Author: hfnukal Date: 2011-03-23 05:04:25 -0400 (Wed, 23 Mar 2011) New Revision: 6115 Added: epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/AbstractCodec.java epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/ToThrowAwayCodec.java Modified: epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/CookieTokenService.java epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/TokenContainer.java Log: JBEPP-610: Passwords saved by CookieTokenService are in JCR DB in plain form Copied: epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/AbstractCodec.java (from rev 5167, portal/branches/branch-GTNPORTAL-1643/component/web/security/src/main/java/org/exoplatform/web/security/security/AbstractCodec.java) =================================================================== --- epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/AbstractCodec.java (rev 0) +++ epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/AbstractCodec.java 2011-03-23 09:04:25 UTC (rev 6115) @@ -0,0 +1,42 @@ +/* + * Copyright (C) 2009 eXo Platform SAS. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.exoplatform.web.security.security; + +import org.exoplatform.container.component.BaseComponentPlugin; + +/** + * Abstract codec used to encode/decode password stored/loaded on/from token entry + * + * @author <a href="mailto:hoang281283@gmail.com">Minh Hoang TO</a> + * Nov 19, 2010 + */ + +public abstract class AbstractCodec extends BaseComponentPlugin +{ + + public String getName() + { + return this.getClass().toString(); + } + + public abstract String encode(String plainInput); + + public abstract String decode(String encodedInput); + +} Modified: epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/CookieTokenService.java =================================================================== --- epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/CookieTokenService.java 2011-03-23 06:27:35 UTC (rev 6114) +++ epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/CookieTokenService.java 2011-03-23 09:04:25 UTC (rev 6115) @@ -24,6 +24,7 @@ import org.exoplatform.commons.chromattic.ChromatticManager; import org.exoplatform.commons.chromattic.ContextualTask; import org.exoplatform.commons.chromattic.SessionContext; +import org.exoplatform.container.component.ComponentPlugin; import org.exoplatform.container.xml.InitParams; import org.exoplatform.web.security.Credentials; import org.exoplatform.web.security.GateInToken; @@ -47,6 +48,9 @@ /** . */ private String lifecycleName="autologin"; + //TODO: Introduce the concept of priority and store the plugins in a map structure + private AbstractCodec codec; + public CookieTokenService(InitParams initParams, ChromatticManager chromatticManager) { super(initParams); @@ -56,8 +60,19 @@ lifecycleName = (String)initParams.getValuesParam(SERVICE_CONFIG).getValues().get(3); } this.chromatticLifeCycle = chromatticManager.getLifeCycle(lifecycleName); + + //Set the default codec + this.codec = new ToThrowAwayCodec(); } + public final void setupCodec(ComponentPlugin codecPlugin) + { + if(codecPlugin instanceof AbstractCodec) + { + this.codec = (AbstractCodec)codecPlugin; + } + } + public String createToken(final Credentials credentials) { if (validityMillis < 0) @@ -76,7 +91,9 @@ long expirationTimeMillis = System.currentTimeMillis() + validityMillis; GateInToken token = new GateInToken(expirationTimeMillis, credentials); TokenContainer container = getTokenContainer(); - container.saveToken(tokenId, token.getPayload(), new Date(token.getExpirationTimeMillis())); + + //Save the token, password is encoded thanks to the codec + container.encodeAndSaveToken(tokenId, token.getPayload(), new Date(expirationTimeMillis), codec); return tokenId; } }.executeWith(chromatticLifeCycle); @@ -89,7 +106,8 @@ @Override protected GateInToken execute() { - return getTokenContainer().getToken((String)id); + //Get the token, encoded password is decoded thanks to codec + return getTokenContainer().getTokenAndDecode(id, codec); } }.executeWith(chromatticLifeCycle); } Copied: epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/ToThrowAwayCodec.java (from rev 5167, portal/branches/branch-GTNPORTAL-1643/component/web/security/src/main/java/org/exoplatform/web/security/security/ToThrowAwayCodec.java) =================================================================== --- epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/ToThrowAwayCodec.java (rev 0) +++ epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/ToThrowAwayCodec.java 2011-03-23 09:04:25 UTC (rev 6115) @@ -0,0 +1,41 @@ +/* + * Copyright (C) 2009 eXo Platform SAS. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.exoplatform.web.security.security; + +/** + * @author <a href="mailto:hoang281283@gmail.com">Minh Hoang TO</a> + * Nov 19, 2010 + */ + +public class ToThrowAwayCodec extends AbstractCodec +{ + + @Override + public String decode(String encodedInput) + { + return encodedInput; + } + + @Override + public String encode(String plainInput) + { + return plainInput; + } + +} Modified: epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/TokenContainer.java =================================================================== --- epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/TokenContainer.java 2011-03-23 06:27:35 UTC (rev 6114) +++ epp/portal/branches/EPP_5_1_Branch/component/web/security/src/main/java/org/exoplatform/web/security/security/TokenContainer.java 2011-03-23 09:04:25 UTC (rev 6115) @@ -84,5 +84,37 @@ entry.setExpirationTime(expirationTime); return entry.getToken(); } + + public GateInToken encodeAndSaveToken(String tokenId, Credentials credentials, Date expirationTime, AbstractCodec codec) + { + Map<String, TokenEntry> tokens = getTokens(); + TokenEntry entry = tokens.get(tokenId); + if (entry == null) + { + entry = createToken(); + tokens.put(tokenId, entry); + entry.setUserName(credentials.getUsername()); + entry.setPassword(codec.encode(credentials.getPassword())); + } + entry.setExpirationTime(expirationTime); + return entry.getToken(); + } + + public GateInToken getTokenAndDecode(String tokenId, AbstractCodec codec) + { + Map<String, TokenEntry> tokens = getTokens(); + TokenEntry entry = tokens.get(tokenId); + if(entry != null) + { + GateInToken gateInToken = entry.getToken(); + Credentials payload = gateInToken.getPayload(); + + //Return a cloned GateInToken + return new GateInToken(gateInToken.getExpirationTimeMillis(), new Credentials(payload.getUsername(), codec + .decode(payload.getPassword()))); + } + return null; + } + }