[portal-commits] JBoss Portal SVN: r8038 - in branches/2_6_CAS_Integration: core/src/main/org/jboss/portal/core/model/portal and 7 other directories.

Author: sohil.shah(a)jboss.com Date: 2007-08-22 15:57:38 -0400 (Wed, 22 Aug 2007) New Revision: 8038 Added: branches/2_6_CAS_Integration/identity/josso/ branches/2_6_CAS_Integration/identity/josso/config/ branches/2_6_CAS_Integration/identity/josso/config/context.xml branches/2_6_CAS_Integration/identity/josso/config/error.jsp branches/2_6_CAS_Integration/identity/josso/config/josso-1.5.jar branches/2_6_CAS_Integration/identity/josso/config/josso-agent-config.xml branches/2_6_CAS_Integration/identity/josso/config/josso-common-1.5.jar branches/2_6_CAS_Integration/identity/josso/config/josso-config.xml branches/2_6_CAS_Integration/identity/josso/config/josso-gateway-config.xml branches/2_6_CAS_Integration/identity/josso/config/josso-jboss4-plugin-1.5.jar branches/2_6_CAS_Integration/identity/josso/config/josso-tomcat55-plugin-1.5.jar branches/2_6_CAS_Integration/identity/josso/config/login-config.xml branches/2_6_CAS_Integration/identity/josso/config/login.jsp branches/2_6_CAS_Integration/identity/josso/config/server.xml branches/2_6_CAS_Integration/identity/josso/lib/ branches/2_6_CAS_Integration/identity/josso/lib/josso-1.5.jar branches/2_6_CAS_Integration/identity/josso/lib/josso-jboss4-plugin-1.5.jar branches/2_6_CAS_Integration/identity/josso/lib/josso-tomcat55-plugin-1.5.jar branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityService.java branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityServiceImpl.java branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityStore.java branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLoginModule.java branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLogoutValve.java Modified: branches/2_6_CAS_Integration/core/build.xml branches/2_6_CAS_Integration/core/src/main/org/jboss/portal/core/model/portal/PortalObjectPermission.java branches/2_6_CAS_Integration/core/src/resources/portal-core-sar/META-INF/jboss-service.xml branches/2_6_CAS_Integration/identity/build.xml branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/CASAuthenticationService.java branches/2_6_CAS_Integration/thirdparty/ Log: JOSSO Single Sign On Framework integration Modified: branches/2_6_CAS_Integration/core/build.xml =================================================================== --- branches/2_6_CAS_Integration/core/build.xml 2007-08-22 17:39:30 UTC (rev 8037) +++ branches/2_6_CAS_Integration/core/build.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -743,6 +743,7 @@ </copy> </target> + <!-- Deploying the CAS SSO Framework integration --> <target name="deploy-cas" depends="deploy-explode"> <require file="${jboss.home}/server/${portal.deploy.dir}"/> <delete file="${jboss.home}/server/${portal.deploy.dir}/jboss-portal.sar/lib/casclient-lenient.jar"/> @@ -774,5 +775,29 @@ <copy todir="${jboss.home}/server/${portal.deploy.dir}/cas.war/WEB-INF/lib" overwrite="true"> <fileset dir="${jboss.home}/server/${portal.deploy.dir}/jboss-portal.sar/lib" includes="portal-identity-lib.jar"/> </copy> - </target> + </target> + + + <!-- Deploying the JOSSO SSO Framework integration --> + <target name="deploy-josso" depends="deploy-explode"> + <require file="${jboss.home}/server/${portal.deploy.dir}"/> + <copy todir="${jboss.home}/server/${portal.deploy.dir}/../conf" overwrite="true"> + <fileset dir="../identity/josso/config" includes="josso-agent-config.xml, josso-config.xml, login-config.xml"/> + </copy> + <copy todir="${jboss.home}/server/${portal.deploy.dir}/jbossweb-tomcat55.sar" overwrite="true"> + <fileset dir="../identity/josso/config" includes="server.xml, josso-1.5.jar, josso-common-1.5.jar, josso-jboss4-plugin-1.5.jar, josso-tomcat55-plugin-1.5.jar"/> + </copy> + <copy todir="${jboss.home}/server/${portal.deploy.dir}/jboss-portal.sar/portal-server.war" overwrite="true"> + <fileset dir="../identity/josso/config" includes="login.jsp, error.jsp"/> + </copy> + <copy todir="${jboss.home}/server/${portal.deploy.dir}/jboss-portal.sar/portal-server.war/WEB-INF" overwrite="true"> + <fileset dir="../identity/josso/config" includes="context.xml"/> + </copy> + <copy todir="${jboss.home}/server/${portal.deploy.dir}/josso.war/WEB-INF/classes" overwrite="true"> + <fileset dir="../identity/josso/config" includes="josso-gateway-config.xml"/> + </copy> + <copy todir="${jboss.home}/server/${portal.deploy.dir}/josso.war/WEB-INF/lib" overwrite="true"> + <fileset dir="${jboss.home}/server/${portal.deploy.dir}/jboss-portal.sar/lib" includes="portal-identity-lib.jar"/> + </copy> + </target> </project> Modified: branches/2_6_CAS_Integration/core/src/main/org/jboss/portal/core/model/portal/PortalObjectPermission.java =================================================================== --- branches/2_6_CAS_Integration/core/src/main/org/jboss/portal/core/model/portal/PortalObjectPermission.java 2007-08-22 17:39:30 UTC (rev 8037) +++ branches/2_6_CAS_Integration/core/src/main/org/jboss/portal/core/model/portal/PortalObjectPermission.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -29,6 +29,7 @@ import org.jboss.portal.security.spi.provider.PermissionRepository; import javax.security.auth.Subject; +import java.security.Principal; import java.security.Permission; import java.util.Collection; import java.util.Iterator; @@ -273,7 +274,7 @@ caller != null && thisPath.getLength() < thatPath.getLength()) { - Set tmp = caller.getPrincipals(UserPrincipal.class); + Set tmp = caller.getPrincipals(); if (tmp.size() > 0) { Iterator i1 = thisPath.names(); @@ -292,7 +293,7 @@ // Iterator i = tmp.iterator(); - UserPrincipal user = (UserPrincipal)i.next(); + Principal user = (Principal)i.next(); String userName = user.getName(); // Modified: branches/2_6_CAS_Integration/core/src/resources/portal-core-sar/META-INF/jboss-service.xml =================================================================== --- branches/2_6_CAS_Integration/core/src/resources/portal-core-sar/META-INF/jboss-service.xml 2007-08-22 17:39:30 UTC (rev 8037) +++ branches/2_6_CAS_Integration/core/src/resources/portal-core-sar/META-INF/jboss-service.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -529,6 +529,14 @@ <depends>portal:service=Module,type=IdentityServiceController</depends> <attribute name="HavingRole"></attribute> </mbean> + <mbean + code="org.jboss.portal.identity.auth.JOSSOIdentityServiceImpl" + name="portal:service=Module,type=JOSSOIdentityService" + xmbean-dd="" + xmbean-code="org.jboss.portal.jems.as.system.JBossServiceModelMBean"> + <xmbean/> + <depends>portal:service=Module,type=IdentityServiceController</depends> + </mbean> <mbean code="org.jboss.portal.core.impl.mail.MailModuleImpl" Modified: branches/2_6_CAS_Integration/identity/build.xml =================================================================== --- branches/2_6_CAS_Integration/identity/build.xml 2007-08-22 17:39:30 UTC (rev 8037) +++ branches/2_6_CAS_Integration/identity/build.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -89,7 +89,7 @@ <!-- Configure thirdparty libraries --> &libraries; - <!--TODO: need to add the CAS SSO system dependency to the thirdparty repository. For now, this is just added to identity/cas/lib --> + <!--TODO: need to add the CAS/JOSSO SSO system dependency to the thirdparty repository. For now, this is just added to identity/cas/lib --> <property name="yale.cas.root" value="cas"/> <property name="yale.cas.lib" value="${yale.cas.root}/lib/"/> <path id="yale.cas.classpath"> @@ -98,6 +98,14 @@ <pathelement path="${yale.cas.lib}/catalina.jar"/> <pathelement path="${yale.cas.lib}/spring-2.0.3.jar"/> </path> + + <property name="josso.root" value="josso"/> + <property name="josso.lib" value="${josso.root}/lib/"/> + <path id="josso.classpath"> + <pathelement path="${josso.lib}/josso-1.5.jar"/> + <pathelement path="${josso.lib}/josso-tomcat55-plugin-1.5.jar"/> + <pathelement path="${josso.lib}/josso-jboss4-plugin-1.5.jar"/> + </path> <path id="library.classpath"> <path refid="sun.servlet.classpath"/> @@ -114,6 +122,7 @@ <!-- cas integration --> <path refid="sun.servlet.classpath"/> <path refid="yale.cas.classpath"/> + <path refid="josso.classpath"/> <path refid="apache.httpclient.classpath"/> </path> Added: branches/2_6_CAS_Integration/identity/josso/config/context.xml =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/context.xml (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/context.