Mercurial > dive4elements > river

annotate gwt-client/src/main/java/org/dive4elements/river/client/server/SamlServlet.java @ 9726:0a5239a1e46e 3.2.x

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Upgrade to Log4j 2
author Tom Gottfried <tom@intevation.de>
date Wed, 02 Mar 2022 10:26:50 +0100
parents 5e38e2924c07
children cfc0aab9947f
rev   line source
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
1 /* Copyright (C) 2011, 2012, 2013 by Bundesanstalt für Gewässerkunde
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
2 * Software engineering by Intevation GmbH
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
3 *
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
4 * This file is Free Software under the GNU AGPL (>=v3)
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY! Check out the
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
6 * documentation coming with Dive4Elements River for details.
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
7 */
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
8
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
9 package org.dive4elements.river.client.server;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
10
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
11 import java.io.IOException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
12 import java.io.InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
13 import java.io.StringBufferInputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
14
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
15 import javax.servlet.ServletException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
16 import javax.servlet.ServletContext;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
17 import javax.servlet.http.HttpServletRequest;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
18 import javax.servlet.http.HttpServletResponse;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
19
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
20 import org.apache.commons.codec.binary.Base64InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
21
9726
0a5239a1e46e Upgrade to Log4j 2
Tom Gottfried <tom@intevation.de>
parents: 8856
diff changeset
22 import org.apache.logging.log4j.Logger;
0a5239a1e46e Upgrade to Log4j 2
Tom Gottfried <tom@intevation.de>
parents: 8856
diff changeset
23 import org.apache.logging.log4j.LogManager;
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
24
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
25 import org.dive4elements.river.client.server.auth.AuthenticationException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
26 import org.dive4elements.river.client.server.auth.User;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
27 import org.dive4elements.river.client.server.auth.saml.TicketValidator;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
28 import org.dive4elements.river.client.server.auth.saml.Assertion;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
29 import org.dive4elements.river.client.server.features.Features;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
30
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
31
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
32 public class SamlServlet extends AuthenticationServlet {
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
33
9726
0a5239a1e46e Upgrade to Log4j 2
Tom Gottfried <tom@intevation.de>
parents: 8856
diff changeset
34 private static Logger log = LogManager.getLogger(SamlServlet.class);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
35
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
36 @Override
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
37 protected void doPost(HttpServletRequest req, HttpServletResponse resp)
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
38 throws ServletException, IOException
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
39 {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
40 String encoding = req.getCharacterEncoding();
6120
b689d2b9d167 Fix saml parameter name to fix SSO
Andre Heinecke <aheinecke@intevation.de>
parents: 5993
diff changeset
41 String samlTicketXML = req.getParameter("saml");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
42
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
43 log.debug("Processing post request");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
44
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
45 if (samlTicketXML == null) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
46 log.debug("No saml ticket provided");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
47 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
48 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
49 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
50
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
51 try {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
52 User user = this.auth(samlTicketXML);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
53 if (user == null) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
54 log.debug("Authentication not successful");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
55 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
56 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
57 }
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
58 this.performLogin(req, resp, user);
8525
5aff82e77ec3 (issue1777) Move logging code for existing tickets to the correct location
Andre Heinecke <andre.heinecke@intevation.de>
parents: 8203
diff changeset
59 log.info("Authentication with existing SAML ticket.");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
60 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
61 catch(AuthenticationException e) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
62 log.error(e, e);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
63 this.redirectFailure(resp, req.getContextPath(), e);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
64 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
65 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
66
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
67 private User auth(String samlTicketXML)
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
68 throws AuthenticationException, IOException
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
69 {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
70 ServletContext sc = this.getServletContext();
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
71
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
72 Assertion assertion = null;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
73 try {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
74 String keyfile =
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
75 (String)sc.getInitParameter("saml-trusted-public-key");
8840
98a3cf810916 Fix client build.
Tom Gottfried <tom@intevation.de>
parents: 8525
diff changeset
76 int timeEps = Integer.parseInt(
98a3cf810916 Fix client build.
Tom Gottfried <tom@intevation.de>
parents: 8525
diff changeset
77 sc.getInitParameter("saml-time-tolerance"));
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
78 TicketValidator validator =
8840
98a3cf810916 Fix client build.
Tom Gottfried <tom@intevation.de>
parents: 8525
diff changeset
79 new TicketValidator(sc.getRealPath(keyfile), timeEps);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
80
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
81 InputStream in = new StringBufferInputStream(samlTicketXML);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
82 assertion = validator.checkTicket(new Base64InputStream(in));
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
83 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
84 catch (Exception e) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
85 log.error(e.getLocalizedMessage(), e);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
86 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
87 if (assertion == null) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
88 throw new AuthenticationException("Login failed.");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
89 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
90
8856
5e38e2924c07 Fix code style.
Tom Gottfried <tom@intevation.de>
parents: 8840
diff changeset
91 Features features = (Features)sc.getAttribute(
5e38e2924c07 Fix code style.
Tom Gottfried <tom@intevation.de>
parents: 8840
diff changeset
92 Features.CONTEXT_ATTRIBUTE);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
93 return new org.dive4elements.river.client.server.auth.saml.User(
6187
7bc35bbd8b27 Store the SAML ticket in the user object after authentication.
Bernhard Herzog <bh@intevation.de>
parents: 6120
diff changeset
94 assertion, samlTicketXML,
7bc35bbd8b27 Store the SAML ticket in the user object after authentication.
Bernhard Herzog <bh@intevation.de>
parents: 6120
diff changeset
95 features.getFeatures(assertion.getRoles()), null);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
96 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
97 }
http://dive4elements.wald.intevation.org