Author: andreas
Date: Wed Sep 26 07:18:47 2007
New Revision: 579662
URL: http://svn.apache.org/viewvc?rev=579662&view=rev
Log:
Consider proxy settings for Shibboleth and login redirect URLs
Added:
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java
Modified:
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/impl/UserAuthenticator.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/impl/UserAuthenticator.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/impl/UserAuthenticator.java?rev=579662&r1=579661&r2=579662&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/impl/UserAuthenticator.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/impl/UserAuthenticator.java Wed Sep 26 07:18:47 2007
@@ -18,6 +18,9 @@
package org.apache.lenya.ac.impl;
import org.apache.avalon.framework.logger.AbstractLogEnabled;
+import org.apache.avalon.framework.service.ServiceException;
+import org.apache.avalon.framework.service.ServiceManager;
+import org.apache.avalon.framework.service.Serviceable;
import org.apache.cocoon.environment.Request;
import org.apache.lenya.ac.AccessControlException;
import org.apache.lenya.ac.AccreditableManager;
@@ -25,12 +28,16 @@
import org.apache.lenya.ac.ErrorHandler;
import org.apache.lenya.ac.Identity;
import org.apache.lenya.ac.User;
+import org.apache.lenya.cms.publication.util.OutgoingLinkRewriter;
+import org.apache.lenya.util.ServletHelper;
/**
* User authenticator.
* @version $Id: UserAuthenticator.java 473842 2006-11-12 01:15:20Z gregor $
*/
-public class UserAuthenticator extends AbstractLogEnabled implements Authenticator {
+public class UserAuthenticator extends AbstractLogEnabled implements Authenticator, Serviceable {
+
+ protected ServiceManager manager;
/**
* @see org.apache.lenya.ac.Authenticator#authenticate(org.apache.lenya.ac.AccreditableManager,
@@ -61,16 +68,15 @@
}
/**
- * Authenticates a user with a given username and password. When the
- * authentication is successful, the user is added to the identity.
+ * Authenticates a user with a given username and password. When the authentication is
+ * successful, the user is added to the identity.
* @param accreditableManager The accreditable manager.
* @param username The username.
* @param password The password.
* @param identity The identity to add the user to.
* @param handler The error handler.
* @throws AccessControlException when something went wrong.
- * @return <code>true</code> if the user was authenticated,
- * <code>false</code> otherwise.
+ * @return <code>true</code> if the user was authenticated, <code>false</code> otherwise.
*/
protected boolean authenticate(AccreditableManager accreditableManager, String username,
String password, Identity identity, ErrorHandler handler) throws AccessControlException {
@@ -116,7 +122,14 @@
}
public String getLoginUri(Request request) {
- return request.getRequestURI() + "?lenya.usecase=login&lenya.step=showscreen";
+ String webappUrl = ServletHelper.getWebappURI(request);
+ OutgoingLinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, getLogger());
+ String outgoingUrl = rewriter.rewrite(webappUrl);
+ return outgoingUrl + "?lenya.usecase=login&lenya.step=showscreen";
+ }
+
+ public void service(ServiceManager manager) throws ServiceException {
+ this.manager = manager;
}
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java?rev=579662&r1=579661&r2=579662&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java Wed Sep 26 07:18:47 2007
@@ -26,9 +26,7 @@
import javax.servlet.http.HttpServletRequest;
import org.apache.avalon.framework.service.ServiceException;
-import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.ServiceSelector;
-import org.apache.avalon.framework.service.Serviceable;
import org.apache.cocoon.environment.Request;
import org.apache.cocoon.environment.http.HttpEnvironment;
import org.apache.lenya.ac.AccessControlException;
@@ -55,13 +53,12 @@
/**
* Shibboleth-based authenticator.
