public abstract class RealmBase extends LifecycleMBeanBase implements Realm
Modifier and Type | Class and Description |
---|---|
protected static class |
RealmBase.AllRolesMode |
Modifier and Type | Field and Description |
---|---|
protected RealmBase.AllRolesMode |
allRolesMode
The all role mode.
|
protected Container |
container
The Container with which this Realm is associated.
|
protected Log |
containerLog
Container log
|
protected String |
digest
Deprecated.
Unused. Will be removed in Tomcat 9.0.x onwards.
|
protected String |
digestEncoding
Deprecated.
Unused. Will be removed in Tomcat 9.0.x onwards.
|
protected MessageDigest |
md
Deprecated.
Unused. Will be removed in Tomcat 9.0.x onwards.
|
protected static MessageDigest |
md5Helper
Deprecated.
Unused. Will be removed in Tomcat 9.0.x onwards.
|
protected String |
realmPath |
protected static StringManager |
sm
The string manager for this package.
|
protected boolean |
stripRealmForGss
When processing users authenticated via the GSS-API, should any
"@...
|
protected PropertyChangeSupport |
support
The property change support for this component.
|
protected boolean |
validate
Should we validate client certificate chains when they are presented?
|
protected X509UsernameRetriever |
x509UsernameRetriever
The object that will extract user names from X509 client certificates.
|
protected String |
x509UsernameRetrieverClassName
The name of the class to use for retrieving user names from X509
certificates.
|
mserver
AFTER_DESTROY_EVENT, AFTER_INIT_EVENT, AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_DESTROY_EVENT, BEFORE_INIT_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, CONFIGURE_START_EVENT, CONFIGURE_STOP_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT
Constructor and Description |
---|
RealmBase() |
Modifier and Type | Method and Description |
---|---|
void |
addPropertyChangeListener(PropertyChangeListener listener)
Add a property change listener to this component.
|
Principal |
authenticate(GSSContext gssContext,
boolean storeCred)
Return the Principal associated with the specified
GSSContext . |
Principal |
authenticate(String username,
String credentials)
Return the Principal associated with the specified username and
credentials, if there is one; otherwise return
null . |
Principal |
authenticate(String username,
String clientDigest,
String nonce,
String nc,
String cnonce,
String qop,
String realm,
String md5a2)
Return the Principal associated with the specified username, which
matches the digest calculated using the given parameters using the
method described in RFC 2069; otherwise return
null . |
Principal |
authenticate(X509Certificate[] certs)
Return the Principal associated with the specified chain of X509
client certificates.
|
void |
backgroundProcess()
Execute a periodic task, such as reloading, etc.
|
protected boolean |
compareCredentials(String userCredentials,
String serverCredentials)
Deprecated.
Unused. Will be removed in Tomcat 9.0.x onwards.
|
protected String |
digest(String credentials)
Digest the password using the specified algorithm and
convert the result to a corresponding hexadecimal string.
|
static String |
Digest(String credentials,
String algorithm,
String encoding)
Digest password using the algorithm specified and convert the result to a
corresponding hex string.
|
SecurityConstraint[] |
findSecurityConstraints(Request request,
Context context)
Return the SecurityConstraints configured to guard the request URI for
this request, or
null if there is no such constraint. |
String |
getAllRolesMode()
Return the all roles mode.
|
Container |
getContainer()
Return the Container with which this Realm has been associated.
|
CredentialHandler |
getCredentialHandler()
Return the CredentialHandler configured for this Realm.
|
String |
getDigest()
Deprecated.
This will be removed in Tomcat 9.0.x as it has been replaced
by the CredentialHandler
|
protected String |
getDigest(String username,
String realmName)
Return the digest associated with given principal's user name.
|
protected Charset |
getDigestCharset()
Deprecated.
This will be removed in Tomcat 9.0.x as it has been replaced
by the CredentialHandler
|
String |
getDigestEncoding()
Deprecated.
This will be removed in Tomcat 9.0.x as it has been replaced
by the CredentialHandler
|
String |
getDomainInternal()
Method implemented by sub-classes to identify the domain in which MBeans
should be registered.
|
protected abstract String |
getName()
Return a short name for this Realm implementation, for use in
log messages.
|
String |
getObjectNameKeyProperties()
Allow sub-classes to specify the key properties component of the
ObjectName that will be used to register this component. |
protected abstract String |
getPassword(String username)
Return the password associated with the given principal's user name.
|
protected abstract Principal |
getPrincipal(String username)
Return the Principal associated with the given user name.
|
protected Principal |
getPrincipal(String username,
GSSCredential gssCredential) |
protected Principal |
getPrincipal(X509Certificate usercert)
Return the Principal associated with the given certificate.
