8:25 a.m.
Author: mposolda
Date: 2011-11-15 09:25:55 -0500 (Tue, 15 Nov 2011)
New Revision: 8073
Added:
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/security/PortalLoginModule.java
Modified:
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/login/ClusteredSSOFilter.java
portal/trunk/examples/portal/ear/src/main/application/META-INF/gatein-jboss-beans.xml
portal/trunk/packaging/jboss-as5/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml
portal/trunk/packaging/jboss-as6/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml
Log:
GTNPORTAL-2274 Can't login after unsuccessful login attempt in cluster profile
Modified:
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/login/ClusteredSSOFilter.java
===================================================================
---
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/login/ClusteredSSOFilter.java 2011-11-15
12:21:46 UTC (rev 8072)
+++
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/login/ClusteredSSOFilter.java 2011-11-15
14:25:55 UTC (rev 8073)
@@ -26,6 +26,7 @@
import org.exoplatform.container.ExoContainer;
import org.exoplatform.container.web.AbstractFilter;
+import org.exoplatform.web.security.PortalLoginModule;
import org.gatein.wci.security.Credentials;
import org.jboss.web.tomcat.security.login.WebAuthentication;
@@ -48,7 +49,7 @@
{
HttpServletRequest httpRequest = (HttpServletRequest)request;
- Credentials credentials =
(Credentials)httpRequest.getSession().getAttribute(Credentials.CREDENTIALS);
+ Credentials credentials =
(Credentials)httpRequest.getSession().getAttribute(PortalLoginModule.AUTHENTICATED_CREDENTIALS);
// Make programatic login if authenticated credentials are present in session -
they were set in another cluster node
if (credentials != null && httpRequest.getRemoteUser() == null)
@@ -64,7 +65,7 @@
// This is a workaround... without this code this attr will vanish from session
after first request - don't ask...
if (credentials != null && httpRequest.getSession(false) != null)
{
- httpRequest.getSession(false).setAttribute(Credentials.CREDENTIALS,
credentials);
+
httpRequest.getSession(false).setAttribute(PortalLoginModule.AUTHENTICATED_CREDENTIALS,
credentials);
}
}
else
Added:
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/security/PortalLoginModule.java
===================================================================
---
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/security/PortalLoginModule.java
(rev 0)
+++
portal/trunk/component/web/security/src/main/java/org/exoplatform/web/security/PortalLoginModule.java 2011-11-15
14:25:55 UTC (rev 8073)
@@ -0,0 +1,204 @@
+/*
+ * JBoss, a division of Red Hat
+ * Copyright 2011, Red Hat Middleware, LLC, and individual
+ * contributors as indicated by the @authors tag. See the
+ * copyright.txt in the distribution for a full listing of
+ * individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+
+package org.exoplatform.web.security;
+
+import org.exoplatform.container.ExoContainer;
+import org.exoplatform.services.log.ExoLogger;
+import org.exoplatform.services.log.Log;
+import org.exoplatform.services.security.Authenticator;
+import org.exoplatform.services.security.Identity;
+import org.exoplatform.services.security.UsernameCredential;
+import org.exoplatform.services.security.jaas.AbstractLoginModule;
+import org.gatein.wci.security.Credentials;
+
+import javax.security.auth.login.LoginException;
+import javax.servlet.http.HttpServletRequest;
+import java.lang.reflect.Method;
+
+/**
+ * A login module implementation that is used to handle reauthentication of client with
same HTTP session on various cluster nodes.
+ * After login of user on cluster node is attribute "authenticatedCredentials"
added to HTTP session in method {@link #commit()}.
+ * Other cluster nodes can than read these credentials in method {@link #login()}, and
can reuse them to relogin.
