Examples with AuthMechanism com.tremolosecurity.proxy.auth.AuthMechanism used on opensource projects

Example 1 with AuthMechanism

use of com.tremolosecurity.proxy.auth.AuthMechanism in project OpenUnison by TremoloSecurity.

the class UnisonConfigManagerImpl method loadAuthMechs.

/* (non-Javadoc)
	 * @see com.tremolosecurity.config.util.ConfigManager#loadAuthMechs()
	 */
/* (non-Javadoc)
	 * @see com.tremolosecurity.config.util.UnisonConfigManager#loadAuthMechs()
	 */
@Override
public void loadAuthMechs() throws ServletException {
    try {
        this.mechs = new HashMap<String, AuthMechanism>();
        // UnisonConfigManagerImpl tremoloCfg = (UnisonConfigManagerImpl) ctx.getAttribute(ConfigFilter.TREMOLO_CONFIG);
        if (getCfg().getAuthMechs() != null) {
            Iterator<MechanismType> mechs = getCfg().getAuthMechs().getMechanism().iterator();
            while (mechs.hasNext()) {
                MechanismType mt = mechs.next();
                initializeAuthenticationMechanism(mt);
            }
        }
    } catch (Exception e) {
        throw new ServletException("Could not initialize Auth Mechanism Filter", e);
    }
    for (String key : this.authChains.keySet()) {
        AuthChainType act = this.authChains.get(key);
        if (act.getLevel() == 0) {
            this.anonAct = act;
            String mechName = act.getAuthMech().get(0).getName();
            this.anonAuthMech = (AnonAuth) this.getAuthMech(this.authMechs.get(mechName).getUri());
        }
    }
    if (this.anonAuthMech == null) {
        this.anonAct = new AuthChainType();
        this.anonAct.setFinishOnRequiredSucess(true);
        this.anonAct.setLevel(0);
        this.anonAct.setName("anon");
        this.anonAuthMech = new AnonAuth();
    }
    if (this.alwaysFailAuth == null) {
        this.alwaysFailAuth = new AlwaysFail();
        String failAuthUri = this.ctxPath + "/fail";
        this.mechs.put(failAuthUri, alwaysFailAuth);
        MechanismType fmt = new MechanismType();
        fmt.setClassName("com.tremolosecurity.proxy.auth.AlwaysFail");
        fmt.setInit(new ConfigType());
        fmt.setParams(new ParamListType());
        fmt.setName("fail");
        fmt.setUri(failAuthUri);
        if (this.cfg.getAuthMechs() == null) {
            this.cfg.setAuthMechs(new AuthMechTypes());
        }
        this.cfg.getAuthMechs().getMechanism().add(fmt);
        this.alwaysFailAuthMech = fmt;
    }
    for (String key : this.authChains.keySet()) {
        AuthChainType act = this.authChains.get(key);
        for (AuthMechType amt : act.getAuthMech()) {
            if (amt.getName().equals(this.alwaysFailAuthMech.getName())) {
                this.authFailChain = act;
                break;
            }
        }
    }
    if (this.authFailChain == null) {
        this.authFailChain = new AuthChainType();
        this.authFailChain.setLevel(0);
        this.authFailChain.setName("alwaysfail");
        AuthMechType amt = new AuthMechType();
        amt.setName(this.alwaysFailAuthMech.getName());
        amt.setRequired("required");
        amt.setParams(new AuthMechParamType());
        this.authFailChain.getAuthMech().add(amt);
    }
    try {
        if (this.getCfg().getAuthMechs() != null && this.getCfg().getAuthMechs().getDynamicAuthMechs() != null && this.getCfg().getAuthMechs().getDynamicAuthMechs().isEnabled()) {
            DynamicPortalUrlsType dynamicAuthMechs = this.getCfg().getAuthMechs().getDynamicAuthMechs();
            String className = dynamicAuthMechs.getClassName();
            HashMap<String, Attribute> cfgAttrs = new HashMap<String, Attribute>();
            for (ParamType pt : dynamicAuthMechs.getParams()) {
                Attribute attr = cfgAttrs.get(pt.getName());
                if (attr == null) {
                    attr = new Attribute(pt.getName());
                    cfgAttrs.put(pt.getName(), attr);
                }
                attr.getValues().add(pt.getValue());
            }
            DynamicAuthMechs dynCustomAuMechs = (DynamicAuthMechs) Class.forName(className).newInstance();
            dynCustomAuMechs.loadDynamicAuthMechs(this, this.getProvisioningEngine(), cfgAttrs);
        }
    } catch (InstantiationException | IllegalAccessException | ClassNotFoundException | ProvisioningException e) {
        throw new ServletException("Could not initialize authentication mechanisms", e);
    }
}

Example 2 with AuthMechanism

use of com.tremolosecurity.proxy.auth.AuthMechanism in project OpenUnison by TremoloSecurity.

the class AuthManagerImpl method execAuth.

