|
1
23
24 package org.infoglue.cms.security;
25
26 import java.io.Serializable  ;
27 import java.net.URLEncoder ;
28 import java.security.Principal ;
29 import java.util.HashMap ;
30 import java.util.Hashtable ;
31 import java.util.Map ;
32 import java.util.Properties ;
33
34 import javax.naming.Context ;
35 import javax.naming.directory.DirContext ;
36 import javax.naming.directory.InitialDirContext ;
37 import javax.servlet.FilterChain ;
38 import javax.servlet.ServletException ;
39 import javax.servlet.http.HttpServletRequest ;
40 import javax.servlet.http.HttpServletResponse ;
41 import javax.servlet.http.HttpSession ;
42
43 import org.apache.log4j.Logger;
44 import org.infoglue.cms.util.CmsPropertyHandler;
45
46
51
52 public class JNDIBasicAuthenticationModule extends AuthenticationModule
53 {
54 private final static Logger logger = Logger.getLogger(JNDIBasicAuthenticationModule.class.getName());
55
56 private String loginUrl = null;
57 private String logoutUrl = null;
58 private String invalidLoginUrl = null;
59 private String successLoginUrl = null;
60 private String authenticatorClass = null;
61 private String authorizerClass = null;
62 private String serverName = null;
63 private String casServiceUrl = null;
64 private String casRenew = null;
65 private String casValidateUrl = null;
66 private String casLogoutUrl = null;
67 private String casAuthorizedProxy = null;
68 private Properties extraProperties = null;
69
70
73
74 public String authenticateUser(HttpServletRequest request, HttpServletResponse response, FilterChain fc) throws Exception
75 {
76 String authenticatedUserName = null;
77
78 HttpSession session = ((HttpServletRequest )request).getSession();
79
80 String userName = request.getParameter("j_username");
82 String password = request.getParameter("j_password");
83 String disableRedirect = (String )request.getAttribute("disableRedirect");
84
85 if (userName == null || userName.equals(""))
87 {
88 if (loginUrl == null)
89 {
90 throw new ServletException (
91 "When InfoGlueFilter protects pages that do not receive a 'userName' " +
92 "parameter, it needs a org.infoglue.cms.security.loginUrl " +
93 "filter parameter");
94 }
95
96 String requestURI = request.getRequestURI();
97
98 String requestQueryString = request.getQueryString();
99 if(requestQueryString != null)
100 {
101 requestQueryString = "?" + requestQueryString;
102 }
103 else
104 {
105 requestQueryString = "";
106 }
107
108 logger.info("requestQueryString:" + requestQueryString);
109
110 String redirectUrl = "";
111
112 if(requestURI.indexOf("?") > 0)
113 {
114 redirectUrl = loginUrl + "&referringUrl=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8");
115 }
116 else
117 {
118 redirectUrl = loginUrl + "?referringUrl=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8");
119 }
120
121 logger.info("redirectUrl:" + redirectUrl);
122 if(disableRedirect == null || !disableRedirect.equals("true"))
123 response.sendRedirect(redirectUrl);
124
125 return null;
126 }
127
128 boolean isAuthenticated = authenticate(userName, password, new HashMap ());
129 logger.info("authenticated:" + isAuthenticated);
130 authenticatedUserName = userName;
131
132 if(!isAuthenticated)
133 {
134 String referringUrl = request.getRequestURI();
135 if(request.getParameter("referringUrl") != null)
136 referringUrl = request.getParameter("referringUrl");
137
138 String requestQueryString = request.getQueryString();
139 if(requestQueryString != null)
140 requestQueryString = "?" + requestQueryString;
141 else
142 requestQueryString = "";
143
144 logger.info("requestQueryString:" + requestQueryString);
145
146 String redirectUrl = "";
147
148 if(referringUrl.indexOf("?") > 0)
149 redirectUrl = invalidLoginUrl + "?userName=" + URLEncoder.encode(userName, "UTF-8") + "&errorMessage=" + URLEncoder.encode("Invalid login - please try again..", "UTF-8") + "&referringUrl=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8");
150 else
151 redirectUrl = invalidLoginUrl + "?userName=" + URLEncoder.encode(userName, "UTF-8") + "?errorMessage=" + URLEncoder.encode("Invalid login - please try again..", "UTF-8") + "&referringUrl=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8");
152
153 logger.info("redirectUrl:" + redirectUrl);
155 if(disableRedirect == null || !disableRedirect.equals("true"))
156 response.sendRedirect(redirectUrl);
157
158 return null;
159 }
160
161 return authenticatedUserName;
163 }
164
165
166
169
170 public String authenticateUser(Map request) throws Exception
171 {
172 String authenticatedUserName = null;
173
174 String userName = (String )request.get("j_username");
176 String password = (String )request.get("j_password");
