*
*/
public class HttpEpiTaf implements HttpTaf {
- private HttpTaf[] tafs;
- private Access access;
- private Locator<URI> locator;
- private TrustChecker trustChecker;
-
- /**
- * HttpEpiTaf constructor
- *
- * Construct the HttpEpiTaf from variable Http specific TAF parameters
-
- * @param tafs
- * @throws CadiException
- */
- public HttpEpiTaf(Access access, Locator<URI> locator, TrustChecker tc, HttpTaf ... tafs) throws CadiException{
- this.tafs = tafs;
- this.access = access;
- this.locator = locator;
- this.trustChecker = tc;
- // Establish what Header Property to look for UserChain/Trust Props
-
- if (tafs.length == 0) {
- throw new CadiException("Need at least one HttpTaf implementation in constructor");
- }
- }
-
- /**
- * validate
- *
- * Respond with the first Http specific TAF to authenticate user based on variable info
- * and "LifeForm" (is it a human behind a browser, or a server utilizing HTTP Protocol).
- *
- * If there is no HttpTAF that can authenticate, respond with the first TAF that suggests it can
- * establish an Authentication conversation (TRY_AUTHENTICATING) (Examples include a redirect to CSP
- * Servers for CSP Cookie, or BasicAuth 401 response, suggesting User/Password for given Realm
- * submission
- *
- * If no TAF declares either, respond with NullTafResp (which denies all questions)
- */
- public TafResp validate(LifeForm reading, HttpServletRequest req, HttpServletResponse resp) {
- // Given a LifeForm Neutral, for HTTP, we need to discover true Life-Form Readings
- if (reading == LifeForm.LFN) {
- reading = tricorderScan(req);
- }
- TafResp tresp = null;
- TafResp firstTry = null;
- List<Redirectable> redirectables = null;
- List<TafResp> log;
- if(access.willLog(Level.DEBUG)) {
- log = new ArrayList<>();
- } else {
- log = null;
- }
- try {
- for (HttpTaf taf : tafs) {
- final long start = System.nanoTime();
- tresp = taf.validate(reading, req, resp);
- addToLog(log, tresp, start);
- switch(tresp.isAuthenticated()) {
- case TRY_ANOTHER_TAF:
- break; // and loop
- case TRY_AUTHENTICATING:
- if (tresp instanceof Redirectable) {
- if (redirectables == null) {
- redirectables = new ArrayList<>();
- }
- redirectables.add((Redirectable)tresp);
- } else if (firstTry == null) {
- firstTry = tresp;
- }
- break;
- case IS_AUTHENTICATED:
- tresp = trustChecker.mayTrust(tresp, req);
- return tresp;
- default:
- return tresp;
- }
- }
- } finally {
- printLog(log);
- }
-
- // If No TAFs configured, at this point. It is safer at this point to be "not validated",
- // rather than "let it go"
- // Note: if exists, there will always be more than 0 entries, according to above code
- if (redirectables == null) {
- return (firstTry != null) ? firstTry : NullTafResp.singleton();
- }
-
- // If there is one Tryable entry then return it
- if (redirectables.size() > 1) {
- return LoginPageTafResp.create(access, locator, resp, redirectables);
- } else {
- return redirectables.get(0);
- }
- }
-
- public boolean revalidate(Principal prin) throws Exception {
- return false;
- }
-
- /*
- * Since this is internal, we use a little Star Trek humor to indicate looking in the HTTP Request to see if we can determine what kind
- * of "LifeForm" reading we can determine, i.e. is there a Human (CarbonBasedLifeForm) behind a browser, or is it mechanical
- * id (SiliconBasedLifeForm)? This makes a difference in some Authentication, i.e CSP, which doesn't work well for SBLFs
- */
- private LifeForm tricorderScan(HttpServletRequest req) {
- // For simplicity's sake, we'll say Humans use FQDNs, not IPs.
-
- // Current guess that only Browsers bother to set "Agent" codes that identify the kind of browser they are.
