org.argeo.slc.cms/src/org/argeo/slc/cms/httpclient3/SpnegoAuthScheme.java

   1 package org.argeo.slc.cms.httpclient3;
   2
   3 import java.net.URL;
   4 import java.security.PrivilegedExceptionAction;
   5 import java.util.ArrayList;
   6
   7 import javax.security.auth.Subject;
   8 import javax.security.auth.login.LoginContext;
   9
  10 import org.apache.commons.httpclient.Credentials;
  11 import org.apache.commons.httpclient.HttpClient;
  12 import org.apache.commons.httpclient.HttpMethod;
  13 import org.apache.commons.httpclient.auth.AuthPolicy;
  14 import org.apache.commons.httpclient.auth.AuthScheme;
  15 import org.apache.commons.httpclient.auth.AuthenticationException;
  16 import org.apache.commons.httpclient.auth.CredentialsProvider;
  17 import org.apache.commons.httpclient.auth.MalformedChallengeException;
  18 import org.apache.commons.httpclient.methods.GetMethod;
  19 import org.apache.commons.httpclient.params.DefaultHttpParams;
  20 import org.apache.commons.httpclient.params.HttpMethodParams;
  21 import org.apache.commons.httpclient.params.HttpParams;
  22 import org.argeo.cms.auth.RemoteAuthUtils;
  23
  24 //// Register client-side SPNEGO auth scheme
  25 //AuthPolicy.registerAuthScheme(SpnegoAuthScheme.NAME, SpnegoAuthScheme.class);
  26 //HttpParams params = DefaultHttpParams.getDefaultParams();
  27 //ArrayList<String> schemes = new ArrayList<>();
  28 //schemes.add(SpnegoAuthScheme.NAME);// SPNEGO preferred
  29 //// schemes.add(AuthPolicy.BASIC);// incompatible with Basic
  30 //params.setParameter(AuthPolicy.AUTH_SCHEME_PRIORITY, schemes);
  31 //params.setParameter(CredentialsProvider.PROVIDER, new HttpCredentialProvider());
  32 //params.setParameter(HttpMethodParams.COOKIE_POLICY, KernelConstants.COOKIE_POLICY_BROWSER_COMPATIBILITY);
  33 //// params.setCookiePolicy(CookiePolicy.BROWSER_COMPATIBILITY);
  34
  35
  36
  37 /** Implementation of the SPNEGO auth scheme. */
  38 public class SpnegoAuthScheme implements AuthScheme {
  39 //      private final static Log log = LogFactory.getLog(SpnegoAuthScheme.class);
  40
  41         public static final String NAME = "Negotiate";
  42 //      private final static Oid KERBEROS_OID;
  43 //      static {
  44 //              try {
  45 //                      KERBEROS_OID = new Oid("1.3.6.1.5.5.2");
  46 //              } catch (GSSException e) {
  47 //                      throw new IllegalStateException("Cannot create Kerberos OID", e);
  48 //              }
  49 //      }
  50
  51         private final static String DEFAULT_KERBEROS_SERVICE = "HTTP";
  52
  53         private boolean complete = false;
  54         private String realm;
  55
  56         @Override
  57         public void processChallenge(String challenge) throws MalformedChallengeException {
  58                 // if(tokenStr!=null){
  59                 // log.error("Received challenge while there is a token. Failing.");
  60                 // complete = false;
  61                 // }
  62
  63         }
  64
  65         @Override
  66         public String getSchemeName() {
  67                 return NAME;
  68         }
  69
  70         @Override
  71         public String getParameter(String name) {
  72                 return null;
  73         }
  74
  75         @Override
  76         public String getRealm() {
  77                 return realm;
  78         }
  79
  80         @Override
  81         public String getID() {
  82                 return NAME;
  83         }
  84
  85         @Override
  86         public boolean isConnectionBased() {
  87                 return true;
  88         }
  89
  90         @Override
  91         public boolean isComplete() {
  92                 return complete;
  93         }
  94
  95         @Override
  96         public String authenticate(Credentials credentials, String method, String uri) throws AuthenticationException {
  97                 // log.debug("authenticate " + method + " " + uri);
  98                 // return null;
  99                 throw new UnsupportedOperationException();
 100         }
 101
 102         @Override
 103         public String authenticate(Credentials credentials, HttpMethod method) throws AuthenticationException {
 104 //              GSSContext context = null;
