User: starksm
Date: 01/04/04 14:46:03
Modified: src/main/org/jboss/security/srp/jaas
SRPCacheLoginModule.java SRPLoginModule.java
Log:
Reorganize the packaging a bit.
Revision Changes Path
1.2 +51 -23
jbosssx/src/main/org/jboss/security/srp/jaas/SRPCacheLoginModule.java
Index: SRPCacheLoginModule.java
===================================================================
RCS file:
/cvsroot/jboss/jbosssx/src/main/org/jboss/security/srp/jaas/SRPCacheLoginModule.java,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- SRPCacheLoginModule.java 2001/03/06 08:35:33 1.1
+++ SRPCacheLoginModule.java 2001/04/04 21:46:03 1.2
@@ -19,25 +19,26 @@
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
-import org.jboss.security.plugins.SecurityAssociationCallback;
+import org.jboss.security.auth.SecurityAssociationCallback;
import org.jboss.security.srp.PkgCategory;
-import org.jboss.security.srp.SRPClientSession;
+import org.jboss.security.srp.SRPServerSession;
import org.jboss.security.srp.SRPServerInterface;
import org.jboss.security.srp.SRPServerInterface.SRPParameters;
import org.jboss.util.CachePolicy;
/** A server side login module that validates a username and
-their session key hash against the cache of authentication
+session client challenge response against the cache of authentication
info maintained by the SRPService mbean. This module needs
a CallbackHandler that supplies the user principal and
credential via the SecurityAssociationCallback object.
module options:
-cacheJndiName, the JNDI name of the CachePolicy of <Principal,Subject>
+cacheJndiName, the JNDI name of the CachePolicy of <Principal,SRPServerSession>
information managed by the SRPSerice.
+domainName,
@author [EMAIL PROTECTED]
-@version $Revision: 1.1 $
+@version $Revision: 1.2 $
*/
public class SRPCacheLoginModule implements LoginModule
{
@@ -46,7 +47,8 @@
private Map sharedState;
private String domainName;
private String cacheJndiName;
- private byte[] sessionKey;
+ private byte[] clientChallenge;
+ private SRPServerSession session;
private Principal userPrincipal;
private boolean debug;
private boolean loginFailed;
@@ -56,7 +58,7 @@
}
// --- Begin LoginModule interface methods
- /**
+ /** Initialize the login module.
@param subject, the subject to authenticate
@param handler, the app CallbackHandler used to obtain username & password
@param sharedState, used to propagate the authenticated principal and
@@ -78,7 +80,13 @@
debug = Boolean.valueOf(d).booleanValue();
}
- /** Access the
+ /** Access the user Principal object and credentials by passing a
+ SecurityAssociationCallback object to the registered CallbackHandler. This
+ method then validates the user by looking up the cache information using
+ the Principal object as the key and compares the cache credential against the
+ the credential obtained from the SecurityAssociationCallback. The
+ login credential should be the M1 verifcation challenge byte[].
+
@return true is login succeeds, false if login does not apply.
@exception LoginException, thrown on login failure.
*/
@@ -96,8 +104,19 @@
InitialContext iniCtx = new InitialContext();
CachePolicy cache = (CachePolicy) iniCtx.lookup(cacheJndiName);
Object cacheCredential = cache.get(userPrincipal);
- if( validateCache(cacheCredential) == false )
- throw new LoginException("Failed to validate SRP session key for:
"+username);
+ /** The cache object should be the SRPServerSession object used in the
+ authentication of the client.
+ */
+ if( cacheCredential instanceof SRPServerSession )
+ {
+ session = (SRPServerSession) cacheCredential;
+ if( validateCache(session) == false )
+ throw new LoginException("Failed to validate SRP session key
for: "+username);
+ }
+ else
+ {
+ throw new LoginException("Unknown type of cache credential:
"+cacheCredential.getClass());
+ }
}
catch(NamingException e)
{
@@ -108,13 +127,15 @@
PkgCategory.debug("Login succeeded");
// Put the username and the client challenge into the sharedState map
sharedState.put("javax.security.auth.login.name", username);
- sharedState.put("javax.security.auth.login.password", sessionKey);
+ sharedState.put("javax.security.auth.login.password", clientChallenge);
loginFailed = false;
return true;
}
/** All login modules have completed the login() phase, comit if we
succeeded. This entails adding the princial to the subject Principals set.
+ It also adds the client challenge response to the PublicCredentials set
+ and the private session key to the PrivateCredentials set.
@return false, if the login() failed, true if the commit succeeds.
@exception LoginException, thrown on failure to add the principal.
