001: /*
002: * Copyright 2003-2006 Rick Knowles <winstone-devel at lists sourceforge net>
003: * Distributed under the terms of either:
004: * - the common development and distribution license (CDDL), v1.0; or
005: * - the GNU Lesser General Public License, v2.1 or later
006: */
007: package winstone.auth;
008:
009: import java.io.IOException;
010: import java.security.cert.X509Certificate;
011: import java.util.List;
012: import java.util.Set;
013:
014: import javax.servlet.http.HttpServletRequest;
015: import javax.servlet.http.HttpServletRequestWrapper;
016: import javax.servlet.http.HttpServletResponse;
017:
018: import org.w3c.dom.Node;
019:
020: import winstone.AuthenticationPrincipal;
021: import winstone.AuthenticationRealm;
022: import winstone.Logger;
023: import winstone.WinstoneRequest;
024:
025: /**
026: * @author <a href="mailto:rick_knowles@hotmail.com">Rick Knowles</a>
027: * @version $Id: ClientcertAuthenticationHandler.java,v 1.3 2006/02/28 07:32:47 rickknowles Exp $
028: */
029: public class ClientcertAuthenticationHandler extends
030: BaseAuthenticationHandler {
031: public ClientcertAuthenticationHandler(Node loginConfigNode,
032: List constraintNodes, Set rolesAllowed,
033: AuthenticationRealm realm) {
034: super (loginConfigNode, constraintNodes, rolesAllowed, realm);
035: Logger.log(Logger.DEBUG, AUTH_RESOURCES,
036: "ClientcertAuthenticationHandler.Initialised",
037: realmName);
038: }
039:
040: /**
041: * Call this once we know that we need to authenticate
042: */
043: protected void requestAuthentication(HttpServletRequest request,
044: HttpServletResponse response, String pathRequested)
045: throws IOException {
046: // Return unauthorized, and set the realm name
047: response
048: .sendError(
049: HttpServletResponse.SC_UNAUTHORIZED,
050: AUTH_RESOURCES
051: .getString("ClientcertAuthenticationHandler.UnauthorizedMessage"));
052: }
053:
054: /**
055: * Handling the (possible) response
056: */
057: protected boolean validatePossibleAuthenticationResponse(
058: HttpServletRequest request, HttpServletResponse response,
059: String pathRequested) throws IOException {
060: // Check for certificates in the request attributes
061: X509Certificate certificateArray[] = (X509Certificate[]) request
062: .getAttribute("javax.servlet.request.X509Certificate");
063: if ((certificateArray != null) && (certificateArray.length > 0)) {
064: boolean failed = false;
065: for (int n = 0; n < certificateArray.length; n++)
066: try {
067: certificateArray[n].checkValidity();
068: } catch (Throwable err) {
069: failed = true;
070: }
071: if (!failed) {
072: AuthenticationPrincipal principal = this .realm
073: .retrieveUser(certificateArray[0]
074: .getSubjectDN().getName());
075: if (principal != null) {
076: principal
077: .setAuthType(HttpServletRequest.CLIENT_CERT_AUTH);
078: if (request instanceof WinstoneRequest)
079: ((WinstoneRequest) request)
080: .setRemoteUser(principal);
081: else if (request instanceof HttpServletRequestWrapper) {
082: HttpServletRequestWrapper wrapper = (HttpServletRequestWrapper) request;
083: if (wrapper.getRequest() instanceof WinstoneRequest)
084: ((WinstoneRequest) wrapper.getRequest())
085: .setRemoteUser(principal);
086: else
087: Logger
088: .log(
089: Logger.WARNING,
090: AUTH_RESOURCES,
091: "ClientCertAuthenticationHandler.CantSetUser",
092: wrapper.getRequest()
093: .getClass()
094: .getName());
095: } else
096: Logger
097: .log(
098: Logger.WARNING,
099: AUTH_RESOURCES,
100: "ClientCertAuthenticationHandler.CantSetUser",
101: request.getClass().getName());
102: }
103: }
104: }
105: return true;
106: }
107: }
|