|
1
17 package org.apache.geronimo.jetty6.handler;
18
19 import java.io.IOException  ;
20 import java.security.AccessControlContext ;
21 import java.security.AccessControlException ;
22 import java.security.PermissionCollection ;
23 import java.security.Principal ;
24
25 import javax.security.auth.Subject ;
26 import javax.security.jacc.PolicyContext ;
27 import javax.security.jacc.WebResourcePermission ;
28 import javax.security.jacc.WebUserDataPermission ;
29 import javax.servlet.ServletException ;
30 import javax.servlet.http.HttpServletRequest ;
31 import javax.servlet.http.HttpServletResponse ;
32
33 import org.apache.geronimo.common.DeploymentException;
34 import org.apache.geronimo.common.GeronimoSecurityException;
35 import org.apache.geronimo.security.Callers;
36 import org.apache.geronimo.security.ContextManager;
37 import org.apache.geronimo.security.IdentificationPrincipal;
38 import org.apache.geronimo.security.SubjectId;
39 import org.apache.geronimo.security.deploy.DefaultPrincipal;
40 import org.apache.geronimo.security.util.ConfigurationUtil;
41 import org.apache.geronimo.jetty6.JAASJettyPrincipal;
42 import org.apache.geronimo.jetty6.JAASJettyRealm;
43 import org.apache.geronimo.jetty6.JettyContainer;
44 import org.mortbay.jetty.HttpException;
45 import org.mortbay.jetty.Request;
46 import org.mortbay.jetty.Response;
47 import org.mortbay.jetty.security.Authenticator;
48 import org.mortbay.jetty.security.FormAuthenticator;
49 import org.mortbay.jetty.security.SecurityHandler;
50
51 public class JettySecurityHandler extends SecurityHandler {
52
53 private String policyContextID;
54
55 private JAASJettyPrincipal defaultPrincipal;
56
57 private String formLoginPath;
58
59 private PermissionCollection checked;
60
61 private PermissionCollection excludedPermissions;
62
63
64 private JAASJettyRealm realm;
65
66 public JettySecurityHandler() {
67 }
68
69 public boolean hasConstraints() {
70 return true;
71 }
72
73 public void init(String policyContextID,
74 DefaultPrincipal defaultPrincipal,
75 PermissionCollection checkedPermissions,
76 PermissionCollection excludedPermissions,
77 ClassLoader classLoader) {
78 this.policyContextID = policyContextID;
79
80 this.defaultPrincipal = generateDefaultPrincipal(defaultPrincipal,classLoader);
81 this.checked = checkedPermissions;
82 this.excludedPermissions = excludedPermissions;
83
84 Authenticator authenticator = getAuthenticator();
85 if (authenticator instanceof FormAuthenticator) {
86 String formLoginPath = ((FormAuthenticator) authenticator).getLoginPage();
87 if (formLoginPath.indexOf('?') > 0) {
88 formLoginPath = formLoginPath.substring(0, formLoginPath.indexOf('?'));
89 }
90 this.formLoginPath = formLoginPath;
91 } else {
92 formLoginPath = null;
93 }
94
95
98 Subject defaultSubject = this.defaultPrincipal.getSubject();
99 ContextManager.registerSubject(defaultSubject);
100 SubjectId id = ContextManager.getSubjectId(defaultSubject);
101 defaultSubject.getPrincipals().add(new IdentificationPrincipal(id));
102 this.realm = (JAASJettyRealm)getUserRealm();
103 assert realm != null;
104 }
105
106 public void doStop(JettyContainer jettyContainer) throws Exception {
107 try{
108 super.doStop();
109 }
110 finally {
111 Subject defaultSubject = this.defaultPrincipal.getSubject();
112 ContextManager.unregisterSubject(defaultSubject);
113 jettyContainer.removeRealm(realm.getSecurityRealmName());
114 }
115 }
116
117
118
123 public void handle(String target, HttpServletRequest request,
124 HttpServletResponse response, int dispatch) throws IOException ,
125 ServletException {
126 String old_policy_id = PolicyContext.getContextID();
127 Callers oldCallers = ContextManager.getCallers();
128
129 try {
130 PolicyContext.setContextID(policyContextID);
131 PolicyContext.setHandlerData(request);
132
133 super.handle(target, request, response, dispatch);
134 } finally {
135 PolicyContext.setContextID(old_policy_id);
136 ContextManager.popCallers(oldCallers);
137 }
138 }
139
140
149
161 public boolean checkSecurityConstraints(String pathInContext,
162 Request request, Response response) throws HttpException,
163 IOException {
164 if (formLoginPath != null) {
165 String pathToBeTested = (pathInContext.indexOf('?') > 0 ? pathInContext
166 .substring(0, pathInContext.indexOf('?'))
