Mercurial > lada > lada-server

annotate src/main/java/de/intevation/lada/util/auth/OpenIDFilter.java @ 555:ac953bee7246 openid

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Interpret session_timeout_minutes as minutes value instead of secs.
author Andre Heinecke <andre.heinecke@intevation.de>
date Fri, 13 Mar 2015 15:20:29 +0100
parents 81cdf448d2cf
children 0e46adb8fcc5
rev   line source
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1 /* Copyright (C) 2015 by Bundesamt fuer Strahlenschutz
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
2 * Software engineering by Intevation GmbH
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
3 *
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
4 * This file is Free Software under the GNU GPL (v>=3)
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY! Check out
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
6 * the documentation coming with IMIS-Labordaten-Application for details.
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
7 */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
8
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
9 package de.intevation.lada.util.auth;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
10
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
11 import org.apache.log4j.Logger;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
12
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
13 import java.util.Map;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
14 import java.util.List;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
15 import java.util.LinkedHashMap;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
16 import java.net.URLDecoder;
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
17 import java.util.Date;
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
18 import java.util.Properties;
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
19 import java.util.Enumeration;
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
20
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
21 import java.io.InputStream;
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
22 import java.io.IOException;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
23
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
24 import javax.servlet.Filter;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
25 import javax.servlet.FilterChain;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
26 import javax.servlet.FilterConfig;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
27 import javax.servlet.ServletContext;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
28 import javax.servlet.ServletException;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
29 import javax.servlet.ServletRequest;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
30 import javax.servlet.ServletResponse;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
31 import javax.servlet.annotation.WebFilter;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
32 import javax.servlet.http.HttpServletRequest;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
33 import javax.servlet.http.HttpServletResponse;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
34 import javax.servlet.http.HttpServletRequestWrapper;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
35 import javax.servlet.http.HttpSession;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
36
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
37 import org.openid4java.association.AssociationSessionType;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
38 import org.openid4java.association.AssociationException;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
39 import org.openid4java.consumer.ConsumerManager;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
40 import org.openid4java.consumer.ConsumerException;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
41 import org.openid4java.consumer.InMemoryConsumerAssociationStore;
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
42 import org.openid4java.consumer.AbstractNonceVerifier;
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
43 import org.openid4java.message.ParameterList;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
44 import org.openid4java.consumer.VerificationResult;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
45 import org.openid4java.discovery.DiscoveryInformation;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
46 import org.openid4java.discovery.Identifier;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
47 import org.openid4java.discovery.DiscoveryException;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
48 import org.openid4java.message.MessageException;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
49 import org.openid4java.message.AuthRequest;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
50
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
51 /** ServletFilter used for OpenID authentification. */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
52 @WebFilter("/*")
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
53 public class OpenIDFilter implements Filter {
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
54
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
55 private static final String CONFIG_FILE = "/openid.properties";
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
56
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
57 /** The name of the header field used to transport OpenID parameters.*/
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
58 private static final String OID_HEADER_DEFAULT = "X-OPENID-PARAMS";
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
59 private String oidHeader;
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
60
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
61 /** The identity provider we accept here. */
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
62 private static final String IDENTITY_PROVIDER_DEFAULT =
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
63 "https://localhost/openid/";
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
64 private String providerUrl;
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
65
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
66 private static final int SESSION_TIMEOUT_DEFAULT_MINUTES = 60;
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
67 private int sessionTimeout;
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
68
554
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
69 private boolean enabled;
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
70
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
71 private static Logger logger = Logger.getLogger(OpenIDFilter.class);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
72
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
73 /** Nonce verifier to allow a session based on openid information.
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
74 *
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
75 * Usually one would create a session for the user but this would not
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
76 * be an advantage here as we want to transport the session in a header
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
77 * anyway.
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
78 *
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
79 * A nonce will be valid as long as as the maxAge is not reached.
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
80 * This is implemented by the basis verifier.
