/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.catalina.realm;
import java.security.Principal;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import javax.management.ObjectName;
import org.apache.catalina.Container;
import org.apache.catalina.CredentialHandler;
import org.apache.catalina.Lifecycle;
import org.apache.catalina.LifecycleException;
import org.apache.catalina.Realm;
import org.apache.catalina.Wrapper;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSName;
/**
* Realm implementation that contains one or more realms. Authentication is attempted for each realm in the order they
* were configured. If any realm authenticates the user then the authentication succeeds. When combining realms
* usernames should be unique across all combined realms.
*/
public class CombinedRealm extends RealmBase {
private static final Log log = LogFactory.getLog(CombinedRealm.class);
/**
* The list of Realms contained by this Realm.
*/
protected final List<Realm> realms = new ArrayList<>();
/**
* Add a realm to the list of realms that will be used to authenticate users.
*
* @param theRealm realm which should be wrapped by the combined realm
*/
public void addRealm(Realm theRealm) {
realms.add(theRealm);
if (log.isDebugEnabled()) {
log.debug(sm.getString("combinedRealm.addRealm", theRealm.getClass().getName(),
Integer.toString(realms.size())));
}
}
/**
* @return the array of Realms that this Realm is wrapping
*/
public ObjectName[] getRealms() {
ObjectName[] result = new ObjectName[realms.size()];
for (Realm realm : realms) {
if (realm instanceof RealmBase) {
result[realms.indexOf(realm)] = ((RealmBase) realm).getObjectName();
}
}
return result;
}
/**
* @return the array of Realms contained by this Realm.
*/
public Realm[] getNestedRealms() {
return realms.toArray(new Realm[0]);
}
@Override
public Principal authenticate(String username, String clientDigest, String nonce, String nc, String cnonce,
String qop, String realmName, String digestA2, String algorithm) {
Principal authenticatedUser = null;
for (Realm realm : realms) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authStart", username, realm.getClass().getName()));
}
authenticatedUser =
realm.authenticate(username, clientDigest, nonce, nc, cnonce, qop, realmName, digestA2, algorithm);
if (authenticatedUser == null) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authFail", username, realm.getClass().getName()));
}
} else {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authSuccess", username, realm.getClass().getName()));
}
break;
}
}
return authenticatedUser;
}
@Override
public Principal authenticate(String username) {
Principal authenticatedUser = null;
for (Realm realm : realms) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authStart", username, realm.getClass().getName()));
}
authenticatedUser = realm.authenticate(username);
if (authenticatedUser == null) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authFail", username, realm.getClass().getName()));
}
} else {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authSuccess", username, realm.getClass().getName()));
}
break;
}
}
return authenticatedUser;
}
@Override
public Principal authenticate(String username, String credentials) {
Principal authenticatedUser = null;
for (Realm realm : realms) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authStart", username, realm.getClass().getName()));
}
authenticatedUser = realm.authenticate(username, credentials);
if (authenticatedUser == null) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authFail", username, realm.getClass().getName()));
}
} else {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authSuccess", username, realm.getClass().getName()));
}
break;
}
}
return authenticatedUser;
}
@Override
public void setContainer(Container container) {
for (Realm realm : realms) {
// Set the realmPath for JMX naming
if (realm instanceof RealmBase) {
((RealmBase) realm).setRealmPath(getRealmPath() + "/realm" + realms.indexOf(realm));
}
// Set the container for sub-realms. Mainly so logging works.
realm.setContainer(container);
}
super.setContainer(container);
}
@Override
protected void startInternal() throws LifecycleException {
// Start 'sub-realms' then this one
Iterator<Realm> iter = realms.iterator();
while (iter.hasNext()) {
Realm realm = iter.next();
if (realm instanceof Lifecycle) {
try {
((Lifecycle) realm).start();
} catch (LifecycleException e) {
// If realm doesn't start can't authenticate against it
iter.remove();
log.error(sm.getString("combinedRealm.realmStartFail", realm.getClass().getName()), e);
}
}
}
if (getCredentialHandler() == null) {
// Set a credential handler that will ask the nested realms so that it can
// be set by the context in the attributes, it won't be used directly
super.setCredentialHandler(new CombinedRealmCredentialHandler());
}
super.startInternal();
}
@Override
protected void stopInternal() throws LifecycleException {
// Stop this realm, then the sub-realms (reverse order to start)
super.stopInternal();
for (Realm realm : realms) {
if (realm instanceof Lifecycle) {
((Lifecycle) realm).stop();
}
}
}
/**
* Ensure child Realms are destroyed when this Realm is destroyed.
