JBossWeb SVN: r1623 - in trunk: java/org/apache/catalina/session and 1 other directories.
by jbossweb-commits@lists.jboss.org
Author: remy.maucherat(a)jboss.com
Date: 2010-12-13 08:18:09 -0500 (Mon, 13 Dec 2010)
New Revision: 1623
Modified:
trunk/java/org/apache/catalina/authenticator/AuthenticatorBase.java
trunk/java/org/apache/catalina/session/ManagerBase.java
trunk/webapps/docs/changelog.xml
Log:
- Also update SSO id generation.
Modified: trunk/java/org/apache/catalina/authenticator/AuthenticatorBase.java
===================================================================
--- trunk/java/org/apache/catalina/authenticator/AuthenticatorBase.java 2010-12-10 04:35:45 UTC (rev 1622)
+++ trunk/java/org/apache/catalina/authenticator/AuthenticatorBase.java 2010-12-13 13:18:09 UTC (rev 1623)
@@ -20,8 +20,6 @@
import java.io.IOException;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
import java.security.Principal;
import java.text.SimpleDateFormat;
import java.util.Date;
@@ -47,6 +45,7 @@
import org.apache.catalina.connector.Response;
import org.apache.catalina.deploy.LoginConfig;
import org.apache.catalina.deploy.SecurityConstraint;
+import org.apache.catalina.session.ManagerBase;
import org.apache.catalina.util.DateTool;
import org.apache.catalina.util.LifecycleSupport;
import org.apache.catalina.util.StringManager;
@@ -85,28 +84,13 @@
/**
- * The default message digest algorithm to use if we cannot use
- * the requested one.
- */
- protected static final String DEFAULT_ALGORITHM = "MD5";
-
-
- /**
* The number of random bytes to include when generating a
* session identifier.
*/
- protected static final int SESSION_ID_BYTES = 16;
+ protected static final int SESSION_ID_BYTES = 18;
/**
- * The message digest algorithm to be used when generating session
- * identifiers. This must be an algorithm supported by the
- * <code>java.security.MessageDigest</code> class on your platform.
- */
- protected String algorithm = DEFAULT_ALGORITHM;
-
-
- /**
* Should we cache authenticated Principals if the request is part of
* an HTTP session?
*/
@@ -128,20 +112,6 @@
/**
- * Return the MessageDigest implementation to be used when
- * creating session identifiers.
- */
- protected MessageDigest digest = null;
-
-
- /**
- * A String initialization parameter used to increase the entropy of
- * the initialization of our random number generator.
- */
- protected String entropy = null;
-
-
- /**
* Descriptive information about this implementation.
*/
protected static final String info =
@@ -166,19 +136,6 @@
/**
- * A random number generator to use when generating session identifiers.
- */
- protected Random random = null;
-
-
- /**
- * The Java class name of the random number generator class to be used
- * when generating session identifiers.
- */
- protected String randomClass = "java.security.SecureRandom";
-
-
- /**
* The string manager for this package.
*/
protected static final StringManager sm =
@@ -210,28 +167,6 @@
/**
- * Return the message digest algorithm for this Manager.
- */
- public String getAlgorithm() {
-
- return (this.algorithm);
-
- }
-
-
- /**
- * Set the message digest algorithm for this Manager.
- *
- * @param algorithm The new message digest algorithm
- */
- public void setAlgorithm(String algorithm) {
-
- this.algorithm = algorithm;
-
- }
-
-
- /**
* Return the cache authenticated Principals flag.
*/
public boolean getCache() {
@@ -292,33 +227,6 @@
/**
- * Return the entropy increaser value, or compute a semi-useful value
- * if this String has not yet been set.
- */
- public String getEntropy() {
-
- // Calculate a semi-useful value if this has not been set
- if (this.entropy == null)
- setEntropy(this.toString());
-
- return (this.entropy);
-
- }
-
-
- /**
- * Set the entropy increaser value.
- *
- * @param entropy The new entropy increaser value
- */
- public void setEntropy(String entropy) {
-
- this.entropy = entropy;
-
- }
-
-
- /**
* Return descriptive information about this Valve implementation.
*/
public String getInfo() {
@@ -329,27 +237,6 @@
/**
- * Return the random number generator class name.
- */
- public String getRandomClass() {
-
- return (this.randomClass);
-
- }
-
-
- /**
- * Set the random number generator class name.
- *
- * @param randomClass The new random number generator class name
- */
- public void setRandomClass(String randomClass) {
-
- this.randomClass = randomClass;
-
- }
-
- /**
* Return the flag that states if we add headers to disable caching by
* proxies.
