You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2017/11/07 09:18:17 UTC
[sling-org-apache-sling-auth-form] annotated tag
org.apache.sling.auth.form-1.0.2 created (now cdadb1a)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a change to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git.
at cdadb1a (tag)
tagging ed58e47108a960394972b121a59422312e7ff810 (commit)
by Carsten Ziegeler
on Wed Dec 15 15:52:39 2010 +0000
- Log -----------------------------------------------------------------
org.apache.sling.auth.form-1.0.2
-----------------------------------------------------------------------
This annotated tag includes the following new commits:
new f467e0e SLING-1116 Initial Version based on Eric Norman's patch (thanks alot)
new 8b679bf SLING-1116 cleanup dependencies
new a0fcd1a SLING-1116 Implement support for the j_validate login form parameter and add support to convey a reason to render the login form using the j_reason request parameter for the login form request
new 44c5ccd SLING-1116 Fix service description
new a812358 SLING-1116 Ensure the FormLoginModulePlugin is actually registered as a service (otherwise authenticaiton may fail). Also the resource attribute is set in the extractRequestParameterAuthentication method to ensure a redirect takes place after successful login
new 0a41f41 SLING-1380 Do not return anything from getPrincipal to allow DefaultLoginModule.getPrincipal to kick in and validate the user name against the existing users (and also to provide the correct principal for the user)
new a25ef67 SLING-1116 make sure the login form action is an absolute path
new 33e89b6 SLING-1419 : Remove dependency to JCR
new 64b2394 SLING-1498 - saving resource being requested
new 0a8abcc SLING-1497 - adding tentative configuration for configuring service.ranking via ConfigAdmin/Metatype
new 1cb242e forgot that maven 3 dropped support for latest. oh well, new scr plugin should be released rsn
new 6b812d8 Use released parent pom.
new 4e10552 SLING-1116 Improve FormReason to convey the human-readable message by toString()
new 217e197 SLING-1565 Move private implementation classes to the impl package and export the o.a.s.formauth package for login forms to be able to interpret the j_reason value with the FormReason enum.
new a606003 SLING-1565 - need to move the login form as well to be in the same package as the servlet
new d5ecfb9 SLING-1564 - adding support for form inclusion as well as custom form pages via fragments
new 196a11f SLING-1587 - file name wasn't being logged
new d3222a7 SLING-1575 Adapt Form and OpenID authentication handler to use new abstract form servlet and authentication handler
new 531e943 SLING-1575 Add @scr.service tag for login form servlets and fully qualify path property definition in the authentication handler
new 03ed695 Remove unneeded (and commented out) version element
new 99b1053 SLING-1588 Fixed, cookie needs to be removed when found to be invalid.
new d24ad09 SLING-1614 Added config settings that allow a login form to be re-displayed when the login token expires, by default the login form is not displayed on expiry, on the basis that it was not displayed by default when the anon user first came to the site.
new e561eda SLING-1614 Added missing property name and metatype text.
new 008d39d SLING-1647 Set handler specific properties in the AuthenticationInfo instead of the credentials. The properties will be transferred to the session by the ResourceResolverFactory implementation
new bdb9503 SLING-1650 Consolidate authentication stuff in a new auth component; * rename commons/auth to auth/core * rename extensions/formauth to auth/form * rename extensions/openidauth to auth/openid
new f4f4bfc SLING-1650 Refactor auth/core, auth/form, auth/openid for the new packages identifying the auth component and refer to the new auth/core for the authentication handlers.
new 5ba6c25 SLING-1650 Remove old packages; make sure the login.html form source is in the correct (new) location
new 9946c7c Set JIRA version id and fix JavaDoc exclusions
new dc98910 Update to Sling API 2.1.0
new af26b77 use Auth Core 1.0.0 to prepare the release
new 9e52b4e [maven-release-plugin] prepare release org.apache.sling.auth.form-1.0.0
new 00fad8b [maven-release-plugin] prepare for next development iteration
new f045f34 Use previous Auth Core SNAPSHOT until after release
new 11448fa SLING-1695 - set the cookie domain either by a config admin property or using a key within the AuthenticationInfo object
new aee24d0 SLING-1714 Convert @scr JavaDoc tags to SCR annotations
new acc1f6b SLING-1714 Metatype descriptor generation is not enabled by default for annotations
new 2574aa6 SLING-1722 Do not embed StringUtils class but import the Commons Lang package
new 1bf2250 SLING-1721 Use no cookie domain if the configured (or requested) cookie domain is an empty string
new 18d11b7 SLING-1729 Provide a simple and faster alternative to the default SecureRandom seeding. This might be of interest mostly for the Linux and Solaris platforms which seed SecureRandom from the blocking /dev/random by default.
new 4d1d59e SLING-1729 Emit a log message if regular SecureRandom seeding is used
new ebdcfd7 Use released version of auth/core dependency
new 93fe53e SLING-1744 Split the authentication data into exactly three fields leaving any excess field separators in the user name field thus supporting user names with @ signs such as email addresses.
new dc0a50e SLING-1752 Unify resource attribute/parameter setting and default value handling
new e633f47 Revert changes from commit 996477 which are not intended to go into that commit (relative to handling auth failures for XHR requests and handling the cookie)
new bfe05c2 SLING-1762 Add the HttpOnly attribute to setting the authentication cookie to make sure the cookie is not available to client side JavaScript. Also, when extracting the authentication data from the cookie ignore empty values.
new 1e178f5 SLING-1783 Make the use of the j_reason request attribute to inform about failures for authentication official
new b087302 Don't quote cookie value and attributes
new 8a77e54 SLING-1785 Use new redirect helper method of tha AbstractAuthenticationHandler
new e4d4eff SLING-1428 Reimplement full j_validate functionality: Send a 403 response if either the provided cookie value is invalid or if the provided user name and password cannot be used to login. Created methods to actually send back the success or failure responses for validation requests.
new 888cdb3 SLING-1428 Implement generalized support for validating credentials supplied by a request using the j_validate request parameter.
new 64b8cf5 updating all modules to parent 10-SNAPSHOT in anticipation of emma additions to parent
new 8972039 SLING-1869 - upgrading to latest SCR plugin and putting scr.annotations in parent
new ad83c4f Update to recent snapshots
new 09f89ed Use latest releases.
new ef7843d Prepare releases
new 17bfd16 [maven-release-plugin] prepare release org.apache.sling.auth.form-1.0.2
new ed58e47 [maven-scm] copy for tag org.apache.sling.auth.form-1.0.2
The 57 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
--
To stop receiving notification emails like this one, please contact
['"commits@sling.apache.org" <co...@sling.apache.org>'].
[sling-org-apache-sling-auth-form] 17/26: SLING-1785 Use new
redirect helper method of tha AbstractAuthenticationHandler
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 8a77e54e294bd29fd28015e918ddfde87921f69b
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Sep 20 08:52:50 2010 +0000
SLING-1785 Use new redirect helper method of tha AbstractAuthenticationHandler
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@998830 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 30 ++++++----------------
1 file changed, 8 insertions(+), 22 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 3feb882..dab932e 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -21,10 +21,11 @@ package org.apache.sling.auth.form.impl;
import java.io.File;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
-import java.net.URLEncoder;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Dictionary;
+import java.util.HashMap;
+
import javax.jcr.Credentials;
import javax.jcr.SimpleCredentials;
import javax.servlet.Servlet;
@@ -396,38 +397,23 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
}
- // prepare the login form redirection target
- final StringBuilder targetBuilder = new StringBuilder();
- targetBuilder.append(request.getContextPath());
- targetBuilder.append(loginForm);
-
- // append originally requested resource (for redirect after login)
- char parSep = '?';
-
- if (resource != null) {
- targetBuilder.append(parSep).append(Authenticator.LOGIN_RESOURCE);
- targetBuilder.append("=").append(
- URLEncoder.encode(resource, "UTF-8"));
- parSep = '&';
- }
+ HashMap<String, String> params = new HashMap<String, String>();
+ params.put(Authenticator.LOGIN_RESOURCE, resource);
// append indication of previous login failure
if (request.getAttribute(FAILURE_REASON) != null) {
final Object jReason = request.getAttribute(FAILURE_REASON);
- @SuppressWarnings("unchecked")
+ @SuppressWarnings("rawtypes")
final String reason = (jReason instanceof Enum)
? ((Enum) jReason).name()
: jReason.toString();
- targetBuilder.append(parSep).append(FAILURE_REASON);
- targetBuilder.append("=").append(URLEncoder.encode(reason, "UTF-8"));
+ params.put(FAILURE_REASON, reason);
}
- // finally redirect to the login form
- final String target = targetBuilder.toString();
try {
- response.sendRedirect(target);
+ sendRedirect(request, response, loginForm, params);
} catch (IOException e) {
- log.error("Failed to redirect to the page: " + target, e);
+ log.error("Failed to redirect to the login form " + loginForm, e);
}
return true;
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 07/26: SLING-1721 Use no cookie
domain if the configured (or requested) cookie domain is an empty string
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 1bf2250c28828283882ee08a649d4f186483b7d7
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Thu Sep 2 12:13:28 2010 +0000
SLING-1721 Use no cookie domain if the configured (or requested) cookie domain is an empty string
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@991904 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 32 ++++++++++++----------
1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 861be54..e59975c 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -25,7 +25,6 @@ import java.net.URLEncoder;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Dictionary;
-
import javax.jcr.Credentials;
import javax.jcr.SimpleCredentials;
import javax.servlet.Servlet;
@@ -72,7 +71,8 @@ import org.slf4j.LoggerFactory;
@Property(name = Constants.SERVICE_DESCRIPTION, value = "Apache Sling Form Based Authentication Handler"),
@Property(name = Constants.SERVICE_VENDOR, value = "The Apache Software Foundation"),
@Property(name = AuthenticationHandler.PATH_PROPERTY, value = "/", cardinality = 100),
- @Property(name = AuthenticationHandler.TYPE_PROPERTY, value = HttpServletRequest.FORM_AUTH, propertyPrivate = true) })
+ @Property(name = AuthenticationHandler.TYPE_PROPERTY, value = HttpServletRequest.FORM_AUTH, propertyPrivate = true),
+ @Property(name = Constants.SERVICE_RANKING, intValue = 0, propertyPrivate = false) })
@Service
public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
@@ -238,13 +238,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
static final String PAR_J_REASON = "j_reason";
/**
- * The service ranking property.