167 : pathInContext);
168
169 if (pathToBeTested.equals(formLoginPath)) {
170 return true;
171 }
172 }
173
174 try {
175 String transportType;
176 if (request.isSecure()) {
177 transportType = "CONFIDENTIAL";
178 } else if (request.getConnection().isIntegral(request)) {
179 transportType = "INTEGRAL";
180 } else {
181 transportType = "NONE";
182 }
183 WebUserDataPermission wudp = new WebUserDataPermission (pathInContext, new String [] { request.getMethod() }, transportType);
184 WebResourcePermission webResourcePermission = new WebResourcePermission (request);
185 Principal user = obtainUser(pathInContext, request, response, webResourcePermission, wudp);
186
187 if (user == null) {
188 return false;
189 }
190 if (user == SecurityHandler.__NOBODY) {
191 return true;
192 }
193
194 AccessControlContext acc = ContextManager.getCurrentContext();
195
196
199
200 acc.checkPermission(wudp);
201
202
205 acc.checkPermission(webResourcePermission);
206 } catch (HttpException he) {
207 response.sendError(he.getStatus(), he.getReason());
208 return false;
209 } catch (AccessControlException ace) {
210 response.sendError(403);
211 return false;
212 }
213 return true;
214 }
215
216
235 private Principal obtainUser(String pathInContext, Request request,
236 Response response, WebResourcePermission resourcePermission,
237 WebUserDataPermission dataPermission) throws IOException {
238 boolean unauthenticated = !(checked.implies(resourcePermission) || checked.implies(dataPermission));
239 boolean forbidden = excludedPermissions.implies(resourcePermission) || excludedPermissions.implies(dataPermission);
240
241 Authenticator authenticator = getAuthenticator();
242 if (!unauthenticated && !forbidden) {
243 return authenticator.authenticate(realm, pathInContext, request,
244 response);
245 } else if (authenticator instanceof FormAuthenticator
246 && pathInContext.endsWith(FormAuthenticator.__J_SECURITY_CHECK)) {
247
250 return authenticator.authenticate(realm, pathInContext, request,
251 response);
252 }
253
254 if (request != null) {
258 Principal user = authenticator.authenticate(realm, pathInContext,
260 request, null);
261 if (user != null) {
262 return user;
263 }
264 }
265
266
269 ContextManager.setCallers(defaultPrincipal.getSubject(), defaultPrincipal.getSubject());
271 return defaultPrincipal;
272 }
273
274
282 protected JAASJettyPrincipal generateDefaultPrincipal(
283 DefaultPrincipal defaultPrincipal, ClassLoader classLoader)
284 throws GeronimoSecurityException {
285
286 if (defaultPrincipal == null) {
287 throw new GeronimoSecurityException(
288 "Unable to generate default principal");
289 }
290
291 try {
292 JAASJettyPrincipal result = new JAASJettyPrincipal("default");
293 Subject defaultSubject = ConfigurationUtil.generateDefaultSubject(
294 defaultPrincipal, classLoader);
295
296 result.setSubject(defaultSubject);
297
298 return result;
299 } catch (DeploymentException de) {
300 throw new GeronimoSecurityException(
301 "Unable to generate default principal", de);
302 }
303 }
304
305 }
306 |
Popular Tags |
Java API By Example, From Geeks To Geeks.