[gatein-commits] gatein SVN: r2004 - in portal/trunk: web/portal/src/main/webapp/login/jsp and 1 other directory.
do-not-reply at jboss.org
do-not-reply at jboss.org
Fri Mar 5 09:04:50 EST 2010
Author: julien_viet
Date: 2010-03-05 09:04:49 -0500 (Fri, 05 Mar 2010)
New Revision: 2004
Modified:
portal/trunk/component/web/src/main/java/org/exoplatform/web/login/InitiateLoginServlet.java
portal/trunk/component/web/src/main/java/org/exoplatform/web/login/PortalLoginController.java
portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp
Log:
- fix bug in direct url authentication (like http://localhost:8080/portal/private/classic)
- simplified the flow of the InitiateLoginServlet
- added debug during the auth process
Modified: portal/trunk/component/web/src/main/java/org/exoplatform/web/login/InitiateLoginServlet.java
===================================================================
--- portal/trunk/component/web/src/main/java/org/exoplatform/web/login/InitiateLoginServlet.java 2010-03-05 13:19:56 UTC (rev 2003)
+++ portal/trunk/component/web/src/main/java/org/exoplatform/web/login/InitiateLoginServlet.java 2010-03-05 14:04:49 UTC (rev 2004)
@@ -25,6 +25,8 @@
import org.exoplatform.web.security.security.AbstractTokenService;
import org.exoplatform.web.security.security.CookieTokenService;
import org.exoplatform.web.security.security.TransientTokenService;
+import org.gatein.common.logging.Logger;
+import org.gatein.common.logging.LoggerFactory;
import java.io.IOException;
@@ -43,12 +45,11 @@
*/
public class InitiateLoginServlet extends AbstractHttpServlet
{
- /**
- * Serial version ID
- */
- private static final long serialVersionUID = -2553824531076121642L;
/** . */
+ private static final Logger log = LoggerFactory.getLogger(InitiateLoginServlet.class);
+
+ /** . */
public static final String COOKIE_NAME = "rememberme";
/** . */
@@ -59,62 +60,64 @@
{
resp.setContentType("text/html; charset=UTF-8");
HttpSession session = req.getSession();
+
+ // Looking for credentials stored in the session
Credentials credentials = (Credentials)session.getAttribute(InitiateLoginServlet.CREDENTIALS);
- session.setAttribute("initialURI", req.getAttribute("javax.servlet.forward.request_uri"));
+ //
if (credentials == null)
{
- String token = getTokenCookie(req);
PortalContainer pContainer = PortalContainer.getInstance();
ServletContext context = pContainer.getPortalContext();
+
+ //
+ String token = getRememberMeTokenCookie(req);
if (token != null)
{
AbstractTokenService tokenService = AbstractTokenService.getInstance(CookieTokenService.class);
credentials = tokenService.validateToken(token, false);
if (credentials == null)
{
+ log.debug("Login initiated with no credentials in session but found token an invalid " + token + " " +
+ "that will be cleared in next response");
+
+ // We clear the cookie in the next response as it was not valid
Cookie cookie = new Cookie(InitiateLoginServlet.COOKIE_NAME, "");
cookie.setPath(req.getContextPath());
cookie.setMaxAge(0);
resp.addCookie(cookie);
+
// This allows the customer to define another login page without
// changing the portal
context.getRequestDispatcher("/login/jsp/login.jsp").include(req, resp);
- return;
}
+ else
+ {
+ // Send authentication request
+ log.debug("Login initiated with no credentials in session but found token " + token + " with existing credentials, " +
+ "performing authentication");
+ sendAuth(resp, credentials.getUsername(), token);
+ }
}
else
{
// This allows the customer to define another login page without
// changing the portal
+ log.debug("Login initiated with no credentials in session and no token cookie, redirecting to login page");
context.getRequestDispatcher("/login/jsp/login.jsp").include(req, resp);
- return;
}
}
else
{
+ // We create a temporary token just for the login time
+ TransientTokenService tokenService = AbstractTokenService.getInstance(TransientTokenService.class);
+ String token = tokenService.createToken(credentials);
req.getSession().removeAttribute(InitiateLoginServlet.CREDENTIALS);
+
+ // Send authentication request
+ log.debug("Login initiated with credentials in session, performing authentication");
+ sendAuth(resp, credentials.getUsername(), token);
}
- String token = null;
- for (Cookie cookie : req.getCookies())
- {
- if (InitiateLoginServlet.COOKIE_NAME.equals(cookie.getName()))
- {
- String rememberme = req.getParameter(COOKIE_NAME);
- if (rememberme != null)
- {
- token = cookie.getValue();
- break;
- }
- }
- }
- if (token == null)
- {
- TransientTokenService tokenService = AbstractTokenService.getInstance(TransientTokenService.class);
- token = tokenService.createToken(credentials);
- }
-
- sendAuth(resp, credentials.getUsername(), token);
}
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
@@ -126,11 +129,16 @@
{
String url = "j_security_check?j_username=" + jUsername + "&j_password=" + jPassword;
url = resp.encodeRedirectURL(url);
-
resp.sendRedirect(url);
}
- private String getTokenCookie(HttpServletRequest req)
+ /**
+ * Extract the remember me token from the request or returns null.
