User: starksm
Date: 02/04/08 21:13:03
Modified: src/main/org/jboss/security/srp/jaas Tag: Branch_2_4
SRPCacheLoginModule.java SRPLoginModule.java
Log:
Merge the changes from 3.0 into 2.4
Revision Changes Path
No revision
No revision
1.3.2.3 +204 -179
jbosssx/src/main/org/jboss/security/srp/jaas/SRPCacheLoginModule.java
Index: SRPCacheLoginModule.java
===================================================================
RCS file:
/cvsroot/jboss/jbosssx/src/main/org/jboss/security/srp/jaas/SRPCacheLoginModule.java,v
retrieving revision 1.3.2.2
retrieving revision 1.3.2.3
diff -u -r1.3.2.2 -r1.3.2.3
--- SRPCacheLoginModule.java 9 Dec 2001 00:55:21 -0000 1.3.2.2
+++ SRPCacheLoginModule.java 9 Apr 2002 04:13:03 -0000 1.3.2.3
@@ -6,10 +6,12 @@
*/
package org.jboss.security.srp.jaas;
+import java.security.GeneralSecurityException;
import java.security.Principal;
import java.util.Arrays;
import java.util.Map;
import java.util.Set;
+import javax.crypto.spec.SecretKeySpec;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.security.auth.Subject;
@@ -20,215 +22,238 @@
import javax.security.auth.spi.LoginModule;
import org.jboss.security.Logger;
+import org.jboss.security.Util;
import org.jboss.security.auth.callback.SecurityAssociationCallback;
+import org.jboss.security.srp.SRPParameters;
import org.jboss.security.srp.SRPServerSession;
import org.jboss.security.srp.SRPServerInterface;
-import org.jboss.security.srp.SRPServerInterface.SRPParameters;
import org.jboss.util.CachePolicy;
/** A server side login module that validates a username and
-session client challenge response against the cache of authentication
-info maintained by the SRPService mbean. This module needs
-a CallbackHandler that supplies the user principal and
-credential via the SecurityAssociationCallback object.
-
-module options:
-cacheJndiName, the JNDI name of the CachePolicy of <Principal,SRPServerSession>
-information managed by the SRPSerice.
-domainName,
-
-@author [EMAIL PROTECTED]
-@version $Revision: 1.3.2.2 $
-*/
+ session client challenge response against the cache of authentication
+ info maintained by the SRPService mbean. This module needs
+ a CallbackHandler that supplies the user principal and
+ credential via the SecurityAssociationCallback object.
+
+ module options:
+ cacheJndiName, the JNDI name of the CachePolicy of <Principal,SRPServerSession>
+ information managed by the SRPSerice.
+ domainName,
+
+ @author [EMAIL PROTECTED]
+ @version $Revision: 1.3.2.3 $
+ */
public class SRPCacheLoginModule implements LoginModule
{
- private static Logger log = Logger.getLogger(SRPCacheLoginModule.class);
- private Subject subject;
- private CallbackHandler handler;
- private Map sharedState;
- private String domainName;
- private String cacheJndiName;
- private byte[] clientChallenge;
- private SRPServerSession session;
- private Principal userPrincipal;
- private boolean loginFailed;
-
- public SRPCacheLoginModule()
- {
- }
-
-// --- Begin LoginModule interface methods
- /** Initialize the login module.
+ private static Logger log = Logger.getLogger(SRPCacheLoginModule.class);
+ private Subject subject;
+ private CallbackHandler handler;
+ private Map sharedState;
+ private String domainName;
+ private String cacheJndiName;
+ private byte[] clientChallenge;
+ private SRPServerSession session;
+ private Principal userPrincipal;
+ private boolean loginFailed;
+
+ public SRPCacheLoginModule()
+ {
+ }
+
+ // --- Begin LoginModule interface methods
+ /** Initialize the login module.
@param subject, the subject to authenticate
@param handler, the app CallbackHandler used to obtain username & password
@param sharedState, used to propagate the authenticated principal and
- credential hash.
+ credential hash.
@param options, the login module options. These include:
- cacheJndiName: the JNDI name of the CachePolicy of <Principal,Subject>
- information managed by the SRPSerice.
- domainName: the security domain name.