/* (non-Javadoc)
	 * @see com.tremolosecurity.proxy.auth.sys.AuthManager#execAuth(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, javax.servlet.http.HttpSession, boolean, com.tremolosecurity.config.util.UrlHolder, com.tremolosecurity.config.xml.AuthChainType, java.lang.String, com.tremolosecurity.proxy.util.NextSys)
	 */
@Override
public boolean execAuth(HttpServletRequest req, HttpServletResponse resp, HttpSession session, boolean jsRedirect, UrlHolder holder, AuthChainType act, String finalURL, NextSys next) throws IOException, ServletException {
    boolean shortCircut = false;
    ConfigManager cfg = (ConfigManager) req.getAttribute(ProxyConstants.TREMOLO_CFG_OBJ);
    // Generate an AuthChainType based on the existing chain+includes
    if (act != cfg.getAuthFailChain()) {
        act = this.buildACT(act, cfg);
    }
    if (act.getLevel() == 0 && (act != cfg.getAuthFailChain())) {
        AuthController actl = (AuthController) session.getAttribute(ProxyConstants.AUTH_CTL);
        // there's no need to go through the process
        String anonMechName = act.getAuthMech().get(0).getName();
        MechanismType mt = holder.getConfig().getAuthMechs().get(anonMechName);
        AnonAuth anonAuth = (AnonAuth) holder.getConfig().getAuthMech(mt.getUri());
        anonAuth.createSession(session, act);
        return finishSuccessfulLogin(req, resp, holder, act, actl.getHolder(), actl, next);
    }
    RequestHolder reqHolder;
    int step = -1;
    AuthController actl = (AuthController) req.getSession().getAttribute(ProxyConstants.AUTH_CTL);
    ArrayList<AuthStep> auths = actl.getAuthSteps();
    if (auths.size() == 0) {
        int id = 0;
        for (AuthMechType amt : act.getAuthMech()) {
            AuthStep as = new AuthStep();
            as.setId(id);
            as.setExecuted(false);
            as.setRequired(amt.getRequired().equals("required"));
            as.setSuccess(false);
            auths.add(as);
            id++;
        }
        boolean anyRequired = false;
        for (AuthStep as : auths) {
            if (as.isRequired()) {
                anyRequired = true;
                break;
            }
        }
        if (!anyRequired) {
            act.setFinishOnRequiredSucess(true);
        }
        step = 0;
        HashMap<String, Attribute> params = new HashMap<String, Attribute>();
        ProxyUtil.loadParams(req, params);
        try {
            reqHolder = new RequestHolder(RequestHolder.getMethod(req.getMethod()), params, finalURL, act.getName(), ((ProxyRequest) req).getQueryStringParams());
            actl.setHolder(reqHolder);
        } catch (Exception e) {
            throw new ServletException("Error creating request holder", e);
        }
    } else {
        reqHolder = actl.getHolder();
        boolean clearAllNotRequired = false;
        // determine the step
        for (AuthStep as : auths) {
            if (as.isSuccess()) {
                // TODO Check to see if the user is locked out
                if (act.getCompliance() != null && act.getCompliance().isEnabled()) {
                    Attribute lastFailed = actl.getAuthInfo().getAttribs().get(act.getCompliance().getLastFailedAttribute());
                    Attribute numFailures = actl.getAuthInfo().getAttribs().get(act.getCompliance().getNumFailedAttribute());
                    if (logger.isDebugEnabled()) {
                        logger.debug("lastFailed Attribute : '" + lastFailed + "'");
                        logger.debug("numFailures Attribute : '" + numFailures + "'");
                    }
                    if (lastFailed != null && numFailures != null) {
                        long lastFailedTS = lastFailed.getValues().size() > 0 ? Long.parseLong(lastFailed.getValues().get(0)) : 0;
                        int numPrevFailures = Integer.parseInt(numFailures.getValues().size() > 0 ? numFailures.getValues().get(0) : "0");
                        long now = new DateTime(DateTimeZone.UTC).getMillis();
                        long lockedUntil = lastFailedTS + act.getCompliance().getMaxLockoutTime();
                        if (logger.isDebugEnabled()) {
                            logger.debug("Num Failed : " + numPrevFailures);
                            logger.debug("Last Failed : '" + lastFailedTS + "'");
                            logger.info("Now : '" + now + "'");
                            logger.info("Locked Until : '" + lockedUntil + "'");
                            logger.info("locked >= now? : '" + (lockedUntil >= now) + "'");
                            logger.info("max fails? : '" + act.getCompliance().getMaxFailedAttempts() + "'");
                            logger.info("too many fails : '" + (numPrevFailures >= act.getCompliance().getMaxFailedAttempts()) + "'");
                        }
                        if (lockedUntil >= now && numPrevFailures >= act.getCompliance().getMaxFailedAttempts()) {
                            try {
                                failAuthentication(req, resp, holder, act);
                            } catch (Exception e) {
                                throw new ServletException("Could not complete authentication failure", e);
                            }
                            return false;
                        }
                    }
                }
                if (act.isFinishOnRequiredSucess()) {
                    step = -1;
                    clearAllNotRequired = true;
                }
            } else {
                if (as.isRequired()) {
                    if (as.isExecuted()) {
                        try {
                            failAuthentication(req, resp, holder, act);
                        } catch (Exception e) {
                            throw new ServletException("Could not complete authentication failure", e);
                        }
                        return false;
                    } else {
                        step = as.getId();
                        break;
                    }
                } else {
                    if (clearAllNotRequired) {
                        as.setExecuted(true);
                        as.setSuccess(true);
                    } else {
                        if (as.isExecuted()) {
                        } else {
                            step = as.getId();
                            break;
                        }
                    }
                }
            }
        }
    }
    if (step != -1) {
        /*if (jsRedirect && step < auths.size()) {
				step++;
			}*/
        AuthStep curStep = auths.get(step);