+ *
+ * @author <a href="mailto:julien.viet@exoplatform.com">Julien
Viet</a>
+ * @version $Revision$
+ */
+public class PortalLoginModule extends AbstractLoginModule
+{
+
+ /** Logger. */
+ private static final Log log = ExoLogger.getLogger(PortalLoginModule.class);
+
+ /** JACC get context method. */
+ private static final Method getContextMethod;
+
+ static
+ {
+ Method getContext = null;
+
+ log.debug("About to configure PortalLoginModule");
+ try
+ {
+ Class<?> policyContextClass =
Thread.currentThread().getContextClassLoader().loadClass("javax.security.jacc.PolicyContext");
+ getContext = policyContextClass.getDeclaredMethod("getContext",
String.class);
+ }
+ catch (ClassNotFoundException ignore)
+ {
+ log.debug("JACC not found ignoring it", ignore);
+ }
+ catch (Exception e)
+ {
+ log.error("Could not obtain JACC get context method", e);
+ }
+
+ //
+ getContextMethod = getContext;
+ }
+
+ public static final String AUTHENTICATED_CREDENTIALS =
"authenticatedCredentials";
+
+ private static final String LOGIN_ON_DIFFERENT_NODE =
"PortalLoginModule.loginOnDifferentNode";
+
+ /**
+ * @see javax.security.auth.spi.LoginModule#login()
+ */
+ @SuppressWarnings("unchecked")
+ public boolean login() throws LoginException
+ {
+ if (getContextMethod != null)
+ {
+ Credentials authCredentials = null;
+
+ try
+ {
+ HttpServletRequest request =
(HttpServletRequest)getContextMethod.invoke(null,
"javax.servlet.http.HttpServletRequest");
+ authCredentials =
(Credentials)request.getSession().getAttribute(AUTHENTICATED_CREDENTIALS);
+
+ // If authenticated credentials were presented in HTTP session, it means that
we were already logged on different cluster node
+ // with this HTTP session. We don't need to validate password again in
this case (We don't have password anyway)
+ if (authCredentials != null)
+ {
+ Authenticator authenticator =
(Authenticator)getContainer().getComponentInstanceOfType(Authenticator.class);
+ if (authenticator == null)
+ {
+ throw new LoginException("No Authenticator component found, check
your configuration");
+ }
+
+ String username = authCredentials.getUsername();
+ Identity identity = authenticator.createIdentity(username);
+
+ sharedState.put("exo.security.identity", identity);
+ sharedState.put("javax.security.auth.login.name", username);
+
+ subject.getPublicCredentials().add(new UsernameCredential(username));
+
+ // Add empty password to subject and remove password key, so that
SharedStateLoginModule won't be processed
+ subject.getPrivateCredentials().add("");
+ sharedState.remove("javax.security.auth.login.password");
+
+ // Add flag that we were logged with real password on different cluster
node. Not on this node.
+ sharedState.put(LOGIN_ON_DIFFERENT_NODE, true);
+ }
+ }
+ catch(Exception e)
+ {
+ log.error(this, e);
+ LoginException le = new LoginException(e.getMessage());
+ le.initCause(e);
+ throw le;
+ }
+ }
+ return true;
+ }
+
+ /**
+ * @see javax.security.auth.spi.LoginModule#commit()
+ */
+ public boolean commit() throws LoginException
+ {
+ // Add authenticated credentials to session only if we were logged on this host
with "real" credentials
+ if (getContextMethod != null &&
+ sharedState.containsKey("javax.security.auth.login.name") &&
+ sharedState.containsKey("javax.security.auth.login.password")
&&
+ sharedState.get(LOGIN_ON_DIFFERENT_NODE) == null)
+ {
+ String uid =
(String)sharedState.get("javax.security.auth.login.name");
+
+ Credentials wc = new Credentials(uid, "");
+
+ HttpServletRequest request = null;
+ try
+ {
+ request = (HttpServletRequest)getContextMethod.invoke(null,
"javax.servlet.http.HttpServletRequest");
+ request.getSession().setAttribute(AUTHENTICATED_CREDENTIALS, wc);
+ handleCredentialsRemoving(request);
+ }
+ catch(Exception e)
+ {
+ log.error(this,e);
+ log.error("LoginModule error. Turn off session credentials checking with
proper configuration option of " +
+ "LoginModule set to false");
+ }
+ }
+ return true;
+ }
+
+ /**
+ * @see javax.security.auth.spi.LoginModule#abort()
+ */
+ public boolean abort() throws LoginException
+ {
+ return true;
+ }
+
+ /**
+ * @see javax.security.auth.spi.LoginModule#logout()
+ */
+ public boolean logout() throws LoginException
+ {
+ return true;
+ }
+
+ @Override
+ protected Log getLogger()
+ {
+ return log;
+ }
+
+ protected static boolean isClusteredSSO()
+ {
+ return ExoContainer.getProfiles().contains("cluster");
+ }
+
+ /**
+ * Remove credentials of authenticated user from HTTP session.
