1+ package org .javaee7 .jaspic .customprincipal .sam ;
2+
3+ import static javax .security .auth .message .AuthStatus .SEND_SUCCESS ;
4+ import static javax .security .auth .message .AuthStatus .SUCCESS ;
5+
6+ import java .io .IOException ;
7+ import java .security .Principal ;
8+ import java .util .Map ;
9+
10+ import javax .security .auth .Subject ;
11+ import javax .security .auth .callback .Callback ;
12+ import javax .security .auth .callback .CallbackHandler ;
13+ import javax .security .auth .callback .UnsupportedCallbackException ;
14+ import javax .security .auth .message .AuthException ;
15+ import javax .security .auth .message .AuthStatus ;
16+ import javax .security .auth .message .MessageInfo ;
17+ import javax .security .auth .message .MessagePolicy ;
18+ import javax .security .auth .message .callback .CallerPrincipalCallback ;
19+ import javax .security .auth .message .callback .GroupPrincipalCallback ;
20+ import javax .security .auth .message .module .ServerAuthModule ;
21+ import javax .servlet .http .HttpServletRequest ;
22+ import javax .servlet .http .HttpServletResponse ;
23+
24+ /**
25+ * Variant of the SAM used by the basic-authentication test, where the so-called "Principal form" of the
26+ * CallerPrincipalCallback is used. Here we pass in a custom Principal instead of a string.
27+ *
28+ * @author Arjan Tijms
29+ *
30+ */
31+ public class TestServerAuthModule implements ServerAuthModule {
32+
33+ private CallbackHandler handler ;
34+ private Class <?>[] supportedMessageTypes = new Class [] { HttpServletRequest .class , HttpServletResponse .class };
35+
36+ @ Override
37+ public void initialize (MessagePolicy requestPolicy , MessagePolicy responsePolicy , CallbackHandler handler ,
38+ @ SuppressWarnings ("rawtypes" ) Map options ) throws AuthException {
39+ this .handler = handler ;
40+ }
41+
42+ @ Override
43+ public AuthStatus validateRequest (MessageInfo messageInfo , Subject clientSubject , Subject serviceSubject )
44+ throws AuthException {
45+
46+ HttpServletRequest request = (HttpServletRequest ) messageInfo .getRequestMessage ();
47+
48+ Callback [] callbacks ;
49+
50+ if (request .getParameter ("doLogin" ) != null ) {
51+
52+ // For the test perform a login by directly "returning" the details of the authenticated user.
53+ // Normally credentials would be checked and the details fetched from some repository
54+
55+ callbacks = new Callback [] {
56+ // The name of the authenticated user *** VIA A CUSTOM PRINCIPAL ***.
57+ // This is the main variant of this test vs basic-authentication
58+ new CallerPrincipalCallback (clientSubject , new MyPrincipal ("test" )),
59+ // the roles of the authenticated user
60+ new GroupPrincipalCallback (clientSubject , new String [] { "architect" })
61+ };
62+ } else {
63+
64+ // The JASPIC protocol for "do nothing"
65+ callbacks = new Callback [] { new CallerPrincipalCallback (clientSubject , (Principal ) null ) };
66+ }
67+
68+ try {
69+
70+ // Communicate the details of the authenticated user to the container. In many
71+ // cases the handler will just store the details and the container will actually handle
72+ // the login after we return from this method.
73+ handler .handle (callbacks );
74+
75+ } catch (IOException | UnsupportedCallbackException e ) {
76+ throw (AuthException ) new AuthException ().initCause (e );
77+ }
78+
79+ return SUCCESS ;
80+ }
81+
82+ @ Override
83+ public Class <?>[] getSupportedMessageTypes () {
84+ return supportedMessageTypes ;
85+ }
86+
87+ @ Override
88+ public AuthStatus secureResponse (MessageInfo messageInfo , Subject serviceSubject ) throws AuthException {
89+ return SEND_SUCCESS ;
90+ }
91+
92+ @ Override
93+ public void cleanSubject (MessageInfo messageInfo , Subject subject ) throws AuthException {
94+
95+ }
96+ }
0 commit comments