hbrealm.java

valvae的方法实现类,有效处理较严

        sb.append(userRoleTable);
        sb.append(" WHERE ");
        sb.append(userNameCol);
        sb.append(" = ?");
        return sb.toString();

    }

    private String createRoleQueryString_initUsername(String role_Column) {
        StringBuffer sb = new StringBuffer("SELECT ");
        sb.append(role_Column);
        sb.append(" FROM ");
        sb.append(userRoleTable);
        sb.append(" WHERE ");
        sb.append("init_username");
        sb.append(" = ?");
        return sb.toString();

    }



    private String getDbPassword(String username,String username_Column, String password_Column) {
        // Look up the user's credentials
        String dbCredentials = null;
        PreparedStatement stmt = null;
        ResultSet rs = null;

        // Number of tries is the numebr of attempts to connect to the database
        // during this login attempt (if we need to open the database)
        // This needs rewritten wuth better pooling support, the existing code
        // needs signature changes since the Prepared statements needs cached
        // with the connections.
        // The code below will try twice if there is a SQLException so the
        // connection may try to be opened again. On normal conditions (including
        // invalid login - the above is only used once.
        int numberOfTries = 2;
        String sql = createQueryString(username_Column,password_Column);
        while (numberOfTries > 0) {
            try {

                // Ensure that we have an open database connection
                open();

                try {
                    stmt = dbConnection.prepareStatement(sql);
                    stmt.setString(1, username);
                    rs = stmt.executeQuery();

                    if (rs.next()) {
                        dbCredentials = rs.getString(1);
                    }
                    if (dbCredentials == null) {
                        return (null);
                    }

                    dbCredentials = dbCredentials.trim();
                    return dbCredentials;

                } finally {
                    if (rs != null) {
                        try {
                            rs.close();
                        } catch (SQLException e) {
                            if (log.isDebugEnabled()) {
                                log.debug(e);
                            }

                        }
                    }
                    if (stmt != null) {
                        try {
                            stmt.close();
                        } catch (SQLException e) {
                            if (log.isDebugEnabled()) {
                                log.debug(e);
                            }

                        }

                    }
                    dbConnection.commit();
                }

            } catch (SQLException e) {

                if (log.isDebugEnabled()) {
                    log.debug(e);
                }

                // Close the connection so that it gets reopened next time
                if (dbConnection != null) {
                    close(dbConnection);
                }

            }

            numberOfTries--;
        }

        return (null);

    }

    /**
     * 在我们所使用的tomcat 5.28中,getPassword()方法返回的是null,<br>
     * 所以为了认证,复写这个方法
     *
     */
    protected String getPassword(String username) {

        return getDbPassword(username,userNameCol, userCredCol);
    }


    /**
     * 在我们所使用的tomcat 5.28中,getPassword()方法返回的是null,<br>
     * 所以为了认证,复写这个方法
     */
    protected Principal getPrincipal(String username) {

        return (new GenericPrincipal(this,
                                     username,
                                     getPassword(username),
                                     getRoles(username)));

    }


    private String createCredentials(String username, String password,
                                     String realm) {
        if (md5Helper == null) {
            try {
                md5Helper = MessageDigest.getInstance("MD5");
            } catch (NoSuchAlgorithmException e) {
                log.error("Couldn't get MD5 digest: ", e);
                throw new IllegalStateException(e.getMessage());
            }
        }
        if (hasMessageDigest()) {
            return password;
        }

        String digestValue = username + ":" + realm + ":"
                             + password;
        byte[] valueBytes = null;
        valueBytes = digestValue.getBytes();
        byte[] digest = null;
        // Bugzilla 32137
        synchronized (md5Helper) {
            digest = md5Helper.digest(valueBytes);
        }

        return md5Encoder.encode(digest);

    }


    private String processNC(String nc){

        if(nc.charAt(0)=='"'&&nc.charAt(nc.length()-1)==('"')){
            return nc.substring(1,nc.length()-1);
        }
        return nc;

    }

    /**
     * Return the Principal associated with the specified username, which
     * matches the digest calculated using the given parameters using the
     * method described in RFC 2069; otherwise return <code>null</code>.
     *
     * @param username Username of the Principal to look up
     * @param clientDigest Digest which has been submitted by the client
     * @param nOnce Unique (or supposedly unique) token which has been used
     * for this request
     * @param realm Realm name
     * @param md5a2 Second MD5 digest used to calculate the digest :
     * MD5(Method + ":" + uri)
     */
    public Principal authenticate(String username, String clientDigest,
                                  String nOnce, String nc, String cnonce,
                                  String qop, String realm,
                                  String md5a2) {
        nc=processNC(nc);
        String password = this.getPassword(username);
        Principal p = authenticate(username, clientDigest,
                                   nOnce, nc, cnonce,
                                   qop, realm,
                                   md5a2, password);
        if (p == null) {
            password = this.getInitPassword(username);
            p = authenticate(username, clientDigest,
                             nOnce, nc, cnonce,
                             qop, realm,
                             md5a2, password);
        }
        return p;
    }

    /**
     *
     * @param username String
     * @param clientDigest String
     * @param nOnce String
     * @param nc String
     * @param cnonce String
     * @param qop String
     * @param realm String
     * @param md5a2 String
     * @return Principal
     */
    public Principal authenticate(String username, String clientDigest,
                                  String nOnce, String nc, String cnonce,
                                  String qop, String realm,
                                  String md5a2, String password) {
        String md5a1 = this.createCredentials(username, password, realm);
        if (md5a1 == null) {
            return null;
        }


        String serverDigestValue = md5a1 + ":" + nOnce + ":" + nc + ":"
                                   + cnonce + ":" + qop + ":" + md5a2;
        byte[] valueBytes = null;
        valueBytes = serverDigestValue.getBytes();
        String serverDigest = null;
        // Bugzilla 32137
        synchronized (md5Helper) {
            serverDigest = md5Encoder.encode(md5Helper.digest(valueBytes));
        }

        if (log.isDebugEnabled()) {
            log.debug(" Username:" + username
                      + " ClientSigest:" + clientDigest + " nOnce:" + nOnce
                      + " nc:" + nc + " cnonce:" + cnonce + " qop:" + qop
                      + " realm:" + realm + "md5a2:" + md5a2
                      + " Server digest:" + serverDigest + " password:" +
                      password);
        }
        if (serverDigest.equals(clientDigest)) {
            ArrayList list=getRoles(username);
            if(list==null||list.size()==0){
                list=getRoles_initUsername(username);
            }
            return (new GenericPrincipal(this,
                                         username,
                                         password,
                                         list));

        } else {
            return null;
        }
    }


}