Author: oching
Date: Tue Sep 9 21:15:50 2008
New Revision: 693701
URL: http://svn.apache.org/viewvc?rev=693701&view=rev
Log:
merged from -r693694 (MRM-911: check first if guest is enabled for the
repository before failing the authentication) 1.1.x branch
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ArchivaServletAuthenticator.java
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ServletAuthenticator.java
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavResourceFactory.java
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProvider.java
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/RepositoryServlet.java
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProviderTest.java
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/UnauthenticatedDavSessionProvider.java
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ArchivaServletAuthenticator.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ArchivaServletAuthenticator.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ArchivaServletAuthenticator.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ArchivaServletAuthenticator.java
Tue Sep 9 21:15:50 2008
@@ -93,7 +93,7 @@
return true;
}
- public boolean isAuthorizedToAccessVirtualRepository( String principal,
String repoId )
+ public boolean isAuthorized( String principal, String repoId )
throws UnauthorizedException
{
try
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ServletAuthenticator.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ServletAuthenticator.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ServletAuthenticator.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-security/src/main/java/org/apache/maven/archiva/security/ServletAuthenticator.java
Tue Sep 9 21:15:50 2008
@@ -41,6 +41,6 @@
public boolean isAuthorized( HttpServletRequest request, SecuritySession
securitySession, String repositoryId,
boolean isWriteRequest ) throws AuthorizationException,
UnauthorizedException;
- public boolean isAuthorizedToAccessVirtualRepository( String principal,
String repoId )
+ public boolean isAuthorized( String principal, String repoId )
throws UnauthorizedException;
}
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavResourceFactory.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavResourceFactory.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavResourceFactory.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavResourceFactory.java
Tue Sep 9 21:15:50 2008
@@ -733,6 +733,22 @@
}
catch ( AuthenticationException e )
{
+ // safety check for MRM-911
+ String guest = archivaXworkUser.getGuest();
+ try
+ {
+ if( servletAuth.isAuthorized( guest,
+ ( ( ArchivaDavResourceLocator )
request.getRequestLocator() ).getRepositoryId() ) )
+ {
+ return true;
+ }
+ }
+ catch ( UnauthorizedException ae )
+ {
+ throw new UnauthorizedDavException( repositoryId,
+ "You are not authenticated and authorized to access
any repository." );
+ }
+
throw new UnauthorizedDavException( repositoryId, "You are not
authenticated" );
}
catch ( MustChangePasswordException e )
@@ -801,7 +817,7 @@
// for the current user logged in
try
{
- if( servletAuth.isAuthorizedToAccessVirtualRepository(
activePrincipal, repository ) )
+ if( servletAuth.isAuthorized( activePrincipal,
repository ) )
{
getResource( locator, mergedRepositoryContents,
logicalResource, repository );
}
@@ -897,7 +913,7 @@
{
try
{
- if( servletAuth.isAuthorizedToAccessVirtualRepository(
activePrincipal, repository ) )
+ if( servletAuth.isAuthorized( activePrincipal, repository
) )
{
allow = true;
break;
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProvider.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProvider.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProvider.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProvider.java
Tue Sep 9 21:15:50 2008
@@ -24,9 +24,11 @@
import org.apache.jackrabbit.webdav.DavException;
import org.apache.jackrabbit.webdav.DavServletRequest;
import org.apache.maven.archiva.webdav.util.RepositoryPathUtil;
+import org.apache.maven.archiva.security.ArchivaXworkUser;
import org.apache.maven.archiva.security.ServletAuthenticator;
import org.codehaus.plexus.redback.authentication.AuthenticationException;
import org.codehaus.plexus.redback.authentication.AuthenticationResult;
+import org.codehaus.plexus.redback.authorization.UnauthorizedException;
import org.codehaus.plexus.redback.policy.MustChangePasswordException;
