Java tutorial
// Description: Java 7 Security Manager Set System Password Servlet /* * Code Factory Asterisk 11 Configuration Model * * Copyright (c) 2014-2015 Mark Sobkow * * This program is available as free software under the GNU GPL v3, or * under a commercial license from Mark Sobkow. For commercial licensing * details, please contact msobkow@sasktel.net. * * Under the terms of the GPL: * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. * * This software incorporates code originally Copyright (c) Mark Sobkow 2014-2015 * and licensed under the BSD 3-Clause license as written by xfree86.org: * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * (1) Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * (2) Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * (3)The name of the author may not be used to * endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * * *********************************************************************** * * Code manufactured by MSS Code Factory */ package net.sourceforge.msscodefactory.cfasterisk.v2_2.CFAstSMWar; import java.io.IOException; import java.io.PrintWriter; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.util.Calendar; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; import org.apache.commons.codec.binary.Base64; import net.sourceforge.msscodefactory.cflib.v2_1.CFLib.CFLib; import net.sourceforge.msscodefactory.cfasterisk.v2_2.CFAst.*; import net.sourceforge.msscodefactory.cfasterisk.v2_2.CFAstObj.*; /** * Servlet implementation class CFAstSMWarSetSystemPasswordHtml */ @WebServlet("/CFAstSMWarSetSystemPasswordHtml") public class CFAstSMWarSetSystemPasswordHtml extends HttpServlet { private static final long serialVersionUID = 1L; /** * @see HttpServlet#HttpServlet() */ public CFAstSMWarSetSystemPasswordHtml() { super(); } /** * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response) */ protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { final String S_ProcName = "doGet"; ICFAstSchemaObj schemaObj; HttpSession sess = request.getSession(false); if (sess == null) { sess = request.getSession(true); schemaObj = new CFAstSchemaObj(); sess.setAttribute("SchemaObj", schemaObj); } else { schemaObj = (ICFAstSchemaObj) sess.getAttribute("SchemaObj"); if (schemaObj == null) { response.sendRedirect("CFAstSMWarLoginHtml"); return; } } ICFAstSchema dbSchema = null; try { CFAstAuthorization auth = schemaObj.getAuthorization(); if (auth != null) { response.sendRedirect("CFAstSMWarSecurityMainHtml"); } else { dbSchema = CFAstSchemaPool.getSchemaPool().getInstance(); schemaObj.setBackingStore(dbSchema); schemaObj.beginTransaction(); ICFAstSecUserObj systemUser = schemaObj.getSecUserTableObj().readSecUserByULoginIdx("system"); String passwordHash = systemUser.getRequiredPasswordHash(); if ((passwordHash != null) && (passwordHash.length() > 0) && (!passwordHash.equals("bootstrap"))) { response.sendRedirect("CFAstSMWarLoginHtml"); } else { ICFAstClusterObj resolvedCluster; String resolvedClusterDescription; ICFAstSysClusterObj sysCluster = schemaObj.getSysClusterTableObj().readSysClusterByIdIdx(1, false); if (sysCluster == null) { resolvedCluster = null; resolvedClusterDescription = null; } else { resolvedCluster = sysCluster.getRequiredContainerCluster(); if (resolvedCluster == null) { throw CFLib.getDefaultExceptionFactory().newNullArgumentException(getClass(), S_ProcName, "resolvedCluster"); } resolvedClusterDescription = resolvedCluster.getRequiredDescription(); } response.setContentType("text/html"); PrintWriter out = response.getWriter(); out.println("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\">"); out.println("<HTML>"); out.println("<BODY>"); out.println("<form method=\"post\" formaction=\"CFAstSMWarSetSystemPasswordHtml\">"); out.println("<H1 style=\"text-align:center\">" + ((resolvedClusterDescription == null) ? "" : resolvedClusterDescription) + " Security Manager</H1>"); out.println( "<H2 style=\"text-align:center\">Please initialize the \"system\" password and cluster details.