Csiv2ClientInterceptor.java

package org.objectweb.jonas.security.iiop;

import java.io.IOException;
import java.io.UnsupportedEncodingException;

import org.omg.CORBA.Any;
import org.omg.CORBA.BAD_PARAM;
import org.omg.CSI.AuthorizationElement;
import org.omg.CSI.EstablishContext;
import org.omg.CSI.GSS_NT_ExportedNameHelper;
import org.omg.CSI.IdentityToken;
import org.omg.CSI.SASContextBody;
import org.omg.CSI.SASContextBodyHelper;
import org.omg.CSIIOP.CompoundSecMech;
import org.omg.CSIIOP.CompoundSecMechList;
import org.omg.CSIIOP.CompoundSecMechListHelper;
import org.omg.CSIIOP.EstablishTrustInClient;
import org.omg.CSIIOP.IdentityAssertion;
import org.omg.CSIIOP.TAG_CSI_SEC_MECH_LIST;
import org.omg.GSSUP.InitialContextToken;
import org.omg.GSSUP.InitialContextTokenHelper;
import org.omg.IOP.Codec;
import org.omg.IOP.SecurityAttributeService;
import org.omg.IOP.ServiceContext;
import org.omg.IOP.TaggedComponent;
import org.omg.IOP.CodecPackage.FormatMismatch;
import org.omg.IOP.CodecPackage.InvalidTypeForEncoding;
import org.omg.IOP.CodecPackage.TypeMismatch;
import org.omg.PortableInterceptor.ClientRequestInfo;
import org.omg.PortableInterceptor.ClientRequestInterceptor;
import org.omg.PortableInterceptor.ForwardRequest;

import org.objectweb.carol.util.csiv2.gss.GSSHelper;

import org.objectweb.util.monolog.api.BasicLevel;
import org.objectweb.util.monolog.api.Logger;

public class Csiv2ClientInterceptor extends org.omg.CORBA.LocalObject implements ClientRequestInterceptor {

    private static final String NAME = "Csiv2ClientInterceptor";

    private Codec codec = null;

    private Logger logger = null;

    private Logger loggerDetails = null;

    public Csiv2ClientInterceptor(Codec codec, Logger logger, Logger loggerDetails) {
        this.codec = codec;
        this.logger = logger;
        this.loggerDetails = loggerDetails;
    }

    public void receive_exception(ClientRequestInfo ri) throws ForwardRequest {

    }

    public void receive_other(ClientRequestInfo ri) throws ForwardRequest {

    }

    public void receive_reply(ClientRequestInfo ri) {

    }

    public void send_poll(ClientRequestInfo ri) {

    }

    public void send_request(ClientRequestInfo ri) throws ForwardRequest {

        // Is there a TAG_CSI_SEC_MECH tagged component in the request ?
        TaggedComponent taggedComponent = null;
        try {
            taggedComponent = ri.get_effective_component(TAG_CSI_SEC_MECH_LIST.value);
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "There is a TAG_CSI_SEC_MECH_LIST tagged component");
            }

        } catch (BAD_PARAM e) {
            if (loggerDetails.isLoggable(BasicLevel.DEBUG)) {
                loggerDetails.log(BasicLevel.DEBUG, "No tagged component with id " + TAG_CSI_SEC_MECH_LIST.value);
            }
            return;

        }

        // Nothing to do if the component is not here
        if (taggedComponent == null) {
            return;
        }


        // Extract infos from the received TaggedComponent
        Any pAny = null;
        try {
            pAny = codec.decode_value(taggedComponent.component_data, CompoundSecMechListHelper.type());
        } catch (FormatMismatch fm) {
            logger.log(BasicLevel.ERROR, "Format mismatch while decoding value :" + fm.getMessage());
            return;
        } catch (TypeMismatch tm) {
            logger.log(BasicLevel.ERROR, "Type mismatch while decoding value :" + tm.getMessage());
            return;
        }

        // TODO : there can have several compound sech mech
        // For now, take first
        CompoundSecMechList compoundSecMechList = CompoundSecMechListHelper.extract(pAny);
        CompoundSecMech compoundSecMech = null;
        if (compoundSecMechList.mechanism_list.length > 0) {
            compoundSecMech = compoundSecMechList.mechanism_list[0];
        } else  {
            // no compound sec mech received !
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "No coumpound sec mech in the list.");
            }
            return;
        }


        long clientContextId = Csiv2Const.STATELESS_CONTEXT_ID;
        AuthorizationElement[] withoutAuthorizationToken = new AuthorizationElement[0];

