Author: remy.maucherat(a)jboss.com Date: 2009-07-09 12:02:35 -0400 (Thu, 09 Jul 2009) New Revision: 1131 Modified: trunk/java/org/apache/catalina/connector/LocalStrings.properties trunk/java/org/apache/catalina/connector/Request.java trunk/java/org/apache/catalina/realm/GenericPrincipal.java trunk/java/org/apache/catalina/realm/JAASRealm.java trunk/java/org/apache/catalina/realm/JNDIRealm.java trunk/java/org/apache/catalina/session/LocalStrings.properties trunk/java/org/apache/catalina/session/StandardSession.java trunk/webapps/docs/changelog.xml Log: - Port: Add logout for JAAS login context. - Port: Some JNDI realm stuff. Modified: trunk/java/org/apache/catalina/connector/LocalStrings.properties =================================================================== --- trunk/java/org/apache/catalina/connector/LocalStrings.properties 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/connector/LocalStrings.properties 2009-07-09 16:02:35 UTC (rev 1131) @@ -55,6 +55,7 @@ coyoteRequest.noAsync=The servlet or filters that are being used by this request do not support async operation coyoteRequest.servletStack=Current Servlet stack for thread {0} coyoteRequest.closed=Response has been closed already +coyoteRequest.logoutfail=Exception logging out user # # MapperListener Modified: trunk/java/org/apache/catalina/connector/Request.java =================================================================== --- trunk/java/org/apache/catalina/connector/Request.java 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/connector/Request.java 2009-07-09 16:02:35 UTC (rev 1131) @@ -3061,6 +3061,7 @@ } public void logout() throws ServletException { + Principal principal = userPrincipal; userPrincipal = null; authType = null; Session session = getSessionInternal(false); @@ -3068,6 +3069,14 @@ session.setPrincipal(null); session.setAuthType(null); } + if (principal instanceof GenericPrincipal) { + GenericPrincipal gp = (GenericPrincipal) principal; + try { + gp.logout(); + } catch (Exception e) { + throw new ServletException(sm.getString("coyoteRequest.logoutfail"), e); + } + } } public DispatcherType getDispatcherType() { Modified: trunk/java/org/apache/catalina/realm/GenericPrincipal.java =================================================================== --- trunk/java/org/apache/catalina/realm/GenericPrincipal.java 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/realm/GenericPrincipal.java 2009-07-09 16:02:35 UTC (rev 1131) @@ -22,6 +22,9 @@ import java.security.Principal; import java.util.Arrays; import java.util.List; + +import javax.security.auth.login.LoginContext; + import org.apache.catalina.Realm; @@ -65,7 +68,7 @@ * @param roles List of roles (must be Strings) possessed by this user */ public GenericPrincipal(Realm realm, String name, String password, - List roles) { + List<String> roles) { this(realm, name, password, roles, null); } @@ -82,8 +85,27 @@ * getUserPrincipal call if not null; if null, this will be returned */ public GenericPrincipal(Realm realm, String name, String password, - List roles, Principal userPrincipal) { - + List<String> roles, Principal userPrincipal) { + this(realm, name, password, roles, userPrincipal, null); + } + + /** + * Construct a new Principal, associated with the specified Realm, for the + * specified username and password, with the specified role names + * (as Strings). + * + * @param realm The Realm that owns this principal + * @param name The username of the user represented by this Principal + * @param password Credentials used to authenticate this user + * @param roles List of roles (must be Strings) possessed by this user + * @param userPrincipal - the principal to be returned from the request + * getUserPrincipal call if not null; if null, this will be returned + * @param loginContext - If provided, this will be used to log out the user + * at the appropriate time + */ + public GenericPrincipal(Realm realm, String name, String password, + List<String> roles, Principal userPrincipal, + LoginContext loginContext) { super(); this.realm = realm; this.name = name; @@ -95,6 +117,7 @@ if (this.roles.length > 0) Arrays.sort(this.roles); } + this.loginContext = loginContext; } @@ -160,6 +183,12 @@ } + /** + * The JAAS LoginContext, if any, used to authenticate this Principal. + * Kept so we can call logout(). + */ + protected LoginContext loginContext = null; + // --------------------------------------------------------- Public Methods @@ -180,6 +209,23 @@ /** + * Calls logout, if necessary, on any associated JAASLoginContext. May in + * the future be extended to cover other logout requirements. + * + * @throws Exception If something goes wrong with the logout. Uses Exception + * to allow for future expansion of this method to cover + * other logout mechanisms that might throw a different + * exception to LoginContext + * + */ + public void logout() throws Exception { + if (loginContext != null) { + loginContext.logout(); + } + } + + + /** * Return a String representation of this object, which exposes only * information that should