BasicAuthHandler obtains a Session ID by performing
* "basic" authentication, using either the "Authorization" or the
* "Proxy-Authorization" headers. This handler prevents
* subsequent downstream handlers from being accessed unless the proper
* authentication was seen in the request. The Session ID obtained by this
* handler is meant to be used by those downsteams handlers to access
* whatever session-dependent information they need.
*
* If the request does not contain the authentication headers or the
* authentication information is not valid, this handler sends an HTTP
* error message along with the "WWW-Authenticate" or "Proxy-Authenticate"
* header, as appropriate. See
* code,
* authorization,
* authenticate
*
* If the request does contain valid authentication information, the
* Session ID associated with the authentication information is inserted
* into the request properties, for use by downstream handlers. After
* inserting the Session ID, this handler returns false to
* allow the downstream handlers to run.
* IF the Session ID in empty (e.g. ""), then, although authenticateion
* succeeds, no Session Id property is set.
*
* The set of valid Session IDs is contained
* in a globally accessible table managed by the SessionManager,
* which may be initialized with a static table
* (see mapFile).
*
* The format of the initialization table (if any) described above is a * Java properties file where keys are the Base64 encoded strings obtained * from the Authentication header and the values are the associated Session * IDs. Base64 strings can contain the '=' character, but the keys in a * Java properties file cannot contain an '=' character, so all '=' characters * in the Base64 strings must be converted to '!' in the properties file, * as shown in the following sample properties file: *
* bXIuIGhhdGU6a2ZqYw!! = radion * Zm9vOmJhcg!! = foo ** The data in the SessionManager table doesn't use the '!'s, only ='s. *
false, to allow subsequent handlers
* to run and perhaps use the Session ID.
* * handlers=auth history file * * auth.class=BasicAuthHandler * auth.session=account * auth.message=Go away, you're not allowed here! * * history.class=HistoryHandler * history.session=account * * file.class=FileHandler * file.root=htdocs ** In the sample pseudo-configuation file specified above, the *
BasicAuthHandler is first invoked to see if the HTTP "basic"
* authentication header is present in the request. If it isn't, a nasty
* message is sent back. If the "basic" authentication header is present
* and corresponds to a user that the BasicAuthHandler knows
* about, the Session ID associated with that user is stored in the specified
* property named "account".
*
* Subsequently, the HistoryHandler examines its specified
* property (also "account") for the Session ID and uses that to keep
* track of which session is issuing the HTTP request.
*
* Each handler that needs a Session ID should have a * configuration parameter that allows the web developer to specify the * name of the request property that holds the Session ID. * Multiple handlers can all use the same request property as each other, * all protected by the same authentication handler. *
code
* * The value 401 corresponds to standard "basic" authentication. * The "Authorization" request header is supposed to contain the * authentication string. If the request was not authenticated, the * "WWW-Authenticate" header is sent in the HTTP error response * to cause the browser to prompt the client to authenticate. *
* The value 407 corresponds to "basic" proxy/firewall authentication. * The "Proxy-Authorization" request header is supposed to contain the * authentication string. If the request was not authenticated, the * "Proxy-Authenticate" header is sent in the HTTP error response * to cause the browser to prompt the client to authenticate. *
* Any other value may also be specified. Whatever the value, it will * be returned as the HTTP result code of the error message. * * *
authorization
* code.
*
*
* authenticate
* * If this string is "", then this handler will * authenticate the request if the authorization header is present, * but will not send an HTTP error message if the request could * not be authenticated. This is useful if the web developer wants to * do something more complex (such as invoking an arbitrary set of * handlers) instead of just sending a simple error message if the * request was not authenticated. In this case, the web developer can * determine that the request was not authenticated because no * Session ID will be present in the request properties. * *
realm
* message
* request.props.
*
* mapFile
*
* The keys in the file are basic authentication (base64) tokens with
* any trailing "=" characters changed to "!".
*
*
session
* ident
* ident argument to {@link SessionManager#getSession}
* to get the table of valid sessions. The default value is
* "authorized". If ident is of the form
* ident:session, then the session
* portion is used as the session argument to
* SessionManager.get(). Otherwise the session
* argument is NULL. This table may be manipulated with the SetTemplate,
* using the "ident" namespace and "session" for the
* SetTemplate "sessionTable" parameter.
* mapFile
* parameter is specified but that file cannot be loaded.
*
* @param server
* The HTTP server that created this handler.