import org.codehaus.plexus.redback.policy.AccountLockedException;
import
org.codehaus.plexus.redback.xwork.filter.authentication.HttpAuthenticator;
@@ -45,10 +47,13 @@
private HttpAuthenticator httpAuth;
- public ArchivaDavSessionProvider( ServletAuthenticator servletAuth,
HttpAuthenticator httpAuth )
+ private ArchivaXworkUser archivaXworkUser;
+
+ public ArchivaDavSessionProvider( ServletAuthenticator servletAuth,
HttpAuthenticator httpAuth, ArchivaXworkUser archivaXworkUser )
{
this.servletAuth = servletAuth;
this.httpAuth = httpAuth;
+ this.archivaXworkUser = archivaXworkUser;
}
public boolean attachSession( WebdavRequest request )
@@ -67,7 +72,24 @@
}
catch ( AuthenticationException e )
{
- throw new UnauthorizedDavException( repositoryId, "You are not
authenticated" );
+ // safety check for MRM-911
+ String guest = archivaXworkUser.getGuest();
+ try
+ {
+ if( servletAuth.isAuthorized( guest,
+ ( ( ArchivaDavResourceLocator )
request.getRequestLocator() ).getRepositoryId() ) )
+ {
+ request.setDavSession(new ArchivaDavSession());
+ return true;
+ }
+ }
+ catch ( UnauthorizedException ae )
+ {
+ throw new UnauthorizedDavException( repositoryId,
+ "You are not authenticated and authorized to access any
repository." );
+ }
+
+ throw new UnauthorizedDavException( repositoryId, "You are not
authenticated." );
}
catch ( MustChangePasswordException e )
{
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/RepositoryServlet.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/RepositoryServlet.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/RepositoryServlet.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/main/java/org/apache/maven/archiva/webdav/RepositoryServlet.java
Tue Sep 9 21:15:50 2008
@@ -44,6 +44,7 @@
import org.apache.maven.archiva.configuration.ConfigurationEvent;
import org.apache.maven.archiva.configuration.ConfigurationListener;
import org.apache.maven.archiva.configuration.ManagedRepositoryConfiguration;
+import org.apache.maven.archiva.security.ArchivaXworkUser;
import org.apache.maven.archiva.security.ServletAuthenticator;
import
org.codehaus.plexus.redback.xwork.filter.authentication.HttpAuthenticator;
import org.codehaus.plexus.spring.PlexusToSpringUtils;
@@ -195,7 +196,9 @@
HttpAuthenticator httpAuth =
(HttpAuthenticator) wac.getBean(
PlexusToSpringUtils.buildSpringId( HttpAuthenticator.ROLE, "basic" ) );
- sessionProvider = new ArchivaDavSessionProvider( servletAuth, httpAuth
);
+ ArchivaXworkUser archivaXworkUser =
+ (ArchivaXworkUser) wac.getBean( PlexusToSpringUtils.buildSpringId(
ArchivaXworkUser.class.getName() ) );
+ sessionProvider = new ArchivaDavSessionProvider( servletAuth,
httpAuth, archivaXworkUser );
}
public void configurationEvent( ConfigurationEvent event )
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProviderTest.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProviderTest.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProviderTest.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/ArchivaDavSessionProviderTest.java
Tue Sep 9 21:15:50 2008
@@ -59,7 +59,7 @@
throws Exception
{
super.setUp();
- sessionProvider = new ArchivaDavSessionProvider(new
ServletAuthenticatorMock(), new HttpAuthenticatorMock());
+ sessionProvider = new ArchivaDavSessionProvider(new
ServletAuthenticatorMock(), new HttpAuthenticatorMock(), null);
request = new WebdavRequestImpl(new HttpServletRequestMock(), null);
}
@@ -362,7 +362,7 @@
return true;
}
- public boolean isAuthorizedToAccessVirtualRepository(String arg0,
String arg1)
+ public boolean isAuthorized(String arg0, String arg1)
throws UnauthorizedException
{
return true;
Modified:
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/UnauthenticatedDavSessionProvider.java
URL:
http://svn.apache.org/viewvc/archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/UnauthenticatedDavSessionProvider.java?rev=693701&r1=693700&r2=693701&view=diff
==============================================================================
---
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/UnauthenticatedDavSessionProvider.java
(original)
+++
archiva/trunk/archiva-modules/archiva-web/archiva-webdav/src/test/java/org/apache/maven/archiva/webdav/UnauthenticatedDavSessionProvider.java
Tue Sep 9 21:15:50 2008
@@ -29,7 +29,7 @@
{
public UnauthenticatedDavSessionProvider()
{
- super(null, null);
+ super(null, null, null);
}
@Override