*/
@@ -639,87 +526,18 @@
* Generate and return a new session identifier for the cookie that
* identifies an SSO principal.
*/
- protected synchronized String generateSessionId() {
+ protected synchronized String generateSessionId(Random random) {
- // Generate a byte array containing a session identifier
- byte bytes[] = new byte[SESSION_ID_BYTES];
- getRandom().nextBytes(bytes);
- bytes = getDigest().digest(bytes);
+ byte[] bytes = new byte[SESSION_ID_BYTES];
+ random.nextBytes(bytes);
+ // Encode the result
+ char[] id = ManagerBase.encode(bytes);
+ return String.valueOf(id);
- // Render the result as a String of hexadecimal digits
- StringBuilder result = new StringBuilder();
- for (int i = 0; i < bytes.length; i++) {
- byte b1 = (byte) ((bytes[i] & 0xf0) >> 4);
- byte b2 = (byte) (bytes[i] & 0x0f);
- if (b1 < 10)
- result.append((char) ('0' + b1));
- else
- result.append((char) ('A' + (b1 - 10)));
- if (b2 < 10)
- result.append((char) ('0' + b2));
- else
- result.append((char) ('A' + (b2 - 10)));
- }
- return (result.toString());
-
}
/**
- * Return the MessageDigest object to be used for calculating
- * session identifiers. If none has been created yet, initialize
- * one the first time this method is called.
- */
- protected synchronized MessageDigest getDigest() {
-
- if (this.digest == null) {
- try {
- this.digest = MessageDigest.getInstance(algorithm);
- } catch (NoSuchAlgorithmException e) {
- try {
- this.digest = MessageDigest.getInstance(DEFAULT_ALGORITHM);
- } catch (NoSuchAlgorithmException f) {
- this.digest = null;
- }
- }
- }
-
- return (this.digest);
-
- }
-
-
- /**
- * Return the random number generator instance we should use for
- * generating session identifiers. If there is no such generator
- * currently defined, construct and seed a new one.
- */
- protected synchronized Random getRandom() {
-
- if (this.random == null) {
- // Calculate the new random number generator seed
- long seed = System.nanoTime();
- char entropy[] = getEntropy().toCharArray();
- for (int i = 0; i < entropy.length; i++) {
- long update = ((byte) entropy[i]) << ((i % 8) * 8);
- seed ^= update;
- }
- // Construct and seed a new random number generator
- try {
- Class clazz = Class.forName(randomClass);
- this.random = (Random) clazz.newInstance();
- } catch (Exception e) {
- this.random = new java.util.Random();
- }
- this.random.setSeed(seed);
- }
-
- return (this.random);
-
- }
-
-
- /**
* Attempts reauthentication to the <code>Realm</code> using
* the credentials included in argument <code>entry</code>.
*
@@ -813,7 +631,7 @@
String ssoId = (String) request.getNote(Constants.REQ_SSOID_NOTE);
if (ssoId == null) {
// Construct a cookie to be returned to the client
- ssoId = generateSessionId();
+ ssoId = generateSessionId(request.getRandom());
Cookie cookie = new Cookie(Constants.SINGLE_SIGN_ON_COOKIE, ssoId);
cookie.setMaxAge(-1);
cookie.setPath("/");
Modified: trunk/java/org/apache/catalina/session/ManagerBase.java
===================================================================
--- trunk/java/org/apache/catalina/session/ManagerBase.java 2010-12-10 04:35:45 UTC (rev 1622)
+++ trunk/java/org/apache/catalina/session/ManagerBase.java 2010-12-13 13:18:09 UTC (rev 1623)
@@ -613,7 +613,7 @@
* @param data The bytes you want to encode
* @return the encoded String
*/
- protected static char[] encode(byte[] data) {
+ public static char[] encode(byte[] data) {
char[] out = new char[((data.length + 2) / 3) * 4];
char[] alphabet = SESSION_ID_ALPHABET;
//
Modified: trunk/webapps/docs/changelog.xml
===================================================================
--- trunk/webapps/docs/changelog.xml 2010-12-10 04:35:45 UTC (rev 1622)
+++ trunk/webapps/docs/changelog.xml 2010-12-13 13:18:09 UTC (rev 1623)
@@ -26,7 +26,7 @@
<jira>189</jira>: Overlay timestamps need special treatment. (remm)
</fix>
<fix>
- Improve session id creation. (remm)
+ Improve session id and SSO id creation. (remm)
</fix>
<fix>
<bug>49779</bug>: Interaction between continue and FORM. (markt)