|
1
13 package info.magnolia.cms.security;
14
15 import info.magnolia.cms.beans.config.ContentRepository;
16 import info.magnolia.cms.core.Content;
17 import info.magnolia.cms.core.HierarchyManager;
18 import info.magnolia.cms.i18n.MessagesManager;
19
20 import javax.jcr.PathNotFoundException;
21 import javax.jcr.RepositoryException;
22 import javax.servlet.http.HttpServletRequest  ;
23 import javax.servlet.http.HttpSession ;
24
25 import org.apache.commons.codec.binary.Base64;
26 import org.apache.commons.lang.StringUtils;
27 import org.apache.log4j.Logger;
28
29
30
34 public final class Authenticator {
35
36
39 private static Logger log = Logger.getLogger(Authenticator.class);
40
41
44 private static final String ATTRIBUTE_USER_ID = "mgnlUserId";
46
49 private static final String ATTRIBUTE_PSWD = "mgnlUserPSWD";
51
54 private static final String ATTRIBUTE_USER_NODE = "mgnlUserNode";
56
59 private Authenticator() {
60 }
62
63
68 public static boolean authenticate(HttpServletRequest req) {
69 String credentials = req.getHeader("Authorization"); if (StringUtils.isEmpty(credentials) || credentials.length() <= 6) {
71 return false;
72 }
73 credentials = getDecodedCredentials(credentials.substring(6).trim());
74 Authenticator.setUserId(credentials, req);
75 Authenticator.setPassword(credentials, req);
76 boolean isValid = isValidUser(req);
77 if (!isValid) {
78 req.getSession().invalidate();
79 }
80 return isValid;
81 }
82
83
88 private static boolean isValidUser(HttpServletRequest request) {
89 HierarchyManager hm = ContentRepository.getHierarchyManager(ContentRepository.USERS);
90 try {
91 String userid = Authenticator.getUserId(request);
92 if (StringUtils.isEmpty(userid)) {
93 return false;
94 }
95 Content userPage = hm.getContent(userid);
96 String encodedPassword = new String (Base64.encodeBase64(Authenticator
97 .getPasswordAsString(request)
98 .getBytes()));
99 String fromRepository = userPage.getNodeData("pswd").getString().trim(); String fromBrowser = encodedPassword.trim();
101 if (fromRepository.equalsIgnoreCase(fromBrowser)) {
102 request.getSession().setAttribute(ATTRIBUTE_USER_NODE, userPage);
103
104 String lang = userPage.getNodeData("language").getString(); if (StringUtils.isEmpty(lang)) {
107 lang = MessagesManager.getDefaultLocale().getLanguage();
108 }
109 MessagesManager.setUserLanguage(lang, request.getSession());
110 return true;
111 }
112 }
113 catch (PathNotFoundException e) {
114 log.info("Unable to locate user [" + Authenticator.getUserId(request) + "], authentication failed"); }
116 catch (RepositoryException e) {
117 log.error("Unable to locate user [" + Authenticator.getUserId(request) + "], authentication failed due to a " + e.getClass().getName(), e);
120 }
121 return false;
122 }
123
124
128 private static String getDecodedCredentials(String credentials) {
129 return (new String (Base64.decodeBase64(credentials.getBytes())));
130 }
131
132
136 private static void setUserId(String decodedCredentials, HttpServletRequest request) {
137 request.getSession().setAttribute(ATTRIBUTE_USER_ID, StringUtils.substringBefore(decodedCredentials, ":")); }
139
140
144 private static void setPassword(String decodedCredentials, HttpServletRequest request) {
145 request.getSession().setAttribute(ATTRIBUTE_PSWD, StringUtils.substringAfter(decodedCredentials, ":")); }
147
148
152 public static String getUserId(HttpServletRequest request) {
153 Object userId = request.getSession().getAttribute(ATTRIBUTE_USER_ID);
154 if (userId == null) {
155 String credentials = request.getHeader("Authorization"); if (credentials == null) {
157 return "superuser"; }
159
160 credentials = getDecodedCredentials(credentials.substring(6).trim());
161 Authenticator.setUserId(credentials, request);
162 userId = request.getSession().getAttribute(ATTRIBUTE_USER_ID);
163 }
164 return (String ) userId;
165 }
166
167
171 public static char[] getPassword(HttpServletRequest request) {
172 Object pswd = request.getSession().getAttribute(ATTRIBUTE_PSWD);
173 if (pswd == null) {
174 return StringUtils.EMPTY.toCharArray();
175 }
176 return ((String ) pswd).toCharArray();
177 }
178
179
183 private static String getPasswordAsString(HttpServletRequest request) {
184 return ((String ) request.getSession().getAttribute(ATTRIBUTE_PSWD));
185 }
186
187
191 public static String getCredentials(HttpServletRequest request) {
192 return request.getHeader("Authorization"); }
194
195
199 public static Content getUserPage(HttpServletRequest request) {
200 return (Content) request.getSession().getAttribute(ATTRIBUTE_USER_NODE);
201 }
202
203
207 public static User getUser(HttpServletRequest request) {
208 return new User(getUserPage(request));
209 }
210
211
216 public static boolean isAuthenticated(HttpServletRequest request) {
217 HttpSession session = request.getSession(false);
219 if (session != null) {
220 try {
221 return session.getAttribute(ATTRIBUTE_USER_NODE) != null;
222 }
223 catch (IllegalStateException e) {
224 log.debug("IllegalStateException caught"); return false;
227 }
228 }
229
230 return false;
231 }
232 } |
Popular Tags |
Java API By Example, From Geeks To Geeks.