You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-dev@portals.apache.org by at...@apache.org on 2008/09/15 14:53:47 UTC
svn commit: r695457 - in
/portals/jetspeed-2/portal/branches/security-refactoring:
components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/
components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/ntlm/
components/j...
Author: ate
Date: Mon Sep 15 05:53:45 2008
New Revision: 695457
URL: http://svn.apache.org/viewvc?rev=695457&view=rev
Log:
- implemented new default AuthenticationProvider and JAAS DefaultLoginModule logic
- improve the SecurityValveImpl which will try to actually access the previously loaded UserSubjectPrincipal in the DefaulLoginModule within the JAAS container (Tomcat only for now).
Added:
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java (contents, props changed)
- copied, changed from r695333, portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/AuthenticationProviderImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java (with props)
Removed:
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/AuthenticationProviderImpl.java
Modified:
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/SecurityValveImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/ntlm/NtlmSecurityValve.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultLoginModule.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/ext/JBossLoginModule.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialAccessManager.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialManager.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/JetspeedSecurityPersistenceManager.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/test/java/org/apache/jetspeed/security/TestAuthenticationProviderProxy.java
portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-commons/src/main/java/org/apache/jetspeed/security/AuthenticatedUserImpl.java
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/SecurityValveImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/SecurityValveImpl.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/SecurityValveImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/SecurityValveImpl.java Mon Sep 15 05:53:45 2008
@@ -16,20 +16,25 @@
*/
package org.apache.jetspeed.security.impl;
+import java.lang.reflect.Method;
import java.security.Principal;
import java.util.HashSet;
import java.util.Set;
import javax.security.auth.Subject;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
import org.apache.jetspeed.administration.PortalAuthenticationConfiguration;
import org.apache.jetspeed.pipeline.valve.SecurityValve;
import org.apache.jetspeed.profiler.Profiler;
import org.apache.jetspeed.request.RequestContext;
+import org.apache.jetspeed.security.JetspeedSubjectFactory;
import org.apache.jetspeed.security.SecurityException;
import org.apache.jetspeed.security.SecurityHelper;
import org.apache.jetspeed.security.User;
import org.apache.jetspeed.security.UserManager;
+import org.apache.jetspeed.security.UserSubjectPrincipal;
import org.apache.jetspeed.statistics.PortalStatistics;
/**
@@ -42,8 +47,11 @@
*/
public class SecurityValveImpl extends AbstractSecurityValve implements SecurityValve
{
+ private static Log log = LogFactory.getLog(SecurityValveImpl.class);
+
private UserManager userMgr;
private PortalStatistics statistics;
+ private boolean resolveTomcatPrincipalFailed;
public SecurityValveImpl(Profiler profiler, UserManager userMgr, PortalStatistics statistics,
PortalAuthenticationConfiguration authenticationConfiguration)
@@ -90,12 +98,17 @@
if (subject != null)
{
Principal subjectUserPrincipal = SecurityHelper.getPrincipal(subject, User.class);
- if ((subjectUserPrincipal == null) || !subjectUserPrincipal.getName().equals(getUserPrincipal(request).getName()))
+ if ((subjectUserPrincipal == null) || !subjectUserPrincipal.getName().equals(userPrincipal.getName()))
{
subject = null;
}
}
+ if (subject == null)
+ {
+ subject = resolveSubjectFromContext(request, userPrincipal);
+ }
+
// create new session subject for user principal if required
if (subject == null)
{
@@ -111,18 +124,17 @@
}
catch (SecurityException sex)
{
- subject = null;
+ if (userPrincipal.getName().equals(userMgr.getAnonymousUser()))
+ {
+ throw sex;
+ }
+ else
+ {
+ log.error("Unknown user Principal "+userPrincipal.getName()+": creating a default subject without any roles", sex);