- */
- @Property(intValue = 0, propertyPrivate = false)
- @SuppressWarnings("unused")
- private static final String PAR_SERVICE_RANKING = Constants.SERVICE_RANKING;
-
- /**
* Key in the AuthenticationInfo map which contains the domain on which the
* auth cookie should be set.
*/
@@ -727,8 +720,11 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
final String authName = OsgiUtil.toString(
properties.get(PAR_AUTH_NAME), DEFAULT_AUTH_NAME);
- final String defaultCookieDomain = OsgiUtil.toString(
- properties.get(PAR_DEFAULT_COOKIE_DOMAIN), null);
+ String defaultCookieDomain = OsgiUtil.toString(
+ properties.get(PAR_DEFAULT_COOKIE_DOMAIN), "");
+ if (defaultCookieDomain.length() == 0) {
+ defaultCookieDomain = null;
+ }
final String authStorage = OsgiUtil.toString(
properties.get(PAR_AUTH_STORAGE), DEFAULT_AUTH_STORAGE);
@@ -931,11 +927,17 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// send the cookie to the response
String cookieDomain = (String) info.get(COOKIE_DOMAIN);
- if (cookieDomain == null) {
+ if (cookieDomain == null || cookieDomain.length() == 0) {
cookieDomain = defaultCookieDomain;
}
- setCookie(request, response, this.cookieName, cookieValue, -1, cookieDomain);
- setCookie(request, response, this.domainCookieName, cookieDomain, -1, cookieDomain);
+ setCookie(request, response, this.cookieName, cookieValue, -1,
+ cookieDomain);
+
+ // send the cookie domain cookie if domain is not null
+ if (cookieDomain != null) {
+ setCookie(request, response, this.domainCookieName,
+ cookieDomain, -1, cookieDomain);
+ }
}
public void clear(HttpServletRequest request,
@@ -957,7 +959,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// remove the old cookie from the client
if (oldCookie != null) {
setCookie(request, response, this.cookieName, "", 0, oldCookieDomain);
- if (oldCookieDomain != null) {
+ if (oldCookieDomain != null && oldCookieDomain.length() > 0) {
setCookie(request, response, this.domainCookieName, "", 0, oldCookieDomain);
}
}
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 11/26: SLING-1744 Split the
authentication data into exactly three fields leaving any excess field
separators in the user name field thus supporting user names with @ signs
such as email addresses.
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 93fe53e6b64f918ca61369dae3b2823cd920e3d7
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Fri Sep 10 08:04:24 2010 +0000
SLING-1744 Split the authentication data into exactly three fields leaving any excess field separators in the user name field thus supporting user names with @ signs such as email addresses.
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@995694 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 7 +++----
.../apache/sling/auth/form/impl/TokenStore.java | 22 ++++++++++++++++++++--
.../form/impl/FormAuthenticationHandlerTest.java | 2 +-
3 files changed, 24 insertions(+), 7 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 57b7ce3..7835e0a 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -35,7 +35,6 @@ import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.lang.StringUtils;
import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.Properties;
import org.apache.felix.scr.annotations.Property;
@@ -844,8 +843,8 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
String getUserId(final String authData) {
if (authData != null) {
- String[] parts = StringUtils.split(authData, "@");
- if (parts != null && parts.length == 3) {
+ String[] parts = TokenStore.split(authData);
+ if (parts != null) {
return parts[2];
}
}
@@ -864,7 +863,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
if (authData == null) {
updateCookie = true;
} else {
- String[] parts = StringUtils.split(authData, "@");
+ String[] parts = TokenStore.split(authData);
if (parts != null && parts.length == 3) {
long cookieTime = Long.parseLong(parts[1].substring(1));
if (System.currentTimeMillis() + (sessionTimeout / 2) > cookieTime) {
diff --git a/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java b/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
index e06ff82..ed9b0ac 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
@@ -178,6 +178,24 @@ class TokenStore {
}
/**
+ * Splits the authentication data into the three parts packed together while
+ * encoding the cookie.
+ *
+ * @param authData The authentication data to split in three parts
+ * @return A string array with three elements being the three parts of the
+ * cookie value or <code>null</code> if the input is
+ * <code>null</code> or if the string does not contain (at least)
+ * three '@' separated parts.
+ */
+ static String[] split(final String authData) {
+ String[] parts = StringUtils.split(authData, "@", 3);
+ if (parts != null && parts.length == 3) {
+ return parts;
+ }
+ return null;
+ }
+
+ /**
* Returns <code>true</code> if the <code>value</code> is a valid secure
* token as follows:
* <ul>
@@ -192,8 +210,8 @@ class TokenStore {
* Otherwise the method returns <code>false</code>.
*/
boolean isValid(String value) {
- String[] parts = StringUtils.split(value, "@");
- if (parts != null && parts.length == 3) {
+ String[] parts = split(value);
+ if (parts != null) {
// single digit token number
int tokenNumber = parts[1].charAt(0) - '0';
diff --git a/src/test/java/org/apache/sling/auth/form/impl/FormAuthenticationHandlerTest.java b/src/test/java/org/apache/sling/auth/form/impl/FormAuthenticationHandlerTest.java
index 20f5054..589bf30 100644
--- a/src/test/java/org/apache/sling/auth/form/impl/FormAuthenticationHandlerTest.java
+++ b/src/test/java/org/apache/sling/auth/form/impl/FormAuthenticationHandlerTest.java
@@ -92,7 +92,7 @@ public class FormAuthenticationHandlerTest extends TestCase {
assertEquals(null, handler.getUserId("field0"));
assertEquals(null, handler.getUserId("field0@field1"));
assertEquals("field3", handler.getUserId("field0@field1@field3"));
- assertEquals(null, handler.getUserId("field0@field1@field3@field4"));
+ assertEquals("field3@field4", handler.getUserId("field0@field1@field3@field4"));
}
/**
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 09/26: SLING-1729 Emit a log
message if regular SecureRandom seeding is used
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 4d1d59e2548ff0c52e0539f9b45a3c3c7470d9be
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Sep 6 17:45:17 2010 +0000
SLING-1729 Emit a log message if regular SecureRandom seeding is used
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@993111 13f79535-47bb-0310-9956-ffa450edef68
---
src/main/java/org/apache/sling/auth/form/impl/TokenStore.java | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java b/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
index d79e686..e06ff82 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
@@ -129,6 +129,13 @@ class TokenStore {
// warm up the crypto API
if (fastSeed) {
random.setSeed(getFastEntropy());
+ } else {
+ log.info("Seeding the secure random number generator can take "
+ + "up to several minutes on some operating systems depending "
+ + "upon environment factors. If this is a problem for you, "
+ + "set the system property 'java.security.egd' to "
+ + "'file:/dev/./urandom' or enable the Fast Seed Generator "
+ + "in the Web Console");
}
byte[] b = new byte[20];
random.nextBytes(b);
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 01/26: [maven-release-plugin]
prepare for next development iteration
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 00fad8bdb601226bd92e4a5ff512fb5e744f0879
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Aug 23 16:25:35 2010 +0000
[maven-release-plugin] prepare for next development iteration
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@988183 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pom.xml b/pom.xml
index 2d3f6fe..7682691 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@
</parent>
<artifactId>org.apache.sling.auth.form</artifactId>
- <version>1.0.0</version>
+ <version>1.0.1-SNAPSHOT</version>
<packaging>bundle</packaging>
<name>Apache Sling Form Based Authentication Handler</name>
@@ -43,9 +43,9 @@
</properties>
<scm>
- <connection>scm:svn:http://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.form-1.0.0</connection>
- <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.form-1.0.0</developerConnection>
- <url>http://svn.apache.org/viewvc/sling/tags/org.apache.sling.auth.form-1.0.0</url>
+ <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form</connection>
+ <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form</developerConnection>
+ <url>http://svn.apache.org/viewvc/sling/trunk/bundles/auth/form</url>
</scm>
<build>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 22/26: Update to recent snapshots
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit ad83c4f65ec356a128efb97855b188d49d02f492
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Wed Dec 8 16:37:27 2010 +0000
Update to recent snapshots
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1043504 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 6eea1f7..c87160c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -21,7 +21,7 @@
<parent>
<groupId>org.apache.sling</groupId>
<artifactId>sling</artifactId>
- <version>10-SNAPSHOT</version>
+ <version>11-SNAPSHOT</version>
<relativePath>../../../parent/pom.xml</relativePath>
</parent>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 10/26: Use released version of
auth/core dependency
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit ebdcfd770bb86fae8d9484dea417d66399aec464
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Tue Sep 7 07:28:10 2010 +0000
Use released version of auth/core dependency
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@993254 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 7fef591..0e529a5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@
<dependency>
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.auth.core</artifactId>
- <version>0.9.0-SNAPSHOT</version>
+ <version>1.0.0</version>
<scope>provided</scope>
</dependency>
<dependency>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 12/26: SLING-1752 Unify resource
attribute/parameter setting and default value handling
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit dc0a50e664a949edeac28cb6532e763a7d786368
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Sep 13 10:08:52 2010 +0000
SLING-1752 Unify resource attribute/parameter setting and default value handling
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@996477 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
.../auth/form/impl/FormAuthenticationHandler.java | 83 ++++++++++++++++------
2 files changed, 64 insertions(+), 21 deletions(-)
diff --git a/pom.xml b/pom.xml
index 0e529a5..34ae84d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@
<dependency>
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.auth.core</artifactId>
- <version>1.0.0</version>
+ <version>1.0.3-SNAPSHOT</version>
<scope>provided</scope>
</dependency>
<dependency>
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 7835e0a..0557d6f 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -330,13 +330,26 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
if (authData != null) {
if (tokenStore.isValid(authData)) {
info = createAuthInfo(authData);
+ } else if ("XMLHttpRequest".equals(request.getHeader("X-Requested-With"))) {
+ // signal to AJAX the request is forbidden
+ try {
+ response.sendError(
+ HttpServletResponse.SC_REQUEST_TIMEOUT,
+ "Session Timeout, please login");
+ response.flushBuffer();
+ } catch (IOException ioe) {
+ // TODO: log !!
