samllogon.java

1. 如何生成自签名的KeyStore以及导出供SP使用的公钥 C:>keytool -v -genkey -alias idp -keystore idp.jks -keyalg RSA -

package samlsso.servlet;

import java.io.IOException;

import javax.security.auth.login.LoginException;
import javax.servlet.Servlet;
import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.opensaml.SAMLResponse;

import weblogic.servlet.security.ServletAuthentication;

import com.bea.xbean.util.Base64;

/**
 *
 * @author maxq
 * @version 0.9
 */
public class SAMLLogon implements Servlet  {

  /**
   * 
   */
  private SAMLUtil util;
  
  /**
   * 
   */
  private String logonPage;
  
  /**
   * 
   */
  private String errPage;
  
  /**
   * 
   */
  private String welcomePage;
  
  /**
   * 
   */
  private final static String TARGET_URL= "ssotarget";
    
  /**
   * SAML Token, 整个系统环境中必须保持一致. 涉及的地方有:
   * 1. Identity Assertion Provider
   * 2. SAMLAuthFilter
   */
  private final static String TOKEN_TYPE= "SAML.Assertion";
  
  /**
   * 
   */
  public SAMLLogon() {
    super();
  }

  /*
   *  (non-Javadoc)
   * @see javax.servlet.Servlet#init(javax.servlet.ServletConfig)
   */
  public void init( ServletConfig config) throws ServletException {
    try {
      util= new SAMLUtil( config.getInitParameter( "path"), config.getInitParameter( "password"),
          config.getInitParameter( "alias"));
      this.logonPage= config.getInitParameter( "logon-page");
      this.errPage= config.getInitParameter( "logon-error-page");
      this.welcomePage= config.getInitParameter( "welcome-page");
    }catch ( Exception e) {
      throw new ServletException( "Failed to construct SAMLUtil " + e);
    }
  }

  /*
   *  (non-Javadoc)
   * @see javax.servlet.Servlet#getServletConfig()
   */
  public ServletConfig getServletConfig() {
    return null;
  }

  /*
   *  (non-Javadoc)
   * @see javax.servlet.Servlet#service(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
   */
  public void service( ServletRequest req, ServletResponse res) throws ServletException, IOException {
    HttpServletRequest request= (HttpServletRequest)req;
    HttpServletResponse response= (HttpServletResponse)res;
    HttpSession session= request.getSession( true);

    String userid= request.getRemoteUser();
    String target= request.getParameter( TARGET_URL);
    
    try {
      // user already logon!
      if ( userid!= null) {
        this.sendAutoLogonPage( request, response);
        return;
      }
      //
      if ( target!= null) {
        session.setAttribute( TARGET_URL, target);
      }
      // not logon
      String uid= request.getParameter( "j_username");
      String pwd= request.getParameter( "j_password");
      if ( uid== null || pwd== null) {
        this.sendLogonPage( request, response);
        return;
      }
      // try to authenticate user
      try {
        int result= ServletAuthentication.login( uid, pwd, request);
        if ( result!= ServletAuthentication.AUTHENTICATED)
          throw new LoginException( 
              "user login failed! Error Code [ref weblogic.servlet.security.ServletAuthentication]: "+ result);
      }catch ( LoginException ex) {
        this.sendErrorPage( request, response, ex);
        return;
      }
      // logon successfully!
      this.sendAutoLogonPage( request, response);
      return;
    }catch ( Exception ex) {
      throw new ServletException( ex);
    }
  }

  /* (non-Javadoc)
   * @see javax.servlet.Servlet#getServletInfo()
   */
  public String getServletInfo() {
    return null;
  }

  /* (non-Javadoc)
   * @see javax.servlet.Servlet#destroy()
   */
  public void destroy() {
  }
  
  /**
   * 
   * @param request
   * @param response
   */
  private void sendWelcomePage( HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    request.getRequestDispatcher( welcomePage).forward( request, response);
  }
  
  /**
   * 
   * @param request
   * @param response
   * @throws ServletException
   * @throws IOException
   */
  private void sendErrorPage( HttpServletRequest request, HttpServletResponse response, Exception ex) throws ServletException, IOException {
    request.setAttribute( "javax.servlet.error.exception", ex);
    request.getRequestDispatcher( errPage).forward( request, response);
  }
  
  /**
   * 
   * @param request
   * @param response
   * @throws ServletException
   * @throws IOException
   */
  private void sendLogonPage( HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    request.getRequestDispatcher( logonPage).forward( request, response);
  }
  
  /**
   * 
   * @param request
   * @param response
   * @throws Exception
   */
  private void sendAutoLogonPage( HttpServletRequest request, HttpServletResponse response) throws Exception {
    String target= request.getParameter( TARGET_URL);
    Object target_sess= request.getSession().getAttribute( TARGET_URL);
    if ( target== null && target_sess!= null) {
      target= String.valueOf(target_sess);
    }
    if ( target!= null) {
      SAMLResponse r= util.getSAMLResponse( request.getRemoteUser(), false);
      String token= Base64.encode( r.toString());
      String autoLogonPage=
        "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\">\n" +
        "<html>\n"+
        "<head>\n"+
        "<title>SSO Auto Logon Form</title>\n"+
        "</head>\n"+
        "<body onLoad=\"document.autologon.submit();\">\n"+
        "<p></p>\n"+
        "<form name=autologon action=\""+ target + "\" method=POST>\n"+
        "<input type=\"hidden\" name=\""+ TOKEN_TYPE +"\" value="+ token+">\n"+
        "</form>\n"+
        "</body>\n"+
        "</html>\n";
      response.resetBuffer();
      response.getWriter().print( autoLogonPage);
      request.getSession(true).removeAttribute( TARGET_URL);
    }else {
      request.getRequestDispatcher( welcomePage).forward( request, response);
    }
  }

}