All Downloads are FREE. Search and download functionalities are using the official Maven repository.
Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance.
Project price only 1 $
You can buy this project and download/modify it how often you want.
com.liferay.portal.servlet.filters.autologin.AutoLoginFilter Maven / Gradle / Ivy
/**
* Copyright (c) 2000-present Liferay, Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or modify it under
* the terms of the GNU Lesser General Public License as published by the Free
* Software Foundation; either version 2.1 of the License, or (at your option)
* any later version.
*
* This library is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
* details.
*/
package com.liferay.portal.servlet.filters.autologin;
import com.liferay.petra.string.StringPool;
import com.liferay.portal.kernel.log.Log;
import com.liferay.portal.kernel.log.LogFactoryUtil;
import com.liferay.portal.kernel.model.User;
import com.liferay.portal.kernel.security.auth.session.AuthenticatedSessionManagerUtil;
import com.liferay.portal.kernel.security.auto.login.AutoLogin;
import com.liferay.portal.kernel.security.pwd.PasswordEncryptorUtil;
import com.liferay.portal.kernel.service.UserLocalServiceUtil;
import com.liferay.portal.kernel.servlet.ProtectedServletRequest;
import com.liferay.portal.kernel.util.GetterUtil;
import com.liferay.portal.kernel.util.Portal;
import com.liferay.portal.kernel.util.PortalUtil;
import com.liferay.portal.kernel.util.StackTraceUtil;
import com.liferay.portal.kernel.util.StringBundler;
import com.liferay.portal.kernel.util.StringUtil;
import com.liferay.portal.kernel.util.URLCodec;
import com.liferay.portal.kernel.util.Validator;
import com.liferay.portal.kernel.util.WebKeys;
import com.liferay.portal.servlet.filters.BasePortalFilter;
import com.liferay.portal.util.PortalInstances;
import com.liferay.portal.util.PropsValues;
import com.liferay.registry.Registry;
import com.liferay.registry.RegistryUtil;
import com.liferay.registry.ServiceReference;
import com.liferay.registry.ServiceTracker;
import com.liferay.registry.ServiceTrackerCustomizer;
import java.util.Set;
import java.util.concurrent.CopyOnWriteArraySet;
import javax.servlet.FilterChain;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
/**
* @author Brian Wing Shun Chan
* @author Peter Fellwock
* @author Raymond Augé
*/
public class AutoLoginFilter extends BasePortalFilter {
protected String getLoginRemoteUser(
HttpServletRequest request, HttpServletResponse response,
HttpSession session, String[] credentials)
throws Exception {
if ((credentials == null) || (credentials.length != 3)) {
return null;
}
String jUsername = credentials[0];
String jPassword = credentials[1];
if (Validator.isNull(jUsername) || Validator.isNull(jPassword)) {
return null;
}
long userId = GetterUtil.getLong(jUsername);
if (userId <= 0) {
return null;
}
User user = UserLocalServiceUtil.fetchUserById(userId);
if ((user == null) || user.isLockout()) {
return null;
}
if (!PropsValues.AUTH_SIMULTANEOUS_LOGINS) {
AuthenticatedSessionManagerUtil.signOutSimultaneousLogins(userId);
}
if (PropsValues.SESSION_ENABLE_PHISHING_PROTECTION) {
session = AuthenticatedSessionManagerUtil.renewSession(
request, session);
}
session.setAttribute("j_username", jUsername);
// Not having access to the unencrypted password will not allow you to
// connect to external resources that require it (mail server)
if (GetterUtil.getBoolean(credentials[2])) {
session.setAttribute("j_password", jPassword);
}
else {
session.setAttribute(
"j_password",
PasswordEncryptorUtil.encrypt(jPassword, user.getPassword()));
if (PropsValues.SESSION_STORE_PASSWORD) {
session.setAttribute(WebKeys.USER_PASSWORD, jPassword);
}
}
session.setAttribute("j_remoteuser", jUsername);
if (PropsValues.PORTAL_JAAS_ENABLE) {
String mainPath = PortalUtil.getPathMain();
String redirect = mainPath.concat("/portal/protected");
if (PropsValues.AUTH_FORWARD_BY_LAST_PATH) {
redirect = redirect.concat("?redirect=");