*/
-public class ShibbolethAuthenticator extends UserAuthenticator implements Serviceable {
+public class ShibbolethAuthenticator extends UserAuthenticator {
protected static final String ERROR_MISSING_UID_ATTRIBUTE = "Unable to get unique identifier for subject. "
+ "Make sure you are listed in the metadata.xml "
+ "file and your resources your are trying to access "
+ "are available and your are allowed to see them. (Resourceregistry).";
- private ServiceManager manager;
public boolean authenticate(AccreditableManager accreditableManager, Request request,
ErrorHandler handler) throws AccessControlException {
@@ -207,10 +204,6 @@
}
}
return req;
- }
-
- public void service(ServiceManager manager) throws ServiceException {
- this.manager = manager;
}
public String getLoginUri(Request request) {
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java?rev=579662&r1=579661&r2=579662&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java Wed Sep 26 07:18:47 2007
@@ -1,15 +1,27 @@
package org.apache.lenya.ac.shibboleth;
+import java.util.Arrays;
import java.util.Map;
import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
+import org.apache.avalon.framework.service.ServiceSelector;
import org.apache.avalon.framework.service.Serviceable;
-import org.apache.cocoon.components.modules.input.AbstractInputModule;
import org.apache.cocoon.environment.ObjectModelHelper;
import org.apache.cocoon.environment.Request;
+import org.apache.lenya.ac.AccessControllerResolver;
+import org.apache.lenya.ac.Policy;
+import org.apache.lenya.ac.PolicyManager;
+import org.apache.lenya.ac.impl.DefaultAccessController;
+import org.apache.lenya.cms.cocoon.components.modules.input.AbstractPageEnvelopeModule;
+import org.apache.lenya.cms.publication.Document;
+import org.apache.lenya.cms.publication.PageEnvelope;
+import org.apache.lenya.cms.publication.Proxy;
+import org.apache.lenya.cms.publication.Publication;
+import org.apache.lenya.cms.publication.util.OutgoingLinkRewriter;
+import org.apache.lenya.util.ServletHelper;
/**
* <p>
@@ -20,33 +32,38 @@
* </p>
* <ul>
* <li><em>wayfServer</em> - the URL of the WAYF server</li>
- * <li><em>shire</em> - the value of the shire request parameter for the WAYF
- * server</li>
- * <li><em>target</em> - the value of the target request parameter for the
- * WAYF server</li>
- * <li><em>providerId</em> - the value of the providerId request parameter
- * for the WAYF server</li>
+ * <li><em>shire</em> - the value of the shire request parameter for the WAYF server</li>
+ * <li><em>target</em> - the value of the target request parameter for the WAYF server</li>
+ * <li><em>providerId</em> - the value of the providerId request parameter for the WAYF server</li>
* </ul>
*/
-public class ShibbolethModule extends AbstractInputModule implements Serviceable {
+public class ShibbolethModule extends AbstractPageEnvelopeModule implements Serviceable {
+ protected static final String ATTR_TARGET = "target";
+ protected static final String ATTR_SHIRE = "shire";
+ protected static final String ATTR_WAYF_SERVER = "wayfServer";
+ protected static final String ATTR_PROVIDER_ID = "providerId";
private ServiceManager manager;
public Object getAttribute(String name, Configuration modeConf, Map objectModel)
throws ConfigurationException {
- Request req = ObjectModelHelper.getRequest(objectModel);
-
- String serverUrl = req.getScheme() + "://" + req.getServerName() + ":"
- + req.getServerPort();
- String servletUrl = serverUrl + req.getServletPath();
-
- if (name.equals("wayfServer")) {
+ // attributes to get from the org.apache.shibboleth.ShibbolethModule
+ String[] shibModuleAttrs = { ATTR_WAYF_SERVER, ATTR_PROVIDER_ID };
+ if (Arrays.asList(shibModuleAttrs).contains(name)) {
org.apache.shibboleth.ShibbolethModule shibModule = null;
try {
shibModule = (org.apache.shibboleth.ShibbolethModule) this.manager
.lookup(org.apache.shibboleth.ShibbolethModule.ROLE);
- return shibModule.getWayfServerUrl();
+
+ if (name.equals(ATTR_WAYF_SERVER)) {
+ return shibModule.getWayfServerUrl();
+ } else if (name.equals(ATTR_PROVIDER_ID)) {
+ return shibModule.getProviderId();
+ } else {
+ throw new ConfigurationException("Attribute [" + name + "] not supported!");
+ }
+
} catch (ServiceException e) {
throw new ConfigurationException("Error looking up shibboleth module: ", e);
} finally {
@@ -54,15 +71,21 @@
this.manager.release(shibModule);
}
}
- } else if (name.equals("shire")) {
- return serverUrl + req.getRequestURI() + "?lenya.usecase=login&lenya.step=login";
- } else if (name.equals("target")) {
- return serverUrl + req.getRequestURI();
- } else if (name.equals("providerId")) {
- return servletUrl + "/shibboleth";
