1
2
3
4
5
6
7
8
9
10
11
12
13
14 package org.eclipse.jetty.security.jaspi.modules;
15
16 import java.io.IOException;
17 import java.util.Map;
18
19 import javax.security.auth.Subject;
20 import javax.security.auth.callback.CallbackHandler;
21 import javax.security.auth.callback.UnsupportedCallbackException;
22 import javax.security.auth.message.AuthException;
23 import javax.security.auth.message.AuthStatus;
24 import javax.security.auth.message.MessageInfo;
25 import javax.security.auth.message.MessagePolicy;
26 import javax.servlet.http.HttpServletRequest;
27 import javax.servlet.http.HttpServletResponse;
28
29 import org.eclipse.jetty.http.HttpHeaders;
30 import org.eclipse.jetty.http.security.Constraint;
31 import org.eclipse.jetty.util.log.Log;
32
33
34
35
36
37 public class BasicAuthModule extends BaseAuthModule
38 {
39
40 private String realmName;
41
42 private static final String REALM_KEY = "org.eclipse.jetty.security.jaspi.modules.RealmName";
43
44 public BasicAuthModule()
45 {
46 }
47
48 public BasicAuthModule(CallbackHandler callbackHandler, String realmName)
49 {
50 super(callbackHandler);
51 this.realmName = realmName;
52 }
53
54 @Override
55 public void initialize(MessagePolicy requestPolicy, MessagePolicy responsePolicy,
56 CallbackHandler handler, Map options)
57 throws AuthException
58 {
59 super.initialize(requestPolicy, responsePolicy, handler, options);
60 realmName = (String) options.get(REALM_KEY);
61 }
62
63 @Override
64 public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject,
65 Subject serviceSubject)
66 throws AuthException
67 {
68 HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
69 HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
70 String credentials = request.getHeader(HttpHeaders.AUTHORIZATION);
71
72 try
73 {
74 if (credentials != null)
75 {
76 if (Log.isDebugEnabled()) Log.debug("Credentials: " + credentials);
77 if (login(clientSubject, credentials, Constraint.__BASIC_AUTH, messageInfo)) { return AuthStatus.SUCCESS; }
78
79 }
80
81 if (!isMandatory(messageInfo)) { return AuthStatus.SUCCESS; }
82 response.setHeader(HttpHeaders.WWW_AUTHENTICATE, "basic realm=\"" + realmName + '"');
83 response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
84 return AuthStatus.SEND_CONTINUE;
85 }
86 catch (IOException e)
87 {
88 throw new AuthException(e.getMessage());
89 }
90 catch (UnsupportedCallbackException e)
91 {
92 throw new AuthException(e.getMessage());
93 }
94
95 }
96 }