        actl.setCurrentStep(curStep);
        AuthMechType amt = act.getAuthMech().get(step);
        loadAmtParams(session, amt);
        // req.getRequestDispatcher(authFilterURI).forward(req, resp);
        Cookie sessionCookieName = new Cookie("autoIdmSessionCookieName", holder.getApp().getCookieConfig().getSessionCookieName());
        String domain = ProxyTools.getInstance().getCookieDomain(holder.getApp().getCookieConfig(), req);
        if (domain != null) {
            sessionCookieName.setDomain(domain);
        }
        sessionCookieName.setPath("/");
        sessionCookieName.setMaxAge(-1);
        sessionCookieName.setSecure(false);
        if ((holder.getApp() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig().isCookiesEnabled() == null) || holder.getApp().getCookieConfig().isCookiesEnabled()) {
            ProxyResponse.addCookieToResponse(holder, sessionCookieName, (HttpServletResponse) ((ProxyResponse) resp).getResponse());
        }
        Cookie appCookieName = new Cookie("autoIdmAppName", URLEncoder.encode(holder.getApp().getName(), "UTF-8"));
        if (domain != null) {
            appCookieName.setDomain(domain);
        }
        appCookieName.setPath("/");
        appCookieName.setMaxAge(-1);
        appCookieName.setSecure(false);
        if ((holder.getApp() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig().isCookiesEnabled() == null) || holder.getApp().getCookieConfig().isCookiesEnabled()) {
            ProxyResponse.addCookieToResponse(holder, appCookieName, (HttpServletResponse) ((ProxyResponse) resp).getResponse());
        }
        // resp.addCookie(appCookieName);
        String redirectURI = "";
        MechanismType nextAuthConfiguration = null;
        if (holder.getConfig().getContextPath().equalsIgnoreCase("/")) {
            nextAuthConfiguration = holder.getConfig().getAuthMechs().get(amt.getName());
            if (nextAuthConfiguration == null) {
                StringBuilder sb = new StringBuilder().append("Authentication mechanism '").append(amt.getName()).append("' does not exist, will always fail");
                logger.warn(sb.toString());
                nextAuthConfiguration = holder.getConfig().getAuthFailMechanism();
            }
            redirectURI = nextAuthConfiguration.getUri();
        } else {
            nextAuthConfiguration = holder.getConfig().getAuthMechs().get(amt.getName());
            if (nextAuthConfiguration == null) {
                StringBuilder sb = new StringBuilder().append("Authentication mechanism '").append(amt.getName()).append("' does not exist, will always fail");
                logger.warn(sb.toString());
                nextAuthConfiguration = holder.getConfig().getAuthFailMechanism();
            }
            redirectURI = new StringBuffer().append(holder.getConfig().getContextPath()).append(nextAuthConfiguration.getUri()).toString();
        }
        req.getSession().setAttribute("TREMOLO_AUTH_URI", redirectURI);
        if (jsRedirect) {
            StringBuffer b = new StringBuffer();
            b.append("<html><head></head><body onload=\"window.location='").append(ProxyTools.getInstance().getFqdnUrl(redirectURI, req)).append("';\"></body></html>");
            String respHTML = b.toString();
            ProxyData pd = new ProxyData();
            pd.setHolder(holder);
            pd.setIns(new ByteArrayInputStream(respHTML.getBytes("UTF-8")));
            pd.setPostProc(null);
            pd.setRequest(null);
            pd.setResponse(null);
            pd.setText(true);
            pd.setLogout(false);
            req.setAttribute(ProxyConstants.TREMOLO_PRXY_DATA, pd);
            // req.setAttribute(ProxySys.AUTOIDM_STREAM_WRITER,true);
            // req.setAttribute(ProxySys.TREMOLO_TXT_DATA, new
            // StringBuffer(respHTML));
            resp.sendError(401);
        } else {
            AuthMechanism mech = cfg.getAuthMech(redirectURI);
            if (mech == null) {
                throw new ServletException("Redirect URI '" + redirectURI + "' does not map to an authentication mechanism");
            }
            req.setAttribute(ProxyConstants.AUTH_REDIR_URI, redirectURI);
            if (curStep != null) {
                curStep.setExecuted(true);
            }
            if (req.getMethod().equalsIgnoreCase("get")) {
                mech.doGet(req, resp, curStep);
            } else if (req.getMethod().equalsIgnoreCase("post")) {
                mech.doPost(req, resp, curStep);
            } else if (req.getMethod().equalsIgnoreCase("put") || req.getMethod().equalsIgnoreCase("patch")) {
                mech.doPut(req, resp, curStep);
            } else if (req.getMethod().equalsIgnoreCase("delete")) {
                mech.doDelete(req, resp, curStep);
            } else if (req.getMethod().equalsIgnoreCase("head")) {
                mech.doHead(req, resp, curStep);
            } else if (req.getMethod().equalsIgnoreCase("options")) {
                mech.doOptions(req, resp, curStep);
            }
        }
        return false;
    } else {
        boolean success = true;
        boolean opSuccess = false;
        boolean hasOptional = false;
        for (AuthStep as : auths) {
            if (as.isRequired()) {
                if (!as.isSuccess()) {
                    success = false;
                    break;
                }
            } else {
                hasOptional = true;
                if (as.isSuccess()) {
                    opSuccess = true;
                }
            }
        }
        boolean allSuccess = success && ((hasOptional && opSuccess) || (!hasOptional));
        if (allSuccess) {
            return finishSuccessfulLogin(req, resp, holder, act, reqHolder, actl, next);
        } else {
            throw new ServletException("Unknown state");
        /*
				 * Cookie sessionCookieName = new
				 * Cookie("autoIdmSessionCookieName","DNE");
				 * sessionCookieName.setDomain
				 * (ProxyTools.getInstance().getCookieDomain
				 * (holder.getApp().getCookieConfig(), req));
				 * sessionCookieName.setPath("/");
				 * sessionCookieName.setMaxAge(0);
				 * sessionCookieName.setSecure(false);
				 * //resp.addCookie(sessionCookieName);
				 * 
				 * Cookie appCookieName = new Cookie("autoIdmAppName","DNE");
				 * appCookieName
				 * .setDomain(ProxyTools.getInstance().getCookieDomain
				 * (holder.getApp().getCookieConfig(), req));
				 * appCookieName.setPath("/"); appCookieName.setMaxAge(0);
				 * appCookieName.setSecure(false);
				 * //resp.addCookie(appCookieName);
				 */
        }
    }
}