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<Context> + <Valve className="org.jboss.portal.identity.auth.JOSSOLogoutValve"/> +</Context> Added: branches/2_6_CAS_Integration/identity/josso/config/error.jsp =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/error.jsp (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/error.jsp 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,41 @@ +<%-- + ~ Copyright (c) 2004-2006, Novascope S.A. and the JOSSO team + ~ All rights reserved. + ~ Redistribution and use in source and binary forms, with or + ~ without modification, are permitted provided that the following + ~ conditions are met: + ~ + ~ * Redistributions of source code must retain the above copyright + ~ notice, this list of conditions and the following disclaimer. + ~ + ~ * Redistributions in binary form must reproduce the above copyright + ~ notice, this list of conditions and the following disclaimer in + ~ the documentation and/or other materials provided with the + ~ distribution. + ~ + ~ * Neither the name of the JOSSO team nor the names of its + ~ contributors may be used to endorse or promote products derived + ~ from this software without specific prior written permission. + ~ + ~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + ~ CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + ~ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + ~ MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + ~ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS + ~ BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + ~ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + ~ TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + ~ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + ~ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + ~ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + ~ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + ~ POSSIBILITY OF SUCH DAMAGE. + --%> + +<%@page contentType="text/html; charset=iso-8859-1" language="java" session="true" %> +<!-- +Redirects the user to the propper login page. Configured as the login url the web.xml for this application. +--> +<% + response.sendRedirect(request.getContextPath() + "/josso_login/"); +%> Added: branches/2_6_CAS_Integration/identity/josso/config/josso-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/config/josso-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: branches/2_6_CAS_Integration/identity/josso/config/josso-agent-config.xml =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/josso-agent-config.xml (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/josso-agent-config.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,15 @@ +<?xml version="1.0" encoding="ISO-8859-1" ?> +<agent> + <class>org.josso.jb4.agent.JBossCatalinaSSOAgent</class> + <gatewayLoginUrl>http://localhost:8080/josso/signon/login.do</gatewayLoginUrl> + <gatewayLogoutUrl>http://localhost:8080/josso/signon/logout.do</gatewayLogoutUrl> + <service-locator> + <class>org.josso.gateway.WebserviceGatewayServiceLocator</class> + <endpoint>localhost:8080</endpoint> + </service-locator> + <partner-apps> + <partner-app> + <context>/portal</context> + </partner-app> + </partner-apps> +</agent> Added: branches/2_6_CAS_Integration/identity/josso/config/josso-common-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/config/josso-common-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: branches/2_6_CAS_Integration/identity/josso/config/josso-config.xml =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/josso-config.xml (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/josso-config.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="ISO-8859-1" ?> +<configuration> + <hierarchicalXml fileName="josso-agent-config.xml"/> +</configuration> Added: branches/2_6_CAS_Integration/identity/josso/config/josso-gateway-config.xml =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/josso-gateway-config.xml (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/josso-gateway-config.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,569 @@ +<?xml version="1.0" encoding="ISO-8859-1" ?> +<!-- + ~ Copyright (c) 2004-2006, Novascope S.A. and the JOSSO team + ~ All rights reserved. + ~ Redistribution and use in source and binary forms, with or + ~ without modification, are permitted provided that the following + ~ conditions are met: + ~ + ~ * Redistributions of source code must retain the above copyright + ~ notice, this list of conditions and the following disclaimer. + ~ + ~ * Redistributions in binary form must reproduce the above copyright + ~ notice, this list of conditions and the following disclaimer in + ~ the documentation and/or other materials provided with the + ~ distribution. + ~ + ~ * Neither the name of the JOSSO team nor the names of its + ~ contributors may be used to endorse or promote products derived + ~ from this software without specific prior written permission. + ~ + ~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + ~ CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + ~ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + ~ MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + ~ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS + ~ BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + ~ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + ~ TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + ~ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + ~ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + ~ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + ~ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + ~ POSSIBILITY OF SUCH DAMAGE. + --> + +<domain> + <name>JOSSO</name> + <type>web</type> + + <!--sso-web-config--> + + <!-- Optional : The URL where the user will be redirected after a successfull login only if josso_back_to request parameter + is not present when accessing the login url + <loginBackToURL>http://localhost:8080/partnerapp/protected/</loginBackToURL> + --> + + <!-- Optional : The URL where the user will be redirected after a logout only if josso_back_to is not present + when accessing the logout url + <logoutBackToURL>http://localhost:8080/partnerapp/protected/</logoutBackToURL> + --> + + <!-- Session token properties --> + <!--session-token--> + + <!-- Optional : Use a secure session token, a secure channel like SSL must be available for this to work + <secure>false</secure> + --> + + + <!--/session-token--> + + <!--/sso-web-config--> + + <authenticator> + <class>org.josso.auth.AuthenticatorImpl</class> + <authentication-schemes> + <!-- Basic Authentication Scheme --> + <authentication-scheme> + <name>basic-authentication</name> + <class>org.josso.auth.scheme.BindUsernamePasswordAuthScheme</class> + + <!-- + The message digest algorithm to be used when hashing passwords. + This must be an algorithm supported by the java.security.MessageDigest class + on your platform. + + In J2SE 1.4.2 you can check : + Java Cryptography Architecture API Specification & Reference - Apendix B : Algorithms + Values are : MD2, MD5, SHA-1, SHA-256, SHA-384, SHA-512,etc. + + To provide LDAP support, also CRYPT is available. + --> + <!-- + <hashAlgorithm>MD5</hashAlgorithm> + --> + + <!-- Supported values are HEX, BASE64. Mandatory if hashAlgorithm was specified --> + <!-- + <hashEncoding>HEX</hashEncoding> + --> + + <!-- Some hash algorithms, like CRYPT, use this property. The default value is 2. + <saltLength>2</saltLength> + --> + + <!-- + <ignorePasswordCase>false</ignorePasswordCase> + <ignoreUserCase>false</ignoreUserCase> + --> + <!-- ========================================================= --> + <!-- JDBC Credential Store --> + <!-- --> + <!-- Always scape comma chars [,] in queries because --> + <!-- jakarta commons-configuration uses them to define arrays. --> + <!-- ========================================================= --> + <!-- + <credential-store> + <class>org.josso.gateway.identity.service.store.db.JDBCIdentityStore</class> + + <credentialsQueryString> + + SELECT login AS username , password AS password FROM josso_user WHERE login = ? + + </credentialsQueryString> + <connectionName>josso</connectionName> + <connectionPassword>josso</connectionPassword> + <connectionURL>jdbc:oracle:thin:@localhost:1521:josso_db</connectionURL> + <driverName>oracle.jdbc.driver.OracleDriver</driverName> + </credential-store> + <credential-store> + <class>org.josso.gateway.identity.service.store.db.DataSourceIdentityStore</class> + + <credentialsQueryString>SELECT login AS username , password AS password FROM josso_user WHERE login = ?</credentialsQueryString> + <dsJndiName>java:jdbc/JossoSamplesDB</dsJndiName> + </credential-store> + --> + + <!-- =============================================================== --> + <!-- LDAP Credential Store --> + <!-- --> + <!-- Chcek javadoc for configuration details : --> + <!-- org.josso.gateway.identity.service.store.ldap.LDAPIdentityStore --> + <!-- =============================================================== --> + <!-- + <credential-store> + <class>org.josso.gateway.identity.service.store.ldap.LDAPIdentityStore</class> + <initialContextFactory>com.sun.jndi.ldap.LdapCtxFactory</initialContextFactory> + <providerUrl>ldap://ldaphost</providerUrl> + <securityPrincipal>cn=Manager,dc=my-domain,dc=com</securityPrincipal> + <securityCredential>secret</securityCredential> + <securityAuthentication>simple</securityAuthentication> + <ldapSearchScope>SUBTREE</ldapSearchScope> + <usersCtxDN>ou=People,dc=my-domain,dc=com</usersCtxDN> + <principalUidAttributeID>uid</principalUidAttributeID> + <rolesCtxDN>ou=Roles,dc=my-domain,dc=com</rolesCtxDN> + <uidAttributeID>uniquemember</uidAttributeID> + <roleAttributeID>cn</roleAttributeID> + <credentialQueryString>uid=username,userPassword=password</credentialQueryString> + <userPropertiesQueryString>mail=mail,cn=description</userPropertiesQueryString> + </credential-store> + --> + + <!-- ================================================= --> + <!-- Memory Credential Store --> + <!