- // If mechanical frameworks are found that populate this, then more advanced analysis may be required
- // Jonathan 1/22/2013
- String agent = req.getHeader("User-Agent");
- if (agent != null && agent.startsWith("Mozilla")) { // covers I.E./Firefox/Safari/probably any other "advanced" Browser see http://en.wikipedia.org/wiki/User_agent
- return LifeForm.CBLF;
- }
- return LifeForm.SBLF; // notably skips "curl","wget", (which is desired behavior. We don't want to try CSP, etc on these)
- }
-
- public Resp revalidate(CachedPrincipal prin, Object state) {
- Resp resp;
- for (HttpTaf taf : tafs) {
- resp = taf.revalidate(prin, state);
- if (resp != Resp.NOT_MINE) {
- return resp;
- }
-// switch(resp) {
-// case NOT_MINE:
-// break;
-// default:
-// return resp;
-// }
- }
- return Resp.NOT_MINE;
- }
-
- private void addToLog(List<TafResp> log, final TafResp tresp, final long start) {
- if (log == null) {
- return;
- }
- tresp.timing(start);
- log.add(tresp);
- }
-
- private void printLog(List<TafResp> log) {
- if (log == null) {
- return;
- }
- for (TafResp tresp : log) {
- access.printf(Level.DEBUG, "%s: %s, ms=%f", tresp.taf(), tresp.desc(), tresp.timing());
- }
- }
-
- /**
- * List HttpTafs with their "toString" representations... primarily useful for Debugging in an IDE
- * like Eclipse.
- */
- public String toString() {
- StringBuilder sb = new StringBuilder();
- for (HttpTaf ht : tafs) {
- sb.append(ht.toString());
- sb.append(". ");
- }
- return sb.toString();
- }
+ private HttpTaf[] tafs;
+ private Access access;
+ private Locator<URI> locator;
+ private TrustChecker trustChecker;
+
+ /**
+ * HttpEpiTaf constructor
+ *
+ * Construct the HttpEpiTaf from variable Http specific TAF parameters
+
+ * @param tafs
+ * @throws CadiException
+ */
+ public HttpEpiTaf(Access access, Locator<URI> locator, TrustChecker tc, HttpTaf ... tafs) throws CadiException{
+ this.tafs = tafs;
+ this.access = access;
+ this.locator = locator;
+ this.trustChecker = tc;
+ // Establish what Header Property to look for UserChain/Trust Props
+
+ if (tafs.length == 0) {
+ throw new CadiException("Need at least one HttpTaf implementation in constructor");
+ }
+ }
+
+ /**
+ * validate
+ *
+ * Respond with the first Http specific TAF to authenticate user based on variable info
+ * and "LifeForm" (is it a human behind a browser, or a server utilizing HTTP Protocol).
