001 /*
002 GRANITE DATA SERVICES
003 Copyright (C) 2011 GRANITE DATA SERVICES S.A.S.
004
005 This file is part of Granite Data Services.
006
007 Granite Data Services is free software; you can redistribute it and/or modify
008 it under the terms of the GNU Library General Public License as published by
009 the Free Software Foundation; either version 2 of the License, or (at your
010 option) any later version.
011
012 Granite Data Services is distributed in the hope that it will be useful, but
013 WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
014 FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public License
015 for more details.
016
017 You should have received a copy of the GNU Library General Public License
018 along with this library; if not, see <http://www.gnu.org/licenses/>.
019 */
020
021 package org.granite.messaging.service.security;
022
023 import java.lang.reflect.Field;
024 import java.lang.reflect.InvocationTargetException;
025 import java.security.Principal;
026 import java.util.Map;
027
028 import javax.servlet.http.HttpServletRequest;
029 import javax.servlet.http.HttpServletRequestWrapper;
030 import javax.servlet.http.HttpSession;
031
032 import org.apache.catalina.Context;
033 import org.apache.catalina.Engine;
034 import org.apache.catalina.Host;
035 import org.apache.catalina.Realm;
036 import org.apache.catalina.Server;
037 import org.apache.catalina.ServerFactory;
038 import org.apache.catalina.Service;
039 import org.apache.catalina.Session;
040 import org.apache.catalina.authenticator.Constants;
041 import org.apache.catalina.connector.Request;
042 import org.apache.catalina.connector.RequestFacade;
043 import org.granite.context.GraniteContext;
044 import org.granite.messaging.webapp.HttpGraniteContext;
045
046 /**
047 * @author Franck WOLFF
048 */
049 public class TomcatSecurityService extends AbstractSecurityService {
050
051 private final Field requestField;
052 private Engine engine = null;
053
054 public TomcatSecurityService() {
055 super();
056 try {
057 // We need to access the org.apache.catalina.connector.Request field from
058 // a org.apache.catalina.connector.RequestFacade. Unfortunately there is
059 // no public getter for this field (and I don't want to create a Valve)...
060 requestField = RequestFacade.class.getDeclaredField("request");
061 requestField.setAccessible(true);
062 } catch (Exception e) {
063 throw new RuntimeException("Could not get 'request' field in Tomcat RequestFacade", e);
064 }
065 }
066
067 protected Field getRequestField() {
068 return requestField;
069 }
070
071 protected Engine getEngine() {
072 return engine;
073 }
074
075 public void configure(Map<String, String> params) {
076 String serviceId = params.get("service");
077
078 Server server = ServerFactory.getServer();
079 if (server == null)
080 throw new NullPointerException("Could not get Tomcat server");
081
082 Service service = null;
083 if (serviceId != null)
084 service = server.findService(serviceId);
085 else {
086 Service[] services = server.findServices();
087 if (services != null && services.length > 0)
088 service = services[0];
089 }
090 if (service == null)
091 throw new NullPointerException("Could not find Tomcat service for: " + (serviceId != null ? serviceId : "(default)"));
092
093 engine = (Engine)service.getContainer();
094 if (engine == null)
095 throw new NullPointerException("Could not find Tomcat container for: " + (serviceId != null ? serviceId : "(default)"));
096 }
097
098 public void login(Object credentials, String charset) throws SecurityServiceException {
099 String[] decoded = decodeBase64Credentials(credentials, charset);
100
101 HttpGraniteContext context = (HttpGraniteContext)GraniteContext.getCurrentInstance();
102 HttpServletRequest httpRequest = context.getRequest();
103 Realm realm = getRealm(httpRequest);
104
105 Principal principal = realm.authenticate(decoded[0], decoded[1]);
106 if (principal == null)
107 throw SecurityServiceException.newInvalidCredentialsException("Wrong username or password");
108
109 Request request = getRequest(httpRequest);
110 request.setAuthType(AUTH_TYPE);
111 request.setUserPrincipal(principal);
112
113 Session session = request.getSessionInternal(true);
114 session.setAuthType(AUTH_TYPE);
115 session.setPrincipal(principal);
116 session.setNote(Constants.SESS_USERNAME_NOTE, decoded[0]);