-- ================================================= --> + <!-- + <credential-store> + <class>org.josso.gateway.identity.service.store.MemoryIdentityStore</class> + <credentialsFileName>josso-credentials.xml</credentialsFileName> + </credential-store> + --> + + <!-- ================================================= --> + <!-- JBoss Portal Credential Store --> + <!-- ================================================= --> + <credential-store> + <class>org.jboss.portal.identity.auth.JOSSOIdentityStore</class> + </credential-store> + + + + <!-- ================================================= --> + <!-- Credential Store Key adapter --> + <!-- ================================================= --> + <credential-store-key-adapter> + <class>org.josso.gateway.identity.service.store.SimpleIdentityStoreKeyAdapter</class> + </credential-store-key-adapter> + + </authentication-scheme> + + <!-- Strong Authentication Scheme --> + <authentication-scheme> + <name>strong-authentication</name> + <class>org.josso.auth.scheme.X509CertificateAuthScheme</class> + + <!-- ========================================================= --> + <!-- JDBC Credential Store --> + <!-- --> + <!-- Always scape comma chars [,] in queries because --> + <!-- jakarta commons-configuration uses them to define arrays. --> + <!-- ========================================================= --> + <!-- + <credential-store> + <class>org.josso.gateway.identity.service.store.db.JDBCIdentityStore</class> + + <credentialsQueryString> + + SELECT login AS username , password AS password FROM josso_user WHERE login = ? + + </credentialsQueryString> + <connectionName>josso</connectionName> + <connectionPassword>josso</connectionPassword> + <connectionURL>jdbc:oracle:thin:@localhost:1521:josso_db</connectionURL> + <driverName>oracle.jdbc.driver.OracleDriver</driverName> + </credential-store> + --> + + <!-- =============================================================== --> + <!-- LDAP Credential Store --> + <!-- --> + <!-- Chcek javadoc for configuration details : --> + <!-- org.josso.gateway.identity.service.store.ldap.LDAPIdentityStore --> + <!-- =============================================================== --> + <!-- + <credential-store> + <class>org.josso.gateway.identity.service.store.ldap.LDAPIdentityStore</class> + <initialContextFactory>com.sun.jndi.ldap.LdapCtxFactory</initialContextFactory> + <providerUrl>ldap://ldaphost</providerUrl> + <securityPrincipal>cn=Manager,dc=my-domain,dc=com</securityPrincipal> + <securityCredential>secret</securityCredential> + <securityAuthentication>simple</securityAuthentication> + <ldapSearchScope>SUBTREE</ldapSearchScope> + <usersCtxDN>ou=People,dc=my-domain,dc=com</usersCtxDN> + <principalUidAttributeID>uid</principalUidAttributeID> + <rolesCtxDN>ou=Roles,dc=my-domain,dc=com</rolesCtxDN> + <uidAttributeID>uniquemember</uidAttributeID> + <roleAttributeID>cn</roleAttributeID> + <credentialQueryString>uid=username,userCertificate;binary=userCertificate</credentialQueryString> + <userPropertiesQueryString>mail=mail,cn=description</userPropertiesQueryString> + </credential-store> + --> + + <!-- ================================================= --> + <!-- Memory Credential Store --> + <!-- ================================================= --> + <credential-store> + <class>org.josso.gateway.identity.service.store.MemoryIdentityStore</class> + <credentialsFileName>josso-credentials.xml</credentialsFileName> + </credential-store> + + <!-- ================================================= --> + <!-- Credential Store Key adapter --> + <!-- ================================================= --> + <credential-store-key-adapter> + <class>org.josso.gateway.identity.service.store.SimpleIdentityStoreKeyAdapter</class> + </credential-store-key-adapter> + + </authentication-scheme> + </authentication-schemes> + </authenticator> + + <sso-identity-manager> + + <class>org.josso.gateway.identity.service.SSOIdentityManagerImpl</class> + + <!-- ========================================================= --> + <!-- DataSource Identity Store --> + <!-- --> + <!-- Always scape comma chars [,] in queries because --> + <!-- jakarta commons-configuration uses them to define arrays. --> + <!-- ========================================================= --> + <!-- + <sso-identity-store> + <class>org.josso.gateway.identity.service.store.db.DataSourceIdentityStore</class> + + <userQueryString> + SELECT login FROM josso_user WHERE login = ? + </userQueryString> + + <userPropertiesQueryString> + SELECT 'user.description' AS name , description AS value FROM josso_user WHERE login = ? + UNION + SELECT name AS name , value AS value FROM josso_user_property WHERE login = ? + </userPropertiesQueryString> + + <rolesQueryString> + SELECT josso_role.name FROM josso_role , josso_user_role , josso_user WHERE josso_user.login = ? AND josso_user.login = josso_user_role.login AND josso_role.name = josso_user_role.name + </rolesQueryString> + + <dsJndiName>java:jdbc/JossoSamplesDB</dsJndiName> + </sso-identity-store> + --> + <!-- ========================================================= --> + <!-- JDBC Identity Store --> + <!-- --> + <!-- Always scape comma chars [,] in queries because --> + <!-- jakarta commons-configuration uses them to define arrays. --> + <!-- ========================================================= --> + + <!--sso-identity-store> + <class>org.josso.gateway.identity.service.store.db.JDBCIdentityStore</class> + + <userQueryString> + SELECT login FROM josso_user WHERE login = ? + </userQueryString> + + You could use a UNION to select properties from different tables/columns : + SELECT 'user.lastName' AS name , lastName AS value FROM josso_user WHERE login = ? + UNION + SELECT 'user.name' AS name , name AS value FROM josso_user WHERE login = ? + UNION + SELECT name AS name , value AS value FROM josso_user_properties WHERE login = ? + + <userPropertiesQueryString> + SELECT 'user.description' AS name , description AS value FROM josso_user WHERE login = ? + UNION + SELECT name AS name , value AS value FROM josso_user_property WHERE login = ? + </userPropertiesQueryString> + <rolesQueryString> + SELECT josso_role.name FROM josso_role , josso_user_role , josso_user WHERE josso_user.login = ? AND josso_user.login = josso_user_role.login AND josso_role.name = josso_user_role.name + </rolesQueryString> + <connectionName>josso</connectionName> + <connectionPassword>josso</connectionPassword> + <connectionURL>jdbc:oracle:thin:@localhost:1521:josso_db</connectionURL> + <driverName>oracle.jdbc.driver.OracleDriver</driverName> + </sso-identity-store--> + + <!-- =============================================================== --> + <!-- LDAP Identity Store --> + <!-- --> + <!-- Chcek javadoc for configuration details : --> + <!-- org.josso.gateway.identity.service.store.ldap.LDAPIdentityStore --> + <!-- ================================================= --> + <!-- + <sso-identity-store> + <class>org.josso.gateway.identity.service.store.ldap.LDAPIdentityStore</class> + <initialContextFactory>com.sun.jndi.ldap.LdapCtxFactory</initialContextFactory> + <providerUrl>ldap://ldaphost</providerUrl> + <securityPrincipal>cn=Manager,dc=my-domain,dc=com</securityPrincipal> + <securityCredential>secret</securityCredential> + <securityAuthentication>simple</securityAuthentication> + <ldapSearchScope>SUBTREE</ldapSearchScope> + <usersCtxDN>ou=People,dc=my-domain,dc=com</usersCtxDN> + <principalUidAttributeID>uid</principalUidAttributeID> + <rolesCtxDN>ou=Roles,dc=my-domain,dc=com</rolesCtxDN> + <uidAttributeID>uniquemember</uidAttributeID> + <roleAttributeID>cn</roleAttributeID> + <credentialQueryString>uid=username,userPassword=password</credentialQueryString> + <userPropertiesQueryString>mail=mail,cn=description</userPropertiesQueryString> + </sso-identity-store> + --> + + <!-- ================================================= --> + <!-- Memory Identity Store --> + <!-- ================================================= --> + <!-- + <sso-identity-store> + <class>org.josso.gateway.identity.service.store.MemoryIdentityStore</class> + <usersFileName>josso-users.xml</usersFileName> + </sso-identity-store> + --> + + <!-- ================================================= --> + <!-- JBoss Portal Credential Store --> + <!-- ================================================= --> + <sso-identity-store> + <class>org.jboss.portal.identity.auth.JOSSOIdentityStore</class> + </sso-identity-store> + + <!-- ================================================= --> + <!-- Identity Store Key adapter --> + <!-- ================================================= --> + <sso-identity-store-key-adapter> + <class>org.josso.gateway.identity.service.store.SimpleIdentityStoreKeyAdapter</class> + </sso-identity-store-key-adapter> + + </sso-identity-manager> + + <sso-session-manager> + + <class>org.josso.gateway.session.service.SSOSessionManagerImpl</class> + + <!-- + Set the maximum time interval, in minutes, between client requests before the SSO Service will invalidate + the session. A negative time indicates that the session should never time out. + --> + <maxInactiveInterval>30</maxInactiveInterval> + + <!-- Max number of sessions per user, default 1 + A negative value indicates that an unlimited number of sessions per user is allowed. + --> + <maxSessionsPerUser>-1</maxSessionsPerUser> + <!