1 23 24 package org.infoglue.cms.security; 25 26 import java.io.ByteArrayInputStream ; 27 import java.io.IOException ; 28 import java.io.StringReader ; 29 import java.io.UnsupportedEncodingException ; 30 import java.net.URLEncoder ; 31 import java.util.HashMap ; 32 import java.util.Iterator ; 33 import java.util.Map ; 34 import java.util.Properties ; 35 36 import javax.servlet.Filter ; 37 import javax.servlet.FilterChain ; 38 import javax.servlet.FilterConfig ; 39 import javax.servlet.ServletException ; 40 import javax.servlet.ServletRequest ; 41 import javax.servlet.ServletResponse ; 42 import javax.servlet.http.HttpServletRequest ; 43 import javax.servlet.http.HttpServletResponse ; 44 import javax.servlet.http.HttpSession ; 45 46 import org.apache.log4j.Logger; 47 import org.infoglue.cms.applications.common.Session; 48 import org.infoglue.cms.exception.SystemException; 49 import org.infoglue.cms.util.CmsPropertyHandler; 50 import org.infoglue.deliver.util.CacheController; 51 52 57 58 public class InfoGlueAuthenticationFilter implements Filter 59 { 60 private final static Logger logger = Logger.getLogger(InfoGlueAuthenticationFilter.class.getName()); 61 62 public final static String INFOGLUE_FILTER_USER = "org.infoglue.cms.security.user"; 63 64 public static String loginUrl = null; 65 public static String logoutUrl = null; 66 public static String invalidLoginUrl = null; 67 public static String successLoginBaseUrl = null; 68 public static String authenticatorClass = null; 69 public static String authorizerClass = null; 70 public static String serverName = null; 71 public static String authConstraint = null; 72 public static String extraParametersFile = null; 73 public static Properties extraProperties = null; 74 public static String casValidateUrl = null; 75 public static String casServiceUrl = null; 76 public static String casLogoutUrl = null; 77 public static String casRenew = null; 78 79 public void init(FilterConfig config) throws ServletException 80 { 81 loginUrl = config.getInitParameter("org.infoglue.cms.security.loginUrl"); 82 logoutUrl = config.getInitParameter("org.infoglue.cms.security.logoutUrl"); 83 invalidLoginUrl = config.getInitParameter("org.infoglue.cms.security.invalidLoginUrl"); 84 successLoginBaseUrl = config.getInitParameter("org.infoglue.cms.security.successLoginBaseUrl"); 85 authenticatorClass = config.getInitParameter("org.infoglue.cms.security.authenticatorClass"); 86 authorizerClass = config.getInitParameter("org.infoglue.cms.security.authorizerClass"); 87 serverName = config.getInitParameter("org.infoglue.cms.security.serverName"); 88 authConstraint = config.getInitParameter("org.infoglue.cms.security.authConstraint"); 89 extraParametersFile = config.getInitParameter("org.infoglue.cms.security.extraParametersFile"); 90 casValidateUrl = config.getInitParameter("org.infoglue.cms.security.casValidateUrl"); 91 casServiceUrl = config.getInitParameter("org.infoglue.cms.security.casServiceUrl"); 92 casLogoutUrl = config.getInitParameter("org.infoglue.cms.security.casLogoutUrl"); 93 95 if(extraParametersFile != null) 96 { 97 try 98 { 99 extraProperties = new Properties (); 100 extraProperties.load(CmsPropertyHandler.class.getResourceAsStream("/" + extraParametersFile)); 101 } 102 catch(Exception e) 103 { 104 logger.error("Error loading properties from file " + "/" + extraParametersFile + ". Reason:" + e.getMessage()); 105 e.printStackTrace(); 106 } 107 } 108 109 try 110 { 111 initializeCMSProperties(); 112 } 113 catch(Exception e) 114 { 115 e.printStackTrace(); 116 } 117 } 118 119 120 public void doFilter(ServletRequest request, ServletResponse response, FilterChain fc) throws ServletException , IOException 121 { 122 HttpServletRequest