- */
- public void initialize(Subject subject, CallbackHandler handler, Map
sharedState, Map options)
- {
- this.subject = subject;
- this.handler = handler;
- this.sharedState = sharedState;
- cacheJndiName = (String) options.get("cacheJndiName");
- log.trace("cacheJndiName="+cacheJndiName);
- domainName = (String) options.get("domainName");
- }
-
- /** Access the user Principal object and credentials by passing a
+ cacheJndiName: the JNDI name of the CachePolicy of <Principal,Subject>
+ information managed by the SRPSerice.
+ domainName: the security domain name.
+ */
+ public void initialize(Subject subject, CallbackHandler handler, Map
sharedState, Map options)
+ {
+ this.subject = subject;
+ this.handler = handler;
+ this.sharedState = sharedState;
+ cacheJndiName = (String) options.get("cacheJndiName");
+ log.trace("cacheJndiName="+cacheJndiName);
+ domainName = (String) options.get("domainName");
+ }
+
+ /** Access the user Principal object and credentials by passing a
SecurityAssociationCallback object to the registered CallbackHandler. This
method then validates the user by looking up the cache information using
the Principal object as the key and compares the cache credential against the
the credential obtained from the SecurityAssociationCallback. The
login credential should be the M1 verifcation challenge byte[].
-
+
@return true is login succeeds, false if login does not apply.
@exception LoginException, thrown on login failure.
*/
- public boolean login() throws LoginException
- {
- loginFailed = true;
- getUserInfo();
-
- String username = userPrincipal.getName();
- // First try to locate an SRPServerInterface using JNDI
- try
- {
- if( cacheJndiName == null )
- throw new LoginException("Required cacheJndiName option not set");
- InitialContext iniCtx = new InitialContext();
- CachePolicy cache = (CachePolicy) iniCtx.lookup(cacheJndiName);
- Object cacheCredential = cache.get(userPrincipal);
- if( cacheCredential == null )
- {
- throw new LoginException("No SRP session found for: "+username);
- }
- log.trace("Found SRP cache credential: "+cacheCredential);
- /** The cache object should be the SRPServerSession object used in the
- authentication of the client.
- */
- if( cacheCredential instanceof SRPServerSession )
- {
- session = (SRPServerSession) cacheCredential;
- if( validateCache(session) == false )
- throw new LoginException("Failed to validate SRP session key
for: "+username);
- }
- else
- {
- throw new LoginException("Unknown type of cache credential:
"+cacheCredential.getClass());
- }
- }
- catch(NamingException e)
- {
- log.error("Failed to load SRP auth cache", e);
- throw new LoginException("Failed to load SRP auth cache:
"+e.toString(true));
- }
-
- log.trace("Login succeeded");
- // Put the username and the client challenge into the sharedState map
- sharedState.put("javax.security.auth.login.name", username);
- sharedState.put("javax.security.auth.login.password", clientChallenge);
- loginFailed = false;
- return true;
- }
-
- /** All login modules have completed the login() phase, comit if we
+ public boolean login() throws LoginException
+ {
+ loginFailed = true;
+ getUserInfo();
+
+ String username = userPrincipal.getName();
+ // First try to locate an SRPServerInterface using JNDI
+ try
+ {
+ if( cacheJndiName == null )
+ throw new LoginException("Required cacheJndiName option not set");
+ InitialContext iniCtx = new InitialContext();
+ CachePolicy cache = (CachePolicy) iniCtx.lookup(cacheJndiName);
+ Object cacheCredential = cache.get(userPrincipal);
+ if( cacheCredential == null )
+ {
+ throw new LoginException("No SRP session found for: "+username);
+ }
+ log.trace("Found SRP cache credential: "+cacheCredential);
+ /** The cache object should be the SRPServerSession object used in the
+ authentication of the client.