+ *
+ * @param request httpRequest
+ */
+ protected void handleCredentialsRemoving(HttpServletRequest request)
+ {
+ // TODO: We can't remove credentials from HTTP session right now because
WSRP-Security relies on it. See method WSSecurityCredentialHelper.handleRequest
+ // request.getSession().removeAttribute(Credentials.CREDENTIALS);
+ }
+}
Modified:
portal/trunk/examples/portal/ear/src/main/application/META-INF/gatein-jboss-beans.xml
===================================================================
---
portal/trunk/examples/portal/ear/src/main/application/META-INF/gatein-jboss-beans.xml 2011-11-15
12:21:46 UTC (rev 8072)
+++
portal/trunk/examples/portal/ear/src/main/application/META-INF/gatein-jboss-beans.xml 2011-11-15
14:25:55 UTC (rev 8073)
@@ -6,6 +6,10 @@
<module-option
name="portalContainerName">sample-portal</module-option>
<module-option
name="realmName">gatein-domain-sample-portal</module-option>
</login-module>
+ <login-module code="org.exoplatform.web.security.PortalLoginModule"
flag="required">
+ <module-option
name="portalContainerName">sample-portal</module-option>
+ <module-option
name="realmName">gatein-domain-sample-portal</module-option>
+ </login-module>
<login-module
code="org.exoplatform.services.security.jaas.SharedStateLoginModule"
flag="required">
<module-option
name="portalContainerName">sample-portal</module-option>
<module-option
name="realmName">gatein-domain-sample-portal</module-option>
Modified:
portal/trunk/packaging/jboss-as5/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml
===================================================================
---
portal/trunk/packaging/jboss-as5/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml 2011-11-15
12:21:46 UTC (rev 8072)
+++
portal/trunk/packaging/jboss-as5/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml 2011-11-15
14:25:55 UTC (rev 8073)
@@ -6,6 +6,10 @@
<module-option
name="portalContainerName">portal</module-option>
<module-option
name="realmName">gatein-domain</module-option>
</login-module>
+ <login-module code="org.exoplatform.web.security.PortalLoginModule"
flag="required">
+ <module-option
name="portalContainerName">portal</module-option>
+ <module-option
name="realmName">gatein-domain</module-option>
+ </login-module>
<login-module
code="org.exoplatform.services.security.jaas.SharedStateLoginModule"
flag="required">
<module-option
name="portalContainerName">portal</module-option>
<module-option
name="realmName">gatein-domain</module-option>
Modified:
portal/trunk/packaging/jboss-as6/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml
===================================================================
---
portal/trunk/packaging/jboss-as6/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml 2011-11-15
12:21:46 UTC (rev 8072)
+++
portal/trunk/packaging/jboss-as6/pkg/src/main/resources/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml 2011-11-15
14:25:55 UTC (rev 8073)
@@ -6,6 +6,10 @@
<module-option
name="portalContainerName">portal</module-option>
<module-option
name="realmName">gatein-domain</module-option>
</login-module>
+ <login-module code="org.exoplatform.web.security.PortalLoginModule"
flag="required">
+ <module-option
name="portalContainerName">portal</module-option>
+ <module-option
name="realmName">gatein-domain</module-option>
+ </login-module>
<login-module
code="org.exoplatform.services.security.jaas.SharedStateLoginModule"
flag="required">
<module-option
name="portalContainerName">portal</module-option>
<module-option
name="realmName">gatein-domain</module-option>