org.apache.catalina.authenticator
Class DigestAuthenticator

java.lang.Object
  org.apache.catalina.valves.ValveBase
      org.apache.catalina.authenticator.AuthenticatorBase
          org.apache.catalina.authenticator.DigestAuthenticator

All Implemented Interfaces:

javax.management.MBeanRegistration, Authenticator, Contained, Lifecycle, Valve

public class DigestAuthenticator
extends AuthenticatorBase

An Authenticator and Valve implementation of HTTP DIGEST Authentication (see RFC 2069).

Version:

$Revision: 1328 $ $Date: 2009-12-09 13:37:21 +0100 (Wed, 09 Dec 2009) $

Author:

Craig R. McClanahan, Remy Maucherat

Field Summary

protected static java.lang.String	info Descriptive information about this implementation.
protected java.lang.String	key Private key.
protected static MD5Encoder	md5Encoder The MD5 helper object for this class.
protected static java.security.MessageDigest	md5Helper MD5 message digest provider.

Fields inherited from class org.apache.catalina.authenticator.AuthenticatorBase

algorithm, cache, changeSessionIdOnAuthentication, context, DEFAULT_ALGORITHM, digest, disableProxyCaching, entropy, lifecycle, random, randomClass, securePagesWithPragma, SESSION_ID_BYTES, sm, sso, started

Fields inherited from class org.apache.catalina.valves.ValveBase

container, containerLog, controller, domain, mserver, next, oname

Fields inherited from interface org.apache.catalina.Lifecycle

AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, DESTROY_EVENT, INIT_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT

Constructor Summary

DigestAuthenticator()

Method Summary

boolean	authenticate(Request request, javax.servlet.http.HttpServletResponse response, LoginConfig config) Authenticate the user making this request, based on the specified login configuration.
protected static java.security.Principal	findPrincipal(Request request, java.lang.String authorization, Realm realm) Parse the specified authorization credentials, and return the associated Principal that these credentials authenticate (if any) from the specified Realm.
protected java.lang.String	generateNOnce(Request request) Generate a unique token.
java.lang.String	getInfo() Return descriptive information about this Valve implementation.
protected java.lang.String	parseUsername(java.lang.String authorization) Parse the username from the specified authorization string.
protected static java.lang.String	removeQuotes(java.lang.String quotedString) Removes the quotes on a string.
protected static java.lang.String	removeQuotes(java.lang.String quotedString, boolean quotesRequired) Removes the quotes on a string.
protected void	setAuthenticateHeader(Request request, javax.servlet.http.HttpServletResponse response, LoginConfig config, java.lang.String nOnce) Generates the WWW-Authenticate header.

Methods inherited from class org.apache.catalina.authenticator.AuthenticatorBase

addLifecycleListener, associate, authenticate, findLifecycleListeners, generateSessionId, getAlgorithm, getCache, getContainer, getDigest, getDisableProxyCaching, getEntropy, getRandom, getRandomClass, getSecurePagesWithPragma, invoke, isChangeSessionIdOnAuthentication, login, logout, reauthenticateFromSSO, register, removeLifecycleListener, setAlgorithm, setCache, setChangeSessionIdOnAuthentication, setContainer, setDisableProxyCaching, setEntropy, setRandomClass, setSecurePagesWithPragma, start, stop, unregister

Methods inherited from class org.apache.catalina.valves.ValveBase

backgroundProcess, createObjectName, event, getContainerName, getController, getDomain, getNext, getObjectName, getParentName, postDeregister, postRegister, preDeregister, preRegister, setController, setNext, setObjectName, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

md5Encoder

protected static final MD5Encoder md5Encoder

The MD5 helper object for this class.

info

protected static final java.lang.String info

Descriptive information about this implementation.

See Also:

Constant Field Values

md5Helper

protected static java.security.MessageDigest md5Helper

MD5 message digest provider.

key

protected java.lang.String key

Private key.

Constructor Detail

DigestAuthenticator

public DigestAuthenticator()

Method Detail

getInfo

public java.lang.String getInfo()

Return descriptive information about this Valve implementation.

Specified by:

getInfo in interface Valve

Overrides:

getInfo in class AuthenticatorBase

authenticate

public boolean authenticate(Request request,
                            javax.servlet.http.HttpServletResponse response,
                            LoginConfig config)
                     throws java.io.IOException

Authenticate the user making this request, based on the specified login configuration. Return true if any specified constraint has been satisfied, or false if we have created a response challenge already.

Specified by:

authenticate in class AuthenticatorBase

Parameters:

request - Request we are processing

response - Response we are creating

config - Login configuration describing how authentication should be performed

Throws:

java.io.IOException - if an input/output error occurs

findPrincipal

protected static java.security.Principal findPrincipal(Request request,
                                                       java.lang.String authorization,
                                                       Realm realm)

Parse the specified authorization credentials, and return the associated Principal that these credentials authenticate (if any) from the specified Realm. If there is no such Principal, return null.

Parameters:

request - HTTP servlet request

authorization - Authorization credentials from this request

realm - Realm used to authenticate Principals

parseUsername

protected java.lang.String parseUsername(java.lang.String authorization)

Parse the username from the specified authorization string. If none can be identified, return null

Parameters:

authorization - Authorization string to be parsed

removeQuotes

protected static java.lang.String removeQuotes(java.lang.String quotedString,
                                               boolean quotesRequired)

Removes the quotes on a string. RFC2617 states quotes are optional for all parameters except realm.

removeQuotes

protected static java.lang.String removeQuotes(java.lang.String quotedString)

Removes the quotes on a string.

generateNOnce

protected java.lang.String generateNOnce(Request request)

Generate a unique token. The token is generated according to the following pattern. NOnceToken = Base64 ( MD5 ( client-IP ":" time-stamp ":" private-key ) ).

Parameters:

request - HTTP Servlet request

setAuthenticateHeader

protected void setAuthenticateHeader(Request request,
                                     javax.servlet.http.HttpServletResponse response,
                                     LoginConfig config,
                                     java.lang.String nOnce)

Generates the WWW-Authenticate header.

The header MUST follow this template :

      WWW-Authenticate    = "WWW-Authenticate" ":" "Digest"
                            digest-challenge

      digest-challenge    = 1#( realm | [ domain ] | nOnce |
                  [ digest-opaque ] |[ stale ] | [ algorithm ] )

      realm               = "realm" "=" realm-value
      realm-value         = quoted-string
      domain              = "domain" "=" <"> 1#URI <">
      nonce               = "nonce" "=" nonce-value
      nonce-value         = quoted-string
      opaque              = "opaque" "=" quoted-string
      stale               = "stale" "=" ( "true" | "false" )
      algorithm           = "algorithm" "=" ( "MD5" | token )
 

Parameters:

request - HTTP Servlet request

response - HTTP Servlet response

config - Login configuration describing how authentication should be performed

nOnce - nonce token