modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerBean.java | 30 - modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerLocal.java | 25 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/TemporarySessionPasswordGenerator.java | 259 ---------- modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/CustomJaasDeploymentService.java | 14 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/TempSessionLoginModule.java | 100 --- 5 files changed, 428 deletions(-)
New commits: commit 3e90719a317d577fc6fc90c0efae8b840aa8cc99 Author: Joseph Marques joseph@redhat.com Date: Wed Oct 13 11:45:13 2010 -0400
remove legacy TempSessionLoginModule and all related classes
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerBean.java index 6359a23..3b125e1 100644 --- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerBean.java +++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerBean.java @@ -93,11 +93,6 @@ public class SubjectManagerBean implements SubjectManagerLocal, SubjectManagerRe private SessionManager sessionManager = SessionManager.getInstance();
/** - * This is used to generate temporary session passwords and to validate those passwords. - */ - private TemporarySessionPasswordGenerator m_sessionPasswordGenerator = new TemporarySessionPasswordGenerator(); - - /** * @see org.rhq.enterprise.server.auth.SubjectManagerLocal#loadUserConfiguration(Integer) */ public Subject loadUserConfiguration(Integer subjectId) { @@ -253,31 +248,6 @@ public class SubjectManagerBean implements SubjectManagerLocal, SubjectManagerRe }
/** - * @see org.rhq.enterprise.server.auth.SubjectManagerLocal#generateTemporarySessionPassword(int) - */ - public String generateTemporarySessionPassword(int sessionId) { - return m_sessionPasswordGenerator.generateSessionPassword(sessionId); - } - - /** - * @see org.rhq.enterprise.server.auth.SubjectManagerLocal#authenticateTemporarySessionPassword(java.lang.String) - */ - public boolean authenticateTemporarySessionPassword(String password) throws Exception { - Integer sessionId = m_sessionPasswordGenerator.authenticateSessionPassword(password); - boolean validPassword = false; - - if (sessionId != null) { - // If the password was valid, sessionId will be the ID to its associated session. We now have to make - // sure that session is still valid - this just makes sure the session hasn't timed out or was invalidated - if (sessionManager.getSubject(sessionId.intValue()) != null) { - validPassword = true; - } - } - - return validPassword; - } - - /** * @see org.rhq.enterprise.server.auth.SubjectManagerLocal#login(String, String) */ public Subject login(String username, String password) throws LoginException { diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerLocal.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerLocal.java index b4b7d55..d62096b 100644 --- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerLocal.java +++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/SubjectManagerLocal.java @@ -72,31 +72,6 @@ public interface SubjectManagerLocal { PageList<Subject> findAllSubjects(PageControl pageControl);
/** - * Generates a one-time temporary session password for the given session. This can be used to authenticate the user - * of that session for one time and one time only (i.e. to login as the user this temporary password can be used as - * opposed to the user's real password). - * - * <p>Note that this method should only be available on this EJB's local interface.</p> - * - * @param sessionId the session to assign a temporary password to - * - * @return a temporary password that can be used once to login as the user - */ - String generateTemporarySessionPassword(int sessionId); - - /** - * Tests the validity of the given session password. Returns <code>true</code> if the password is valid and the - * session is still valid. - * - * @param password a temporary session password that was created by {@link #generateTemporarySessionPassword(int)}. - * - * @return <code>true</code> if the given <code>password</code> is valid and its associated session is still valid - * - * @throws Exception if the password was valid but its associated session has either timed out or was invalidated - */ - boolean authenticateTemporarySessionPassword(String password) throws Exception; - - /** * Logs in a user without performing any authentication. This method should be used with care and not available to * remote clients. Because of the unauthenticated nature of this login, the new login session will have a session * timeout of only a few seconds. However, if you pass in <code>true</code> for the "reattach", this method will diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/TemporarySessionPasswordGenerator.