Skip to content

Commit 55ca0b3

Browse files
trajanotrajano
committed
Compiles successfully to EAR but does not work with WAS8.5 security yet
1 parent 7ca0fee commit 55ca0b3

File tree

9 files changed

+575
-163
lines changed

9 files changed

+575
-163
lines changed

‎README.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Entrust TruePass JASPIC implementation
2+
======================================
3+
4+
This is a simplistic implementation of [HttpHeaderAuthModule](https://github.com/trajano/server-auth-modules/blob/master/src/main/java/net/trajano/auth/HttpHeaderAuthModule.java) from [Server Auth Modules](https://site.trajano.net/server-auth-modules/) which has been hard coded for Entrust TruePass implementations and uses Java EE 6 to support older versions of WebSphere Application Server.
5+
6+
It provides a sample EAR and web app that can be deployed to WebSphere Application Server based on [Utility JSPs](https://github.com/trajano/util).
7+
8+
This is implemented with [JASPIC embedded inside the application](https://trajano.net/2014/11/implementing-jaspic-in-the-application/).

‎entrust-truepass-jaspic/src/main/java/net/trajano/entrust/jaspic/EntrustTruePassAuthModuleConfigProvider.java

-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@
88
import javax.security.auth.message.config.AuthConfigProvider;
99
import javax.security.auth.message.config.ClientAuthConfig;
1010
import javax.security.auth.message.config.ServerAuthConfig;
11-
import javax.security.auth.message.module.ClientAuthModule;
12-
import javax.security.auth.message.module.ServerAuthModule;
1311

1412
import net.trajano.entrust.jaspic.internal.ServerAuthModuleAuthConfig;
1513

‎entrust-truepass-jaspic/src/main/java/net/trajano/entrust/jaspic/EntrustTruePassJaspicModule.java

