siteminderauthenticationprocessingfilter.java

acegi构造安全的java系统

/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.acegisecurity.ui.webapp;

import org.acegisecurity.Authentication;
import org.acegisecurity.AuthenticationException;

import org.acegisecurity.context.HttpSessionContextIntegrationFilter;
import org.acegisecurity.context.SecurityContext;

import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


/**
 * Extends Acegi's AuthenticationProcessingFilter to pick up CA/Netegrity Siteminder headers.<P>Also provides a
 * backup form-based authentication and the ability set source key names.</p>
 *  <P><B>Siteminder</B> must present two <B>headers</B> to this filter, a username and password. You must set the
 * header keys before this filter is used for authentication, otherwise Siteminder checks will be skipped. If the
 * Siteminder check is unsuccessful (i.e. if the headers are not found), then the form parameters will be checked (see
 * next paragraph). This allows applications to optionally function even when their Siteminder infrastructure is
 * unavailable, as is often the case during development.</p>
 *  <P><B>Login forms</B> must present two <B>parameters</B> to this filter: a username and password. If not
 * specified, the parameter names to use are contained in the static fields {@link #ACEGI_SECURITY_FORM_USERNAME_KEY}
 * and {@link #ACEGI_SECURITY_FORM_PASSWORD_KEY}.</p>
 *  <P><B>Do not use this class directly.</B> Instead, configure <code>web.xml</code> to use the {@link
 * org.acegisecurity.util.FilterToBeanProxy}.</p>
 */
public class SiteminderAuthenticationProcessingFilter extends AuthenticationProcessingFilter {
    //~ Static fields/initializers =====================================================================================

    /** Log instance for debugging */
    private static final Log logger = LogFactory.getLog(SiteminderAuthenticationProcessingFilter.class);

    //~ Instance fields ================================================================================================

    /** Form password request key. */
    private String formPasswordParameterKey = null;

    /** Form username request key. */
    private String formUsernameParameterKey = null;

    /** Siteminder password header key. */
    private String siteminderPasswordHeaderKey = null;

    /** Siteminder username header key. */
    private String siteminderUsernameHeaderKey = null;

    //~ Constructors ===================================================================================================

/**
     * Basic constructor.
     */
    public SiteminderAuthenticationProcessingFilter() {
        super();
    }

    //~ Methods ========================================================================================================

    /**
     *
     * @see org.acegisecurity.ui.AbstractProcessingFilter#attemptAuthentication(javax.servlet.http.HttpServletRequest)
     */
    public Authentication attemptAuthentication(HttpServletRequest request)
        throws AuthenticationException {
        String username = null;
        String password = null;

        // Check the Siteminder headers for authentication info
        if ((siteminderUsernameHeaderKey != null) && (siteminderUsernameHeaderKey.length() > 0)
            && (siteminderPasswordHeaderKey != null) && (siteminderPasswordHeaderKey.length() > 0)) {
            username = request.getHeader(siteminderUsernameHeaderKey);
            password = request.getHeader(siteminderPasswordHeaderKey);
        }

        // If the Siteminder authentication info wasn't available, then get it
        // from the form parameters
        if ((username == null) || (username.length() == 0) || (password == null) || (password.length() == 0)) {
            if (logger.isDebugEnabled()) {
                logger.debug("Siteminder headers not found for authentication, so trying to use form values");
            }

            if ((formUsernameParameterKey != null) && (formUsernameParameterKey.length() > 0)) {
                username = request.getParameter(formUsernameParameterKey);
            } else {
                username = request.getParameter(ACEGI_SECURITY_FORM_USERNAME_KEY);
            }

            password = obtainPassword(request);
        }

        // Convert username and password to upper case. This is normally not a
        // good practice but we do it here because Siteminder gives us the username
        // in lower case, while most backing systems store it in upper case.
        if (username != null) {
            username = username.toUpperCase();
        } else {
            // If username is null, set to blank to avoid a NPE.
            username = "";
        }

        if (password != null) {
            password = password.toUpperCase();
        } else {
            // If password is null, set to blank to avoid a NPE.
            password = "";
        }