*
* @param propsPrefix
* A prefix to prepend to all of the keys that this
* handler uses to extract configuration information.
*
* @return true if this Handler initialized
* successfully, false otherwise.
*/
public boolean
init(Server server, String propsPrefix)
{
Properties props = server.props;
this.propsPrefix = propsPrefix;
isMine = new MatchString(propsPrefix, server.props);
try {
String str = props.getProperty(propsPrefix + CODE);
code = Integer.decode(str).intValue();
} catch (Exception e) {}
if (code == 407) {
authorization = "Proxy-Authorization";
authenticate = "Proxy-Authenticate";
}
authorization = props.getProperty(propsPrefix + AUTHORIZATION, authorization);
authenticate = props.getProperty(propsPrefix + AUTHENTICATE, authenticate);
realm = props.getProperty(propsPrefix + REALM, realm);
message = props.getProperty(propsPrefix + MESSAGE, message);
mapFile = props.getProperty(propsPrefix + MAP_FILE, mapFile);
session = props.getProperty(propsPrefix + SESSION, session);
ident = props.getProperty(propsPrefix + IDENT, ident);
int i = ident.indexOf(":");
if (i>0) {
sessionTable=ident.substring(i+1);
ident = ident.substring(0,i);
}
try {
if (message.startsWith("@")) {
message = ResourceHandler.getResourceString(server.props,
propsPrefix, message.substring(1));
}
} catch (IOException e) {
server.log(Server.LOG_ERROR, propsPrefix,
"Can't get \"denied\" message");
}
if (mapFile != null) try {
server.log(Server.LOG_DIAGNOSTIC, propsPrefix,
"Loading credentials file " + mapFile);
InputStream in = ResourceHandler.getResourceStream(server.props,
propsPrefix, mapFile);
Properties p = new Properties();
p.load(in);
in.close();
Properties map = (Properties) SessionManager.getSession(ident,
sessionTable, Properties.class);
Enumeration keys = p.keys();
while (keys.hasMoreElements()) {
String key = (String) keys.nextElement();
String value = (String) p.get(key);
map.put(key.replace('!', '='), value);
}
} catch (Exception e) {
server.log(Server.LOG_DIAGNOSTIC, propsPrefix,
"Credentials file (" + mapFile + ") not available: " + e);
}
mapFile = null;
return true;
}
/**
* Looks up the credentials for this request, and insert them into the
* request stream. If no credentials are found, prompt the user for them.
*/
public boolean
respond(Request request) throws IOException {
if (!isMine.match(request.url)) {
return false;
}
String auth = request.headers.get(authorization);
if (auth == null) {
return complain(request,"Missing http header: " + authorization);
}
try {
/*
* Strip off "basic" at beginning of value.
*/
StringTokenizer st = new StringTokenizer(auth);
if ("basic".equalsIgnoreCase(st.nextToken()) == false) {
return complain(request, "Non-basic realm: " + auth);
}
auth = st.nextToken();
String id;
request.log(Server.LOG_DIAGNOSTIC, propsPrefix,
"Session manager: " + ident + ":" + sessionTable);
Properties h = (Properties) SessionManager.getSession(ident,
sessionTable, Properties.class);
id = (String) h.getProperty(auth);
if (id == null) {
return complain(request, "no id matching: " + auth);
}
/*
* Found registered user, so add user to request properties.
*/
if (!id.equals("")) {
request.props.put(session, id);
request.props.put("gotCookie", "true");
request.log(Server.LOG_DIAGNOSTIC, propsPrefix,
"Setting " + session + " to: " + id);
} else {
request.log(Server.LOG_DIAGNOSTIC, propsPrefix,
"Authorization accepted, no session provided");
}
return false;
} catch (Exception e) {
/* Malformed authorization. */
return complain(request, e.toString());
}
}
/**
* Authentication failed.
* Send the appropriate authentication required header as a response.
* @param request The request to respond to
* @param reason The reason for failure (for diagnostics)
* @return True
*/
public boolean
complain(Request request, String reason)
throws IOException
{
if (authenticate.length() == 0) {
request.log(Server.LOG_DIAGNOSTIC, propsPrefix, "no authenticate?");
return false;
}
request.addHeader(authenticate, "basic realm=\"" + realm + "\"");
request.sendResponse(Format.subst(request.props, message),
"text/html", code);
request.log(Server.LOG_DIAGNOSTIC, propsPrefix, reason);
return true;
}
}