JAAS.java

package org.objectweb.jonas.security.realm.web.catalina50;

import java.security.Principal;
import java.security.acl.Group;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Iterator;

import javax.security.auth.Subject;
import javax.security.auth.login.AccountExpiredException;
import javax.security.auth.login.CredentialExpiredException;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;

import org.objectweb.util.monolog.api.BasicLevel;
import org.objectweb.util.monolog.api.Logger;

import org.objectweb.jonas.common.Log;
import org.objectweb.jonas.security.auth.callback.NoInputCallbackHandler;

import org.apache.catalina.LifecycleException;
import org.apache.catalina.realm.GenericPrincipal;
import org.apache.catalina.realm.RealmBase;

import org.objectweb.security.context.SecurityContext;
import org.objectweb.security.context.SecurityCurrent;


public class JAAS extends RealmBase {

    private static final String NAME = "JRealmJAASCatalina50";

    private static final String INFO = "org.objectweb.jonas.security.realm.JRealmJAASCatalina50/1.0";

    private static final String JAAS_CONFIG_NAME = "tomcat";

    private static Logger logger = null;

    private X509Certificate cert = null;


    public String getInfo() {
        return INFO;
    }

    public Principal authenticate(X509Certificate[] cert) {
        String headerCertificate = "##DN##";
        //concat the header certificate and replace the caracters
        String dn = headerCertificate.concat(cert[0].getSubjectDN().getName().replace('=', '#').replace(',', '%').replace(' ', '$'));
        this.cert = cert[0];
        return authenticate(dn, "");
    }

    public Principal authenticate(String username, String credentials) {

        // No authentication can be made with a null username
        if (username == null) {
            log("No username so no authentication");
            return null;
        }
        // Establish a LoginContext to use for authentication
        LoginContext loginContext = null;
        try {
            loginContext = new LoginContext(JAAS_CONFIG_NAME, new NoInputCallbackHandler(username, credentials, this.cert));
        } catch (LoginException e) {
            logger.log(BasicLevel.ERROR, "loginException for user :" + username);
            return null;
        }
        // Negotiate a login via this LoginContext
        Subject subject = null;
        try {
            loginContext.login();
            subject = loginContext.getSubject();
            if (subject == null) {
                if (logger.isLoggable(BasicLevel.ERROR)) {
                    logger.log(BasicLevel.ERROR, "failedLoginlogin for user :" + username);
                }
                return null;
            }
        } catch (AccountExpiredException e) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, "accountExpired for user :" + username);
            }
            return null;
        } catch (CredentialExpiredException e) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, "credentialExpired for user :" + username);
            }
            return null;
        } catch (FailedLoginException e) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, "failedLogin for user :" + username);
            }
            return null;
        } catch (LoginException e) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, "loginException for user :" + username);
            }
            return null;
        }

        // Get credentials iterators from the subject
        Iterator credentialsIterator = subject.getPrivateCredentials().iterator();
        String credential = (String) credentialsIterator.next();

        // Retrieve first principal name found (without groups)
        Iterator iterator = subject.getPrincipals(Principal.class).iterator();
        String userName = null;
        while (iterator.hasNext() && (userName == null)) {
            Principal principal = (Principal) iterator.next();
            if (!(principal instanceof Group)) {
               userName = principal.getName();
            }
        }

        // No name --> error
        if (userName == null) {
            logger.log(BasicLevel.ERROR, "No Username found in the subject");
            return null;
        }

        // Retrieve all roles of the user (Roles are members of the Group.class)
        iterator = subject.getPrincipals(Group.class).iterator();
        ArrayList roles = new ArrayList();
        while (iterator.hasNext()) {
            Group group = (Group) iterator.next();
            Enumeration e = group.members();
            while (e.hasMoreElements()) {
                Principal p = (Principal) e.nextElement();
                roles.add(p.getName());
            }
        }

        GenericPrincipal principal = new GenericPrincipal(this, userName, credential, roles);
        //instanciation of the security context
        SecurityContext ctx = new SecurityContext(userName, roles);
        SecurityCurrent current = SecurityCurrent.getCurrent();
        current.setSecurityContext(ctx);

        return principal;
    }


    protected String getName() {
        return NAME;
    }


    protected String getPassword(String username) {
        return null;
    }


    protected Principal getPrincipal(String username) {
        return null;
    }


    public synchronized void start() throws LifecycleException {

        if (logger == null) {
            logger = Log.getLogger(Log.JONAS_SECURITY_PREFIX);
        }

        // Perform normal superclass initialization
        super.start();

    }


    public synchronized void stop() throws LifecycleException {
        // Perform normal superclass finalization
        super.stop();
   }


    protected void log(String message) {
        logger.log(BasicLevel.DEBUG, message);
    }


}

---