        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        // Place the last username attempted into HttpSession for views
        request.getSession().setAttribute(ACEGI_SECURITY_LAST_USERNAME_KEY, username);

        return this.getAuthenticationManager().authenticate(authRequest);
    }

    /**
     * Returns the form password parameter key.
     *
     * @return The form password parameter key.
     */
    public String getFormPasswordParameterKey() {
        return formPasswordParameterKey;
    }

    /**
     * Returns the form username parameter key.
     *
     * @return The form username parameter key.
     */
    public String getFormUsernameParameterKey() {
        return formUsernameParameterKey;
    }

    /**
     * Returns the Siteminder password header key.
     *
     * @return The Siteminder password header key.
     */
    public String getSiteminderPasswordHeaderKey() {
        return siteminderPasswordHeaderKey;
    }

    /**
     * Returns the Siteminder username header key.
     *
     * @return The Siteminder username header key.
     */
    public String getSiteminderUsernameHeaderKey() {
        return siteminderUsernameHeaderKey;
    }

    /**
     * Overridden method to obtain different value depending on whether Siteminder or form validation is being
     * performed.
     *
     * @param request so that request attributes can be retrieved
     *
     * @return the password that will be presented in the <code>Authentication</code> request token to the
     *         <code>AuthenticationManager</code>
     */
    protected String obtainPassword(HttpServletRequest request) {
        if ((formPasswordParameterKey != null) && (formPasswordParameterKey.length() > 0)) {
            return request.getParameter(formPasswordParameterKey);
        } else {
            return request.getParameter(ACEGI_SECURITY_FORM_PASSWORD_KEY);
        }
    }

    /**
     * Overridden to perform authentication not only on j_security_check, but also on requests for the default
     * target URL when the user isn't already authenticated.<p>Thank you Paul Garvey for providing a
     * straightforward solution (and code) for this!</p>
     *
     * @see org.acegisecurity.ui.AbstractProcessingFilter#requiresAuthentication(javax.servlet.http.HttpServletRequest,
     *      javax.servlet.http.HttpServletResponse)
     */
    protected boolean requiresAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
        String uri = request.getRequestURI();
        int pathParamIndex = uri.indexOf(';');

        if (pathParamIndex > 0) {
            // strip everything after the first semi-colon
            uri = uri.substring(0, pathParamIndex);
        }

        //attempt authentication if j_secuity_check is present or if the getDefaultTargetUrl()
        //is present and user is not already authenticated.
        boolean bAuthenticated = false;
        SecurityContext context = (SecurityContext)
                request.getSession().getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);

        if (context != null) {
            Authentication auth = context.getAuthentication();

            if ((auth != null) && auth instanceof UsernamePasswordAuthenticationToken) {
                UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) auth;
                bAuthenticated = token.isAuthenticated();
            }
        }

        // if true is returned then authentication will be attempted.
        boolean bAttemptAuthentication = (uri.endsWith(request.getContextPath() + getFilterProcessesUrl()))
                || ((getDefaultTargetUrl() != null) && uri.endsWith(getDefaultTargetUrl()) && !bAuthenticated);

        if (logger.isDebugEnabled()) {
            logger.debug("Authentication attempted for the following URI ==> " + uri + " is " + bAttemptAuthentication);
        }

        return bAttemptAuthentication;
    }

    /**
     * Sets the form password parameter key.
     *
     * @param key The form password parameter key.
     */
    public void setFormPasswordParameterKey(final String key) {
        this.formPasswordParameterKey = key;
    }

    /**
     * Sets the form username parameter key.
     *
     * @param key The form username parameter key.
     */
    public void setFormUsernameParameterKey(final String key) {
        this.formUsernameParameterKey = key;
    }

    /**
     * Sets the Siteminder password header key.
     *
     * @param key The Siteminder password header key.
     */
    public void setSiteminderPasswordHeaderKey(final String key) {
        this.siteminderPasswordHeaderKey = key;
    }

    /**
     * Sets the Siteminder username header key.
     *
     * @param key The Siteminder username header key.
     */
    public void setSiteminderUsernameHeaderKey(final String key) {
        this.siteminderUsernameHeaderKey = key;
    }
}