Java tutorial
/* This file is part of Cyclos. Cyclos is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. Cyclos is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with Cyclos; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ package nl.strohalm.cyclos.webservices.rest; import java.io.IOException; import java.util.Collection; import java.util.Collections; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import nl.strohalm.cyclos.entities.access.Channel; import nl.strohalm.cyclos.entities.access.PrincipalType; import nl.strohalm.cyclos.entities.exceptions.EntityNotFoundException; import nl.strohalm.cyclos.entities.members.Element; import nl.strohalm.cyclos.entities.members.Member; import nl.strohalm.cyclos.services.access.AccessServiceLocal; import nl.strohalm.cyclos.services.access.ChannelServiceLocal; import nl.strohalm.cyclos.services.access.exceptions.BlockedCredentialsException; import nl.strohalm.cyclos.services.access.exceptions.CredentialsException; import nl.strohalm.cyclos.services.access.exceptions.InvalidCredentialsException; import nl.strohalm.cyclos.services.access.exceptions.UserNotFoundException; import nl.strohalm.cyclos.services.elements.ElementServiceLocal; import nl.strohalm.cyclos.services.transactions.exceptions.InvalidChannelException; import nl.strohalm.cyclos.utils.access.LoggedUser; import nl.strohalm.cyclos.webservices.WebServiceContext; import nl.strohalm.cyclos.webservices.model.ServerErrorVO; import org.apache.commons.lang.StringUtils; import org.codehaus.jackson.map.ObjectMapper; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.authority.SimpleGrantedAuthority; /** * An {@link AuthenticationProvider} which validates the username / password in Cyclos. WARN: Can't throw AuthenticationException cause it returns 401 * UNAUTHORIZED and that is captured by the browser, pops up an authentication form and we don't want that. A 401 freezes the mobile app. * @author luis */ public class RestAuthenticationProvider implements AuthenticationProvider { private ElementServiceLocal elementService; private AccessServiceLocal accessService; private ChannelServiceLocal channelService; private static final String INVALID_CREDENTIALS = "INVALID_CREDENTIALS"; private static final String CHANNEL_DISABLED = "CHANNEL_DISABLED"; private static final String BLOCKED_CREDENTIALS = "BLOCKED_CREDENTIALS"; private static final String UNKNOWN_AUTHENTICATION_ERROR = "UNKNOWN_AUTHENTICATION_ERROR"; @Override public Authentication authenticate(final Authentication authentication) throws AuthenticationException { // Get / validate the principal / credentials String principal = authentication.getName(); String credentials = (String) authentication.getCredentials(); if (StringUtils.isEmpty(principal) || StringUtils.isEmpty(credentials)) { sendError("Empty username / password", INVALID_CREDENTIALS); throw new InvalidCredentialsException(); } // Get the request HttpServletRequest request = WebServiceContext.getRequest(); if (request == null) { sendError("Couldn't resolve the current request", UNKNOWN_AUTHENTICATION_ERROR); throw new IllegalStateException("Couldn't resolve the current request"); } final String remoteAddr = request.getRemoteAddr(); // Load the channel Channel channel = channelService.loadByInternalName(Channel.REST); final PrincipalType principalType = channelService.resolvePrincipalType(Channel.REST, channel.getDefaultPrincipalType().getPrincipal().name()); // Validate the user String usernameToVerify = principal; Member member = null; try { member = elementService.loadByPrincipal(principalType, principal, Element.Relationships.USER, Element.Relationships.GROUP); usernameToVerify = member.getUsername(); } catch (final EntityNotFoundException e) { usernameToVerify = ""; } // Verify username try { accessService.verifyLogin(null, usernameToVerify, remoteAddr); } catch (UserNotFoundException e) { sendError("Invalid username / password", INVALID_CREDENTIALS); throw new InvalidCredentialsException(); } // Check if the channel is enabled for the specific member if (!accessService.isChannelEnabledForMember(channel, member)) { sendError("Channel disabled for the member", CHANNEL_DISABLED); throw new InvalidChannelException(member.getUsername(), channel.getInternalName()); } // Check the credentials try { accessService.checkCredentials(channel, member.getMemberUser(), credentials, remoteAddr, null); } catch (BlockedCredentialsException e) { sendError("Credentials blocked", BLOCKED_CREDENTIALS); throw e; } catch (CredentialsException e) { sendError("Invalid username / password", INVALID_CREDENTIALS); throw e; } // Initialize the LoggedUser, so it is accessible from the services WebServiceContext.setRestMember(member); LoggedUser.init(member.getUser(), remoteAddr); // Authentication succeeded Collection<SimpleGrantedAuthority> authority = Collections .singleton(new SimpleGrantedAuthority("ROLE_REST")); return new UsernamePasswordAuthenticationToken(principal, credentials, authority); } public void setAccessServiceLocal(final AccessServiceLocal accessService) { this.accessService = accessService; } public void setChannelServiceLocal(final ChannelServiceLocal channelService) { this.channelService = channelService; } public void setElementServiceLocal(final ElementServiceLocal elementService) { this.elementService = elementService; } @Override public boolean supports(final Class<?> authentication) { return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication)); } private void sendError(final String message, final String errorCode) { HttpServletResponse response = WebServiceContext.getResponse(); ObjectMapper mapper = new ObjectMapper(); try { response.setContentType("application/json"); response.setStatus(HttpServletResponse.SC_BAD_REQUEST); mapper.writeValue(response.getWriter(), new ServerErrorVO(errorCode, message)); } catch (IOException e) { e.printStackTrace(); } } }