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
81 * We only implement seed no mark that we accept nonce's multiple
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
82 * times.
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
83 */
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
84 private class SessionNonceVerifier extends AbstractNonceVerifier {
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
85 public SessionNonceVerifier(int maxAge) {
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
86 super(maxAge);
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
87 }
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
88
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
89 @Override
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
90 protected int seen(Date now, String opUrl, String nonce) {
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
91 return OK;
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
92 }
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
93 };
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
94
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
95 private ConsumerManager manager;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
96
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
97 /* This should be moved into a map <server->discovered>
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
98 * as we currently only supporting one server this is static. */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
99 boolean discoveryDone = false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
100 private DiscoveryInformation discovered;
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
101
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
102 private boolean discoverServer() {
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
103 /* Perform discovery on the configured providerUrl */
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
104 List discoveries = null;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
105 try {
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
106 discoveries = manager.discover(providerUrl);
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
107 } catch (DiscoveryException e) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
108 logger.debug("Discovery failed: " + e.getMessage());
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
109 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
110 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
111
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
112 if (discoveries == null || discoveries.isEmpty()) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
113 logger.error(
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
114 "Failed discovery step. OpenID provider unavailable?");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
115 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
116 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
117
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
118 /* Add association for the discovered information */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
119 discovered = manager.associate(discoveries);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
120
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
121 return true;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
122 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
123
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
124 /** Split up the OpenID response query provided in the header.
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
125 *
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
126 * @param responseQuery The query provided in the header field.
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
127 * @return The query as ParameterList or null on error.
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
128 */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
129 private ParameterList splitParams(String responseQuery) {
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
130 if (responseQuery == null) {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
131 return null;
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
132 }
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
133 Map<String, String> queryMap =
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
134 new LinkedHashMap<String, String>();
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
135 final String[] pairs = responseQuery.split("&");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
136 for (String pair : pairs) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
137 final int idx = pair.indexOf("=");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
138 if (idx <= 0) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
139 logger.debug("Invalid query.");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
140 return null;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
141 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
142 try {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
143 final String key = URLDecoder.decode(
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
144 pair.substring(0, idx), "UTF-8");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
145
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
146 if (queryMap.containsKey(key)) {
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
147 logger.debug("Duplicate key: " + key + " ignored.");
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
148 continue;
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
149 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
150 final String value = URLDecoder.decode(
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
151 pair.substring(idx + 1), "UTF-8");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
152 queryMap.put(key, value);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
153 } catch (java.io.UnsupportedEncodingException e) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
154 logger.error("UTF-8 unkown?!");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
155 return null;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
156 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
157 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
158 if (queryMap.isEmpty()) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
159 logger.debug("Empty query.");
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
160 return null;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
161 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
162 return new ParameterList(queryMap);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
163 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
164
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
165 private boolean checkOpenIDHeader(ServletRequest req) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
166
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
167 HttpServletRequest hReq = (HttpServletRequest) req;
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
168
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
169 /* Debug code to dump headers
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
170 Enumeration<String> headerNames = hReq.getHeaderNames();
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
171 while (headerNames.hasMoreElements()) {
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
172 String headerName = headerNames.nextElement();
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
