IDMUserAuthModule.java revision 32740a05f87c7f3ebb19181cc4b02d228444850c
/*
* The contents of this file are subject to the terms of the Common Development and
* Distribution License (the License). You may not use this file except in compliance with the
* License.
*
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
* specific language governing permission and limitations under the License.
*
* When distributing Covered Software, include this CDDL Header Notice in each file and include
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
* Header, with the fields enclosed by brackets [] replaced by your own identifying
* information: "Portions copyright [year] [name of copyright owner]".
*
* Copyright 2013-2014 ForgeRock Inc.
*/
/**
* Authentication Module for authenticating users against a managed users table.
*
* @author Phill Cunnington
* @author brmiller
*/
public abstract class IDMUserAuthModule extends IDMServerAuthModule {
// property config keys
private final String queryOnResource;
// A list of ports that allow authentication purely based on client certificates (SSL mutual auth)
private AuthHelper authHelper;
/**
* Constructor used by the commons Authentication Filter framework to create an instance of this authentication
* module.
*/
this.queryOnResource = queryOnResource;
public ServerContext access() {
try {
} catch (ResourceException e) {
throw new IllegalStateException("Router context unavailable", e);
}
}
};
}
/**
* Constructor used by tests to inject dependencies.
*
* @param authHelper A mock of an AuthHelper instance.
*/
public IDMUserAuthModule(AuthHelper authHelper, Accessor<ServerContext> accessor, String queryId, String queryOnResource) {
this.queryOnResource = queryOnResource;
this.authHelper = authHelper;
}
/**
* Initialises the ManagedUserAuthModule.
*
* @param requestPolicy {@inheritDoc}
* @param responsePolicy {@inheritDoc}
* @param handler {@inheritDoc}
*/
protected void initialize(MessagePolicy requestPolicy, MessagePolicy responsePolicy, CallbackHandler handler) {
String clientAuthOnlyStr = IdentityServer.getInstance().getProperty("openidm.auth.clientauthonlyports");
if (clientAuthOnlyStr != null) {
}
}
authHelper = new AuthHelper(
}
/**
* Validates the request by authenticating against either the client certificate in the request, internally or
* Basic Authentication from the request header internally.
*
* @param messageInfo {@inheritDoc}
* @param clientSubject {@inheritDoc}
* @param serviceSubject {@inheritDoc}
* @param securityContextMapper {@inheritDoc}
* @return {@inheritDoc}
*/
protected AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject,
boolean authenticated;
// if we see the certificate port this request is for client auth only
if (allowClientCertOnly(req)) {
//Auth success will be logged in IDMServerAuthModule super type.
} else if (headerLogin != null) {
//Auth success will be logged in IDMServerAuthModule super type.
//Auth success will be logged in IDMServerAuthModule super type.
} else {
//Auth failure will be logged in IDMServerAuthModule super type.
return AuthStatus.SEND_FAILURE;
}
if (authenticated) {
return authcid;
}
});
}
}
/**
* Whether to allow authentication purely based on client certificates.
*
* Note that the checking of the certificates MUST be done by setting jetty up for client auth required.
*
* @return true if authentication via client certificate only is sufficient.
*/
}
/**
* Authenticates the request using the client certificate from the request.
*
* @param request The ServletRequest.
*/
// This is currently Jetty specific
private boolean authenticateUsingClientCert(ServletRequest request, SecurityContextMapper securityContextMapper) {
}
}
return false;
}
return true;
}
/**
* Gets the client certificates from the request.
*
* @param request The ServletRequest.
* @return An array of X509Certificates.
*/
// This is currently Jetty specific
if (checkCerts instanceof X509Certificate[]) {
return (X509Certificate[]) checkCerts;
} else {
return null;
}
}
/**
* Authenticates the request.
*
* @param request The HttpServletRequest.
*/
private boolean authenticateUser(HttpServletRequest request, SecurityContextMapper securityContextMapper) {
return false;
}
try {
return authHelper.authenticate(queryId, queryOnResource, username, password, securityContextMapper, accessor.access());
} catch (IllegalStateException e) {
return false;
}
}
/**
* Authenticates the request using the contents of the Http Authorization Header.
*
* @param authorizationHeader The Http Authorization Header value.
*/
private boolean authenticateUsingBasicAuth(String authorizationHeader, SecurityContextMapper securityContextMapper) {
return false;
}
return false;
}
if (t.length != 2) {
return false;
}
try {
return authHelper.authenticate(queryId, queryOnResource, t[0], t[1], securityContextMapper, accessor.access());
} catch (IllegalStateException e) {
return false;
}
}
/**
* No work to do here so always returns AuthStatus.SEND_SUCCESS.
*
* @param messageInfo {@inheritDoc}
* @param serviceSubject {@inheritDoc}
* @return {@inheritDoc}
*/
}
/**
* Nothing to clean up.
*
* @param messageInfo {@inheritDoc}
* @param subject {@inheritDoc}
*/
}
}