</H2>"); out.println("<p>"); out.println("<center>"); out.println("<table style=\"width:60%\">"); out.println( "<tr><th style=\"text-align:left\">Password:</th><td><input type=\"password\" name=\"Password\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Confirm Password:</th><td><input type=\"password\" name=\"ConfirmPassword\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Cluster Domain Name:</th><td><input name=\"ClusterDomainName\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Cluster Description:</th><td><input name=\"ClusterDescription\"/></td></tr>"); out.println( "<tr><td colspan=\"2\" style=\"text-align:center\"><button type=\"submit\" name=\"Ok\"\">Ok</button></td></tr>"); out.println("</table>"); out.println("</center>"); out.println("</form>"); out.println("</BODY>"); out.println("</HTML>"); } } } catch (RuntimeException e) { throw CFLib.getDefaultExceptionFactory().newRuntimeException(getClass(), S_ProcName, "Caught RuntimeException -- " + e.getMessage(), e); } finally { if (dbSchema != null) { try { if (schemaObj.isTransactionOpen()) { schemaObj.rollback(); } } catch (RuntimeException e) { } schemaObj.setBackingStore(null); CFAstSchemaPool.getSchemaPool().releaseInstance(dbSchema); } } } /** * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response) */ protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { final String S_ProcName = "doPost"; ICFAstSchemaObj schemaObj; HttpSession sess = request.getSession(false); if (sess == null) { sess = request.getSession(true); schemaObj = new CFAstSchemaObj(); sess.setAttribute("SchemaObj", schemaObj); } else { schemaObj = (ICFAstSchemaObj) sess.getAttribute("SchemaObj"); if (schemaObj == null) { response.sendRedirect("CFAstSMWarLoginHtml"); return; } } ICFAstSchema dbSchema = null; try { CFAstAuthorization auth = schemaObj.getAuthorization(); if (auth != null) { response.sendRedirect("CFAstSMWarSecurityMainHtml"); } else { dbSchema = CFAstSchemaPool.getSchemaPool().getInstance(); schemaObj.setBackingStore(dbSchema); schemaObj.beginTransaction(); ICFAstSecUserObj systemUser = schemaObj.getSecUserTableObj().readSecUserByULoginIdx("system"); String passwordHash = systemUser.getRequiredPasswordHash(); if ((passwordHash != null) && (passwordHash.length() > 0) && (!passwordHash.equals("bootstrap"))) { response.sendRedirect("CFAstSMWarLoginHtml"); } else { ICFAstClusterObj resolvedCluster; String resolvedClusterDomainName; String resolvedClusterDescription; ICFAstSysClusterObj sysCluster = schemaObj.getSysClusterTableObj().readSysClusterByIdIdx(1, false); if (sysCluster == null) { resolvedCluster = null; resolvedClusterDomainName = (String) request.getParameter("ClusterDomainName"); resolvedClusterDescription = (String) request.getParameter("ClusterDescription"); } else { resolvedCluster = sysCluster.getRequiredContainerCluster(); if (resolvedCluster == null) { throw CFLib.getDefaultExceptionFactory().newNullArgumentException(getClass(), S_ProcName, "resolvedCluster"); } resolvedClusterDomainName = resolvedCluster.getRequiredFullDomainName(); resolvedClusterDescription = resolvedCluster.getRequiredDescription(); } String password = (String) request.getParameter("Password"); if (password == null) { password = ""; } String confirmPassword = (String) request.getParameter("ConfirmPassword"); if (confirmPassword == null) { confirmPassword = ""; } response.setContentType("text/html"); PrintWriter out = response.getWriter(); if (password.length() <= 0) { out.println("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\">"); out.println("<HTML>"); out.println("<BODY>"); out.println("<form method=\"post\" formaction=\"CFAstSMWarSetSystemPasswordHtml\">"); out.println("<H1 style=\"text-align:center\">" + ((resolvedClusterDescription == null) ? "" : resolvedClusterDescription) + " Security Manager</H1>"); out.println( "<H2 style=\"text-align:center\">Please initialize the \"system\" password and cluster details.</H2>"); out.println("<p>"); out.println("<center>"); out.println("<table style=\"width:60%\">"); out.println( "<tr><th style=\"text-align:left\">Password:</th><td><input type=\"password\" name=\"Password\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Confirm Password:</th><td><input type=\"password\" name=\"ConfirmPassword\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Cluster Domain Name:</th><td><input name=\"ClusterDomainName\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Cluster Description:</th><td><input name=\"ClusterDescription\"/></td></tr>"); out.println( "<tr><td colspan=\"2\" style=\"text-align:center\"><button type=\"submit\" name=\"Ok\"\">Ok</button></td></tr>"); out.println("</table>"); out.println("</center>"); out.println("</form>"); out.println("</BODY>"); out.println("</HTML>"); } else if (!password.equals(confirmPassword)) { out.println("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\">"); out.println("<HTML>"); out.println("<BODY>"); out.println("<form method=\"post\" formaction=\"CFAstSMWarSetSystemPasswordHtml\">"); out.println("<H1 style=\"text-align:center\">" + ((resolvedClusterDescription == null) ? "" : resolvedClusterDescription) + " Security Manager</H1>"); out.println( "<H2 style=\"text-align:center\">Please initialize the \"system\" password and cluster details.