package cn.dreampie.common.plugin.shiro;
/**
* Created by wangrenhui on 14-1-3.
*//*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
import cn.dreampie.common.config.AppConstants;
import cn.dreampie.common.plugin.shiro.exception.IncorrectCaptchaException;
import cn.dreampie.common.util.security.EncriptionUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.UnauthenticatedException;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.UnknownSessionException;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.util.WebUtils;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.IOException;
import java.util.Arrays;
/**
* An <code>AuthenticationFilter</code> that is capable of automatically performing an authentication attempt
* based on the incoming request.
*
* @since 0.9
*/
public abstract class MyAuthenticatingFilter extends MyAuthenticationFilter {
public static final String PERMISSIVE = "permissive";
public static final String DEFAULT_CAPTCHA_PARAM = "captcha";
//TODO - complete JavaDoc
protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
CaptchaUsernamePasswordToken token = createToken(request, response);
if (token == null) {
String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken " +
"must be created in order to execute a login attempt.";
throw new IllegalStateException(msg);
}
try {
doCaptchaValidate(token);
Subject subject = getSubject(request, response);
subject.login(token);
return onLoginSuccess(token, subject, request, response);
} catch (AuthenticationException e) {
return onLoginFailure(token, e, request, response);
}
}
protected abstract CaptchaUsernamePasswordToken createToken(ServletRequest request, ServletResponse response) throws Exception;
protected CaptchaUsernamePasswordToken createToken(String username, String password,
ServletRequest request, ServletResponse response) {
boolean rememberMe = isRememberMe(request);
String host = getHost(request);
return createToken(username, password, rememberMe, host);
}
protected CaptchaUsernamePasswordToken createToken(String username, String password,
boolean rememberMe, String host) {
return new CaptchaUsernamePasswordToken(username, password, rememberMe, host);
}
protected boolean onLoginSuccess(AuthenticationToken token, Subject subject,
ServletRequest request, ServletResponse response) throws Exception {
return true;
}
protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e,
ServletRequest request, ServletResponse response) throws Exception {
return false;
}
/**
* Returns the host name or IP associated with the current subject. This method is primarily provided for use
* during construction of an <code>AuthenticationToken</code>.
*
* The default implementation merely returns {@link javax.servlet.ServletRequest#getRemoteHost()}.
*
* @param request the incoming ServletRequest
* @return the <code>InetAddress</code> to associate with the login attempt.
*/
protected String getHost(ServletRequest request) {
return request.getRemoteHost();
}
/**
* Returns <code>true</code> if "rememberMe" should be enabled for the login attempt associated with the
* current <code>request</code>, <code>false</code> otherwise.
*
* This implementation always returns <code>false</code> and is provided as a template hook to subclasses that
* support <code>rememberMe</code> logins and wish to determine <code>rememberMe</code> in a custom mannner
* based on the current <code>request</code>.
*
* @param request the incoming ServletRequest
* @return <code>true</code> if "rememberMe" should be enabled for the login attempt associated with the
* current <code>request</code>, <code>false</code> otherwise.
*/
protected boolean isRememberMe(ServletRequest request) {
return false;
}
/**
* Determines whether the current subject should be allowed to make the current request.
*
* The default implementation returns <code>true</code> if the user is authenticated. Will also return
* <code>true</code> if the {@link #isLoginRequest} returns false and the "permissive" flag is set.
*
* @return <code>true</code> if request should be allowed access
*/
@Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
return super.isAccessAllowed(request, response, mappedValue) ||
(!isLoginRequest(request, response) && isPermissive(mappedValue));
}
/**
* Returns <code>true</code> if the mappedValue contains the {@link #PERMISSIVE} qualifier.
*
* @param mappedValue mappedValue
* @return <code>true</code> if this filter should be permissive
*/
protected boolean isPermissive(Object mappedValue) {
if (mappedValue != null) {
String[] values = (String[]) mappedValue;
return Arrays.binarySearch(values, PERMISSIVE) >= 0;
}
return false;
}
/**
* Overrides the default behavior to call {@link #onAccessDenied} and swallow the exception if the exception is
* {@link org.apache.shiro.authz.UnauthenticatedException}.
*/
@Override
protected void cleanup(ServletRequest request, ServletResponse response, Exception existing) throws ServletException, IOException {
if (existing instanceof UnauthenticatedException || (existing instanceof ServletException && existing.getCause() instanceof UnauthenticatedException)) {
try {
onAccessDenied(request, response);
existing = null;
} catch (Exception e) {
existing = e;
}
}
super.cleanup(request, response, existing);
}
protected String getCaptcha(ServletRequest request) {
return WebUtils.getCleanParam(request, DEFAULT_CAPTCHA_PARAM);
}
// 创建 Token
protected CaptchaUsernamePasswordToken createToken(String username, String password, String captcha,
ServletRequest request, ServletResponse response) {
boolean rememberMe = isRememberMe(request);
String host = getHost(request);
return new CaptchaUsernamePasswordToken(username, password, rememberMe, host, captcha);
}
// 验证码校验
protected void doCaptchaValidate(CaptchaUsernamePasswordToken token) {
Session session = SecurityUtils.getSubject().getSession();
if (session == null) {
throw new UnknownSessionException("Unable found required Session");
} else {
if (session.getAttribute(DEFAULT_CAPTCHA_PARAM) != null) {
String captcha = session.getAttribute(DEFAULT_CAPTCHA_PARAM).toString();
// String captcha = CookieUtils.getCookie(request, AppConstants.CAPTCHA_NAME);
if (token.getCaptcha() != null &&
captcha.equalsIgnoreCase(EncriptionUtils.encrypt(token.getCaptcha()))) {
return;
}
}
throw new IncorrectCaptchaException();
}
}
}