177
178 logger.info("authenticateUser:userName:" + userName);
179
180 if (userName == null || userName.equals(""))
182 {
183 return null;
184 }
185
186 boolean isAuthenticated = authenticate(userName, password, new HashMap ());
187 logger.info("authenticated:" + isAuthenticated);
188
189 if(!isAuthenticated)
190 {
191 return null;
192 }
193
194 authenticatedUserName = userName;
195
196 return authenticatedUserName;
197 }
198
199
200
203
204 public String getLoginDialogUrl(HttpServletRequest request, HttpServletResponse response) throws Exception
205 {
206 if(CmsPropertyHandler.getApplicationName().equals("deliver"))
207 {
208 logger.info("It was a deliver request... let's keep it simple...");
209 String returnAddress = null;
210
211 String referer = request.getHeader("Referer");
212
213 if(referer == null || referer.indexOf("ViewStructureToolToolBar.action") != -1)
214 referer = "/";
215
216 logger.info("successLoginUrl:" + successLoginUrl);
217 if(successLoginUrl != null)
218 {
219 returnAddress = successLoginUrl;
220 }
221 else
222 {
223 returnAddress = request.getRequestURL().toString() + "?" + request.getQueryString() + "&referer=" + URLEncoder.encode(referer, "UTF-8") + "&date=" + System.currentTimeMillis();
224 }
225
226 logger.info("returnAddress:" + returnAddress);
227 return request.getContextPath() + "/ExtranetLogin!loginForm.action?returnAddress=" + URLEncoder.encode(returnAddress, "UTF-8");
228 }
229
230 String url = null;
231
232 String userName = request.getParameter("j_username");
234 String password = request.getParameter("j_password");
235
236 if (userName == null || userName.equals(""))
238 {
239 if (loginUrl == null)
240 {
241 throw new ServletException (
242 "When InfoGlueFilter protects pages that do not receive a 'userName' " +
243 "parameter, it needs a org.infoglue.cms.security.loginUrl " +
244 "filter parameter");
245 }
246
247 String requestURI = request.getRequestURI();
248
249 String requestQueryString = request.getQueryString();
250 if(requestQueryString != null)
251 {
252 requestQueryString = "?" + requestQueryString;
253 }
254 else
255 {
256 requestQueryString = "";
257 }
258
259 logger.info("requestQueryString:" + requestQueryString);
260
261 String redirectUrl = "";
262
263 if(requestURI.indexOf("?") > 0)
264 {
265 redirectUrl = loginUrl + "&referringUrl=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8");
266 }
267 else
268 {
269 redirectUrl = loginUrl + "?referringUrl=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(requestURI + requestQueryString, "UTF-8");
270 }
271
272 logger.info("redirectUrl:" + redirectUrl);
273 return redirectUrl;
274 }
275
276 boolean isAuthenticated = authenticate(userName, password, new HashMap ());
277 logger.info("authenticated:" + isAuthenticated);
278 String authenticatedUserName = userName;
279
280 if(!isAuthenticated)
281 {
282 String referringUrl = request.getRequestURI();
283 if(request.getParameter("referringUrl") != null)
284 referringUrl = request.getParameter("referringUrl");
285
286 String requestQueryString = request.getQueryString();
287 if(requestQueryString != null)
288 requestQueryString = "?" + requestQueryString;
289 else
290 requestQueryString = "";
291
292 logger.info("requestQueryString:" + requestQueryString);
293
294 String redirectUrl = "";
295
296 if(referringUrl.indexOf("?") > 0)
297 redirectUrl = invalidLoginUrl + "?userName=" + URLEncoder.encode(userName, "UTF-8") + "&errorMessage=" + URLEncoder.encode("Invalid login - please try again..", "UTF-8") + "&referringUrl=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8");
298 else
299 redirectUrl = invalidLoginUrl + "?userName=" + URLEncoder.encode(userName, "UTF-8") + "?errorMessage=" + URLEncoder.encode("Invalid login - please try again..", "UTF-8") + "&referringUrl=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8") + "&returnAddress=" + URLEncoder.encode(referringUrl + requestQueryString, "UTF-8");
300
301 logger.info("redirectUrl:" + redirectUrl);
303 return redirectUrl;
304 }
305
306 return url;
307 }
308
309
312
313 private boolean authenticate(String userName, String password, Map parameters) throws Exception
314 {
315 boolean isAuthenticated = false;
316
317 String administratorUserName = CmsPropertyHandler.getAdministratorUserName();
318 String administratorPassword = CmsPropertyHandler.getAdministratorPassword();
319 boolean isAdministrator = (userName.equalsIgnoreCase(administratorUserName) && password.equalsIgnoreCase(administratorPassword)) ? true : false;
324
325 if(isAdministrator || bindUserUsingJNDI(userName, password))
326 {
327 isAuthenticated = true;
328 }
329
330 return isAuthenticated;
331 }
332