+ subject = JetspeedSubjectFactory.createSubject(userMgr.newTransientUser(userPrincipal.getName()), null, null, null);
+ }
}
- // if subject not available, generate default subject using
- // request or default profiler anonymous user principal
- if (subject == null)
- {
- Set principals = new HashSet();
- principals.add(userPrincipal);
- subject = new Subject(true, principals, new HashSet(), new HashSet());
- }
-
// create a new statistics *user* session
if (statistics != null)
{
@@ -149,9 +161,45 @@
Principal userPrincipal = request.getRequest().getUserPrincipal();
if (userPrincipal == null)
{
- userPrincipal = new TransientUser(userMgr.getAnonymousUser());
- }
+ userPrincipal = userMgr.newTransientUser(userMgr.getAnonymousUser());
+ }
return userPrincipal;
}
-
+
+ protected Subject resolveSubjectFromContext(RequestContext request, Principal userPrincipal)
+ {
+ if (userPrincipal.getName().equals(userMgr.getAnonymousUser()))
+ {
+ return null;
+ }
+ if (userPrincipal instanceof UserSubjectPrincipal)
+ {
+ return ((UserSubjectPrincipal)userPrincipal).getSubject();
+ }
+ return resolveSubjectFromContainerPrincipal(request, userPrincipal);
+ }
+
+ protected Subject resolveSubjectFromContainerPrincipal(RequestContext request, Principal userPrincipal)
+ {
+ // default handling for Tomcat Realm
+ if (!resolveTomcatPrincipalFailed && userPrincipal.getClass().getName().equals("org.apache.catalina.realm.GenericPrincipal"))
+ {
+ try
+ {
+ Method m = userPrincipal.getClass().getMethod("getUserPrincipal", (Class[])null);
+ Principal p = (Principal)m.invoke(userPrincipal, (Object[])null);
+ if (p != null && p instanceof UserSubjectPrincipal)
+ {
+ return ((UserSubjectPrincipal)p).getSubject();
+ }
+ }
+ catch (Exception e)
+ {
+ // ignore
+ }
+ // don't try again
+ resolveTomcatPrincipalFailed = true;
+ }
+ return null;
+ }
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/ntlm/NtlmSecurityValve.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/ntlm/NtlmSecurityValve.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/ntlm/NtlmSecurityValve.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-portal/src/main/java/org/apache/jetspeed/security/impl/ntlm/NtlmSecurityValve.java Mon Sep 15 05:53:45 2008
@@ -31,8 +31,6 @@
import org.apache.jetspeed.security.User;
import org.apache.jetspeed.security.UserManager;
import org.apache.jetspeed.security.impl.AbstractSecurityValve;
-import org.apache.jetspeed.security.impl.TransientUser;
-import org.apache.jetspeed.security.impl.UserImpl;
import org.apache.jetspeed.statistics.PortalStatistics;
/**
* NTLMSecurityValve provides Subject creation based on the
@@ -118,7 +116,7 @@
}
// otherwise return anonymous principal
- return new TransientUser(userMgr.getAnonymousUser());
+ return userMgr.newTransientUser(userMgr.getAnonymousUser());
}
protected Subject getSubject(RequestContext context) throws Exception
Copied: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java (from r695333, portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/AuthenticationProviderImpl.java)
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java?p2=portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java&p1=portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/AuthenticationProviderImpl.java&r1=695333&r2=695457&rev=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/AuthenticationProviderImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java Mon Sep 15 05:53:45 2008
@@ -31,11 +31,11 @@
* @see org.apache.jetspeed.security.AuthenticationProvider
* @version $Id$
*/
-public class AuthenticationProviderImpl implements AuthenticationProvider
+public abstract class BaseAuthenticationProvider implements AuthenticationProvider
{
/** The logger. */
- private static final Log log = LogFactory.getLog(AuthenticationProviderImpl.class);
+ private static final Log log = LogFactory.getLog(BaseAuthenticationProvider.class);
/** The provider name. */
private String providerName;
@@ -54,7 +54,7 @@
* @param credHandler The credential handler.
* @param userSecurityHandler The user security handler.
*/
- public AuthenticationProviderImpl(String providerName, String providerDescription)
+ public BaseAuthenticationProvider(String providerName, String providerDescription)
{
// The provider name.
this.providerName = providerName;
@@ -72,7 +72,7 @@
* @param providerDescription The provider description.
* @param loginConfig The login module config.
