* A simplistic JAAS module to authenticate objects using an EODatabase object. *
* Supported Parameters: *
* Besides true/false other common results are EOs representing the account * or some UID. *
* The calling code will check the result object for success by calling
* UObject.boolValue(result).
*
* @param _login - the login to authenticate
* @param _password - the password to check
* @return an object representing the login result
*/
public Object checkLoginAndPassword(String _login, String _password) {
// TBD: provide some default implementation which checks for an 'Accounts'
// entity plus some fetch-spec?
return false;
}
/**
* This adds a principal to the subject being authenticated.
*
* @param _login - the login which got authenticated
* @param _loginResult - the result of the authentication method
* @return true if the principal could be added, false otherwise
*/
public boolean addPrincipalForAuthenticatedLogin
(String _login, Object _loginResult)
{
if (this.subject == null) {
log.error("EODatabaseLoginModule has no subject assigned?!");
return false;
}
Principal p = new EODatabasePrincipal(this.database, _login, _loginResult);
this.subject.getPrincipals().add(p);
return true;
}
/**
* You can use this to log or process authentication aborts (called by the
* abort() method.
*
* @param _principal - the EODatabasePrincipal which is getting aborted
*/
public void abortDatabasePrincipal(EODatabasePrincipal _principal) {
if (_principal == null)
return;
if (log.isInfoEnabled())
log.info("user login aborted by JAAS: " + _principal.getName());
_principal.dispose();
}
/**
* You can override this if you need special logout processing.
*
* @param _principal - the EODatabasePrincipal which shall be logged out
*/
public void logoutDatabasePrincipal(EODatabasePrincipal _principal) {
if (_principal == null)
return;
if (log.isInfoEnabled())
log.info("logout: " + _principal.getName());
_principal.dispose();
}
/* phase one: authenticate user or token */
/**
* This is the primary JAAS Phase 1 entry point. The default implementation
* grabs login/username from the CallbackHandler (eg the one provided by the
* JoHTTPAuthenticator) and calls loginWithUsernameAndPassword() with this
* information.
*
* @return true if authentication was successful, false otherwise
* @throws LoginException
*/
public boolean login() throws LoginException {
if (this.database == null)
throw new LoginException("missing valid JAAS EODatabase config!");
if (this.handler == null)
throw new LoginException("missing JAAS callback handler!");
return this.loginWithUsernameAndPassword();
}
protected boolean loginWithUsernameAndPassword(String _login, char[] _pwd)
throws LoginException
{
if (_login == null || _login.length() == 0)
throw new FailedLoginException(" got no login");
String pwd = new String(_pwd);
Object loginResult = this.checkLoginAndPassword(_login, pwd);
if (!UObject.boolValue(loginResult))
throw new FailedLoginException("login failed for user: " + _login);
return this.addPrincipalForAuthenticatedLogin(_login, loginResult);
}
/**
* This is the default JAAS Phase 1 implementation, which grabs login/pwd
* from the CallbackHandler (eg the one provided by the JoHTTPAuthenticator)
* and calls loginWithUsernameAndPassword() with this information.
*
* @return true if authentication was successful, false otherwise
* @throws LoginException
*/
protected boolean loginWithUsernameAndPassword() throws LoginException {
/* first retrieve username/password */
NameCallback nc = new NameCallback("login");
PasswordCallback pc = new PasswordCallback("password", false /* no echo */);
try {
this.handler.handle(new Callback[] { nc, pc });
}
catch (IOException ie) {
log.error("some IO error occurred during Name/PasswordCallback retrieval",
ie);
return false;
}
catch (UnsupportedCallbackException uce) {
/* token callbacks unsupported, this is OK */
return false;
}
/* then attempt a login */
return this.loginWithUsernameAndPassword(nc.getName(), pc.getPassword());
}
/* phase two */
public boolean commit() throws LoginException {
/* nothing to be done */
return true;
}
public boolean abort() throws LoginException {
Set