333 public Principal loginUser(HttpServletRequest request, HttpServletResponse response, Map status) throws Exception
334 {
335 return null;
336 }
337
338 public boolean logoutUser(HttpServletRequest request, HttpServletResponse response) throws Exception
339 {
340 return false;
341 }
342
343 private boolean bindUserUsingJNDI(String userName, String password)
344 {
345 if(password == null || password.equals(""))
346 {
347 String allowAnonymousBind = this.extraProperties.getProperty("allowAnonymousBind");
348 if(allowAnonymousBind == null || !allowAnonymousBind.equalsIgnoreCase("true"))
349 {
350 logger.warn("Anonymous bind attemped by not giving any password. Not allowed - now using password '--No password given but anonymous binds not allowed--'");
351 password = "--No password given but anonymous binds not allowed--";
352 }
353 }
354
355 boolean result = false;
356 DirContext ctx = null;
357 String connectionURL = this.extraProperties.getProperty("connectionURL");
358 String ldapUserName = this.extraProperties.getProperty("userNamePattern");
359
360 String anonymousUserName = CmsPropertyHandler.getAnonymousUser();
361 if(userName.equals(anonymousUserName))
362 {
363 ldapUserName = this.extraProperties.getProperty("anonymousUserNamePattern");
364 }
365
366 ldapUserName = ldapUserName.replaceFirst("infoglue.user", userName);
367
368 Hashtable env = new Hashtable ();
369
370 env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
371 env.put(Context.PROVIDER_URL, connectionURL);
372 env.put(Context.SECURITY_AUTHENTICATION, "simple");
373 env.put(Context.SECURITY_PRINCIPAL, ldapUserName);
374 env.put(Context.SECURITY_CREDENTIALS, password);
375
376 try
377 {
378 ctx = new InitialDirContext (env);
379 logger.info("User: " + ldapUserName + " successfully bound.");
380 ctx.close();
381 result = true;
382 }
383 catch (Exception e)
384 {
385 logger.info("Could not bind user: " + ldapUserName + ", " + e.getMessage());
386 }
387
388 return result;
389 }
390
391 public String getAuthenticatorClass()
392 {
393 return authenticatorClass;
394 }
395
396 public void setAuthenticatorClass(String authenticatorClass)
397 {
398 this.authenticatorClass = authenticatorClass;
399 }
400
401 public String getAuthorizerClass()
402 {
403 return authorizerClass;
404 }
405
406 public void setAuthorizerClass(String authorizerClass)
407 {
408 this.authorizerClass = authorizerClass;
409 }
410
411 public String getInvalidLoginUrl()
412 {
413 return invalidLoginUrl;
414 }
415
416 public void setInvalidLoginUrl(String invalidLoginUrl)
417 {
418 this.invalidLoginUrl = invalidLoginUrl;
419 }
420
421 public String getLoginUrl()
422 {
423 return loginUrl;
424 }
425
426 public void setLoginUrl(String loginUrl)
427 {
428 this.loginUrl = loginUrl;
429 }
430
431 public String getLogoutUrl()
432 {
433 return logoutUrl;
434 }
435
436 public void setLogoutUrl(String logoutUrl)
437 {
438 this.logoutUrl = logoutUrl;
439 }
440
441 public String getSuccessLoginUrl()
442 {
443 return successLoginUrl;
444 }
445
446 public void setSuccessLoginUrl(String successLoginUrl)
447 {
448 this.successLoginUrl = successLoginUrl;
449 }
450
451 public String getServerName()
452 {
453 return this.serverName;
454 }
455
456 public void setServerName(String serverName)
457 {
458 this.serverName = serverName;
459 }
460
461 public Properties getExtraProperties()
462 {
463 return extraProperties;
464 }
465
466 public void setExtraProperties(Properties extraProperties)
467 {
468 this.extraProperties = extraProperties;
469 }
470
471 public String getCasRenew()
472 {
473 return casRenew;
474 }
475
476 public void setCasRenew(String casRenew)
477 {
478 this.casRenew = casRenew;
479 }
480
481 public String getCasServiceUrl()
482 {
483 return casServiceUrl;
484 }
485
486 public void setCasServiceUrl(String casServiceUrl)
487 {
488 this.casServiceUrl = casServiceUrl;
489 }
490
491 public String getCasValidateUrl()
492 {
493 return casValidateUrl;
494 }
495
496 public void setCasValidateUrl(String casValidateUrl)
497 {
498 this.casValidateUrl = casValidateUrl;
499 }
500
501 public String getCasAuthorizedProxy()
502 {
503 return casAuthorizedProxy;
504 }
505
506 public void setCasAuthorizedProxy(String casAuthorizedProxy)
507 {
508 this.casAuthorizedProxy = casAuthorizedProxy;
509 }
510
511 public Object getTransactionObject()
512 {
513 return null;
514 }
515
516 public void setTransactionObject(Object transactionObject)
517 {
518 }
519
520
521 public String getCasLogoutUrl()
522 {
523 return casLogoutUrl;
524 }
525
526
527 public void setCasLogoutUrl(String casLogoutUrl)
528 {
529 this.casLogoutUrl = casLogoutUrl;
530 }
531
532 } |
Popular Tags |
Java API By Example, From Geeks To Geeks.