117 session.setNote(Constants.SESS_PASSWORD_NOTE, decoded[1]);
118
119 endLogin(credentials, charset);
120 }
121
122 public Object authorize(AbstractSecurityContext context) throws Exception {
123
124 startAuthorization(context);
125
126 HttpGraniteContext graniteContext = (HttpGraniteContext)GraniteContext.getCurrentInstance();
127 HttpServletRequest httpRequest = graniteContext.getRequest();
128 Request request = getRequest(httpRequest);
129 Session session = request.getSessionInternal(false);
130
131 Principal principal = null;
132 if (session != null) {
133 request.setAuthType(session.getAuthType());
134 principal = session.getPrincipal();
135 if (principal == null && tryRelogin())
136 principal = session.getPrincipal();
137 }
138
139 request.setUserPrincipal(principal);
140
141 if (context.getDestination().isSecured()) {
142 if (principal == null) {
143 if (httpRequest.getRequestedSessionId() != null) {
144 HttpSession httpSession = httpRequest.getSession(false);
145 if (httpSession == null || httpRequest.getRequestedSessionId().equals(httpSession.getId()))
146 throw SecurityServiceException.newSessionExpiredException("Session expired");
147 }
148 throw SecurityServiceException.newNotLoggedInException("User not logged in");
149 }
150
151 boolean accessDenied = true;
152 for (String role : context.getDestination().getRoles()) {
153 if (request.isUserInRole(role)) {
154 accessDenied = false;
155 break;
156 }
157 }
158 if (accessDenied)
159 throw SecurityServiceException.newAccessDeniedException("User not in required role");
160 }
161
162 try {
163 return endAuthorization(context);
164 } catch (InvocationTargetException e) {
165 for (Throwable t = e; t != null; t = t.getCause()) {
166 // Don't create a dependency to javax.ejb in SecurityService...
167 if (t instanceof SecurityException ||
168 "javax.ejb.EJBAccessException".equals(t.getClass().getName()))
169 throw SecurityServiceException.newAccessDeniedException(t.getMessage());
170 }
171 throw e;
172 }
173 }
174
175 public void logout() throws SecurityServiceException {
176 HttpGraniteContext context = (HttpGraniteContext)GraniteContext.getCurrentInstance();
177
178 Session session = getSession(context.getRequest(), false);
179 if (session != null && session.getPrincipal() != null) {
180 session.setAuthType(null);
181 session.setPrincipal(null);
182 session.removeNote(Constants.SESS_USERNAME_NOTE);
183 session.removeNote(Constants.SESS_PASSWORD_NOTE);
184
185 endLogout();
186
187 session.expire();
188 }
189 }
190
191 protected Principal getPrincipal(HttpServletRequest httpRequest) {
192 Request request = getRequest(httpRequest);
193 Session session = request.getSessionInternal(false);
194 return (session != null ? session.getPrincipal() : null);
195 }
196
197 protected Session getSession(HttpServletRequest httpRequest, boolean create) {
198 Request request = getRequest(httpRequest);
199 return request.getSessionInternal(create);
200 }
201
202 protected Request getRequest(HttpServletRequest request) {
203 while (request instanceof HttpServletRequestWrapper)
204 request = (HttpServletRequest)((HttpServletRequestWrapper)request).getRequest();
205 try {
206 return (Request)requestField.get(request);
207 } catch (Exception e) {
208 throw new RuntimeException("Could not get tomcat request", e);
209 }
210 }
211
212 protected Context getContext(HttpServletRequest request) {
213 String serverName = request.getServerName();
214 String contextPath = request.getContextPath();
215
216 Host host = (Host)engine.findChild(serverName);
217 if (host == null) {
218 // if it cannot find host, then use the default host.
219 host = (Host)engine.findChild(engine.getDefaultHost());
220 if (host == null)
221 throw new NullPointerException("Could not find Tomcat host for: " + serverName + " or: " + engine.getDefaultHost());
222 }
223
224 Context context = (Context)host.findChild(contextPath);
225 if (context == null)
226 throw new NullPointerException("Could not find Tomcat context for: " + contextPath);
227 return context;
228 }
229
230 protected Realm getRealm(HttpServletRequest request) {
231 Context context = getContext(request);
232 Realm realm = context.getRealm();
233 if (realm == null)
234 throw new NullPointerException("Could not find Tomcat realm for: " + context.getPath());
235
236 return realm;
237 }
238 }