You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by cs...@apache.org on 2017/08/22 14:54:06 UTC
[3/4] karaf git commit: [KARAF-5316] Make EncryptionSupport easier to
use
[KARAF-5316] Make EncryptionSupport easier to use
Project: http://git-wip-us.apache.org/repos/asf/karaf/repo
Commit: http://git-wip-us.apache.org/repos/asf/karaf/commit/d6edb10e
Tree: http://git-wip-us.apache.org/repos/asf/karaf/tree/d6edb10e
Diff: http://git-wip-us.apache.org/repos/asf/karaf/diff/d6edb10e
Branch: refs/heads/master
Commit: d6edb10e0cf65f1d9eafb98154add8f007f70653
Parents: e380f88
Author: Christian Schneider <ch...@die-schneider.net>
Authored: Tue Aug 22 16:29:42 2017 +0200
Committer: Christian Schneider <ch...@die-schneider.net>
Committed: Tue Aug 22 16:29:42 2017 +0200
----------------------------------------------------------------------
.../jaas/modules/AbstractKarafLoginModule.java | 47 +------------
.../modules/encryption/EncryptionSupport.java | 71 +++++++++++++++-----
.../jaas/modules/jdbc/JDBCBackingEngine.java | 14 +---
.../properties/AutoEncryptionSupport.java | 28 +-------
.../properties/PropertiesBackingEngine.java | 19 ++----
5 files changed, 66 insertions(+), 113 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/karaf/blob/d6edb10e/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
----------------------------------------------------------------------
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
index 7f7807b..a6601d0 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
@@ -68,7 +68,7 @@ public abstract class AbstractKarafLoginModule implements LoginModule {
user = null;
}
- public void initialize(Subject sub, CallbackHandler handler, Map options) {
+ public void initialize(Subject sub, CallbackHandler handler, Map<String, ?> options) {
this.subject = sub;
this.callbackHandler = handler;
this.options = options;
@@ -81,50 +81,9 @@ public abstract class AbstractKarafLoginModule implements LoginModule {
encryptionSupport = new EncryptionSupport(options);
}
-
- public String getEncryptedPassword(String password) {
- Encryption encryption = encryptionSupport.getEncryption();
- String encryptionPrefix = encryptionSupport.getEncryptionPrefix();
- String encryptionSuffix = encryptionSupport.getEncryptionSuffix();
-
- if (encryption == null) {
- return password;
- } else {
- boolean prefix = encryptionPrefix == null || password.startsWith(encryptionPrefix);
- boolean suffix = encryptionSuffix == null || password.endsWith(encryptionSuffix);
- if (prefix && suffix) {
- return password;
- } else {
- String p = encryption.encryptPassword(password);
- if (encryptionPrefix != null) {
- p = encryptionPrefix + p;
- }
- if (encryptionSuffix != null) {
- p = p + encryptionSuffix;
- }
- return p;
- }
- }
- }
-
public boolean checkPassword(String plain, String encrypted) {
- Encryption encryption = encryptionSupport.getEncryption();
- String encryptionPrefix = encryptionSupport.getEncryptionPrefix();
- String encryptionSuffix = encryptionSupport.getEncryptionSuffix();
-
- if (encryption == null) {
- return plain.equals(encrypted);
- } else {
- boolean prefix = encryptionPrefix == null || encrypted.startsWith(encryptionPrefix);
- boolean suffix = encryptionSuffix == null || encrypted.endsWith(encryptionSuffix);
- if (prefix && suffix) {
- encrypted = encrypted.substring(encryptionPrefix != null ? encryptionPrefix.length() : 0,
- encrypted.length() - (encryptionSuffix != null ? encryptionSuffix.length() : 0));
- return encryption.checkPassword(plain, encrypted);
- } else {
- return plain.equals(encrypted);
- }
- }
+ String newEncrypted = encryptionSupport.encrypt(plain);
+ return encrypted.equals(newEncrypted);
}
}
http://git-wip-us.apache.org/repos/asf/karaf/blob/d6edb10e/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
----------------------------------------------------------------------
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
index 036fc9b..61e28f0 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
@@ -40,7 +40,12 @@ public class EncryptionSupport {
private String name;
private Map<String, String> encOpts;
-
+
+ public static EncryptionSupport noEncryptionSupport() {
+ Map<String, Object> options = new HashMap<>();
+ options.put("enabled", "false");
+ return new EncryptionSupport(options);
+ }
public EncryptionSupport(Map<String, ?> options) {
this.debug = Boolean.parseBoolean((String) options.get("debug"));
@@ -52,31 +57,54 @@ public class EncryptionSupport {
