = defaultRealm;
61 }
62
63
69 public ActionForward startAuthentication(ActionMapping mapping, HttpServletRequest request, HttpServletResponse response)
70 throws SecurityErrorException {
71 if (request.getParameter("auth") != null) {
74 if (request.getSession().getAttribute(Constants.AUTH_SENT) == null) {
75 boolean hasAuthorization = request.getHeader("Authorization") != null
76 && Boolean.TRUE.equals(request.getSession().getAttribute(Constants.AUTH_SENT));
77 try {
78 if (!hasAuthorization) {
79 sendAuthorizationError(request, response, defaultRealm);
80 return null;
81 }
82 } catch (Exception e) {
83 throw new SecurityErrorException(SecurityErrorException.INTERNAL_ERROR, e);
84 }
85 }
86 return new ActionForward("/logon.do", true);
87 } else {
88 return mapping.findForward("display");
89 }
90 }
91
92
95 public Credentials authenticate(HttpServletRequest request, RequestParameterMap parameterMap)
96 throws InvalidLoginCredentialsException, SecurityErrorException, AccountLockedException, InputRequiredException {
97
98 try {
99 String authorization = request.getHeader("Authorization");
100 if (authorization == null) {
101 throw new SecurityErrorException(SecurityErrorException.INTERNAL_ERROR, "No credentials supplied.");
102 }
103
104 request.getSession().removeAttribute(Constants.AUTH_SENT);
105
106 int idx = authorization.indexOf(' ');
107
108 if (idx == -1 || idx == authorization.length() - 1) {
109 throw new InvalidLoginCredentialsException("No Authorization provided.");
110 }
111
112 String method = authorization.substring(0, idx);
114
115 if (!method.equalsIgnoreCase("basic")) {
116 throw new InvalidLoginCredentialsException("Only HTTP Basic authentication is currently supported.");
117 }
118
119 String encoded = authorization.substring(idx + 1);
121 String httpCredentials = new String (Base64.decode(encoded));
122
123 idx = httpCredentials.indexOf(':');
124
125 if (idx == 0 || idx == -1 || idx == httpCredentials.length() - 1) {
126 throw new InvalidLoginCredentialsException("Invalid authorization.");
127 }
128
129 String username = httpCredentials.substring(0, idx);
131 String password = httpCredentials.substring(idx + 1);
132
133 idx = username.indexOf('\\');
135 UserDatabase udb = null;
136 if(idx != -1) {
137 String realmName = username.substring(0, idx);
138 try {
139 udb = UserDatabaseManager.getInstance().getUserDatabase(realmName);
140 username = username.substring(idx + 1);
141 }
142 catch(Exception e) {
143 }
144 } else {
145 udb = UserDatabaseManager.getInstance().getDefaultUserDatabase();
146 }
147
148 try {
149 User account = udb.getAccount(username);
150 scheme.setUser(account);
151 if (password == null || password.equals("")) {
152 throw new InvalidLoginCredentialsException("No password supplied.");
153 }
154 account = doLogon(username, password, scheme.getUser().getRealm().getResourceName());
155 } catch (InvalidLoginCredentialsException ilce) {
156 throw ilce;
157 } catch (UserNotFoundException unfe) {
158 throw new InvalidLoginCredentialsException();
159 } catch (Exception e) {
160 throw new SecurityErrorException(SecurityErrorException.INTERNAL_ERROR, e);
161 }
162 credentials = new PasswordCredentials(username, password.toCharArray());
163 } finally {
164 request.getSession().removeAttribute(Constants.AUTH_SENT);
165 }
166 return credentials;
167 }
168
169
175 public static void sendAuthorizationError(HttpServletRequest request, HttpServletResponse response, String realm)
176 throws IOException {
177 if (log.isInfoEnabled())
178 log.info("Sending auth request for realm " + realm);
179 response.setHeader("WWW-Authenticate", "Basic realm=\"" + realm + "\"");
180 response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
181 request.getSession().setAttribute(Constants.AUTH_SENT, Boolean.TRUE);
182 }
183
184 } |
Popular Tags |
Java API By Example, From Geeks To Geeks.