Example 3 with AuthMechanism

use of com.tremolosecurity.proxy.auth.AuthMechanism in project OpenUnison by TremoloSecurity.

the class ConfigSys method doConfig.

/* (non-Javadoc)
	 * @see com.tremolosecurity.proxy.ConfigSys#doConfig(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, com.tremolosecurity.proxy.util.NextSys)
	 */
public void doConfig(HttpServletRequest req, HttpServletResponse resp, NextSys nextSys) throws IOException, ServletException {
    UrlHolder holder = null;
    AuthInfo userAuth = null;
    try {
        SessionManager sessionManager = (SessionManager) this.ctx.getAttribute(ProxyConstants.TREMOLO_SESSION_MANAGER);
        boolean setSessionCookie = false;
        boolean checkLogout = false;
        RequestHolder reqHolder = (RequestHolder) req.getAttribute(ProxyConstants.TREMOLO_REQ_HOLDER);
        holder = (UrlHolder) req.getAttribute(ProxyConstants.AUTOIDM_CFG);
        boolean isForcedAuth = req.getAttribute(ProxyConstants.TREMOLO_IS_FORCED_AUTH) != null ? (Boolean) req.getAttribute(ProxyConstants.TREMOLO_IS_FORCED_AUTH) : false;
        checkLogout = true;
        StringBuffer resetsb = new StringBuffer(cfg.getAuthPath()).append("resetChain");
        HttpSession sharedSession = req.getSession();
        if (sharedSession != null) {
            AuthController actl = (AuthController) sharedSession.getAttribute(ProxyConstants.AUTH_CTL);
            if (actl != null && actl.getHolder() != null) {
                RequestHolder presentHolder = actl.getHolder();
                AuthInfo authdata = actl.getAuthInfo();
                userAuth = authdata;
                if (!req.getRequestURI().startsWith(cfg.getAuthPath()) && /*&&  ! presentHolder.getUrlNoQueryString().equalsIgnoreCase(req.getRequestURL().toString())*/
                (authdata == null || !authdata.isAuthComplete())) {
                    // we're going to ignore requests for favicon.ico
                    if (!req.getRequestURI().endsWith("/favicon.ico") && !req.getRequestURI().endsWith("/apple-touch-icon-precomposed.png") && !req.getRequestURI().endsWith("/apple-touch-icon.png")) {
                        sharedSession.removeAttribute(ProxyConstants.AUTH_CTL);
                        this.cfg.createAnonUser(sharedSession);
                    }
                } else if (req.getRequestURI().equalsIgnoreCase(resetsb.toString())) {
                    sharedSession.removeAttribute("TREMOLO_AUTH_URI");
                    for (AuthStep step : actl.getAuthSteps()) {
                        step.setExecuted(false);
                        step.setSuccess(false);
                    }
                    actl.setCurrentStep(actl.getAuthSteps().get(0));
                    String chainName = holder.getUrl().getAuthChain();
                    AuthChainType chain = cfg.getAuthChains().get(chainName);
                    String mech = chain.getAuthMech().get(0).getName();
                    String uri = cfg.getAuthMechs().get(mech).getUri();
                    holder.getConfig().getAuthManager().loadAmtParams(sharedSession, chain.getAuthMech().get(0));
                    String redirectURI = "";
                    if (holder.getConfig().getContextPath().equalsIgnoreCase("/")) {
                        redirectURI = uri;
                    } else {
                        redirectURI = new StringBuffer().append(holder.getConfig().getContextPath()).append(uri).toString();
                    }
                    sharedSession.setAttribute("TREMOLO_AUTH_URI", redirectURI);
                    resp.sendRedirect(redirectURI);
                    return;
                }
            }
            if (isForcedAuth) {
                actl.setHolder(reqHolder);
                String authChain = holder.getUrl().getAuthChain();
                AuthChainType act = cfg.getAuthChains().get(authChain);
                holder.getConfig().getAuthManager().loadAmtParams(sharedSession, act.getAuthMech().get(0));
            }
        }
        if (holder == null) {
            if (req.getRequestURI().startsWith(cfg.getAuthPath())) {
                req.setAttribute(ProxyConstants.AUTOIDM_MYVD, cfg.getMyVD());
                ProxyResponse presp = new ProxyResponse((HttpServletResponse) resp, (HttpServletRequest) req);
                // we still need a holder
                /*AuthController actl = (AuthController) sharedSession.getAttribute(AuthSys.AUTH_CTL);
						if (actl != null) {
							holder = cfg.findURL(actl.getHolder().getUrlNoQueryString());
							req.setAttribute(ConfigSys.AUTOIDM_CFG, holder);
						} else {*/
                AuthMechanism authMech = cfg.getAuthMech(((HttpServletRequest) req).getRequestURI());
                if (authMech != null) {
                    String finalURL = authMech.getFinalURL(req, resp);
                    if (finalURL != null) {
                        holder = cfg.findURL(finalURL);
                    } else {
                    // throw new ServletException("Can not generate holder");
                    }
                } else {
                // throw new ServletException("Can not generate holder");
                }
                // no holder should be needed beyond this point
                // }
                /*
						
						
								String urlChain = holder.getUrl().getAuthChain();
								AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
								
								HashMap<String,Attribute> params = new HashMap<String,Attribute>();
								ProxyUtil.loadParams(req, params);
								reqHolder = new RequestHolder(HTTPMethod.GET,params,finalURL,true,act.getName());
								
								isForcedAuth = true;
								req.setAttribute(ConfigSys.AUTOIDM_CFG, holder);
								
