at.gv.egovernment.moa.id.auth.servlet.SSOSendAssertionServlet.java Source code

Java tutorial

Introduction

Here is the source code for at.gv.egovernment.moa.id.auth.servlet.SSOSendAssertionServlet.java

Source

/*******************************************************************************
 * Copyright 2014 Federal Chancellery Austria
 * MOA-ID has been developed in a cooperation between BRZ, the Federal
 * Chancellery Austria - ICT staff unit, and Graz University of Technology.
 * 
 * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
 * the European Commission - subsequent versions of the EUPL (the "Licence");
 * You may not use this work except in compliance with the Licence.
 * You may obtain a copy of the Licence at:
 * http://www.osor.eu/eupl/
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the Licence is distributed on an "AS IS" basis,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the Licence for the specific language governing permissions and
 * limitations under the Licence.
 * 
 * This product combines work with different licenses. See the "NOTICE" text
 * file for details on the various modules and licenses.
 * The "NOTICE" text file is part of the distribution. Any derivative works
 * that you distribute must include a readable copy of the "NOTICE" text file.
 ******************************************************************************/
package at.gv.egovernment.moa.id.auth.servlet;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.StringEscapeUtils;

import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
import at.gv.egovernment.moa.id.moduls.ModulUtils;
import at.gv.egovernment.moa.id.moduls.SSOManager;
import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.MiscUtil;

public class SSOSendAssertionServlet extends AuthServlet {

    private static final long serialVersionUID = 1L;

    private static final String PARAM = "value";
    private static final String MODULE = "mod";
    private static final String ACTION = "action";
    private static final String ID = "identifier";

    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        String id = null;
        Logger.info("Receive " + SSOSendAssertionServlet.class + " Request");
        try {

            Object idObject = req.getParameter(ID);

            if (idObject != null && (idObject instanceof String)) {
                id = (String) idObject;
            }

            String value = req.getParameter(PARAM);
            value = StringEscapeUtils.escapeHtml(value);
            if (!ParamValidatorUtils.isValidUseMandate(value))
                throw new WrongParametersException("SSOSendAssertionServlet", PARAM, null);

            //get module and action
            Object moduleObject = req.getParameter(MODULE);
            String module = null;
            if (moduleObject != null && (moduleObject instanceof String)) {
                module = (String) moduleObject;
            }

            Object actionObject = req.getParameter(ACTION);
            String action = null;
            if (actionObject != null && (actionObject instanceof String)) {
                action = (String) actionObject;
            }

            if (MiscUtil.isEmpty(module) || MiscUtil.isEmpty(action) || MiscUtil.isEmpty(id)) {
                Logger.warn("No Moduel or Action parameter received!");
                throw new WrongParametersException("Module or Action is empty", "", "auth.10");
            }

            SSOManager ssomanager = SSOManager.getInstance();
            //get SSO Cookie for Request
            String ssoId = ssomanager.getSSOSessionID(req);

            //check SSO session
            if (ssoId != null) {
                String correspondingMOASession = ssomanager.existsOldSSOSession(ssoId);

                if (correspondingMOASession != null) {
                    Logger.warn("Request sends an old SSO Session ID(" + ssoId + ")! "
                            + "Invalidate the corresponding MOASession with ID=" + correspondingMOASession);

                    AuthenticationSessionStoreage.destroySession(correspondingMOASession);

                    ssomanager.deleteSSOSessionID(req, resp);
                }
            }

            boolean isValidSSOSession = ssomanager.isValidSSOSession(ssoId, null);

            String moaSessionID = null;

            if (isValidSSOSession) {

                //check UseMandate flag
                String valueString = null;
                ;
                if ((value != null) && (value.compareTo("") != 0)) {
                    valueString = value;
                } else {
                    valueString = "false";
                }

                if (valueString.compareToIgnoreCase("true") == 0) {
                    moaSessionID = AuthenticationSessionStoreage.getMOASessionSSOID(ssoId);
                    AuthenticationSession moasession = AuthenticationSessionStoreage.getSession(moaSessionID);
                    AuthenticationSessionStoreage.setAuthenticated(moaSessionID, true);

                    String redirectURL = new DataURLBuilder().buildDataURL(moasession.getAuthURL(),
                            ModulUtils.buildAuthURL(module, action, id), "");

                    resp.setContentType("text/html");
                    resp.setStatus(302);

                    resp.addHeader("Location", redirectURL);
                    Logger.debug("REDIRECT TO: " + redirectURL);

                }

                else {
                    throw new AuthenticationException("auth.21", new Object[] {});
                }

            } else {
                handleError("SSO Session is not valid", null, req, resp, id);
            }

        } catch (MOADatabaseException e) {
            handleError("SSO Session is not found", e, req, resp, id);

        } catch (WrongParametersException e) {
            handleError("Parameter is not valid", e, req, resp, id);

        } catch (AuthenticationException e) {
            handleError(e.getMessage(), e, req, resp, id);

        } catch (Exception e) {
            Logger.error("SSOSendAssertion has an interal Error.", e);
        }

    }

}