+ */
+ if( cacheCredential instanceof SRPServerSession )
+ {
+ session = (SRPServerSession) cacheCredential;
+ if( validateCache(session) == false )
+ throw new LoginException("Failed to validate SRP session key for:
"+username);
+ }
+ else
+ {
+ throw new LoginException("Unknown type of cache credential:
"+cacheCredential.getClass());
+ }
+ }
+ catch(NamingException e)
+ {
+ log.error("Failed to load SRP auth cache", e);
+ throw new LoginException("Failed to load SRP auth cache:
"+e.toString(true));
+ }
+
+ log.trace("Login succeeded");
+ // Put the username and the client challenge into the sharedState map
+ sharedState.put("javax.security.auth.login.name", username);
+ sharedState.put("javax.security.auth.login.password", clientChallenge);
+ loginFailed = false;
+ return true;
+ }
+
+ /** All login modules have completed the login() phase, commit if we
succeeded. This entails adding the princial to the subject Principals set.
It also adds the client challenge response to the PublicCredentials set
- and the private session key to the PrivateCredentials set.
+ and the private session key to the PrivateCredentials set as a SecretKeySpec.
@return false, if the login() failed, true if the commit succeeds.
@exception LoginException, thrown on failure to add the principal.
*/
- public boolean commit() throws LoginException
- {
- if( loginFailed == true )
- return false;
- Set principals = subject.getPrincipals();
- subject.getPrincipals().add(userPrincipal);
- subject.getPublicCredentials().add(clientChallenge);
- byte[] sessionKey = session.getSessionKey();
- subject.getPrivateCredentials().add(sessionKey);
- return true;
- }
-
- public boolean abort() throws LoginException
- {
- userPrincipal = null;
- clientChallenge = null;
- return true;
- }
-
+ public boolean commit() throws LoginException
+ {
+ if( loginFailed == true )
+ return false;
+ Set principals = subject.getPrincipals();
+ principals.add(userPrincipal);
+ subject.getPublicCredentials().add(clientChallenge);
+ byte[] sessionKey = session.getSessionKey();
+ SRPParameters params = session.getParameters();
+ Set privateCredentials = subject.getPrivateCredentials();
+ privateCredentials.add(params);
+ if( params.cipherAlgorithm != null )
+ {
+ SecretKeySpec secretKey = new SecretKeySpec(sessionKey,
params.cipherAlgorithm);
+ privateCredentials.add(secretKey);
+ }
+ else
+ {
+ privateCredentials.add(sessionKey);
+ }
+
+ return true;
+ }
+
+ public boolean abort() throws LoginException
+ {
+ userPrincipal = null;
+ clientChallenge = null;
+ return true;
+ }
- /** Remove the userPrincipal, clientChallenge and sessionKey associated
- with the subject during commit().
+ /** Remove the userPrincipal, clientChallenge and sessionKey associated
+ with the subject during commit().
@return true always.
@exception LoginException, thrown on exception during remove of the Principal
- added during the commit.
+ added during the commit.
*/
- public boolean logout() throws LoginException
- {
- try
- {
- if( subject.isReadOnly() == false )
- { // Remove userPrincipal
- Set s = subject.getPrincipals(userPrincipal.getClass());
- s.remove(userPrincipal);
- subject.getPublicCredentials().remove(clientChallenge);
- byte[] sessionKey = session.getSessionKey();
- subject.getPrivateCredentials().remove(sessionKey);
+ public boolean logout() throws LoginException
+ {
+ try
+ {
+ if( subject.isReadOnly() == false )
+ { // Remove userPrincipal
+ Set s = subject.getPrincipals(userPrincipal.getClass());
+ s.remove(userPrincipal);
+ subject.getPublicCredentials().remove(clientChallenge);
+ byte[] sessionKey = session.getSessionKey();
+ SRPParameters params = session.getParameters();
+ Set privateCredentials = subject.getPrivateCredentials();
+ if( params.cipherAlgorithm != null )
+ {
+ SecretKeySpec secretKey = new SecretKeySpec(sessionKey,
params.cipherAlgorithm);
+ privateCredentials.remove(secretKey);
}
- }
- catch(Exception e)
- {
- throw new LoginException("Failed to remove commit information,
"+e.getMessage());
- }
- return true;
- }
-
+ else
+ {
+ privateCredentials.remove(sessionKey);
+ }
+ privateCredentials.remove(params);
+ }
+ }
+ catch(Exception e)
+ {
+ throw new LoginException("Failed to remove commit information,
"+e.getMessage());
+ }
+ return true;
+ }
+
// --- End LoginModule interface methods
-
- /** Obtain the Principal and credentials that are to be authenticated.
+
+ /** Obtain the Principal and credentials that are to be authenticated.
