View Javadoc

1   /*
2   jGuard is a security framework based on top of jaas (java authentication and authorization security).
3   it is written for web applications, to resolve simply, access control problems.
4   version $Name$
5   http://sourceforge.net/projects/jguard/
6   
7   Copyright (C) 2004  Charles GAY
8   
9   This library is free software; you can redistribute it and/or
10  modify it under the terms of the GNU Lesser General Public
11  License as published by the Free Software Foundation; either
12  version 2.1 of the License, or (at your option) any later version.
13  
14  This library is distributed in the hope that it will be useful,
15  but WITHOUT ANY WARRANTY; without even the implied warranty of
16  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
17  Lesser General Public License for more details.
18  
19  You should have received a copy of the GNU Lesser General Public
20  License along with this library; if not, write to the Free Software
21  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
22  
23  
24  jGuard project home page:
25  http://sourceforge.net/projects/jguard/
26  
27  */
28  package net.sf.jguard.core.authentication.schemes;
29  
30  import net.sf.jguard.core.authentication.AccessContext;
31  import net.sf.jguard.core.authentication.AuthenticationException;
32  import net.sf.jguard.core.authentication.bindings.AuthenticationBindingsFactory;
33  import net.sf.jguard.core.authorization.permissions.JGPositivePermissionCollection;
34  
35  import javax.security.auth.callback.Callback;
36  import javax.security.auth.callback.NameCallback;
37  import javax.security.auth.callback.PasswordCallback;
38  import javax.security.auth.callback.UnsupportedCallbackException;
39  import java.security.Permission;
40  import java.security.PermissionCollection;
41  import java.util.ArrayList;
42  import java.util.Collection;
43  import java.util.List;
44  import java.util.Map;
45  
46  /**
47   * HTTP FORM which requires a login (NameCallback) and a password (PasswordCallback).
48   *
49   * @author <a href="mailto:diabolo512@users.sourceforge.net">Charles Gay</a>
50   * @see NameCallback
51   * @see PasswordCallback
52   * @since 1.1
53   */
54  public abstract class FormSchemeHandler implements StatefulAuthenticationSchemeHandler {
55      private ArrayList<Class> callbackTypes = null;
56      protected AuthenticationBindingsFactory factory;
57      protected PermissionCollection grantedPermissions;
58      protected Permission logoffPermission;
59      protected Permission logonPermission;
60      protected Permission logonProcessPermission;
61      protected boolean goToLastAccessDeniedUriOnSuccess = true;
62      public static final String LOGIN = "login";
63      public static final String PASSWORD = "password";
64  
65      public FormSchemeHandler(Map<String, String> parameters, AuthenticationBindingsFactory factory) {
66          callbackTypes = new ArrayList<Class>();
67          callbackTypes.add(NameCallback.class);
68          callbackTypes.add(PasswordCallback.class);
69          this.factory = factory;
70          this.goToLastAccessDeniedUriOnSuccess = Boolean.parseBoolean((String) parameters.get("goToLastAccessDeniedUriOnSuccess"));
71          initSettings(parameters);
72  
73          grantedPermissions = new JGPositivePermissionCollection();
74          grantedPermissions.add(logonPermission);
75          grantedPermissions.add(logoffPermission);
76          grantedPermissions.add(logonProcessPermission);
77      }
78  
79      protected abstract void initSettings(Map<String, String> parameters) throws IllegalArgumentException;
80  
81      public String getName() {
82          return "FORM";
83      }
84  
85      public PermissionCollection getGrantedPermissions() {
86          return grantedPermissions;
87      }
88  
89      public Collection<Class> getCallbackTypes() {
90          return callbackTypes;
91      }
92  
93      public boolean answerToChallenge(AccessContext context) {
94          boolean answerToChallenge = getlogonProcessPermission().implies(getPermission(context));
95          return answerToChallenge;
96      }
97  
98  
99      public abstract void buildChallenge(AccessContext context) throws AuthenticationException;
100 
101     public void handleSchemeCallbacks(AccessContext context, List<Callback> cbks) throws UnsupportedCallbackException {
102         String login = getLogin(context);
103         String password = getPassword(context);
104         for (Callback cb : cbks) {
105             if (cb instanceof NameCallback) {
106                 ((NameCallback) cb).setName(login);
107             } else if (cb instanceof PasswordCallback) {
108                 ((PasswordCallback) cb).setPassword(password.toCharArray());
109             }
110         }
111     }
112 
113     protected abstract String getLogin(AccessContext context);
114 
115     protected abstract String getPassword(AccessContext context);
116 
117     protected abstract Permission getPermission(AccessContext context);
118 
119     protected abstract Permission getlogonProcessPermission();
120 
121 }