com.sun.enterprise.security.auth.realm.certificate.CertificateRealm Maven / Gradle / Ivy
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright 1997-2007 Sun Microsystems, Inc. All rights reserved.
*
* The contents of this file are subject to the terms of either the GNU
* General Public License Version 2 only ("GPL") or the Common Development
* and Distribution License("CDDL") (collectively, the "License"). You
* may not use this file except in compliance with the License. You can obtain
* a copy of the License at https://glassfish.dev.java.net/public/CDDL+GPL.html
* or glassfish/bootstrap/legal/LICENSE.txt. See the License for the specific
* language governing permissions and limitations under the License.
*
* When distributing the software, include this License Header Notice in each
* file and include the License file at glassfish/bootstrap/legal/LICENSE.txt.
* Sun designates this particular file as subject to the "Classpath" exception
* as provided by Sun in the GPL Version 2 section of the License file that
* accompanied this code. If applicable, add the following below the License
* Header, with the fields enclosed by brackets [] replaced by your own
* identifying information: "Portions Copyrighted [year]
* [name of copyright owner]"
*
* Contributor(s):
*
* If you wish your version of this file to be governed by only the CDDL or
* only the GPL Version 2, indicate your decision by adding "[Contributor]
* elects to include this software in this distribution under the [CDDL or GPL
* Version 2] license." If you don't indicate a single choice of license, a
* recipient has the option to distribute your version of this file under
* either the CDDL, the GPL Version 2 or to extend the choice of license to
* its licensees as provided above. However, if you add GPL Version 2 code
* and therefore, elected the GPL Version 2 license, then the option applies
* only if the new code is made subject to such option by the copyright
* holder.
*/
package com.sun.enterprise.security.auth.realm.certificate;
import java.util.*;
import java.util.logging.Level;
import java.io.*;
import java.security.*;
import javax.security.auth.login.*;
import javax.security.auth.Subject;
import org.glassfish.security.common.Group;
//import com.sun.enterprise.security.SecurityContext;
import com.sun.enterprise.security.auth.realm.BadRealmException;
import com.sun.enterprise.security.auth.realm.NoSuchUserException;
import com.sun.enterprise.security.auth.realm.NoSuchRealmException;
import com.sun.enterprise.security.auth.realm.InvalidOperationException;
import com.sun.enterprise.security.util.*;
import com.sun.enterprise.security.auth.realm.IASRealm;
import com.sun.enterprise.security.common.Util;
import com.sun.enterprise.security.integration.AppServSecurityContext;
import org.jvnet.hk2.annotations.Service;
import sun.security.x509.X500Name;
/**
* Realm wrapper for supporting certificate authentication.
*
* The certificate realm provides the security-service functionality
* needed to process a client-cert authentication. Since the SSL processing,
* and client certificate verification is done by NSS, no authentication
* is actually done by this realm. It only serves the purpose of being
* registered as the certificate handler realm and to service group
* membership requests during web container role checks.
*
*
There is no JAAS LoginModule corresponding to the certificate realm,
* therefore this realm does not require the jaas-context configuration
* parameter to be set. The purpose of a JAAS LoginModule is to implement
* the actual authentication processing, which for the case of this
* certificate realm is already done by the time execution gets to Java.
*
*
The certificate realm needs the following properties in its
* configuration: None.
*
*
The following optional attributes can also be specified:
*
* - assign-groups - A comma-separated list of group names which
* will be assigned to all users who present a cryptographically
* valid certificate. Since groups are otherwise not supported
* by the cert realm, this allows grouping cert users
* for convenience.
*
*
*/
@Service
public final class CertificateRealm extends IASRealm
{
// Descriptive string of the authentication type of this realm.
public static final String AUTH_TYPE = "certificate";
private Vector defaultGroups = new Vector();
// Optional link to a realm to verify group (possibly user, later)
// public static final String PARAM_USEREALM = "use-realm";
// Optional ordered list of possible elements to use as user name
// from X.500 name.