+ }
+ return AuthenticationInfo.DOING_AUTH;
} else {
if (this.loginAfterExpire) {
- // signal the requestCredentials method a previous login failure
- request.setAttribute(PAR_J_REASON, FormReason.TIMEOUT);
- info = AuthenticationInfo.FAIL_AUTH;
+ // signal the requestCredentials method a previous login
+ // failure
+ request.setAttribute(PAR_J_REASON, FormReason.TIMEOUT);
+ info = AuthenticationInfo.FAIL_AUTH;
}
- // clear the cookie, its invalid and we should get rid of it so that the invalid cookie
+ // clear the cookie, its invalid and we should get rid of it
+ // so that the invalid cookie
// isn't present on the authN operation.
authStorage.clear(request, response);
}
@@ -379,11 +392,8 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
return true;
}
- String resource = getLoginResource(request, null);
- if (resource == null) {
- resource = request.getContextPath() + request.getPathInfo();
- request.setAttribute(Authenticator.LOGIN_RESOURCE, resource);
- }
+ final String resource = setLoginResourceAttribute(request,
+ request.getRequestURI());
if (includeLoginForm && (resourceResolverFactory != null)) {
ResourceResolver resourceResolver = null;
@@ -651,9 +661,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// authentication, otherwise the request may be processed
// as a POST request to the j_security_check page (unless
// the j_validate parameter is set)
- if (getLoginResource(request, null) == null) {
- request.setAttribute(Authenticator.LOGIN_RESOURCE, "/");
- }
+ setLoginResourceAttribute(request, request.getContextPath());
}
}
@@ -896,6 +904,15 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
* {@link CookieAuthData} in an HTTP Cookie.
*/
private static class CookieStorage implements AuthenticationStorage {
+
+ /**
+ * The Set-Cookie header used to manage the login cookie.
+ *
+ * @see CookieStorage#setCookie(HttpServletRequest, HttpServletResponse,
+ * String, String, int, String)
+ */
+ private static final String HEADER_SET_COOKIE = "Set-Cookie";
+
private final String cookieName;
private final String domainCookieName;
private final String defaultCookieDomain;
@@ -917,8 +934,11 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// reverse the base64 encoding
try {
- return new String(Base64.decodeBase64(value),
- "UTF-8");
+ String result = new String(
+ Base64.decodeBase64(value), "UTF-8");
+ if (result.length() > 0) {
+ return result;
+ }
} catch (UnsupportedEncodingException e1) {
throw new RuntimeException(e1);
}
@@ -988,14 +1008,37 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
? "/"
: ctxPath;
- Cookie cookie = new Cookie(name, value);
+ /*
+ * The Servlet Spec 2.5 does not allow us to set the commonly used
+ * HttpOnly attribute on cookies (Servlet API 3.0 does) so we create
+ * the Set-Cookie header manually. See
+ * http://www.owasp.org/index.php/HttpOnly for information on what
+ * the HttpOnly attribute is used for.
+ */
+
+ final StringBuilder header = new StringBuilder();
+
+ // default setup with name, value, cookie path and HttpOnly
+ header.append(name).append('=').append(value);
+ header.append(";Path=").append(cookiePath);
+ header.append(";HttpOnly"); // don't allow JS access
+
+ // set the cookie domain if so configured
if (domain != null) {
- cookie.setDomain(domain);
+ header.append(";Domain=").append(domain);
+ }
+
+ // Only set the Max-Age attribute to remove the cookie
+ if (age == 0) {
+ header.append(";Max-Age=").append(age);
}
- cookie.setMaxAge(age);
- cookie.setPath(cookiePath);
- cookie.setSecure(request.isSecure());
- response.addCookie(cookie);
+
+ // ensure the cookie is secured if this is an https request
+ if (request.isSecure()) {
+ header.append(";Secure");
+ }
+
+ response.addHeader(HEADER_SET_COOKIE, header.toString());
}
}
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 26/26: [maven-scm] copy for tag
org.apache.sling.auth.form-1.0.2
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit ed58e47108a960394972b121a59422312e7ff810
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Wed Dec 15 15:52:39 2010 +0000
[maven-scm] copy for tag org.apache.sling.auth.form-1.0.2
git-svn-id: https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.form-1.0.2@1049610 13f79535-47bb-0310-9956-ffa450edef68
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 16/26: Don't quote cookie value
and attributes
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit b0873022b208420b7f0412d7d75d63efbdf2424b
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Sat Sep 18 18:08:58 2010 +0000
Don't quote cookie value and attributes
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@998508 13f79535-47bb-0310-9956-ffa450edef68
---
.../apache/sling/auth/form/impl/FormAuthenticationHandler.java | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 4415c33..3feb882 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -994,18 +994,18 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
final StringBuilder header = new StringBuilder();
// default setup with name, value, cookie path and HttpOnly
- header.append(name).append("=\"").append(value).append('"');
- header.append("; Path=\"").append(cookiePath).append('"');
+ header.append(name).append("=").append(value);
+ header.append("; Path=").append(cookiePath);
header.append("; HttpOnly"); // don't allow JS access
// set the cookie domain if so configured
if (domain != null) {
- header.append("; Domain=\"").append(domain).append('"');
+ header.append("; Domain=").append(domain);
}
// Only set the Max-Age attribute to remove the cookie
if (age >= 0) {
- header.append("; Max-Age=\"").append(age).append('"');
+ header.append("; Max-Age=").append(age);
}
// ensure the cookie is secured if this is an https request
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 19/26: SLING-1428 Implement
generalized support for validating credentials supplied by a request using
the j_validate request parameter.
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 888cdb3868ca46260f54d0aad38298e280bb11b0
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Fri Sep 24 19:50:12 2010 +0000
SLING-1428 Implement generalized support for validating credentials supplied by a request using the j_validate request parameter.
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1001053 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 104 ++-------------------
1 file changed, 9 insertions(+), 95 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index f5a47f7..6e25289 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -235,13 +235,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final String PAR_J_PASSWORD = "j_password";
/**
- * The name of the form submission parameter indicating that the submitted
- * username and password should just be checked and a status code be set for
- * success (200/OK) or failure (403/FORBIDDEN).
- */
- private static final String PAR_J_VALIDATE = "j_validate";
-
- /**
* Key in the AuthenticationInfo map which contains the domain on which the
* auth cookie should be set.
*/
@@ -252,18 +245,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
private static final long MINUTES = 60L * 1000L;
- /**
- * The name of the request header set by
- * {@link #authenticationFailed(HttpServletRequest, HttpServletResponse, AuthenticationInfo)}
- * if instead of requesting credentials from the client a 403/FORBIDDEN response is sent.
- * <p>
- * This header may be inspected by clients for a reason why the request
- * failed.
- *
- * @see #authenticationFailed(HttpServletRequest, HttpServletResponse, AuthenticationInfo)
- */
- private static final String X_REASON = "X-Reason";
-
/** default log */
private final Logger log = LoggerFactory.getLogger(getClass());
@@ -339,15 +320,11 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// so that the invalid cookie isn't present on the authN
// operation.
authStorage.clear(request, response);
- if (this.loginAfterExpire) {
+ if (this.loginAfterExpire || isValidateRequest(request)) {
// signal the requestCredentials method a previous login
// failure
request.setAttribute(FAILURE_REASON, FormReason.TIMEOUT);
info = AuthenticationInfo.FAIL_AUTH;
- } else if (isValidateRequest(request)) {
- // send 403 response and terminate the request
- sendInvalid(response, FormReason.TIMEOUT);
- info = AuthenticationInfo.DOING_AUTH;
}
}
}
@@ -451,17 +428,8 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// clear authentication data from Cookie or Http Session
authStorage.clear(request, response);
- if (isValidateRequest(request)) {
-
- // just validated the credentials to be invalid
- sendInvalid(response, FormReason.INVALID_CREDENTIALS);
-
- } else {
-
- // signal the requestCredentials method a previous login failure
- request.setAttribute(FAILURE_REASON, FormReason.INVALID_CREDENTIALS);
-
- }
+ // signal the reason for login failure
+ request.setAttribute(FAILURE_REASON, FormReason.INVALID_CREDENTIALS);
}
/**
@@ -489,14 +457,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
refreshAuthData(request, response, authInfo);
final boolean result;
- if (isValidateRequest(request)) {
-
- sendValid(response);
-
- // terminate request, all done
- result = true;
-
- } else if (DefaultAuthenticationFeedbackHandler.handleRedirect(
+ if (DefaultAuthenticationFeedbackHandler.handleRedirect(
request, response)) {
// terminate request, all done in the default handler
@@ -550,56 +511,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
/**
- * Returns <code>true</code> if the the client just asks for validation of
- * submitted username/password credentials.
- * <p>
- * This implementation returns <code>true</code> if the request parameter
- * {@link #PAR_J_VALIDATE} is set to <code>true</code> (case-insensitve). If
- * the request parameter is not set or to any value other than
- * <code>true</code> this method returns <code>false</code>.
- *
- * @param request The request to provide the parameter to check
- * @return <code>true</code> if the {@link #PAR_J_VALIDATE} parameter is set
- * to <code>true</code>.
- */
- private boolean isValidateRequest(final HttpServletRequest request) {
- return "true".equalsIgnoreCase(request.getParameter(PAR_J_VALIDATE));
- }
-
- /**
- * Sends a 200/OK response to a credential validation request.
- *
- * @param response The response object
- */
- private void sendValid(final HttpServletResponse response) {
- try {
- response.setStatus(200);
- response.flushBuffer();
- } catch (IOException ioe) {
- log.error("Failed to send 200/OK response", ioe);
- }
- }
-
- /**
- * Sends a 403/FORBIDDEN response to a credential validation request
- * providing the given reason as the value of the {@link #X_REASON} header.
