public abstract class RealmBase extends LifecycleMBeanBase implements Realm
Modifier and Type | Class and Description |
---|---|
protected static class |
RealmBase.AllRolesMode |
Lifecycle.SingleUse
Modifier and Type | Field and Description |
---|---|
protected RealmBase.AllRolesMode |
allRolesMode
The all role mode.
|
protected Container |
container
The Container with which this Realm is associated.
|
protected Log |
containerLog
Container log
|
protected java.lang.String |
digest
Deprecated.
Unused. Will be removed in Tomcat 8.5.x onwards.
|
protected java.lang.String |
digestEncoding
Deprecated.
Unused. Will be removed in Tomcat 8.5.x onwards.
|
protected java.security.MessageDigest |
md
Deprecated.
Unused. Will be removed in Tomcat 8.5.x onwards.
|
protected static java.security.MessageDigest |
md5Helper
Deprecated.
Unused. Will be removed in Tomcat 8.5.x onwards.
|
protected java.lang.String |
realmPath |
protected static StringManager |
sm
The string manager for this package.
|
protected boolean |
stripRealmForGss
When processing users authenticated via the GSS-API, should any
"@...
|
protected java.beans.PropertyChangeSupport |
support
The property change support for this component.
|
protected boolean |
validate
Should we validate client certificate chains when they are presented?
|
protected X509UsernameRetriever |
x509UsernameRetriever
The object that will extract user names from X509 client certificates.
|
protected java.lang.String |
x509UsernameRetrieverClassName
The name of the class to use for retrieving user names from X509
certificates.
|
mserver
AFTER_DESTROY_EVENT, AFTER_INIT_EVENT, AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_DESTROY_EVENT, BEFORE_INIT_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, CONFIGURE_START_EVENT, CONFIGURE_STOP_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT
Constructor and Description |
---|
RealmBase() |
Modifier and Type | Method and Description |
---|---|
void |
addPropertyChangeListener(java.beans.PropertyChangeListener listener)
Add a property change listener to this component.
|
java.security.Principal |
authenticate(org.ietf.jgss.GSSContext gssContext,
boolean storeCreds)
Try to authenticate using a
GSSContext |
java.security.Principal |
authenticate(java.lang.String username)
Return the Principal associated with the specified username, if there
is one; otherwise return
null . |
java.security.Principal |
authenticate(java.lang.String username,
java.lang.String credentials)
Return the Principal associated with the specified username and
credentials, if there is one; otherwise return
null . |
java.security.Principal |
authenticate(java.lang.String username,
java.lang.String clientDigest,
java.lang.String nonce,
java.lang.String nc,
java.lang.String cnonce,
java.lang.String qop,
java.lang.String realm,
java.lang.String md5a2)
Try to authenticate with the specified username, which
matches the digest calculated using the given parameters using the
method described in RFC 2617 (which is a superset of RFC 2069).
|
java.security.Principal |
authenticate(java.security.cert.X509Certificate[] certs)
Return the Principal associated with the specified chain of X509
client certificates.
|
void |
backgroundProcess()
Execute a periodic task, such as reloading, etc.
|
protected boolean |
compareCredentials(java.lang.String userCredentials,
java.lang.String serverCredentials)
Deprecated.
Unused. Will be removed in Tomcat 8.5.x onwards.
|
protected java.lang.String |
digest(java.lang.String credentials)
Deprecated.
Used. Will be removed in Tomcat 9.
|
static java.lang.String |
Digest(java.lang.String credentials,
java.lang.String algorithm,
java.lang.String encoding)
Deprecated.
Unused. This will be removed in Tomcat 9.
|
SecurityConstraint[] |
findSecurityConstraints(Request request,
Context context)
Return the SecurityConstraints configured to guard the request URI for
this request, or
null if there is no such constraint. |
java.lang.String |
getAllRolesMode()
Return the all roles mode.
|
Container |
getContainer()
Return the Container with which this Realm has been associated.
|
CredentialHandler |
getCredentialHandler() |
java.lang.String |
getDigest()
Deprecated.
This will be removed in Tomcat 8.5.x as it has been replaced
by the CredentialHandler
|
protected java.lang.String |
getDigest(java.lang.String username,
java.lang.String realmName)
Return the digest associated with given principal's user name.
|
protected java.nio.charset.Charset |
getDigestCharset()
Deprecated.