</H2>"); out.println("<p>"); out.println("<center>"); out.println("<table style=\"width:60%\">"); out.println( "<tr><th style=\"text-align:left\">Password:</th><td><input type=\"password\" name=\"Password\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Confirm Password:</th><td><input type=\"password\" name=\"ConfirmPassword\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Cluster Domain Name:</th><td><input name=\"ClusterDomainName\"/></td></tr>"); out.println( "<tr><th style=\"text-align:left\">Cluster Description:</th><td><input name=\"ClusterDescription\"/></td></tr>"); out.println( "<tr><td colspan=\"2\" style=\"text-align:center\"><button type=\"submit\" name=\"Ok\"\">Ok</button></td></tr>"); out.println("</table>"); out.println("</center>"); out.println("</form>"); out.println("</BODY>"); out.println("</HTML>"); } else { MessageDigest msgDigest = MessageDigest.getInstance("SHA-512"); msgDigest.update(password.getBytes("UTF-8")); byte[] hash = msgDigest.digest(); byte[] encodedHash = Base64.encodeBase64(hash); msgDigest.update(encodedHash); hash = msgDigest.digest(); encodedHash = Base64.encodeBase64(hash); String hashedAndEncodedPassword = new String(encodedHash); // Need to temporarily "log in" as system.system to set the password ICFAstClusterObj systemCluster = schemaObj.getClusterTableObj() .readClusterByUDomainNameIdx("system"); ICFAstTenantObj systemTenant = schemaObj.getTenantTableObj() .readTenantByUNameIdx(systemCluster.getRequiredId(), "system"); ICFAstSecSessionObj systemSession = schemaObj.getSecSessionTableObj().newInstance(); ICFAstSecSessionEditObj editSystemSession = (ICFAstSecSessionEditObj) systemSession .beginEdit(); editSystemSession.setRequiredContainerSecUser(systemUser); editSystemSession.setRequiredStart(Calendar.getInstance()); systemSession = editSystemSession.create(); editSystemSession.endEdit(); auth = new CFAstAuthorization(); auth.setSecCluster(systemCluster); auth.setSecTenant(systemTenant); auth.setSecSession(systemSession); schemaObj.setAuthorization(auth); if (resolvedCluster == null) { ICFAstClusterObj cluster = schemaObj.getClusterTableObj().newInstance(); ICFAstClusterEditObj editCluster = cluster.beginEdit(); editCluster.setRequiredFullDomainName(resolvedClusterDomainName); editCluster.setRequiredDescription(resolvedClusterDescription); cluster = editCluster.create(); editCluster.endEdit(); resolvedCluster = cluster; ICFAstTenantObj tenant = schemaObj.getTenantTableObj().newInstance(); ICFAstTenantEditObj editTenant = tenant.beginEdit(); editTenant.setRequiredContainerCluster(cluster); editTenant.setRequiredTenantName("system"); tenant = editTenant.create(); editTenant.endEdit(); sysCluster = schemaObj.getSysClusterTableObj().newInstance(); ICFAstSysClusterEditObj editSysCluster = sysCluster.beginEdit(); editSysCluster.setRequiredContainerCluster(resolvedCluster); editSysCluster.setRequiredSingletonId(1); sysCluster = editSysCluster.create(); editSysCluster.endEdit(); } ICFAstSecUserEditObj editSystemUser = (ICFAstSecUserEditObj) systemUser.beginEdit(); editSystemUser.setRequiredPasswordHash(hashedAndEncodedPassword); editSystemUser.update(); editSystemUser.endEdit(); editSystemSession = (ICFAstSecSessionEditObj) systemSession.beginEdit(); editSystemSession.setOptionalFinish(Calendar.getInstance()); editSystemSession.update(); editSystemSession.endEdit(); schemaObj.commit(); schemaObj.setAuthorization(null); out.println("<H1 style=\"text-align:center\">" + ((resolvedClusterDescription == null) ? "" : resolvedClusterDescription) + " Security Manager</H1>"); out.println("<H2 style=\"text-align:center\">Password set.</H2>"); out.println("<p style=\"text-align:center\">"); out.println( "You may now <A HRef=\"CFAstSMWarLoginHtml\">log in to the security manager.</A>"); } } } } catch (NoSuchAlgorithmException e) { throw CFLib.getDefaultExceptionFactory().newRuntimeException(getClass(), S_ProcName, "Caught NoSuchAlgorithmException -- " + e.getMessage(), e); } catch (RuntimeException e) { throw CFLib.getDefaultExceptionFactory().newRuntimeException(getClass(), S_ProcName, "Caught RuntimeException -- " + e.getMessage(), e); } finally { if (dbSchema != null) { try { if (schemaObj.isTransactionOpen()) { schemaObj.rollback(); } } catch (RuntimeException e) { } schemaObj.setBackingStore(null); CFAstSchemaPool.getSchemaPool().releaseInstance(dbSchema); } } } }