173 logger.debug("Header: " + headerName);
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
174 Enumeration<String> headers = hReq.getHeaders(headerName);
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
175 while (headers.hasMoreElements()) {
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
176 String headerValue = headers.nextElement();
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
177 logger.debug("Value: " + headerValue);
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
178 }
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
179 }
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
180 */
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
181 /* First check if the header is provided at all */
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
182 String oidParamString = hReq.getHeader(oidHeader);
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
183
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
184 if (oidParamString == null) {
548
95a48e1f1a26 Fix return_url handling and send params to client in header
Andre Heinecke <andre.heinecke@intevation.de>
parents: 547
diff changeset
185 logger.debug("Header " + oidHeader + " not provided. Trying params.");
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
186 oidParamString = hReq.getQueryString();
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
187 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
188
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
189 /* Parse the parameters to a map for openid4j */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
190 ParameterList oidParams = splitParams(oidParamString);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
191 if (oidParams == null) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
192 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
193 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
194
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
195 /* Verify against the discovered server. */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
196 VerificationResult verification = null;
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
197 String receivingURL = oidParams.getParameterValue("openid.return_to");
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
198
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
199 try {
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
200 verification = manager.verify(receivingURL, oidParams,
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
201 discovered);
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
202 } catch (MessageException e) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
203 logger.debug("Verification failed: " + e.getMessage());
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
204 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
205 } catch (DiscoveryException e) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
206 logger.debug("Verification discovery exception: " + e.getMessage());
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
207 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
208 } catch (AssociationException e) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
209 logger.debug("Verification assoc exception: " + e.getMessage());
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
210 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
211 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
212
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
213 /* See what could be verified */
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
214 Identifier verified = verification.getVerifiedId();
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
215 if (verified == null) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
216 logger.debug("Failed to verify Identity information: " +
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
217 verification.getStatusMsg());
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
218 return false;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
219 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
220
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
221 logger.debug("Verified user: " + verified);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
222
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
223 return true;
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
224 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
225
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
226 @Override
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
227 public void init(FilterConfig config)
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
228 throws ServletException
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
229 {
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
230 /* Read config and initialize configuration variables */
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
231 Properties properties = new Properties();
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
232 InputStream stream = null;
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
233 try {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
234 stream = getClass().getResourceAsStream(CONFIG_FILE);
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
235 properties.load(stream);
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
236 stream.close();
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
237 } catch (java.io.FileNotFoundException e) {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
238 logger.error ("Failed to find config file: " + CONFIG_FILE);
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
239 } catch (java.io.IOException e) {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
240 logger.error ("Failed to read config file: " + CONFIG_FILE);
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
241 }
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
242 try {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
243 sessionTimeout = Integer.parseInt(
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
244 properties.getProperty("session_timeout_minutes"));
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
245 } catch (NumberFormatException e) {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
246 sessionTimeout = SESSION_TIMEOUT_DEFAULT_MINUTES;
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
247 }
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
248 oidHeader = properties.getProperty("oidHeader", OID_HEADER_DEFAULT);
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
249 providerUrl = properties.getProperty("identity_provider",
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
250 IDENTITY_PROVIDER_DEFAULT);
554
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
251 enabled = !properties.getProperty("enabled",
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
252 "true").toLowerCase().equals("false");
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
253
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
254 manager = new ConsumerManager();
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
255 /* We probably want to implement our own association store to keep
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
256 * associations persistent. */
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
257 manager.setAssociations(new InMemoryConsumerAssociationStore());
555
ac953bee7246 Interpret session_timeout_minutes as minutes value instead of secs.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 554
diff changeset
