Changeset 1140

Timestamp:

2009-03-12 15:36:46 (4 years ago)

Author:

bruno

Message:

security:

• fix authentication strength logic, which would not work in case auth info for multiple auth methods is available on the request (e.g. in a header and in a cookie)
• decode the request path for matching by the protect-rules.

File:

• trunk/modules/kauri-security/kauri-security-impl/src/main/java/org/kauriproject/security/infrastructure/SecurityFilter.java (modified) (5 diffs)

trunk/modules/kauri-security/kauri-security-impl/src/main/java/org/kauriproject/security/infrastructure/SecurityFilter.java

@@ -84 +84 @@
         // but reuse the existing Authentication token.
         Authentication existingAuthToken = SecurityContextHolder.getContext().getAuthentication();
-        Authentication authToken = null;
+        Authentication selectedAuthToken = null;
         AuthenticationMethodEntry selectedAuthMethod = null;
 
@@ -91 +91 @@
             // Look for authentication information on the request by querying all authentication methods
             //
-
-            for (AuthenticationMethodEntry authenticationMethod : filterContext.realm.getAuthenticationMethods()) {
+            for (AuthenticationMethodEntry authMethod : filterContext.realm.getAuthenticationMethods()) {
+                Authentication currentAuthToken;
                 try {
-                    authToken = authenticationMethod.get().getAuthentication(request, response, filterContext.realm);
+                    currentAuthToken = authMethod.get().getAuthentication(request, response, filterContext.realm);
                 } catch (AuthenticationException ae) {
-                    return handleException(request, response, authToken, authenticationMethod.get(), ae, filterContext);
+                    return handleException(request, response, selectedAuthToken, authMethod.get(), ae, filterContext);
                 }
 
-                if (authToken != null) {
-                    selectedAuthMethod = authenticationMethod;
-                    break;
+                if (currentAuthToken != null
+                        && (selectedAuthMethod == null || authMethod.getStrength() > selectedAuthMethod.getStrength())) {
+                    selectedAuthMethod = authMethod;
+                    selectedAuthToken = currentAuthToken;
                 }
             }
 
             // If no authentication info found on the request, send a challenge
-            if (authToken == null) {
+            if (selectedAuthToken == null) {
                 return sendChallenge(request, response, filterContext, null);
             }
@@ -119 +120 @@
             //
             try {
-                authToken = filterContext.realm.getAuthenticationManager().authenticate(authToken);
-                if (authToken == null) {
+                selectedAuthToken = filterContext.realm.getAuthenticationManager().authenticate(selectedAuthToken);
+                if (selectedAuthToken == null) {
                     throw new IllegalStateException("Contract violation: AuthenticationManager.authenticate(Authentication) returned null authentication.");
                 }
             } catch (AuthenticationException ae) {
-                return handleException(request, response, authToken, selectedAuthMethod.get(), ae, filterContext);
+                return handleException(request, response, selectedAuthToken, selectedAuthMethod.get(), ae, filterContext);
             }
         } else {
-            authToken = existingAuthToken;
+            selectedAuthToken = existingAuthToken;
         }
 
@@ -138 +139 @@
                 SecurityContext ctx = generateNewContext();
                 SecurityContextHolder.setContext(ctx);
-                SecurityContextHolder.getContext().setAuthentication(authToken);
-            }
-
-            populateRestletContext(request, authToken, filterContext);
+                SecurityContextHolder.getContext().setAuthentication(selectedAuthToken);
+            }
+
+            populateRestletContext(request, selectedAuthToken, filterContext);
 
             try {
-                filterContext.realm.getAccessDecisionManager().decide(authToken, filterContext.invocation, filterContext.configAttrDef);
+                filterContext.realm.getAccessDecisionManager().decide(selectedAuthToken, filterContext.invocation, filterContext.configAttrDef);
             } catch (AccessDeniedException ade) {
-                return handleException(request, response, authToken, selectedAuthMethod.get(), ade, filterContext);
+                return handleException(request, response, selectedAuthToken, selectedAuthMethod.get(), ade, filterContext);
             } catch (AuthenticationException ae) {
-                return handleException(request, response, authToken, selectedAuthMethod.get(), ae, filterContext);
+                return handleException(request, response, selectedAuthToken, selectedAuthMethod.get(), ae, filterContext);
             }
 
@@ -256 +257 @@
     private SecurityFilterContext determineSecurity(Request request) {
         String moduleId = module.getId();
-        String requestPath = request.getResourceRef().getRemainingPart(false, false);
+        String requestPath = request.getResourceRef().getRemainingPart(true, false);
         String restserviceName = (String)request.getAttributes().get("org.kauriproject.restservice.name");