JACC.java

package org.objectweb.jonas.security.realm.web.catalina50;

import java.io.IOException;
import java.security.Principal;
import java.security.cert.X509Certificate;
import java.util.ArrayList;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.catalina.Context;
import org.apache.catalina.HttpRequest;
import org.apache.catalina.HttpResponse;
import org.apache.catalina.LifecycleException;
import org.apache.catalina.deploy.LoginConfig;
import org.apache.catalina.deploy.SecurityConstraint;
import org.apache.catalina.realm.Constants;
import org.apache.catalina.realm.GenericPrincipal;
import org.apache.catalina.realm.RealmBase;
import org.apache.catalina.util.StringManager;

import org.objectweb.jonas.common.Log;
import org.objectweb.jonas.security.SecurityService;
import org.objectweb.jonas.security.realm.factory.JResource;
import org.objectweb.jonas.security.realm.factory.JResourceException;
import org.objectweb.jonas.security.realm.principals.User;
import org.objectweb.jonas.service.ServiceManager;
import org.objectweb.jonas.web.lib.PermissionManager;

import org.objectweb.security.context.SecurityContext;
import org.objectweb.security.context.SecurityCurrent;

import org.objectweb.util.monolog.api.BasicLevel;
import org.objectweb.util.monolog.api.Logger;

public class JACC extends RealmBase implements Cloneable {

    private static final String NAME = "JRealmJACCCatalina50";

    private static final String INFO = "org.objectweb.jonas.security.realm.JRealmJACCCatalina50/1.0";

    private static StringManager sm = StringManager.getManager(Constants.Package);

    private static Logger logger = null;

    private JResource jResource = null;

    private String resourceName = null;

    private SecurityService securityService = null;

    private PermissionManager permissionManager = null;

    private HttpRequest lastHttpRequest = null;

    private Context context = null;

    public String getInfo() {
        return INFO;
    }

    public String getResourceName() {
        return resourceName;
    }

    public void setResourceName(String resourceName) {
        this.resourceName = resourceName;

    }

    public void setPermissionManager(PermissionManager permissionManager) {
        this.permissionManager = permissionManager;

    }

    public SecurityConstraint[] findSecurityConstraints(HttpRequest request, Context context) {
        // Use super Method
        return super.findSecurityConstraints(request, context);
    }

    public boolean hasResourcePermission(HttpRequest request, HttpResponse response, SecurityConstraint[] constraints,
            Context context) throws IOException {

        // Update request
        lastHttpRequest = request;

        // --- Use code of RealmBase for the Login / Error pages

        // Specifically allow access to the form login and form error pages
        // and the "j_security_check" action
        LoginConfig config = context.getLoginConfig();
        if (config != null && Constants.FORM_METHOD.equals(config.getAuthMethod())) {
            String requestURI = request.getDecodedRequestURI();
            String loginPage = context.getPath() + config.getLoginPage();
            if (loginPage.equals(requestURI)) {
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Allow access to login page " + loginPage);
                }
                return true;
            }

            String errorPage = context.getPath() + config.getErrorPage();
            if (errorPage.equals(requestURI)) {
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Allow access to error page " + errorPage);
                }
                return true;
            }
            if (requestURI.endsWith(Constants.FORM_ACTION)) {
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Allow access to username/password submission");
                }
                return true;
            }
        }

        // Which user principal have we already authenticated?
        Principal principal = ((HttpServletRequest) request.getRequest()).getUserPrincipal();

        // --- End of code from RealmBase class

        String[] roles = null;
        String principalName = null;
        if (principal instanceof GenericPrincipal) {
            roles = ((GenericPrincipal) principal).getRoles();
            principalName = principal.getName();
        }

        boolean hasResourcePermission = permissionManager.checkWebResourcePermission((HttpServletRequest) request,
                principalName, roles);

        // Need to send HTTP status code as invoke() method of Authenticator
        // expect that it is
        // done by the realm.
        if (!hasResourcePermission) {
            // Return a "Forbidden" message denying access to this resource
            ((HttpServletResponse) response.getResponse()).sendError(HttpServletResponse.SC_FORBIDDEN, sm
                    .getString("realmBase.forbidden"));
        }

        return hasResourcePermission;
    }

    public boolean hasRole(Principal principal, String role) {

        if ((principal == null) || (role == null) || !(principal instanceof GenericPrincipal)) {
            return false;
        }

        if (logger.isLoggable(BasicLevel.DEBUG)) {
            logger.log(BasicLevel.DEBUG, "Principal = " + principal);
            logger.log(BasicLevel.DEBUG, "Role = " + role);
        }

        if (context == null) {
            logger.log(BasicLevel.ERROR, "Cannot find a servlet name for isUserInRole() as no context was found");
            return false;
        }

        if (lastHttpRequest == null) {
            logger.log(BasicLevel.ERROR, "Cannot find a servlet name for isUserInRole(). No previous request !");
            return false;
        }
        HttpServletRequest httpServletRequest = (HttpServletRequest) lastHttpRequest.getRequest();
        String servletName = findServletName(httpServletRequest);
        String[] roles = null;
        String principalName = null;

        if (principal instanceof GenericPrincipal) {
            roles = ((GenericPrincipal) principal).getRoles();
            principalName = principal.getName();
        }

        boolean hasRole = permissionManager.checkWebRoleRefPermission(httpServletRequest, servletName, principalName, roles, role);
        return hasRole;
    }

    private String findServletName(HttpServletRequest httpServletRequest) {

        // Pattern of the user (remove path)
        String userPattern = httpServletRequest.getRequestURI().substring(httpServletRequest.getContextPath().length());

        if (logger.isLoggable(BasicLevel.DEBUG)) {
            logger.log(BasicLevel.DEBUG, "User Pattern = " + userPattern);
        }

        String servletName = "";
        String[] patterns = context.findServletMappings();
        boolean foundServlet = false;
        String pattern = "";
        int i = 0;

        // Try to search servlet name
        while ((i < patterns.length) && !foundServlet) {
            pattern = patterns[i];
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Pattern found = " + pattern);
                logger.log(BasicLevel.DEBUG, "Servlet name for pattern = " + context.findServletMapping(pattern));
            }

            // Extension pattern and ends with extension
            if (pattern.startsWith("*.") && userPattern.endsWith(pattern.substring(1))) {
                foundServlet = true;
                continue;
            }

            // Exact Servlet name (ie pattern = /ServletName and userPattern =
            // /ServletName)
            if (pattern.equals(userPattern)) {
                foundServlet = true;
                continue;
            }

            i++;
        }

        if (foundServlet) {
            servletName = context.findServletMapping(pattern);
            // JSP case. servlet name must be empty as required by JACC
            // specification
            if (servletName.equals("jsp")) {
                servletName = "";
            }
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Found servlet name = " + servletName);
            }
        }
        return servletName;
    }

    public boolean hasUserDataPermission(HttpRequest request, HttpResponse response, SecurityConstraint[] constraints)
            throws IOException {

        // Update request
        lastHttpRequest = request;

        // ---- Start of copy from RealmBase class ---

        // Validate the request against the user data constraint
        if (request.getRequest().isSecure()) {
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "User data constraint already satisfied");
            }
            return true;
        }

        // Which user principal have we already authenticated?
        Principal principal = ((HttpServletRequest) request).getUserPrincipal();

        // ---- End of copy from RealmBase class ---

        String[] roles = null;
        String principalName = null;
        if (principal instanceof GenericPrincipal) {
            roles = ((GenericPrincipal) principal).getRoles();
            principalName = principal.getName();
        }

        // ---- Start of copy from RealmBase class ---
        for (int i = 0; i < constraints.length; i++) {
            SecurityConstraint constraint = constraints[i];
            // Use redirect only if it the transport protocol is integral or
            // confidential
            String userConstraint = constraint.getUserConstraint();

            // Redirect only if the constraint is INTEGRAL or CONFIDENTIAL !
            if (userConstraint != null
                    && (userConstraint.equals(Constants.INTEGRAL_TRANSPORT) || userConstraint
                            .equals(Constants.CONFIDENTIAL_TRANSPORT))) {
                // Initialize variables we need to determine the appropriate
                // action
                HttpServletRequest hrequest = (HttpServletRequest) request.getRequest();
                HttpServletResponse hresponse = (HttpServletResponse) response.getResponse();
                int redirectPort = request.getConnector().getRedirectPort();

