Examples with Session org.apache.catalina.Session used on opensource projects

Example 36 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class Request method isRequestedSessionIdValid.

/**
     * @return <code>true</code> if the session identifier included in this
     * request identifies a valid session.
     */
@Override
public boolean isRequestedSessionIdValid() {
    if (requestedSessionId == null) {
        return false;
    }
    Context context = getContext();
    if (context == null) {
        return false;
    }
    Manager manager = context.getManager();
    if (manager == null) {
        return false;
    }
    Session session = null;
    try {
        session = manager.findSession(requestedSessionId);
    } catch (IOException e) {
    // Can't find the session
    }
    if ((session == null) || !session.isValid()) {
        // Check for parallel deployment contexts
        if (getMappingData().contexts == null) {
            return false;
        } else {
            for (int i = (getMappingData().contexts.length); i > 0; i--) {
                Context ctxt = getMappingData().contexts[i - 1];
                try {
                    if (ctxt.getManager().findSession(requestedSessionId) != null) {
                        return true;
                    }
                } catch (IOException e) {
                // Ignore
                }
            }
            return false;
        }
    }
    return true;
}

Example 37 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class AuthenticatorBase method register.

private void register(Request request, HttpServletResponse response, Principal principal, String authType, String username, String password, boolean alwaysUseSession, boolean cache) {
    if (log.isDebugEnabled()) {
        String name = (principal == null) ? "none" : principal.getName();
        log.debug("Authenticated '" + name + "' with type '" + authType + "'");
    }
    // Cache the authentication information in our request
    request.setAuthType(authType);
    request.setUserPrincipal(principal);
    Session session = request.getSessionInternal(false);
    if (session != null) {
        // the session ID. See BZ 59043.
        if (changeSessionIdOnAuthentication && principal != null) {
            String oldId = null;
            if (log.isDebugEnabled()) {
                oldId = session.getId();
            }
            Manager manager = request.getContext().getManager();
            manager.changeSessionId(session);
            request.changeSessionId(session.getId());
            if (log.isDebugEnabled()) {
                log.debug(sm.getString("authenticator.changeSessionId", oldId, session.getId()));
            }
        }
    } else if (alwaysUseSession) {
        session = request.getSessionInternal(true);
    }
    // Cache the authentication information in our session, if any
    if (cache) {
        if (session != null) {
            session.setAuthType(authType);
            session.setPrincipal(principal);
            if (username != null) {
                session.setNote(Constants.SESS_USERNAME_NOTE, username);
            } else {
                session.removeNote(Constants.SESS_USERNAME_NOTE);
            }
            if (password != null) {
                session.setNote(Constants.SESS_PASSWORD_NOTE, password);
            } else {
                session.removeNote(Constants.SESS_PASSWORD_NOTE);
            }
        }
    }
    // Construct a cookie to be returned to the client
    if (sso == null) {
        return;
    }
    // Only create a new SSO entry if the SSO did not already set a note
    // for an existing entry (as it would do with subsequent requests
    // for DIGEST and SSL authenticated contexts)
    String ssoId = (String) request.getNote(Constants.REQ_SSOID_NOTE);
    if (ssoId == null) {
        // Construct a cookie to be returned to the client
        ssoId = sessionIdGenerator.generateSessionId();
        Cookie cookie = new Cookie(Constants.SINGLE_SIGN_ON_COOKIE, ssoId);
        cookie.setMaxAge(-1);
        cookie.setPath("/");
        // Bugzilla 41217
        cookie.setSecure(request.isSecure());
        // Bugzilla 34724
        String ssoDomain = sso.getCookieDomain();
        if (ssoDomain != null) {
            cookie.setDomain(ssoDomain);
        }
        // cookies
        if (request.getServletContext().getSessionCookieConfig().isHttpOnly() || request.getContext().getUseHttpOnly()) {
            cookie.setHttpOnly(true);
        }
        response.addCookie(cookie);
        // Register this principal with our SSO valve
        sso.register(ssoId, principal, authType, username, password);
        request.setNote(Constants.REQ_SSOID_NOTE, ssoId);
    } else {
        if (principal == null) {
            // Registering a programmatic logout
            sso.deregister(ssoId);
            request.removeNote(Constants.REQ_SSOID_NOTE);
            return;
        } else {
            // Update the SSO session with the latest authentication data
            sso.update(ssoId, principal, authType, username, password);
        }
    }
    // SSO entry will never be cleared if we don't associate the session
    if (session == null) {
        session = request.getSessionInternal(true);
    }
    sso.associate(ssoId, session);
}

Example 38 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class FormAuthenticator method matchRequest.

