openidauthenticationaction.java

开源的OpenId的一个java实现

/*
 * Copyright 2005-2008 WSO2, Inc. (http://wso2.com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.wso2.solutions.identity.user.ui.action;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.struts2.StrutsStatics;
import org.openid4java.message.ParameterList;
import org.wso2.solutions.identity.IdentityConstants;
import org.wso2.solutions.identity.openid.OpenIDUtil;

import com.opensymphony.xwork2.ActionContext;

public class OpenIDAuthenticationAction extends ManagedAction {

    private static final long serialVersionUID = 2379986821364538695L;

    public boolean phishingResistanceAuthentication;

    public boolean multiFactorAuthentication;

    public boolean multiFactorPhysicalAuthentication;

    public boolean multiFactorAuthenticationWithUsernamePassword;

    /**
     * This will get executed during the user's authentication to the OpenID
     * Provider
     */
    public String execute() throws Exception {

        ActionContext context = null;
        HttpServletRequest request = null;
        HttpServletResponse response = null;
        ParameterList requestParam = null;
        HttpSession session = null;
        String openID = null;
        String[] policies = null;

        context = ActionContext.getContext();
        request = (HttpServletRequest) context.get(StrutsStatics.HTTP_REQUEST);
        response = (HttpServletResponse) context
                .get(StrutsStatics.HTTP_RESPONSE);
        session = request.getSession();
        requestParam = (ParameterList) session
                .getAttribute(IdentityConstants.OpenId.PARAM_LIST);

        if (requestParam != null
                && requestParam
                        .hasParameter(IdentityConstants.OpenId.ATTR_IDENTITY)) {
            openID = requestParam.getParameter(
                    IdentityConstants.OpenId.ATTR_IDENTITY).getValue();
        } else {
            addErrorMessage(getText("openid_required"));
            loadMessages();
            return ERROR;
        }

        loadMessages();

        if (session
                .getAttribute("multiFactorAuthenticationWithUsernamePassword") != null) {
            multiFactorAuthenticationWithUsernamePassword = true;
            session
                    .removeAttribute("multiFactorAuthenticationWithUsernamePassword");
        }

        if (multiFactorAuthenticationWithUsernamePassword) {
            return SUCCESS;
        }

        policies = OpenIDUtil.getRequestedAuthenticationPolicies(requestParam);

        if (policies != null) {
            for (String policy : policies) {
                if (policy
                        .equalsIgnoreCase(IdentityConstants.OpenId.PapeAttributes.PHISHING_RESISTANCE)) {
                    phishingResistanceAuthentication = true;
                }
                if (policy
                        .equalsIgnoreCase(IdentityConstants.OpenId.PapeAttributes.MULTI_FACTOR)) {
                    multiFactorAuthentication = true;
                    phishingResistanceAuthentication = false;
                }
                if (policy
                        .equalsIgnoreCase(IdentityConstants.OpenId.PapeAttributes.MULTI_FACTOR_PHYSICAL)) {
                    multiFactorPhysicalAuthentication = true;
                }
            }
        }

        // Check whether the remember me option is set
        Cookie[] cookies = request.getCookies();

        boolean rememberme = false;
        String openidurl = null;
        String password = null;
        String useInfoCard = null;

        if (cookies != null) {
            Cookie curCookie = null;
            for (int x = 0; x < cookies.length; x++) {
                curCookie = cookies[x];
                if (curCookie.getName().equalsIgnoreCase("rememberme")) {
                    rememberme = true;
                } else if (curCookie.getName().equalsIgnoreCase("openid")) {
                    openidurl = curCookie.getValue();
                } else if (curCookie.getName().equalsIgnoreCase("password")) {
                    password = new String(new sun.misc.BASE64Decoder()
                            .decodeBuffer(curCookie.getValue()), "UTF-8");
                } else if (curCookie.getName().equalsIgnoreCase(
                        "infocardCookie")) {
                    useInfoCard = curCookie.getValue();
                }
            }

            if (useInfoCard != null && useInfoCard.equals(openID)
                    && !multiFactorAuthentication
                    && !multiFactorPhysicalAuthentication) {
                // OpenID Provider needs to know which authentication mechanism
                // the user went through while authenticating to the OP.
                session
                        .setAttribute("phishingResistanceAuthentication",
                                "true");
                response.sendRedirect("OpenIDSelfIssuedLogin.action");
                return SUCCESS;
            }

            if (rememberme && openidurl != null && openidurl.equals(openID)
                    && password != null && !phishingResistanceAuthentication
                    && !multiFactorAuthentication
                    && !multiFactorPhysicalAuthentication) {
                session.setAttribute("password", password);
                response.sendRedirect("OpenIDAuthVerification.action");
            }
        }
        return SUCCESS;
    }

    public boolean isPhishingResistanceAuthentication() {
        return phishingResistanceAuthentication;
    }

    public boolean isMultiFactorAuthentication() {
        return multiFactorAuthentication;
    }

    public boolean isMultiFactorPhysicalAuthentication() {
        return multiFactorPhysicalAuthentication;
    }

    public boolean isMultiFactorAuthenticationWithUsernamePassword() {
        return multiFactorAuthenticationWithUsernamePassword;
    }

}