1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.eclipse.jetty.security.jaspi.modules;
20
21 import java.io.IOException;
22 import java.util.Map;
23
24 import javax.security.auth.Subject;
25 import javax.security.auth.callback.CallbackHandler;
26 import javax.security.auth.callback.UnsupportedCallbackException;
27 import javax.security.auth.message.AuthException;
28 import javax.security.auth.message.AuthStatus;
29 import javax.security.auth.message.MessageInfo;
30 import javax.security.auth.message.MessagePolicy;
31 import javax.servlet.http.HttpServletRequest;
32 import javax.servlet.http.HttpServletResponse;
33
34 import org.eclipse.jetty.http.HttpHeader;
35 import org.eclipse.jetty.util.log.Log;
36 import org.eclipse.jetty.util.log.Logger;
37 import org.eclipse.jetty.util.security.Constraint;
38
39
40
41
42
43 public class BasicAuthModule extends BaseAuthModule
44 {
45 private static final Logger LOG = Log.getLogger(BasicAuthModule.class);
46
47
48 private String realmName;
49
50 private static final String REALM_KEY = "org.eclipse.jetty.security.jaspi.modules.RealmName";
51
52 public BasicAuthModule()
53 {
54 }
55
56 public BasicAuthModule(CallbackHandler callbackHandler, String realmName)
57 {
58 super(callbackHandler);
59 this.realmName = realmName;
60 }
61
62 @Override
63 public void initialize(MessagePolicy requestPolicy, MessagePolicy responsePolicy,
64 CallbackHandler handler, Map options)
65 throws AuthException
66 {
67 super.initialize(requestPolicy, responsePolicy, handler, options);
68 realmName = (String) options.get(REALM_KEY);
69 }
70
71 @Override
72 public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject,
73 Subject serviceSubject)
74 throws AuthException
75 {
76 HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
77 HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
78 String credentials = request.getHeader(HttpHeader.AUTHORIZATION.asString());
79
80 try
81 {
82 if (credentials != null)
83 {
84 if (LOG.isDebugEnabled()) LOG.debug("Credentials: " + credentials);
85 if (login(clientSubject, credentials, Constraint.__BASIC_AUTH, messageInfo)) { return AuthStatus.SUCCESS; }
86
87 }
88
89 if (!isMandatory(messageInfo)) { return AuthStatus.SUCCESS; }
90 response.setHeader(HttpHeader.WWW_AUTHENTICATE.asString(), "basic realm=\"" + realmName + '"');
91 response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
92 return AuthStatus.SEND_CONTINUE;
93 }
94 catch (IOException e)
95 {
96 throw new AuthException(e.getMessage());
97 }
98 catch (UnsupportedCallbackException e)
99 {
100 throw new AuthException(e.getMessage());
101 }
102
103 }
104 }