package org.jboss.as.jacorb.security;
import java.io.IOException;
import java.io.InputStream;
import java.security.Principal;
import java.security.acl.Group;
import java.util.Map;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import org.jboss.as.jacorb.csiv2.idl.SASCurrent;
import org.jboss.security.auth.callback.SecurityAssociationCallback;
import org.jboss.security.auth.spi.AbstractServerLoginModule;
/**
* Login module that allows a user to authenticate as long as an identity token is present.
* <p/>
* Subclasses can override {@link #validateCredential(String, org.jboss.as.jacorb.csiv2.idl.SASCurrent)} to
* implement identity token validation logic.
* <p/>
* WARNING: Installing this class as a login module without subclassing and implementing validation essentially
* means that the server will trust any incoming CORBA invocation.
*
* @author Stuart Douglas
*/
public class TrustedIdentityTokenLoginModule extends AbstractServerLoginModule {
/**
* The login identity
*/
private Principal identity;
/**
* The proof of login identity
*/
private SASCurrent credential;
@Override
public void initialize(Subject subject, CallbackHandler callbackHandler,
Map<String, ?> sharedState, Map<String, ?> options) {
super.initialize(subject, callbackHandler, sharedState, options);
}
@Override
@SuppressWarnings("unchecked")
public boolean login() throws LoginException {
// See if shared credentials exist
if (super.login() == true) {
// Setup our view of the user
Object username = sharedState.get("javax.security.auth.login.name");
if (username instanceof Principal)
identity = (Principal) username;
else {
String name = username.toString();
try {
identity = createIdentity(name);
} catch (Exception e) {
LoginException le = new LoginException();
le.initCause(e);
throw le;
}
}
return true;
}
super.loginOk = false;
if (callbackHandler == null) {
throw new LoginException();
}
SecurityAssociationCallback callback = new SecurityAssociationCallback();
Callback[] callbacks = {callback};
final String username;
try {
callbackHandler.handle(callbacks);
username = callback.getPrincipal().getName();
final Object c = callback.getCredential();
if (c instanceof SASCurrent) {
credential = (SASCurrent) c;
} else {
return false;
}
} catch (IOException e) {
LoginException le = new LoginException();
le.initCause(e);
throw le;
} catch (UnsupportedCallbackException e) {
LoginException le = new LoginException();
le.initCause(e);
throw le;
}
validateCredential(username, credential);
if (username == null) {
return false;
}
if (identity == null) {
try {
identity = createIdentity(username);
} catch (Exception e) {
LoginException le = new LoginException();
le.initCause(e);
throw le;
}
}
if (getUseFirstPass() == true) { // Add the principal to the shared state map
sharedState.put("javax.security.auth.login.name", identity);
sharedState.put("javax.security.auth.login.password", credential);
}
super.loginOk = true;
return true;
}
/**
* Validates the credential. Unfortunately there is not much we can do here by default.
* <p/>
* This method can be overridden to provide some real validation logic
*
* @param username The username
* @param credential The SASCurrent.
*/
protected void validateCredential(final String username, final SASCurrent credential) throws LoginException {
if (credential.get_incoming_principal_name() == null ||
credential.get_incoming_principal_name().length == 0) {
throw new LoginException();
}
}
@Override
protected Principal getIdentity() {
return identity;
}
@Override
protected Group[] getRoleSets() throws LoginException {
return new Group[0];
}
@Override
protected Principal getUnauthenticatedIdentity() {
return unauthenticatedIdentity;
}
protected String getUsername() {
String username = null;
if (getIdentity() != null)
username = getIdentity().getName();
return username;
}
protected void safeClose(InputStream fis) {
try {
if (fis != null) {
fis.close();
}
} catch (Exception e) {
}
}
}