- *
- * @param response The response object
- * @param reason The reason to set on the header; not expected to be
- * <code>null</code>
- */
- private void sendInvalid(final HttpServletResponse response,
- final FormReason reason) {
- try {
- response.setStatus(HttpServletResponse.SC_FORBIDDEN);
- response.setHeader(X_REASON, reason.toString());
- response.flushBuffer();
- } catch (IOException ioe) {
- log.error("Failed to send 403/Forbidden response", ioe);
- }
- }
-
- /**
* Ensures the authentication data is set (if not set yet) and the expiry
* time is prolonged (if auth data already existed).
* <p>
@@ -666,8 +577,11 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// make sure, that the request is redirected after successful
// authentication, otherwise the request may be processed
// as a POST request to the j_security_check page (unless
- // the j_validate parameter is set)
- setLoginResourceAttribute(request, request.getContextPath());
+ // the j_validate parameter is set); but only if this is not
+ // a validation request
+ if (!isValidateRequest(request)) {
+ setLoginResourceAttribute(request, request.getContextPath());
+ }
}
}
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 15/26: SLING-1783 Make the use
of the j_reason request attribute to inform about failures for
authentication official
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 1e178f565475fc64a4f3d0f45deec246fc5de36a
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Fri Sep 17 12:55:49 2010 +0000
SLING-1783 Make the use of the j_reason request attribute to inform about failures for authentication official
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@998105 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/AuthenticationFormServlet.java | 5 ++--
.../auth/form/impl/FormAuthenticationHandler.java | 33 ++++++++--------------
2 files changed, 15 insertions(+), 23 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java b/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java
index bc86a16..c6def05 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java
@@ -26,6 +26,7 @@ import org.apache.felix.scr.annotations.Properties;
import org.apache.felix.scr.annotations.Property;
import org.apache.felix.scr.annotations.Service;
import org.apache.sling.auth.core.spi.AbstractAuthenticationFormServlet;
+import org.apache.sling.auth.core.spi.AuthenticationHandler;
import org.apache.sling.auth.form.FormReason;
/**
@@ -65,12 +66,12 @@ public class AuthenticationFormServlet extends AbstractAuthenticationFormServlet
*/
protected String getReason(final HttpServletRequest request) {
// return the resource attribute if set to a non-empty string
- Object resObj = request.getAttribute(FormAuthenticationHandler.PAR_J_REASON);
+ Object resObj = request.getAttribute(AuthenticationHandler.FAILURE_REASON);
if (resObj instanceof FormReason) {
return ((FormReason) resObj).toString();
}
- final String reason = request.getParameter(FormAuthenticationHandler.PAR_J_REASON);
+ final String reason = request.getParameter(AuthenticationHandler.FAILURE_REASON);
if (reason != null) {
try {
return FormReason.valueOf(reason).toString();
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 8865eab..4415c33 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -241,15 +241,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final String PAR_J_VALIDATE = "j_validate";
/**
- * The name of the request parameter indicating to the login form why the
- * form is being rendered. If this parameter is not set the form is called
- * for the first time and the implied reason is that the authenticator just
- * requests credentials. Otherwise the parameter is set to a
- * {@link FormReason} value.
- */
- static final String PAR_J_REASON = "j_reason";
-
- /**
* Key in the AuthenticationInfo map which contains the domain on which the
* auth cookie should be set.
*/
@@ -333,7 +324,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
} else {
if (this.loginAfterExpire) {
// signal the requestCredentials method a previous login failure
- request.setAttribute(PAR_J_REASON, FormReason.TIMEOUT);
+ request.setAttribute(FAILURE_REASON, FormReason.TIMEOUT);
info = AuthenticationInfo.FAIL_AUTH;
}
// clear the cookie, its invalid and we should get rid of it so that the invalid cookie
@@ -421,13 +412,13 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
// append indication of previous login failure
- if (request.getAttribute(PAR_J_REASON) != null) {
- final Object jReason = request.getAttribute(PAR_J_REASON);
+ if (request.getAttribute(FAILURE_REASON) != null) {
+ final Object jReason = request.getAttribute(FAILURE_REASON);
@SuppressWarnings("unchecked")
final String reason = (jReason instanceof Enum)
? ((Enum) jReason).name()
: jReason.toString();
- targetBuilder.append(parSep).append(PAR_J_REASON);
+ targetBuilder.append(parSep).append(FAILURE_REASON);
targetBuilder.append("=").append(URLEncoder.encode(reason, "UTF-8"));
}
@@ -470,7 +461,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
authStorage.clear(request, response);
// signal the requestCredentials method a previous login failure
- request.setAttribute(PAR_J_REASON, FormReason.INVALID_CREDENTIALS);
+ request.setAttribute(FAILURE_REASON, FormReason.INVALID_CREDENTIALS);
}
/**
@@ -1003,23 +994,23 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
final StringBuilder header = new StringBuilder();
// default setup with name, value, cookie path and HttpOnly
- header.append(name).append('=').append(value);
- header.append(";Path=").append(cookiePath);
- header.append(";HttpOnly"); // don't allow JS access
+ header.append(name).append("=\"").append(value).append('"');
+ header.append("; Path=\"").append(cookiePath).append('"');
+ header.append("; HttpOnly"); // don't allow JS access
// set the cookie domain if so configured
if (domain != null) {
- header.append(";Domain=").append(domain);
+ header.append("; Domain=\"").append(domain).append('"');
}
// Only set the Max-Age attribute to remove the cookie
- if (age == 0) {
- header.append(";Max-Age=").append(age);
+ if (age >= 0) {
+ header.append("; Max-Age=\"").append(age).append('"');
}
// ensure the cookie is secured if this is an https request
if (request.isSecure()) {
- header.append(";Secure");
+ header.append("; Secure");
}
response.addHeader(HEADER_SET_COOKIE, header.toString());
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 14/26: SLING-1762 Add the
HttpOnly attribute to setting the authentication cookie to make sure the
cookie is not available to client side JavaScript. Also,
when extracting the authentication data from the cookie ignore empty values.
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit bfe05c2895d9b9376ba4f46795305ab74b9c47e7
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Sep 13 14:07:31 2010 +0000
SLING-1762 Add the HttpOnly attribute to setting the authentication cookie to make sure the cookie is not available to client side JavaScript. Also, when extracting the authentication data from the cookie ignore empty values.
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@996543 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 60 +++++++++++++++++-----
1 file changed, 46 insertions(+), 14 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 7f8a5ca..8865eab 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -891,6 +891,15 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
* {@link CookieAuthData} in an HTTP Cookie.
*/
private static class CookieStorage implements AuthenticationStorage {
+
+ /**
+ * The Set-Cookie header used to manage the login cookie.
+ *
+ * @see CookieStorage#setCookie(HttpServletRequest, HttpServletResponse,
+ * String, String, int, String)
+ */
+ private static final String HEADER_SET_COOKIE = "Set-Cookie";
+
private final String cookieName;
private final String domainCookieName;
private final String defaultCookieDomain;
@@ -907,15 +916,15 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
for (Cookie cookie : cookies) {
if (this.cookieName.equals(cookie.getName())) {
// found the cookie, so try to extract the credentials
- // from it
+ // from it and reverse the base64 encoding
String value = cookie.getValue();
-
- // reverse the base64 encoding
- try {
- return new String(Base64.decodeBase64(value),
- "UTF-8");
- } catch (UnsupportedEncodingException e1) {
- throw new RuntimeException(e1);
+ if (value.length() > 0) {
+ try {
+ return new String(Base64.decodeBase64(value),
+ "UTF-8");
+ } catch (UnsupportedEncodingException e1) {
+ throw new RuntimeException(e1);
+ }
}
}
}
@@ -983,14 +992,37 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
? "/"
: ctxPath;
- Cookie cookie = new Cookie(name, value);
+ /*
+ * The Servlet Spec 2.5 does not allow us to set the commonly used
+ * HttpOnly attribute on cookies (Servlet API 3.0 does) so we create
+ * the Set-Cookie header manually. See
+ * http://www.owasp.org/index.php/HttpOnly for information on what
+ * the HttpOnly attribute is used for.
+ */
+
+ final StringBuilder header = new StringBuilder();
+
+ // default setup with name, value, cookie path and HttpOnly
+ header.append(name).append('=').append(value);
+ header.append(";Path=").append(cookiePath);
+ header.append(";HttpOnly"); // don't allow JS access
+
+ // set the cookie domain if so configured
if (domain != null) {
- cookie.setDomain(domain);
+ header.append(";Domain=").append(domain);
+ }
+
+ // Only set the Max-Age attribute to remove the cookie
+ if (age == 0) {
+ header.append(";Max-Age=").append(age);
}
- cookie.setMaxAge(age);
- cookie.setPath(cookiePath);
- cookie.setSecure(request.isSecure());
- response.addCookie(cookie);
+
+ // ensure the cookie is secured if this is an https request
+ if (request.isSecure()) {
+ header.append(";Secure");
+ }
+
+ response.addHeader(HEADER_SET_COOKIE, header.toString());
}
}
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 03/26: SLING-1695 - set the
cookie domain either by a config admin property or using a key within the
AuthenticationInfo object
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 11448fa07bd7a7685fee2843aa24b1c24fbc5c77
Author: Justin Edelson <ju...@apache.org>
AuthorDate: Thu Aug 26 12:59:57 2010 +0000
SLING-1695 - set the cookie domain either by a config admin property or using a key within the AuthenticationInfo object
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@989652 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 63 ++++++++++++++++------
.../OSGI-INF/metatype/metatype.properties | 5 ++
2 files changed, 52 insertions(+), 16 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 4322234..b34fa86 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -163,7 +163,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*
* @scr.property type="Boolean" valueRef="DEFAULT_INCLUDE_FORM"
*/
- public static final String PAR_INCLUDE_FORM = "form.use.include";
+ private static final String PAR_INCLUDE_FORM = "form.use.include";
/**
* The default include value.