// public static final String PARAM_NAMEFIELD = "name-field";
// private String[] nameFields = null;
// private static final String LINK_SEP = ",";
/**
* Initialize a realm with some properties. This can be used
* when instantiating realms from their descriptions. This
* method is invoked from Realm during initialization.
*
* @param props Initialization parameters used by this realm.
* @exception BadRealmException If the configuration parameters
* identify a corrupt realm.
* @exception NoSuchRealmException If the configuration parameters
* specify a realm which doesn't exist.
*
*/
protected void init(Properties props)
throws BadRealmException, NoSuchRealmException
{
super.init(props);
String[] groups = addAssignGroups(null);
if (groups != null && groups.length > 0) {
for (String gp : groups) {
defaultGroups.add(gp);
}
}
/* future enhacement; allow using subset of DN as name field;
requires RI fixes to handle subject & principal names
consistently
String nameLink = props.getProperty(PARAM_NAMEFIELD);
if (nameLink == null) {
Util.debug(log, "CertificateRealm: No "+PARAM_NAMEFIELD+
" provided, will use X.500 name.");
} else {
StringTokenizer st = new StringTokenizer(nameLink, LINK_SEP);
int n = st.countTokens();
nameFields = new String[n];
for (int i=0; iAs noted, the certificate realm does not do the actual
* authentication (signature and cert chain validation) for
* the user certificate, this is done earlier in NSS. This method
* simply sets up the security context for the user in order to
* properly complete the authentication processing.
*
* If any groups have been assigned to cert-authenticated users
* through the assign-groups property these groups are added to
* the security context for the current user.
*
* @param subject The Subject object for the authentication request.
* @param x500name The X500Name object from the user certificate.
*
public void authenticate(Subject subject, X500Name x500name)
{
// It is important to use x500name.getName() in order to be
// consistent with web containers view of the name - see bug
// 4646134 for reasons why this matters.
String name = x500name.getName();
if (_logger.isLoggable(Level.FINEST)) {
_logger.finest(
"Certificate realm setting up security context for: "+ name);
}
if (defaultGroups != null) {
Set principalSet = subject.getPrincipals();
Enumeration e = defaultGroups.elements();
while (e.hasMoreElements()) {
principalSet.add(new Group((String) e.nextElement()));
}
}
SecurityContext securityContext =
new SecurityContext(name, subject);
SecurityContext.setCurrent(securityContext);
}*/
/**
* Complete authentication of certificate user.
*
*
As noted, the certificate realm does not do the actual
* authentication (signature and cert chain validation) for
* the user certificate, this is done earlier in NSS. This method
* simply sets up the security context for the user in order to
* properly complete the authentication processing.
*
*
If any groups have been assigned to cert-authenticated users
* through the assign-groups property these groups are added to
* the security context for the current user.
*
* @param subject The Subject object for the authentication request.
* @param x500name The X500Name object from the user certificate.
*
*/
public void authenticate(Subject subject, X500Name x500name)
{
// It is important to use x500name.getName() in order to be
// consistent with web containers view of the name - see bug
// 4646134 for reasons why this matters.
String name = x500name.getName();
if (_logger.isLoggable(Level.FINEST)) {
_logger.finest(
"Certificate realm setting up security context for: "+ name);
}
if (defaultGroups != null) {
Set principalSet = subject.getPrincipals();
Enumeration e = defaultGroups.elements();
while (e.hasMoreElements()) {
principalSet.add(new Group((String) e.nextElement()));
}
}
/*SecurityContext securityContext =
new SecurityContext(name, subject);
SecurityContext.setCurrent(securityContext);*/
AppServSecurityContext secContext = Util.getDefaultHabitat().getByContract(AppServSecurityContext.class);
AppServSecurityContext securityContext = secContext.newInstance(name, subject);
securityContext.setCurrentSecurityContext(securityContext);
}
}