								String chainName = holder.getUrl().getAuthChain();
								AuthChainType chain = cfg.getAuthChains().get(chainName);
								String mech = chain.getAuthMech().get(0).getName();
								String uri = cfg.getAuthMechs().get(mech).getUri();
								
								AuthSys.loadAmtParams(sharedSession, chain.getAuthMech().get(0));
							}
						} 
							
						
						if (holder == null) {
							resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
							AccessLog.log(AccessEvent.NotFound, null, req, null, "Resource Not Found");
							return;
						}*/
                nextSys.nextSys(req, presp);
                presp.pushHeadersAndCookies(null);
            } else {
                String redirectLocation = cfg.getErrorPages().get(HttpServletResponse.SC_NOT_FOUND);
                if (redirectLocation != null) {
                    resp.sendRedirect(redirectLocation);
                } else {
                    resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
                }
                AccessLog.log(AccessEvent.NotFound, null, req, null, "Resource Not Found");
            }
        } else {
            req.setAttribute(ProxyConstants.AUTOIDM_CFG, holder);
            req.setAttribute(ProxyConstants.AUTOIDM_MYVD, cfg.getMyVD());
            ProxyResponse presp = new ProxyResponse((HttpServletResponse) resp, (HttpServletRequest) req);
            ProxyData pd = null;
            try {
                nextSys.nextSys(req, presp);
                pd = (ProxyData) req.getAttribute(ProxyConstants.TREMOLO_PRXY_DATA);
                if (holder.getApp().getCookieConfig() != null) {
                    String logouturi = holder.getApp().getCookieConfig().getLogoutURI();
                    AuthController actl = (AuthController) sharedSession.getAttribute(ProxyConstants.AUTH_CTL);
                    if (actl != null) {
                        AuthInfo authdata = actl.getAuthInfo();
                        userAuth = authdata;
                        if ((req.getRequestURI().equalsIgnoreCase(logouturi) || (pd != null && pd.isLogout())) && (authdata != null)) {
                            // Execute logout handlers
                            ArrayList<LogoutHandler> logoutHandlers = (ArrayList<LogoutHandler>) sharedSession.getAttribute(LogoutUtil.LOGOUT_HANDLERS);
                            if (logoutHandlers != null) {
                                for (LogoutHandler h : logoutHandlers) {
                                    h.handleLogout(req, presp);
                                }
                            }
                            sessionManager.clearSession(holder, sharedSession, (HttpServletRequest) req, (HttpServletResponse) resp);
                        }
                    }
                }
                presp.pushHeadersAndCookies(holder);
                if (pd != null && pd.getIns() != null) {
                    if (pd.getResponse() == null) {
                        this.procData(pd.getRequest(), resp, holder, pd.isText(), pd.getIns(), sessionManager);
                    } else {
                        this.procData(pd.getRequest(), pd.getResponse(), holder, pd.isText(), pd.getIns(), pd.getPostProc(), sessionManager);
                    }
                }
            } finally {
                if (pd != null && pd.getHttpRequestBase() != null) {
                    pd.getHttpRequestBase().releaseConnection();
                    if (!resp.isCommitted()) {
                        resp.getOutputStream().flush();
                        resp.getOutputStream().close();
                    }
                }
            }
        }
    } catch (Exception e) {
        ApplicationType appType = null;
        if (holder != null) {
            appType = holder.getApp();
        } else {
            appType = new ApplicationType();
            appType.setName("UNKNOWN");
        }
        AccessLog.log(AccessEvent.Error, appType, (HttpServletRequest) req, userAuth, "NONE");
        req.setAttribute("TREMOLO_ERROR_REQUEST_URL", req.getRequestURL().toString());
        req.setAttribute("TREMOLO_ERROR_EXCEPTION", e);
        logger.error("Could not process request", e);
        String redirectLocation = cfg.getErrorPages().get(500);
        if (redirectLocation != null) {
            resp.sendRedirect(redirectLocation);
        } else {
            StringBuffer b = new StringBuffer();
            b.append(cfg.getAuthFormsPath()).append("error.jsp");
            resp.setStatus(500);
            req.getRequestDispatcher(b.toString()).forward(req, resp);
        }
    }
}

Example 4 with AuthMechanism

use of com.tremolosecurity.proxy.auth.AuthMechanism in project OpenUnison by TremoloSecurity.

the class UnisonConfigManagerImpl method initializeAuthenticationMechanism.

private void initializeAuthenticationMechanism(MechanismType mt) throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    AuthMechanism authMech = (AuthMechanism) Class.forName(mt.getClassName().trim()).newInstance();
    HashMap<String, Attribute> attrs = new HashMap<String, Attribute>();
    Iterator<ParamType> params = mt.getInit().getParam().iterator();
    while (params.hasNext()) {
        ParamType pt = params.next();
        Attribute attr = attrs.get(pt.getName());
        if (attr == null) {
            attr = new Attribute(pt.getName());
            attrs.put(pt.getName(), attr);
        }
        attr.getValues().add(pt.getValue());
    }
    authMech.init(ctx, attrs);
    if (this.ctxPath.equalsIgnoreCase("/")) {
        this.mechs.put(mt.getUri(), authMech);
    } else {
        this.mechs.put(this.ctxPath + mt.getUri(), authMech);
    }
    if (mt.getClassName().equals("com.tremolosecurity.proxy.auth.AlwaysFail")) {
        this.alwaysFailAuth = (AlwaysFail) authMech;
        this.alwaysFailAuthMech = mt;
    }
}

Example 5 with AuthMechanism

use of com.tremolosecurity.proxy.auth.AuthMechanism in project OpenUnison by TremoloSecurity.

the class UnisonServletFilter method doFilter.