 105                 String hostname;
 106                 try {
 107                         hostname = method.getURI().getHost();
 108                         String tokenStr = RemoteAuthUtils.createGssToken(null, DEFAULT_KERBEROS_SERVICE, hostname);
 109                         return "Negotiate " + tokenStr;
 110                 } catch (Exception e1) {
 111                         complete = true;
 112                         throw new AuthenticationException("Cannot authenticate " + method, e1);
 113                 }
 114 //              String serverPrinc = DEFAULT_KERBEROS_SERVICE + "@" + hostname;
 115 //
 116 //              try {
 117 //                      // Get service's principal name
 118 //                      GSSManager manager = GSSManager.getInstance();
 119 //                      GSSName serverName = manager.createName(serverPrinc, GSSName.NT_HOSTBASED_SERVICE, KERBEROS_OID);
 120 //
 121 //                      // Get the context for authentication
 122 //                      context = manager.createContext(serverName, KERBEROS_OID, null, GSSContext.DEFAULT_LIFETIME);
 123 //                      // context.requestMutualAuth(true); // Request mutual authentication
 124 //                      // context.requestConf(true); // Request confidentiality
 125 //                      context.requestCredDeleg(true);
 126 //
 127 //                      byte[] token = new byte[0];
 128 //
 129 //                      // token is ignored on the first call
 130 //                      token = context.initSecContext(token, 0, token.length);
 131 //
 132 //                      // Send a token to the server if one was generated by
 133 //                      // initSecContext
 134 //                      if (token != null) {
 135 //                              tokenStr = Base64.getEncoder().encodeToString(token);
 136 //                              // complete=true;
 137 //                      }
 138 //              } catch (GSSException e) {
 139 //                      complete = true;
 140 //                      throw new AuthenticationException("Cannot authenticate to " + serverPrinc, e);
 141 //              }
 142         }
 143
 144         public static void main(String[] args) {
 145                 String principal = System.getProperty("javax.security.auth.login.name");
 146                 if (args.length == 0 || principal == null) {
 147                         System.err.println("usage: java -Djavax.security.auth.login.name=<principal@REALM> "
 148                                         + SpnegoAuthScheme.class.getName() + " <url>");
 149                         System.exit(1);
 150                         return;
 151                 }
 152                 String url = args[0];
 153
 154                 URL jaasUrl = SpnegoAuthScheme.class.getResource("jaas.cfg");
 155                 System.setProperty("java.security.auth.login.config", jaasUrl.toExternalForm());
 156                 try {
 157                         LoginContext lc = new LoginContext("SINGLE_USER");
 158                         lc.login();
 159
 160                         AuthPolicy.registerAuthScheme(SpnegoAuthScheme.NAME, SpnegoAuthScheme.class);
 161                         HttpParams params = DefaultHttpParams.getDefaultParams();
 162                         ArrayList<String> schemes = new ArrayList<>();
 163                         schemes.add(SpnegoAuthScheme.NAME);
 164                         params.setParameter(AuthPolicy.AUTH_SCHEME_PRIORITY, schemes);
 165                         params.setParameter(CredentialsProvider.PROVIDER, new HttpCredentialProvider());
 166
 167                         int responseCode = Subject.doAs(lc.getSubject(), new PrivilegedExceptionAction<Integer>() {
 168                                 public Integer run() throws Exception {
 169                                         HttpClient httpClient = new HttpClient();
 170                                         return httpClient.executeMethod(new GetMethod(url));
 171                                 }
 172                         });
 173                         System.out.println("Reponse code: " + responseCode);
 174                 } catch (Exception e) {
 175                         e.printStackTrace();
 176                 }
 177         }
 178
 179 }