*/
@Override
protected void destroyInternal() throws LifecycleException {
for (Realm realm : realms) {
if (realm instanceof Lifecycle) {
((Lifecycle) realm).destroy();
}
}
super.destroyInternal();
}
/**
* Delegate the backgroundProcess call to all sub-realms.
*/
@Override
public void backgroundProcess() {
super.backgroundProcess();
for (Realm r : realms) {
r.backgroundProcess();
}
}
@Override
public Principal authenticate(X509Certificate[] certs) {
Principal authenticatedUser = null;
String username = null;
if (certs != null && certs.length > 0) {
username = certs[0].getSubjectX500Principal().toString();
}
for (Realm realm : realms) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authStart", username, realm.getClass().getName()));
}
authenticatedUser = realm.authenticate(certs);
if (authenticatedUser == null) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authFail", username, realm.getClass().getName()));
}
} else {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authSuccess", username, realm.getClass().getName()));
}
break;
}
}
return authenticatedUser;
}
@Override
public Principal authenticate(GSSContext gssContext, boolean storeCred) {
if (gssContext.isEstablished()) {
Principal authenticatedUser = null;
GSSName gssName;
try {
gssName = gssContext.getSrcName();
} catch (GSSException e) {
log.warn(sm.getString("realmBase.gssNameFail"), e);
return null;
}
for (Realm realm : realms) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authStart", gssName, realm.getClass().getName()));
}
authenticatedUser = realm.authenticate(gssContext, storeCred);
if (authenticatedUser == null) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authFail", gssName, realm.getClass().getName()));
}
} else {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authSuccess", gssName, realm.getClass().getName()));
}
break;
}
}
return authenticatedUser;
}
// Fail in all other cases
return null;
}
@Override
public Principal authenticate(GSSName gssName, GSSCredential gssCredential) {
Principal authenticatedUser = null;
for (Realm realm : realms) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authStart", gssName, realm.getClass().getName()));
}
authenticatedUser = realm.authenticate(gssName, gssCredential);
if (authenticatedUser == null) {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authFail", gssName, realm.getClass().getName()));
}
} else {
if (log.isTraceEnabled()) {
log.trace(sm.getString("combinedRealm.authSuccess", gssName, realm.getClass().getName()));
}
break;
}
}
return authenticatedUser;
}
@Override
public boolean hasRole(Wrapper wrapper, Principal principal, String role) {
for (Realm realm : realms) {
if (realm.hasRole(wrapper, principal, role)) {
return true;
}
}
return false;
}
@Override
protected String getPassword(String username) {
// This method should never be called
// Stack trace will show where this was called from
UnsupportedOperationException uoe =
new UnsupportedOperationException(sm.getString("combinedRealm.getPassword"));
log.error(uoe.getMessage(), uoe);
throw uoe;
}
@Override
protected Principal getPrincipal(String username) {
// This method should never be called
// Stack trace will show where this was called from
UnsupportedOperationException uoe =
new UnsupportedOperationException(sm.getString("combinedRealm.getPrincipal"));
log.error(uoe.getMessage(), uoe);
throw uoe;
}
@Override
public boolean isAvailable() {
for (Realm realm : realms) {
if (!realm.isAvailable()) {
return false;
}
}
return true;
}
@Override
public void setCredentialHandler(CredentialHandler credentialHandler) {
// This is unusual for a CombinedRealm as it does not use
// CredentialHandlers. It might be a mis-configuration so warn the user.
log.warn(sm.getString("combinedRealm.setCredentialHandler"));
super.setCredentialHandler(credentialHandler);
}
private class CombinedRealmCredentialHandler implements CredentialHandler {
@Override
public boolean matches(String inputCredentials, String storedCredentials) {
for (Realm realm : realms) {
if (realm.getCredentialHandler().matches(inputCredentials, storedCredentials)) {
return true;
}
}
return false;
}
@Override
public String mutate(String inputCredentials) {
if (realms.isEmpty()) {
return null;
}
for (Realm realm : realms) {
String mutatedCredentials = realm.getCredentialHandler().mutate(inputCredentials);
if (mutatedCredentials != null) {
return mutatedCredentials;
}
}
return null;
}
}
}