*/
- public AuthenticationProviderImpl(String providerName, String providerDescription, String loginConfig)
+ public BaseAuthenticationProvider(String providerName, String providerDescription, String loginConfig)
{
this(providerName, providerDescription);
@@ -127,10 +127,4 @@
{
this.providerName = providerName;
}
-
- public AuthenticatedUser authenticate(String userName, String password) throws SecurityException
- {
- // TODO Auto-generated method stub
- return null;
- }
}
\ No newline at end of file
Propchange: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java
------------------------------------------------------------------------------
cvs2svn:cvs-rev = 1.3
Propchange: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/BaseAuthenticationProvider.java
------------------------------------------------------------------------------
svn:keywords = Author Date Id Revision
Added: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java?rev=695457&view=auto
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java (added)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java Mon Sep 15 05:53:45 2008
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jetspeed.security.impl;
+
+import org.apache.jetspeed.security.AuthenticatedUser;
+import org.apache.jetspeed.security.AuthenticatedUserImpl;
+import org.apache.jetspeed.security.PasswordCredential;
+import org.apache.jetspeed.security.SecurityException;
+import org.apache.jetspeed.security.spi.UserPasswordCredentialManager;
+
+/**
+ * @version $Id$
+ *
+ */
+public class DefaultAuthenticationProvider extends BaseAuthenticationProvider
+{
+ private UserPasswordCredentialManager upcm;
+
+ public DefaultAuthenticationProvider(String providerName, String providerDescription, UserPasswordCredentialManager upcm)
+ {
+ super(providerName, providerDescription);
+ this.upcm = upcm;
+ }
+
+ public DefaultAuthenticationProvider(String providerName, String providerDescription, String loginConfig,
+ UserPasswordCredentialManager upcm)
+ {
+ super(providerName, providerDescription, loginConfig);
+ this.upcm = upcm;
+ }
+
+ public AuthenticatedUser authenticate(String userName, String password) throws SecurityException
+ {
+ PasswordCredential credential = upcm.getAuthenticatedPasswordCredential(userName, password);
+ return new AuthenticatedUserImpl(credential.getUser(), new UserCredentialImpl(credential));
+ }
+}
Propchange: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java
------------------------------------------------------------------------------
svn:keywords = Id
Propchange: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultAuthenticationProvider.java
------------------------------------------------------------------------------
svn:mime-type = text/plain
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultLoginModule.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultLoginModule.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultLoginModule.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/DefaultLoginModule.java Mon Sep 15 05:53:45 2008
@@ -29,6 +29,8 @@
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
import org.apache.jetspeed.security.AuthenticatedUser;
import org.apache.jetspeed.security.LoginModuleProxy;
import org.apache.jetspeed.security.Role;
@@ -53,7 +55,8 @@
*/
public class DefaultLoginModule implements LoginModule
{
-
+ private static final Log log = LogFactory.getLog(DefaultLoginModule.class);
+
/** <p>LoginModule debug mode is turned off by default.</p> */
protected boolean debug;
@@ -70,10 +73,10 @@
protected CallbackHandler callbackHandler;
/** <p>State shared with other configured LoginModules.</p> */
- protected Map sharedState;
+ protected Map<String,?> sharedState;
/** <p>Options specified in the login Configuration for this particular LoginModule.</p> */
- protected Map options;
+ protected Map<String,?> options;
/** <p>The authentication provider service.</p> */
protected AuthenticationProvider authProvider;
@@ -86,6 +89,8 @@
/** <p>The user name.</p> */
protected String username;
+
+ protected AuthenticatedUser user;
/**
@@ -173,9 +178,10 @@
// TODO We should get the user profile here and had it in cache so that we do not have to retrieve it again.
