IWAModule.java revision 0c3f79f75f596c8d6700b2de830000f754bb28a9
/*
* The contents of this file are subject to the terms of the Common Development and
* Distribution License (the License). You may not use this file except in compliance with the
* License.
*
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
* specific language governing permission and limitations under the License.
*
* When distributing Covered Software, include this CDDL Header Notice in each file and include
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
* Header, with the fields enclosed by brackets [] replaced by your own identifying
* information: "Portions copyright [year] [name of copyright owner]".
*
* Copyright 2013-2014 ForgeRock AS.
*/
/**
* Commons Authentication Filter module to provide authentication using IWA.
*
* @author Phill Cunnington
*/
public class IWAModule implements ServerAuthModule {
/**
* Constructor used by the commons Authentication Filter framework to create an instance of this authentication
* module.
*/
public IWAModule() {
}
/**
* Constructor used by tests to inject dependencies.
*
* @param commonsIwaModule A mock of the Commons IWAModule.
*/
this.commonsIwaModule = commonsIwaModule;
}
/**
* {@inheritDoc}
*/
public final Class[] getSupportedMessageTypes() {
}
/**
* Initialises the commons IWA authentication module.
*
*
* @param requestPolicy {@inheritDoc}
* @param responsePolicy {@inheritDoc}
* @param handler {@inheritDoc}
* @throws AuthException {@inheritDoc}
*/
public void initialize(MessagePolicy requestPolicy, MessagePolicy responsePolicy, CallbackHandler handler, Map options) throws AuthException {
}
/**
* Uses the IWA authentication to handle the authentication process.
*
* AuthStatus.SEND_CONTINUE is returned with the response Http code set to 401 unauthorized and a Negotiate header.
* If IWA is enabled on the client then the subsequent request will contain the Kerberos token and
* AuthStatus.SUCCESS will be returned for a successful authentication and AuthStatus.SEND_FAILURE if authentication
* fails/
*
* @param messageInfo {@inheritDoc}
* @param clientSubject {@inheritDoc}
* @param serviceSubject {@inheritDoc}
* @return {@inheritDoc}
* @throws AuthException {@inheritDoc}
*/
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {
try {
AuthStatus authStatus = commonsIwaModule.validateRequest(messageInfo, clientSubject, serviceSubject);
return authStatus;
}
break;
}
}
throw new AuthException("Could not get username");
}
// Need to set as much information as possible so it can be put in both the request and JWT for IDM
// and later use
SecurityContextMapper.fromMessageInfo(principal, messageInfo).setResource("system/AD/account");//TODO shouldn't this be configurable?...
//Auth success will be logged in IDMServerAuthModule super type.
return AuthStatus.SUCCESS;
} catch (AuthException e) {
// fallback to AD passthrough
//Auth failure will be logged in IDMServerAuthModule super type.
return AuthStatus.SEND_FAILURE;
} finally {
}
}
/**
* No work to do here so always returns AuthStatus.SEND_SUCCESS.
*
* @param messageInfo {@inheritDoc}
* @param serviceSubject {@inheritDoc}
* @return {@inheritDoc}
*/
return AuthStatus.SEND_SUCCESS;
}
/**
* Nothing to clean up.
*
* @param messageInfo {@inheritDoc}
* @param subject {@inheritDoc}
*/
}
}