001: /*
002: * JBoss, Home of Professional Open Source.
003: * Copyright 2006, Red Hat Middleware LLC, and individual contributors
004: * as indicated by the @author tags. See the copyright.txt file in the
005: * distribution for a full listing of individual contributors.
006: *
007: * This is free software; you can redistribute it and/or modify it
008: * under the terms of the GNU Lesser General Public License as
009: * published by the Free Software Foundation; either version 2.1 of
010: * the License, or (at your option) any later version.
011: *
012: * This software is distributed in the hope that it will be useful,
013: * but WITHOUT ANY WARRANTY; without even the implied warranty of
014: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
015: * Lesser General Public License for more details.
016: *
017: * You should have received a copy of the GNU Lesser General Public
018: * License along with this software; if not, write to the Free
019: * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
020: * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
021: */
022: package org.jboss.jmx.connector.invoker;
023:
024: import java.security.Principal;
025: import javax.naming.InitialContext;
026: import javax.security.auth.Subject;
027:
028: import org.jboss.mx.server.Invocation;
029: import org.jboss.mx.interceptor.AbstractInterceptor;
030: import org.jboss.mx.interceptor.Interceptor;
031: import org.jboss.security.SubjectSecurityManager;
032:
033: /** A security interceptor that requires an authorized user for invoke(Invocation)
034: * operation calls when the SecurityDomain and SecurityMgr attributes are
035: * specified. Access to attributes and the MBeanInfo are not intercepted.
036: *
037: * @see Interceptor
038: *
039: * @author <a href="mailto:juha@jboss.org">Juha Lindfors</a>.
040: * @author Scott.Stark@jboss.org
041: * @version $Revision: 57209 $
042: *
043: */
044: public final class AuthenticationInterceptor extends
045: AbstractInterceptor {
046: private SubjectSecurityManager securityMgr;
047:
048: public void setSecurityDomain(String securityDomain)
049: throws Exception {
050: try {
051: if (log.isTraceEnabled())
052: log.trace("setSecurityDomain=" + securityDomain);
053: InitialContext ctx = new InitialContext();
054: securityMgr = (SubjectSecurityManager) ctx
055: .lookup(securityDomain);
056: } catch (Exception e) {
057: if (log.isTraceEnabled())
058: log.trace("Ignorable exception in setSecurityDomain=",
059: e);
060: }
061:
062: }
063:
064: /**
065: *
066: * @param invocation
067: * @return
068: * @throws Throwable
069: */
070: public Object invoke(Invocation invocation) throws Throwable {
071: String type = invocation.getType();
072: Subject subject = null;
073: if (type == Invocation.OP_INVOKE && securityMgr != null) {
074: String opName = invocation.getName();
075: if (opName.equals("invoke")) {
076: Object[] args = invocation.getArgs();
077: org.jboss.invocation.Invocation inv = (org.jboss.invocation.Invocation) args[0];
078: // Authenticate the caller based on the security association
079: Principal caller = inv.getPrincipal();
080: Object credential = inv.getCredential();
081: subject = new Subject();
082: boolean isValid = securityMgr.isValid(caller,
083: credential, subject);
084: if (log.isTraceEnabled())
085: log.trace("[Authentication for caller=" + caller
086: + " and subject=" + subject + "]:result="
087: + isValid);
088: if (isValid == false) {
089: String msg = "Failed to authenticate principal="
090: + caller + ", securityDomain="
091: + securityMgr.getSecurityDomain();
092: throw new SecurityException(msg);
093:
094: }
095: // Push the caller security context
096: SecurityActions.pushSubjectContext(caller, credential,
097: subject);
098: }
099: }
100:
101: try {
102: Interceptor i = invocation.nextInterceptor();
103: return i.invoke(invocation);
104: } finally {
105: if (log.isTraceEnabled() && subject != null)
106: log.trace("pop out the subject:" + subject);
107:
108: // Don't leak the security context
109: if (subject != null)
110: SecurityActions.popSubjectContext();
111: }
112: }
113: }
|