@@ -172,7 +172,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
private static final boolean DEFAULT_INCLUDE_FORM = false;
-
/**
* Whether to present a login form when a users cookie expires, the default
* is not to present the form.
@@ -189,6 +188,13 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final boolean DEFAULT_LOGIN_AFTER_EXPIRE = false;
/**
+ * The default domain on which to see the auth cookie (if cookie storage is used)
+ *
+ * @scr.property
+ */
+ private static final String PAR_DEFAULT_COOKIE_DOMAIN = "form.default.cookie.domain";
+
+ /**
* The request method required for user name and password submission by the
* form (value is "POST").
*/
@@ -248,6 +254,12 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final String PAR_SERVICE_RANKING = Constants.SERVICE_RANKING;
/**
+ * Key in the AuthenticationInfo map which contains the domain on which the
+ * auth cookie should be set.
+ */
+ private static final String COOKIE_DOMAIN = "cookie.domain";
+
+ /**
* The factor to convert minute numbers into milliseconds used internally
*/
private static final long MINUTES = 60L * 1000L;
@@ -302,7 +314,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
private boolean loginAfterExpire;
-
/**
* Extracts cookie/session based credentials from the request. Returns
* <code>null</code> if the handler assumes HTTP Basic authentication would
@@ -615,7 +626,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
if (authData != null) {
- authStorage.set(request, response, authData);
+ authStorage.set(request, response, authData, authInfo);
} else {
authStorage.clear(request, response);
}
@@ -725,6 +736,10 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
final String authName = OsgiUtil.toString(
properties.get(PAR_AUTH_NAME), DEFAULT_AUTH_NAME);
+
+ final String defaultCookieDomain = OsgiUtil.toString(
+ properties.get(PAR_DEFAULT_COOKIE_DOMAIN), null);
+
final String authStorage = OsgiUtil.toString(
properties.get(PAR_AUTH_STORAGE), DEFAULT_AUTH_STORAGE);
if (AUTH_STORAGE_SESSION_ATTRIBUTE.equals(authStorage)) {
@@ -735,7 +750,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
} else {
- this.authStorage = new CookieStorage(authName);
+ this.authStorage = new CookieStorage(authName, defaultCookieDomain);
log.info("Using Cookie store with name {}", authName);
}
@@ -772,7 +787,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
this.includeLoginForm = OsgiUtil.toBoolean(properties.get(PAR_INCLUDE_FORM), DEFAULT_INCLUDE_FORM);
this.loginAfterExpire = OsgiUtil.toBoolean(properties.get(PAR_LOGIN_AFTER_EXPIRE), DEFAULT_LOGIN_AFTER_EXPIRE);
-
}
protected void deactivate(
@@ -872,7 +886,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
String extractAuthenticationInfo(HttpServletRequest request);
void set(HttpServletRequest request, HttpServletResponse response,
- String authData);
+ String authData, AuthenticationInfo info);
void clear(HttpServletRequest request, HttpServletResponse response);
}
@@ -883,9 +897,13 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
private static class CookieStorage implements AuthenticationStorage {
private final String cookieName;
+ private final String domainCookieName;
+ private final String defaultCookieDomain;
- public CookieStorage(final String cookieName) {
+ public CookieStorage(final String cookieName, final String defaultCookieDomain) {
this.cookieName = cookieName;
+ this.domainCookieName = cookieName + "." + COOKIE_DOMAIN;
+ this.defaultCookieDomain = defaultCookieDomain;
}
public String extractAuthenticationInfo(HttpServletRequest request) {
@@ -912,7 +930,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
public void set(HttpServletRequest request,
- HttpServletResponse response, String authData) {
+ HttpServletResponse response, String authData, AuthenticationInfo info) {
// base64 encode to handle any special characters
String cookieValue;
try {
@@ -922,39 +940,52 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
// send the cookie to the response
- setCookie(request, response, cookieValue, -1);
+ String cookieDomain = (String) info.get(COOKIE_DOMAIN);
+ if (cookieDomain == null) {
+ cookieDomain = defaultCookieDomain;
+ }
+ setCookie(request, response, this.cookieName, cookieValue, -1, cookieDomain);
+ setCookie(request, response, this.domainCookieName, cookieDomain, -1, cookieDomain);
}
public void clear(HttpServletRequest request,
HttpServletResponse response) {
Cookie oldCookie = null;
+ String oldCookieDomain = null;
Cookie[] cookies = request.getCookies();
if (cookies != null) {
for (Cookie cookie : cookies) {
if (this.cookieName.equals(cookie.getName())) {
// found the cookie
oldCookie = cookie;
- break;
+ } else if (this.domainCookieName.equals(cookie.getName())) {
+ oldCookieDomain = cookie.getValue();
}
}
}
// remove the old cookie from the client
if (oldCookie != null) {
- setCookie(request, response, "", 0);
+ setCookie(request, response, this.cookieName, "", 0, oldCookieDomain);
+ if (oldCookieDomain != null) {
+ setCookie(request, response, this.domainCookieName, "", 0, oldCookieDomain);
+ }
}
}
private void setCookie(final HttpServletRequest request,
- final HttpServletResponse response, final String value,
- final int age) {
+ final HttpServletResponse response, final String name,
+ final String value, final int age, final String domain) {
final String ctxPath = request.getContextPath();
final String cookiePath = (ctxPath == null || ctxPath.length() == 0)
? "/"
: ctxPath;
- Cookie cookie = new Cookie(this.cookieName, value);
+ Cookie cookie = new Cookie(name, value);
+ if (domain != null) {
+ cookie.setDomain(domain);
+ }
cookie.setMaxAge(age);
cookie.setPath(cookiePath);
cookie.setSecure(request.isSecure());
@@ -985,7 +1016,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
public void set(HttpServletRequest request,
- HttpServletResponse response, String authData) {
+ HttpServletResponse response, String authData, AuthenticationInfo info) {
// store the auth hash as a session attribute
HttpSession session = request.getSession();
session.setAttribute(sessionAttributeName, authData);
diff --git a/src/main/resources/OSGI-INF/metatype/metatype.properties b/src/main/resources/OSGI-INF/metatype/metatype.properties
index 686bd82..5aa2bd7 100644
--- a/src/main/resources/OSGI-INF/metatype/metatype.properties
+++ b/src/main/resources/OSGI-INF/metatype/metatype.properties
@@ -79,4 +79,9 @@ form.onexpire.login.name = On Login Expire, Re-login
form.onexpire.login.description = If true, when the form login expires the user \
will be prompted to re-login. If false they become an anonymous user. The default \
is false.
+
+form.default.cookie.domain.name = Default Cookie Domain
+form.default.cookie.domain.description = The domain on which authentication cookies will \
+ be set, unless overridden in the AuthenticationInfo object. The default is null \
+ which means to set the cookie on the request domain.
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 08/26: SLING-1729 Provide a
simple and faster alternative to the default SecureRandom seeding. This
might be of interest mostly for the Linux and Solaris platforms which seed
SecureRandom from the blocking /dev/random by default.
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 18d11b71141c7c8a4098e18b26bc2ac50b2b549c
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Sep 6 11:59:13 2010 +0000
SLING-1729 Provide a simple and faster alternative to the default SecureRandom seeding. This might be of interest mostly for the Linux and Solaris platforms which seed SecureRandom from the blocking /dev/random by default.
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@993004 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 17 +++++-
.../apache/sling/auth/form/impl/TokenStore.java | 71 ++++++++++++++++++++--
.../OSGI-INF/metatype/metatype.properties | 7 +++
3 files changed, 90 insertions(+), 5 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index e59975c..57b7ce3 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -153,6 +153,19 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
@Property(value = DEFAULT_TOKEN_FILE)
private static final String PAR_TOKEN_FILE = "form.token.file";
+ private static final boolean DEFAULT_TOKEN_FAST_SEED = false;
+
+ /**
+ * Whether to use a less secure but faster seeding mechanism to seed the
+ * random number generator in the {@link TokenStore}. By default the faster
+ * mechanism is disabled and the platform provided seeding is used. This may
+ * however block the startup considerably, particularly on Linux and Solaris
+ * platforms which use the (blocking but secure) <code>/dev/random</code>
+ * device for seeding.
+ */
+ @Property(boolValue = DEFAULT_TOKEN_FAST_SEED)
+ private static final String PAR_TOKEN_FAST_SEED = "form.token.fastseed";
+
/**
* The default include value.
*
@@ -758,8 +771,10 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
properties.get(PAR_TOKEN_FILE), DEFAULT_TOKEN_FILE);
final File tokenFile = getTokenFile(tokenFileName,
componentContext.getBundleContext());
+ final boolean fastSeed = OsgiUtil.toBoolean(
+ properties.get(PAR_TOKEN_FAST_SEED), DEFAULT_TOKEN_FAST_SEED);
log.info("Storing tokens in {}", tokenFile.getAbsolutePath());
- this.tokenStore = new TokenStore(tokenFile, sessionTimeout);
+ this.tokenStore = new TokenStore(tokenFile, sessionTimeout, fastSeed);
this.loginModule = null;
try {
diff --git a/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java b/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
index 31a3977..d79e686 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/TokenStore.java
@@ -25,9 +25,9 @@ import java.io.FileOutputStream;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
+import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
-
import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
@@ -109,9 +109,10 @@ class TokenStore {
* @throws NullPointerException if <code>tokenFile</code> is
* <code>null</code>.