// TODO Ideally the User should be available from the session. Need discussion around this.
refreshProxy();
- commitPrincipals(subject, ums.getUser(username));
+ commitSubject(subject, user.getUser(), SecurityHelper.getPrincipals(ums.getSubject(user), Role.class));
username = null;
+ user = null;
commitSuccess = true;
if (callbackHandler instanceof PassiveCallbackHandler)
@@ -186,7 +192,7 @@
}
catch (Exception ex)
{
- ex.printStackTrace(System.out);
+ log.error(ex);
throw new LoginException(ex.getMessage());
}
}
@@ -221,11 +227,19 @@
try
{
- AuthenticatedUser authUser = authProvider.authenticate(this.username, password);
+ user = authProvider.authenticate(this.username, password);
}
catch (SecurityException se)
{
- throw new FailedLoginException("Authentication failed: Password does not match");
+ if (se.getCause() != null)
+ {
+ log.error(se.getLocalizedMessage(),se.getCause());
+ }
+ else
+ {
+ log.warn(se.getLocalizedMessage());
+ }
+ throw new FailedLoginException("Authentication failed");
}
success = true;
@@ -251,6 +265,7 @@
public boolean logout() throws LoginException
{
// TODO Can we set subject to null?
+ user = null;
subject.getPrincipals().clear();
subject.getPrivateCredentials().clear();
subject.getPublicCredentials().clear();
@@ -263,7 +278,7 @@
/**
* @see javax.security.auth.spi.LoginModule#initialize(javax.security.auth.Subject, javax.security.auth.callback.CallbackHandler, java.util.Map, java.util.Map)
*/
- public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options)
+ public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String,?> sharedState, Map<String,?> options)
{
this.subject = subject;
this.callbackHandler = callbackHandler;
@@ -277,24 +292,29 @@
}
}
- protected List getUserRoles(Subject subject)
- {
- return SecurityHelper.getPrincipals(subject, Role.class);
- }
-
/**
* Default setup of the logged on Subject Principals for Tomcat
* @param subject
* @param user
*/
- protected void commitPrincipals(Subject subject, User user)
+ protected void commitSubject(Subject containerSubject, User user, List<Principal> rolePrincipals)
{
// add user specific portal user name and roles
- subject.getPrincipals().add((Principal) user);
- subject.getPrincipals().addAll(getUserRoles(subject));
-
- // add portal user role: used in web.xml authorization to
- // detect authenticated portal users
- subject.getPrincipals().add(new RoleImpl(portalUserRole));
+ subject.getPrincipals().add(user);
+ boolean hasPortalUserRole = false;
+ for (Principal role : rolePrincipals)
+ {
+ subject.getPrincipals().add(role);
+ if (role.getName().equals(portalUserRole))
+ {
+ hasPortalUserRole = true;
+ }
+ }
+ if (!hasPortalUserRole)
+ {
+ // add portal user role: used in web.xml authorization to
+ // detect authenticated portal users
+ subject.getPrincipals().add(new RoleImpl(portalUserRole));
+ }
}
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/ext/JBossLoginModule.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/ext/JBossLoginModule.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/ext/JBossLoginModule.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/ext/JBossLoginModule.java Mon Sep 15 05:53:45 2008
@@ -40,12 +40,11 @@
private static class JBossGroup implements Group
{
private String name;
- private ArrayList members = new ArrayList();
+ private ArrayList<Principal> members = new ArrayList<Principal>();
- public JBossGroup(String name, List members)
+ public JBossGroup(String name)
{
this.name = name;
- this.members.addAll(members);
}
public boolean addMember(Principal user)
@@ -68,7 +67,7 @@
return members.remove(user);
}
- public Enumeration members()
+ public Enumeration<Principal> members()
{
return Collections.enumeration(members);
}
@@ -91,16 +90,37 @@
* @param userManager
* @see DefaultLoginModule#DefaultLoginModule(UserManager)
*/
- protected JBossLoginModule (AuthenticationProvider authProvider, UserManager userManager) {
+ protected JBossLoginModule (AuthenticationProvider authProvider, UserManager userManager)
+ {
super (authProvider, userManager);
}
-
- protected void commitPrincipals(Subject subject, User user)
+
+ public JBossLoginModule(AuthenticationProvider authProvider, UserManager userManager, String portalUserRole)
{
- // add UserPrincipal to subject
- subject.getPrincipals().add((Principal) user);
