10:52 a.m.
Author: remy.maucherat(a)jboss.com
Date: 2013-06-19 11:52:43 -0400 (Wed, 19 Jun 2013)
New Revision: 2225
Modified:
branches/8.0.x/src/main/java/org/apache/catalina/authenticator/AuthenticatorBase.java
branches/8.0.x/src/main/java/org/apache/catalina/deploy/SecurityConstraint.java
branches/8.0.x/src/main/java/org/apache/catalina/realm/RealmBase.java
branches/8.0.x/src/main/java/org/apache/catalina/startup/ContextConfig.java
Log:
Adapt and port Servlet 3.1 auth updates, to support **.
Modified:
branches/8.0.x/src/main/java/org/apache/catalina/authenticator/AuthenticatorBase.java
===================================================================
---
branches/8.0.x/src/main/java/org/apache/catalina/authenticator/AuthenticatorBase.java 2013-06-18
12:31:51 UTC (rev 2224)
+++
branches/8.0.x/src/main/java/org/apache/catalina/authenticator/AuthenticatorBase.java 2013-06-19
15:52:43 UTC (rev 2225)
@@ -395,6 +395,36 @@
}
}
+ // Special handling for form-based logins to deal with the case where
+ // a resource is protected for some HTTP methods but not protected for
+ // GET which is used after authentication when redirecting to the
+ // protected resource.
+ // TODO: This is similar to the FormAuthenticator.matchRequest() logic
+ // Is there a way to remove the duplication?
+ Session session = request.getSessionInternal(false);
+ if (session != null) {
+ SavedRequest savedRequest =
+ (SavedRequest) session.getNote(Constants.FORM_REQUEST_NOTE);
+ if (savedRequest != null) {
+ String decodedRequestURI = request.getDecodedRequestURI();
+ if (decodedRequestURI != null &&
+ decodedRequestURI.equals(
+ savedRequest.getDecodedRequestURI())) {
+ if (!authenticate(request, response)) {
+ if (CatalinaLogger.AUTH_LOGGER.isDebugEnabled()) {
+ CatalinaLogger.AUTH_LOGGER.debug(" Failed authenticate()
test");
+ }
+ /*
+ * ASSERT: Authenticator already set the appropriate
+ * HTTP status code, so we do not have to do anything
+ * special
+ */
+ return;
+ }
+ }
+ }
+ }
+
Realm realm = this.context.getRealm();
// Is this request URI subject to a security constraint?
SecurityConstraint [] constraints
@@ -450,10 +480,13 @@
for(i=0; i < constraints.length && authRequired; i++) {
if(!constraints[i].getAuthConstraint()) {
authRequired = false;
- } else if(!constraints[i].getAllRoles()) {
+ break;
+ } else if(!constraints[i].getAllRoles() &&
+ !constraints[i].getAuthenticatedUsers()) {
String [] roles = constraints[i].findAuthRoles();
if(roles == null || roles.length == 0) {
authRequired = false;
+ break;
}
}
}
Modified: branches/8.0.x/src/main/java/org/apache/catalina/deploy/SecurityConstraint.java
===================================================================
---
branches/8.0.x/src/main/java/org/apache/catalina/deploy/SecurityConstraint.java 2013-06-18
12:31:51 UTC (rev 2224)
+++
branches/8.0.x/src/main/java/org/apache/catalina/deploy/SecurityConstraint.java 2013-06-19
15:52:43 UTC (rev 2225)
@@ -39,6 +39,9 @@
public class SecurityConstraint implements Serializable {
+ public static final String ROLE_ALL_ROLES = "*";
+ public static final String ROLE_ALL_AUTHENTICATED_USERS = "**";
+
// ----------------------------------------------------------- Constructors
@@ -56,13 +59,21 @@
/**
- * Was the "all roles" wildcard included in the authorization constraints
- * for this security constraint?
+ * Was the "all roles" wildcard - {@link #ROLE_ALL_ROLES} - included in
the
+ * authorization constraints for this security constraint?
*/
private boolean allRoles = false;
/**
+ * Was the "all authenticated users" wildcard -
+ * {@link #ROLE_ALL_AUTHENTICATED_USERS} - included in the authorization
+ * constraints for this security constraint?
+ */
+ private boolean authenticatedUsers = false;
+
+
+ /**
* Was an authorization constraint included in this security constraint?
* This is necessary to distinguish the case where an auth-constraint with
* no roles (signifying no direct access at all) was requested, versus
@@ -113,6 +124,15 @@
/**
+ * Was the "all authenticated users" wildcard included in this
+ * authentication constraint?
+ */
+ public boolean getAuthenticatedUsers() {
+ return this.authenticatedUsers;
+ }
+
+
+ /**
* Return the authorization constraint present flag for this security
* constraint.