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/TemporarySessionPasswordGenerator.java deleted file mode 100644 index fc82ce2..0000000 --- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/auth/TemporarySessionPasswordGenerator.java +++ /dev/null @@ -1,259 +0,0 @@ -/* - * RHQ Management Platform - * Copyright (C) 2005-2008 Red Hat, Inc. - * All rights reserved. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - */ -package org.rhq.enterprise.server.auth; - -import java.util.ArrayList; -import java.util.HashMap; -import java.util.List; -import java.util.Map; -import java.util.Random; -import org.jboss.security.Util; - -/** - * Provides a random password generator and a storage area that helps temporarily authenticate users even though their - * true passwords are not known. This is necessary when a scheduled action is triggered and we want to run as the user, - * but we don't know the user's true password. In other words, these temporary passwords should only be used if we have - * previously validated the user for a given session ID. Session passwords generated by this object can only be used - * once, and they must be validated fairly quickly after being generated. - * - * <p>This object is thread-safe.</p> - * - * @author John Mazzitelli - */ -public class TemporarySessionPasswordGenerator { - /** - * This is a separator character that will appear between the session ID and a random set of characters in a - * generated session password. This character must NOT be in {@link #SESSION_PASSWORD_PREFIX}. - */ - private static final char SESSION_PASSWORD_SEPARATOR = '$'; - - /** - * A prefix to all generated session passwords; this makes it possible to quickly identify a possible session - * password. While this doesn't exclusively identify only session passwords, it helps eliminate most passwords from - * being recognized as a session password. None of the characters in this string will be the same as - * {@link #SESSION_PASSWORD_SEPARATOR}. - */ - private static final String SESSION_PASSWORD_PREFIX = "_x|=~"; - - /** - * Map keyed on session Integers whose values are Longs indicating when the session's password was created. - */ - private final Map<Integer, Long> m_sessionPasswordCreationDates; - - /** - * Map keyed on session Integers whose values are the MD5 strings of the generated passwords. - */ - private final Map<Integer, String> m_sessionPasswordMD5Strings; - - /** - * The amount of milliseconds that a temporary password is guaranteed to remain valid (a password may actually live - * longer than this, but it is not guaranteed to do so) - */ - private final int m_timeoutMillis; - - /** - * Constructor for {@link TemporarySessionPasswordGenerator}. - */ - public TemporarySessionPasswordGenerator() { - this(60 * 60 * 1000); // be default, give a copious 60 minutes - this is easily enough for what we need to use this class for - } - - /** - * Constructor for {@link TemporarySessionPasswordGenerator}. - * - * @param timeoutMillis the amount of milliseconds that a temporary password is guaranteed to remain valid (a - * password may actually live longer than this, but it is not guaranteed to do so) - */ - public TemporarySessionPasswordGenerator(int timeoutMillis) { - m_sessionPasswordCreationDates = new HashMap<Integer, Long>(); - m_sessionPasswordMD5Strings = new HashMap<Integer, String>(); - m_timeoutMillis = timeoutMillis; - - return; - } - - /** - * Given a session identifier, this will generate a temporary password that can be used to identify the user whose - * session that is. Use {@link #authenticateSessionPassword(String)} to later check for this password's - * authenticity. This session password can only be authenticated once. - * - * @param sessionId the session of a user who needs a temporary password assigned - * - * @return a password that can be used to associate a session with a user - * - * @see #authenticateSessionPassword(String) - */ - public String generateSessionPassword(int sessionId) { - StringBuffer pwBuf = new StringBuffer(SESSION_PASSWORD_PREFIX); - - pwBuf.append(sessionId); - pwBuf.append(SESSION_PASSWORD_SEPARATOR); - pwBuf.append(generateRandomPassword()); - - String pw = pwBuf.toString(); - - storeSessionPassword(new Integer(sessionId), pw); - - return pw; - } - - /** - * Returns the session's ID if the given session's password was one that was generated by this object. Returns - * <code>null</code> if the password was invalid and thus the user attempting to log in should be denied access. - * Once authenticated, the password will no longer be valid and can not be used to validate the session again. - * - * @param password the password to test - * - * @return session's ID if the session's <code>password</code> was one that was generated by this object; <code> - * null</code> otherwise - * - * @throws IllegalStateException if the password was in a valid format but the password's MD5 does not match; this - * exception will only be thrown when it looks like someone