                // Is redirecting disabled?
                if (redirectPort <= 0) {
                    if (logger.isLoggable(BasicLevel.DEBUG)) {
                        logger.log(BasicLevel.DEBUG, "SSL redirect is disabled");
                    }
                    hresponse.sendError(HttpServletResponse.SC_FORBIDDEN, hrequest.getRequestURI());
                    return false;
                }

                // Redirect to the corresponding SSL port
                StringBuffer file = new StringBuffer();
                String protocol = "https";
                String host = hrequest.getServerName();
                // Protocol
                file.append(protocol).append("://");
                // Host with port
                file.append(host).append(":").append(redirectPort);
                // URI
                file.append(hrequest.getRequestURI());
                String requestedSessionId = hrequest.getRequestedSessionId();
                if ((requestedSessionId != null) && hrequest.isRequestedSessionIdFromURL()) {
                    file.append(";jsessionid=");
                    file.append(requestedSessionId);
                }
                String queryString = hrequest.getQueryString();
                if (queryString != null) {
                    file.append('?');
                    file.append(queryString);
                }

                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Redirecting to " + file.toString());
                }
                hresponse.sendRedirect(file.toString());

                return false;
            }
        }

        // ---- End of copy from RealmBase ---

        // If Transport protocol is NONE :
        boolean hasUserDataPermission = permissionManager.checkWebUserDataPermission((HttpServletRequest) request,
                principalName,
                roles);
        return hasUserDataPermission;

    }

    public Principal authenticate(String username, String credentials) {

        // No authentication can be made with a null username
        if (username == null) {
            logger.log(BasicLevel.DEBUG, "No username so no authentication");
            return null;
        }

        // Does a user with this username exist?
        User user = null;
        try {
            user = jResource.findUser(username);
        } catch (Exception jre) {
            // could not retrieve user
            logger.log(BasicLevel.ERROR, "Can not find the user : " + jre.getMessage());
            return null;
        }

        // User was not found
        if (user == null) {
            logger.log(BasicLevel.DEBUG, "User " + username + " not found.");
            return null;
        }

        boolean validated = jResource.isValidUser(user, credentials);
        if (!validated) {
            logger.log(BasicLevel.ERROR, "The password for the user " + username + " is not valid");
            return null;
        }

        ArrayList combinedRoles = null;
        try {
            combinedRoles = jResource.getArrayListCombinedRoles(user);
        } catch (JResourceException jre) {
            logger.log(BasicLevel.ERROR, jre.getMessage());
            return null;
        }

        GenericPrincipal principal = new GenericPrincipal(this, user.getName(), user.getPassword(), combinedRoles);
        SecurityContext ctx = new SecurityContext(principal.getName(), combinedRoles);
        SecurityCurrent current = SecurityCurrent.getCurrent();
        current.setSecurityContext(ctx);

        return principal;
    }

    public Principal authenticate(X509Certificate[] cert) {
        String dn = cert[0].getSubjectDN().getName();
        return authenticate(dn, "tomcat");
    }

    protected String getName() {
        return NAME;
    }

    protected String getPassword(String username) {
        return null;
    }

    protected Principal getPrincipal(String username) {
        return null;
    }

    public void setContext(Context context) {
        this.context = context;
    }

    public synchronized void start() throws LifecycleException {

        if (logger == null) {
            logger = Log.getLogger(Log.JONAS_SECURITY_PREFIX);
        }

        // Get the Security Service
        try {
            securityService = (SecurityService) ServiceManager.getInstance().getSecurityService();
        } catch (Exception e) {
            // Can't retrieve Security service
            throw new LifecycleException("can't retrieve Security service");
        }

        // Get the resource from the security service
        jResource = securityService.getJResource(resourceName);
        if (jResource == null) {
            throw new LifecycleException("Can't retrieve resource '" + resourceName + "' from the security service");
        }

        // Perform normal superclass initialization
        super.start();

    }

    public synchronized void stop() throws LifecycleException {
        // Perform normal superclass finalization
        super.stop();

        // Release reference to our resource
        jResource = null;
    }

    protected void log(String message) {
        logger.log(BasicLevel.DEBUG, message);
    }

    public Object clone() throws CloneNotSupportedException {
        JACC jRealm = new JACC();
        jRealm.setResourceName(resourceName);
        jRealm.setDebug(debug);
        return jRealm;
    }

}

---