1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.eclipse.jetty.security.authentication;
20
21 import java.io.IOException;
22
23 import javax.servlet.ServletRequest;
24 import javax.servlet.ServletResponse;
25 import javax.servlet.http.HttpServletRequest;
26 import javax.servlet.http.HttpServletResponse;
27
28 import org.eclipse.jetty.http.HttpHeaders;
29 import org.eclipse.jetty.security.ServerAuthException;
30 import org.eclipse.jetty.security.UserAuthentication;
31 import org.eclipse.jetty.server.Authentication;
32 import org.eclipse.jetty.server.Authentication.User;
33 import org.eclipse.jetty.server.UserIdentity;
34 import org.eclipse.jetty.util.log.Log;
35 import org.eclipse.jetty.util.log.Logger;
36 import org.eclipse.jetty.util.security.Constraint;
37
38 public class SpnegoAuthenticator extends LoginAuthenticator
39 {
40 private static final Logger LOG = Log.getLogger(SpnegoAuthenticator.class);
41
42 private String _authMethod = Constraint.__SPNEGO_AUTH;
43
44 public SpnegoAuthenticator()
45 {
46
47 }
48
49
50
51
52
53 public SpnegoAuthenticator( String authMethod )
54 {
55 _authMethod = authMethod;
56 }
57
58 public String getAuthMethod()
59 {
60 return _authMethod;
61 }
62
63
64
65 public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatory) throws ServerAuthException
66 {
67 HttpServletRequest req = (HttpServletRequest)request;
68 HttpServletResponse res = (HttpServletResponse)response;
69
70 String header = req.getHeader(HttpHeaders.AUTHORIZATION);
71
72 if (!mandatory)
73 {
74 return new DeferredAuthentication(this);
75 }
76
77
78 if ( header == null )
79 {
80 try
81 {
82 if (DeferredAuthentication.isDeferred(res))
83 {
84 return Authentication.UNAUTHENTICATED;
85 }
86
87 LOG.debug("SpengoAuthenticator: sending challenge");
88 res.setHeader(HttpHeaders.WWW_AUTHENTICATE, HttpHeaders.NEGOTIATE);
89 res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
90 return Authentication.SEND_CONTINUE;
91 }
92 catch (IOException ioe)
93 {
94 throw new ServerAuthException(ioe);
95 }
96 }
97 else if (header != null && header.startsWith(HttpHeaders.NEGOTIATE))
98 {
99 String spnegoToken = header.substring(10);
100
101 UserIdentity user = login(null,spnegoToken, request);
102
103 if ( user != null )
104 {
105 return new UserAuthentication(getAuthMethod(),user);
106 }
107 }
108
109 return Authentication.UNAUTHENTICATED;
110 }
111
112 public boolean secureResponse(ServletRequest request, ServletResponse response, boolean mandatory, User validatedUser) throws ServerAuthException
113 {
114 return true;
115 }
116
117 }