/*
* See if this prefix matches one of the roles
*/
Handler handler = null; // the handler for this url
String role = null; // the role for this url
Enumeration keys = proxies.keys();
while(keys.hasMoreElements()) {
String key = (String) keys.nextElement();
if (request.url.startsWith(key)) {
RoleData data = (RoleData) proxies.get(key);
handler = data.handler;
role = data.role;
break;
}
}
if (role == null) {
request.log(Server.LOG_DIAGNOSTIC," No prefix match for: " +
request.url);
request.sendError(400, "Not found", "No matching role");
return true;
}
/*
* Set a browser cookie, if it doesn't exist
*/
if (cookieValue == null) {
do {
cookieValue = Guid.getString();
} while (cookieValue.length() < 14);
cookieValue = cookieValue.substring(0,14);
request.log(Server.LOG_DIAGNOSTIC," New cookie: " + cookieValue);
request.addHeader("Set-Cookie", cookieName + "=" + cookieValue
+ "; path=" + UrlPrefix);
}
request.props.put("challenge", cookieValue);
/*
* No token, Send client the login page. Then the request should
* be re-issued by the client with the credentials in the query data.
*/
if (!Token.haveToken(cookieValue)) {
Token.getToken(cookieValue); // create a blank token
returnLogin(request, "");
return true;
}
Token token = Token.getToken(cookieValue);
/*
* Have an empty token, Call the STS handler to get the
* proper credentials. The client card data should be
* in the query data. Make sure we add the challenge to the
* query data.
*
* XXX Technicaly this is incorrect. We need to generate our own request object, instead of
* trying to pervert the original one.
*/
if (token.getId() == null) {
String save = request.url;
request.url = authUrl;
if (request.query.length() > 0) {
request.query += "&random=" + cookieValue;
} else {
request.query = "random=" + cookieValue;
}
request.log(Server.LOG_DIAGNOSTIC,
" About to call token handler: " + authUrl
+ " query: " + request.query
+ " params: " + request.getQueryData(null)
+ " post: " + request.postData
+ " headers: " + request.headers
+ " request.method:" + request.method );
boolean ok = tokenHandler.respond(request);
request.log(Server.LOG_DIAGNOSTIC, " result " + ok + " (" +
request.props + ")");
request.url = save;
/*
* at this point we should have the credentials in the request.
* If not - return to the login page.
* If so, remember the credentials in our token object.
*/
String id = (String) request.props.get(idKey);
String error = request.props.getProperty("error", "unknown");
if (id == null) {
request.log(Server.LOG_DIAGNOSTIC, " Can't find: " +
idKey + " in request data");
returnLogin(request, "No token id found in request data: " +
error.substring(error.lastIndexOf(":")+1));
return true;
}
String roles = (String) request.props.get(roleKey);
if (roles == null) {
request.log(Server.LOG_DIAGNOSTIC, " Can't find: " +
roleKey + " in request data");
returnLogin(request, "No roles available for id " + id);
return true;
}
token.setToken(id, roles);
/*
* Strip off the query data used for token validation.
* This should restore the query info that was presented as
* part of the original request.
*/
// request.query="";
}
/*
* Have a token, make sure its still valid. If so, call the
* proper handler, otherwise redirect to the login page with
* the appropriate error message. We should remember the URL,
* so we can redirect back here when reauthentication is complete.
*/
if (token.getAge() > maxAge || token.getIdle() > maxIdle ||
token.getUses() > maxUses) {
String message;
if (token.getAge() > maxAge) {
message = "Session is too old";
} else if (token.getIdle() > maxIdle) {
message = "Session was idle too long";
} else {
message = "Session was used up";
}
Token.removeToken(cookieValue);
returnLogin(request, message);
return true;
}
request.log(Server.LOG_DIAGNOSTIC, "Credentials check: " +
" age=" + token.getAge() +
" idle=" + token.getIdle() +
" uses=" + token.getUses());
/*
* Now check the url against the list of allowed roles
*/
Vector valid = token.getRoles();
if (valid.contains(role)) {
if (handler != null) {
request.log(Server.LOG_DIAGNOSTIC, " dispatching to proxy " + role);
return handler.respond(request);
} else {
request.log(Server.LOG_DIAGNOSTIC, " dispatching next handler");
return false;
}
} else {