is trying to hack a - * session password - * - * @see #generateSessionPassword(int) - */ - public Integer authenticateSessionPassword(String password) throws IllegalStateException { - int separator = (password != null) ? password.indexOf(SESSION_PASSWORD_SEPARATOR) : -1; - - // let's quickly eliminate most passwords - if ((separator == -1) || !password.startsWith(SESSION_PASSWORD_PREFIX)) { - return null; - } - - String sessionStr = password.substring(SESSION_PASSWORD_PREFIX.length(), separator); - Integer sessionId; - - try { - sessionId = new Integer(sessionStr); - } catch (NumberFormatException e) { - // kinda looked like our password, but it can't be since this should have been a valid session ID number - return null; - } - - String passwordMD5 = generateMD5(password); - String sessionMD5; - - synchronized (this) { - purgeOldSessionPasswords(); // let's do this cleanup now; must do this inside the sychronized block - - // we only allow a session password to be authenticated once, so remove all traces of it while retrieving it - sessionMD5 = m_sessionPasswordMD5Strings.remove(sessionId); - m_sessionPasswordCreationDates.remove(sessionId); - } - - // the session password was either already authenticated or was removed because it was too old - if (sessionMD5 == null) { - return null; - } - - // the password was wrong, if we got this far and the password was wrong, someone is trying to hack - if (!sessionMD5.equals(passwordMD5)) { - throw new IllegalStateException( - "WARNING! A session was attempted to be reattached but the login password was invalid"); - } - - return sessionId; - } - - /** - * Stores the generated session password in our internal data structures so we can authenticate the session using - * the password. - * - * @param sessionId the session identifier - * @param pw the password to store - */ - private void storeSessionPassword(Integer sessionId, String pw) { - synchronized (this) { - purgeOldSessionPasswords(); // let's do this cleanup now; must do this inside the sychronized block - - m_sessionPasswordCreationDates.put(sessionId, new Long(System.currentTimeMillis())); - m_sessionPasswordMD5Strings.put(sessionId, generateMD5(pw)); - } - - return; - } - - /** - * Looks at the current set of session passwords and removes those that are old. Not sure why these passwords would - * be hanging around, since usually generated session passwords are authenticated fairly quickly thereafter. But - * just in case something went wrong between the time the password was generated and the time it was to be - * authenticated, this method is used to clean up. - * - * <p>To avoid having to enter another synchronized block and again attempt to aquire a lock, make sure you call - * this method from within a sychronized block - this method requires "this" object's lock.</p> - */ - private void purgeOldSessionPasswords() { - long earliestAllowed = System.currentTimeMillis() - m_timeoutMillis; - List<Integer> doomedSessions = new ArrayList<Integer>(); - - for (Map.Entry<Integer, Long> entry : m_sessionPasswordCreationDates.entrySet()) { - Long creationTime = entry.getValue(); - - if (creationTime.longValue() < earliestAllowed) { - doomedSessions.add(entry.getKey()); - } - } - - for (Integer doomedSession : doomedSessions) { - m_sessionPasswordCreationDates.remove(doomedSession); - m_sessionPasswordMD5Strings.remove(doomedSession); - } - - return; - } - - /** - * Generates a random password that will be used as part of the session password. - * - * @return a random password - */ - private String generateRandomPassword() { - // generate a random password - this will usually be used as part of a Basic Authentication to our WebDAV server - // make sure these can be encoded in a URL (no + signs - don't ask - see UrlUtil.encodeMore) - // make sure SESSION_PASSWORD_SEPARATOR character is NOT in the chars variable! - StringBuffer password = new StringBuffer(); - String chars = "0a3X1bWd-2VeU*fTgH7sGtF6YS^KpJqI4rh7RiQj_5P.kOZlNm|0Mn~Lou!9EvD4wACxB8yz"; - Random random = new Random(System.currentTimeMillis()); - int passwordLength = 0; - - while (passwordLength < 64) { - passwordLength = random.nextInt(129); - } - - random = new Random(System.currentTimeMillis() + passwordLength); - - for (int i = 0; i < passwordLength; i++) { - password.append(chars.charAt(random.nextInt(chars.length()))); - } - - return password.toString(); - } - - /** - * Given a password string, this will return its MD5. - * - * @param password the string whose MD5 is to be calculated - * - * @return the MD5 string - */ - private String generateMD5(String password) { - return Util.createPasswordHash("MD5", "base64", null, null, password); - } -} \ No newline at end of file diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/CustomJaasDeploymentService.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/CustomJaasDeploymentService.java index caec439..7787dba 100644 --- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/CustomJaasDeploymentService.java +++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/CustomJaasDeploymentService.java @@ -113,20 +113,6 @@ public class CustomJaasDeploymentService implements CustomJaasDeploymentServiceM this.log.info("Enabling RHQ JDBC JAAS Provider"); configEntries.add(ace);