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest req = new LocalSessionRequest((HttpServletRequest) request);
    HttpServletResponse resp = (HttpServletResponse) response;
    ConfigManager cfg = (ConfigManager) ctx.getAttribute(ProxyConstants.TREMOLO_CONFIG);
    SessionManager sessionMgr = (SessionManager) ctx.getAttribute(ProxyConstants.TREMOLO_SESSION_MANAGER);
    ProxyRequest pr = null;
    try {
        pr = new ProxyRequest((HttpServletRequest) req);
    } catch (Exception e1) {
        logger.error("Unable to create request", e1);
        throw new IOException("Could not create request");
    }
    try {
        req.setAttribute(ProxyConstants.TREMOLO_FILTER_CHAIN, chain);
        NextEmbSys embSys = new NextEmbSys(this.cfg.getServletContext(), chain, passOn);
        /*System.err.println("*** Begin Request ****");
			System.err.println("url = '" + ((HttpServletRequest)req).getRequestURL() + "'");
			Cookie[] cookies = ((HttpServletRequest) req).getCookies();
			if (cookies != null) {
				for (Cookie cookie : cookies) {
					System.err.println("'" + cookie.getName() + "'='" + cookie.getValue() + "'");
				}
			}
			System.err.println("*** End Request ****");*/
        String fwdProto = req.getHeader("X-Forwarded-Proto");
        boolean toSSL = false;
        if (cfg.isForceToSSL()) {
            if (fwdProto != null) {
                toSSL = fwdProto.equalsIgnoreCase("http");
            } else {
                toSSL = !req.getRequestURL().toString().toLowerCase().startsWith("https");
            }
        }
        if (toSSL) {
            StringBuffer redirURL = new StringBuffer();
            URL reqURL = new URL(req.getRequestURL().toString());
            redirURL.append("https://").append(reqURL.getHost());
            if (cfg.getExternalSecurePort() != 443) {
                redirURL.append(":").append(cfg.getSecurePort());
            }
            redirURL.append(reqURL.getPath());
            if (reqURL.getQuery() != null) {
                redirURL.append('?').append(reqURL.getQuery());
            }
            resp.sendRedirect(redirURL.toString());
            return;
        }
        // add hsts
        if (GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getApplications().isHsts()) {
            StringBuffer sb = new StringBuffer();
            sb.append("max-age=").append(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getApplications().getHstsTTL()).append(" ; includeSubDomains");
            resp.addHeader("Strict-Transport-Security", sb.toString());
        }
        req.setAttribute(ProxyConstants.TREMOLO_CFG_OBJ, cfg);
        HttpServletRequest servReq = (HttpServletRequest) req;
        String URL;
        HttpSession sharedSession = null;
        UrlHolder holder = null;
        URL = servReq.getRequestURL().toString();
        holder = cfg.findURL(URL);
        boolean isForcedAuth = false;
        RequestHolder reqHolder = null;
        String sessionCookieName = req.getParameter("sessionCookie");
        if (sessionCookieName == null) {
            Cookie[] cookies = ((HttpServletRequest) req).getCookies();
            if (cookies != null) {
                for (int i = 0; i < cookies.length; i++) {
                    if (cookies[i].getName().equals("autoIdmSessionCookieName")) {
                        sessionCookieName = cookies[i].getValue();
                    }
                }
            }
        }
        if (sessionCookieName == null) {
        } else {
        }
        if (holder == null) {
            // check the session
            sharedSession = sessionMgr.getSession(sessionCookieName, holder, ((HttpServletRequest) req), ((HttpServletResponse) resp), this.ctx);
            if (sharedSession != null) {
                AuthController actl = (AuthController) sharedSession.getAttribute(ProxyConstants.AUTH_CTL);
                if (actl.getHolder() != null) {
                    URL = ((AuthController) sharedSession.getAttribute(ProxyConstants.AUTH_CTL)).getHolder().getURL();
                    holder = cfg.findURL(URL);
                }
            }
        } else {
            sharedSession = sessionMgr.getSession(holder, ((HttpServletRequest) req), ((HttpServletResponse) resp), this.ctx);
        }
        // LocalSessionRequest lsr = new LocalSessionRequest((HttpServletRequest)req,sharedSession);
        if (sharedSession != null) {