*/
@@ -124,19 +145,22 @@
return false;
Set principals = subject.getPrincipals();
subject.getPrincipals().add(userPrincipal);
- subject.getPublicCredentials().add(sessionKey);
+ subject.getPublicCredentials().add(clientChallenge);
+ byte[] sessionKey = session.getSessionKey();
+ subject.getPrivateCredentials().add(sessionKey);
return true;
}
public boolean abort() throws LoginException
{
userPrincipal = null;
- sessionKey = null;
+ clientChallenge = null;
return true;
}
- /** Remove the userPrincipal associated with the subject.
+ /** Remove the userPrincipal, clientChallenge and sessionKey associated
+ with the subject during commit().
@return true always.
@exception LoginException, thrown on exception during remove of the Principal
added during the commit.
@@ -149,17 +173,22 @@
{ // Remove userPrincipal
Set s = subject.getPrincipals(userPrincipal.getClass());
s.remove(userPrincipal);
+ subject.getPublicCredentials().remove(clientChallenge);
+ byte[] sessionKey = session.getSessionKey();
+ subject.getPrivateCredentials().remove(sessionKey);
}
}
catch(Exception e)
{
- throw new LoginException("Failed to remove user principal,
"+e.getMessage());
+ throw new LoginException("Failed to remove commit information,
"+e.getMessage());
}
return true;
}
// --- End LoginModule interface methods
+ /** Obtain the Principal and credentials that are to be authenticated.
+ */
private void getUserInfo() throws LoginException
{
// Get the security association info
@@ -172,7 +201,7 @@
{
handler.handle(callbacks);
userPrincipal = sac.getPrincipal();
- sessionKey = (byte[]) sac.getCredential();
+ clientChallenge = (byte[]) sac.getCredential();
sac.clearCredential();
}
catch(java.io.IOException e)
@@ -189,14 +218,13 @@
}
}
- private boolean validateCache(Object cacheCredential)
+ /** This method obtains the session getClientResponse() value which
+ contains the challenge the client used to verify the session key.
+ */
+ private boolean validateCache(SRPServerSession session)
{
- boolean isValid = false;
- if( cacheCredential instanceof byte[] )
- {
- byte[] a1 = (byte[]) cacheCredential;
- isValid = Arrays.equals(a1, sessionKey);
- }
+ byte[] challenge = session.getClientResponse();
+ boolean isValid = Arrays.equals(challenge, clientChallenge);
return isValid;
}
1.2 +8 -2 jbosssx/src/main/org/jboss/security/srp/jaas/SRPLoginModule.java
Index: SRPLoginModule.java
===================================================================
RCS file:
/cvsroot/jboss/jbosssx/src/main/org/jboss/security/srp/jaas/SRPLoginModule.java,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- SRPLoginModule.java 2001/03/06 08:35:33 1.1
+++ SRPLoginModule.java 2001/04/04 21:46:03 1.2
@@ -34,7 +34,7 @@
authentication system developed by Tom Wu ([EMAIL PROTECTED]).
@author [EMAIL PROTECTED]
-@version $Revision: 1.1 $
+@version $Revision: 1.2 $
*/
public class SRPLoginModule implements LoginModule
{
@@ -47,6 +47,7 @@
private String username;
private String password;
private Principal userPrincipal;
+ private byte[] sessionKey;
private boolean debug;
private boolean loginFailed;
@@ -122,6 +123,7 @@
M1 = client.response(B);
PkgCategory.debug("Exchanging challenges");
M2 = server.verify(username, M1);
+ sessionKey = client.getSessionKey();
}
catch(Exception e)
{
@@ -147,7 +149,9 @@
/** All login modules have completed the login() phase, comit if we
succeeded. This entails adding an instance of principalClassName to the
- subject principals set.
+ subject principals set and the private session key to the PrivateCredentials
+ set.
+
@return false, if the login() failed, true if the commit succeeds.
@exception LoginException, thrown on failure to create a Principal.
*/
@@ -178,6 +182,7 @@
password = null;
}
subject.getPrincipals().add(userPrincipal);
+ subject.getPrivateCredentials().add(sessionKey);
return true;
}
@@ -203,6 +208,7 @@
{ // Remove userPrincipal
Set s = subject.getPrincipals(userPrincipal.getClass());
s.remove(userPrincipal);
+ subject.getPrivateCredentials().remove(sessionKey);
}
}
catch(Exception e)
_______________________________________________
Jboss-development mailing list
[EMAIL PROTECTED]
http://lists.sourceforge.net/lists/listinfo/jboss-development