*/
- TokenStore(final File tokenFile, final long sessionTimeout)
- throws NoSuchAlgorithmException, InvalidKeyException,
- IllegalStateException, UnsupportedEncodingException {
+ TokenStore(final File tokenFile, final long sessionTimeout,
+ final boolean fastSeed) throws NoSuchAlgorithmException,
+ InvalidKeyException, IllegalStateException,
+ UnsupportedEncodingException {
if (tokenFile == null) {
throw new NullPointerException("tokenfile");
@@ -126,6 +127,9 @@ class TokenStore {
loadTokens();
// warm up the crypto API
+ if (fastSeed) {
+ random.setSeed(getFastEntropy());
+ }
byte[] b = new byte[20];
random.nextBytes(b);
final SecretKey secretKey = new SecretKeySpec(b, HMAC_SHA1);
@@ -377,4 +381,63 @@ class TokenStore {
}
return new String(c);
}
+
+ /**
+ * Creates a byte array of entry from the current state of the system:
+ * <ul>
+ * <li>The current system time in milliseconds since the epoch</li>
+ * <li>The number of nanoseconds since system startup</li>
+ * <li>The name, size and last modification time of the files in the
+ * <code>java.io.tmpdir</code> folder.</li>
+ * </ul>
+ * <p>
+ * <b>NOTE</b> This method generates entropy fast but not necessairily
+ * secure enough for seeding the random number generator.
+ *
+ * @return bytes of entropy
+ */
+ private static byte[] getFastEntropy() {
+ final MessageDigest md;
+
+ try {
+ md = MessageDigest.getInstance("SHA");
+ } catch (NoSuchAlgorithmException nsae) {
+ throw new InternalError("internal error: SHA-1 not available.");
+ }
+
+ // update with XorShifted time values
+ update(md, System.currentTimeMillis());
+ update(md, System.nanoTime());
+
+ // scan the temp file system
+ File file = new File(System.getProperty("java.io.tmpdir"));
+ File[] entries = file.listFiles();
+ if (entries != null) {
+ for (File entry : entries) {
+ md.update(entry.getName().getBytes());
+ update(md, entry.lastModified());
+ update(md, entry.length());
+ }
+ }
+
+ return md.digest();
+ }
+
+ /**
+ * Updates the message digest with an XOR-Shifted value.
+ *
+ * @param md The MessageDigest to update
+ * @param value The original value to be XOR-Shifted first before taking the
+ * bytes ot update the message digest
+ */
+ private static void update(final MessageDigest md, long value) {
+ value ^= (value << 21);
+ value ^= (value >>> 35);
+ value ^= (value << 4);
+
+ for (int i = 0; i < 8; i++) {
+ md.update((byte) value);
+ value >>= 8;
+ }
+ }
}
\ No newline at end of file
diff --git a/src/main/resources/OSGI-INF/metatype/metatype.properties b/src/main/resources/OSGI-INF/metatype/metatype.properties
index 5aa2bd7..2d92666 100644
--- a/src/main/resources/OSGI-INF/metatype/metatype.properties
+++ b/src/main/resources/OSGI-INF/metatype/metatype.properties
@@ -67,6 +67,13 @@ form.token.file.description = The name of the file used to persist the \
working directory. In the future this file may be store in the JCR Repository \
to support clustering scenarios.
+form.token.fastseed.name = Fast Seed Generator
+form.token.fastseed.description = Defines whether the random number generator \
+ should be seeded with a fast but less secure method. If this property is not \
+ set or is set to "false" the seed generator of the Java platform will be \
+ used. By default the secure seed generator is used, which may block startup \
+ on Linux and Solaris systems due to accessing /dev/random.
+
service.ranking.name = Ranking
service.ranking.description = The relative ranking of this service.
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 02/26: Use previous Auth Core
SNAPSHOT until after release
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit f045f34e5a2d03f2876dfa72e845228f2b9bb99b
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Aug 23 16:27:40 2010 +0000
Use previous Auth Core SNAPSHOT until after release
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@988186 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 7682691..fb71cbe 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@
<dependency>
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.auth.core</artifactId>
- <version>1.0.0</version>
+ <version>0.9.0-SNAPSHOT</version>
<scope>provided</scope>
</dependency>
<dependency>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 04/26: SLING-1714 Convert @scr
JavaDoc tags to SCR annotations
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit aee24d01192abd69092d1e4b55dc4ec4817a43fa
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Wed Sep 1 13:17:14 2010 +0000
SLING-1714 Convert @scr JavaDoc tags to SCR annotations
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@991526 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 6 ++
.../auth/form/impl/AuthenticationFormServlet.java | 22 +++--
.../auth/form/impl/FormAuthenticationHandler.java | 110 ++++++++++-----------
3 files changed, 68 insertions(+), 70 deletions(-)
diff --git a/pom.xml b/pom.xml
index fb71cbe..62ea825 100644
--- a/pom.xml
+++ b/pom.xml
@@ -164,5 +164,11 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-simple</artifactId>
</dependency>
+ <dependency>
+ <groupId>org.apache.felix</groupId>
+ <artifactId>org.apache.felix.scr.annotations</artifactId>
+ <version>1.3.0</version>
+ <scope>provided</scope>
+ </dependency>
</dependencies>
</project>
diff --git a/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java b/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java
index 2a38ff6..bc86a16 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/AuthenticationFormServlet.java
@@ -18,37 +18,39 @@
*/
package org.apache.sling.auth.form.impl;
+import javax.servlet.Servlet;
import javax.servlet.http.HttpServletRequest;
+import org.apache.felix.scr.annotations.Component;
+import org.apache.felix.scr.annotations.Properties;
+import org.apache.felix.scr.annotations.Property;
+import org.apache.felix.scr.annotations.Service;
import org.apache.sling.auth.core.spi.AbstractAuthenticationFormServlet;
import org.apache.sling.auth.form.FormReason;
/**
* The <code>AuthenticationFormServlet</code> provides the default login form
* used for Form Based Authentication.
- *
- * @scr.component metatype="no"
- * @scr.property name="service.vendor" value="The Apache Software Foundation"
- * @scr.property name="service.description"
- * value="Default Login Form for Form Based Authentication"
- * @scr.service interface="javax.servlet.Servlet"
*/
+@Component
+@Properties( {
+ @Property(name = "service.vendor", value = "The Apache Software Foundation"),
+ @Property(name = "service.description", value = "Default Login Form for Form Based Authentication") })
+@Service(value = Servlet.class)
@SuppressWarnings("serial")
public class AuthenticationFormServlet extends AbstractAuthenticationFormServlet {
/**
* The constant is used to provide the service registration path
- *
- * @scr.property name="sling.servlet.paths"
*/
+ @Property(name = "sling.servlet.paths")
static final String SERVLET_PATH = "/system/sling/form/login";
/**
* This constant is used to provide the service registration property
* indicating to pass requests to this servlet unauthenticated.
- *
- * @scr.property name="sling.auth.requirements"
*/
+ @Property(name = "sling.auth.requirements")
@SuppressWarnings("unused")
private static final String AUTH_REQUIREMENT = "-" + SERVLET_PATH;
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index b34fa86..388b2db 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -37,12 +37,21 @@ import javax.servlet.http.HttpSession;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang.StringUtils;
+import org.apache.felix.scr.annotations.Component;
+import org.apache.felix.scr.annotations.Properties;
+import org.apache.felix.scr.annotations.Property;
+import org.apache.felix.scr.annotations.PropertyOption;
+import org.apache.felix.scr.annotations.Reference;
+import org.apache.felix.scr.annotations.ReferenceCardinality;
+import org.apache.felix.scr.annotations.ReferencePolicy;
+import org.apache.felix.scr.annotations.Service;
import org.apache.sling.api.auth.Authenticator;
import org.apache.sling.api.resource.LoginException;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.ResourceResolverFactory;
import org.apache.sling.auth.core.spi.AbstractAuthenticationHandler;
+import org.apache.sling.auth.core.spi.AuthenticationHandler;
import org.apache.sling.auth.core.spi.AuthenticationInfo;
import org.apache.sling.auth.core.spi.DefaultAuthenticationFeedbackHandler;
import org.apache.sling.auth.form.FormReason;
@@ -57,38 +66,23 @@ import org.slf4j.LoggerFactory;
/**
* The <code>FormAuthenticationHandler</code> class implements the authorization
* steps based on a cookie.
- *
- * @scr.component immediate="false" label="%auth.form.name"
- * description="%auth.form.description"
- * name="org.apache.sling.auth.form.FormAuthenticationHandler"
- * @scr.property name="service.description"
- * value="Apache Sling Form Based Authentication Handler"
- * @scr.property name="service.vendor" value="The Apache Software Foundation"
- * @scr.property nameRef=
- * "org.apache.sling.auth.core.spi.AuthenticationHandler.PATH_PROPERTY"
- * values.0="/"
- * @scr.property nameRef=
- * "org.apache.sling.auth.core.spi.AuthenticationHandler.TYPE_PROPERTY"
- * valueRef="javax.servlet.http.HttpServletRequest.FORM_AUTH"
- * private="true"
- * @scr.service
*/
+@Component(label = "%auth.form.name", description = "%auth.form.description", name = "org.apache.sling.auth.form.FormAuthenticationHandler")
+@Properties( {
+ @Property(name = Constants.SERVICE_DESCRIPTION, value = "Apache Sling Form Based Authentication Handler"),
+ @Property(name = Constants.SERVICE_VENDOR, value = "The Apache Software Foundation"),
+ @Property(name = AuthenticationHandler.PATH_PROPERTY, value = "/", cardinality = 100),
+ @Property(name = AuthenticationHandler.TYPE_PROPERTY, value = HttpServletRequest.FORM_AUTH, propertyPrivate = true) })
+@Service
public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
/**
* The name of the parameter providing the login form URL.
- *
- * @scr.property valueRef="AuthenticationFormServlet.SERVLET_PATH"
*/
+ @Property(value=AuthenticationFormServlet.SERVLET_PATH)
private static final String PAR_LOGIN_FORM = "form.login.form";
/**
- * @scr.property valueRef="DEFAULT_AUTH_STORAGE" options "cookie"="Cookie"
- * "session"="Session Attribute"
- */
- private static final String PAR_AUTH_STORAGE = "form.auth.storage";
-
- /**
* The value of the {@link #PAR_AUTH_STORAGE} parameter indicating the use
* of a Cookie to store the authentication data.
*/
@@ -106,13 +100,10 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
private static final String DEFAULT_AUTH_STORAGE = AUTH_STORAGE_COOKIE;
- /**
- * The name of the configuration parameter providing the Cookie or session
- * attribute name.