encOpts.put(key.substring("encryption.".length()), options.get(key).toString());
}
}
- encryptionPrefix = encOpts.remove("prefix");
- encryptionSuffix = encOpts.remove("suffix");
+ encryptionPrefix = defaulIfNull(encOpts.remove("prefix"), "");
+ encryptionSuffix = defaulIfNull(encOpts.remove("suffix"), "");
enabled = Boolean.parseBoolean(encOpts.remove("enabled"));
- if (!enabled) {
- if (debug) {
- logger.debug("Encryption is disabled.");
- }
+ if (!enabled && debug) {
+ logger.debug("Encryption is disabled.");
}
name = encOpts.remove("name");
if (debug) {
- if (name != null && name.length() > 0) {
- logger.debug("Encryption is enabled. Using service " + name + " with options " + encOpts);
- } else {
- logger.debug("Encryption is enabled. Using options " + encOpts);
- }
+ logOptions();
+ }
+ }
+
+ public String encrypt(String plain) {
+ getEncryption();
+ if (encryption == null || isEncrypted(plain)) {
+ return plain;
+ } else {
+ return encryptionPrefix + encryption.encryptPassword(plain) + encryptionSuffix;
+ }
+ }
+
+ private void logOptions() {
+ if (name != null && name.length() > 0) {
+ logger.debug("Encryption is enabled. Using service " + name + " with options " + encOpts);
+ } else {
+ logger.debug("Encryption is enabled. Using options " + encOpts);
}
}
+
+ private String defaulIfNull(String value, String defaultValue) {
+ return value == null ? defaultValue : value;
+ }
+
+ private boolean isEncrypted(String password) {
+ boolean prefixPresent = "".equals(encryptionPrefix) || password.startsWith(encryptionPrefix);
+ boolean suffixPresent = "".equals(encryptionSuffix) || password.endsWith(encryptionSuffix);
+ return prefixPresent && suffixPresent;
+ }
+ /**
+ * @deprecated Use encrypt instead. This method will be made private
+ * @return chosen encryption
+ */
+ @Deprecated
public Encryption getEncryption() {
- if (encryption != null) {
+ if (encryption != null || !enabled) {
return encryption;
}
- if (!enabled) {
- return null;
- }
ServiceTracker<EncryptionService, EncryptionService> tracker = new ServiceTracker<>(bundleContext, getFilter(), null);
tracker.open();
@@ -130,20 +158,31 @@ public class EncryptionSupport {
}
}
+ @Deprecated
public String getEncryptionSuffix() {
return encryptionSuffix;
}
+ @Deprecated
public void setEncryptionSuffix(String encryptionSuffix) {
this.encryptionSuffix = encryptionSuffix;
}
+ @Deprecated
public String getEncryptionPrefix() {
return encryptionPrefix;
}
+ @Deprecated
public void setEncryptionPrefix(String encryptionPrefix) {
this.encryptionPrefix = encryptionPrefix;
}
+
+ /**
+ * For tests
+ */
+ void setEncryption(Encryption encryption) {
+ this.encryption = encryption;
+ }
}
http://git-wip-us.apache.org/repos/asf/karaf/blob/d6edb10e/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/jdbc/JDBCBackingEngine.java
----------------------------------------------------------------------
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/jdbc/JDBCBackingEngine.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/jdbc/JDBCBackingEngine.java
index 11a52cc..420d549 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/jdbc/JDBCBackingEngine.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/jdbc/JDBCBackingEngine.java
@@ -50,6 +50,7 @@ public class JDBCBackingEngine implements BackingEngine {
public JDBCBackingEngine(DataSource dataSource) {
this.dataSource = dataSource;
+ this.encryptionSupport = EncryptionSupport.noEncryptionSupport();
}
public JDBCBackingEngine(DataSource dataSource, EncryptionSupport encryptionSupport) {
@@ -67,19 +68,10 @@ public class JDBCBackingEngine implements BackingEngine {
if (username.startsWith(GROUP_PREFIX)) {
throw new IllegalArgumentException("Prefix not permitted: " + GROUP_PREFIX);
}
- //If encryption support is enabled, encrypt password
- if (encryptionSupport != null && encryptionSupport.getEncryption() != null) {
- password = encryptionSupport.getEncryption().encryptPassword(password);
- if (encryptionSupport.getEncryptionPrefix() != null) {
- password = encryptionSupport.getEncryptionPrefix() + password;
- }
- if (encryptionSupport.getEncryptionSuffix() != null) {
- password = password + encryptionSupport.getEncryptionSuffix();
- }
- }
+ String encPassword = encryptionSupport.encrypt(password);
try {
try (Connection connection = dataSource.getConnection()) {
- rawUpdate(connection, addUserStatement, username, password);