+ *
+ * @param req the incoming request
+ * @return the token
+ */
+ private String getRememberMeTokenCookie(HttpServletRequest req)
{
Cookie[] cookies = req.getCookies();
if (cookies != null)
Modified: portal/trunk/component/web/src/main/java/org/exoplatform/web/login/PortalLoginController.java
===================================================================
--- portal/trunk/component/web/src/main/java/org/exoplatform/web/login/PortalLoginController.java 2010-03-05 13:19:56 UTC (rev 2003)
+++ portal/trunk/component/web/src/main/java/org/exoplatform/web/login/PortalLoginController.java 2010-03-05 14:04:49 UTC (rev 2004)
@@ -23,6 +23,8 @@
import org.exoplatform.web.security.Credentials;
import org.exoplatform.web.security.security.AbstractTokenService;
import org.exoplatform.web.security.security.CookieTokenService;
+import org.gatein.common.logging.Logger;
+import org.gatein.common.logging.LoggerFactory;
import java.io.IOException;
@@ -38,28 +40,28 @@
public class PortalLoginController extends AbstractHttpServlet
{
- /**
- * Serial version ID.
- */
- private static final long serialVersionUID = -9167273087235951389L;
+ /** . */
+ private static final Logger log = LoggerFactory.getLogger(PortalLoginController.class);
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
{
- //
String username = req.getParameter("username");
String password = req.getParameter("password");
//
if (username == null)
{
+ log.error("Tried to access the portal login controller without username provided");
resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "No username provided");
}
if (password == null)
{
+ log.error("Tried to access the portal login controller without password provided");
resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "No password provided");
}
//
+ log.debug("Found username and password and set credentials in http session");
Credentials credentials = new Credentials(username, password);
req.getSession().setAttribute(InitiateLoginServlet.CREDENTIALS, credentials);
@@ -70,7 +72,12 @@
if (uri == null || uri.length() == 0)
{
uri = req.getContextPath() + "/private/classic";
+ log.debug("No initial URI found, will use default " + uri + " instead ");
}
+ else
+ {
+ log.debug("Found initial URI " + uri);
+ }
// if we do have a remember me
String rememberme = req.getParameter("rememberme");
@@ -82,6 +89,9 @@
//Create token
AbstractTokenService tokenService = AbstractTokenService.getInstance(CookieTokenService.class);
String cookieToken = tokenService.createToken(credentials);
+
+ log.debug("Found a remember me request parameter, created a persistent token " + cookieToken + " for it and set it up " +
+ "in the next response");
Cookie cookie = new Cookie(InitiateLoginServlet.COOKIE_NAME, cookieToken);
cookie.setPath(req.getContextPath());
cookie.setMaxAge((int)tokenService.getValidityTime() / 1000);
Modified: portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp
===================================================================
--- portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp 2010-03-05 13:19:56 UTC (rev 2003)
+++ portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp 2010-03-05 14:04:49 UTC (rev 2004)
@@ -43,7 +43,7 @@
cookie.setMaxAge(0);
response.addCookie(cookie);
- response.setCharacterEncoding("UTF-8");
+ response.setCharacterEncoding("UTF-8");
response.setContentType("text/html; charset=UTF-8");
%>
<!DOCTYPE html
@@ -70,7 +70,7 @@
%>
<font color="red"><%=res.getString("UILoginForm.label.SigninFail")%></font><%}%>
<form name="loginForm" action="<%= contextPath + "/login"%>" method="post" style="margin: 0px;">
- <input type="hidden" name="uri" value="<%=session.getAttribute("initialURI") %>"/>
+ <input type="hidden" name="initialURI" value="<%=request.getAttribute("javax.servlet.forward.request_uri")%>"/>
<table>
<tr class="FieldContainer">
<td class="FieldLabel"><%=res.getString("UILoginForm.label.UserName")%></td>
More information about the gatein-commits
mailing list