Source code: com/lutris/http/BasicAuth.java
1 /*
2 * Enhydra Java Application Server Project
3 *
4 * The contents of this file are subject to the Enhydra Public License
5 * Version 1.1 (the "License"); you may not use this file except in
6 * compliance with the License. You may obtain a copy of the License on
7 * the Enhydra web site ( http://www.enhydra.org/ ).
8 *
9 * Software distributed under the License is distributed on an "AS IS"
10 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
11 * the License for the specific terms governing rights and limitations
12 * under the License.
13 *
14 * The Initial Developer of the Enhydra Application Server is Lutris
15 * Technologies, Inc. The Enhydra Application Server and portions created
16 * by Lutris Technologies, Inc. are Copyright Lutris Technologies, Inc.
17 * All Rights Reserved.
18 *
19 * Contributor(s):
20 *
21 * $Id: BasicAuth.java,v 1.10.14.1 2000/10/19 17:59:07 jasona Exp $
22 */
23
24
25
26
27 package com.lutris.http;
28
29 import com.lutris.appserver.server.httpPresentation.HttpPresentationRequest;
30 import com.lutris.appserver.server.httpPresentation.HttpPresentationResponse;
31 import com.lutris.appserver.server.httpPresentation.HttpPresentationException;
32 import com.lutris.appserver.server.jolt.joltpo.JoltRequest;
33 import com.lutris.appserver.server.jolt.joltpo.JoltResponse;
34 import com.lutris.util.Convert;
35 import javax.servlet.http.*;
36
37 /**
38 * Methods to be used to implement the HTTP Basic Auth authorization
39 * method. This is the standard username/password mechanism in use all
40 * over the web. <P>
41 *
42 * Note: the username and password are sent over the net base64 encoded,
43 * which is practically clear text. So this method is no more secure than
44 * the communication channel being used. <P>
45 *
46 * Usage: <BR>
47 * When a request comes in, before responding to it, call
48 * <CODE>getAuthentication()</CODE>. It will return the username and
49 * password that was sent along with the request. If no authorization was
50 * sent, null is returned. The caller is then responsible for deciding if
51 * the username and password are valid. <P>
52 *
53 * If the caller decides that the authorization is not sufficient,
54 * a <CODE>PageUnauthorizedException</CODE> should be thrown. <P>
55 *
56 * If you are writing a LBS application, the recommended place to put
57 * this processing is in your Application's <CODE>requestPreprocessor()</CODE>
58 * function. That function is called for every request, before the
59 * presentation objects are called.
60 *
61 * @see com.lutris.appserver.server.httpPresentation.PageUnauthorizedException
62 * @version $Revision: 1.10.14.1 $
63 * @author Andy John
64 */
65 public class BasicAuth {
66
67 // Private constructor, so no instances. Just use the static methods.
68 private BasicAuth() {}
69
70 /**
71 * Checks to see if the authorization matches the given username
72 * and password. If not, or if no authorization was sent, false is
73 * returned. If req, username or password are null, then it is assumed
74 * that authentication is not being used, and all requests are allowed.
75 *
76 * @param req The request to authenticate.
77 * @return The username and password, or null if no authorization was
78 * sent.
79 */
80 public static BasicAuthResult getAuthentication(
81 HttpPresentationRequest req) {
82 if (req == null)
83 return null;
84 String authHeader = null;
85 try {
86 authHeader = req.getHeader("Authorization");
87 } catch (HttpPresentationException hpe) {
88 }
89 return getAuth(authHeader);
90 }
91
92
93 /**
94 * Checks to see if the authorization matches the given username
95 * and password. If not, or if no authorization was sent, false is
96 * returned. If req, username or password are null, then it is assumed
97 * that authentication is not being used, and all requests are allowed.
98 *
99 * @param req The request to authenticate.
100 * @return The username and password, or null if no authorization was
101 * sent.
102 */
103 public static BasicAuthResult getAuthentication(JoltRequest req) {
104 if (req == null)
105 return null;
106 String authHeader = null;
107 try {
108 authHeader = req.getHeader("Authorization");
109 } catch (HttpPresentationException hpe) {
110 }
111 return getAuth(authHeader);
112 }
113
114
115 /**
116 * Extracts and returns the username and password using the HTTP
117 * Basic Auth method. If no authorization was sent, null is
118 * returned. Use this flavor if you are writing a non-Enhydra
119 * servlet.
120 *
121 * @param req The request to authenticate.
122 * @return The username and password, or null if no authorization was
123 * sent.
124 */
125 public static BasicAuthResult getAuthentication(HttpServletRequest req) {
126 if (req == null)
127 return null;
128 return getAuth(req.getHeader("Authorization"));
129 }
130
131
132 private static BasicAuthResult getAuth(String authHeader) {
133 if (authHeader == null)
134 // No auth header was sent. Deny the request.
135 return null;
136 /*
137 Now decode the username and password.
138 */
139 if (!authHeader.startsWith("Basic "))
140 // Syntax error in auth header.
141 return null;
142 authHeader = authHeader.substring(6);
143 byte[] bytes = Convert.fromBase64String(authHeader);
144 authHeader = new String(bytes);
145 int colon = authHeader.indexOf(":");
146 if (colon < 0)
147 // Syntax error in auth header.
148 return null;
149 String un = authHeader.substring(0, colon);
150 String pw = authHeader.substring(colon + 1);
151 return new BasicAuthResult(un, pw);
152 }
153
154 }
155