- *
- * @scr.property valueRef="DEFAULT_AUTH_NAME"
- */
- private static final String PAR_AUTH_NAME = "form.auth.name";
+ @Property(value = DEFAULT_AUTH_STORAGE, options = {
+ @PropertyOption(name = AUTH_STORAGE_COOKIE, value = "Cookie"),
+ @PropertyOption(name = AUTH_STORAGE_SESSION_ATTRIBUTE, value = "Session Attribute") })
+ private static final String PAR_AUTH_STORAGE = "form.auth.storage";
/**
* The default Cookie or session attribute name
@@ -122,12 +113,11 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final String DEFAULT_AUTH_NAME = "sling.formauth";
/**
- * This is the name of the SimpleCredentials attribute that holds the auth
- * info extracted from the cookie value.
- *
- * @scr.property valueRef="DEFAULT_CREDENTIALS_ATTRIBUTE_NAME"
+ * The name of the configuration parameter providing the Cookie or session
+ * attribute name.
*/
- private static final String PAR_CREDENTIALS_ATTRIBUTE_NAME = "form.credentials.name";
+ @Property(value = DEFAULT_AUTH_NAME)
+ private static final String PAR_AUTH_NAME = "form.auth.name";
/**
* Default value for the {@link #PAR_CREDENTIALS_ATTRIBUTE_NAME} property
@@ -135,12 +125,11 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final String DEFAULT_CREDENTIALS_ATTRIBUTE_NAME = DEFAULT_AUTH_NAME;
/**
- * The number of minutes after which a login session times out. This value
- * is used as the expiry time set in the authentication data.
- *
- * @scr.property type="Integer" valueRef="DEFAULT_AUTH_TIMEOUT"
+ * This is the name of the SimpleCredentials attribute that holds the auth
+ * info extracted from the cookie value.
*/
- public static final String PAR_AUTH_TIMEOUT = "form.auth.timeout";
+ @Property(value = DEFAULT_CREDENTIALS_ATTRIBUTE_NAME)
+ private static final String PAR_CREDENTIALS_ATTRIBUTE_NAME = "form.credentials.name";
/**
* The default authentication data time out value.
@@ -150,20 +139,19 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final int DEFAULT_AUTH_TIMEOUT = 30;
/**
- * The name of the file used to persist the security tokens
- *
- * @scr.property valueRef="DEFAULT_TOKEN_FILE"
+ * The number of minutes after which a login session times out. This value
+ * is used as the expiry time set in the authentication data.
*/
- private static final String PAR_TOKEN_FILE = "form.token.file";
+ @Property(intValue = DEFAULT_AUTH_TIMEOUT)
+ public static final String PAR_AUTH_TIMEOUT = "form.auth.timeout";
private static final String DEFAULT_TOKEN_FILE = "cookie-tokens.bin";
/**
- * Whether to redirect to the login form or simple do an include.
- *
- * @scr.property type="Boolean" valueRef="DEFAULT_INCLUDE_FORM"
+ * The name of the file used to persist the security tokens
*/
- private static final String PAR_INCLUDE_FORM = "form.use.include";
+ @Property(value = DEFAULT_TOKEN_FILE)
+ private static final String PAR_TOKEN_FILE = "form.token.file";
/**
* The default include value.
@@ -173,12 +161,10 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final boolean DEFAULT_INCLUDE_FORM = false;
/**
- * Whether to present a login form when a users cookie expires, the default
- * is not to present the form.
- *
- * @scr.property type="Boolean" valueRef="DEFAULT_LOGIN_AFTER_EXPIRE"
+ * Whether to redirect to the login form or simple do an include.
*/
- private static final String PAR_LOGIN_AFTER_EXPIRE = "form.onexpire.login";
+ @Property(boolValue = DEFAULT_INCLUDE_FORM)
+ public static final String PAR_INCLUDE_FORM = "form.use.include";
/**
* The default login after expire of a cookie.
@@ -188,10 +174,16 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
private static final boolean DEFAULT_LOGIN_AFTER_EXPIRE = false;
/**
+ * Whether to present a login form when a users cookie expires, the default
+ * is not to present the form.
+ */
+ @Property(boolValue = DEFAULT_LOGIN_AFTER_EXPIRE)
+ private static final String PAR_LOGIN_AFTER_EXPIRE = "form.onexpire.login";
+
+ /**
* The default domain on which to see the auth cookie (if cookie storage is used)
- *
- * @scr.property
*/
+ @Property
private static final String PAR_DEFAULT_COOKIE_DOMAIN = "form.default.cookie.domain";
/**
@@ -247,9 +239,8 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
/**
* The service ranking property.
- *
- * @scr.property type="Integer" value="0" private="false"
*/
+ @Property(intValue = 0, propertyPrivate = false)
@SuppressWarnings("unused")
private static final String PAR_SERVICE_RANKING = Constants.SERVICE_RANKING;
@@ -304,9 +295,8 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
/**
* The resource resolver factory used to resolve the login form as a resource
- *
- * @scr.reference policy="dynamic" cardinality="0..1"
*/
+ @Reference(policy = ReferencePolicy.DYNAMIC, cardinality = ReferenceCardinality.OPTIONAL_UNARY)
private ResourceResolverFactory resourceResolverFactory;
/**
@@ -739,7 +729,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
final String defaultCookieDomain = OsgiUtil.toString(
properties.get(PAR_DEFAULT_COOKIE_DOMAIN), null);
-
+
final String authStorage = OsgiUtil.toString(
properties.get(PAR_AUTH_STORAGE), DEFAULT_AUTH_STORAGE);
if (AUTH_STORAGE_SESSION_ATTRIBUTE.equals(authStorage)) {
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 05/26: SLING-1714 Metatype
descriptor generation is not enabled by default for annotations
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit acc1f6be2a25a663c98fbb4926bb74f553a424b6
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Wed Sep 1 14:21:15 2010 +0000
SLING-1714 Metatype descriptor generation is not enabled by default for annotations
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@991549 13f79535-47bb-0310-9956-ffa450edef68
---
.../java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 388b2db..861be54 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -67,7 +67,7 @@ import org.slf4j.LoggerFactory;
* The <code>FormAuthenticationHandler</code> class implements the authorization
* steps based on a cookie.
*/
-@Component(label = "%auth.form.name", description = "%auth.form.description", name = "org.apache.sling.auth.form.FormAuthenticationHandler")
+@Component(label = "%auth.form.name", description = "%auth.form.description", metatype = true, name = "org.apache.sling.auth.form.FormAuthenticationHandler")
@Properties( {
@Property(name = Constants.SERVICE_DESCRIPTION, value = "Apache Sling Form Based Authentication Handler"),
@Property(name = Constants.SERVICE_VENDOR, value = "The Apache Software Foundation"),
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 24/26: Prepare releases
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit ef7843d5ae893fef01fc4adf5dcafd3ff9734f75
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Wed Dec 15 15:49:05 2010 +0000
Prepare releases
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1049600 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 4a454cb..7dc359c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@
<dependency>
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.auth.core</artifactId>
- <version>1.0.3-SNAPSHOT</version>
+ <version>1.0.4</version>
<scope>provided</scope>
</dependency>
<dependency>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 21/26: SLING-1869 - upgrading to
latest SCR plugin and putting scr.annotations in parent
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 8972039edb09aacc88bd1b4b744d70f28725af8f
Author: Justin Edelson <ju...@apache.org>
AuthorDate: Wed Nov 10 14:36:52 2010 +0000
SLING-1869 - upgrading to latest SCR plugin and putting scr.annotations in parent
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1033493 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 --
1 file changed, 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index 3937d31..6eea1f7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -166,8 +166,6 @@
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.scr.annotations</artifactId>
- <version>1.3.0</version>
- <scope>provided</scope>
</dependency>
</dependencies>
</project>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 06/26: SLING-1722 Do not embed
StringUtils class but import the Commons Lang package
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 2574aa67682b5c34a07150ea9f4ac2ef022b7a63
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Thu Sep 2 09:54:02 2010 +0000
SLING-1722 Do not embed StringUtils class but import the Commons Lang package
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@991877 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 1 -
1 file changed, 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 62ea825..7fef591 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,7 +78,6 @@
</Import-Package>
<Embed-Dependency>
org.apache.sling.commons.osgi;inline="org/apache/sling/commons/osgi/OsgiUtil.*",
- commons-lang;inline="org/apache/commons/lang/StringUtils.class",
commons-codec;inline="org/apache/commons/codec/binary/Base64.*
|org/apache/commons/codec/binary/Hex*
|org/apache/commons/codec/binary/StringUtils*
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 20/26: updating all modules to
parent 10-SNAPSHOT in anticipation of emma additions to parent
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 64b8cf567853d2e14a8e87a9c51cb553066fd38d
Author: Justin Edelson <ju...@apache.org>
AuthorDate: Wed Oct 13 20:54:21 2010 +0000
updating all modules to parent 10-SNAPSHOT in anticipation of emma additions to parent
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1022288 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 34ae84d..3937d31 100644
--- a/pom.xml
+++ b/pom.xml
@@ -21,7 +21,7 @@
<parent>
<groupId>org.apache.sling</groupId>
<artifactId>sling</artifactId>
- <version>9</version>
+ <version>10-SNAPSHOT</version>
<relativePath>../../../parent/pom.xml</relativePath>
</parent>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 18/26: SLING-1428 Reimplement
full j_validate functionality: Send a 403 response if either the provided
cookie value is invalid or if the provided user name and password cannot be
used to login. Created methods to actually send back the success or failure
responses for validation requests.
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit e4d4eff5caac01256945b675c6d880233127c201
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Thu Sep 23 13:33:27 2010 +0000
SLING-1428 Reimplement full j_validate functionality: Send a 403 response if either the provided cookie value is invalid or if the provided user name and password cannot be used to login. Created methods to actually send back the success or failure responses for validation requests.
