"javax.security.auth.subject";
+ public static final String GSS_CREDENTIAL_ATTR =
+ "org.apache.catalina.realm.GSS_CREDENTIAL";
+
+
/**
* The master flag which controls strict servlet specification
* compliance.
* Return the Principal associated with the specified chain of X509
* client certificates. If there is none, return <code>null</code>.
*
- * @param certs The gssContext processed by the {@link Authenticator}.
+ * @param gssContext The gssContext processed by the {@link Authenticator}.
+ * @param storeCreds Should the realm attempt to store the delegated
+ * credentials in the returned Principal?
*/
- public Principal authenticate(GSSContext gssContext);
+ public Principal authenticate(GSSContext gssContext, boolean storeCreds);
/**
this.loginConfigName = loginConfigName;
}
+ private boolean storeDelegatedCredentials = true;
+ public boolean isStoreDelegatedCredentials() {
+ return storeDelegatedCredentials;
+ }
+ public void setStoreDelegatedCredentials(
+ boolean storeDelegatedCredentials) {
+ this.storeDelegatedCredentials = storeDelegatedCredentials;
+ }
+
@Override
protected String getAuthMethod() {
return false;
}
- principal = context.getRealm().authenticate(gssContext);
+ principal = context.getRealm().authenticate(gssContext,
+ storeDelegatedCredentials);
} catch (GSSException e) {
if (log.isDebugEnabled()) {
log.debug(sm.getString("spnegoAuthenticator.ticketValidateFail",
return asyncSupported;
}
+ if (name.equals(Globals.GSS_CREDENTIAL_ATTR)) {
+ if (userPrincipal instanceof GenericPrincipal) {
+ return ((GenericPrincipal) userPrincipal).getGssCredential();
+ }
+ return null;
+ }
+
Object attr=attributes.get(name);
if(attr!=null)
* {@inheritDoc}
*/
@Override
- public Principal authenticate(GSSContext gssContext) {
+ public Principal authenticate(GSSContext gssContext, boolean storeCreds) {
if (gssContext.isEstablished()) {
Principal authenticatedUser = null;
String username = null;
username, realm.getInfo()));
}
- authenticatedUser = realm.authenticate(gssContext);
+ authenticatedUser = realm.authenticate(gssContext, storeCreds);
if (authenticatedUser == null) {
if (log.isDebugEnabled()) {
import javax.security.auth.login.LoginContext;
+import org.ietf.jgss.GSSCredential;
+
/**
* Generic implementation of <strong>java.security.Principal</strong> that
*/
public GenericPrincipal(String name, String password, List<String> roles,
Principal userPrincipal, LoginContext loginContext) {
+ this(name, password, roles, userPrincipal, loginContext, null);
+ }
+
+ /**
+ * Construct a new Principal, associated with the specified Realm, for the
+ * specified username and password, with the specified role names
+ * (as Strings).
+ *
+ * @param name The username of the user represented by this Principal
+ * @param password Credentials used to authenticate this user
+ * @param roles List of roles (must be Strings) possessed by this user
+ * @param userPrincipal - the principal to be returned from the request
+ * getUserPrincipal call if not null; if null, this will be returned
+ * @param loginContext - If provided, this will be used to log out the user
+ * at the appropriate time
+ * @param gssCredential - If provided, the user's delegated credentials
+ */
+ public GenericPrincipal(String name, String password, List<String> roles,
+ Principal userPrincipal, LoginContext loginContext,
+ GSSCredential gssCredential) {
super();
this.name = name;
this.password = password;
Arrays.sort(this.roles);
}
this.loginContext = loginContext;
+ this.gssCredential = gssCredential;
}
*/
protected LoginContext loginContext = null;
+
+ /**
+ * The user's delegated credentials.
+ */
+ protected GSSCredential gssCredential = null;
+
+ public GSSCredential getGssCredential() {
+ return this.gssCredential;
+ }
+ protected void setGssCredential(GSSCredential gssCredential) {
+ this.gssCredential = gssCredential;
+ }
+
// --------------------------------------------------------- Public Methods
memoryRealm.xmlFeatureEncoding=Exception configuring digester to permit java encoding names in XML files. Only IANA encoding names will be supported.
realmBase.algorithm=Invalid message digest algorithm {0} specified
realmBase.alreadyStarted=This Realm has already been started
+realmBase.delegatedCredentialFail=Unable to obtain delegated credentials for user [{0}
realmBase.digest=Error digesting user credentials
realmBase.forbidden=Access to the requested resource has been denied
realmBase.hasRoleFailure=Username {0} does NOT have role {1}
* {@inheritDoc}
*/
@Override
- public Principal authenticate(GSSContext gssContext) {
+ public Principal authenticate(GSSContext gssContext, boolean storeCreds) {
if (gssContext.isEstablished()) {
String username = null;
GSSName name = null;
return null;
}
- Principal authenticatedUser = super.authenticate(gssContext);
+ Principal authenticatedUser =
+ super.authenticate(gssContext, storeCreds);
if (authenticatedUser == null) {
registerAuthFailure(username);
import org.apache.juli.logging.LogFactory;
import org.apache.tomcat.util.res.StringManager;
import org.ietf.jgss.GSSContext;
+import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSName;
* {@inheritDoc}
*/
@Override
- public Principal authenticate(GSSContext gssContext) {
+ public Principal authenticate(GSSContext gssContext, boolean storeCred) {
if (gssContext.isEstablished()) {
GSSName name = null;
try {
}
if (name!= null) {
- return getPrincipal(name.toString());
+ GSSCredential gssCredential = null;
+ if (storeCred && gssContext.getCredDelegState()) {
+ try {
+ gssCredential = gssContext.getDelegCred();
+ } catch (GSSException e) {
+ e.printStackTrace();
+ if (log.isDebugEnabled()) {
+ log.debug(sm.getString(
+ "realmBase.delegatedCredentialFail", name),
+ e);
+ }
+ }
+ }
+ return getPrincipal(name.toString(), gssCredential);
}
}
if (roles.length == 0 && !constraint.getAllRoles()) {
if(constraint.getAuthConstraint()) {
if( log.isDebugEnabled() )
- log.debug("No roles ");
+ log.debug("No role)s ");
status = false; // No listed roles means no access at all
denyfromall = true;
break;
protected abstract Principal getPrincipal(String username);
+ protected Principal getPrincipal(String username,
+ GSSCredential gssCredential) {
+ Principal p = getPrincipal(username);
+
+ if (p instanceof GenericPrincipal) {
+ ((GenericPrincipal) p).setGssCredential(gssCredential);
+ }
+
+ return p;
+ }
+
/**
* Return the Server object that is the ultimate parent for the container
* with which this Realm is associated. If the server cannot be found (eg
* Set of attribute names which are not allowed to be persisted.
*/
protected static final String[] excludedAttributes = {
- Globals.SUBJECT_ATTR
+ Globals.SUBJECT_ATTR,
+ Globals.GSS_CREDENTIAL_ATTR
};
specified, the platform default provider will be used.</p>
</attribute>
+ <attribute name="storeDelegatedCredentials" required="false">
+ <p>Controls if the user' delegated credentials will be stored in
+ the user Principal. If available, the delegated credentials will be
+ available to applications (e.g. for onward authentication to external
+ services) via the <code>org.apache.catalina.realm.GSS_CREDENTIAL</code>
+ request attribute.If not set, the default value of <code>true</code>
+ will be used.</p>
+ </attribute>
+
</attributes>
</subsection>
projects / tomcat7.0 / commitdiff