| BasicAuthHeaderAutoLogin.java |
1 /**
2 * Copyright (c) 2000-2009 Liferay, Inc. All rights reserved.
3 *
4 * The contents of this file are subject to the terms of the Liferay Enterprise
5 * Subscription License ("License"). You may not use this file except in
6 * compliance with the License. You can obtain a copy of the License by
7 * contacting Liferay, Inc. See the License for the specific language governing
8 * permissions and limitations under the License, including but not limited to
9 * distribution rights of the Software.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
12 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
14 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
15 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
16 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
17 * SOFTWARE.
18 */
19
20 package com.liferay.portal.security.auth;
21
22 import com.liferay.portal.NoSuchUserException;
23 import com.liferay.portal.kernel.log.Log;
24 import com.liferay.portal.kernel.log.LogFactoryUtil;
25 import com.liferay.portal.kernel.util.Base64;
26 import com.liferay.portal.kernel.util.GetterUtil;
27 import com.liferay.portal.kernel.util.StringPool;
28 import com.liferay.portal.service.UserLocalServiceUtil;
29
30 import java.util.StringTokenizer;
31
32 import javax.servlet.http.HttpServletRequest;
33 import javax.servlet.http.HttpServletResponse;
34
35 /**
36 * <a href="BasicAuthHeaderAutoLogin.java.html"><b><i>View Source</i></b></a>
37 *
38 * <p>
39 * 1. Install Firefox. These instructions assume you have Firefox 2.0.0.1.
40 * Previous version of Firefox have been tested and are known to work.
41 * </p>
42 *
43 * <p>
44 * 2. Install the Modify Headers 0.5.4 Add-on. Tools > Add Ons. Click the get
45 * extensions link at the bottom of the window. Type in "Modify Headers" in the
46 * Search box. Find Modify Headers in the results page and click on it. Then
47 * click the install now link.
48 * </p>
49 *
50 * <p>
51 * 3. Configure Modify Headers to add a basic authentication header. Tools >
52 * Modify Headers. In the Modify Headers window select the Add drop down. Type
53 * in "Authorization" in the next box. Type in "Basic bGlmZXJheS5jb20uMTp0ZXN0"
54 * in the next box. Click the Add button.
55 * </p>
56 *
57 * <p>
58 * 4. Make sure your header modification is enabled and point your browser to
59 * the Liferay portal.
60 * </p>
61 *
62 * <p>
63 * 5. You should now be authenticated as Joe Bloggs.
64 * </p>
65 *
66 * @author Britt Courtney
67 * @author Brian Wing Shun Chan
68 *
69 */
70 public class BasicAuthHeaderAutoLogin implements AutoLogin {
71
72 public String[] login(
73 HttpServletRequest request, HttpServletResponse response)
74 throws AutoLoginException {
75
76 try {
77 String[] credentials = null;
78
79 // Get the Authorization header, if one was supplied
80
81 String authorization = request.getHeader("Authorization");
82
83 if (authorization == null) {
84 return credentials;
85 }
86
87 StringTokenizer st = new StringTokenizer(authorization);
88
89 if (!st.hasMoreTokens()) {
90 return credentials;
91 }
92
93 String basic = st.nextToken();
94
95 // We only handle HTTP Basic authentication
96
97 if (!basic.equalsIgnoreCase(HttpServletRequest.BASIC_AUTH)) {
98 return credentials;
99 }
100
101 String encodedCredentials = st.nextToken();
102
103 if (_log.isDebugEnabled()) {
104 _log.debug("Encoded credentials are " + encodedCredentials);
105 }
106
107 String decodedCredentials = new String(
108 Base64.decode(encodedCredentials));
109
110 if (_log.isDebugEnabled()) {
111 _log.debug("Decoded credentials are " + decodedCredentials);
112 }
113
114 int pos = decodedCredentials.indexOf(StringPool.COLON);
115
116 if (pos == -1) {
117 return credentials;
118 }
119
120 long userId = GetterUtil.getLong(
121 decodedCredentials.substring(0, pos));
122 String password = decodedCredentials.substring(pos + 1);
123
124 try {
125 UserLocalServiceUtil.getUserById(userId);
126
127 credentials = new String[3];
128
129 credentials[0] = String.valueOf(userId);
130 credentials[1] = password;
131 credentials[2] = Boolean.TRUE.toString();
132 }
133 catch (NoSuchUserException nsue) {
134 if (_log.isWarnEnabled()) {
135 _log.warn(userId + " is not a valid user id");
136 }
137 }
138
139 return credentials;
140 }
141 catch (Exception e) {
142 throw new AutoLoginException(e);
143 }
144 }
145
146 private static Log _log =
147 LogFactoryUtil.getLog(BasicAuthHeaderAutoLogin.class);
148
149 }