/jboss-as-7.1.1.Final/domain-management/src/main/java/org/jboss/as/domain/management/security/PropertiesCallbackHandler.java

  1/*
  2 * JBoss, Home of Professional Open Source.
  3 * Copyright 2011, Red Hat, Inc., and individual contributors
  4 * as indicated by the @author tags. See the copyright.txt file in the
  5 * distribution for a full listing of individual contributors.
  6 *
  7 * This is free software; you can redistribute it and/or modify it
  8 * under the terms of the GNU Lesser General Public License as
  9 * published by the Free Software Foundation; either version 2.1 of
 10 * the License, or (at your option) any later version.
 11 *
 12 * This software is distributed in the hope that it will be useful,
 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 15 * Lesser General Public License for more details.
 16 *
 17 * You should have received a copy of the GNU Lesser General Public
 18 * License along with this software; if not, write to the Free
 19 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 20 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 21 */
 22
 23package org.jboss.as.domain.management.security;
 24
 25import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.PATH;
 26import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.PLAIN_TEXT;
 27import static org.jboss.as.domain.management.DomainManagementLogger.ROOT_LOGGER;
 28import static org.jboss.as.domain.management.DomainManagementMessages.MESSAGES;
 29
 30import java.io.IOException;
 31import java.util.LinkedList;
 32import java.util.List;
 33import java.util.Properties;
 34
 35import javax.security.auth.callback.Callback;
 36import javax.security.auth.callback.NameCallback;
 37import javax.security.auth.callback.PasswordCallback;
 38import javax.security.auth.callback.UnsupportedCallbackException;
 39import javax.security.sasl.AuthorizeCallback;
 40import javax.security.sasl.RealmCallback;
 41
 42import org.jboss.dmr.ModelNode;
 43import org.jboss.msc.service.Service;
 44import org.jboss.msc.service.StartContext;
 45import org.jboss.msc.service.StartException;
 46import org.jboss.msc.service.StopContext;
 47import org.jboss.sasl.callback.DigestHashCallback;
 48
 49/**
 50 * A CallbackHandler obtaining the users and their passwords from a properties file.
 51 *
 52 * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
 53 */
 54public class PropertiesCallbackHandler extends PropertiesFileLoader implements Service<DomainCallbackHandler>,
 55        DomainCallbackHandler {
 56
 57    public static final String SERVICE_SUFFIX = "properties_authentication";
 58
 59    // Technically this CallbackHandler could also support the VerifyCallback callback, however at the moment
 60    // this is only likely to be used with the Digest mechanism so no need to add that support.
 61    private static final Class[] PLAIN_CALLBACKS = { AuthorizeCallback.class, RealmCallback.class, NameCallback.class,
 62            PasswordCallback.class };
 63    private static final Class[] DIGEST_CALLBACKS = { AuthorizeCallback.class, RealmCallback.class, NameCallback.class,
 64            DigestHashCallback.class };
 65
 66    private static final String DOLLAR_LOCAL = "$local";
 67
 68    private final Class[] supportedCallbacks;
 69
 70    private final String realm;
 71    private final boolean plainText;
 72
 73    public PropertiesCallbackHandler(String realm, ModelNode properties) {
 74        super(properties.require(PATH).asString());
 75        this.realm = realm;
 76        if (properties.hasDefined(PLAIN_TEXT)) {
 77            plainText = properties.require(PLAIN_TEXT).asBoolean();
 78        } else {
 79            plainText = false;
 80        }
 81        supportedCallbacks = plainText ? PLAIN_CALLBACKS : DIGEST_CALLBACKS;
 82    }
 83
 84    /*
 85     * Service Methods
 86     */
 87
 88    public void start(StartContext context) throws StartException {
 89        super.start(context);
 90    }
 91
 92    @Override
 93    protected void verifyProperties(Properties properties) throws IOException {
 94        final String admin = "admin";
 95        if (properties.contains(admin) && admin.equals(properties.get(admin))) {
 96            ROOT_LOGGER.userAndPasswordWarning();
 97        }
 98    }
 99
100    public void stop(StopContext context) {
101        super.stop(context);
102    }
103
104    public DomainCallbackHandler getValue() throws IllegalStateException, IllegalArgumentException {
105        return this;
106    }
107
108    /*
109     * DomainCallbackHandler Methods
110     */
111
112    public Class[] getSupportedCallbacks() {
113        return supportedCallbacks;
114    }
115
116    @Override
117    public boolean isReady() {
118        Properties users;
119        try {
120            users = getProperties();
121        } catch (IOException e) {
122            return false;
123        }
124        return (users.size() > 0);
125    }
126
127    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
128        List<Callback> toRespondTo = new LinkedList<Callback>();
129
130        String userName = null;
131        boolean userFound = false;
132
133        Properties users = getProperties();
134
135        // A single pass may be sufficient but by using a two pass approach the Callbackhandler will not
136        // fail if an unexpected order is encountered.
137
138        // First Pass - is to double check no unsupported callbacks and to retrieve
139        // information from the callbacks passing in information.
140        for (Callback current : callbacks) {
141
142            if (current instanceof AuthorizeCallback) {
143                toRespondTo.add(current);
144            } else if (current instanceof NameCallback) {
145                NameCallback nameCallback = (NameCallback) current;
146                userName = nameCallback.getDefaultName();
147                userFound = users.containsKey(userName);
148            } else if (current instanceof PasswordCallback && plainText) {
149                toRespondTo.add(current);
150            } else if (current instanceof DigestHashCallback && plainText == false) {
151                toRespondTo.add(current);
152            } else if (current instanceof RealmCallback) {
153                String realm = ((RealmCallback) current).getDefaultText();
154                if (this.realm.equals(realm) == false) {
155                    throw MESSAGES.invalidRealm(realm, this.realm);
156                }
157            } else {
158                throw new UnsupportedCallbackException(current);
159            }
160        }
161
162        // Second Pass - Now iterate the Callback(s) requiring a response.
163        for (Callback current : toRespondTo) {
164            if (current instanceof AuthorizeCallback) {
165                AuthorizeCallback authorizeCallback = (AuthorizeCallback) current;
166                // Don't support impersonating another identity
167                authorizeCallback.setAuthorized(authorizeCallback.getAuthenticationID().equals(
168                        authorizeCallback.getAuthorizationID()));
169            } else if (current instanceof PasswordCallback) {
170                if (userFound == false) {
171                    throw new UserNotFoundException(userName);
172                }
173                String password = users.get(userName).toString();
174                ((PasswordCallback) current).setPassword(password.toCharArray());
175            } else if (current instanceof DigestHashCallback) {
176                if (userFound == false) {
177                    throw new UserNotFoundException(userName);
178                }
179                String hash = users.get(userName).toString();
180                ((DigestHashCallback) current).setHexHash(hash);
181            }
182        }
183
184    }
185
186}