* * @version $Revision$, $Date$ */ public class AgentCertAuthentication implements IAuthManager, IProfileAuthenticator { /* result auth token attributes */ public static final String TOKEN_USERDN = "user"; public static final String TOKEN_USER_DN = "userdn"; public static final String TOKEN_USERID = "userid"; public static final String TOKEN_UID = "uid"; public static final String TOKEN_GROUP = "group"; /* required credentials */ public static final String CRED_CERT = IAuthManager.CRED_SSL_CLIENT_CERT; protected String[] mRequiredCreds = { CRED_CERT }; /* config parameters to pass to console (none) */ protected static String[] mConfigParams = null; private String mName = null; private String mImplName = null; private IConfigStore mConfig = null; private IUGSubsystem mUGSub = null; private ICertUserLocator mCULocator = null; public AgentCertAuthentication() { } /** * initializes the CertUserDBAuthentication auth manager *
* called by AuthSubsystem init() method, when initializing all available authentication managers. * * @param name The name of this authentication manager instance. * @param implName The name of the authentication manager plugin. * @param config The configuration store for this authentication manager. */ public void init(String name, String implName, IConfigStore config) throws EBaseException { mName = name; mImplName = implName; mConfig = config; mUGSub = (IUGSubsystem) CMS.getSubsystem(CMS.SUBSYSTEM_UG); mCULocator = mUGSub.getCertUserLocator(); } /** * Gets the name of this authentication manager. */ public String getName() { return mName; } /** * Gets the plugin name of authentication manager. */ public String getImplName() { return mImplName; } public boolean isSSLClientRequired() { return true; } /** * authenticates user(agent) by certificate *
* called by other subsystems or their servlets to authenticate users (agents)
*
* @param authCred - authentication credential that contains
* an usrgrp.Certificates of the user (agent)
* @return the authentication token that contains the following
*
* @exception EMissingCredential If a required credential for this
* authentication manager is missing.
* @exception EInvalidCredentials If credentials cannot be authenticated.
* @exception EBaseException If an internal error occurred.
* @see com.netscape.certsrv.authentication.AuthToken
* @see com.netscape.certsrv.usrgrp.Certificates
*/
public IAuthToken authenticate(IAuthCredentials authCred)
throws EMissingCredential, EInvalidCredentials, EBaseException {
CMS.debug("AgentCertAuthentication: start");
CMS.debug("authenticator instance name is " + getName());
// force SSL handshake
SessionContext context = SessionContext.getExistingContext();
ISSLClientCertProvider provider = (ISSLClientCertProvider)
context.get("sslClientCertProvider");
if (provider == null) {
CMS.debug("AgentCertAuthentication: No SSL Client Cert Provider Found");
throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
}
CMS.debug("AgentCertAuthenticator: got provider");
CMS.debug("AgentCertAuthenticator: retrieving client certificate");
X509Certificate[] allCerts = provider.getClientCertificateChain();
if (allCerts == null) {
CMS.debug("AgentCertAuthentication: No SSL Client Certs Found");
throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
}
CMS.debug("AgentCertAuthenticator: got certificates");
// retreive certificate from socket
AuthToken authToken = new AuthToken(this);
X509Certificate[] x509Certs = allCerts;
// default certificate default has bugs in version
// version(3) is returned as 3, which should be 2
X509CertImpl ci[] = new X509CertImpl[x509Certs.length];
try {
for (int i = 0; i < x509Certs.length; i++) {
ci[i] = new X509CertImpl(x509Certs[i].getEncoded());
}
} catch (CertificateException e) {
CMS.debug(e.toString());
}
// check if certificate(s) is revoked
boolean checkRevocation = true;
try {
checkRevocation = mConfig.getBoolean("checkRevocation", true);
} catch (EBaseException e) {
// do nothing; default to true
}
if (checkRevocation) {
if (CMS.isRevoked(ci)) {
CMS.debug("AgentCertAuthentication: certificate revoked");
throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
}
}
// map cert to user
IUser user = null;
Certificates certs = new Certificates(ci);
try {
user = mCULocator.locateUser(certs);
} catch (EUsrGrpException e) {
throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
} catch (netscape.ldap.LDAPException e) {
throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR",
e.toString()));
}
// any unexpected error occurs like internal db down,
// UGSubsystem only returns null for user.
if (user == null) {
throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
}
// get group name from configuration file
IConfigStore sconfig = CMS.getConfigStore();
String groupname = "";
try {
groupname = sconfig.getString("auths.instance." + getName() + ".agentGroup",
"");
} catch (EBaseException ee) {
}
if (!groupname.equals("")) {
CMS.debug("check if " + user.getUserID() + " is in group " + groupname);
IUGSubsystem uggroup = (IUGSubsystem) CMS.getSubsystem(CMS.SUBSYSTEM_UG);
if (!uggroup.isMemberOf(user, groupname)) {
CMS.debug(user.getUserID() + " is not in this group " + groupname);
throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHORIZATION_ERROR"));
}
}
authToken.set(TOKEN_USERDN, user.getUserDN());
authToken.set(TOKEN_USER_DN, user.getUserDN());
authToken.set(TOKEN_USERID, user.getUserID());
authToken.set(TOKEN_UID, user.getUserID());
authToken.set(TOKEN_GROUP, groupname);
authToken.set(CRED_CERT, certs);
CMS.debug("AgentCertAuthentication: authenticated " + user.getUserDN());
return authToken;
}
/**
* get the list of authentication credential attribute names
* required by this authentication manager. Generally used by
* the servlets that handle agent operations to authenticate its
* users. It calls this method to know which are the
* required credentials from the user (e.g. Javascript form data)
*
* @return attribute names in Vector
*/
public String[] getRequiredCreds() {
return (mRequiredCreds);
}
/**
* get the list of configuration parameter names
* required by this authentication manager. Generally used by
* the Certificate Server Console to display the table for
* configuration purposes. CertUserDBAuthentication is currently not
* exposed in this case, so this method is not to be used.
*
* @return configuration parameter names in Hashtable of Vectors
* where each hashtable entry's key is the substore name, value is a
* Vector of parameter names. If no substore, the parameter name
* is the Hashtable key itself, with value same as key.
*/
public String[] getConfigParams() {
return (mConfigParams);
}
/**
* prepare this authentication manager for shutdown.
*/
public void shutdown() {
}
/**
* gets the configuretion substore used by this authentication
* manager
*
* @return configuration store
*/
public IConfigStore getConfigStore() {
return mConfig;
}
// Profile-related methods
public void init(IProfile profile, IConfigStore config)
throws EProfileException {
}
/**
* Retrieves the localizable name of this policy.
*/
public String getName(Locale locale) {
return CMS.getUserMessage(locale, "CMS_AUTHENTICATION_AGENT_NAME");
}
/**
* Retrieves the localizable description of this policy.
*/
public String getText(Locale locale) {
return CMS.getUserMessage(locale, "CMS_AUTHENTICATION_AGENT_TEXT");
}
/**
* Retrieves a list of names of the value parameter.
*/
public Enumeration