File	Doc	Category	Size	Date	Package
BasicAuthenticator.java	API Doc	Glassfish v2 API	9069	Thu May 31 14:15:38 BST 2007	org.apache.catalina.authenticator

BasicAuthenticator

• java.lang.Object
  • AuthenticatorBase

Fields Summary
private static com.sun.org.apache.commons.logging.Log	log
protected static final org.apache.catalina.util.Base64	base64Helper The Base64 helper object for this class.
protected static final String	info Descriptive information about this implementation.

Constructors Summary

Methods Summary
public boolean	authenticate(org.apache.catalina.HttpRequest request, org.apache.catalina.HttpResponse response, org.apache.catalina.deploy.LoginConfig config) Authenticate the user making this request, based on the specified login configuration. Return true if any specified constraint has been satisfied, or false if we have created a response challenge already. param request Request we are processing param response Response we are creating param login Login configuration describing how authentication should be performed exception IOException if an input/output error occurs // Have we already authenticated someone? Principal principal = ((HttpServletRequest) request.getRequest()).getUserPrincipal(); if (principal != null) { if (log.isDebugEnabled()) log.debug("Already authenticated '" + principal.getName() + "'"); return (true); } // Validate any credentials already included with this request HttpServletRequest hreq = (HttpServletRequest) request.getRequest(); HttpServletResponse hres = (HttpServletResponse) response.getResponse(); String authorization = request.getAuthorization(); /* IASRI 4868073 String username = parseUsername(authorization); String password = parsePassword(authorization); principal = context.getRealm().authenticate(username, password); if (principal != null) { register(request, response, principal, Constants.BASIC_METHOD, username, password); return (true); } */ // BEGIN IASRI 4868073 // Only attempt to parse and validate the authorization if one was // sent by the client. No reason to attempt to login with null // authorization which must fail anyway. With basic auth this // scenario always occurs first so this is a common case. This // will also prevent logging the audit message for failure to // authenticate null user (since login failures are always logged // per psarc req). if (authorization != null) { String username = parseUsername(authorization); String password = parsePassword(authorization); principal = context.getRealm().authenticate(username, password); if (principal != null) { register(request, response, principal, Constants.BASIC_METHOD, username, password); String ssoId = (String) request.getNote( Constants.REQ_SSOID_NOTE); if (ssoId != null) { getSession(request, true); } return (true); } } // END IASRI 4868073 // Send an "unauthorized" response and an appropriate challenge String realmName = config.getRealmName(); if (realmName == null) realmName = hreq.getServerName() + ":" + hreq.getServerPort(); // if (debug >= 1) // log("Challenging for realm '" + realmName + "'"); hres.setHeader("WWW-Authenticate", "Basic realm=\"" + realmName + "\""); hres.sendError(HttpServletResponse.SC_UNAUTHORIZED); // hres.flushBuffer(); return (false);
public java.lang.String	getInfo() Return descriptive information about this Valve implementation. // ------------------------------------------------------------- Properties return (this.info);
protected java.lang.String	parsePassword(java.lang.String authorization) Parse the password from the specified authorization credentials. If none can be found, return null. param authorization Authorization credentials from this request if (authorization == null) return (null); if (!authorization.toLowerCase().startsWith("basic ")) return (null); authorization = authorization.substring(6).trim(); // Decode and parse the authorization credentials String unencoded = new String(base64Helper.decode(authorization.getBytes())); int colon = unencoded.indexOf(':"); if (colon < 0) return (null); // String username = unencoded.substring(0, colon).trim(); String password = unencoded.substring(colon + 1); return (password);
protected java.lang.String	parseUsername(java.lang.String authorization) Parse the username from the specified authorization credentials. If none can be found, return null. param authorization Authorization credentials from this request if (authorization == null) return (null); if (!authorization.toLowerCase().startsWith("basic ")) return (null); authorization = authorization.substring(6).trim(); // Decode and parse the authorization credentials String unencoded = new String(base64Helper.decode(authorization.getBytes())); int colon = unencoded.indexOf(':"); if (colon < 0) return (null); String username = unencoded.substring(0, colon); // String password = unencoded.substring(colon + 1).trim(); return (username);