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1000462 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 92 ++++++++++++++++------
1 file changed, 67 insertions(+), 25 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index dab932e..f5a47f7 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -252,6 +252,18 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
*/
private static final long MINUTES = 60L * 1000L;
+ /**
+ * The name of the request header set by
+ * {@link #authenticationFailed(HttpServletRequest, HttpServletResponse, AuthenticationInfo)}
+ * if instead of requesting credentials from the client a 403/FORBIDDEN response is sent.
+ * <p>
+ * This header may be inspected by clients for a reason why the request
+ * failed.
+ *
+ * @see #authenticationFailed(HttpServletRequest, HttpServletResponse, AuthenticationInfo)
+ */
+ private static final String X_REASON = "X-Reason";
+
/** default log */
private final Logger log = LoggerFactory.getLogger(getClass());
@@ -323,14 +335,20 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
if (tokenStore.isValid(authData)) {
info = createAuthInfo(authData);
} else {
+ // clear the cookie, its invalid and we should get rid of it
+ // so that the invalid cookie isn't present on the authN
+ // operation.
+ authStorage.clear(request, response);
if (this.loginAfterExpire) {
- // signal the requestCredentials method a previous login failure
+ // signal the requestCredentials method a previous login
+ // failure
request.setAttribute(FAILURE_REASON, FormReason.TIMEOUT);
info = AuthenticationInfo.FAIL_AUTH;
+ } else if (isValidateRequest(request)) {
+ // send 403 response and terminate the request
+ sendInvalid(response, FormReason.TIMEOUT);
+ info = AuthenticationInfo.DOING_AUTH;
}
- // clear the cookie, its invalid and we should get rid of it so that the invalid cookie
- // isn't present on the authN operation.
- authStorage.clear(request, response);
}
}
}
@@ -358,19 +376,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
return false;
}
- // 1. check whether we short cut for a failed log in with validation
- if (isValidateRequest(request)) {
- try {
- response.setStatus(403);
- response.flushBuffer();
- } catch (IOException ioe) {
- log.error("Failed to send 403/FORBIDDEN response", ioe);
- }
-
- // consider credentials requested
- return true;
- }
-
final String resource = setLoginResourceAttribute(request,
request.getRequestURI());
@@ -446,8 +451,17 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// clear authentication data from Cookie or Http Session
authStorage.clear(request, response);
- // signal the requestCredentials method a previous login failure
- request.setAttribute(FAILURE_REASON, FormReason.INVALID_CREDENTIALS);
+ if (isValidateRequest(request)) {
+
+ // just validated the credentials to be invalid
+ sendInvalid(response, FormReason.INVALID_CREDENTIALS);
+
+ } else {
+
+ // signal the requestCredentials method a previous login failure
+ request.setAttribute(FAILURE_REASON, FormReason.INVALID_CREDENTIALS);
+
+ }
}
/**
@@ -477,12 +491,7 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
final boolean result;
if (isValidateRequest(request)) {
- try {
- response.setStatus(200);
- response.flushBuffer();
- } catch (IOException ioe) {
- log.error("Failed to send 200/OK response", ioe);
- }
+ sendValid(response);
// terminate request, all done
result = true;
@@ -558,6 +567,39 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
}
/**
+ * Sends a 200/OK response to a credential validation request.
+ *
+ * @param response The response object
+ */
+ private void sendValid(final HttpServletResponse response) {
+ try {
+ response.setStatus(200);
+ response.flushBuffer();
+ } catch (IOException ioe) {
+ log.error("Failed to send 200/OK response", ioe);
+ }
+ }
+
+ /**
+ * Sends a 403/FORBIDDEN response to a credential validation request
+ * providing the given reason as the value of the {@link #X_REASON} header.
+ *
+ * @param response The response object
+ * @param reason The reason to set on the header; not expected to be
+ * <code>null</code>
+ */
+ private void sendInvalid(final HttpServletResponse response,
+ final FormReason reason) {
+ try {
+ response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+ response.setHeader(X_REASON, reason.toString());
+ response.flushBuffer();
+ } catch (IOException ioe) {
+ log.error("Failed to send 403/Forbidden response", ioe);
+ }
+ }
+
+ /**
* Ensures the authentication data is set (if not set yet) and the expiry
* time is prolonged (if auth data already existed).
* <p>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 25/26: [maven-release-plugin]
prepare release org.apache.sling.auth.form-1.0.2
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 17bfd16ce03a61a9917df68f807dd1ad686f7cb4
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Wed Dec 15 15:52:25 2010 +0000
[maven-release-plugin] prepare release org.apache.sling.auth.form-1.0.2
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1049609 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pom.xml b/pom.xml
index 7dc359c..21779bb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@
</parent>
<artifactId>org.apache.sling.auth.form</artifactId>
- <version>1.0.1-SNAPSHOT</version>
+ <version>1.0.2</version>
<packaging>bundle</packaging>
<name>Apache Sling Form Based Authentication Handler</name>
@@ -43,9 +43,9 @@
</properties>
<scm>
- <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form</connection>
- <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form</developerConnection>
- <url>http://svn.apache.org/viewvc/sling/trunk/bundles/auth/form</url>
+ <connection>scm:svn:http://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.form-1.0.2</connection>
+ <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.form-1.0.2</developerConnection>
+ <url>http://svn.apache.org/viewvc/sling/tags/org.apache.sling.auth.form-1.0.2</url>
</scm>
<build>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 13/26: Revert changes from
commit 996477 which are not intended to go into that commit (relative to
handling auth failures for XHR requests and handling the cookie)
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit e633f47e78d1109838b2df8c669ca2bb84f5766f
Author: Felix Meschberger <fm...@apache.org>
AuthorDate: Mon Sep 13 12:12:34 2010 +0000
Revert changes from commit 996477 which are not intended to go into that commit (relative to handling auth failures for XHR requests and handling the cookie)
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@996509 13f79535-47bb-0310-9956-ffa450edef68
---
.../auth/form/impl/FormAuthenticationHandler.java | 68 ++++------------------
1 file changed, 10 insertions(+), 58 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
index 0557d6f..7f8a5ca 100644
--- a/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
+++ b/src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java
@@ -330,26 +330,13 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
if (authData != null) {
if (tokenStore.isValid(authData)) {
info = createAuthInfo(authData);
- } else if ("XMLHttpRequest".equals(request.getHeader("X-Requested-With"))) {
- // signal to AJAX the request is forbidden
- try {
- response.sendError(
- HttpServletResponse.SC_REQUEST_TIMEOUT,
- "Session Timeout, please login");
- response.flushBuffer();
- } catch (IOException ioe) {
- // TODO: log !!
- }
- return AuthenticationInfo.DOING_AUTH;
} else {
if (this.loginAfterExpire) {
- // signal the requestCredentials method a previous login
- // failure
+ // signal the requestCredentials method a previous login failure
request.setAttribute(PAR_J_REASON, FormReason.TIMEOUT);
info = AuthenticationInfo.FAIL_AUTH;
}
- // clear the cookie, its invalid and we should get rid of it
- // so that the invalid cookie
+ // clear the cookie, its invalid and we should get rid of it so that the invalid cookie
// isn't present on the authN operation.
authStorage.clear(request, response);
}
@@ -904,15 +891,6 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
* {@link CookieAuthData} in an HTTP Cookie.
*/
private static class CookieStorage implements AuthenticationStorage {
-
- /**
- * The Set-Cookie header used to manage the login cookie.
- *
- * @see CookieStorage#setCookie(HttpServletRequest, HttpServletResponse,
- * String, String, int, String)
- */
- private static final String HEADER_SET_COOKIE = "Set-Cookie";
-
private final String cookieName;
private final String domainCookieName;
private final String defaultCookieDomain;
@@ -934,11 +912,8 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
// reverse the base64 encoding
try {
- String result = new String(
- Base64.decodeBase64(value), "UTF-8");
- if (result.length() > 0) {
- return result;
- }
+ return new String(Base64.decodeBase64(value),
+ "UTF-8");
} catch (UnsupportedEncodingException e1) {
throw new RuntimeException(e1);
}
@@ -1008,37 +983,14 @@ public class FormAuthenticationHandler extends AbstractAuthenticationHandler {
? "/"
: ctxPath;
- /*
- * The Servlet Spec 2.5 does not allow us to set the commonly used
- * HttpOnly attribute on cookies (Servlet API 3.0 does) so we create
- * the Set-Cookie header manually. See
- * http://www.owasp.org/index.php/HttpOnly for information on what
- * the HttpOnly attribute is used for.
- */
-
- final StringBuilder header = new StringBuilder();
-
- // default setup with name, value, cookie path and HttpOnly
- header.append(name).append('=').append(value);
- header.append(";Path=").append(cookiePath);
- header.append(";HttpOnly"); // don't allow JS access
-
- // set the cookie domain if so configured
+ Cookie cookie = new Cookie(name, value);
if (domain != null) {
- header.append(";Domain=").append(domain);
- }
-
- // Only set the Max-Age attribute to remove the cookie
- if (age == 0) {
- header.append(";Max-Age=").append(age);
+ cookie.setDomain(domain);
}
-
- // ensure the cookie is secured if this is an https request
- if (request.isSecure()) {
- header.append(";Secure");
- }
-
- response.addHeader(HEADER_SET_COOKIE, header.toString());
+ cookie.setMaxAge(age);
+ cookie.setPath(cookiePath);
+ cookie.setSecure(request.isSecure());
+ response.addCookie(cookie);
}
}
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.
[sling-org-apache-sling-auth-form] 23/26: Use latest releases.
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to annotated tag org.apache.sling.auth.form-1.0.2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-form.git
commit 09f89ed914d9960ce322f868c72a22cecc968788
Author: Carsten Ziegeler <cz...@apache.org>
AuthorDate: Mon Dec 13 08:55:35 2010 +0000
Use latest releases.
git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/form@1045037 13f79535-47bb-0310-9956-ffa450edef68
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index c87160c..4a454cb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -21,7 +21,7 @@
<parent>
<groupId>org.apache.sling</groupId>
<artifactId>sling</artifactId>
- <version>11-SNAPSHOT</version>
+ <version>10</version>
<relativePath>../../../parent/pom.xml</relativePath>
</parent>
--
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.