|
String |
getRealmPath() |
protected String |
getRealmSuffix() |
protected Server |
getServer()
Return the Server object that is the ultimate parent for the container
with which this Realm is associated.
|
boolean |
getValidate()
Return the "validate certificate chains" flag.
|
String |
getX509UsernameRetrieverClassName()
Gets the name of the class that will be used to extract user names
from X509 client certificates.
|
protected boolean |
hasMessageDigest() |
boolean |
hasResourcePermission(Request request,
Response response,
SecurityConstraint[] constraints,
Context context)
Perform access control based on the specified authorization constraint.
|
boolean |
hasRole(Wrapper wrapper,
Principal principal,
String role)
Return
true if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false . |
boolean |
hasUserDataPermission(Request request,
Response response,
SecurityConstraint[] constraints)
Enforce any user data constraint required by the security constraint
guarding this request URI.
|
protected void |
initInternal()
Sub-classes wishing to perform additional initialization should override
this method, ensuring that super.initInternal() is the first call in the
overriding method.
|
boolean |
isStripRealmForGss() |
static void |
main(String[] args)
Generate a stored credential string for the given password and associated
parameters.
|
void |
removePropertyChangeListener(PropertyChangeListener listener)
Remove a property change listener from this component.
|
void |
setAllRolesMode(String allRolesMode)
Set the all roles mode.
|
void |
setContainer(Container container)
Set the Container with which this Realm has been associated.
|
void |
setCredentialHandler(CredentialHandler credentialHandler)
Set the CredentialHandler to be used by this Realm.
|
void |
setDigest(String digest)
Deprecated.
This will be removed in Tomcat 9.0.x as it has been replaced
by the CredentialHandler
|
void |
setDigestEncoding(String charset)
Deprecated.
This will be removed in Tomcat 9.0.x as it has been replaced
by the CredentialHandler
|
void |
setRealmPath(String theRealmPath) |
void |
setStripRealmForGss(boolean stripRealmForGss) |
void |
setValidate(boolean validate)
Set the "validate certificate chains" flag.
|
void |
setX509UsernameRetrieverClassName(String className)
Sets the name of the class that will be used to extract user names
from X509 client certificates.
|
protected void |
startInternal()
Prepare for the beginning of active use of the public methods of this
component and implement the requirements of
LifecycleBase.startInternal() . |
protected void |
stopInternal()
Gracefully terminate the active use of the public methods of this
component and implement the requirements of
LifecycleBase.stopInternal() . |
String |
toString()
Return a String representation of this component.
|
destroyInternal, getDomain, getObjectName, postDeregister, postRegister, preDeregister, preRegister, register, setDomain, unregister
addLifecycleListener, destroy, findLifecycleListeners, fireLifecycleEvent, getState, getStateName, init, removeLifecycleListener, setState, setState, start, stop
protected Container container
protected Log containerLog
@Deprecated protected String digest
null
if no digesting should
be performed.@Deprecated protected String digestEncoding
@Deprecated protected volatile MessageDigest md
@Deprecated protected static volatile MessageDigest md5Helper
protected static final StringManager sm
protected final PropertyChangeSupport support
protected boolean validate
protected String x509UsernameRetrieverClassName
protected X509UsernameRetriever x509UsernameRetriever
protected RealmBase.AllRolesMode allRolesMode
protected boolean stripRealmForGss
protected String realmPath
public CredentialHandler getCredentialHandler()
Realm
getCredentialHandler
in interface Realm
public void setCredentialHandler(CredentialHandler credentialHandler)
Realm
setCredentialHandler
in interface Realm
public Container getContainer()
getContainer
in interface Realm
public void setContainer(Container container)
setContainer
in interface Realm
container
- The associated Containerpublic String getAllRolesMode()
public void setAllRolesMode(String allRolesMode)
allRolesMode
- A string representation of the new all roles mode@Deprecated public String getDigest()
@Deprecated public void setDigest(String digest)
digest
- The new digest algorithm@Deprecated public String getDigestEncoding()
@Deprecated public void setDigestEncoding(String charset)
charset
- The charset (null for platform default)@Deprecated protected Charset getDigestCharset() throws UnsupportedEncodingException
UnsupportedEncodingException
public boolean getValidate()
public void setValidate(boolean validate)
validate
- The new validate certificate chains flagpublic String getX509UsernameRetrieverClassName()
public void setX509UsernameRetrieverClassName(String className)
className
- The name of the class that will be used to extract user names
from X509 client certificates.X509UsernameRetriever
public boolean isStripRealmForGss()
public void setStripRealmForGss(boolean stripRealmForGss)
public void addPropertyChangeListener(PropertyChangeListener listener)
addPropertyChangeListener
in interface Realm
listener
- The listener to addpublic Principal authenticate(String username, String credentials)
null
.authenticate
in interface Realm
username
- Username of the Principal to look upcredentials
- Password or other credentials to use in
authenticating this usernamepublic Principal authenticate(String username, String clientDigest, String nonce, String nc, String cnonce, String qop, String realm, String md5a2)
null
.authenticate
in interface Realm
username
- Username of the Principal to look upclientDigest
- Digest which has been submitted by the clientnonce
- Unique (or supposedly unique) token which has been used
for this requestrealm
- Realm namemd5a2
- Second MD5 digest used to calculate the digest :
MD5(Method + ":" + uri)public Principal authenticate(X509Certificate[] certs)
null
.authenticate
in interface Realm
certs
- Array of client certificates, with the first one in
the array being the certificate of the client itself.public Principal authenticate(GSSContext gssContext, boolean storeCred)
GSSContext
.
