Mercurial > dive4elements > river

annotate gwt-client/src/main/java/org/dive4elements/river/client/server/SamlServlet.java @ 9747:cfc0aab9947f 3.2.x

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Enable bind-mounting client configuration in docker container
author Tom Gottfried <tom@intevation.de>
date Mon, 05 Sep 2022 17:55:32 +0200
parents 0a5239a1e46e
children
rev   line source
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
1 /* Copyright (C) 2011, 2012, 2013 by Bundesanstalt für Gewässerkunde
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
2 * Software engineering by Intevation GmbH
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
3 *
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
4 * This file is Free Software under the GNU AGPL (>=v3)
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY! Check out the
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
6 * documentation coming with Dive4Elements River for details.
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
7 */
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
8
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
9 package org.dive4elements.river.client.server;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
10
9747
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
11 import java.io.File;
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
12 import java.io.IOException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
13 import java.io.InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
14 import java.io.StringBufferInputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
15
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
16 import javax.servlet.ServletException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
17 import javax.servlet.ServletContext;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
18 import javax.servlet.http.HttpServletRequest;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
19 import javax.servlet.http.HttpServletResponse;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
20
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
21 import org.apache.commons.codec.binary.Base64InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
22
9726
0a5239a1e46e Upgrade to Log4j 2
Tom Gottfried <tom@intevation.de>
parents: 8856
diff changeset
23 import org.apache.logging.log4j.Logger;
0a5239a1e46e Upgrade to Log4j 2
Tom Gottfried <tom@intevation.de>
parents: 8856
diff changeset
24 import org.apache.logging.log4j.LogManager;
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
25
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
26 import org.dive4elements.river.client.server.auth.AuthenticationException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
27 import org.dive4elements.river.client.server.auth.User;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
28 import org.dive4elements.river.client.server.auth.saml.TicketValidator;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
29 import org.dive4elements.river.client.server.auth.saml.Assertion;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
30 import org.dive4elements.river.client.server.features.Features;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
31
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
32
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
33 public class SamlServlet extends AuthenticationServlet {
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
34
9726
0a5239a1e46e Upgrade to Log4j 2
Tom Gottfried <tom@intevation.de>
parents: 8856
diff changeset
35 private static Logger log = LogManager.getLogger(SamlServlet.class);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
36
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
37 @Override
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
38 protected void doPost(HttpServletRequest req, HttpServletResponse resp)
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
39 throws ServletException, IOException
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
40 {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
41 String encoding = req.getCharacterEncoding();
6120
b689d2b9d167 Fix saml parameter name to fix SSO
Andre Heinecke <aheinecke@intevation.de>
parents: 5993
diff changeset
42 String samlTicketXML = req.getParameter("saml");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
43
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
44 log.debug("Processing post request");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
45
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
46 if (samlTicketXML == null) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
47 log.debug("No saml ticket provided");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
48 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
49 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
50 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
51
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
52 try {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
53 User user = this.auth(samlTicketXML);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
54 if (user == null) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
55 log.debug("Authentication not successful");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
56 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
57 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
58 }
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
59 this.performLogin(req, resp, user);
8525
5aff82e77ec3 (issue1777) Move logging code for existing tickets to the correct location
Andre Heinecke <andre.heinecke@intevation.de>
parents: 8203
diff changeset
60 log.info("Authentication with existing SAML ticket.");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
61 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
62 catch(AuthenticationException e) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
63 log.error(e, e);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
64 this.redirectFailure(resp, req.getContextPath(), e);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
65 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
66 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
67
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
68 private User auth(String samlTicketXML)
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
69 throws AuthenticationException, IOException
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
70 {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
71 ServletContext sc = this.getServletContext();
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
72
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
73 Assertion assertion = null;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
74 try {
9747
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
75 File keyfile = new File(
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
76 sc.getInitParameter("saml-trusted-public-key"));
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
77 String path = keyfile.isAbsolute()
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
78 ? keyfile.getPath()
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
79 : sc.getRealPath(keyfile.getPath());
8840
98a3cf810916 Fix client build.
Tom Gottfried <tom@intevation.de>
parents: 8525
diff changeset
80 int timeEps = Integer.parseInt(
98a3cf810916 Fix client build.
Tom Gottfried <tom@intevation.de>
parents: 8525
diff changeset
81 sc.getInitParameter("saml-time-tolerance"));
9747
cfc0aab9947f Enable bind-mounting client configuration in docker container
Tom Gottfried <tom@intevation.de>
parents: 9726
diff changeset
82 TicketValidator validator = new TicketValidator(path, timeEps);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
83
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
84 InputStream in = new StringBufferInputStream(samlTicketXML);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
85 assertion = validator.checkTicket(new Base64InputStream(in));
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
86 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
87 catch (Exception e) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
88 log.error(e.getLocalizedMessage(), e);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
89 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
90 if (assertion == null) {
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
91 throw new AuthenticationException("Login failed.");
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
92 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
93
8856
5e38e2924c07 Fix code style.
Tom Gottfried <tom@intevation.de>
parents: 8840
diff changeset
94 Features features = (Features)sc.getAttribute(
5e38e2924c07 Fix code style.
Tom Gottfried <tom@intevation.de>
parents: 8840
diff changeset
95 Features.CONTEXT_ATTRIBUTE);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
96 return new org.dive4elements.river.client.server.auth.saml.User(
6187
7bc35bbd8b27 Store the SAML ticket in the user object after authentication.
Bernhard Herzog <bh@intevation.de>
parents: 6120
diff changeset
97 assertion, samlTicketXML,
7bc35bbd8b27 Store the SAML ticket in the user object after authentication.
Bernhard Herzog <bh@intevation.de>
parents: 6120
diff changeset
98 features.getFeatures(assertion.getRoles()), null);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
99 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
100 }
http://dive4elements.wald.intevation.org