[jboss-cvs] JBossAS SVN: r78092 - trunk/tomcat/src/main/org/jboss/web/tomcat/security.
jboss-cvs-commits at lists.jboss.org
jboss-cvs-commits at lists.jboss.org
Fri Sep 5 12:12:03 EDT 2008
Author: anil.saldhana at jboss.com
Date: 2008-09-05 12:12:02 -0400 (Fri, 05 Sep 2008)
New Revision: 78092
Modified:
trunk/tomcat/src/main/org/jboss/web/tomcat/security/JBossWebRealm.java
trunk/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java
trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityAssociationActions.java
Log:
JBAS-5930: fallback mechanism in obtaining JBoss Security manager
Modified: trunk/tomcat/src/main/org/jboss/web/tomcat/security/JBossWebRealm.java
===================================================================
--- trunk/tomcat/src/main/org/jboss/web/tomcat/security/JBossWebRealm.java 2008-09-05 16:00:28 UTC (rev 78091)
+++ trunk/tomcat/src/main/org/jboss/web/tomcat/security/JBossWebRealm.java 2008-09-05 16:12:02 UTC (rev 78092)
@@ -57,6 +57,7 @@
import org.jboss.security.RealmMapping;
import org.jboss.security.SecurityConstants;
import org.jboss.security.SecurityContext;
+import org.jboss.security.SecurityUtil;
import org.jboss.security.SimplePrincipal;
import org.jboss.security.SubjectSecurityManager;
import org.jboss.security.audit.AuditEvent;
@@ -115,6 +116,14 @@
* false - consider, true - do not consider
*/
protected boolean ignoreBaseDecision = false;
+
+ protected static boolean securityManagerFallback = true;
+
+ static
+ {
+ String str = SecurityAssociationActions.getSystemProperty("jbosswebrealm.fallback", "true");
+ securityManagerFallback = Boolean.parseBoolean(str);
+ }
/**
* Set the class name of the CertificatePrincipal used for mapping X509 cert
@@ -181,21 +190,15 @@
*/
public Principal authenticate(X509Certificate[] certs)
{
- Principal principal = null;
- Context securityCtx = getSecurityNamingContext();
- if (securityCtx == null)
- {
- if (trace)
- {
- log.trace("No security naming context for authenticate(X509Certificate[])");
- }
- return null;
- }
+ Principal principal = null;
try
{
// Get the JBoss security manager from the ENC context
- SubjectSecurityManager securityMgr = (SubjectSecurityManager) securityCtx.lookup("securityMgr");
+ SubjectSecurityManager securityMgr = getSubjectSecurityManager("authenticate(X509Certificate[] certs)");
+ if(securityMgr == null)
+ return null;
+
Subject subject = new Subject();
principal = certMapping.toPrinicipal(certs);
if (securityMgr.isValid(principal, certs, subject))
@@ -208,7 +211,17 @@
SecurityAssociationActions.setPrincipalInfo(principal, certs, subject);
// Get the CallerPrincipal mapping
- RealmMapping realmMapping = (RealmMapping) securityCtx.lookup("realmMapping");
+ RealmMapping realmMapping = null;
+ if(securityMgr instanceof RealmMapping)
+ realmMapping = (RealmMapping)securityMgr;
+ else
+ realmMapping = getRealmMapping();
+
+ if(realmMapping == null)
+ {
+ log.trace("RealmMapping is null for authenticate(x509 params)");
+ return null;
+ }
Principal oldPrincipal = principal;
principal = realmMapping.getPrincipal(oldPrincipal);
if (trace)
@@ -231,7 +244,7 @@
principal = null;
}
}
- catch (NamingException e)
+ catch (Exception e)
{
log.error("Error during authenticate", e);
if (enableAudit)
@@ -259,16 +272,7 @@
public Principal authenticate(String username, String digest, String nonce, String nc, String cnonce, String qop,
String realm, String md5a2)
{
- Principal principal = null;
- Context securityCtx = getSecurityNamingContext();
- if (securityCtx == null)
- {
- if (trace)
- {
- log.trace("No security naming context for authenticate(String, String)");
- }
- return null;
