Mercurial > dive4elements > river

annotate gwt-client/src/main/java/org/dive4elements/river/client/server/SamlServlet.java @ 9497:d6d5ca6d4af0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Enabled logging of saml-group-name in log-ing logfile. Some cleanup/refaktoring.
author gernotbelger
date Thu, 27 Sep 2018 17:40:39 +0200
parents 5e38e2924c07
children ca19b7186294
rev   line source
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
1 /* Copyright (C) 2011, 2012, 2013 by Bundesanstalt für Gewässerkunde
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
2 * Software engineering by Intevation GmbH
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
3 *
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
4 * This file is Free Software under the GNU AGPL (>=v3)
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY! Check out the
5993
ea9eef426962 Removed trailing whitespace.
Sascha L. Teichmann <teichmann@intevation.de>
parents: 5953
diff changeset
6 * documentation coming with Dive4Elements River for details.
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
7 */
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
8
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
9 package org.dive4elements.river.client.server;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
10
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
11 import java.io.IOException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
12 import java.io.InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
13 import java.io.StringBufferInputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
14
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
15 import javax.servlet.ServletContext;
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
16 import javax.servlet.ServletException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
17 import javax.servlet.http.HttpServletRequest;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
18 import javax.servlet.http.HttpServletResponse;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
19
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
20 import org.apache.commons.codec.binary.Base64InputStream;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
21 import org.apache.log4j.Logger;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
22 import org.dive4elements.river.client.server.auth.AuthenticationException;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
23 import org.dive4elements.river.client.server.auth.User;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
24 import org.dive4elements.river.client.server.auth.saml.Assertion;
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
25 import org.dive4elements.river.client.server.auth.saml.TicketValidator;
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
26 import org.dive4elements.river.client.server.auth.was.Response;
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
27 import org.dive4elements.river.client.server.features.Features;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
28
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
29 public class SamlServlet extends AuthenticationServlet {
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
30
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
31 private static Logger log = Logger.getLogger(SamlServlet.class);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
32
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
33 @Override
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
34 protected void doPost(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
35 // final String encoding = req.getCharacterEncoding();
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
36 final String samlTicketXML = req.getParameter("saml");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
37
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
38 log.debug("Processing post request");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
39
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
40 if (samlTicketXML == null) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
41 log.debug("No saml ticket provided");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
42 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
43 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
44 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
45
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
46 try {
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
47 final User user = this.auth(samlTicketXML);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
48 if (user == null) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
49 log.debug("Authentication not successful");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
50 this.redirectFailure(resp, req.getContextPath());
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
51 return;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
52 }
5953
24dc13ac8e6c Add AuthenticationServlet, a common base class for the login servlets
Bernhard Herzog <bh@intevation.de>
parents: 5950
diff changeset
53 this.performLogin(req, resp, user);
8525
5aff82e77ec3 (issue1777) Move logging code for existing tickets to the correct location
Andre Heinecke <andre.heinecke@intevation.de>
parents: 8203
diff changeset
54 log.info("Authentication with existing SAML ticket.");
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
55 }
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
56 catch (final AuthenticationException e) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
57 log.error(e, e);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
58 this.redirectFailure(resp, req.getContextPath(), e);
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
59 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
60 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
61
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
62 private User auth(final String samlTicketXML) throws AuthenticationException {
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
63 final ServletContext sc = this.getServletContext();
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
64
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
65 Assertion assertion = null;
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
66 try {
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
67 final String keyfile = sc.getInitParameter("saml-trusted-public-key");
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
68 final int timeEps = Integer.parseInt(sc.getInitParameter("saml-time-tolerance"));
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
69 final TicketValidator validator = new TicketValidator(sc.getRealPath(keyfile), timeEps);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
70
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
71 final InputStream in = new StringBufferInputStream(samlTicketXML);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
72 assertion = validator.checkTicket(new Base64InputStream(in));
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
73 }
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
74 catch (final Exception e) {
8203
238fc722f87a sed 's/logger/log/g' src/**/*.java
Sascha L. Teichmann <teichmann@intevation.de>
parents: 6187
diff changeset
75 log.error(e.getLocalizedMessage(), e);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
76 }
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
77
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
78 if (assertion == null)
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
79 throw new AuthenticationException("Login failed.");
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
80
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
81 final Features features = (Features) sc.getAttribute(Features.CONTEXT_ATTRIBUTE);
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
82
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
83 return Response.createUser(null, samlTicketXML, assertion, features);
5950
38d161edba77 Add SamlServlet to implement actual login via SAML Ticket.
Bernhard Herzog <bh@intevation.de>
parents:
diff changeset
84 }
9497
d6d5ca6d4af0 Enabled logging of saml-group-name in log-ing logfile.
gernotbelger
parents: 8856
diff changeset
85 }
http://dive4elements.wald.intevation.org