String autoLoginRedirect = (String)request.getAttribute(
AutoLogin.AUTO_LOGIN_REDIRECT_AND_CONTINUE);
if (Validator.isNull(autoLoginRedirect)) {
autoLoginRedirect = PortalUtil.getCurrentCompleteURL(
request);
}
redirect = redirect.concat(
URLCodec.encodeURL(autoLoginRedirect));
}
response.sendRedirect(redirect);
}
return jUsername;
}
@Override
protected void processFilter(
HttpServletRequest request, HttpServletResponse response,
FilterChain filterChain)
throws Exception {
HttpSession session = request.getSession();
String host = PortalUtil.getHost(request);
if (PortalInstances.isAutoLoginIgnoreHost(host)) {
if (_log.isDebugEnabled()) {
_log.debug("Ignore host " + host);
}
processFilter(
AutoLoginFilter.class.getName(), request, response,
filterChain);
return;
}
String contextPath = PortalUtil.getPathContext();
String path = StringUtil.toLowerCase(request.getRequestURI());
if (!contextPath.equals(StringPool.SLASH) &&
path.contains(contextPath)) {
path = path.substring(contextPath.length());
}
if (PortalInstances.isAutoLoginIgnorePath(path)) {
if (_log.isDebugEnabled()) {
_log.debug("Ignore path " + path);
}
processFilter(
AutoLoginFilter.class.getName(), request, response,
filterChain);
return;
}
String remoteUser = request.getRemoteUser();
String jUserName = (String)session.getAttribute("j_username");
if (!PropsValues.AUTH_LOGIN_DISABLED && (remoteUser == null) &&
(jUserName == null)) {
for (AutoLogin autoLogin : _autoLogins) {
try {
String[] credentials = autoLogin.login(request, response);
String redirect = (String)request.getAttribute(
AutoLogin.AUTO_LOGIN_REDIRECT);
if (Validator.isNotNull(redirect)) {
response.sendRedirect(redirect);
return;
}
String loginRemoteUser = getLoginRemoteUser(
request, response, session, credentials);
if (loginRemoteUser != null) {
request = new ProtectedServletRequest(
request, loginRemoteUser);
if (PropsValues.PORTAL_JAAS_ENABLE) {
return;
}
if (!PropsValues.AUTH_FORWARD_BY_LAST_PATH) {
redirect = Portal.PATH_MAIN;
}
else {
redirect = (String)request.getAttribute(
AutoLogin.AUTO_LOGIN_REDIRECT_AND_CONTINUE);
}
if (Validator.isNotNull(redirect)) {
response.sendRedirect(redirect);
return;
}
}
}
catch (Exception e) {
StringBundler sb = new StringBundler(6);
sb.append("Current URL ");
String currentURL = PortalUtil.getCurrentURL(request);
sb.append(currentURL);
sb.append(" generates exception: ");
sb.append(e.getMessage());
if (_log.isInfoEnabled()) {
sb.append(" stack: ");
sb.append(StackTraceUtil.getStackTrace(e));
}
if (currentURL.endsWith(_PATH_CHAT_LATEST)) {
if (_log.isWarnEnabled()) {
_log.warn(sb.toString());
}
}
else {
_log.error(sb.toString());
}
}
}
}
processFilter(
AutoLoginFilter.class.getName(), request, response, filterChain);
}
private static final String _PATH_CHAT_LATEST = "/-/chat/latest";
private static final Log _log = LogFactoryUtil.getLog(
AutoLoginFilter.class);
private static final Set _autoLogins =
new CopyOnWriteArraySet<>();
private static final ServiceTracker _serviceTracker;
private static class AutoLoginServiceTrackerCustomizer
implements ServiceTrackerCustomizer {
@Override
public AutoLogin addingService(
ServiceReference serviceReference) {
if (GetterUtil.getBoolean(
serviceReference.getProperty("private.auto.login"))) {
return null;
}
Registry registry = RegistryUtil.getRegistry();
AutoLogin autoLogin = registry.getService(serviceReference);
if (autoLogin == null) {
return null;
}
_autoLogins.add(autoLogin);
return autoLogin;
}
@Override
public void modifiedService(
ServiceReference serviceReference, AutoLogin autoLogin) {
}
@Override
public void removedService(
ServiceReference serviceReference, AutoLogin autoLogin) {
Registry registry = RegistryUtil.getRegistry();
registry.ungetService(serviceReference);
_autoLogins.remove(autoLogin);
}
}
static {
Registry registry = RegistryUtil.getRegistry();
_serviceTracker = registry.trackServices(
AutoLogin.class, new AutoLoginServiceTrackerCustomizer());
_serviceTracker.open();
}
}