+ rawUpdate(connection, addUserStatement, username, encPassword);
}
} catch (SQLException e) {
throw new RuntimeException("Error adding user", e);
http://git-wip-us.apache.org/repos/asf/karaf/blob/d6edb10e/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/AutoEncryptionSupport.java
----------------------------------------------------------------------
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/AutoEncryptionSupport.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/AutoEncryptionSupport.java
index 975497e..662fc31 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/AutoEncryptionSupport.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/AutoEncryptionSupport.java
@@ -32,7 +32,6 @@ import java.util.concurrent.Executors;
import java.util.concurrent.TimeUnit;
import org.apache.felix.utils.properties.Properties;
-import org.apache.karaf.jaas.modules.Encryption;
import org.apache.karaf.jaas.modules.encryption.EncryptionSupport;
import org.apache.karaf.util.StreamUtils;
import org.slf4j.Logger;
@@ -119,7 +118,7 @@ public class AutoEncryptionSupport implements Runnable, Closeable {
String storedPassword = infos[0];
// check if the stored password is flagged as encrypted
- String encryptedPassword = getEncryptedPassword(storedPassword);
+ String encryptedPassword = encryptionSupport.encrypt(storedPassword);
if (!storedPassword.equals(encryptedPassword)) {
LOGGER.debug("The password isn't flagged as encrypted, encrypt it.");
userInfos = encryptedPassword + ",";
@@ -143,29 +142,4 @@ public class AutoEncryptionSupport implements Runnable, Closeable {
}
}
- String getEncryptedPassword(String password) {
- Encryption encryption = encryptionSupport.getEncryption();
- String encryptionPrefix = encryptionSupport.getEncryptionPrefix();
- String encryptionSuffix = encryptionSupport.getEncryptionSuffix();
-
- if (encryption == null) {
- return password;
- } else {
- boolean prefix = encryptionPrefix == null || password.startsWith(encryptionPrefix);
- boolean suffix = encryptionSuffix == null || password.endsWith(encryptionSuffix);
- if (prefix && suffix) {
- return password;
- } else {
- String p = encryption.encryptPassword(password);
- if (encryptionPrefix != null) {
- p = encryptionPrefix + p;
- }
- if (encryptionSuffix != null) {
- p = p + encryptionSuffix;
- }
- return p;
- }
- }
- }
-
}
http://git-wip-us.apache.org/repos/asf/karaf/blob/d6edb10e/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesBackingEngine.java
----------------------------------------------------------------------
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesBackingEngine.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesBackingEngine.java
index 1c3a85b..9435f0c 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesBackingEngine.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/properties/PropertiesBackingEngine.java
@@ -39,6 +39,7 @@ public class PropertiesBackingEngine implements BackingEngine {
public PropertiesBackingEngine(Properties users) {
this.users = users;
+ this.encryptionSupport = EncryptionSupport.noEncryptionSupport();
}
public PropertiesBackingEngine(Properties users, EncryptionSupport encryptionSupport) {
@@ -58,25 +59,13 @@ public class PropertiesBackingEngine implements BackingEngine {
String[] infos = null;
StringBuffer userInfoBuffer = new StringBuffer();
- String newPassword = password;
-
- //If encryption support is enabled, encrypt password
- if (encryptionSupport != null && encryptionSupport.getEncryption() != null) {
- newPassword = encryptionSupport.getEncryption().encryptPassword(password);
- if (encryptionSupport.getEncryptionPrefix() != null) {
- newPassword = encryptionSupport.getEncryptionPrefix() + newPassword;
- }
- if (encryptionSupport.getEncryptionSuffix() != null) {
- newPassword = newPassword + encryptionSupport.getEncryptionSuffix();
- }
- }
-
+ String encPassword = encryptionSupport.encrypt(password);
String userInfos = users.get(username);
//If user already exists, update password
if (userInfos != null && userInfos.length() > 0) {
infos = userInfos.split(",");
- userInfoBuffer.append(newPassword);
+ userInfoBuffer.append(encPassword);
for (int i = 1; i < infos.length; i++) {
userInfoBuffer.append(",");
@@ -85,7 +74,7 @@ public class PropertiesBackingEngine implements BackingEngine {
String newUserInfo = userInfoBuffer.toString();
users.put(username, newUserInfo);
} else {
- users.put(username, newPassword);
+ users.put(username, encPassword);
}
try {