be public. */ Modified: trunk/java/org/apache/catalina/realm/JAASRealm.java =================================================================== --- trunk/java/org/apache/catalina/realm/JAASRealm.java 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/realm/JAASRealm.java 2009-07-09 16:02:35 UTC (rev 1131) @@ -426,7 +426,7 @@ log.debug(sm.getString("jaasRealm.loginContextCreated", username)); // Return the appropriate Principal for this authenticated Subject - Principal principal = createPrincipal(username, subject); + Principal principal = createPrincipal(username, subject, loginContext); if (principal == null) { log.debug(sm.getString("jaasRealm.authenticateFailure", username)); return (null); @@ -487,8 +487,11 @@ * roles, but only if their respective classes match one of the "role class" classes. * If a user Principal cannot be constructed, return <code>null</code>. * @param subject The <code>Subject</code> representing the logged-in user + * @param loginContext Associated with th Princpal so + * {@link LoginContext#logout()} can be called later */ - protected Principal createPrincipal(String username, Subject subject) { + protected Principal createPrincipal(String username, Subject subject, + LoginContext loginContext) { // Prepare to scan the Principals for this Subject List<String> roles = new ArrayList<String>(); @@ -535,7 +538,8 @@ } // Return the resulting Principal for our authenticated user - return new GenericPrincipal(this, username, null, roles, userPrincipal); + return new GenericPrincipal(this, username, null, roles, userPrincipal, + loginContext); } /** Modified: trunk/java/org/apache/catalina/realm/JNDIRealm.java =================================================================== --- trunk/java/org/apache/catalina/realm/JNDIRealm.java 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/realm/JNDIRealm.java 2009-07-09 16:02:35 UTC (rev 1131) @@ -1420,10 +1420,10 @@ boolean validated = false; if (hasMessageDigest()) { - // iPlanet support if the values starts with {SHA1} + // Some directories prefix the password with the hash type // The string is in a format compatible with Base64.encode not // the Hex encoding of the parent class. - if (password.startsWith("{SHA}")) { + if (password.startsWith("{MD5}") || password.startsWith("{SHA}")) { /* sync since super.digest() does this same thing */ synchronized (this) { password = password.substring(5); Modified: trunk/java/org/apache/catalina/session/LocalStrings.properties =================================================================== --- trunk/java/org/apache/catalina/session/LocalStrings.properties 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/session/LocalStrings.properties 2009-07-09 16:02:35 UTC (rev 1131) @@ -45,6 +45,7 @@ standardSession.getId.ise=getId: Session already invalidated standardSession.getMaxInactiveInterval.ise=getMaxInactiveInterval: Session already invalidated standardSession.getValueNames.ise=getValueNames: Session already invalidated +standardSession.logoutfail=Exception logging out user when expiring session standardSession.notSerializable=Cannot serialize session attribute {0} for session {1} standardSession.removeAttribute.ise=removeAttribute: Session already invalidated standardSession.sessionEvent=Session event listener threw exception Modified: trunk/java/org/apache/catalina/session/StandardSession.java =================================================================== --- trunk/java/org/apache/catalina/session/StandardSession.java 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/java/org/apache/catalina/session/StandardSession.java 2009-07-09 16:02:35 UTC (rev 1131) @@ -52,6 +52,7 @@ import org.apache.catalina.Session; import org.apache.catalina.SessionEvent; import org.apache.catalina.SessionListener; +import org.apache.catalina.realm.GenericPrincipal; import org.apache.catalina.security.SecurityUtil; import org.apache.catalina.util.Enumerator; import org.apache.catalina.util.StringManager; @@ -727,6 +728,18 @@ fireSessionEvent(Session.SESSION_DESTROYED_EVENT, null); } + // Call the logout method + if (principal instanceof GenericPrincipal) { + GenericPrincipal gp = (GenericPrincipal) principal; + try { + gp.logout(); + } catch (Exception e) { + manager.getContainer().getLogger().error( + sm.getString("standardSession.logoutfail"), + e); + } + } + // We have completed expire of this session expiring = false; Modified: trunk/webapps/docs/changelog.xml =================================================================== --- trunk/webapps/docs/changelog.xml 2009-07-08 16:00:01 UTC (rev 1130) +++ trunk/webapps/docs/changelog.xml 2009-07-09 16:02:35 UTC (rev 1131) @@ -114,6 +114,12 @@ <fix> JDBC driver cleanup fix, using a hack to define the cleaner component in the webapp classloader. (markt) </fix> + <fix> + <bug>39231</bug>: Call logout on the JAAS login context whenever possible. (markt) + </fix> + <fix> + <bug>37984</bug>: Strip {MD5} as well as {SHA} from digested passwords. (markt) + </fix> </changelog> </subsection> <subsection name="Coyote">