import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.deploy.SecurityConstraint;
+import org.ietf.jgss.GSSContext;
/**
* A <b>Realm</b> is a read-only facade for an underlying security realm
* used to authenticate individual users, and identify the security roles
* Return the Principal associated with the specified chain of X509
* client certificates. If there is none, return <code>null</code>.
*
- * @param certs Array of client certificates, with the first one in
+ * @param certs The gssContext processed by the {@link Authenticator}.
+ */
+ public Principal authenticate(GSSContext gssContext);
+
+
+ /**
+ * Return the Principal associated with the specified {@link GSSContext}.
+ * If there is none, return <code>null</code>.
+ *
+ * @param gssContext Array of client certificates, with the first one in
* the array being the certificate of the client itself.
*/
public Principal authenticate(X509Certificate certs[]);
import javax.security.auth.login.LoginException;
import javax.servlet.http.HttpServletResponse;
+import org.apache.catalina.Context;
import org.apache.catalina.LifecycleException;
import org.apache.catalina.connector.Request;
import org.apache.catalina.deploy.LoginConfig;
-import org.apache.catalina.realm.GenericPrincipal;
import org.apache.catalina.startup.Bootstrap;
import org.apache.catalina.util.Base64;
import org.apache.juli.logging.Log;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
-import org.ietf.jgss.GSSName;
+
/**
* A SPNEGO authenticator that uses the SPENGO/Kerberos support built in to Java
try {
principal = Subject.doAs(serviceSubject,
- new KerberosAuthAction(decoded.getBytes(), response));
+ new KerberosAuthAction(decoded.getBytes(),
+ response, context));
} catch (PrivilegedActionException e) {
// TODO Auto-generated catch block
e.printStackTrace();
private byte[] inToken;
private HttpServletResponse resp;
+ private Context context;
- public KerberosAuthAction(byte[] inToken, HttpServletResponse resp) {
+ public KerberosAuthAction(byte[] inToken, HttpServletResponse resp,
+ Context context) {
this.inToken = inToken;
this.resp = resp;
+ this.context = context;
}
@Override
// Assume the GSSContext is stateless
// TODO: Confirm this assumption
- GSSContext context =
+ GSSContext gssContext =
GSSManager.getInstance().createContext((GSSCredential) null);
Principal principal = null;
}
byte[] outToken =
- context.acceptSecContext(inToken, 0, inToken.length);
+ gssContext.acceptSecContext(inToken, 0, inToken.length);
if (outToken == null) {
throw new GSSException(GSSException.DEFECTIVE_TOKEN);
}
- GSSName initiatorName = context.getSrcName();
-
- if (context.isEstablished()) {
- // TODO This (and a lot of the surrounding code) needs to move
- // to RealmBase so authorisation will work. This is just a quick
- // hack to get authentication working.
- principal = new GenericPrincipal(initiatorName.toString(), null);
- }
+ principal = context.getRealm().authenticate(gssContext);
// Send response token on success and failure
resp.setHeader("WWW-Authenticate", "Negotiate "
+ Base64.encode(outToken));
- context.dispose();
+ gssContext.dispose();
return principal;
}
}
import org.apache.catalina.Realm;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
+import org.ietf.jgss.GSSContext;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSName;
/**
* Realm implementation that contains one or more realms. Authentication is
return authenticatedUser;
}
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public Principal authenticate(GSSContext gssContext) {
+ if (gssContext.isEstablished()) {
+ Principal authenticatedUser = null;
+ String username = null;
+
+ GSSName name = null;
+ try {
+ name = gssContext.getSrcName();
+ } catch (GSSException e) {
+ log.warn(sm.getString("realmBase.gssNameFail"), e);
+ return null;
+ }
+
+ username = name.toString();
+
+ for (Realm realm : realms) {
+ if (log.isDebugEnabled()) {
+ log.debug(sm.getString("combinedRealm.authStart",
+ username, realm.getInfo()));
+ }
+
+ authenticatedUser = realm.authenticate(gssContext);
+
+ if (authenticatedUser == null) {
+ if (log.isDebugEnabled()) {
+ log.debug(sm.getString("combinedRealm.authFail",
+ username, realm.getInfo()));
+ }
+ } else {
+ if (log.isDebugEnabled()) {
+ log.debug(sm.getString("combinedRealm.authSucess",
+ username, realm.getInfo()));
+ }
+ break;
+ }
+ }
+ return authenticatedUser;
+ }
+
+ // Fail in all other cases
+ return null;
+ }
+
@Override
protected String getName() {
return name;
realmBase.notStarted=This Realm has not yet been started
realmBase.authenticateFailure=Username {0} NOT successfully authenticated
realmBase.authenticateSuccess=Username {0} successfully authenticated
+realmBase.gssNameFail=Failed to extract name from established GSSContext
userDatabaseRealm.authenticateError=Login configuration error authenticating username {0}
userDatabaseRealm.lookup=Exception looking up UserDatabase under key {0}
userDatabaseRealm.noDatabase=No UserDatabase component found under key {0}
import org.apache.catalina.LifecycleException;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
+import org.ietf.jgss.GSSContext;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSName;
/**
* This class extends the CombinedRealm (hence it can wrap other Realms) to
/**
+ * {@inheritDoc}
+ */
+ @Override
+ public Principal authenticate(GSSContext gssContext) {
+ if (gssContext.isEstablished()) {
+ String username = null;
+ GSSName name = null;
+ try {
+ name = gssContext.getSrcName();
+ } catch (GSSException e) {
+ log.warn(sm.getString("realmBase.gssNameFail"), e);
+ return null;
+ }
+
+ username = name.toString();
+
+ if (isLocked(username)) {
+ // Trying to authenticate a locked user is an automatic failure
+ registerAuthFailure(username);
+
+ log.warn(sm.getString("lockOutRealm.authLockedUser", username));
+ return null;
+ }
+
+ Principal authenticatedUser = super.authenticate(gssContext);
+
+ if (authenticatedUser == null) {
+ registerAuthFailure(username);
+ } else {
+ registerAuthSuccess(username);
+ }
+ return authenticatedUser;
+ }
+
+ // Fail in all other cases
+ return null;
+ }
+
+
+ /**
* Unlock the specified username. This will remove all records of
* authentication failures for this user.
*
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
import org.apache.tomcat.util.res.StringManager;
+import org.ietf.jgss.GSSContext;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSName;
/**
* Simple implementation of <b>Realm</b> that reads an XML file to configure
/**
+ * {@inheritDoc}
+ */
+ @Override
+ public Principal authenticate(GSSContext gssContext) {
+ if (gssContext.isEstablished()) {
+ GSSName name = null;
+ try {
+ name = gssContext.getSrcName();
+ } catch (GSSException e) {
+ log.warn(sm.getString("realmBase.gssNameFail"), e);
+ }
+
+ if (name!= null) {
+ return getPrincipal(name.toString());
+ }
+ }
+
+ // Fail in all other cases
+ return null;
+ }
+
+
+ /**
* Execute a periodic task, such as reloading, etc. This method will be
* invoked inside the classloading context of this container. Unexpected
* throwables will be caught and logged.
projects / tomcat7.0 / commitdiff