httpServletRequest = (HttpServletRequest )request; 123 HttpServletResponse httpServletResponse = (HttpServletResponse )response; 124 125 String URI = httpServletRequest.getRequestURI(); 126 String URL = httpServletRequest.getRequestURL().toString(); 127 if(logger.isInfoEnabled()) 128 { 129 logger.info("URI: + " + URI); 130 logger.info("URL: + " + URL); 131 } 132 133 if(URI.indexOf(loginUrl) > -1 || URL.indexOf(loginUrl) > -1 || URI.indexOf(invalidLoginUrl) > -1 || URL.indexOf(invalidLoginUrl) > -1 || URI.indexOf(logoutUrl) > -1 || URL.indexOf(logoutUrl) > -1 || URI.indexOf("UpdateCache") > -1 || URI.indexOf("protectedRedirect.jsp") > -1) 134 { 135 fc.doFilter(request, response); 136 return; 137 } 138 139 if (!(request instanceof HttpServletRequest ) || !(response instanceof HttpServletResponse )) 141 throw new ServletException ("InfoGlue Filter protects only HTTP resources"); 142 143 HttpSession session = ((HttpServletRequest )request).getSession(); 144 145 String sessionTimeout = CmsPropertyHandler.getSessionTimeout(); 146 if(sessionTimeout == null) 147 sessionTimeout = "1800"; 148 149 session.setMaxInactiveInterval(new Integer (sessionTimeout).intValue()); 150 151 if (session != null && session.getAttribute(INFOGLUE_FILTER_USER) != null) 154 { 155 fc.doFilter(request, response); 163 return; 164 } 166 167 try 169 { 170 boolean isAdministrator = false; 171 172 String userName = request.getParameter("j_username"); 173 String password = request.getParameter("j_password"); 174 175 if(userName != null && password != null) 176 { 177 String administratorUserName = CmsPropertyHandler.getAdministratorUserName(); 178 String administratorPassword = CmsPropertyHandler.getAdministratorPassword(); 179 isAdministrator = (userName.equalsIgnoreCase(administratorUserName) && password.equalsIgnoreCase(administratorPassword)) ? true : false; 180 } 181 182 if(!isAdministrator) 184 { 185 logger.info("Principal:" + httpServletRequest.getUserPrincipal()); 186 if(httpServletRequest.getUserPrincipal() != null && !(httpServletRequest.getUserPrincipal() instanceof InfoGluePrincipal)) 187 { 188 userName = httpServletRequest.getUserPrincipal().getName(); 189 logger.info("Now trusting the container logged in identity..."); 190 } 191 } 192 193 String authenticatedUserName = userName; 194 195 if(!isAdministrator) 196 authenticatedUserName = authenticateUser(httpServletRequest, httpServletResponse, fc); 197 198 if(authenticatedUserName != null) 199 { 200 logger.info("Getting the principal from user name:" + authenticatedUserName); 201 202 InfoGluePrincipal user = getAuthenticatedUser(authenticatedUserName); 203 if(user == null || (!user.getIsAdministrator() && !hasAuthorizedRole(user))) 204 { 205 httpServletResponse.sendRedirect("unauthorizedLogin.jsp"); 207 return; 209 } 210 211 CacheController.clearCache("authorizationCache"); 213 214 if(session != null) 216 { 217 session.setAttribute(INFOGLUE_FILTER_USER, user); 218 setUserProperties(session, user); 219 } 220 221 if(successLoginBaseUrl != null && !URL.startsWith(successLoginBaseUrl)) 222 { 223 checkSuccessRedirect(request, response, URL); 224 } 225 else 226 { 227 fc.doFilter(request, response); 228 return; 229 } 230 } 231 } 232 catch(Exception e) 233 { 234 e.printStackTrace(); 235 } 236 } 237 238 243 244 private void setUserProperties(HttpSession session, InfoGluePrincipal user) 245 { 246 String preferredLanguageCode = CmsPropertyHandler.getPreferredLanguageCode(user.getName()); 247 if(preferredLanguageCode != null && preferredLanguageCode.length() > 0) 248 session.setAttribute(Session.LOCALE, new java.util.Locale (preferredLanguageCode)); 249 else 250 session.setAttribute(Session.LOCALE, java.util.Locale.ENGLISH); 251 252 String preferredToolId = CmsPropertyHandler.getPreferredToolId(user.getName()); 253 if(preferredToolId != null && preferredToolId.length() > 0) 254 session.setAttribute(Session.TOOL_ID, new Integer (preferredToolId)); 255 else 256 session.setAttribute(Session.TOOL_ID, new Integer (0)); 257 } 258 259 public void destroy() { } 260 261 private void checkSuccessRedirect(ServletRequest request, ServletResponse response, String URL) throws ServletException , IOException , UnsupportedEncodingException 262 { 263 String requestURI = ((HttpServletRequest )request).getRequestURI(); 264 265 String requestQueryString = ((HttpServletRequest )request).getQueryString(); 266 if(requestQueryString != null) 267 requestQueryString = "?" + requestQueryString; 268 else 269 requestQueryString = ""; 270 271 String redirectUrl = ""; 272 273 279 if(requestURI.indexOf("?") > -1) 280 redirectUrl = successLoginBaseUrl + requestURI + URLEncoder.encode(requestQueryString, "UTF-8"); 281 else 282 redirectUrl = successLoginBaseUrl + requestURI + URLEncoder.encode(requestQueryString, "UTF-8"); 283 284 logger.info("redirectUrl:" + redirectUrl); 285 ((HttpServletResponse )response).sendRedirect(redirectUrl); 286 } 287 288 private boolean hasAuthorizedRole(InfoGluePrincipal user) 289 { 290 boolean isAuthorized = false; 291 292 logger.info("authConstraint:" + authConstraint); 293 294 if(authConstraint == null || authConstraint.equalsIgnoreCase("")) 295 return true; 296 297 Iterator rolesIterator = user.getRoles().iterator(); 298 while(rolesIterator.hasNext()) 299 { 300 InfoGlueRole role = (InfoGlueRole)rolesIterator.next(); 301 logger.info("role:" + role); 302 if(role.getName().equalsIgnoreCase(authConstraint)) 303 { 304 isAuthorized = true; 305 break; 306 } 307 } 308 309 return isAuthorized; 310 } 311 312 private String authenticateUser(HttpServletRequest request, HttpServletResponse response, FilterChain fc) throws ServletException , Exception 313 { 314 String authenticatedUserName = null; 315 316 AuthenticationModule authenticationModule = AuthenticationModule.getAuthenticationModule(null, null); 317 318 331 332 authenticatedUserName = authenticationModule.authenticateUser(request, response, fc); 333 334 return authenticatedUserName; 335 } 336 337 338 341 342 private InfoGluePrincipal getAuthenticatedUser(String userName) throws ServletException , Exception 343 { 344 AuthorizationModule authorizationModule = null; 345 try 346 { 347 authorizationModule = (AuthorizationModule)Class.forName(authorizerClass).newInstance(); 348 } 349 catch(Exception e) 350 { 351 logger.error("The authorizationModule-class was wrong:" + e.getMessage() + ": defaulting to infoglue:s own", e); 352 authorizationModule = (AuthorizationModule)Class.forName(InfoGlueBasicAuthorizationModule.class.getName()).newInstance(); 353 } 354 355 authorizationModule.setExtraProperties(extraProperties); 356 logger.info("authorizerClass:" + authorizerClass + ":" + authorizationModule.getClass().getName()); 357 358 InfoGluePrincipal infoGluePrincipal = authorizationModule.getAuthorizedInfoGluePrincipal(userName); 359 logger.info("infoGluePrincipal:" + infoGluePrincipal); 360 if(infoGluePrincipal != null) 361 { 362 logger.info("roles:" + infoGluePrincipal.getRoles()); 363 logger.info("groups:" + infoGluePrincipal.getGroups()); 364 } 365 366 return infoGluePrincipal; 367 } 368 369 370 373 public static void initializeProperties() throws SystemException 374 { 375 try 376 { 377 authenticatorClass = CmsPropertyHandler.getServerNodeProperty("deliver", "authenticatorClass", true, null); 378 authorizerClass = CmsPropertyHandler.getServerNodeProperty("deliver", "authorizerClass", true, null); 379 invalidLoginUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "invalidLoginUrl", true, null); 