- JBossGroup roles = new JBossGroup("Roles", getUserRoles(subject));
- roles.addMember(new RoleImpl(portalUserRole));
- subject.getPrincipals().add(roles);
+ super(authProvider, userManager, portalUserRole);
+ }
+
+ protected void commitSubject(Subject containerSubject, User user, List<Principal> rolePrincipals)
+ {
+ // add user specific portal user name and roles
+ subject.getPrincipals().add(user);
+ boolean hasPortalUserRole = false;
+ JBossGroup roles = new JBossGroup("Roles");
+
+ for (Principal role : rolePrincipals)
+ {
+ roles.addMember(role);
+ if (role.getName().equals(portalUserRole))
+ {
+ hasPortalUserRole = true;
+ }
+ }
+ if (!hasPortalUserRole)
+ {
+ // add portal user role: used in web.xml authorization to
+ // detect authenticated portal users
+ roles.addMember(new RoleImpl(portalUserRole));
+ }
+ subject.getPrincipals().add(roles);
}
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialAccessManager.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialAccessManager.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialAccessManager.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialAccessManager.java Mon Sep 15 05:53:45 2008
@@ -37,5 +37,6 @@
* @return
*/
PasswordCredential getPasswordCredential(String userName);
+ void loadPasswordCredentialUser(PasswordCredential credential);
List<PasswordCredential> getHistoricPasswordCredentials(User user);
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialManager.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialManager.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialManager.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialManager.java Mon Sep 15 05:53:45 2008
@@ -16,9 +16,13 @@
*/
package org.apache.jetspeed.security.spi;
+import org.apache.jetspeed.security.PasswordCredential;
+import org.apache.jetspeed.security.SecurityException;
+
/**
* @version $Id$
*/
public interface UserPasswordCredentialManager extends UserPasswordCredentialStorageManager
{
+ PasswordCredential getAuthenticatedPasswordCredential(String userName, String password) throws SecurityException;
}
\ No newline at end of file
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/JetspeedSecurityPersistenceManager.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/JetspeedSecurityPersistenceManager.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/JetspeedSecurityPersistenceManager.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/JetspeedSecurityPersistenceManager.java Mon Sep 15 05:53:45 2008
@@ -357,7 +357,7 @@
* Warning: the User reference is configured with auto-retrieve="false".
* This is intentionally done to allow retrieving the credential for authentication purposes only
* so no User is loaded when authentication fails.
- * The user reference can be materialized by OJB using persistenceBroker.retrieveReference(credential, "user").
+ * The user reference can be materialized by calling {@link #loadPasswordCredentialUser(PasswordCredential)}.
* </p>
*/
public PasswordCredential getPasswordCredential(String userName)
@@ -374,6 +374,14 @@
}
return pwc;
}
+
+ public void loadPasswordCredentialUser(PasswordCredential credential)
+ {
+ if (credential.getUser() == null)
+ {
+ getPersistenceBroker(true).retrieveReference(credential, "user");
+ }
+ }
public List<PasswordCredential> getHistoricPasswordCredentials(User user)
{
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java Mon Sep 15 05:53:45 2008
@@ -16,9 +16,11 @@
*/
package org.apache.jetspeed.security.spi.impl;
+import org.apache.jetspeed.security.JetspeedPrincipalType;
import org.apache.jetspeed.security.PasswordCredential;
import org.apache.jetspeed.security.SecurityException;
import org.apache.jetspeed.security.User;
+import org.apache.jetspeed.security.spi.UserPasswordCredentialAccessManager;
import org.apache.jetspeed.security.spi.UserPasswordCredentialManager;
import org.apache.jetspeed.security.spi.UserPasswordCredentialPolicyManager;
import org.apache.jetspeed.security.spi.UserPasswordCredentialStorageManager;
@@ -29,16 +31,18 @@
public class UserPasswordCredentialManagerImpl implements UserPasswordCredentialManager
{
private UserPasswordCredentialStorageManager upcsm;
+ private UserPasswordCredentialAccessManager upcam;
private UserPasswordCredentialPolicyManager upcpm;