-- + If true, when the max number of sessions per user is exceeded, + an already existing session will be invalidated to create a new one. + If false, when the max number of sessions per user is exceeded, + an exception is thrown and the new session is not created. + --> + <invalidateExceedingSessions>false</invalidateExceedingSessions> + + + <!-- + Time interval, in milliseconds, between exired sessions cleanup. + --> + <sessionMonitorInterval>10000</sessionMonitorInterval> + + <!-- =================================================================== --> + <!-- Serialized Session Store --> + <!-- --> + <!-- Session Store implementation which uses Java Serialization to --> + <!-- persist Single Sign-On user sessions. --> + <!-- It allows to reconstruct the session state after a system shutdown. --> + <!-- =================================================================== --> + <!-- + <sso-session-store> + <class>org.josso.gateway.session.service.store.SerializedSessionStore</class> + file where serialized sessions will be stored (optional) + <serializedFile>/tmp/josso_sessions.ser</serializedFile> + </sso-session-store> + --> + + + <!-- =============================================================== --> + <!-- DataSource Session Store --> + <!-- --> + <!-- This store persists SSO sessions in a RDBMS, it's usefull for --> + <!-- example when multiple SSO servers must share session information--> + <!-- like in a cluster. --> + <!-- --> + <!-- NOTE :Remember to escape spetial chars like < with &lt; , etc --> + <!-- --> + <!-- --> + <!-- Chcek javadoc for configuration details : --> + <!-- org.josso.gateway.session.service.store.db.DataSourceSessionStore --> + <!-- =============================================================== --> + <!-- + <sso-session-store> + + <class>org.josso.gateway.session.service.store.db.DataSourceSessionStore</class> + + <dsJndiName>java:jdbc/JossoSamplesDB</dsJndiName> + + <sizeQuery>SELECT COUNT(*) FROM JOSSO_SESSION</sizeQuery> + <keysQuery>SELECT session_id FROM JOSSO_SESSION</keysQuery> + <loadAllQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION</loadAllQuery> + <loadQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE session_id = ?</loadQuery> + <loadByUserNameQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE username = ?</loadByUserNameQuery> + + <loadByLastAccessTimeQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE last_access_time &lt; ?</loadByLastAccessTimeQuery> + <loadByValidQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE valid = ?</loadByValidQuery> + <deleteDml>DELETE FROM JOSSO_SESSION WHERE session_id = ?</deleteDml> + <deleteAllDml>DELETE FROM JOSSO_SESSION</deleteAllDml> + <insertDml>INSERT INTO JOSSO_SESSION (session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid) VALUES (?, ?, ?, ?, ?, ?, ?) </insertDml> + + <dsJndiName>java:jdbc/JossoSamplesDB</dsJndiName> + + </sso-session-store> + --> + + <!-- =============================================================== --> + <!-- Jdbc Session Store --> + <!-- --> + <!-- This store persists SSO sessions in a RDBMS, it's usefull for --> + <!-- example when multiple SSO servers must share session information--> + <!-- like in a cluster. --> + <!-- --> + <!-- NOTE :Remember to escape spetial chars like < with &lt; , etc --> + <!-- --> + <!-- Chcek javadoc for configuration details : --> + <!-- org.josso.gateway.session.service.store.db.JdbcSessionStore --> + <!-- =============================================================== --> + <!-- + <sso-session-store> + + <class>org.josso.gateway.session.service.store.db.JdbcSessionStore</class> + + <connectionName>josso</connectionName> + <connectionPassword>josso</connectionPassword> + <connectionURL>jdbc:oracle:thin:@localhost:1521:josso_db</connectionURL> + <driverName>oracle.jdbc.driver.OracleDriver</driverName> + + <sizeQuery>SELECT COUNT(*) FROM JOSSO_SESSION</sizeQuery> + <keysQuery>SELECT session_id FROM JOSSO_SESSION</keysQuery> + <loadAllQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION</loadAllQuery> + <loadQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE session_id = ?</loadQuery> + <loadByUserNameQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE username = ?</loadByUserNameQuery> + + <loadByLastAccessTimeQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE last_access_time &lt; ?</loadByLastAccessTimeQuery> + <loadByValidQuery>SELECT session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid FROM JOSSO_SESSION WHERE valid = ?</loadByValidQuery> + <deleteDml>DELETE FROM JOSSO_SESSION WHERE session_id = ?</deleteDml> + <deleteAllDml>DELETE FROM JOSSO_SESSION</deleteAllDml> + <insertDml>INSERT INTO JOSSO_SESSION (session_id, userName, creation_time, last_access_time, access_count, max_inactive_interval, valid) VALUES (?, ?, ?, ?, ?, ?, ?) </insertDml> + + </sso-session-store> + --> + + + <!-- =============================================================== --> + <!-- Memory Session Store --> + <!-- =============================================================== --> + <sso-session-store> + <class>org.josso.gateway.session.service.store.MemorySessionStore</class> + </sso-session-store> + + <sso-session-id-generator> + + <class>org.josso.gateway.session.service.SessionIdGeneratorImpl</class> + <!-- + The message digest algorithm to be used when generating session + identifiers. This must be an algorithm supported by the + java.security.MessageDigest class on your platform. + + In J2SE 1.4.2 you can check : + Java Cryptography Architecture API Specification & Reference - Apendix A : Standard Names + Values are : MD2, MD5, SHA-1, SHA-256, SHA-384, SHA-512 + --> + <algorithm>MD5</algorithm> + + </sso-session-id-generator> + + </sso-session-manager> + + <!-- SSO Audit Manager compoment --> + <sso-audit-manager> + <class>org.josso.gateway.audit.service.SSOAuditManagerImpl</class> + + <!-- + List of handlers that will process this request + Every handler must have its own unique name. + --> + <handlers> + + <!-- This handler logs all audit trails using Log4J, under the given category --> + <handler> + <class>org.josso.gateway.audit.service.handler.LoggerAuditTrailHandler</class> + <name>LoggerAuditTrailHandler</name> + <category>org.josso.gateway.audit.SSO_AUDIT</category> + </handler> + + <!-- + <handler> + <class>MyOtherHandler</class> + <name>MyOhterHandlerName</name> + <myProperty>value</myProperty> + </handler> + --> + + </handlers> + </sso-audit-manager> + + <!-- SSO Event Manager component --> + <sso-event-manager> + <class>org.josso.gateway.event.security.JMXSSOEventManagerImpl</class> + <!-- + JMX Name of the EventManager MBean that will send SSO Events as JMX Notifications + The MBean will be registered by the MBeanComponentKeeper. + --> + <oname>josso:type=SSOEventManager</oname> + <!-- You can add your own listeners here : --> + <!-- Every listener should have a unique name --> + + <!-- + <listeners> + <listener> + <class>com.myCompany.MyEventListener</class> + <name>MyEventListener</name> + <property1>MyListenerProperty1Value</property1> + </listener> + <listener> + <class>com.myCompany.MyOtherEventListener</class> + <name>MyOtherEventListener</name> + <propertyA>MyOtherListenerPropertyAValue</propertyA> + </listener> + </listeners> + --> + + </sso-event-manager> + +</domain> Added: branches/2_6_CAS_Integration/identity/josso/config/josso-jboss4-plugin-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/config/josso-jboss4-plugin-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: branches/2_6_CAS_Integration/identity/josso/config/josso-tomcat55-plugin-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/config/josso-tomcat55-plugin-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: branches/2_6_CAS_Integration/identity/josso/config/login-config.xml =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/login-config.xml (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/login-config.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,165 @@ +<?xml version='1.0'?> +<!DOCTYPE policy PUBLIC + "-//JBoss//DTD JBOSS Security Config 3.0//EN" + "http://www.jboss.org/j2ee/dtd/security_config.dtd"> + +<!-- The XML based JAAS login configuration read by the +org.jboss.security.auth.login.XMLLoginConfig mbean. Add +an application-policy element for each security domain. + +The outline of the application-policy is: +<application-policy name="security-domain-name"> + <authentication> + <login-module code="login.module1.class.name" flag="control_flag"> + <module-option name = "option1-name">option1-value</module-option> + <module-option name = "option2-name">option2-value</module-option> + ... + </login-module> + + <login-module code="login.module2.class.name" flag="control_flag"> + ... + </login-module> + ... + </authentication> +</application-policy> + +--> + +<policy> + <!-- Used by clients within the application server VM such as + mbeans and servlets that access EJBs. + --> + <application-policy name = "client-login"> + <authentication> + <login-module code = "org.jboss.security.ClientLoginModule" + flag = "required"> + <!-- Any existing security context will be restored on logout --> + <module-option name="restore-login-identity">true</module-option> + </login-module> + </authentication> + </application-policy> + + <!