258 manager.setNonceVerifier(new SessionNonceVerifier(sessionTimeout * 60));
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
259 manager.setMinAssocSessEnc(AssociationSessionType.DH_SHA256);
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
260 discoveryDone = discoverServer();
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
261 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
262
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
263 @Override
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
264 public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
265 throws IOException, ServletException
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
266 {
554
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
267 if (!enabled) {
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
268 /* If we are not enabled we pass everything through */
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
269 logger.debug("OpenID filter disabled. Passing through.");
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
270 chain.doFilter(req, resp);
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
271 return;
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
272 }
81cdf448d2cf Add option to completely disable the openIDFilter
Andre Heinecke <andre.heinecke@intevation.de>
parents: 551
diff changeset
273
548
95a48e1f1a26 Fix return_url handling and send params to client in header
Andre Heinecke <andre.heinecke@intevation.de>
parents: 547
diff changeset
274 HttpServletRequest hReq = (HttpServletRequest) req;
95a48e1f1a26 Fix return_url handling and send params to client in header
Andre Heinecke <andre.heinecke@intevation.de>
parents: 547
diff changeset
275 HttpServletResponse hResp = (HttpServletResponse) resp;
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
276 if (!discoveryDone) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
277 discoveryDone = discoverServer();
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
278 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
279 if (discoveryDone && checkOpenIDHeader(req)) {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
280 /** Successfully authenticated. */
548
95a48e1f1a26 Fix return_url handling and send params to client in header
Andre Heinecke <andre.heinecke@intevation.de>
parents: 547
diff changeset
281 hResp.addHeader(oidHeader, hReq.getQueryString().replace(
95a48e1f1a26 Fix return_url handling and send params to client in header
Andre Heinecke <andre.heinecke@intevation.de>
parents: 547
diff changeset
282 "is_return=true",""));
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
283 chain.doFilter(req, resp);
546
b691c8697e6f Implement pseudo session based on OpenID nonce
Andre Heinecke <andre.heinecke@intevation.de>
parents: 545
diff changeset
284 return;
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
285 }
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
286 String authRequestURL = "Error communicating with openid server";
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
287 int errorCode = 698;
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
288 if (discoveryDone) {
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
289 /* Parse the parameters to a map for openid4j */
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
290 ParameterList params = splitParams(hReq.getQueryString());
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
291 String returnToUrl;
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
292 if (params == null) {
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
293 logger.debug("Failed to get any parameters from url.");
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
294 hResp.reset();
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
295 hResp.setStatus(401);
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
296 hResp.getOutputStream().print("{\"success\":false,\"message\":\"" + errorCode + "\",\"data\":" +
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
297 "\"No return url provided!\",\"errors\":{},\"warnings\":{}," +
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
298 "\"readonly\":false,\"totalCount\":0}");
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
299 hResp.getOutputStream().flush();
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
300 return;
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
301 } else {
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
302 returnToUrl = params.getParameterValue("return_to");
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
303 }
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
304 try {
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
305 /*
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
306 String returnToUrl = hReq.getRequestURL().toString()
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
307 + "?is_return=true";*/
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
308 AuthRequest authReq = manager.authenticate(discovered,
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
309 returnToUrl);
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
310 authRequestURL = authReq.getDestinationUrl(true);
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
311 errorCode = 699;
547
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
312 } catch (MessageException e) {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
313 logger.debug("Failed to create the Authentication request: " +
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
314 e.getMessage());
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
315 } catch (ConsumerException e) {
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
316 logger.debug("Error in consumer manager: " +
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
317 e.getMessage());
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
318 }
f9f1edd30b33 Get openid configuration from properties file and start on return url handling
Andre Heinecke <andre.heinecke@intevation.de>
parents: 546
diff changeset
319 }
550
fff43091ccc9 Send raw response on authentication failure instead of HTTP error document.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 548
diff changeset
320 hResp.reset();
fff43091ccc9 Send raw response on authentication failure instead of HTTP error document.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 548
diff changeset
321 hResp.setStatus(401);
551
68c8b9e5f3e9 Let the return to url be handled by the client.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 550
diff changeset
322 hResp.getOutputStream().print("{\"success\":false,\"message\":\"" + errorCode + "\",\"data\":" +
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
323 "\"" + authRequestURL + "\",\"errors\":{},\"warnings\":{}," +
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
324 "\"readonly\":false,\"totalCount\":0}");
550
fff43091ccc9 Send raw response on authentication failure instead of HTTP error document.
Andre Heinecke <andre.heinecke@intevation.de>
parents: 548
diff changeset
325 hResp.getOutputStream().flush();
545
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
326 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
327 @Override
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
328 public void destroy()
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
329 {
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
330 }
8e3f57e2f4af Change openID authentication to a filter.
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
331 };
This site is hosted by Intevation GmbH (Datenschutzerklärung und Impressum | Privacy Policy and Imprint)