001: /*
002: * Copyright (c) 2005 Kurt Miller <truk@optonline.net>
003: *
004: * Permission to use, copy, modify, and distribute this software for any
005: * purpose with or without fee is hereby granted, provided that the above
006: * copyright notice and this permission notice appear in all copies.
007: *
008: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
009: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
010: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
011: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
012: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
013: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
014: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
015: */
016:
017: /* This file rewritten from a sample implementation of JDBCRealm written by Kurt Miller.
018: *
019: * We configure realm with no digest, then encode it when authenticating
020: * instead of decoding database credentials. Because We don't know why
021: * MVNTomcatJDBCRealm is never called
022: *
023: * View Thread: http://www.mvnforum.com/mvnforum/mvnforum/viewthread?thread=2782
024: */
025: package com.mvnsoft.auth.realm;
026:
027: import java.security.MessageDigest;
028: import java.security.Principal;
029: import java.security.cert.X509Certificate;
030:
031: import org.apache.catalina.realm.JDBCRealm;
032: import org.apache.commons.logging.Log;
033: import org.apache.commons.logging.LogFactory;
034:
035: import sun.misc.BASE64Encoder;
036:
037: public class MVNTomcatJDBCRealm extends JDBCRealm {
038:
039: private static Log log = LogFactory
040: .getLog(MVNTomcatJDBCRealm.class);
041:
042: protected String getPassword(String username) {
043: // I don't know why this method is never called
044: return super .getPassword(username);
045: }
046:
047: public String getMD5_Base64(String input) {
048: // please note that we dont use digest, because if we
049: // cannot get digest, then the second time we have to call it
050: // again, which will fail again
051: MessageDigest digest = null;
052: try {
053: digest = MessageDigest.getInstance("MD5");
054: } catch (Exception ex) {
055: log
056: .fatal(
057: "Cannot get MessageDigest. Application may fail to run correctly.",
058: ex);
059: }
060: if (digest == null)
061: return input;
062:
063: // now everything is ok, go ahead
064: try {
065: digest.update(input.getBytes("UTF-8"));
066: } catch (java.io.UnsupportedEncodingException ex) {
067: log.error("Assertion: This should never occur.");
068: }
069: byte[] rawData = digest.digest();
070: BASE64Encoder encoder = new BASE64Encoder();
071:
072: return encoder.encode(rawData);
073: }
074:
075: protected String digest(String credentials) {
076: System.out.println("MVNTomcatJDBCRealm.digest()");
077: //return super.digest(credentials);
078: return getMD5_Base64(credentials);
079: }
080:
081: /**
082: * This is a sample implementation of JDBCRealm using password
083: */
084:
085: public Principal authenticate(String username, String password) {
086: String md5_base64 = getMD5_Base64(password);
087: System.out
088: .println("MVNTomcatJDBCRealm.authenticate(username, password)");
089: //System.out.println("Authenticate 2 params " + username + " and " + md5_base64);
090: //return super.authenticate(username, md5_base64);
091: return super .authenticate(username, password);
092: }
093:
094: public Principal authenticate(String username, byte[] credentials) {
095: System.out.println("Authenticate byte");
096: return super .authenticate(username, credentials);
097: }
098:
099: public Principal authenticate(String username, String clientDigest,
100: String nOnce, String nc, String cnonce, String qop,
101: String realm, String md5a2) {
102: //System.out.println("Authenticate username, clientDigest, nOnce, nc, cnonce, qop, realm, md5a2");
103: return super .authenticate(username, clientDigest, nOnce, nc,
104: cnonce, qop, realm, md5a2);
105: }
106:
107: public Principal authenticate(X509Certificate[] certs) {
108: //System.out.println("Authenticate X509Certificate");
109: return super.authenticate(certs);
110: }
111: }
|