+161-145
Original file line numberDiff line numberDiff line change
@@ -32,149 +32,165 @@
3232
*
3333
* @see https://trajano.net/2014/06/creating-a-simple-jaspic-auth-module/
3434
*/
35-
public class EntrustTruePassJaspicModule implements ServerAuthModule, ServerAuthContext {
36-
37-
/**
38-
* Logger.
39-
*/
40-
private static final Logger LOG;
41-
42-
/**
43-
* Entrust HTTP Header.
44-
*/
45-
public static final String ENTRUST_HTTP_HEADER = "Entrust-Client";
46-
47-
static {
48-
LOG = Logger.getLogger("net.trajano.entrust.jaspic");
49-
}
50-
51-
/**
52-
* Callback handler that is passed in initialize by the container. This
53-
* processes the callbacks which are objects that populate the "subject".
54-
*/
55-
private CallbackHandler handler;
56-
57-
/**
58-
* Mandatory flag.
59-
*/
60-
private boolean mandatory;
61-
62-
/**
63-
* Does nothing.
64-
*
65-
* @param messageInfo
66-
* message info
67-
* @param subject
68-
* subject
69-
*/
70-
@Override
71-
public void cleanSubject(final MessageInfo messageInfo, final Subject subject) throws AuthException {
72-
73-
// Does nothing.
74-
}
75-
76-
/**
77-
* <p>
78-
* Supported message types. For our case we only need to deal with HTTP
79-
* servlet request and responses. On Java EE 7 this will handle WebSockets
80-
* as well.
81-
* </p>
82-
* <p>
83-
* This creates a new array for security at the expense of performance.
84-
* </p>
85-
*
86-
* @return {@link HttpServletRequest} and {@link HttpServletResponse}
87-
* classes.
88-
*/
89-
@SuppressWarnings("rawtypes")
90-
@Override
91-
public Class[] getSupportedMessageTypes() {
92-
93-
return new Class<?>[] { HttpServletRequest.class, HttpServletResponse.class };
94-
}
95-
96-
/**
97-
* Builds a list of groups from the request. This simply returns "users"
98-
*
99-
* @param req
100-
* servlet request.
101-
* @return array of groups.
102-
*/
103-
private String[] groups(final HttpServletRequest req) {
104-
105-
return new String[] { "users" };
106-
}
107-
108-
/**
109-
* {@inheritDoc}
110-
*
111-
* @param requestPolicy
112-
* request policy, ignored
113-
* @param responsePolicy
114-
* response policy, ignored
115-
* @param h
116-
* callback handler
117-
* @param options
118-
* options
119-
*/
120-
@Override
121-
public void initialize(final MessagePolicy requestPolicy, final MessagePolicy responsePolicy,
122-
final CallbackHandler h, @SuppressWarnings("rawtypes") final Map options) throws AuthException {
123-
124-
handler = h;
125-
mandatory = requestPolicy.isMandatory();
126-
}
127-
128-
/**
129-
* Return {@link AuthStatus#SEND_SUCCESS}.
130-
*
131-
* @param messageInfo
132-
* contains the request and response messages. At this point the
133-
* response message is already committed so nothing can be
134-
* changed.
135-
* @param subject
136-
* subject.
137-
* @return {@link AuthStatus#SEND_SUCCESS}
138-
*/
139-
@Override
140-
public AuthStatus secureResponse(final MessageInfo messageInfo, final Subject subject) throws AuthException {
141-
142-
return AuthStatus.SEND_SUCCESS;
143-
}
144-
145-
/**
146-
* {@inheritDoc}
147-
*/
148-
@Override
149-
public AuthStatus validateRequest(final MessageInfo messageInfo, final Subject client, final Subject serviceSubject)
150-
throws AuthException {
151-
152-
final HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
153-
final HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();
154-
try {
155-
if (!mandatory && !req.isSecure()) {
156-
return AuthStatus.SUCCESS;
157-
}
158-
if (!req.isSecure()) {
159-
resp.sendError(HttpURLConnection.HTTP_FORBIDDEN, "An HTTPS connection is required");
160-
return AuthStatus.SEND_FAILURE;
161-
}
162-
final String userName = Base64.decodeToString(req.getHeader(ENTRUST_HTTP_HEADER));
163-
if (userName == null && mandatory) {
164-
return AuthStatus.FAILURE;
165-
} else if (userName == null && !mandatory) {
166-
return AuthStatus.SUCCESS;
167-
}
168-
169-
handler.handle(new Callback[] { new CallerPrincipalCallback(client, userName),
170-
new GroupPrincipalCallback(client, groups(req)) });
171-
return AuthStatus.SUCCESS;
172-
} catch (final IOException e) {
173-
LOG.throwing(this.getClass().getName(), "IOException was thrown on validateRequest()", e);
174-
throw new AuthException(e.getMessage());
175-
} catch (final UnsupportedCallbackException e) {
176-
LOG.throwing(this.getClass().getName(), "UnsupportedCallbackException was thrown on validateRequest()", e);
177-
throw new AuthException(e.getMessage());
178-
}
179-
}
35+
public class EntrustTruePassJaspicModule implements
36+
ServerAuthModule,
37+
ServerAuthContext {
38+
39+
/**
40+
* Logger.
41+
*/
42+
private static final Logger LOG;
43+
44+
/**
45+
* Entrust HTTP Header.
46+
*/
47+
public static final String ENTRUST_HTTP_HEADER = "Entrust-Client";
48+
49+
static {
50+
LOG = Logger.getLogger("net.trajano.entrust.jaspic");
51+
}
52+
53+
/**
54+
* Callback handler that is passed in initialize by the container. This
55+
* processes the callbacks which are objects that populate the "subject".
56+
*/
57+
private CallbackHandler handler;
58+
59+
/**
60+
* Mandatory flag.
61+
*/
62+
private boolean mandatory;
63+
64+
/**
65+
* Does nothing.
66+
*
67+
* @param messageInfo
68+
* message info
69+
* @param subject
70+
* subject
71+
*/
72+
@Override
73+
public void cleanSubject(final MessageInfo messageInfo,
74+
final Subject subject) throws AuthException {
75+
76+
// Does nothing.
77+
}
78+
79+
/**
80+
* <p>
81+
* Supported message types. For our case we only need to deal with HTTP
82+
* servlet request and responses. On Java EE 7 this will handle WebSockets
83+
* as well.
84+
* </p>
85+
* <p>
86+
* This creates a new array for security at the expense of performance.
87+
* </p>
88+
*
89+
* @return {@link HttpServletRequest} and {@link HttpServletResponse}
90+
* classes.
91+
*/
92+
@SuppressWarnings("rawtypes")
93+
@Override
94+
public Class[] getSupportedMessageTypes() {
95+
96+
return new Class<?>[] {
97+
HttpServletRequest.class,
98+
HttpServletResponse.class
99+
};
100+
}
101+
102+
/**
103+
* Builds a list of groups from the request. This simply returns "users".
104+
* This value must match the security-roles in web.xml
105+
*
106+
* @param req
107+
* servlet request.
108+
* @return array of groups.
109+
*/
110+
private String[] groups(final HttpServletRequest req) {
111+
112+
return new String[] {
113+
"users"
114+
};
115+
}
116+
117+
/**
118+
* {@inheritDoc}
119+
*
120+
* @param requestPolicy
121+
* request policy, ignored
122+
* @param responsePolicy
123+
* response policy, ignored
124+
* @param h
125+
* callback handler
126+
* @param options
127+
* options
128+
*/
129+
@Override
130+
public void initialize(final MessagePolicy requestPolicy,
131+
final MessagePolicy responsePolicy,
132+
final CallbackHandler h,
133+
@SuppressWarnings("rawtypes") final Map options) throws AuthException {
134+
135+
handler = h;
136+
mandatory = requestPolicy.isMandatory();
137+
}
138+
139+
/**
140+
* Return {@link AuthStatus#SEND_SUCCESS}.
141+
*
142+
* @param messageInfo
143+
* contains the request and response messages. At this point the
144+
* response message is already committed so nothing can be
145+
* changed.
146+
* @param subject
147+
* subject.
148+
* @return {@link AuthStatus#SEND_SUCCESS}
149+
*/
150+
@Override
151+
public AuthStatus secureResponse(final MessageInfo messageInfo,
152+
final Subject subject) throws AuthException {
153+
154+
return AuthStatus.SEND_SUCCESS;
155+
}
156+
157+
/**
158+
* {@inheritDoc}
159+
*/
160+
@Override
161+
public AuthStatus validateRequest(final MessageInfo messageInfo,
162+
final Subject client,
163+
final Subject serviceSubject)
164+
throws AuthException {
165+
166+
final HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
167+
final HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();
168+
try {
169+
if (!mandatory && !req.isSecure()) {
170+
return AuthStatus.SUCCESS;
171+
}
172+
if (!req.isSecure()) {
173+
resp.sendError(HttpURLConnection.HTTP_FORBIDDEN, "An HTTPS connection is required");
174+
return AuthStatus.SEND_FAILURE;
175+
}
176+
final String userName = Base64.decodeToString(req.getHeader(ENTRUST_HTTP_HEADER));
177+
if (userName == null && mandatory) {
178+
return AuthStatus.FAILURE;
179+
} else if (userName == null && !mandatory) {
180+
return AuthStatus.SUCCESS;
181+
}
182+
183+
handler.handle(new Callback[] {
184+
new CallerPrincipalCallback(client, userName),
185+
new GroupPrincipalCallback(client, groups(req))
186+
});
187+
return AuthStatus.SUCCESS;
188+
} catch (final IOException e) {
189+
LOG.throwing(this.getClass().getName(), "IOException was thrown on validateRequest()", e);
190+
throw new AuthException(e.getMessage());
191+
} catch (final UnsupportedCallbackException e) {
192+
LOG.throwing(this.getClass().getName(), "UnsupportedCallbackException was thrown on validateRequest()", e);
193+
throw new AuthException(e.getMessage());
194+
}
195+
}
180196
}

