* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *
- * This TAF implements the "Basic Auth" protocol.
- *
- * WARNING! It is true for any implementation of "Basic Auth" that the password is passed unencrypted.
- * This is because the expectation, when designed years ago, was that it would only be used in
+ *
+ * This TAF implements the "Basic Auth" protocol.
+ *
+ * WARNING! It is true for any implementation of "Basic Auth" that the password is passed unencrypted.
+ * This is because the expectation, when designed years ago, was that it would only be used in
* conjunction with SSL (https). It is common, however, for users to ignore this on the assumption that
* their internal network is secure, or just ignorance. Therefore, a WARNING will be printed
* when the HTTP Channel is not encrypted (unless explicitly turned off).
* conjunction with SSL (https). It is common, however, for users to ignore this on the assumption that
* their internal network is secure, or just ignorance. Therefore, a WARNING will be printed
* when the HTTP Channel is not encrypted (unless explicitly turned off).
public BasicHttpTaf(Access access, CredVal rbac, String realm, long timeToLive, boolean turnOnWarning) {
this.access = access;
this.realm = realm;
public BasicHttpTaf(Access access, CredVal rbac, String realm, long timeToLive, boolean turnOnWarning) {
this.access = access;
this.realm = realm;
this.timeToLive = timeToLive;
String csvFile = access.getProperty(Config.CADI_BATH_CONVERT, null);
if(csvFile==null) {
this.timeToLive = timeToLive;
String csvFile = access.getProperty(Config.CADI_BATH_CONVERT, null);
if(csvFile==null) {
- try {
- mapIds = new MapBathConverter(access, new CSV(access,csvFile));
- } catch (IOException | CadiException e) {
- access.log(e,"Bath Map Conversion is not initialzed (non fatal)");
- }
+ try {
+ mapIds = new MapBathConverter(access, new CSV(access,csvFile));
+ } catch (IOException | CadiException e) {
+ access.log(e,"Bath Map Conversion is not initialzed (non fatal)");
+ }
}
}
public void add(final CredValDomain cvd) {
rbacs.put(cvd.domain(), cvd);
}
}
}
public void add(final CredValDomain cvd) {
rbacs.put(cvd.domain(), cvd);
}
return DenialOfServiceTaf.respDenyID(access,bc.getUser());
}
CachedBasicPrincipal bp = new CachedBasicPrincipal(this,bc,realm,timeToLive);
return DenialOfServiceTaf.respDenyID(access,bc.getUser());
}
CachedBasicPrincipal bp = new CachedBasicPrincipal(this,bc,realm,timeToLive);
// access.log(Level.WARN,bp.getName() + ":" + new String(bp.getCred()));
if (cv.validate(bp.getName(),Type.PASSWORD,bp.getCred(),req)) {
return new BasicHttpTafResp(access,bp,bp.getName()+" authenticated by password",RESP.IS_AUTHENTICATED,resp,realm,false);
} else {
//TODO may need timed retries in a given time period
// access.log(Level.WARN,bp.getName() + ":" + new String(bp.getCred()));
if (cv.validate(bp.getName(),Type.PASSWORD,bp.getCred(),req)) {
return new BasicHttpTafResp(access,bp,bp.getName()+" authenticated by password",RESP.IS_AUTHENTICATED,resp,realm,false);
} else {
//TODO may need timed retries in a given time period
- return new BasicHttpTafResp(access,bc.getUser(),buildMsg(bp,req,"user/pass combo invalid for ",bc.getUser(),"from",req.getRemoteAddr()),
+ return new BasicHttpTafResp(access,bc.getUser(),buildMsg(bp,req,"user/pass combo invalid for ",bc.getUser(),"from",req.getRemoteAddr()),
RESP.TRY_AUTHENTICATING,resp,realm,true);
}
}
RESP.TRY_AUTHENTICATING,resp,realm,true);
}
}
}
try {
CachedBasicPrincipal ba = new CachedBasicPrincipal(this,authz,realm,timeToLive);
}
try {
CachedBasicPrincipal ba = new CachedBasicPrincipal(this,authz,realm,timeToLive);
if (DenialOfServiceTaf.isDeniedID(ba.getName())!=null) {
return DenialOfServiceTaf.respDenyID(access,ba.getName());
}
if (DenialOfServiceTaf.isDeniedID(ba.getName())!=null) {
return DenialOfServiceTaf.respDenyID(access,ba.getName());
}
// access.log(Level.WARN,ba.getName() + ":" + new String(ba.getCred()));
if (cv.validate(ba.getName(), Type.PASSWORD, ba.getCred(), req)) {
return new BasicHttpTafResp(access,ba, ba.getName()+" authenticated by BasicAuth password",RESP.IS_AUTHENTICATED,resp,realm,false);
} else {
//TODO may need timed retries in a given time period
// access.log(Level.WARN,ba.getName() + ":" + new String(ba.getCred()));
if (cv.validate(ba.getName(), Type.PASSWORD, ba.getCred(), req)) {
return new BasicHttpTafResp(access,ba, ba.getName()+" authenticated by BasicAuth password",RESP.IS_AUTHENTICATED,resp,realm,false);
} else {
//TODO may need timed retries in a given time period
- return new BasicHttpTafResp(access,target,buildMsg(ba,req,"user/pass combo invalid"),
+ return new BasicHttpTafResp(access,target,buildMsg(ba,req,"user/pass combo invalid"),
RESP.TRY_AUTHENTICATING,resp,realm,true);
}
} catch (IOException e) {
RESP.TRY_AUTHENTICATING,resp,realm,true);
}
} catch (IOException e) {
}
return new BasicHttpTafResp(access,target,"Requesting HTTP Basic Authorization",RESP.TRY_AUTHENTICATING,resp,realm,false);
}
}
return new BasicHttpTafResp(access,target,"Requesting HTTP Basic Authorization",RESP.TRY_AUTHENTICATING,resp,realm,false);
}
protected String buildMsg(Principal pr, HttpServletRequest req, Object ... msg) {
StringBuilder sb = new StringBuilder();
if (pr!=null) {
protected String buildMsg(Principal pr, HttpServletRequest req, Object ... msg) {
StringBuilder sb = new StringBuilder();
if (pr!=null) {
@Override
public Resp revalidate(CachedPrincipal prin, Object state) {
if (prin instanceof BasicPrincipal) {
@Override
public Resp revalidate(CachedPrincipal prin, Object state) {
if (prin instanceof BasicPrincipal) {