If there is none, return null
.authenticate
in interface Realm
gssContext
- The gssContext processed by the Authenticator
.storeCred
- Should the realm attempt to store the delegated
credentials in the returned Principal?@Deprecated protected boolean compareCredentials(String userCredentials, String serverCredentials)
public void backgroundProcess()
backgroundProcess
in interface Realm
public SecurityConstraint[] findSecurityConstraints(Request request, Context context)
null
if there is no such constraint.findSecurityConstraints
in interface Realm
request
- Request we are processingcontext
- Context the Request is mapped topublic boolean hasResourcePermission(Request request, Response response, SecurityConstraint[] constraints, Context context) throws IOException
true
if this constraint is satisfied and processing
should continue, or false
otherwise.hasResourcePermission
in interface Realm
request
- Request we are processingresponse
- Response we are creatingconstraints
- Security constraint we are enforcingcontext
- The Context to which client of this class is attached.IOException
- if an input/output error occurspublic boolean hasRole(Wrapper wrapper, Principal principal, String role)
true
if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false
. This method can be overridden by Realm
implementations, but the default is adequate when an instance of
GenericPrincipal
is used to represent authenticated
Principals from this Realm.public boolean hasUserDataPermission(Request request, Response response, SecurityConstraint[] constraints) throws IOException
true
if this constraint
was not violated and processing should continue, or false
if we have created a response already.hasUserDataPermission
in interface Realm
request
- Request we are processingresponse
- Response we are creatingconstraints
- Security constraint being checkedIOException
- if an input/output error occurspublic void removePropertyChangeListener(PropertyChangeListener listener)
removePropertyChangeListener
in interface Realm
listener
- The listener to removeprotected void initInternal() throws LifecycleException
LifecycleMBeanBase
initInternal
in class LifecycleMBeanBase
LifecycleException
protected void startInternal() throws LifecycleException
LifecycleBase.startInternal()
.startInternal
in class LifecycleBase
LifecycleException
- if this component detects a fatal error
that prevents this component from being usedprotected void stopInternal() throws LifecycleException
LifecycleBase.stopInternal()
.stopInternal
in class LifecycleBase
LifecycleException
- if this component detects a fatal error
that needs to be reportedpublic String toString()
protected String digest(String credentials)
credentials
- Password or other credentials to use in
authenticating this usernameprotected boolean hasMessageDigest()
protected String getDigest(String username, String realmName)
protected abstract String getName()
protected abstract String getPassword(String username)
protected Principal getPrincipal(X509Certificate usercert)
protected abstract Principal getPrincipal(String username)
protected Principal getPrincipal(String username, GSSCredential gssCredential)
protected Server getServer()
null
is
returned.public static final String Digest(String credentials, String algorithm, String encoding)
credentials
- Password or other credentials to use in authenticating
this usernamealgorithm
- Algorithm used to do the digestencoding
- Character encoding of the string to digestpublic static void main(String[] args)
The following parameters are supported:
Charset.defaultCharset()
) will
be used.This generation process currently supports the following CredentialHandlers, the correct one being selected based on the algorithm specified:
args
- The parameters passed on the command linepublic String getObjectNameKeyProperties()
LifecycleMBeanBase
ObjectName
that will be used to register this component.getObjectNameKeyProperties
in class LifecycleMBeanBase
ObjectName
public String getDomainInternal()
LifecycleMBeanBase
getDomainInternal
in class LifecycleMBeanBase
public String getRealmPath()
public void setRealmPath(String theRealmPath)
protected String getRealmSuffix()
Copyright © 2000-2014 Apache Software Foundation. All Rights Reserved.