} else {
- throw new ConfigurationException("Attribute [" + name + "] not supported!");
+ Request req = ObjectModelHelper.getRequest(objectModel);
+ String webappUrl = ServletHelper.getWebappURI(req);
+ OutgoingLinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, getLogger());
+ String outgoingUrl = rewriter.rewrite(webappUrl);
+
+ if (name.equals(ATTR_SHIRE)) {
+ return outgoingUrl + "?lenya.usecase=login&lenya.step=login";
+ } else if (name.equals(ATTR_TARGET)) {
+ return outgoingUrl;
+ } else {
+ throw new ConfigurationException("Attribute [" + name + "] not supported!");
+ }
}
+
}
public void service(ServiceManager manager) throws ServiceException {
Added: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java?rev=579662&view=auto
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java (added)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java Wed Sep 26 07:18:47 2007
@@ -0,0 +1,127 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ *
+ */
+package org.apache.lenya.cms.publication.util;
+
+import org.apache.avalon.framework.container.ContainerUtil;
+import org.apache.avalon.framework.logger.AbstractLogEnabled;
+import org.apache.avalon.framework.logger.Logger;
+import org.apache.avalon.framework.service.ServiceManager;
+import org.apache.avalon.framework.service.ServiceSelector;
+import org.apache.cocoon.environment.Context;
+import org.apache.cocoon.environment.ObjectModelHelper;
+import org.apache.lenya.ac.AccessControllerResolver;
+import org.apache.lenya.ac.Policy;
+import org.apache.lenya.ac.PolicyManager;
+import org.apache.lenya.ac.impl.DefaultAccessController;
+import org.apache.lenya.cms.cocoon.components.context.ContextUtility;
+import org.apache.lenya.cms.publication.Document;
+import org.apache.lenya.cms.publication.DocumentBuilder;
+import org.apache.lenya.cms.publication.Proxy;
+import org.apache.lenya.cms.publication.Publication;
+import org.apache.lenya.cms.publication.PublicationFactory;
+import org.apache.lenya.cms.publication.URLInformation;
+
+/**
+ * Converts outgoing links under the consideration of the proxy settings.
+ */
+public class OutgoingLinkRewriter extends AbstractLogEnabled {
+
+ private ServiceManager manager;
+
+ /**
+ * @param manager The service manager.
+ * @param logger The logger.
+ */
+ public OutgoingLinkRewriter(ServiceManager manager, Logger logger) {
+ ContainerUtil.enableLogging(this, logger);
+ this.manager = manager;
+ }
+
+ /**
+ * @param webappUrl The web application URL to rewrite.
+ * @return A URL.
+ */
+ public String rewrite(String webappUrl) {
+
+ URLInformation info = new URLInformation(webappUrl);
+ String pubId = info.getPublicationId();
+ String area = info.getArea();
+
+ String proxyUrl = null;
+
+ if (pubId != null && area != null) {
+ ContextUtility contextUtil = null;
+ try {
+ contextUtil = (ContextUtility) this.manager.lookup(ContextUtility.ROLE);
+ Context context = ObjectModelHelper.getContext(contextUtil.getObjectModel());
+ String servletContextPath = context.getRealPath("");
+ Publication pub = PublicationFactory.getPublication(pubId, servletContextPath);
+
+ DocumentBuilder builder = pub.getDocumentBuilder();
+ if (builder.isDocument(pub, webappUrl)) {
+ Document doc = builder.buildDocument(pub, webappUrl);
+ Proxy proxy = pub.getProxy(doc, isSslProtected(webappUrl));
+ if (proxy != null) {
+ proxyUrl = proxy.getURL(doc);
+ }
+ }
+
+ } catch (Exception e) {
+ throw new RuntimeException("Could not rewrite URL [" + webappUrl + "]: ", e);
+ } finally {
+ if (contextUtil != null) {
+ this.manager.release(contextUtil);
+ }
+ }
+ }
+
+ return proxyUrl != null ? proxyUrl : webappUrl;
+
+ }
+
+ protected boolean isSslProtected(String webappUrl) {
+ DefaultAccessController accessController = null;
+ ServiceSelector selector = null;
+ AccessControllerResolver resolver = null;
+
+ try {
+ selector = (ServiceSelector) manager.lookup(AccessControllerResolver.ROLE + "Selector");
+ resolver = (AccessControllerResolver) selector
+ .select(AccessControllerResolver.DEFAULT_RESOLVER);
+
+ accessController = (DefaultAccessController) resolver
+ .resolveAccessController(webappUrl);
+ PolicyManager policyManager = accessController.getPolicyManager();
+ Policy policy = policyManager.getPolicy(accessController.getAccreditableManager(),
+ webappUrl);
+ return policy.isSSLProtected();
+
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ } finally {
+ if (selector != null) {
+ if (resolver != null) {
+ if (accessController != null) {
+ resolver.release(accessController);
+ }
+ selector.release(resolver);
+ }
+ manager.release(selector);
+ }
+ }
+ }
+}
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.