380 successLoginBaseUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "successLoginBaseUrl", true, null); 381 loginUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "loginUrl", true, null); 382 logoutUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "logoutUrl", true, null); 383 serverName = CmsPropertyHandler.getServerNodeProperty("deliver", "serverName", true, null); 384 casRenew = CmsPropertyHandler.getServerNodeProperty("deliver", "casRenew", true, null); 385 casServiceUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "casServiceUrl", true, null); 386 casValidateUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "casValidateUrl", true, null); 387 casLogoutUrl = CmsPropertyHandler.getServerNodeProperty("deliver", "casLogoutUrl", true, null); 388 389 394 395 String extraPropertiesString = CmsPropertyHandler.getServerNodeDataProperty("deliver", "extraSecurityParameters", true, null); 396 if(extraPropertiesString != null) 398 { 399 logger.info("Loading extra properties from propertyset. extraPropertiesString:" + extraPropertiesString); 400 try 401 { 402 extraProperties = new Properties (); 403 extraProperties.load(new ByteArrayInputStream (extraPropertiesString.getBytes("UTF-8"))); 404 } 406 catch(Exception e) 407 { 408 logger.error("Error loading properties from string. Reason:" + e.getMessage()); 409 e.printStackTrace(); 410 } 411 } 412 else 413 { 414 String extraPropertiesFile = CmsPropertyHandler.getProperty("extraParametersFile"); 415 logger.info("Trying to load extra properties from file. extraPropertiesFile:" + extraPropertiesFile); 416 if(extraPropertiesFile != null) 417 { 418 try 419 { 420 extraProperties = new Properties (); 421 extraProperties.load(CmsPropertyHandler.class.getResourceAsStream("/" + extraPropertiesFile)); 422 } 423 catch(Exception e) 424 { 425 logger.error("Error loading properties from file " + "/" + extraPropertiesFile + ". Reason:" + e.getMessage()); 426 e.printStackTrace(); 427 } 428 } 429 430 } 431 432 logger.info("authenticatorClass:" + authenticatorClass); 433 logger.info("authorizerClass:" + authorizerClass); 434 logger.info("invalidLoginUrl:" + invalidLoginUrl); 435 logger.info("successLoginBaseUrl:" + successLoginBaseUrl); 436 logger.info("loginUrl:" + loginUrl); 437 logger.info("logoutUrl:" + logoutUrl); 438 logger.info("serverName:" + serverName); 439 logger.info("casRenew:" + casRenew); 440 logger.info("casServiceUrl:" + casServiceUrl); 441 logger.info("casValidateUrl:" + casValidateUrl); 442 logger.info("casLogoutUrl:" + casLogoutUrl); 443 if(logger.isDebugEnabled()) 444 { 445 if(extraProperties != null) 446 extraProperties.list(System.out); 447 else 448 logger.info("extraProperties:" + extraProperties); 449 } 450 } 451 catch(Exception e) 452 { 453 logger.error("An error occurred so we should not complete the transaction:" + e, e); 454 throw new SystemException("Setting the security parameters failed: " + e.getMessage(), e); 455 } 456 } 457 458 461 public static void initializeCMSProperties() throws SystemException 462 { 463 try 464 { 465 String authenticatorClass = CmsPropertyHandler.getServerNodeProperty("authenticatorClass", true, "org.infoglue.cms.security.InfoGlueBasicAuthenticationModule"); 466 String authorizerClass = CmsPropertyHandler.getServerNodeProperty("authorizerClass", true, "org.infoglue.cms.security.InfoGlueBasicAuthorizationModule"); 467 String invalidLoginUrl = CmsPropertyHandler.getServerNodeProperty("invalidLoginUrl", true, "Login!invalidLogin.action"); 468 String successLoginBaseUrl = CmsPropertyHandler.getServerNodeProperty("successLoginBaseUrl", true, null); 469 String loginUrl = CmsPropertyHandler.getServerNodeProperty("loginUrl", true, "Login.action"); 