*/
- private void getUserInfo() throws LoginException
- {
- // Get the security association info
- if( handler == null )
- throw new LoginException("No CallbackHandler provied");
-
- SecurityAssociationCallback sac = new SecurityAssociationCallback();
- Callback[] callbacks = { sac };
- try
- {
- handler.handle(callbacks);
- userPrincipal = sac.getPrincipal();
- clientChallenge = (byte[]) sac.getCredential();
- sac.clearCredential();
- }
- catch(java.io.IOException e)
- {
- throw new LoginException(e.toString());
- }
- catch(UnsupportedCallbackException uce)
- {
- throw new LoginException("UnsupportedCallback: " +
uce.getCallback().toString());
- }
- catch(ClassCastException e)
- {
- throw new LoginException("Credential info is not of type byte[], "+
e.getMessage());
- }
- }
-
- /** This method obtains the session getClientResponse() value which
- contains the challenge the client used to verify the session key.
- */
- private boolean validateCache(SRPServerSession session)
- {
- byte[] challenge = session.getClientResponse();
- boolean isValid = Arrays.equals(challenge, clientChallenge);
- return isValid;
- }
-
+ private void getUserInfo() throws LoginException
+ {
+ // Get the security association info
+ if( handler == null )
+ throw new LoginException("No CallbackHandler provied");
+
+ SecurityAssociationCallback sac = new SecurityAssociationCallback();
+ Callback[] callbacks = { sac };
+ try
+ {
+ handler.handle(callbacks);
+ userPrincipal = sac.getPrincipal();
+ clientChallenge = (byte[]) sac.getCredential();
+ sac.clearCredential();
+ }
+ catch(java.io.IOException e)
+ {
+ throw new LoginException(e.toString());
+ }
+ catch(UnsupportedCallbackException uce)
+ {
+ throw new LoginException("UnsupportedCallback: " +
uce.getCallback().toString());
+ }
+ catch(ClassCastException e)
+ {
+ throw new LoginException("Credential info is not of type byte[], "+
e.getMessage());
+ }
+ }
+
+ /** This method obtains the session getClientResponse() value which
+ contains the challenge the client used to verify the session key.
+ */
+ private boolean validateCache(SRPServerSession session)
+ {
+ byte[] challenge = session.getClientResponse();
+ boolean isValid = Arrays.equals(challenge, clientChallenge);
+ return isValid;
+ }
+
}
1.2.4.3 +272 -249 jbosssx/src/main/org/jboss/security/srp/jaas/SRPLoginModule.java
Index: SRPLoginModule.java
===================================================================
RCS file:
/cvsroot/jboss/jbosssx/src/main/org/jboss/security/srp/jaas/SRPLoginModule.java,v
retrieving revision 1.2.4.2
retrieving revision 1.2.4.3
diff -u -r1.2.4.2 -r1.2.4.3
--- SRPLoginModule.java 9 Dec 2001 00:55:21 -0000 1.2.4.2
+++ SRPLoginModule.java 9 Apr 2002 04:13:03 -0000 1.2.4.3
@@ -1,5 +1,5 @@
/*
- * JBoss, the OpenSource EJB server
+ * JBoss, the OpenSource J2EE WebOS
*
* Distributable under LGPL license.
* See terms of license at gnu.org.
@@ -11,6 +11,7 @@
import java.security.Principal;
import java.util.Map;
import java.util.Set;
+import javax.crypto.spec.SecretKeySpec;
import javax.naming.InitialContext;
import javax.security.auth.Subject;
import javax.security.auth.callback.CallbackHandler;
@@ -21,305 +22,327 @@
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
-import org.jboss.security.Logger;
+import org.jboss.logging.Logger;
import org.jboss.security.Util;
import org.jboss.security.srp.SRPClientSession;
+import org.jboss.security.srp.SRPParameters;
import org.jboss.security.srp.SRPServerInterface;
-import org.jboss.security.srp.SRPServerInterface.SRPParameters;
/** A login module that uses the SRP protocol documented in RFC2945
-to authenticate a username & password in a secure fashion without
-using an encrypted channel.
-
-The supported configuration options include:
-<ul>
+ to authenticate a username & password in a secure fashion without
+ using an encrypted channel.
+
+ The supported configuration options include:
+ <ul>
<li>principalClassName: the fully qualified class name of the
java.security.Principal
implementation to use. The implementation must provide a public constructor that
accepts a single String argument representing the name of the principal.
If not specified this defaults to org.jboss.security.SimplePrincipal.
</li>
-
+
<li>srpServerJndiName: the JNDI name of the SRPServerInterface object to use
for communicating with the SRP authentication server. If both srpServerJndiName
and srpServerRmiUrl options are specified, the srpServerJndiName is tried before
srpServerRmiUrl.
</li>
-
+
<li>srpServerRmiUrl: the RMI protocol URL string for the location of the
SRPServerInterface proxy to use for communicating with the SRP authentication
server.
</li>
-</ul>
-
-This product uses the 'Secure Remote Password' cryptographic
-authentication system developed by Tom Wu ([EMAIL PROTECTED]).
-
-@author [EMAIL PROTECTED]
-@version $Revision: 1.2.4.2 $
-*/
+ </ul>
+
+ This product uses the 'Secure Remote Password' cryptographic
+ authentication system developed by Tom Wu ([EMAIL PROTECTED]).
+
+ @author [EMAIL PROTECTED]
+ @version $Revision: 1.2.4.3 $
+ */
public class SRPLoginModule implements LoginModule
{
- private Subject subject;
- private CallbackHandler handler;
- private Map sharedState;
- private String principalClassName;
- private String srpServerRmiUrl;
- private String srpServerJndiName;
- private String username;
- private String password;
- private Principal userPrincipal;
- private byte[] sessionKey;
- private boolean loginFailed;
- private Logger log;
-
- /** Creates new SRPLoginModule */
- public SRPLoginModule()
- {
- }
-
-// --- Begin LoginModule interface methods
- /**
+ private Subject subject;
+ private CallbackHandler handler;
+ private Map sharedState;
+ private String principalClassName;
+ private String srpServerRmiUrl;
+ private String srpServerJndiName;
+ private String username;
+ private char[] password;
+ private SRPServerInterface srpServer;
+ private SRPParameters params;
+ private Principal userPrincipal;
+ private byte[] sessionKey;
+ private boolean loginFailed;
+ private Logger log;
+
+ /** Creates new SRPLoginModule */
+ public SRPLoginModule()
+ {
+ }
+
+ // --- Begin LoginModule interface methods
+ /**
@param subject, the subject to authenticate
@param handler, the app CallbackHandler used to obtain username & password
@param sharedState, used to propagate the authenticated principal and
- credential hash.
+ credential hash.
@param options, the login module options. These include:
- principalClassName: the java.security.Principal class name implimentation
to use.
- srpServerJndiName: the jndi name of the SRPServerInterface implimentation
to use. This
- is tried before srpServerRmiUrl.
- srpServerRmiUrl: the rmi url for the SRPServerInterface implimentation to
use.
+ principalClassName: the java.security.Principal class name implimentation to
use.
+ srpServerJndiName: the jndi name of the SRPServerInterface implimentation to
use. This
+ is tried before srpServerRmiUrl.
+ srpServerRmiUrl: the rmi url for the SRPServerInterface implimentation to use.
*/
- public void initialize(Subject subject, CallbackHandler handler, Map
sharedState, Map options)
- {
- this.subject = subject;
- this.handler = handler;
- this.sharedState = sharedState;
- principalClassName = (String) options.get("principalClassName");
- if( principalClassName == null )
- principalClassName = "org.jboss.security.SimplePrincipal";
- srpServerJndiName = (String) options.get("srpServerJndiName");
- srpServerRmiUrl = (String) options.get("srpServerRmiUrl");
- log = Logger.getLogger(getClass());
- }
-
- /** This is where the SRP protocol exchange occurs.
+ public void initialize(Subject subject, CallbackHandler handler, Map
sharedState, Map options)
+ {
+ this.subject = subject;
+ this.handler = handler;
+ this.sharedState = sharedState;
+ principalClassName = (String) options.get("principalClassName");
+ if( principalClassName == null )
+ principalClassName = "org.jboss.security.SimplePrincipal";
+ srpServerJndiName = (String) options.get("srpServerJndiName");
+ srpServerRmiUrl = (String) options.get("srpServerRmiUrl");
+ log = Logger.getLogger(getClass());
+ }
+
+ /** This is where the SRP protocol exchange occurs.
@return true is login succeeds, false if login does not apply.
@exception LoginException, thrown on login failure.
*/
- public boolean login() throws LoginException
- {
- loginFailed = true;
- getUserInfo();
- SRPServerInterface server;
- // First try to locate an SRPServerInterface using JNDI
- if( srpServerJndiName != null )
- {
- server = loadServerFromJndi(srpServerJndiName);
- }
- else if( srpServerRmiUrl != null )
- {
- server = loadServer(srpServerRmiUrl);
- }
- else
- {
- throw new LoginException("No option specified to access a
SRPServerInterface instance");
- }
- if( server == null )
- throw new LoginException("Failed to access a SRPServerInterface
instance");
-
- byte[] M1, M2;
- SRPClientSession client = null;
- try
- { // Perform the SRP login protocol
+ public boolean login() throws LoginException
+ {
+ boolean trace = log.isTraceEnabled();
+ loginFailed = true;
+ getUserInfo();
+ // First try to locate an SRPServerInterface using JNDI
+ if( srpServerJndiName != null )
+ {
+ srpServer = loadServerFromJndi(srpServerJndiName);
+ }
+ else if( srpServerRmiUrl != null )
+ {
+ srpServer = loadServer(srpServerRmiUrl);
+ }
+ else
+ {
+ throw new LoginException("No option specified to access a
SRPServerInterface instance");
+ }
+ if( srpServer == null )
+ throw new LoginException("Failed to access a SRPServerInterface instance");
+
+ byte[] M1, M2;
+ SRPClientSession client = null;
+ try
+ { // Perform the SRP login protocol
+ if( trace )
log.trace("Getting SRP parameters for username: "+username);
- Util.init();
- SRPParameters params = server.getSRPParameters(username);
+ Util.init();
+ params = srpServer.getSRPParameters(username);
+ if( trace )
+ {
log.trace("N: "+Util.tob64(params.N));
log.trace("g: "+Util.tob64(params.g));
log.trace("s: "+Util.tob64(params.s));
- byte[] hn = Util.newDigest().digest(params.N);
+ }
+ byte[] hn = Util.newDigest().digest(params.N);
+ if( trace )
log.trace("H(N): "+Util.tob64(hn));
- byte[] hg = Util.newDigest().digest(params.g);
+ byte[] hg = Util.newDigest().digest(params.g);
+ if( trace )
+ {
log.trace("H(g): "+Util.tob64(hg));
log.trace("Creating SRPClientSession");
- client = new SRPClientSession(username, password, params.s, params.N,
params.g);
+ }
+ client = new SRPClientSession(username, password, params);
+ if( trace )
log.trace("Generating client public key");
- byte[] A = client.exponential();
+ byte[] A = client.exponential();
+ if( trace )
log.trace("Exchanging public keys");
- byte[] B = server.init(username, A);
+ byte[] B = srpServer.init(username, A);
+ if( trace )
log.trace("Generating server challenge");
- M1 = client.response(B);
+ M1 = client.response(B);
+ if( trace )
log.trace("Exchanging challenges");
- M2 = server.verify(username, M1);
- sessionKey = client.getSessionKey();
- }
- catch(Exception e)
- {
- log.warn("Failed to complete SRP login", e);
- throw new LoginException("Failed to complete SRP login,
msg="+e.getMessage());
- }
- finally
- {
- server = null;
- }
-
- log.trace("Verifying server response");
- if( client.verify(M2) == false )
- throw new LoginException("Failed to validate server reply");
- log.trace("Login succeeded");
-
- // Put the username and the client challenge into the sharedState map
- sharedState.put("javax.security.auth.login.name", username);
- sharedState.put("javax.security.auth.login.password", M1);
- loginFailed = false;
- return true;
- }
+ M2 = srpServer.verify(username, M1);
+ sessionKey = client.getSessionKey();
+ }
+ catch(Exception e)
+ {
+ log.warn("Failed to complete SRP login", e);
+ throw new LoginException("Failed to complete SRP login,
msg="+e.getMessage());
+ }
+
+ if( trace )
+ log.trace("Verifying server response");
+ if( client.verify(M2) == false )
+ throw new LoginException("Failed to validate server reply");
+ if( trace )
+ log.trace("Login succeeded");
+
+ // Put the username and the client challenge into the sharedState map
+ sharedState.put("javax.security.auth.login.name", username);
+ sharedState.put("javax.security.auth.login.password", M1);
+ loginFailed = false;
+ return true;
+ }
- /** All login modules have completed the login() phase, comit if we
+ /** All login modules have completed the login() phase, comit if we
succeeded. This entails adding an instance of principalClassName to the
subject principals set and the private session key to the PrivateCredentials
set.