-- Security domain for JBossMQ --> + <application-policy name = "jbossmq"> + <authentication> + <login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule" + flag = "required"> + <module-option name = "unauthenticatedIdentity">guest</module-option> + <module-option name = "dsJndiName">java:/DefaultDS</module-option> + <module-option name = "principalsQuery">SELECT PASSWD FROM JMS_USERS WHERE USERID=?</module-option> + <module-option name = "rolesQuery">SELECT ROLEID, 'Roles' FROM JMS_ROLES WHERE USERID=?</module-option> + </login-module> + </authentication> + </application-policy> + + <!-- Security domain for JBossMQ when using file-state-service.xml + <application-policy name = "jbossmq"> + <authentication> + <login-module code = "org.jboss.mq.sm.file.DynamicLoginModule" + flag = "required"> + <module-option name = "unauthenticatedIdentity">guest</module-option> + <module-option name = "sm.objectname">jboss.mq:service=StateManager</module-option> + </login-module> + </authentication> + </application-policy> + --> + + <!-- Security domains for testing new jca framework --> + <application-policy name = "HsqlDbRealm"> + <authentication> + <login-module code = "org.jboss.resource.security.ConfiguredIdentityLoginModule" + flag = "required"> + <module-option name = "principal">sa</module-option> + <module-option name = "userName">sa</module-option> + <module-option name = "password"></module-option> + <module-option name = "managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=DefaultDS</module-option> + </login-module> + </authentication> + </application-policy> + + <application-policy name = "JmsXARealm"> + <authentication> + <login-module code = "org.jboss.resource.security.ConfiguredIdentityLoginModule" + flag = "required"> + <module-option name = "principal">guest</module-option> + <module-option name = "userName">guest</module-option> + <module-option name = "password">guest</module-option> + <module-option name = "managedConnectionFactoryName">jboss.jca:service=TxCM,name=JmsXA</module-option> + </login-module> + </authentication> + </application-policy> + + <!-- A template configuration for the jmx-console web application. This + defaults to the UsersRolesLoginModule the same as other and should be + changed to a stronger authentication mechanism as required. + --> + <application-policy name = "jmx-console"> + <authentication> + <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" + flag = "required"> + <module-option name="usersProperties">props/jmx-console-users.properties</module-option> + <module-option name="rolesProperties">props/jmx-console-roles.properties</module-option> + </login-module> + </authentication> + </application-policy> + + <!-- A template configuration for the web-console web application. This + defaults to the UsersRolesLoginModule the same as other and should be + changed to a stronger authentication mechanism as required. + --> + <application-policy name = "$webConsoleDomain"> + <authentication> + <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" + flag = "required"> + <module-option name="usersProperties">web-console-users.properties</module-option> + <module-option name="rolesProperties">web-console-roles.properties</module-option> + </login-module> + </authentication> + </application-policy> + + <!-- A template configuration for the JBossWS web application (and transport layer!). + This defaults to the UsersRolesLoginModule the same as other and should be + changed to a stronger authentication mechanism as required. + --> + <application-policy name="JBossWS"> + <authentication> + <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" + flag="required"> + <module-option name="usersProperties">props/jbossws-users.properties</module-option> + <module-option name="rolesProperties">props/jbossws-roles.properties</module-option> + <module-option name="unauthenticatedIdentity">anonymous</module-option> + </login-module> + </authentication> + </application-policy> + + <!-- The default login configuration used by any security domain that + does not have a application-policy entry with a matching name + --> + <application-policy name = "other"> + <!-- A simple server login module, which can be used when the number + of users is relatively small. It uses two properties files: + users.properties, which holds users (key) and their password (value). + roles.properties, which holds users (key) and a comma-separated list of + their roles (value). + The unauthenticatedIdentity property defines the name of the principal + that will be used when a null username and password are presented as is + the case for an unuathenticated web client or MDB. If you want to + allow such users to be authenticated add the property, e.g., + unauthenticatedIdentity="nobody" + --> + <authentication> + <login-module code = "org.jboss.security.auth.spi.UsersRolesLoginModule" + flag = "required" /> + </authentication> + </application-policy> + + <!-- JOSSO JAAS Module configuration --> + <application-policy name = "josso"> + <authentication> + <login-module code = "org.jboss.portal.identity.auth.JOSSOLoginModule" + flag = "required"> + <module-option name="debug">true</module-option> + </login-module> + </authentication> + </application-policy> +</policy> Added: branches/2_6_CAS_Integration/identity/josso/config/login.jsp =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/login.jsp (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/login.jsp 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,41 @@ +<%-- + ~ Copyright (c) 2004-2006, Novascope S.A. and the JOSSO team + ~ All rights reserved. + ~ Redistribution and use in source and binary forms, with or + ~ without modification, are permitted provided that the following + ~ conditions are met: + ~ + ~ * Redistributions of source code must retain the above copyright + ~ notice, this list of conditions and the following disclaimer. + ~ + ~ * Redistributions in binary form must reproduce the above copyright + ~ notice, this list of conditions and the following disclaimer in + ~ the documentation and/or other materials provided with the + ~ distribution. + ~ + ~ * Neither the name of the JOSSO team nor the names of its + ~ contributors may be used to endorse or promote products derived + ~ from this software without specific prior written permission. + ~ + ~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + ~ CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + ~ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + ~ MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + ~ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS + ~ BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + ~ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + ~ TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + ~ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + ~ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + ~ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + ~ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + ~ POSSIBILITY OF SUCH DAMAGE. + --%> + +<%@page contentType="text/html; charset=iso-8859-1" language="java" session="true" %> +<!-- +Redirects the user to the propper login page. Configured as the login url the web.xml for this application. +--> +<% + response.sendRedirect(request.getContextPath() + "/josso_login/"); +%> Added: branches/2_6_CAS_Integration/identity/josso/config/server.xml =================================================================== --- branches/2_6_CAS_Integration/identity/josso/config/server.xml (rev 0) +++ branches/2_6_CAS_Integration/identity/josso/config/server.xml 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,178 @@ +<Server> + + <!-- Use a custom version of StandardService that allows the + connectors to be started independent of the normal lifecycle + start to allow web apps to be deployed before starting the + connectors. + --> + <Service name="jboss.web" + className="org.jboss.web.tomcat.tc5.StandardService"> + + <!-- A HTTP/1.1 Connector on port 8080 --> + <Connector port="8080" address="${jboss.bind.address}" + maxThreads="250" strategy="ms" maxHttpHeaderSize="8192" + emptySessionPath="true" + enableLookups="false" redirectPort="8443" acceptCount="100" + connectionTimeout="20000" disableUploadTimeout="true"/> + + <!-- Add this option to the connector to avoid problems with + .NET clients that don't implement HTTP/1.1 correctly + restrictedUserAgents="^.*MS Web Services Client Protocol 1.1.4322.*$" + --> + + <!-- A AJP 1.3 Connector on port 8009 --> + <Connector port="8009" address="${jboss.bind.address}" + emptySessionPath="true" enableLookups="false" redirectPort="8443" + protocol="AJP/1.3"/> + + <!-- SSL/TLS Connector configuration using the admin devl guide keystore + <Connector port="8443" address="${jboss.bind.address}" + maxThreads="100" strategy="ms" maxHttpHeaderSize="8192" + emptySessionPath="true" + scheme="https" secure="true" clientAuth="false" + keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore" + keystorePass="rmi+ssl" sslProtocol = "TLS" /> + --> + + <Engine name="jboss.web" defaultHost="localhost"> + + <!