Federation.java revision 4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1c
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk/**
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * The contents of this file are subject to the terms
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * of the Common Development and Distribution License
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * (the License). You may not use this file except in
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * compliance with the License.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * You can obtain a copy of the License at
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * https://opensso.dev.java.net/public/CDDLv1.0.html or
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * opensso/legal/CDDLv1.0.txt
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * See the License for the specific language governing
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * permission and limitations under the License.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * When distributing Covered Code, include this CDDL
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Header Notice in each file and include the License file
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * at opensso/legal/CDDLv1.0.txt.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * If applicable, add the following below the CDDL Header,
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * with the fields enclosed by brackets [] replaced by
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * your own identifying information:
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * "Portions Copyrighted [year] [name of copyright owner]"
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * $Id: Federation.java,v 1.3 2009/01/28 05:35:10 ww203982 Exp $
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkpackage com.sun.identity.authentication.modules.federation;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.shared.debug.Debug;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.shared.datastruct.CollectionHelper;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.iplanet.sso.SSOToken;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.authentication.spi.AMLoginModule;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.authentication.spi.AuthLoginException;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.authentication.util.ISAuthConstants;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.plugin.session.SessionProvider;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport com.sun.identity.plugin.session.impl.FMSessionProvider;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.io.IOException;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.ArrayList;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.Date;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.HashMap;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.Iterator;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.List;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.Map;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.util.ResourceBundle;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport java.security.Principal;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport javax.security.auth.Subject;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport javax.security.auth.callback.Callback;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport javax.security.auth.callback.CallbackHandler;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport javax.security.auth.callback.NameCallback;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkimport javax.security.auth.callback.UnsupportedCallbackException;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk// import com.sun.identity.shared.ldap.util.DN;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenkpublic class Federation extends AMLoginModule {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk private String userName = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk private Principal userPrincipal = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk private static final String fmAuthFederation = "fmAuthFederation";
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk private static Debug debug = Debug.getInstance(fmAuthFederation);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk private ResourceBundle bundle = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk static private String AUTH_LEVEL = ISAuthConstants.AUTH_ATTR_PREFIX_NEW +
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk "FederationAuthLevel";
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk private CallbackHandler callbackHandler;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk /**
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Constructor
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk public Federation() {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.message("Federation()");
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk /**
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Initialize parameters.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk public void init(Subject subject, Map sharedState, Map options) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.message("in initialize...");
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk java.util.Locale locale = getLoginLocale();
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk bundle = amCache.getResBundle(fmAuthFederation, locale);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk if (debug.messageEnabled()) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.message(
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk "fmAuthFederation Authentication resource bundle locale="+
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk locale);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk this.callbackHandler = getCallbackHandler();
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk if (options != null) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk String authLevelStr = CollectionHelper.getMapAttr(
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk options, AUTH_LEVEL);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk if (authLevelStr != null) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk try {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk setAuthLevel(Integer.parseInt(authLevelStr));
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk } catch (Exception e) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.error("Unable to set auth level " +
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk authLevelStr,e);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk /**
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Process the authentication request.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * @return ISAuthConstants.LOGIN_SUCCEED as succeeded;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * ISAuthConstants.LOGIN_IGNORE as failed.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * @exception AuthLoginException upon any failure. login state should be
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * kept on exceptions for status check in auth chaining.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk public int process(Callback[] callbacks, int state)
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk throws AuthLoginException {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk String randomSecret = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk String principalName = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk String authLevel = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk try {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk Callback[] cbs = new Callback[3];
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk cbs[0] = new NameCallback(FMSessionProvider.RANDOM_SECRET);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk cbs[1] = new NameCallback(SessionProvider.PRINCIPAL_NAME);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk cbs[2] = new NameCallback(SessionProvider.AUTH_LEVEL);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk callbackHandler.handle(cbs);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk randomSecret = ((NameCallback)cbs[0]).getName();
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk principalName = ((NameCallback)cbs[1]).getName();
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk authLevel = ((NameCallback)cbs[2]).getName();
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk } catch (IllegalArgumentException ill) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk throw new AuthLoginException(fmAuthFederation, "IllegalArgs", null);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk } catch (IOException ioe) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk throw new AuthLoginException(ioe);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk } catch (UnsupportedCallbackException uce) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk throw new AuthLoginException(fmAuthFederation, "UnsupportedCallback",
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk null);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk if (!FMSessionProvider.matchSecret(randomSecret)) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk throw new AuthLoginException(fmAuthFederation, "NoMatchingSecret",
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk null);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk // TBD: This piece may or may not be needed
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk /*
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk DN dnObject = new DN(userName);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk String [] array = dnObject.explodeDN(true);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk userName = array[0];
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.message("Module is successful");
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk storeUsernamePasswd(principalName, null);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk userName = principalName;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk if (authLevel != null && authLevel.length() != 0) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk try {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk int authLevelInt = Integer.parseInt(authLevel);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk setAuthLevel(authLevelInt);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk } catch (Exception e) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.error("Unable to set auth level " +
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk authLevel,e);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk return ISAuthConstants.LOGIN_SUCCEED;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk /**
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Returns principal of the authenticated user.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * @return Principal of the authenticated user.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk public Principal getPrincipal() {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk if (userPrincipal == null && userName != null) {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk userPrincipal = new FederationPrincipal(userName);
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk return userPrincipal;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk /**
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * Clean up the login state.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk public void destroyModuleState() {
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk debug.message("clean up module state");
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk userName = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk userPrincipal = null;
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk }
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk}
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk