Author: markt Date: Sun Mar 22 17:03:22 2009 New Revision: 757218 URL: http://svn.apache.org/viewvc?rev=757218&view=rev Log: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=41407 Add support for CLIENT-CERT authentication to JAAS realm.
Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASCallbackHandler.java tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASMemoryLoginModule.java tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASRealm.java tomcat/container/tc5.5.x/webapps/docs/changelog.xml tomcat/current/tc5.5.x/STATUS.txt Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASCallbackHandler.java URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASCallbackHandler.java?rev=757218&r1=757217&r2=757218&view=diff ============================================================================== --- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASCallbackHandler.java (original) +++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASCallbackHandler.java Sun Mar 22 17:03:22 2009 @@ -83,21 +83,22 @@ /** * Construct a callback handler for DIGEST authentication. * - * @param realm Our associated JAASRealm instance - * @param username Username to be authenticated with - * @param password Password to be authenticated with - * @param nonce Server generated nonce - * @param nc Nonce count - * @param cnonce Client generated nonce - * @param qop Quality of protection aplied to the message - * @param realmName Realm name - * @param md5a2 Second MD5 digest used to calculate the digest + * @param realm Our associated JAASRealm instance + * @param username Username to be authenticated with + * @param password Password to be authenticated with + * @param nonce Server generated nonce + * @param nc Nonce count + * @param cnonce Client generated nonce + * @param qop Quality of protection aplied to the message + * @param realmName Realm name + * @param md5a2 Second MD5 digest used to calculate the digest * MD5(Method + ":" + uri) + * @param authMethod The authentication mehtod in use */ public JAASCallbackHandler(JAASRealm realm, String username, String password, String nonce, String nc, String cnonce, String qop, String realmName, - String md5a2) { + String md5a2, String authMethod) { this(realm, username, password); this.nonce = nonce; this.nc = nc; @@ -105,6 +106,7 @@ this.qop = qop; this.realmName = realmName; this.md5a2 = md5a2; + this.authMethod = authMethod; } // ----------------------------------------------------- Instance Variables @@ -126,7 +128,6 @@ */ protected JAASRealm realm = null; - /** * The username to be authenticated with. */ @@ -162,6 +163,10 @@ */ protected String md5a2; + /** + * The authentication methdod to be used. If null, assume BASIC/FORM. + */ + protected String authMethod; // --------------------------------------------------------- Public Methods @@ -211,6 +216,8 @@ cb.setText(realmName); } else if (cb.getPrompt().equals("md5a2")) { cb.setText(md5a2); + } else if (cb.getPrompt().equals("authMethod")) { + cb.setText(authMethod); } else { throw new UnsupportedCallbackException(callbacks[i]); } Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASMemoryLoginModule.java URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASMemoryLoginModule.java?rev=757218&r1=757217&r2=757218&view=diff ============================================================================== --- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASMemoryLoginModule.java (original) +++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASMemoryLoginModule.java Sun Mar 22 17:03:22 2009 @@ -39,6 +39,7 @@ import org.apache.catalina.Context; import org.apache.catalina.Realm; +import org.apache.catalina.authenticator.Constants; import org.apache.catalina.connector.Request; import org.apache.catalina.deploy.SecurityConstraint; import org.apache.catalina.util.RequestUtil; @@ -309,7 +310,7 @@ // Set up our CallbackHandler requests if (callbackHandler == null) throw new LoginException("No CallbackHandler specified"); - Callback callbacks[] = new Callback[8]; + Callback callbacks[] = new Callback[9]; callbacks[0] = new NameCallback("Username: "); callbacks[1] = new PasswordCallback("Password: ", false); callbacks[2] = new TextInputCallback("nonce"); @@ -318,6 +319,7 @@ callbacks[5] = new TextInputCallback("qop"); callbacks[6] = new TextInputCallback("realmName"); callbacks[7] = new TextInputCallback("md5a2"); + callbacks[8] = new TextInputCallback("authMethod"); // Interact with the user to retrieve the username and password String username = null; @@ -328,6 +330,7 @@ String qop = null; String realmName = null; String md5a2 = null; + String authMethod = null; try { callbackHandler.handle(callbacks); @@ -340,6 +343,7 @@ qop = ((TextInputCallback) callbacks[5]).getText(); realmName = ((TextInputCallback) callbacks[6]).getText(); md5a2 = ((TextInputCallback) callbacks[7]).getText(); + authMethod = ((TextInputCallback) callbacks[8]).getText(); } catch (IOException e) { throw new LoginException(e.toString()); } catch (UnsupportedCallbackException e) { @@ -347,13 +351,16 @@ } // Validate the username and password we have received - if (md5a2 == null) { - // Not using DIGEST + if (authMethod == null) { + // BASIC or FORM principal = super.authenticate(username, password); - } else { - // Must be using DIGEST + } else if (authMethod.equals(Constants.DIGEST_METHOD)) { principal = super.authenticate(username, password, nonce, nc, cnonce, qop, realmName, md5a2); + } else if (authMethod.equals(Constants.CERT_METHOD)) { + principal = super.getPrincipal(username); + } else { + throw new LoginException("Unknown authentication method"); } log.debug("login " + username + " " + principal); Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASRealm.java URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASRealm.java?rev=757218&r1=757217&r2=757218&view=diff ============================================================================== --- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASRealm.java (original) +++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/realm/JAASRealm.java Sun Mar 22 17:03:22 2009 @@ -34,6 +34,7 @@ import org.apache.catalina.Container; import org.apache.catalina.LifecycleException; +import org.apache.catalina.authenticator.Constants; import org.apache.catalina.util.StringManager; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; @@ -340,13 +341,15 @@ * @param realmName Realm name * @param md5a2 Second MD5 digest used to calculate the digest * MD5(Method + ":" + uri) + * @param authMethod The authentication scheme in use */ public Principal authenticate(String username, String clientDigest, String nonce, String nc, String cnonce, String qop, String realmName, String md5a2) { return authenticate(username, new JAASCallbackHandler(this, username, clientDigest, nonce, - nc, cnonce, qop, realmName, md5a2)); + nc, cnonce, qop, realmName, md5a2, + Constants.DIGEST_METHOD)); } @@ -470,7 +473,9 @@ */ protected Principal getPrincipal(String username) { - return (null); + return authenticate(username, + new JAASCallbackHandler(this, username, null, null, null, null, + null, null, null, Constants.CERT_METHOD)); } Modified: tomcat/container/tc5.5.x/webapps/docs/changelog.xml URL: http://svn.apache.org/viewvc/tomcat/container/tc5.5.x/webapps/docs/changelog.xml?rev=757218&r1=757217&r2=757218&view=diff ============================================================================== --- tomcat/container/tc5.5.x/webapps/docs/changelog.xml (original) +++ tomcat/container/tc5.5.x/webapps/docs/changelog.xml Sun Mar 22 17:03:22 2009 @@ -35,6 +35,10 @@ <subsection name="Catalina"> <changelog> <fix> + <bug>41407</bug>: JAAS Realm now works with CLIENT-CERT authentication. + (markt) + </fix> + <fix> <bug>45576</bug>: JAAS Realm now works with DIGEST authentication. (markt) </fix> Modified: tomcat/current/tc5.5.x/STATUS.txt URL: http://svn.apache.org/viewvc/tomcat/current/tc5.5.x/STATUS.txt?rev=757218&r1=757217&r2=757218&view=diff ============================================================================== --- tomcat/current/tc5.5.x/STATUS.txt (original) +++ tomcat/current/tc5.5.x/STATUS.txt Sun Mar 22 17:03:22 2009 @@ -31,12 +31,6 @@ 0: fhanik - silently swallow an error, and default to the default config file, yoavs: don't like silent swallowing -1: -* Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=41407 - Add support for CLIENT-CERT to the JASSRealm. Builds on DIGEST patch above. - http://svn.apache.org/viewvc?rev=684270&view=rev - +1: markt, fhanik, mturk - -1: - * Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=45528 Improved fix that hopefully addresses previous concerns http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java?r1=685981&r2=687645&diff_format=h --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org