- /* - * NOT USED ANYMORE - // to support the need for authenticating temporary session passwords, add a login module that can do that - // we set an empty set of config options, but if we need to, we can store the config items - // in the RHQ_config_props table, which would allow the GUI to modify them (just in case we want to add that capability) - // the "conf" Properties value has all RHQ_config_props values, so we have that now - // for now, there are no config properties we need in this login module, so just create an empty map - ace = new AppConfigurationEntry(TempSessionLoginModule.class.getName(), - AppConfigurationEntry.LoginModuleControlFlag.SUFFICIENT, new HashMap<String, String>()); - this.log.info("Enabled the temporary session login module"); - configEntries.add(ace); - * - */ - String provider = conf.getProperty(RHQConstants.JAASProvider);
if ((provider != null) && provider.equals(RHQConstants.LDAPJAASProvider)) { diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/TempSessionLoginModule.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/TempSessionLoginModule.java deleted file mode 100644 index a58f275..0000000 --- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/TempSessionLoginModule.java +++ /dev/null @@ -1,100 +0,0 @@ -/* - * RHQ Management Platform - * Copyright (C) 2005-2008 Red Hat, Inc. - * All rights reserved. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation version 2 of the License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - */ -package org.rhq.enterprise.server.core.jaas; - -import java.security.acl.Group; -import java.util.Map; -import javax.security.auth.Subject; -import javax.security.auth.callback.CallbackHandler; -import javax.security.auth.login.LoginException; -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; -import org.jboss.security.SimpleGroup; -import org.jboss.security.auth.spi.UsernamePasswordLoginModule; -import org.rhq.enterprise.server.util.LookupUtil; - -/** - * A "special" JAAS login module that checks to see if the password is a valid temporary session password. If it is, the - * user is authenticated; if not, the user is denied access. - * - * <p>This is used mainly to support the use-case where a server component needs to submit a request that needs to again - * be authenticated. In this case, the server doesn't know the user's true password; instead a temporary session - * password was created for the user. - * - * @author John Mazzitelli - */ -public class TempSessionLoginModule extends UsernamePasswordLoginModule { - /** - * Logger - */ - private static final Log LOG = LogFactory.getLog(TempSessionLoginModule.class); - - /** - * A place where this login module can initialize itself. - * - * @param theSubject - * @param theHandler - * @param theSharedState - * @param theOptions - */ - public void initialize(Subject theSubject, CallbackHandler theHandler, Map theSharedState, Map theOptions) { - super.initialize(theSubject, theHandler, theSharedState, theOptions); - } - - /** - * We don't know the user's true password, so we don't know the expected password; therefore, this returns an empty - * string. This class overrides {@link #validatePassword(String, String)} so it can validate on the input password - * that was entered by the client, since it is all we need to check validity. - * - * @return empty string - */ - protected String getUsersPassword() { - return ""; - } - - /** - * Authenticates the user by seeing if the <code>inputPassword</code> is a valid temporary session password. <code> - * expectedPassword</code> is ignored. - * - * @see UsernamePasswordLoginModule#validatePassword(String, String) - */ - protected boolean validatePassword(String inputPassword, String expectedPassword) { - boolean validPassword = false; - - // call into the JON authentication subsystem to see if the input password was valid. - try { - validPassword = LookupUtil.getSubjectManager().authenticateTemporarySessionPassword(inputPassword); - } catch (Exception e) { - LOG.error("Failed to authenticate a session password for user [" + getUsername() + "]", e); - } - - return validPassword; - } - - /** - * @see org.jboss.security.auth.spi.AbstractServerLoginModule#getRoleSets() - */ - protected Group[] getRoleSets() throws LoginException { - SimpleGroup roles = new SimpleGroup("Roles"); - - //roles.addMember( new SimplePrincipal( "some role" ) ); - - return new Group[] { roles }; - } -} \ No newline at end of file