- }
+ Principal principal = null;
Principal caller = (Principal) SecurityAssociationValve.userPrincipal.get();
if (caller == null && username == null && digest == null)
@@ -282,7 +286,10 @@
CallbackHandlerPolicyContextHandler.setCallbackHandler(handler);
// Get the JBoss security manager from the ENC context
- SubjectSecurityManager securityMgr = (SubjectSecurityManager) securityCtx.lookup("securityMgr");
+ SubjectSecurityManager securityMgr = getSubjectSecurityManager("authenticate( digest related)");
+ if(securityMgr == null)
+ return null;
+
principal = new SimplePrincipal(username);
Subject subject = new Subject();
if (securityMgr.isValid(principal, digest, subject))
@@ -292,7 +299,17 @@
SecurityAssociationActions.setPrincipalInfo(principal, digest, subject);
// Get the CallerPrincipal mapping
- RealmMapping realmMapping = (RealmMapping) securityCtx.lookup("realmMapping");
+ RealmMapping realmMapping = null;
+ if(securityMgr instanceof RealmMapping)
+ realmMapping = (RealmMapping)securityMgr;
+ else
+ realmMapping = getRealmMapping();
+
+ if(realmMapping == null)
+ {
+ log.trace("RealmMapping is null for authenticate(digest params)");
+ return null;
+ }
Principal oldPrincipal = principal;
principal = realmMapping.getPrincipal(oldPrincipal);
if (trace)
@@ -315,7 +332,7 @@
}
}
}
- catch (NamingException e)
+ catch (Exception e)
{
principal = null;
log.error("Error during authenticate", e);
@@ -347,16 +364,7 @@
{
log.trace("Begin authenticate, username=" + username);
}
- Principal principal = null;
- Context securityCtx = getSecurityNamingContext();
- if (securityCtx == null)
- {
- if (trace)
- {
- log.trace("No security naming context for authenticate(String, String)");
- }
- return null;
- }
+ Principal principal = null;
Principal caller = (Principal) SecurityAssociationValve.userPrincipal.get();
if (caller == null && username == null && credentials == null)
@@ -367,7 +375,10 @@
try
{
// Get the JBoss security manager from the ENC context
- SubjectSecurityManager securityMgr = (SubjectSecurityManager) securityCtx.lookup("securityMgr");
+ SubjectSecurityManager securityMgr = getSubjectSecurityManager("authenticate(username,cred)");
+ if(securityMgr == null)
+ return null;
+
principal = new SimplePrincipal(username);
Subject subject = new Subject();
if (securityMgr.isValid(principal, credentials, subject))
@@ -375,8 +386,19 @@
log.trace("User: " + username + " is authenticated");
securityDomain = securityMgr.getSecurityDomain();
SecurityAssociationActions.setPrincipalInfo(principal, credentials, subject);
+
// Get the CallerPrincipal mapping
- RealmMapping realmMapping = (RealmMapping) securityCtx.lookup("realmMapping");
+ RealmMapping realmMapping = null;
+ if(securityMgr instanceof RealmMapping)
+ realmMapping = (RealmMapping)securityMgr;
+ else
+ realmMapping = getRealmMapping();
+
+ if(realmMapping == null)
+ {
+ log.trace("RealmMapping is null for authenticate(username,cred)");
+ return null;
+ }
Principal oldPrincipal = principal;
principal = realmMapping.getPrincipal(oldPrincipal);
if (trace)
@@ -399,7 +421,7 @@
principal = null;
}
}
- catch (NamingException e)
+ catch (Exception e)
{
principal = null;
log.error("Error during authenticate", e);
@@ -764,20 +786,114 @@
private Context getSecurityNamingContext()
{
Context securityCtx = null;
+ InitialContext iniCtx = null;
// Get the JBoss security manager from the ENC context
try
{
- InitialContext iniCtx = new InitialContext();
+ iniCtx = new InitialContext();
securityCtx = (Context) iniCtx.lookup("java:comp/env/security");
}
catch (NamingException e)
{
// Apparently there is no security context?
