001: /*
002: * Copyright (c) 1998-2008 Caucho Technology -- all rights reserved
003: *
004: * This file is part of Resin(R) Open Source
005: *
006: * Each copy or derived work must preserve the copyright notice and this
007: * notice unmodified.
008: *
009: * Resin Open Source is free software; you can redistribute it and/or modify
010: * it under the terms of the GNU General Public License as published by
011: * the Free Software Foundation; either version 2 of the License, or
012: * (at your option) any later version.
013: *
014: * Resin Open Source is distributed in the hope that it will be useful,
015: * but WITHOUT ANY WARRANTY; without even the implied warranty of
016: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE, or any warranty
017: * of NON-INFRINGEMENT. See the GNU General Public License for more
018: * details.
019: *
020: * You should have received a copy of the GNU General Public License
021: * along with Resin Open Source; if not, write to the
022: * Free SoftwareFoundation, Inc.
023: * 59 Temple Place, Suite 330
024: * Boston, MA 02111-1307 USA
025: *
026: * @author Sam
027: */
028:
029: package com.caucho.server.security;
030:
031: import javax.annotation.PostConstruct;
032: import javax.servlet.ServletContext;
033: import javax.servlet.ServletException;
034: import javax.servlet.http.HttpServletRequest;
035: import javax.servlet.http.HttpServletResponse;
036: import javax.servlet.http.HttpSession;
037: import java.security.Principal;
038: import java.util.ArrayList;
039:
040: /**
041: * The AuthenticatorList is used to configure more than one authenticators in a
042: * list, each authenticator is tried in turn and if the authentication fails the
043: * next authenticator in the list is attempted.
044: *
045: * <code><pre>
046: * <authenticator type="com.caucho.server.security.AuthenticatorList">
047: * <init>
048: * <authenticator resin:type="com.caucho.server.security.XmlAuthenticator">
049: * <user>admin:NIHlOSafJN2H7emQCkOQ2w==:user,admin</user>
050: * </authenticator>
051: *
052: * <authenticator resin:type='com.caucho.server.security.JdbcAuthenticator'>
053: * <data-source>jdbc/users</data-source>
054: * <password-query>
055: * SELECT password FROM LOGIN WHERE username=?
056: * </password-query>
057: * <cookie-auth-query>
058: * SELECT username FROM LOGIN WHERE cookie=?
059: * </cookie-auth-query>
060: * <cookie-auth-update>
061: * UPDATE LOGIN SET cookie=? WHERE username=?
062: * </cookie-auth-update>
063: * <role-query>
064: * SELECT role FROM LOGIN WHERE username=?
065: * </role-query>
066: * </authenticator>
067: * </init>
068: * </authenticator>
069: *
070: * <login-config auth-method='basic'/>
071: *
072: * <security-constraint url-pattern='/users/*' role-name='user'/>
073: * <security-constraint url-pattern='/admin/*' role-name='admin'/>
074: *
075: * </pre></code>
076: */
077: public class AuthenticatorList implements ServletAuthenticator {
078: private ArrayList<ServletAuthenticator> _authenticators = new ArrayList<ServletAuthenticator>();
079:
080: /**
081: * Sets the path to the XML file.
082: */
083: public void addAuthenticator(ServletAuthenticator authenticator) {
084: _authenticators.add(authenticator);
085: }
086:
087: @PostConstruct
088: public void init() throws ServletException {
089: }
090:
091: public Principal login(HttpServletRequest request,
092: HttpServletResponse response, ServletContext application,
093: String user, String password) throws ServletException {
094: Principal result = null;
095:
096: for (ServletAuthenticator authenticator : _authenticators) {
097: result = authenticator.login(request, response,
098: application, user, password);
099:
100: if (result != null)
101: break;
102: }
103:
104: return result;
105: }
106:
107: public Principal getUserPrincipal(HttpServletRequest request,
108: HttpServletResponse response, ServletContext application)
109: throws ServletException {
110: Principal result = null;
111:
112: for (ServletAuthenticator authenticator : _authenticators) {
113: result = authenticator.getUserPrincipal(request, response,
114: application);
115:
116: if (result != null)
117: break;
118: }
119:
120: return result;
121: }
122:
123: public Principal loginDigest(HttpServletRequest request,
124: HttpServletResponse response, ServletContext app,
125: String user, String realm, String nonce, String uri,
126: String qop, String nc, String cnonce, byte[] clientDigset)
127: throws ServletException {
128: Principal result = null;
129:
130: for (ServletAuthenticator authenticator : _authenticators) {
131: result = authenticator.loginDigest(request, response, app,
132: user, realm, nonce, uri, qop, nc, cnonce,
133: clientDigset);
134:
135: if (result != null)
136: break;
137: }
138:
139: return result;
140: }
141:
142: public boolean isUserInRole(HttpServletRequest request,
143: HttpServletResponse response, ServletContext application,
144: Principal user, String role) throws ServletException {
145: boolean result = false;
146:
147: for (ServletAuthenticator authenticator : _authenticators) {
148: result = authenticator.isUserInRole(request, response,
149: application, user, role);
150:
151: if (result)
152: break;
153: }
154:
155: return result;
156: }
157:
158: public void logout(ServletContext application,
159: HttpSession timeoutSession, String sessionId, Principal user)
160: throws ServletException {
161: for (ServletAuthenticator authenticator : _authenticators) {
162: authenticator.logout(application, timeoutSession,
163: sessionId, user);
164: }
165: }
166: }
|