Remember Me code available

I have completed my implementation of the "Remember Me" functionality for SecurityFilter and I would like to submit my changes back to the SecurityFilter developers for consideration of integrating the code back into the main SecurityFilter code base. What follows is a description of the implementation.  Code is attached.

------------------------------------------------------------------------


I have added a new interface called StickyLoginInterface in the org.securityfilter.filter package.  The interface can be implemented by anyone wanting to provide their own implementation of the "Remember Me" functionality.  The interface provides for the following methods:

rememberLogin() 

forgetLogin()

rememberingLogin()

getRememberedUsername()

getRememberedPassword()


I have created a default implementation of the StickyLoginInterface.  The class (StickyLoginDefaultManager) is also in the org.securityfilter.filter package.  I have added a <remember-me> tag to the securityfilter-config.xml file.  The chosen implementation of the StickyLoginInterface is specified like this:

<remember-me className="org.securityfilter.filter.MyImplementationClassNameGoesHere">

Any parameters needed by the implementation class can be passed from the securityfilter-config.xml by specifying the following <remember-me-param> tag.

<remember-me-param name="name" value="value"/>


For my implementation (StickyLoginDefaultManager).  I borrowed some ideas from the .NET specs that are described in the following article. http://msdn.microsoft.com/msdnmag/issues/02/05/ASPSec2/default.aspx   Here are the parameters that can be passed to the stickyLoginDefaultManager.


<remember-me className="org.securityfilter.filter.StickyLoginDefaultManager">
   <remember-me-param name="cookielife" value="15"/>
   <remember-me-param name="protection" value="all"/>
   <remember-me-param name="validationkey" value="006482916751408065181856202465421"/>
   <remember-me-param name="useIP" value="true"/>
   <remember-me-param name="encryptionAlgorithm" value="DES"/>
   <remember-me-param name="encryptionMode" value="ECB"/>
   <remember-me-param name="encryptionPadding" value="PKCS5Padding"/>
   <remember-me-param name="encryptionkey" value="415468653865408520219808202297970"/>
</remember-me>


cookieLife (optional) specifies the number of days that you wish to keep the login cookie.  The default if not specified is 15 days)
protection (optional) specifies the type of protection you want for the persisted cookie.  Valid values are: all, validation, encryption, none.  The default is not specified is all.

validationkey (required if protection is all or validation) specifies a key that is combined with the actual cookie data and then used to generate a MD5 hash value.  This hash value is stored with the cookie and then is later used to determine if the cookie has been tampered with.

useIP (optional) (valid only when protection is all or validation) specifies if the clients IP address is to be used when calculating the validation hash.  Provides extra protection against someone moving a cookie from one machine to another.

encryptionAlgorithm (optional) (valid only when protection is all or encryption)  specifies the encryption algorithm to use when encrypting the cookie values.  The default if not specified is DES.

encryptionMode (optional) (valid only when protection is all or encryption)  specifies the encryption mode to use when encrypting the cookie values.  The default if not specified is ECB.

encryptionPadding (optional) (valid only when protection is all or encryption)  specifies the encryption padding to use when encrypting the cookie values.  The default if not specified is PKCS5Padding.

encryptionkey (required if protection is all or encryption) specifies a key that is used to encrypt and decrypt cookie values.  Should NOT appear before the other encryption* parameters (if specified) in the securityfilter-config.xml file.

IMPORTANT!

A couple of points about this encryption implementation.

- This implementation makes use of the Sun Java Cryptography Extension (JCE).  The JCE comes as a part of the standard download for Java 1.4  BUT, it's an optional (separate) download for Java 1.3 and earlier.  If a user is using Java 1.3 or earlier and they want to use the encryption feature then they must download and install (per Sun's instructions) the Java Cryptography Extension from the Sun website (http://java.sun.com/products/archive/jce/1.2/)

- The default "provider" that comes with JCE is the SunJCE provider.  The SunJCE provider supports the DES, Triple DES, and the Blowfish encryption algorithms.  I have tested this implementation ONLY with the DES algorithm.  I suspect that there may need to be some coding tweaks to get the this implementation to work with other algorithms but I have not yet tried them. 
- Other, third-party, JCE providers can be used instead of the SunJCE provider.  See Sun's website for a complete list of known third-party providers and for instructions on how to change the JCE default provider. 

- The standard JCE provides for "strong" encryption.  "Unlimited" encryption is available as a separate download from Sun's site.  There are some export restrictions on the "unlimited" encryption so if a user chooses to use it they need to understand and adhere to those restrictions.  See Sun's website for complete details.



Dave