- }
+ }
return securityCtx;
}
/**
+ * Get the JBossWebMetaData
+ * @return
+ */
+ private JBossWebMetaData getMetaData()
+ {
+ return SecurityAssociationValve.activeWebMetaData.get();
+ }
+
+ /**
+ * Get the security domain
+ * from the meta data
+ * @return
+ */
+ private String getSecurityDomain()
+ {
+ String securityDomain = null;
+ JBossWebMetaData jbossMetaData = getMetaData();
+ if(jbossMetaData != null)
+ securityDomain = jbossMetaData.getSecurityDomain();
+ if(securityDomain != null)
+ {
+ securityDomain = SecurityUtil.unprefixSecurityDomain(securityDomain);
+ }
+ return securityDomain;
+ }
+
+ /**
+ * Get the JBoss SubjectSecurityManager (AuthenticationManager)
+ * @param wherefrom the method from where this is called for trace log
+ * @return
+ */
+ private SubjectSecurityManager getSubjectSecurityManager(String wherefrom)
+ {
+ SubjectSecurityManager subjectSecurityManager = null;
+ Context securityCtx = getSecurityNamingContext();
+ if (securityCtx == null)
+ {
+ if (trace)
+ {
+ log.trace("No security naming context for " + wherefrom);
+ }
+ }
+ try
+ {
+ if(securityCtx != null)
+ subjectSecurityManager = (SubjectSecurityManager) securityCtx.lookup("securityMgr");
+ }
+ catch (NamingException e)
+ {
+ }
+ if(subjectSecurityManager == null && securityManagerFallback)
+ {
+ String str = SecurityConstants.JAAS_CONTEXT_ROOT + "/" + getSecurityDomain();
+ try
+ {
+ InitialContext ic = new InitialContext();
+ subjectSecurityManager = (SubjectSecurityManager)ic.lookup(str);
+ }
+ catch (NamingException e)
+ {
+ }
+ }
+ return subjectSecurityManager;
+ }
+
+ /**
+ * Get the Realm Mapping from the Security
+ * Naming Context
+ * @return
+ */
+ private RealmMapping getRealmMapping()
+ {
+ RealmMapping realmMapping = null;
+ Context securityCtx = getSecurityNamingContext();
+ if (securityCtx == null)
+ {
+ if (trace)
+ {
+ log.trace("No security naming context");
+ }
+ return null;
+ }
+ try
+ {
+ realmMapping = (RealmMapping) securityCtx.lookup("realmMapping");
+ }
+ catch (NamingException e)
+ {
+ }
+ return realmMapping;
+ }
+
+ /**
* Get a set of SecurityConstraints from either the PolicyProvider
* or the securityConstraintProviderClass class, via reflection
*
Modified: trunk/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java
===================================================================
--- trunk/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java 2008-09-05 16:00:28 UTC (rev 78091)
+++ trunk/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java 2008-09-05 16:12:02 UTC (rev 78092)
@@ -69,6 +69,7 @@
public void invoke(Request request, Response response)
throws IOException, ServletException
{
+ SecurityAssociationValve.activeWebMetaData.set(metaData);
activeCS.set(warCS);
HttpServletRequest httpRequest = (HttpServletRequest) request.getRequest();
@@ -91,6 +92,7 @@
}
finally
{
+ SecurityAssociationValve.activeWebMetaData.set(null);
SecurityAssociationValve.activeRequest.set(null);
SecurityAssociationActions.clear();
activeCS.set(null);
Modified: trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityAssociationActions.java
===================================================================
--- trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityAssociationActions.java 2008-09-05 16:00:28 UTC (rev 78091)
+++ trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityAssociationActions.java 2008-09-05 16:12:02 UTC (rev 78092)
@@ -39,6 +39,7 @@
* principal and credential
*
* @author Scott.Stark at jboss.org
+ * @author Anil.Saldhana at jboss.org
* @version $Revison:$
*/
class SecurityAssociationActions
@@ -320,4 +321,15 @@
}
});
}
+
+ static String getSystemProperty(final String key, final String defaultValue)
+ {
+ return AccessController.doPrivileged(new PrivilegedAction<String>()
+ {
+ public String run()
+ {
+ return System.getProperty(key, defaultValue);
+ }
+ });
+ }
}
\ No newline at end of file
More information about the jboss-cvs-commits
mailing list