01: package ru.emdev.EmForge.security;
02:
03: import java.io.IOException;
04:
05: import javax.security.auth.callback.Callback;
06: import javax.security.auth.callback.CallbackHandler;
07: import javax.security.auth.callback.UnsupportedCallbackException;
08:
09: import org.acegisecurity.Authentication;
10: import org.acegisecurity.AuthenticationException;
11: import org.acegisecurity.AuthenticationManager;
12: import org.acegisecurity.context.SecurityContextHolder;
13: import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
14: import org.apache.commons.logging.Log;
15: import org.apache.commons.logging.LogFactory;
16: import org.apache.ws.security.WSPasswordCallback;
17:
18: public class WsCallbackHandler implements CallbackHandler {
19: private final Log log = LogFactory.getLog(getClass());
20:
21: private AuthenticationManager authenticationManager;
22:
23: public void setAuthenticationManager(
24: AuthenticationManager i_authenticationManager) {
25: authenticationManager = i_authenticationManager;
26: }
27:
28: public void handle(Callback[] i_callbacks) throws IOException,
29: UnsupportedCallbackException {
30: log.debug("we\'re in the callback handler");
31:
32: WSPasswordCallback pc = (WSPasswordCallback) i_callbacks[0];
33:
34: if (pc.getUsage() == WSPasswordCallback.USERNAME_TOKEN) {
35:
36: // @TODO: password is sent in digest mode. we'll have to code this to pull the clear password from the
37: // database to compare it at this end using the following. Until then, we'll just need to set the
38: // password to something generic
39:
40: /* to be implemented later:
41:
42: * String plainText = connector.getPassword(pc.getIdentifer());
43:
44: *** this will throw an error if the incoming password
45: doesn't match what we found:
46:
47: * pc.setPassword(plainText);
48:
49: */
50:
51: /** interim code - set generic password */
52:
53: pc.setPassword(""/** !!! PLAIN_TEXT */
54: );
55:
56: } else if (pc.getUsage() == WSPasswordCallback.USERNAME_TOKEN_UNKNOWN) {
57: // performs Authentication
58: try {
59: Authentication authentication = new UsernamePasswordAuthenticationToken(
60: pc.getIdentifer(), pc.getPassword());
61: authentication = authenticationManager
62: .authenticate(authentication);
63: SecurityContextHolder.getContext().setAuthentication(
64: authentication);
65: } catch (AuthenticationException ex) {
66: throw new IOException("password incorrect for user: "
67: + pc.getIdentifer());
68: }
69:
70: log.debug("user logged in via web-service: "
71: + pc.getIdentifer());
72: pc.setPassword(pc.getPassword());
73:
74: } else {
75: throw new UnsupportedCallbackException(i_callbacks[0],
76: "Unrecognized Callback");
77: }
78: }
79: }
|