%line | %branch | |||||||||
---|---|---|---|---|---|---|---|---|---|---|
org.apache.jcs.utils.servlet.BasicHttpAuthenticator |
|
|
1 | package org.apache.jcs.utils.servlet; |
|
2 | ||
3 | /* |
|
4 | * Licensed to the Apache Software Foundation (ASF) under one |
|
5 | * or more contributor license agreements. See the NOTICE file |
|
6 | * distributed with this work for additional information |
|
7 | * regarding copyright ownership. The ASF licenses this file |
|
8 | * to you under the Apache License, Version 2.0 (the |
|
9 | * "License"); you may not use this file except in compliance |
|
10 | * with the License. You may obtain a copy of the License at |
|
11 | * |
|
12 | * http://www.apache.org/licenses/LICENSE-2.0 |
|
13 | * |
|
14 | * Unless required by applicable law or agreed to in writing, |
|
15 | * software distributed under the License is distributed on an |
|
16 | * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
|
17 | * KIND, either express or implied. See the License for the |
|
18 | * specific language governing permissions and limitations |
|
19 | * under the License. |
|
20 | */ |
|
21 | ||
22 | import java.io.IOException; |
|
23 | ||
24 | import javax.servlet.http.HttpServletRequest; |
|
25 | import javax.servlet.http.HttpServletResponse; |
|
26 | ||
27 | import org.apache.commons.logging.Log; |
|
28 | import org.apache.commons.logging.LogFactory; |
|
29 | import org.apache.jcs.utils.config.IUtilConstants; |
|
30 | ||
31 | import sun.misc.BASE64Decoder; |
|
32 | ||
33 | /** |
|
34 | * Used to perform basic http authentication. |
|
35 | */ |
|
36 | public class BasicHttpAuthenticator |
|
37 | { |
|
38 | 0 | private final static Log log = LogFactory.getLog( BasicHttpAuthenticator.class ); |
39 | ||
40 | /** Contains the "WWW-Authenticate" http response header. */ |
|
41 | private final String wwwAuthHeader; |
|
42 | ||
43 | /** |
|
44 | * @param jcs |
|
45 | * the jcs parameter used to specify the "WWW-Authenticate" http |
|
46 | * response header. |
|
47 | */ |
|
48 | public BasicHttpAuthenticator( String jcs ) |
|
49 | 0 | { |
50 | 0 | this.wwwAuthHeader = "BASIC jcs=\"" + jcs + "\""; |
51 | 0 | } |
52 | ||
53 | /** |
|
54 | * Authenticates the http <code>"Authorization"</code> header information. |
|
55 | * <p> |
|
56 | * @param req |
|
57 | * @param res |
|
58 | * @return boolean |
|
59 | */ |
|
60 | public final boolean authenticate( HttpServletRequest req, HttpServletResponse res ) |
|
61 | { |
|
62 | try |
|
63 | { |
|
64 | 0 | if ( !authorized( req.getHeader( "Authorization" ) ) ) |
65 | { |
|
66 | 0 | res.setContentType( "text/html" ); |
67 | 0 | res.setHeader( "WWW-Authenticate", wwwAuthHeader ); |
68 | 0 | res.sendError( HttpServletResponse.SC_UNAUTHORIZED ); |
69 | 0 | return false; |
70 | } |
|
71 | } |
|
72 | 0 | catch ( IOException ex ) |
73 | { |
|
74 | 0 | log.warn( ex.getMessage() ); |
75 | 0 | return false; |
76 | 0 | } |
77 | 0 | return true; |
78 | } |
|
79 | ||
80 | /** |
|
81 | * Returns true iff the given "Authorization" http request header contains |
|
82 | * authorized user id and password. |
|
83 | * <p> |
|
84 | * @param authHeader |
|
85 | * @return |
|
86 | * @throws IOException |
|
87 | */ |
|
88 | private boolean authorized( String authHeader ) |
|
89 | throws IOException |
|
90 | { |
|
91 | 0 | if ( authHeader == null || authHeader.length() < 9 ) |
92 | { |
|
93 | 0 | return false; |
94 | } |
|
95 | // Get encoded user and password, comes after "BASIC " |
|
96 | 0 | String userpassEncoded = authHeader.substring( 6 ); |
97 | ||
98 | 0 | BASE64Decoder dec = new BASE64Decoder(); |
99 | 0 | String userpassDecoded = new String( dec.decodeBuffer( userpassEncoded ) ); |
100 | 0 | int idx = userpassDecoded.indexOf( ':' ); |
101 | ||
102 | 0 | if ( idx == -1 ) |
103 | { |
|
104 | 0 | return false; |
105 | } |
|
106 | 0 | String userid = userpassDecoded.substring( 0, idx ); |
107 | 0 | String password = userpassDecoded.substring( idx + 1 ); |
108 | ||
109 | 0 | if ( userid.trim().length() <= 0 || password.trim().length() <= 0 ) |
110 | { |
|
111 | 0 | return false; |
112 | } |
|
113 | 0 | return checkPassword( userid, password ); |
114 | } |
|
115 | ||
116 | /** |
|
117 | * Default implementation of checking the password. |
|
118 | * <p> |
|
119 | * @param userid |
|
120 | * @param password |
|
121 | * @return true iff the given user id and password is valid. |
|
122 | */ |
|
123 | protected boolean checkPassword( String userid, String password ) |
|
124 | { |
|
125 | 0 | return userid.equalsIgnoreCase( IUtilConstants.ADMIN_USERID ) |
126 | && password.equals( IUtilConstants.ADMIN_PASSWORD ); |
|
127 | } |
|
128 | } |
This report is generated by jcoverage, Maven and Maven JCoverage Plugin. |