+ *
+ * If there is no HttpTAF that can authenticate, respond with the first TAF that suggests it can
+ * establish an Authentication conversation (TRY_AUTHENTICATING) (Examples include a redirect to CSP
+ * Servers for CSP Cookie, or BasicAuth 401 response, suggesting User/Password for given Realm
+ * submission
+ *
+ * If no TAF declares either, respond with NullTafResp (which denies all questions)
+ */
+ public TafResp validate(LifeForm reading, HttpServletRequest req, HttpServletResponse resp) {
+ // Given a LifeForm Neutral, for HTTP, we need to discover true Life-Form Readings
+ if (reading == LifeForm.LFN) {
+ reading = tricorderScan(req);
+ }
+ TafResp tresp = null;
+ TafResp firstTry = null;
+ List<Redirectable> redirectables = null;
+ List<TafResp> log;
+ if(access.willLog(Level.DEBUG)) {
+ log = new ArrayList<>();
+ } else {
+ log = null;
+ }
+ try {
+ for (HttpTaf taf : tafs) {
+ final long start = System.nanoTime();
+ tresp = taf.validate(reading, req, resp);
+ addToLog(log, tresp, start);
+ switch(tresp.isAuthenticated()) {
+ case TRY_ANOTHER_TAF:
+ break; // and loop
+ case TRY_AUTHENTICATING:
+ if (tresp instanceof Redirectable) {
+ if (redirectables == null) {
+ redirectables = new ArrayList<>();
+ }
+ redirectables.add((Redirectable)tresp);
+ } else if (firstTry == null) {
+ firstTry = tresp;
+ }
+ break;
+ case IS_AUTHENTICATED:
+ tresp = trustChecker.mayTrust(tresp, req);
+ return tresp;
+ default:
+ return tresp;
+ }
+ }
+ } finally {
+ printLog(log);
+ }
+
+ // If No TAFs configured, at this point. It is safer at this point to be "not validated",
+ // rather than "let it go"
+ // Note: if exists, there will always be more than 0 entries, according to above code
+ if (redirectables == null) {
+ return (firstTry != null) ? firstTry : NullTafResp.singleton();
+ }
+
+ // If there is one Tryable entry then return it
+ if (redirectables.size() > 1) {
+ return LoginPageTafResp.create(access, locator, resp, redirectables);
+ } else {
+ return redirectables.get(0);
+ }
+ }
+
+ public boolean revalidate(Principal prin) throws Exception {
+ return false;
+ }
+
+ /*
+ * Since this is internal, we use a little Star Trek humor to indicate looking in the HTTP Request to see if we can determine what kind
+ * of "LifeForm" reading we can determine, i.e. is there a Human (CarbonBasedLifeForm) behind a browser, or is it mechanical
+ * id (SiliconBasedLifeForm)? This makes a difference in some Authentication, i.e CSP, which doesn't work well for SBLFs
+ */
+ private LifeForm tricorderScan(HttpServletRequest req) {
+ // For simplicity's sake, we'll say Humans use FQDNs, not IPs.
+
+ // Current guess that only Browsers bother to set "Agent" codes that identify the kind of browser they are.
+ // If mechanical frameworks are found that populate this, then more advanced analysis may be required
+ // Jonathan 1/22/2013
+ String agent = req.getHeader("User-Agent");
+ if (agent != null && agent.startsWith("Mozilla")) { // covers I.E./Firefox/Safari/probably any other "advanced" Browser see http://en.wikipedia.org/wiki/User_agent
+ return LifeForm.CBLF;
+ }
+ return LifeForm.SBLF; // notably skips "curl","wget", (which is desired behavior. We don't want to try CSP, etc on these)
+ }
+
+ public Resp revalidate(CachedPrincipal prin, Object state) {
+ Resp resp;
+ for (HttpTaf taf : tafs) {
+ resp = taf.revalidate(prin, state);
+ if (resp != Resp.NOT_MINE) {
+ return resp;
+ }
+// switch(resp) {
+// case NOT_MINE:
+// break;
+// default:
+// return resp;
+// }
+ }
+ return Resp.NOT_MINE;
+ }
+
+ private void addToLog(List<TafResp> log, final TafResp tresp, final long start) {
+ if (log == null) {
+ return;
+ }
+ tresp.timing(start);
+ log.add(tresp);
+ }
+
+ private void printLog(List<TafResp> log) {
+ if (log == null) {
+ return;
+ }
+ for (TafResp tresp : log) {
+ access.printf(Level.DEBUG, "%s: %s, ms=%f", tresp.taf(), tresp.desc(), tresp.timing());
+ }
+ }
+
+ /**
+ * List HttpTafs with their "toString" representations... primarily useful for Debugging in an IDE
+ * like Eclipse.
+ */
+ public String toString() {
+ StringBuilder sb = new StringBuilder();
+ for (HttpTaf ht : tafs) {
+ sb.append(ht.toString());
+ sb.append(". ");
+ }
+ return sb.toString();
+ }
}
Code Review / aaf / authz.git / blobdiff