*/
@@ -177,6 +197,24 @@
}
+ /**
+ * Called in the unlikely event that an application defines a role named
+ * "**".
+ */
+ public void treatAllAuthenticatedUsersAsApplicationRole() {
+ if (authenticatedUsers) {
+ authenticatedUsers = false;
+
+ String results[] = new String[authRoles.length + 1];
+ for (int i = 0; i < authRoles.length; i++)
+ results[i] = authRoles[i];
+ results[authRoles.length] = ROLE_ALL_AUTHENTICATED_USERS;
+ authRoles = results;
+ authConstraint = true;
+ }
+ }
+
+
// --------------------------------------------------------- Public Methods
@@ -191,10 +229,14 @@
if (authRole == null)
return;
authConstraint = true;
- if ("*".equals(authRole)) {
+ if (ROLE_ALL_ROLES.equals(authRole)) {
allRoles = true;
return;
}
+ if (ROLE_ALL_AUTHENTICATED_USERS.equals(authRole)) {
+ authenticatedUsers = true;
+ return;
+ }
String results[] = new String[authRoles.length + 1];
for (int i = 0; i < authRoles.length; i++)
results[i] = authRoles[i];
@@ -329,6 +371,14 @@
if (authRole == null)
return;
+ if (ROLE_ALL_ROLES.equals(authRole)) {
+ allRoles = false;
+ return;
+ }
+ if (ROLE_ALL_AUTHENTICATED_USERS.equals(authRole)) {
+ authenticatedUsers = false;
+ return;
+ }
int n = -1;
for (int i = 0; i < authRoles.length; i++) {
if (authRoles[i].equals(authRole)) {
Modified: branches/8.0.x/src/main/java/org/apache/catalina/realm/RealmBase.java
===================================================================
--- branches/8.0.x/src/main/java/org/apache/catalina/realm/RealmBase.java 2013-06-18
12:31:51 UTC (rev 2224)
+++ branches/8.0.x/src/main/java/org/apache/catalina/realm/RealmBase.java 2013-06-19
15:52:43 UTC (rev 2225)
@@ -751,7 +751,13 @@
if (CatalinaLogger.REALM_LOGGER.isDebugEnabled())
CatalinaLogger.REALM_LOGGER.debug(" Checking roles " +
principal);
- if (roles.length == 0 && !constraint.getAllRoles()) {
+ if (constraint.getAuthenticatedUsers() && principal != null) {
+ if (CatalinaLogger.REALM_LOGGER.isDebugEnabled()) {
+ CatalinaLogger.REALM_LOGGER.debug("Passing all authenticated
users");
+ }
+ status = true;
+ } else if (roles.length == 0 && !constraint.getAllRoles() &&
+ !constraint.getAuthenticatedUsers()) {
if(constraint.getAuthConstraint()) {
if( CatalinaLogger.REALM_LOGGER.isDebugEnabled() )
CatalinaLogger.REALM_LOGGER.debug("No roles ");
Modified: branches/8.0.x/src/main/java/org/apache/catalina/startup/ContextConfig.java
===================================================================
--- branches/8.0.x/src/main/java/org/apache/catalina/startup/ContextConfig.java 2013-06-18
12:31:51 UTC (rev 2224)
+++ branches/8.0.x/src/main/java/org/apache/catalina/startup/ContextConfig.java 2013-06-19
15:52:43 UTC (rev 2225)
@@ -665,13 +665,22 @@
*/
protected void validateSecurityRoles() {
+ // Check if ** role was defined by the application itself
+ if (context.findSecurityRole(SecurityConstraint.ROLE_ALL_AUTHENTICATED_USERS)) {
+ SecurityConstraint constraints[] = context.findConstraints();
+ for (SecurityConstraint constraint : constraints) {
+ constraint.treatAllAuthenticatedUsersAsApplicationRole();
+ }
+ }
+
// Check role names used in <security-constraint> elements
SecurityConstraint constraints[] = context.findConstraints();
for (int i = 0; i < constraints.length; i++) {
String roles[] = constraints[i].findAuthRoles();
for (int j = 0; j < roles.length; j++) {
- if (!"*".equals(roles[j]) &&
- !context.findSecurityRole(roles[j])) {
+ if (!SecurityConstraint.ROLE_ALL_ROLES.equals(roles[j])
+ &&
!SecurityConstraint.ROLE_ALL_AUTHENTICATED_USERS.equals(roles[j])
+ && !context.findSecurityRole(roles[j])) {
CatalinaLogger.STARTUP_LOGGER.roleValidationAuth(roles[j]);
context.addSecurityRole(roles[j]);
}