- public UserPasswordCredentialManagerImpl(UserPasswordCredentialStorageManager upcsm)
+ public UserPasswordCredentialManagerImpl(UserPasswordCredentialStorageManager upcsm, UserPasswordCredentialAccessManager upcam)
{
this.upcsm = upcsm;
+ this.upcam = upcam;
}
- public UserPasswordCredentialManagerImpl(UserPasswordCredentialStorageManager upcsm, UserPasswordCredentialPolicyManager upcpm)
+ public UserPasswordCredentialManagerImpl(UserPasswordCredentialStorageManager upcsm, UserPasswordCredentialAccessManager upcam, UserPasswordCredentialPolicyManager upcpm)
{
- this(upcsm);
+ this(upcsm, upcam);
this.upcpm = upcpm;
}
@@ -60,4 +64,39 @@
}
upcsm.storePasswordCredential(credential);
}
+
+ public PasswordCredential getAuthenticatedPasswordCredential(String userName, String password) throws SecurityException
+ {
+ PasswordCredential credential = upcam.getPasswordCredential(userName);
+ if (upcpm != null)
+ {
+ upcpm.onLoad(credential, userName);
+ upcpm.authenticate(credential, userName, password);
+ }
+ else if (password == null)
+ {
+ throw new SecurityException(SecurityException.PASSWORD_REQUIRED);
+ }
+ else if (credential.getPassword() == null || !password.equals(new String(credential.getPassword())))
+ {
+ throw new SecurityException(SecurityException.INVALID_PASSWORD);
+ }
+ if (!credential.isEnabled() || credential.isExpired())
+ {
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER_TYPE_NAME, userName));
+ }
+ try
+ {
+ upcam.loadPasswordCredentialUser(credential);
+ }
+ catch (Exception e)
+ {
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER_TYPE_NAME, userName), e);
+ }
+ if (credential.getUser() == null || !credential.getUser().isEnabled())
+ {
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER_TYPE_NAME, userName));
+ }
+ return credential;
+ }
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/test/java/org/apache/jetspeed/security/TestAuthenticationProviderProxy.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/test/java/org/apache/jetspeed/security/TestAuthenticationProviderProxy.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/test/java/org/apache/jetspeed/security/TestAuthenticationProviderProxy.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/test/java/org/apache/jetspeed/security/TestAuthenticationProviderProxy.java Mon Sep 15 05:53:45 2008
@@ -23,7 +23,7 @@
import junit.framework.Test;
import junit.framework.TestSuite;
-import org.apache.jetspeed.security.impl.AuthenticationProviderImpl;
+import org.apache.jetspeed.security.impl.BaseAuthenticationProvider;
import org.apache.jetspeed.security.impl.AuthenticationProviderProxyImpl;
import org.apache.jetspeed.security.impl.GroupManagerImpl;
import org.apache.jetspeed.security.impl.LoginModuleProxyImpl;
@@ -62,7 +62,7 @@
// CredentialHandler ldapCh = new LdapCredentialHandler();
// Security Providers.
- AuthenticationProvider defaultAtnProvider = new AuthenticationProviderImpl("DefaultAuthenticator",
+ AuthenticationProvider defaultAtnProvider = new BaseAuthenticationProvider("DefaultAuthenticator",
"The default authenticator", "login.conf", ch, ush);
// AuthenticationProvider ldapAtnProvider = new
// AuthenticationProviderImpl("LdapAuthenticator", "The ldap
Modified: portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-commons/src/main/java/org/apache/jetspeed/security/AuthenticatedUserImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-commons/src/main/java/org/apache/jetspeed/security/AuthenticatedUserImpl.java?rev=695457&r1=695456&r2=695457&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-commons/src/main/java/org/apache/jetspeed/security/AuthenticatedUserImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-commons/src/main/java/org/apache/jetspeed/security/AuthenticatedUserImpl.java Mon Sep 15 05:53:45 2008
@@ -17,6 +17,7 @@
package org.apache.jetspeed.security;
+import java.util.HashSet;
import java.util.Set;
@@ -30,6 +31,12 @@
private Set<Object> publicCredentials;
private Set<Object> privateCredentials;
+ public AuthenticatedUserImpl(User user, UserCredential privateCredential)
+ {
+ this.user = user;
+ this.privateCredentials = new HashSet<Object>(1);
+ this.privateCredentials.add(privateCredential);
+ }
public AuthenticatedUserImpl(User user, Set<Object> publicCredentials, Set<Object> privateCredentials)
{
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org