-
+
@return false, if the login() failed, true if the commit succeeds.
@exception LoginException, thrown on failure to create a Principal.
*/
- public boolean commit() throws LoginException
- {
- if( loginFailed == true )
- return false;
- if( principalClassName == null )
- throw new LoginException("No principalClassName specified");
-
- // Associate an instance of Principal with the subject
- userPrincipal = null;
- try
- {
- ClassLoader loader = Thread.currentThread().getContextClassLoader();
- Class clazz = loader.loadClass(principalClassName);
- Class[] parameterTypes = {String.class};
- Constructor ctor = clazz.getConstructor(parameterTypes);
- String[] args = {username};
- userPrincipal = (Principal) ctor.newInstance(args);
- }
- catch(Exception e)
- {
- throw new LoginException("Failed to create Principal, "+e.getMessage());
- }
- finally
- {
- password = null;
- }
- subject.getPrincipals().add(userPrincipal);
- subject.getPrivateCredentials().add(sessionKey);
-
- return true;
- }
-
- public boolean abort() throws LoginException
- {
- username = null;
- password = null;
- return true;
- }
-
+ public boolean commit() throws LoginException
+ {
+ if( loginFailed == true )
+ return false;
+ if( principalClassName == null )
+ throw new LoginException("No principalClassName specified");
+
+ // Associate an instance of Principal with the subject
+ userPrincipal = null;
+ try
+ {
+ ClassLoader loader = Thread.currentThread().getContextClassLoader();
+ Class clazz = loader.loadClass(principalClassName);
+ Class[] parameterTypes = {String.class};
+ Constructor ctor = clazz.getConstructor(parameterTypes);
+ String[] args = {username};
+ userPrincipal = (Principal) ctor.newInstance(args);
+ }
+ catch(Exception e)
+ {
+ throw new LoginException("Failed to create Principal, "+e.getMessage());
+ }
+ finally
+ {
+ password = null;
+ }
+ subject.getPrincipals().add(userPrincipal);
+ Set privateCredentials = subject.getPrivateCredentials();
+ privateCredentials.add(sessionKey);
+ if( params.cipherAlgorithm != null )
+ {
+ SecretKeySpec secretKey = new SecretKeySpec(sessionKey,
params.cipherAlgorithm);
+ privateCredentials.add(secretKey);
+ }
+ privateCredentials.add(params);
+
+ return true;
+ }
+
+ public boolean abort() throws LoginException
+ {
+ username = null;
+ password = null;
+ return true;
+ }
- /** Remove the userPrincipal associated with the subject.
+ /** Remove the userPrincipal associated with the subject.
@return true always.
@exception LoginException, thrown on exception during remove of the Principal
- added during the commit.
+ added during the commit.