        IdentityToken identityToken = null;

        // Anonymous
        IdentityToken anonymousIdentityToken = new IdentityToken();
        anonymousIdentityToken.anonymous(true);

        // Absent
        IdentityToken absentIdentityToken = new IdentityToken();
        absentIdentityToken.absent(true);


        byte[] clientAuthenticationToken = Csiv2Const.EMPTY_BYTES;


        // Test what we need to send (depending of the support)
        // see 16-5.2 section

        // Client authentication token
        if ((compoundSecMech.as_context_mech.target_requires & EstablishTrustInClient.value) == EstablishTrustInClient.value) {
            pAny = null;
            try {
                pAny = ORBHelper.getOrb().create_any();
            } catch (Csiv2InterceptorException csie) {
                logger.log(BasicLevel.ERROR, "Cannot get orb for any = " + csie.getMessage());
                return;
            }
            InitialContextToken initialContextToken = null;
            try {
                initialContextToken = SecurityContextHelper.getInstance().getInitialContextToken();
            } catch (UnsupportedEncodingException uee) {
                logger.log(BasicLevel.ERROR, "Unsupported encoding for UTF8" + uee.getMessage());
                return;
            }
            InitialContextTokenHelper.insert(pAny, initialContextToken);
            byte[] contextData = null;

            try {
                contextData = codec.encode_value(pAny);
            } catch (InvalidTypeForEncoding itfe) {
                logger.log(BasicLevel.ERROR, "Cannot encode a given any corba object : " + itfe.getMessage());
                return;
            }

            try {
                clientAuthenticationToken = GSSHelper.encodeToken(contextData);
            } catch (IOException ioe) {
                logger.log(BasicLevel.ERROR, "Cannot encode client authentication token : " + ioe.getMessage());
                return;
            }
        }


        // Identity token case
        if ((compoundSecMech.sas_context_mech.target_supports & IdentityAssertion.value) == IdentityAssertion.value) {
            pAny = null;
            try {
                pAny = ORBHelper.getOrb().create_any();
            } catch (Csiv2InterceptorException csie) {
                logger.log(BasicLevel.ERROR, "Cannot get orb for any = " + csie.getMessage());
                return;
            }


            // Insert username
            String identity = SecurityContextHelper.getInstance().getIdentityToken();
            byte[] name = GSSHelper.encodeExported(identity);
            byte[] principalName = null;
            GSS_NT_ExportedNameHelper.insert(pAny, name);
            try {
                principalName = codec.encode_value(pAny);
            } catch (InvalidTypeForEncoding itfe) {
                logger.log(BasicLevel.ERROR, "Cannot encode a given any corba object : " + itfe.getMessage());
                return;
            }


            // Put name in the token
            identityToken = new IdentityToken();
            identityToken.principal_name(principalName);

        }

        // No identity was set (principal name), so use absent identity
        if (identityToken == null) {
            identityToken = absentIdentityToken;
        }

        // if absent and no client auth token, don't do anything
        if (identityToken == absentIdentityToken && clientAuthenticationToken == Csiv2Const.EMPTY_BYTES) {
            return;
        }


        EstablishContext establishContext = new EstablishContext(clientContextId, withoutAuthorizationToken,
                identityToken, clientAuthenticationToken);





        try {
            pAny = ORBHelper.getOrb().create_any();
        } catch (Csiv2InterceptorException csie) {
            logger.log(BasicLevel.ERROR, "Cannot get orb for any = " + csie.getMessage());
            return;
        }

        // Generate contextData of service context with EstablishContext
        SASContextBody sasContextBody = new SASContextBody();
        sasContextBody.establish_msg(establishContext);
        SASContextBodyHelper.insert(pAny, sasContextBody);
        byte[] contextData = null;

        try {
            contextData = codec.encode_value(pAny);
        } catch (InvalidTypeForEncoding itfe) {
            logger.log(BasicLevel.ERROR, "Cannot encode a given any corba object : " + itfe.getMessage());
            return;
        }

        // build service context and add it
        ServiceContext serviceContext = new ServiceContext(SecurityAttributeService.value, contextData);
        ri.add_request_service_context(serviceContext, Csiv2Const.REPLACE_SECURITY_ATTRIBUTE_SERVICE);

    }

    public void destroy() {
        // TODO Auto-generated method stub

    }

    public String name() {
        return NAME;
    }

}

---