            pr.setSession(sharedSession);
        }
        if ((holder == null || holder.getUrl().getUri().equalsIgnoreCase("/")) && req.getRequestURI().startsWith(cfg.getAuthPath()) && sessionCookieName == null) {
            // if (req.getRequestURI().startsWith("/auth/")) {
            AuthMechanism authMech = cfg.getAuthMech(((HttpServletRequest) req).getRequestURI());
            if (authMech != null) {
                String finalURL = authMech.getFinalURL(pr, resp);
                if (resp.getStatus() == 302) {
                    // redirect sent, stop processing
                    return;
                }
                if (finalURL != null) {
                    holder = cfg.findURL(finalURL);
                    if (holder != null) {
                        String urlChain = holder.getUrl().getAuthChain();
                        AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
                        HashMap<String, Attribute> params = new HashMap<String, Attribute>();
                        ProxyUtil.loadParams(req, params);
                        if (req instanceof ProxyRequest) {
                            reqHolder = new RequestHolder(HTTPMethod.GET, params, finalURL, true, act.getName(), ((ProxyRequest) req).getQueryStringParams());
                        } else {
                            reqHolder = new RequestHolder(HTTPMethod.GET, params, finalURL, true, act.getName(), ((com.tremolosecurity.embedd.LocalSessionRequest) req).getQueryStringParams());
                        }
                        isForcedAuth = true;
                        sharedSession = sessionMgr.getSession(holder, ((HttpServletRequest) req), ((HttpServletResponse) resp), this.ctx);
                        if (sharedSession != null) {
                            pr.setSession(sharedSession);
                        }
                        Cookie lsessionCookieName = new Cookie("autoIdmSessionCookieName", holder.getApp().getCookieConfig().getSessionCookieName());
                        String domain = ProxyTools.getInstance().getCookieDomain(holder.getApp().getCookieConfig(), req);
                        if (domain != null) {
                            lsessionCookieName.setDomain(domain);
                        }
                        lsessionCookieName.setPath("/");
                        lsessionCookieName.setMaxAge(-1);
                        lsessionCookieName.setSecure(false);
                        if ((holder.getApp() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig().isCookiesEnabled() == null) || holder.getApp().getCookieConfig().isCookiesEnabled()) {
                            ProxyResponse.addCookieToResponse(holder, lsessionCookieName, (HttpServletResponse) response);
                        }
                        Cookie appCookieName = new Cookie("autoIdmAppName", URLEncoder.encode(holder.getApp().getName(), "UTF-8"));
                        if (domain != null) {
                            appCookieName.setDomain(domain);
                        }
                        appCookieName.setPath("/");
                        appCookieName.setMaxAge(-1);
                        appCookieName.setSecure(false);
                        if ((holder.getApp() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig() == null || holder.getApp().getCookieConfig().isCookiesEnabled() == null) || holder.getApp().getCookieConfig().isCookiesEnabled()) {
                            ProxyResponse.addCookieToResponse(holder, appCookieName, (HttpServletResponse) response);
                        }
                    // resp.addCookie(appCookieName);
                    }
                }
            }
        }
        req.setAttribute(ProxyConstants.AUTOIDM_CFG, holder);
        req.setAttribute(ProxyConstants.TREMOLO_IS_FORCED_AUTH, isForcedAuth);
        req.setAttribute(ProxyConstants.TREMOLO_REQ_HOLDER, reqHolder);
        if (!resp.isCommitted()) {
            embSys.nextSys(pr, (HttpServletResponse) resp);
        }
    } catch (Exception e) {
        req.setAttribute("TREMOLO_ERROR_REQUEST_URL", req.getRequestURL().toString());
        req.setAttribute("TREMOLO_ERROR_EXCEPTION", e);
        logger.error("Could not process request", e);
        StringBuffer b = new StringBuffer();
        b.append(cfg.getAuthFormsPath()).append("error.jsp");
        req.getRequestDispatcher(b.toString()).forward(pr, resp);
    }
}