-- The JAAS based authentication and authorization realm implementation + that is compatible with the jboss 3.2.x realm implementation. + - certificatePrincipal : the class name of the + org.jboss.security.auth.certs.CertificatePrincipal impl + used for mapping X509[] cert chains to a Princpal. + - allRolesMode : how to handle an auth-constraint with a role-name=*, + one of strict, authOnly, strictAuthOnly + + strict = Use the strict servlet spec interpretation which requires + that the user have one of the web-app/security-role/role-name + + authOnly = Allow any authenticated user + + strictAuthOnly = Allow any authenticated user only if there are no + web-app/security-roles + --> + <!-- + <Realm className="org.jboss.web.tomcat.security.JBossSecurityMgrRealm" + certificatePrincipal="org.jboss.security.auth.certs.SubjectDNMapping" + allRolesMode="authOnly" + /> + --> + + <!-- A subclass of JBossSecurityMgrRealm that uses the authentication + behavior of JBossSecurityMgrRealm, but overrides the authorization + checks to use JACC permissions with the current java.security.Policy + to determine authorized access. + - allRolesMode : how to handle an auth-constraint with a role-name=*, + one of strict, authOnly, strictAuthOnly + + strict = Use the strict servlet spec interpretation which requires + that the user have one of the web-app/security-role/role-name + + authOnly = Allow any authenticated user + + strictAuthOnly = Allow any authenticated user only if there are no + web-app/security-roles + <Realm className="org.jboss.web.tomcat.security.JaccAuthorizationRealm" + certificatePrincipal="org.jboss.security.auth.certs.SubjectDNMapping" + allRolesMode="authOnly" + /> + --> + + <!-- Integrating the JOSSO realm --> + <Realm className="org.josso.jb4.agent.JBossCatalinaRealm" + appName="josso" + userClassNames="org.josso.gateway.identity.service.BaseUserImpl" + roleClassNames="org.josso.gateway.identity.service.BaseRoleImpl" + debug="1" /> + + <Host name="localhost" + autoDeploy="false" deployOnStartup="false" deployXML="false"> + + <!-- UNCOMMENT TO ENABLE CUSTOMIZATION OF TOMCAT AUTHENTICATORS + <Host name="localhost" + autoDeploy="false" deployOnStartup="false" deployXML="false" + configClass="org.jboss.web.tomcat.security.config.JBossContextConfig"> + --> + + + <!-- Uncomment to enable request dumper. This Valve "logs interesting + contents from the specified Request (before processing) and the + corresponding Response (after processing). It is especially useful + in debugging problems related to headers and cookies." + --> + <!-- + <Valve className="org.apache.catalina.valves.RequestDumperValve" /> + --> + + <!-- Access logger --> + <!-- + <Valve className="org.apache.catalina.valves.FastCommonAccessLogValve" + prefix="localhost_access_log." suffix=".log" + pattern="common" directory="${jboss.server.home.dir}/log" + resolveHosts="false" /> + --> + + <!-- Uncomment to enable single sign-on across web apps + deployed to this host. Does not provide SSO across a cluster. + + If this valve is used, do not use the JBoss ClusteredSingleSignOn + valve shown below. + + A new configuration attribute is available beginning with + release 4.0.4: + + cookieDomain configures the domain to which the SSO cookie + will be scoped (i.e. the set of hosts to + which the cookie will be presented). By default + the cookie is scoped to "/", meaning the host + that presented it. Set cookieDomain to a + wider domain (e.g. "xyz.com") to allow an SSO + to span more than one hostname. + --> + <!-- + <Valve className="org.apache.catalina.authenticator.SingleSignOn" /> + --> + + <!-- Uncomment to enable single sign-on across web apps + deployed to this host AND to all other hosts in the cluster. + + If this valve is used, do not use the standard Tomcat SingleSignOn + valve shown above. + + Valve uses a JBossCache instance to support SSO credential + caching and replication across the cluster. The JBossCache + instance must be configured separately. By default, the valve + shares a JBossCache with the service that supports HttpSession + replication. See the "tc5-cluster-service.xml" file in the + server/all/deploy directory for cache configuration details. + + Besides the attributes supported by the standard Tomcat + SingleSignOn valve (see the Tomcat docs), this version also + supports the following attributes: + + cookieDomain see above + + treeCacheName JMX ObjectName of the JBossCache MBean used to + support credential caching and replication across + the cluster. If not set, the default value is + "jboss.cache:service=TomcatClusteringCache", the + standard ObjectName of the JBossCache MBean used + to support session replication. + --> + <!-- + <Valve className="org.jboss.web.tomcat.tc5.sso.ClusteredSingleSignOn" /> + --> + + + <!-- Uncomment to check for unclosed connections and transaction terminated checks + in servlets/jsps. + Important: You need to uncomment the dependency on the CachedConnectionManager + in META-INF/jboss-service.xml + <Valve className="org.jboss.web.tomcat.tc5.jca.CachedConnectionValve" + cachedConnectionManagerObjectName="jboss.jca:service=CachedConnectionManager" + transactionManagerObjectName="jboss:service=TransactionManager" /> + --> + + <!-- JOSSO Agent Valve --> + <Valve className="org.josso.tc55.agent.SSOAgentValve" debug="1"/> + </Host> + </Engine> + + </Service> + +</Server> Added: branches/2_6_CAS_Integration/identity/josso/lib/josso-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/lib/josso-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: branches/2_6_CAS_Integration/identity/josso/lib/josso-jboss4-plugin-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/lib/josso-jboss4-plugin-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: branches/2_6_CAS_Integration/identity/josso/lib/josso-tomcat55-plugin-1.5.jar =================================================================== (Binary files differ) Property changes on: branches/2_6_CAS_Integration/identity/josso/lib/josso-tomcat55-plugin-1.5.jar ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Modified: branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/CASAuthenticationService.java =================================================================== --- branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/CASAuthenticationService.java 2007-08-22 17:39:30 UTC (rev 8037) +++ branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/CASAuthenticationService.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -109,14 +109,16 @@ */ public boolean authenticate(String username, String password) { + Session session = null; + Transaction tx = null; try { boolean status = false; InitialContext initialContext = new InitialContext(); SessionFactory sessionFactory = (SessionFactory)initialContext.lookup("java:/portal/IdentitySessionFactory"); - Session session = sessionFactory.openSession(); - Transaction tx = session.beginTransaction(); + session = sessionFactory.openSession(); + tx = session.beginTransaction(); User user = this.userModule.findUserByUserName(username); if(user != null) @@ -149,10 +151,7 @@ status = user.validatePassword(password); } } - - tx.commit(); - session.close(); - + return status; } catch(Exception e) @@ -160,5 +159,10 @@ log.error(this, e); return false; } + finally + { + tx.commit(); + session.close(); + } } } Added: branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityService.java =================================================================== --- branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityService.java (rev 0) +++ branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityService.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,45 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.portal.identity.auth; + +/* + * Created on May 24, 2007 + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public interface JOSSOIdentityService extends AuthenticationService +{ + /** + * + * @param username + * @return + */ + public String[] getUserRoles(String username); + + /** + * + * @param username + * @return + */ + public boolean exists(String username); +} Added: branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityServiceImpl.java =================================================================== --- branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityServiceImpl.java (rev 0) +++ branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityServiceImpl.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,212 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.portal.identity.auth; + +import java.util.Iterator; +import java.util.Set; + +import javax.naming.InitialContext; + +import org.apache.log4j.Logger; + +import org.hibernate.SessionFactory; +import org.hibernate.Session; +import org.hibernate.Transaction; + +import org.jboss.portal.identity.Role; +import org.jboss.portal.identity.UserModule; +import org.jboss.portal.identity.UserProfileModule; +import org.jboss.portal.identity.MembershipModule; +import org.jboss.portal.identity.User; + +/* + * Created on May 24, 2007 + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class JOSSOIdentityServiceImpl implements JOSSOIdentityService +{ + private static Logger log = Logger.getLogger(JOSSOIdentityServiceImpl.class); + + private UserModule userModule = null; + private UserProfileModule profileModule = null; + private MembershipModule membershipModule = null; + + /** + * + * + */ + public void start() + { + try + { + InitialContext initialContext = new InitialContext(); + + this.userModule = (UserModule)initialContext.lookup("java:/portal/UserModule"); + this.profileModule = (UserProfileModule)initialContext.lookup("java:/portal/UserProfileModule"); + this.membershipModule = (MembershipModule)initialContext.lookup("java:/portal/MembershipModule"); + } + catch(Exception e) + { + log.error(this, e); + this.stop(); + } + } + + /** + * + * + */ + public void stop() + { + this.userModule = null; + this.profileModule = null; + this.membershipModule = null; + } + + /** + * + * @param username + * @return + */ + public String[] getUserRoles(String username) + { + Session session = null; + Transaction tx = null; + try + { + String[] userRoles = null; + + InitialContext initialContext = new InitialContext(); + SessionFactory sessionFactory = (SessionFactory)initialContext.lookup("java:/portal/IdentitySessionFactory"); + session = sessionFactory.openSession(); + tx = session.beginTransaction(); + + User user = this.userModule.findUserByUserName(username); + if(user != null && user.getUserName().trim().equals(username.trim())) + { + Set roles = this.membershipModule.getRoles(user); + userRoles = new String[roles.size()+1]; + userRoles[0] = "Authenticated"; + int index = 1; + for(Iterator itr=roles.iterator();itr.hasNext();) + { + Role role = (Role)itr.next(); + userRoles[index++] = role.getName(); + } + } + + return userRoles; + } + catch(Exception e) + { + log.error(this, e); + throw new RuntimeException(e); + } + finally + { + tx.commit(); + session.close(); + } + } + + /** + * + * @param username + * @return + */ + public boolean exists(String username) + { + Session session = null; + Transaction tx = null; + try + { + boolean exists = false; + + InitialContext initialContext = new InitialContext(); + SessionFactory sessionFactory = (SessionFactory)initialContext.lookup("java:/portal/IdentitySessionFactory"); + session = sessionFactory.openSession(); + tx = session.beginTransaction(); + + User user = this.userModule.findUserByUserName(username); + if(user != null && user.getUserName().trim().equals(username.trim())) + { + exists = true; + } + + return exists; + } + catch(Exception e) + { + log.error(this, e); + throw new RuntimeException(e); + } + finally + { + tx.commit(); + session.close(); + } + } + + /** + * + */ + public boolean authenticate(String username, String password) + { + Session session = null; + Transaction tx = null; + try + { + boolean status = false; + + InitialContext initialContext = new InitialContext(); + SessionFactory sessionFactory = (SessionFactory)initialContext.lookup("java:/portal/IdentitySessionFactory"); + session = sessionFactory.openSession(); + tx = session.beginTransaction(); + + User user = this.userModule.findUserByUserName(username); + if(user != null) + { + //Check and make sure the user account is enabled + Boolean enabled = (Boolean)this.profileModule.getProperty(user, User.INFO_USER_ENABLED); + if(enabled != null || enabled.booleanValue()) + { + //Now perform validation + status = user.validatePassword(password); + } + } + + return status; + } + catch(Exception e) + { + log.error(this, e); + return false; + } + finally + { + tx.commit(); + session.close(); + } + } +} Added: branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityStore.java =================================================================== --- branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityStore.java (rev 0) +++ branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOIdentityStore.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,190 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.portal.identity.auth; + +import javax.management.MBeanServer; +import javax.management.ObjectName; + +import org.apache.log4j.Logger; + +import org.jboss.mx.util.MBeanProxy; +import org.jboss.mx.util.MBeanServerLocator; +import org.josso.gateway.SSONameValuePair; +import org.josso.gateway.identity.exceptions.NoSuchUserException; +import org.josso.gateway.identity.exceptions.SSOIdentityException; +import org.josso.gateway.identity.service.BaseRole; +import org.josso.gateway.identity.service.BaseRoleImpl; +import org.josso.gateway.identity.service.BaseUser; +import org.josso.gateway.identity.service.BaseUserImpl; +import org.josso.gateway.identity.service.store.IdentityStore; +import org.josso.gateway.identity.service.store.UserKey; +import org.josso.gateway.identity.service.store.SimpleUserKey; +import org.josso.auth.Credential; +import org.josso.auth.CredentialKey; +import org.josso.auth.BindableCredentialStore; +import org.josso.auth.exceptions.SSOAuthenticationException; +import org.josso.auth.scheme.AuthenticationScheme; +import org.josso.auth.scheme.UsernameCredential; +import org.josso.auth.scheme.PasswordCredential; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + * + */ +public class JOSSOIdentityStore implements IdentityStore, BindableCredentialStore +{ + /** + * + */ + private static Logger log = Logger.getLogger(JOSSOIdentityStore.class); + + /** + * + */ + private AuthenticationScheme authenticationScheme = null; + + /** + * + */ + private JOSSOIdentityService portalIdentityService = null; + + + /** + * + * + */ + public JOSSOIdentityStore() + { + try + { + MBeanServer mbeanServer = MBeanServerLocator.locateJBoss(); + this.portalIdentityService = (JOSSOIdentityService) + MBeanProxy.get(JOSSOIdentityService.class,new ObjectName("portal:service=Module,type=JOSSOIdentityService"),mbeanServer); + } + catch(Exception e) + { + this.authenticationScheme = null; + this.portalIdentityService = null; + + log.error(this, e); + throw new RuntimeException("JOSSOIdentityStore registration failed...."); + } + } + //-----IdentityStore implementation-------------------------------------------------------------------------------------------------- + /** + * + */ + public BaseRole[] findRolesByUserKey(UserKey userKey) + throws SSOIdentityException + { + if(this.portalIdentityService == null) + { + throw new IllegalStateException("JOSSOIdentityStore not properly registered with the JOSSO system.."); + } + + //Get the role information from the Portal Identity System + String[] userRoles = this.portalIdentityService.getUserRoles(userKey.toString()); + + //Map the Portal Identity information to JOSSO Identity information + BaseRole[] roles = new BaseRole[userRoles.length]; + for(int i=0; i<userRoles.length; i++) + { + roles[i] = new BaseRoleImpl(userRoles[i]); + } + + + return roles; + } + + /** + * + */ + public BaseUser loadUser(UserKey userKey) throws NoSuchUserException, + SSOIdentityException + { + if(this.portalIdentityService == null) + { + throw new IllegalStateException("JOSSOIdentityStore not properly registered with the JOSSO system.."); + } + + //Map the Portal Identity to JOSSO Identity + BaseUser user = new BaseUserImpl(); + user.setName(userKey.toString()); + user.addProperty("password", ""); + + return user; + } + + /** + * + */ + public boolean userExists(UserKey userKey) throws SSOIdentityException + { + if(this.portalIdentityService == null) + { + throw new IllegalStateException("JOSSOIdentityStore not properly registered with the JOSSO system.."); + } + + return this.portalIdentityService.exists(userKey.toString()); + } + //---------BindableCredentialStore implementation--------------------------------------------------------------------------------------------- + /** + * + */ + public Credential[] loadCredentials(CredentialKey credentialKey) throws SSOIdentityException + { + if(this.portalIdentityService == null) + { + throw new IllegalStateException("JOSSOIdentityStore not properly registered with the JOSSO system.."); + } + + //Get the User corresponding to this credentialKey + BaseUser user = this.loadUser((SimpleUserKey)credentialKey); + SSONameValuePair[] properties = user.getProperties(); + String password = properties[0].getValue(); + + return new Credential[]{new UsernameCredential(user.getName()), new PasswordCredential(password)}; + } + + /** + * + */ + public boolean bind(String username, String password) throws SSOAuthenticationException + { + return this.portalIdentityService.authenticate(username, password); + } + + + /** + * + */ + public void setAuthenticationScheme(AuthenticationScheme authenticationScheme) + { + if(this.portalIdentityService == null) + { + throw new IllegalStateException("JOSSOIdentityStore not properly registered with the JOSSO system.."); + } + + this.authenticationScheme = authenticationScheme; + } +} Added: branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLoginModule.java =================================================================== --- branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLoginModule.java (rev 0) +++ branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLoginModule.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,213 @@ +/* + * Copyright (c) 2004-2006, Novascope S.A. and the JOSSO team + * All rights reserved. + * Redistribution and use in source and binary forms, with or + * without modification, are permitted provided that the following + * conditions are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * * Neither the name of the JOSSO team nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package org.jboss.portal.identity.auth; + +import org.apache.log4j.Logger; +import org.josso.gateway.identity.SSORole; +import org.josso.gateway.identity.SSOUser; +import org.josso.gateway.identity.service.BaseRoleImpl; +import org.josso.gateway.identity.service.BaseUserImpl; +import org.josso.tc55.agent.jaas.SSOGatewayLoginModule; + +import javax.security.auth.Subject; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.login.LoginException; +import java.security.Principal; +import java.security.acl.Group; +import java.util.Iterator; +import java.util.Map; +import java.util.Set; + +/** + * SSOGatewayLogin Module for JBoss. + * <p> + * It specialized the SSOGatewayLoginModule by associating an additional + * group called ("Roles") which contains user roles. + * The original SSOGatewayLoginModule associates the user and its roles directly + * as Subject's Principals. This won't work in JBoss since it obtains user roles + * from a special Group that must be called "Roles". + * This LoginModule adds this special group, adds the roles as members of it and + * associates such group to the Subject as built by the SSOGatewayLoginModule. + * <p> + * To configure this JAAS Login Module module, add to the + * $JBOSS_HOME/server/default/conf/login-config.xml file the following entry : + * <p> +<pre> +&lt;policy&gt; + &lt;!-- Used by JOSSO Agents for authenticating users against the Gateway --&gt; + &lt;application-policy name = "josso"&gt; + &lt;authentication&gt; + &lt;login-module code = "org.josso.jb32.agent.JBossSSOGatewayLoginModule" + flag = "required"&gt; + &lt;module-option name="debug"&gt;true&lt;/module-option&gt; + &lt;/login-module&gt; + &lt;/authentication&gt; + &lt;/application-policy&gt; + ... + &lt;/policy&gt; +</pre> + * + * @author <a href="mailto:gbrigand@josso.org">Gianluca Brigandi</a> + * @version CVS $Id: JBossSSOGatewayLoginModule.java 338 2006-02-09 16:53:07Z sgonzalez $ + */ + +public class JOSSOLoginModule extends SSOGatewayLoginModule { + + private static final Logger logger = Logger.getLogger(JOSSOLoginModule .class); + + private Subject _savedSubject; + + /** the principal to use when user is not authenticated **/ + protected SSOUser _unauthenticatedIdentity; + + + /** + * Initialize this LoginModule . + * Save the received Subject to change it when commit() gets invoked. + * + * @param subject the Subject to be authenticated. + * + * @param callbackHandler a CallbackHandler for communicating + * with the end user (prompting for user names and + * passwords, for example). + * + * @param sharedState shared LoginModule state. + * + * @param options options specified in the login Configuration + * for this particular LoginModule. + */ + public void initialize(Subject subject, CallbackHandler callbackHandler, + Map sharedState, Map options) { + + _savedSubject = subject; + super.initialize(subject, callbackHandler, sharedState, options); + // Check for unauthenticatedIdentity option. + String name = (String) options.get("unauthenticatedIdentity"); + if( name != null ) + { + try + { + _unauthenticatedIdentity = createIdentity(name); + logger.debug("Saw unauthenticatedIdentity="+name); + } + catch(Exception e) + { + logger.warn("Failed to create custom unauthenticatedIdentity", e); + } + } + } + + /** + * This method supports the unauthenticatedIdentity property used by JBoss. + */ + public boolean login() throws LoginException { + + if (!super.login()) { + // We have an unauthenticated user, use configured Principal + if (_unauthenticatedIdentity != null) { + logger.debug("Authenticated as unauthenticatedIdentity : " + _unauthenticatedIdentity); + _ssoUserPrincipal = _unauthenticatedIdentity; + _succeeded = true; + return true; + } + } + + return true; + } + + /* + * This method is called if the LoginContext's overall authentication succeeded. + * + * The Subject saved in the previously executed initialize() method, is modified + * by adding a new special Group called "Roles" whose members are the SSO user roles. + * JBoss will fetch user roles by examining such group. + * + * @exception LoginException if the commit fails. + * + * @return true if this LoginModule's own login and commit + * attempts succeeded, or false otherwise. + */ + public boolean commit() throws LoginException { + boolean rc = false; + // HashMap setsMap = new HashMap(); + + rc = super.commit(); + + Set ssoRolePrincipals = _savedSubject.getPrincipals(SSORole.class); + Group targetGrp = new BaseRoleImpl("Roles"); + Iterator i = ssoRolePrincipals.iterator(); + Set cour = new java.util.HashSet(); + while (i.hasNext()) { + Principal p = (Principal)i.next(); + + targetGrp.addMember(p); // Add user role to "Roles" group + + //super hack to make the Subject work properly with the Portal Authorization Engine + ((BaseRoleImpl)p).addMember(this.createIdentity(p.getName())); + } + // Add the "Roles" group to the Subject so that JBoss can fetch user roles. + _savedSubject.getPrincipals().removeAll(ssoRolePrincipals); + _savedSubject.getPrincipals().add(targetGrp); + + /*Set ssoUserPrincipals = _savedSubject.getPrincipals(SSOUser.class); + Group callerPrincipal = new BaseRoleImpl("CallerPrincipal"); + Iterator j = ssoUserPrincipals.iterator(); + if (j.hasNext()) { + Principal user = (Principal) j.next(); + callerPrincipal.addMember(user); + } + + // Add the "CallerPrincipal" group to the Subject so that JBoss can fetch user. + _savedSubject.getPrincipals().add(callerPrincipal);*/ + + return rc; + } + + protected SSOUser createIdentity(String username) { + return new BaseUserImpl(username); + } + + protected SSORole[] getRoleSets() throws LoginException { + if (_ssoUserPrincipal == _unauthenticatedIdentity) { + // Using unauthenticatedIdentity .. + if(logger.isDebugEnabled()) + logger.debug("Using unauthenticatedIdentity " + _ssoUserPrincipal + ", returning no roles."); + + return new SSORole[0]; + } + return super.getRoleSets(); + } + +} Added: branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLogoutValve.java =================================================================== --- branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLogoutValve.java (rev 0) +++ branches/2_6_CAS_Integration/identity/src/main/org/jboss/portal/identity/auth/JOSSOLogoutValve.java 2007-08-22 19:57:38 UTC (rev 8038) @@ -0,0 +1,122 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.portal.identity.auth; + +import java.io.IOException; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.Cookie; + +import org.apache.catalina.connector.Request; +import org.apache.catalina.connector.Response; +import org.apache.catalina.valves.ValveBase; + +/* + * Created on May 23, 2007 + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class JOSSOLogoutValve extends ValveBase +{ + /** + * + */ + public void invoke(Request request, Response response) throws IOException, + ServletException + { + HttpServletRequest httpRequest = (HttpServletRequest) request; + + Cookie jossoPortalCookie = this.findJOSSOPortalLogoutCookie(httpRequest); + if(jossoPortalCookie != null) + { + String referer = jossoPortalCookie.getValue(); + + if(referer != null && referer.trim().length() > 0) + { + //Delete this cookie + jossoPortalCookie = new Cookie("JOSSO_PORTAL_LOGOUT", ""); + jossoPortalCookie.setMaxAge(0); //setting the value to 0 should delete this cookie from the browser + response.addCookie(jossoPortalCookie); + + //This form of redirect is needed instead of sendRedirect + //otherwise the JBOSS_PORTAL_LOGOUT cookie cleanup does not happen + StringBuffer buffer = new StringBuffer(); + buffer.append("<html>"+"\n"); + buffer.append("<head>"+"\n"); + buffer.append("</head>"+"\n"); + buffer.append("<body onload=\"setTimeout('document.form1.submit()',1000);\">"+"\n"); + buffer.append("<form name=\"form1\" action=\""+referer+"\" method=\"post\">"+"\n"); + buffer.append("</form>"+"\n"); + buffer.append("</body>"+"\n"); + buffer.append("</html>"+"\n"); + + response.getOutputStream().write(buffer.toString().getBytes()); + response.getOutputStream().flush(); + + return; + } + } + + // continue processing the request + this.getNext().invoke(request, response); + + if(httpRequest.getRequestURI().endsWith("/signout")) + { + String jossoLogout = httpRequest.getContextPath() + org.josso.agent.Constants.JOSSO_LOGOUT_URI; + + Cookie cookie = new Cookie("JOSSO_PORTAL_LOGOUT",httpRequest.getHeader("Referer")); + cookie.setMaxAge(-1); //setting the value so that cookie expires when broser is closed + response.addCookie(cookie); + + response.sendRedirect(jossoLogout); + } + } + + /** + * + * @param request + * @return + */ + private Cookie findJOSSOPortalLogoutCookie(HttpServletRequest request) + { + Cookie cookie = null; + + Cookie[] cookies = request.getCookies(); + if(cookies != null) + { + for(int i=0; i<cookies.length; i++) + { + Cookie cour = cookies[i]; + + if(cour.getName().equals("JOSSO_PORTAL_LOGOUT")) + { + cookie = cour; + break; + } + } + } + + return cookie; + } +} Property changes on: branches/2_6_CAS_Integration/thirdparty ___________________________________________________________________ Name: svn:ignore + antlr apache-ant apache-codec apache-collections apache-fileupload apache-httpclient apache-lang *