This will be removed in Tomcat 8.5.x as it has been replaced
by the CredentialHandler
|
java.lang.String |
getDigestEncoding()
Deprecated.
This will be removed in Tomcat 8.5.x as it has been replaced
by the CredentialHandler
|
java.lang.String |
getDomainInternal()
Method implemented by sub-classes to identify the domain in which MBeans
should be registered.
|
protected abstract java.lang.String |
getName() |
java.lang.String |
getObjectNameKeyProperties()
Allow sub-classes to specify the key properties component of the
ObjectName that will be used to register this component. |
protected abstract java.lang.String |
getPassword(java.lang.String username)
Get the password for the specified user.
|
protected abstract java.security.Principal |
getPrincipal(java.lang.String username)
Get the principal associated with the specified user.
|
protected java.security.Principal |
getPrincipal(java.lang.String username,
org.ietf.jgss.GSSCredential gssCredential) |
protected java.security.Principal |
getPrincipal(java.security.cert.X509Certificate usercert)
Get the principal associated with the specified certificate.
|
java.lang.String |
getRealmPath() |
protected java.lang.String |
getRealmSuffix() |
protected Server |
getServer()
Return the Server object that is the ultimate parent for the container
with which this Realm is associated.
|
int |
getTransportGuaranteeRedirectStatus() |
boolean |
getValidate()
Return the "validate certificate chains" flag.
|
java.lang.String |
getX509UsernameRetrieverClassName()
Gets the name of the class that will be used to extract user names
from X509 client certificates.
|
protected boolean |
hasMessageDigest() |
boolean |
hasResourcePermission(Request request,
Response response,
SecurityConstraint[] constraints,
Context context)
Perform access control based on the specified authorization constraint.
|
boolean |
hasRole(Wrapper wrapper,
java.security.Principal principal,
java.lang.String role)
Return
true if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false . |
boolean |
hasUserDataPermission(Request request,
Response response,
SecurityConstraint[] constraints)
Enforce any user data constraint required by the security constraint
guarding this request URI.
|
protected void |
initInternal()
Sub-classes wishing to perform additional initialization should override
this method, ensuring that super.initInternal() is the first call in the
overriding method.
|
boolean |
isStripRealmForGss() |
static void |
main(java.lang.String[] args)
Generate a stored credential string for the given password and associated
parameters.
|
void |
removePropertyChangeListener(java.beans.PropertyChangeListener listener)
Remove a property change listener from this component.
|
void |
setAllRolesMode(java.lang.String allRolesMode)
Set the all roles mode.
|
void |
setContainer(Container container)
Set the Container with which this Realm has been associated.
|
void |
setCredentialHandler(CredentialHandler credentialHandler)
Set the CredentialHandler to be used by this Realm.
|
void |
setDigest(java.lang.String digest)
Deprecated.
This will be removed in Tomcat 8.5.x as it has been replaced
by the CredentialHandler
|
void |
setDigestEncoding(java.lang.String charset)
Deprecated.
This will be removed in Tomcat 8.5.x as it has been replaced
by the CredentialHandler
|
void |
setRealmPath(java.lang.String theRealmPath) |
void |
setStripRealmForGss(boolean stripRealmForGss) |
void |
setTransportGuaranteeRedirectStatus(int transportGuaranteeRedirectStatus)
Set the HTTP status code used when the container needs to issue an HTTP
redirect to meet the requirements of a configured transport guarantee.
|
void |
setValidate(boolean validate)
Set the "validate certificate chains" flag.
|
void |
setX509UsernameRetrieverClassName(java.lang.String className)
Sets the name of the class that will be used to extract user names
from X509 client certificates.
|
protected void |
startInternal()
Prepare for the beginning of active use of the public methods of this
component and implement the requirements of
LifecycleBase.startInternal() . |
protected void |
stopInternal()
Gracefully terminate the active use of the public methods of this
component and implement the requirements of
LifecycleBase.stopInternal() . |
java.lang.String |
toString()
Return a String representation of this component.