*/
- public boolean logout() throws LoginException
- {
- try
- {
- if( subject.isReadOnly() == false )
- { // Remove userPrincipal
- Set s = subject.getPrincipals(userPrincipal.getClass());
- s.remove(userPrincipal);
- subject.getPrivateCredentials().remove(sessionKey);
- }
- }
- catch(Exception e)
- {
- throw new LoginException("Failed to remove user principal,
"+e.getMessage());
- }
- return true;
- }
+ public boolean logout() throws LoginException
+ {
+ try
+ {
+ if( subject.isReadOnly() == false )
+ { // Remove userPrincipal
+ Set s = subject.getPrincipals(userPrincipal.getClass());
+ s.remove(userPrincipal);
+ subject.getPrivateCredentials().remove(sessionKey);
+ }
+ if( srpServer != null )
+ {
+ srpServer.close(username);
+ }
+ }
+ catch(Exception e)
+ {
+ throw new LoginException("Failed to remove user principal,
"+e.getMessage());
+ }
+ return true;
+ }
// --- End LoginModule interface methods
- private void getUserInfo() throws LoginException
- {
- // See if there is a shared username & password
- String _username = (String)
sharedState.get("javax.security.auth.login.name");
- char[] _password = null;
- if( username != null )
- {
- Object pw = sharedState.get("javax.security.auth.login.password");
- if( pw instanceof char[] )
- _password = (char[]) pw;
- else if( pw != null )
- _password = pw.toString().toCharArray();
- }
-
- // If we have a username, password return
- if( _username != null && _password != null )
- {
- username = _username;
- password = new String(_password);
- return;
- }
-
- // Request a username and password
- if( handler == null )
- throw new LoginException("No CallbackHandler provied to
SRPLoginModule");
-
- NameCallback nc = new NameCallback("Username: ", "guest");
- PasswordCallback pc = new PasswordCallback("Password: ", false);
- Callback[] callbacks = { nc, pc };
- try
- {
- handler.handle(callbacks);
- username = nc.getName();
- _password = pc.getPassword();
- if( _password != null )
- password = new String(_password);
- pc.clearPassword();
- }
- catch(java.io.IOException e)
- {
- throw new LoginException(e.toString());
- }
- catch(UnsupportedCallbackException uce)
- {
- throw new LoginException("UnsupportedCallback: " +
uce.getCallback().toString());
- }
- }
-
- private SRPServerInterface loadServerFromJndi(String jndiName)
- {
- SRPServerInterface server = null;
- try
- {
- InitialContext ctx = new InitialContext();
- server = (SRPServerInterface) ctx.lookup(jndiName);
- }
- catch(Exception e)
- {
- e.printStackTrace();
- }
- return server;
- }
- private SRPServerInterface loadServer(String rmiUrl)
- {
- SRPServerInterface server = null;
- try
- {
- server = (SRPServerInterface) Naming.lookup(rmiUrl);
- }
- catch(Exception e)
- {
- e.printStackTrace();
- }
- return server;
- }
+ private void getUserInfo() throws LoginException
+ {
+ // See if there is a shared username & password
+ String _username = (String) sharedState.get("javax.security.auth.login.name");
+ char[] _password = null;
+ if( username != null )
+ {
+ Object pw = sharedState.get("javax.security.auth.login.password");
+ if( pw instanceof char[] )
+ _password = (char[]) pw;
+ else if( pw != null )
+ _password = pw.toString().toCharArray();
+ }
+
+ // If we have a username, password return
+ if( _username != null && _password != null )
+ {
+ username = _username;
+ password = _password;
+ return;
+ }
+
+ // Request a username and password
+ if( handler == null )
+ throw new LoginException("No CallbackHandler provied to SRPLoginModule");
+
+ NameCallback nc = new NameCallback("Username: ", "guest");
+ PasswordCallback pc = new PasswordCallback("Password: ", false);
+ Callback[] callbacks = { nc, pc };
+ try
+ {
+ handler.handle(callbacks);
+ username = nc.getName();
+ _password = pc.getPassword();
+ if( _password != null )
+ password = _password;
+ pc.clearPassword();
+ }
+ catch(java.io.IOException e)
+ {
+ throw new LoginException(e.toString());
+ }
+ catch(UnsupportedCallbackException uce)
+ {
+ throw new LoginException("UnsupportedCallback: " +
uce.getCallback().toString());
+ }
+ }
+
+ private SRPServerInterface loadServerFromJndi(String jndiName)
+ {
+ SRPServerInterface server = null;
+ try
+ {
+ InitialContext ctx = new InitialContext();
+ server = (SRPServerInterface) ctx.lookup(jndiName);
+ }
+ catch(Exception e)
+ {
+ e.printStackTrace();
+ }
+ return server;
+ }
+ private SRPServerInterface loadServer(String rmiUrl)
+ {
+ SRPServerInterface server = null;
+ try
+ {
+ server = (SRPServerInterface) Naming.lookup(rmiUrl);
+ }
+ catch(Exception e)
+ {
+ e.printStackTrace();
+ }
+ return server;
+ }
}
_______________________________________________
Jboss-development mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-development