‎entrust-truepass-jaspic/src/main/java/net/trajano/entrust/jaspic/EntrustTruePassServletContextInitializer.java

+6-5
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ public class EntrustTruePassServletContextInitializer implements
1111
ServletContextListener {
1212

1313
/**
14-
* Registers the authentication modules. {@inheritDoc}
14+
* Registers the authentication modules. {@inheritDoc}
1515
*/
1616
@Override
1717
public void contextInitialized(final ServletContextEvent sce) {
@@ -22,9 +22,10 @@ public void contextInitialized(final ServletContextEvent sce) {
2222
}
2323

2424
/**
25-
* Does nothing. {@inheritDoc}
25+
* Does nothing. {@inheritDoc}
2626
*/
27-
@Override
28-
public void contextDestroyed(ServletContextEvent sce) {
29-
}
27+
@Override
28+
public void contextDestroyed(ServletContextEvent sce) {
29+
30+
}
3031
}

‎entrust-truepass-jaspic/src/main/java/net/trajano/entrust/jaspic/internal/ServerAuthModuleAuthConfig.java

+5-11
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,18 @@
11
package net.trajano.entrust.jaspic.internal;
22

33
import java.util.Map;
4+
import java.util.concurrent.ConcurrentHashMap;
45

56
import javax.security.auth.Subject;
67
import javax.security.auth.callback.CallbackHandler;
78
import javax.security.auth.message.AuthException;
8-
import javax.security.auth.message.config.ServerAuthConfig;
9-
import javax.security.auth.message.config.ServerAuthContext;
10-
import javax.security.auth.message.module.ServerAuthModule;
11-
12-
import java.util.Map;
13-
import java.util.concurrent.ConcurrentHashMap;
14-
15-
import javax.security.auth.callback.CallbackHandler;
169
import javax.security.auth.message.MessageInfo;
1710
import javax.security.auth.message.MessagePolicy;
1811
import javax.security.auth.message.MessagePolicy.TargetPolicy;
12+
import javax.security.auth.message.config.ServerAuthConfig;
13+
import javax.security.auth.message.config.ServerAuthContext;
14+
import javax.security.auth.message.module.ServerAuthModule;
1915

20-
import net.trajano.entrust.jaspic.EntrustTruePassAuthModuleConfigProvider;
2116
import net.trajano.entrust.jaspic.EntrustTruePassJaspicModule;
2217

2318
/**
@@ -115,8 +110,7 @@ public String getAppContext() {
115110
*/
116111
public String getAuthContextID(final MessageInfo messageInfo) {
117112

118-
final Object isMandatory = messageInfo.getMap()
119-
.get(JAVAX_SECURITY_AUTH_MESSAGE_MESSAGE_POLICY_IS_MANDATORY);
113+
final Object isMandatory = messageInfo.getMap().get(JAVAX_SECURITY_AUTH_MESSAGE_MESSAGE_POLICY_IS_MANDATORY);
120114
if (isMandatory != null && isMandatory instanceof String && Boolean.valueOf((String) isMandatory)) {
121115
return messageInfo.toString();
122116
}

0 commit comments

Comments
 (0)