|
destroyInternal, getDomain, getObjectName, postDeregister, postRegister, preDeregister, preRegister, register, setDomain, unregister
addLifecycleListener, destroy, findLifecycleListeners, fireLifecycleEvent, getState, getStateName, init, removeLifecycleListener, setState, setState, start, stop
protected Container container
protected Log containerLog
@Deprecated protected java.lang.String digest
null
if no digesting should
be performed.@Deprecated protected java.lang.String digestEncoding
@Deprecated protected volatile java.security.MessageDigest md
@Deprecated protected static volatile java.security.MessageDigest md5Helper
protected static final StringManager sm
protected final java.beans.PropertyChangeSupport support
protected boolean validate
protected java.lang.String x509UsernameRetrieverClassName
protected X509UsernameRetriever x509UsernameRetriever
protected RealmBase.AllRolesMode allRolesMode
protected boolean stripRealmForGss
protected java.lang.String realmPath
public int getTransportGuaranteeRedirectStatus()
public void setTransportGuaranteeRedirectStatus(int transportGuaranteeRedirectStatus)
transportGuaranteeRedirectStatus
- The status to use. This value is
not validatedpublic CredentialHandler getCredentialHandler()
getCredentialHandler
in interface Realm
public void setCredentialHandler(CredentialHandler credentialHandler)
Realm
setCredentialHandler
in interface Realm
credentialHandler
- the CredentialHandler
to usepublic Container getContainer()
getContainer
in interface Realm
public void setContainer(Container container)
setContainer
in interface Realm
container
- The associated Containerpublic java.lang.String getAllRolesMode()
public void setAllRolesMode(java.lang.String allRolesMode)
allRolesMode
- A string representation of the new all roles mode@Deprecated public java.lang.String getDigest()
@Deprecated public void setDigest(java.lang.String digest)
digest
- The new digest algorithm@Deprecated public java.lang.String getDigestEncoding()
@Deprecated public void setDigestEncoding(java.lang.String charset)
charset
- The charset (null for platform default)@Deprecated protected java.nio.charset.Charset getDigestCharset() throws java.io.UnsupportedEncodingException
java.io.UnsupportedEncodingException
public boolean getValidate()
public void setValidate(boolean validate)
validate
- The new validate certificate chains flagpublic java.lang.String getX509UsernameRetrieverClassName()
public void setX509UsernameRetrieverClassName(java.lang.String className)
className
- The name of the class that will be used to extract user names
from X509 client certificates.X509UsernameRetriever
public boolean isStripRealmForGss()
public void setStripRealmForGss(boolean stripRealmForGss)
public void addPropertyChangeListener(java.beans.PropertyChangeListener listener)
addPropertyChangeListener
in interface Realm
listener
- The listener to addpublic java.security.Principal authenticate(java.lang.String username)
null
.authenticate
in interface Realm
username
- Username of the Principal to look upnull
if none is
associated.public java.security.Principal authenticate(java.lang.String username, java.lang.String credentials)
null
.authenticate
in interface Realm
username
- Username of the Principal to look upcredentials
- Password or other credentials to use in
authenticating this usernamenull
if there is none.public java.security.Principal authenticate(java.lang.String username, java.lang.String clientDigest, java.lang.String nonce, java.lang.String nc, java.lang.String cnonce, java.lang.String qop, java.lang.String realm, java.lang.String md5a2)
authenticate
in interface Realm
username
- Username of the Principal to look upclientDigest
- Digest which has been submitted by the clientnonce
- Unique (or supposedly unique) token which has been used
for this requestnc
- the nonce countercnonce
- the client chosen nonceqop
- the "quality of protection" (nc
and cnonce
will only be used, if qop
is not null
).realm
- Realm namemd5a2
- Second MD5 digest used to calculate the digest :
MD5(Method + ":" + uri)null
if there is none.public java.security.Principal authenticate(java.security.cert.X509Certificate[] certs)
null
.authenticate
in interface Realm
certs
- Array of client certificates, with the first one in
the array being the certificate of the client itself.null
if there is nonepublic java.security.Principal authenticate(org.ietf.jgss.GSSContext gssContext, boolean storeCreds)
GSSContext
authenticate
in interface Realm
gssContext
- The gssContext processed by the Authenticator
.storeCreds
- Should the realm attempt to store the delegated
credentials in the returned Principal?null
if there is none@Deprecated protected boolean compareCredentials(java.lang.String userCredentials, java.lang.String serverCredentials)
public void backgroundProcess()
backgroundProcess
in interface Realm
