4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster/**
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster *
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * Copyright (c) 2007 Sun Microsystems Inc. All Rights Reserved
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster *
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * The contents of this file are subject to the terms
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * of the Common Development and Distribution License
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * (the License). You may not use this file except in
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * compliance with the License.
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster *
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * You can obtain a copy of the License at
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * opensso/legal/CDDLv1.0.txt
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * See the License for the specific language governing
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * permission and limitations under the License.
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster *
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * When distributing Covered Code, include this CDDL
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * Header Notice in each file and include the License file
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * at opensso/legal/CDDLv1.0.txt.
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * If applicable, add the following below the CDDL Header,
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * with the fields enclosed by brackets [] replaced by
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * your own identifying information:
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * "Portions Copyrighted [year] [name of copyright owner]"
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster *
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * $Id: SSOTokenMechanismHandler.java,v 1.3 2008/06/25 05:49:56 qcheng Exp $
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster *
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster */
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterpackage com.sun.identity.liberty.ws.authnsvc.mechanism;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport javax.security.auth.callback.Callback;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport javax.security.auth.callback.NameCallback;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport javax.security.auth.callback.PasswordCallback;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport org.w3c.dom.Element;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.iplanet.sso.SSOException;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.iplanet.sso.SSOToken;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.iplanet.sso.SSOTokenManager;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.sun.identity.liberty.ws.authnsvc.AuthnSvcConstants;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.sun.identity.liberty.ws.authnsvc.AuthnSvcUtils;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.sun.identity.liberty.ws.authnsvc.protocol.SASLRequest;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.sun.identity.liberty.ws.authnsvc.protocol.SASLResponse;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.sun.identity.liberty.ws.soapbinding.Message;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterimport com.sun.identity.sm.SMSEntry;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster/**
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * The <code>SSOTokenMechanismHandler</code> is a handler for 'SSOTOKEN'
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * mechanism.
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster */
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Fosterpublic class SSOTokenMechanismHandler implements MechanismHandler {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster private static String defaultOrg = SMSEntry.getRootSuffix();
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster private static String MECHANISM_SSOTOKEN = "SSOTOKEN";
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster /**
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * Generates a SASL response according to the SASL request
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * @param saslReq a SASL request
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * @param message a SOAP Message containing the SASL request
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * @param respMessageID messageID of SOAP Message response that will
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * contain returned SASL response
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster * @return a SASL response
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster */
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster public SASLResponse processSASLRequest(SASLRequest saslReq,
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster Message message, String respMessageID) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (AuthnSvcUtils.debug.messageEnabled()) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster AuthnSvcUtils.debug.message(
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "SSOTokenMechanismHandler.processSASLRequest: ");
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster String refToMessageID = saslReq.getRefToMessageID();
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster boolean isFirstRequest = (refToMessageID == null ||
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster refToMessageID.length() == 0);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (AuthnSvcUtils.debug.messageEnabled()) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster AuthnSvcUtils.debug.message(
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "SSOTokenMechanismHandler.processSASLRequest: " +
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "refToMessageID = " + refToMessageID);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster SASLResponse saslResp = null;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster byte[] data = saslReq.getData();
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (data == null) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (isFirstRequest) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp = new SASLResponse(SASLResponse.CONTINUE);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp.setServerMechanism(MECHANISM_SSOTOKEN);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster } else {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp = new SASLResponse(SASLResponse.ABORT);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster } else {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster String dataStr = null;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster try {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster dataStr = new String(data, "UTF-8");
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster } catch (Exception ex) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster AuthnSvcUtils.debug.error(
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "SSOTokenMechanismHandler.processSASLRequest: ", ex);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (dataStr == null) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp = new SASLResponse(SASLResponse.ABORT);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster } else {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp = authenticate(dataStr, message);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (isFirstRequest) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp = new SASLResponse(SASLResponse.CONTINUE);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp.setServerMechanism(MECHANISM_SSOTOKEN);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster return saslResp;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster private SASLResponse authenticate(String data, Message message) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (AuthnSvcUtils.debug.messageEnabled()) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster AuthnSvcUtils.debug.message(
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "SSOTokenMechanismHandler.authenticate: " +
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "SSOTokenID = " + data);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster try {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster SSOTokenManager manager = SSOTokenManager.getInstance();
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster SSOToken token = manager.createSSOToken(data);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster manager.validateToken(token);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster String userDN = token.getPrincipal().getName();
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster SASLResponse saslResp = new SASLResponse(SASLResponse.OK);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster if (!AuthnSvcUtils.setResourceOfferingAndCredentials(
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster saslResp, message, userDN)) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster return new SASLResponse(SASLResponse.ABORT);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster return saslResp;
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster } catch (Exception ex) {
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster AuthnSvcUtils.debug.error(
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster "SSOTokenMechanismHandler.authenticate: ", ex);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster return new SASLResponse(SASLResponse.ABORT);
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster }
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster
4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1cAllan Foster}