/**
     * Does this request match the saved one (so that it must be the redirect
     * we signaled after successful authentication?
     *
     * @param request The request to be verified
     * @return <code>true</code> if the requests matched the saved one
     */
protected boolean matchRequest(Request request) {
    // Has a session been created?
    Session session = request.getSessionInternal(false);
    if (session == null) {
        return false;
    }
    // Is there a saved request?
    SavedRequest sreq = (SavedRequest) session.getNote(Constants.FORM_REQUEST_NOTE);
    if (sreq == null) {
        return false;
    }
    // Is there a saved principal?
    if (session.getNote(Constants.FORM_PRINCIPAL_NOTE) == null) {
        return false;
    }
    // Does the request URI match?
    String decodedRequestURI = request.getDecodedRequestURI();
    if (decodedRequestURI == null) {
        return false;
    }
    return decodedRequestURI.equals(sreq.getDecodedRequestURI());
}

Example 39 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class FormAuthenticator method isContinuationRequired.

@Override
protected boolean isContinuationRequired(Request request) {
    // Special handling for form-based logins to deal with the case
    // where the login form (and therefore the "j_security_check" URI
    // to which it submits) might be outside the secured area
    String contextPath = this.context.getPath();
    String decodedRequestURI = request.getDecodedRequestURI();
    if (decodedRequestURI.startsWith(contextPath) && decodedRequestURI.endsWith(Constants.FORM_ACTION)) {
        return true;
    }
    // Special handling for form-based logins to deal with the case where
    // a resource is protected for some HTTP methods but not protected for
    // GET which is used after authentication when redirecting to the
    // protected resource.
    // TODO: This is similar to the FormAuthenticator.matchRequest() logic
    // Is there a way to remove the duplication?
    Session session = request.getSessionInternal(false);
    if (session != null) {
        SavedRequest savedRequest = (SavedRequest) session.getNote(Constants.FORM_REQUEST_NOTE);
        if (savedRequest != null && decodedRequestURI.equals(savedRequest.getDecodedRequestURI())) {
            return true;
        }
    }
    return false;
}

Example 40 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class FormAuthenticator method doAuthenticate.

// ------------------------------------------------------ Protected Methods
/**
     * Authenticate the user making this request, based on the specified
     * login configuration.  Return <code>true</code> if any specified
     * constraint has been satisfied, or <code>false</code> if we have
     * created a response challenge already.
     *
     * @param request Request we are processing
     * @param response Response we are creating
     *
     * @exception IOException if an input/output error occurs
     */
@Override
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException {
    if (checkForCachedAuthentication(request, response, true)) {
        return true;
    }
    // References to objects we will need later
    Session session = null;
    Principal principal = null;
    // Have we authenticated this user before but have caching disabled?
    if (!cache) {
        session = request.getSessionInternal(true);
        if (log.isDebugEnabled()) {
            log.debug("Checking for reauthenticate in session " + session);
        }
        String username = (String) session.getNote(Constants.SESS_USERNAME_NOTE);
        String password = (String) session.getNote(Constants.SESS_PASSWORD_NOTE);
        if ((username != null) && (password != null)) {
            if (log.isDebugEnabled()) {
                log.debug("Reauthenticating username '" + username + "'");
            }
            principal = context.getRealm().authenticate(username, password);
            if (principal != null) {
                session.setNote(Constants.FORM_PRINCIPAL_NOTE, principal);
                if (!matchRequest(request)) {
                    register(request, response, principal, HttpServletRequest.FORM_AUTH, username, password);
                    return true;
                }
            }
            if (log.isDebugEnabled()) {
                log.debug("Reauthentication failed, proceed normally");
            }
        }
    }
    // authentication?  If so, forward the *original* request instead.
    if (matchRequest(request)) {
        session = request.getSessionInternal(true);
        if (log.isDebugEnabled()) {
            log.debug("Restore request from session '" + session.getIdInternal() + "'");
        }
        principal = (Principal) session.getNote(Constants.FORM_PRINCIPAL_NOTE);
        register(request, response, principal, HttpServletRequest.FORM_AUTH, (String) session.getNote(Constants.SESS_USERNAME_NOTE), (String) session.getNote(Constants.SESS_PASSWORD_NOTE));
        // and password in the session, so remove them
        if (cache) {
            session.removeNote(Constants.SESS_USERNAME_NOTE);
            session.removeNote(Constants.SESS_PASSWORD_NOTE);
        }
        if (restoreRequest(request, session)) {
            if (log.isDebugEnabled()) {
                log.debug("Proceed to restored request");
            }
            return true;
        } else {
            if (log.isDebugEnabled()) {
                log.debug("Restore of original request failed");
            }
            response.sendError(HttpServletResponse.SC_BAD_REQUEST);
            return false;
        }
    }
    // Acquire references to objects we will need to evaluate
    String contextPath = request.getContextPath();
    String requestURI = request.getDecodedRequestURI();
    // Is this the action request from the login page?
    boolean loginAction = requestURI.startsWith(contextPath) && requestURI.endsWith(Constants.FORM_ACTION);
    LoginConfig config = context.getLoginConfig();
    // No -- Save this request and redirect to the form login page
    if (!loginAction) {
        // may not go to the correct web application
        if (request.getServletPath().length() == 0 && request.getPathInfo() == null) {
            StringBuilder location = new StringBuilder(requestURI);
            location.append('/');
            if (request.getQueryString() != null) {
                location.append('?');
                location.append(request.getQueryString());
            }
            response.sendRedirect(response.encodeRedirectURL(location.toString()));
            return false;
        }
        session = request.getSessionInternal(true);
        if (log.isDebugEnabled()) {
            log.debug("Save request in session '" + session.getIdInternal() + "'");
        }
        try {
            saveRequest(request, session);
        } catch (IOException ioe) {
            log.debug("Request body too big to save during authentication");
            response.sendError(HttpServletResponse.SC_FORBIDDEN, sm.getString("authenticator.requestBodyTooBig"));
            return false;
        }
        forwardToLoginPage(request, response, config);
        return false;
    }
    // Yes -- Acknowledge the request, validate the specified credentials
    // and redirect to the error page if they are not correct
    request.getResponse().sendAcknowledgement();
    Realm realm = context.getRealm();
    if (characterEncoding != null) {
        request.setCharacterEncoding(characterEncoding);
    }
    String username = request.getParameter(Constants.FORM_USERNAME);
    String password = request.getParameter(Constants.FORM_PASSWORD);
    if (log.isDebugEnabled()) {
        log.debug("Authenticating username '" + username + "'");
    }
    principal = realm.authenticate(username, password);
    if (principal == null) {
        forwardToErrorPage(request, response, config);
        return false;
    }
    if (log.isDebugEnabled()) {
        log.debug("Authentication of '" + username + "' was successful");
    }
    if (session == null) {
        session = request.getSessionInternal(false);
    }
    if (session == null) {
        if (containerLog.isDebugEnabled()) {
            containerLog.debug("User took so long to log on the session expired");
        }
        if (landingPage == null) {
            response.sendError(HttpServletResponse.SC_REQUEST_TIMEOUT, sm.getString("authenticator.sessionExpired"));
        } else {
            // Make the authenticator think the user originally requested
            // the landing page
            String uri = request.getContextPath() + landingPage;
            SavedRequest saved = new SavedRequest();
            saved.setMethod("GET");
            saved.setRequestURI(uri);
            saved.setDecodedRequestURI(uri);
            request.getSessionInternal(true).setNote(Constants.FORM_REQUEST_NOTE, saved);
            response.sendRedirect(response.encodeRedirectURL(uri));
        }
        return false;
    }
    // Save the authenticated Principal in our session
    session.setNote(Constants.FORM_PRINCIPAL_NOTE, principal);
    // Save the username and password as well
    session.setNote(Constants.SESS_USERNAME_NOTE, username);
    session.setNote(Constants.SESS_PASSWORD_NOTE, password);
    // Redirect the user to the original request URI (which will cause
    // the original request to be restored)
    requestURI = savedRequestURL(session);
    if (log.isDebugEnabled()) {
        log.debug("Redirecting to original '" + requestURI + "'");
    }
    if (requestURI == null) {
        if (landingPage == null) {
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, sm.getString("authenticator.formlogin"));
        } else {
            // Make the authenticator think the user originally requested
            // the landing page
            String uri = request.getContextPath() + landingPage;
            SavedRequest saved = new SavedRequest();
            saved.setMethod("GET");
            saved.setRequestURI(uri);
            saved.setDecodedRequestURI(uri);
            session.setNote(Constants.FORM_REQUEST_NOTE, saved);
            response.sendRedirect(response.encodeRedirectURL(uri));
        }
    } else {
        // Until the Servlet API allows specifying the type of redirect to
        // use.
        Response internalResponse = request.getResponse();
        String location = response.encodeRedirectURL(requestURI);
        if ("HTTP/1.1".equals(request.getProtocol())) {
            internalResponse.sendRedirect(location, HttpServletResponse.SC_SEE_OTHER);
        } else {
            internalResponse.sendRedirect(location, HttpServletResponse.SC_FOUND);
        }
    }
    return false;
}