public SecurityConstraint[] findSecurityConstraints(Request request, Context context)
null
if there is no such constraint.findSecurityConstraints
in interface Realm
request
- Request we are processingcontext
- Context the Request is mapped toSecurityConstraint
, of null
if there is nonepublic boolean hasResourcePermission(Request request, Response response, SecurityConstraint[] constraints, Context context) throws java.io.IOException
true
if this constraint is satisfied and processing
should continue, or false
otherwise.hasResourcePermission
in interface Realm
request
- Request we are processingresponse
- Response we are creatingconstraints
- Security constraint we are enforcingcontext
- The Context to which client of this class is attached.true
if this constraint is satisfied and processing
should continue, or false
otherwisejava.io.IOException
- if an input/output error occurspublic boolean hasRole(Wrapper wrapper, java.security.Principal principal, java.lang.String role)
true
if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false
. This method can be overridden by Realm
implementations, but the default is adequate when an instance of
GenericPrincipal
is used to represent authenticated
Principals from this Realm.hasRole
in interface Realm
principal
- Principal for whom the role is to be checkedrole
- Security role to be checkedwrapper
- wrapper context for evaluating roletrue
if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false
.public boolean hasUserDataPermission(Request request, Response response, SecurityConstraint[] constraints) throws java.io.IOException
true
if this constraint
was not violated and processing should continue, or false
if we have created a response already.hasUserDataPermission
in interface Realm
request
- Request we are processingresponse
- Response we are creatingconstraints
- Security constraint being checkedtrue
if this constraint
was not violated and processing should continue, or false
if we have created a response already.java.io.IOException
- if an input/output error occurspublic void removePropertyChangeListener(java.beans.PropertyChangeListener listener)
removePropertyChangeListener
in interface Realm
listener
- The listener to removeprotected void initInternal() throws LifecycleException
LifecycleMBeanBase
initInternal
in class LifecycleMBeanBase
LifecycleException
protected void startInternal() throws LifecycleException
LifecycleBase.startInternal()
.startInternal
in class LifecycleBase
LifecycleException
- if this component detects a fatal error
that prevents this component from being usedprotected void stopInternal() throws LifecycleException
LifecycleBase.stopInternal()
.stopInternal
in class LifecycleBase
LifecycleException
- if this component detects a fatal error
that needs to be reportedpublic java.lang.String toString()
toString
in class java.lang.Object
@Deprecated protected java.lang.String digest(java.lang.String credentials)
credentials
- Password or other credentials to use in
authenticating this usernameprotected boolean hasMessageDigest()
protected java.lang.String getDigest(java.lang.String username, java.lang.String realmName)
username
- the user namerealmName
- the realm nameprotected abstract java.lang.String getName()
protected abstract java.lang.String getPassword(java.lang.String username)
username
- The user nameprotected java.security.Principal getPrincipal(java.security.cert.X509Certificate usercert)
usercert
- The user certificateprotected abstract java.security.Principal getPrincipal(java.lang.String username)
username
- The user nameprotected java.security.Principal getPrincipal(java.lang.String username, org.ietf.jgss.GSSCredential gssCredential)
protected Server getServer()
null
is
returned.@Deprecated public static final java.lang.String Digest(java.lang.String credentials, java.lang.String algorithm, java.lang.String encoding)
credentials
- Password or other credentials to use in authenticating
this usernamealgorithm
- Algorithm used to do the digestencoding
- Character encoding of the string to digestpublic static void main(java.lang.String[] args)
The following parameters are supported:
Charset.defaultCharset()
) will
be used.This generation process currently supports the following CredentialHandlers, the correct one being selected based on the algorithm specified:
args
- The parameters passed on the command linepublic java.lang.String getObjectNameKeyProperties()
LifecycleMBeanBase
ObjectName
that will be used to register this component.getObjectNameKeyProperties
in class LifecycleMBeanBase
ObjectName
public java.lang.String getDomainInternal()
LifecycleMBeanBase
getDomainInternal
in class LifecycleMBeanBase
public java.lang.String getRealmPath()
public void setRealmPath(java.lang.String theRealmPath)
protected java.lang.String getRealmSuffix()
Copyright © 2000-2018 Apache Software Foundation. All Rights Reserved.