470 String logoutUrl = CmsPropertyHandler.getServerNodeProperty("logoutUrl", true, "Login!logout.action"); 471 String serverName = CmsPropertyHandler.getServerNodeProperty("serverName", true, null); 472 String casRenew = CmsPropertyHandler.getServerNodeProperty("casRenew", true, null); 473 String casServiceUrl = CmsPropertyHandler.getServerNodeProperty("casServiceUrl", true, null); 474 String casValidateUrl = CmsPropertyHandler.getServerNodeProperty("casValidateUrl", true, null); 475 String casLogoutUrl = CmsPropertyHandler.getServerNodeProperty("casLogoutUrl", true, null); 476 String authConstraint = CmsPropertyHandler.getServerNodeProperty("authConstraint", true, "cmsUser"); 477 478 InfoGlueAuthenticationFilter.authenticatorClass = authenticatorClass; 480 InfoGlueAuthenticationFilter.authorizerClass = authorizerClass; 482 InfoGlueAuthenticationFilter.invalidLoginUrl = invalidLoginUrl; 484 InfoGlueAuthenticationFilter.successLoginBaseUrl = successLoginBaseUrl; 486 InfoGlueAuthenticationFilter.loginUrl = loginUrl; 488 InfoGlueAuthenticationFilter.logoutUrl = logoutUrl; 490 InfoGlueAuthenticationFilter.serverName = serverName; 492 InfoGlueAuthenticationFilter.casRenew = casRenew; 494 InfoGlueAuthenticationFilter.authConstraint = authConstraint; 496 497 InfoGlueAuthenticationFilter.casServiceUrl = casServiceUrl; 499 InfoGlueAuthenticationFilter.casValidateUrl = casValidateUrl; 501 InfoGlueAuthenticationFilter.casLogoutUrl = casLogoutUrl; 503 504 509 510 String extraPropertiesString = CmsPropertyHandler.getServerNodeDataProperty("deliver", "extraSecurityParameters", true, null); 511 if(extraPropertiesString != null) 513 { 514 logger.info("Loading extra properties from propertyset. extraPropertiesString:" + extraPropertiesString); 515 try 516 { 517 extraProperties = new Properties (); 518 extraProperties.load(new ByteArrayInputStream (extraPropertiesString.getBytes("UTF-8"))); 519 } 521 catch(Exception e) 522 { 523 logger.error("Error loading properties from string. Reason:" + e.getMessage()); 524 e.printStackTrace(); 525 } 526 } 527 else 528 { 529 String extraPropertiesFile = CmsPropertyHandler.getProperty("extraParametersFile"); 530 logger.info("Trying to load extra properties from file. extraPropertiesFile:" + extraPropertiesFile); 531 if(extraPropertiesFile != null) 532 { 533 try 534 { 535 extraProperties = new Properties (); 536 extraProperties.load(CmsPropertyHandler.class.getResourceAsStream("/" + extraPropertiesFile)); 537 } 538 catch(Exception e) 539 { 540 logger.error("Error loading properties from file " + "/" + extraPropertiesFile + ". Reason:" + e.getMessage()); 541 e.printStackTrace(); 542 } 543 } 544 545 } 546 547 logger.info("authenticatorClass:" + authenticatorClass); 548 logger.info("authorizerClass:" + authorizerClass); 549 logger.info("invalidLoginUrl:" + invalidLoginUrl); 550 logger.info("successLoginBaseUrl:" + successLoginBaseUrl); 551 logger.info("loginUrl:" + loginUrl); 552 logger.info("logoutUrl:" + logoutUrl); 553 logger.info("serverName:" + serverName); 554 logger.info("authConstraint:" + authConstraint); 555 logger.info("casRenew:" + casRenew); 556 logger.info("casServiceUrl:" + casServiceUrl); 557 logger.info("casValidateUrl:" + casValidateUrl); 558 logger.info("casLogoutUrl:" + casLogoutUrl); 559 if(logger.isDebugEnabled()) 560 { 561 if(extraProperties != null) 562 extraProperties.list(System.out); 563 else 564 logger.info("extraProperties:" + extraProperties); 565 } 566 } 567 catch(Exception e) 568 { 569 logger.error("An error occurred so we should not complete the transaction:" + e, e); 570 throw new SystemException("Setting the security parameters failed: " + e.getMessage(), e); 571 } 572 } 573 574 } 575 | Popular Tags |