Mercurial > dive4elements > river

annotate gwt-client/src/main/java/org/dive4elements/river/client/server/SamlServlet.java @ 6187:7bc35bbd8b27

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Store the SAML ticket in the user object after authentication. The SAML ticket will be needed to allow single sign-on to work for the links into the wiki that are used in several places in the UI. Part of flys/issue1265
author Bernhard Herzog <bh@intevation.de>
date Tue, 04 Jun 2013 17:13:50 +0200
parents b689d2b9d167
children 238fc722f87a
rev   line source
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
1 /* Copyright (C) 2011, 2012, 2013 by Bundesanstalt für Gewässerkunde
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
2 * Software engineering by Intevation GmbH
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
3 *
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
4 * This file is Free Software under the GNU AGPL (>=v3)
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY! Check out the
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
6 * documentation coming with Dive4Elements River for details.
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
7 */
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
8
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
9 package org.dive4elements.river.client.server;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
10
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
11 import java.io.IOException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
12 import java.io.InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
13 import java.io.StringBufferInputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
14
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
15 import javax.servlet.ServletException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
16 import javax.servlet.ServletContext;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
17 import javax.servlet.http.HttpServletRequest;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
18 import javax.servlet.http.HttpServletResponse;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
19
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
20 import org.apache.commons.codec.binary.Base64InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
21
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
22 import org.apache.log4j.Logger;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
23
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
24 import org.dive4elements.river.client.server.auth.AuthenticationException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
25 import org.dive4elements.river.client.server.auth.User;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
26 import org.dive4elements.river.client.server.auth.saml.TicketValidator;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
27 import org.dive4elements.river.client.server.auth.saml.Assertion;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
28 import org.dive4elements.river.client.server.features.Features;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
29
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
30
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
31 public class SamlServlet extends AuthenticationServlet {
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
32
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
33 private static Logger logger = Logger.getLogger(SamlServlet.class);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
34
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
35 @Override
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
36 protected void doPost(HttpServletRequest req, HttpServletResponse resp)
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
37 throws ServletException, IOException
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
38 {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
39 String encoding = req.getCharacterEncoding();
6120
b689d2b9d167 Fix saml parameter name to fix SSO
Andre Heinecke <aheinecke@intevation.de>
parents: 5993
diff changeset
40 String samlTicketXML = req.getParameter("saml");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
41
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
42 logger.debug("Processing post request");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
43
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
44 if (samlTicketXML == null) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
45 logger.debug("No saml ticket provided");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
46 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
47 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
48 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
49
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
50 try {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
51 User user = this.auth(samlTicketXML);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
52 if (user == null) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
53 logger.debug("Authentication not successful");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
54 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
55 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
56 }
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
57 this.performLogin(req, resp, user);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
58 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
59 catch(AuthenticationException e) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
60 logger.error(e, e);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
61 this.redirectFailure(resp, req.getContextPath(), e);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
62 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
63 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
64
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
65 private User auth(String samlTicketXML)
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
66 throws AuthenticationException, IOException
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
67 {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
68 ServletContext sc = this.getServletContext();
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
69
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
70 Assertion assertion = null;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
71 try {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
72 String keyfile =
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
73 (String)sc.getInitParameter("saml-trusted-public-key");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
74 TicketValidator validator =
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
75 new TicketValidator(sc.getRealPath(keyfile));
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
76
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
77 InputStream in = new StringBufferInputStream(samlTicketXML);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
78 assertion = validator.checkTicket(new Base64InputStream(in));
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
79 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
80 catch (Exception e) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
81 logger.error(e.getLocalizedMessage(), e);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
82 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
83 if (assertion == null) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
84 throw new AuthenticationException("Login failed.");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
85 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
86
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
87 Features features = (Features)sc.getAttribute(Features.CONTEXT_ATTRIBUTE);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
88 return new org.dive4elements.river.client.server.auth.saml.User(
6187
7bc35bbd8b27 Store the SAML ticket in the user object after authentication.
Bernhard Herzog <bh@intevation.de>
parents: 6120
diff changeset
89 assertion, samlTicketXML,
7bc35bbd8b27 Store the SAML ticket in the user object after authentication.
Bernhard Herzog <bh@intevation.de>
parents: 6120
diff changeset
90 features.getFeatures(assertion.getRoles()), null);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
91 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
92 }
http://dive4elements.wald.intevation.org