public abstract class RealmBase extends LifecycleMBeanBase implements GSSRealm
| Modifier and Type | Class and Description |
|---|---|
protected static class |
RealmBase.AllRolesMode |
Lifecycle.SingleUse| Modifier and Type | Field and Description |
|---|---|
protected RealmBase.AllRolesMode |
allRolesMode
The all role mode.
|
protected Container |
container
The Container with which this Realm is associated.
|
protected Log |
containerLog
Container log
|
protected String |
realmPath |
protected static StringManager |
sm
The string manager for this package.
|
protected boolean |
stripRealmForGss
When processing users authenticated via the GSS-API, should any
"@...
|
protected PropertyChangeSupport |
support
The property change support for this component.
|
protected boolean |
validate
Should we validate client certificate chains when they are presented?
|
protected X509UsernameRetriever |
x509UsernameRetriever
The object that will extract user names from X509 client certificates.
|
protected String |
x509UsernameRetrieverClassName
The name of the class to use for retrieving user names from X509
certificates.
|
mserverAFTER_DESTROY_EVENT, AFTER_INIT_EVENT, AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_DESTROY_EVENT, BEFORE_INIT_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, CONFIGURE_START_EVENT, CONFIGURE_STOP_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT| Constructor and Description |
|---|
RealmBase() |
| Modifier and Type | Method and Description |
|---|---|
void |
addPropertyChangeListener(PropertyChangeListener listener)
Add a property change listener to this component.
|
Principal |
authenticate(GSSContext gssContext,
boolean storeCred)
Try to authenticate using a
GSSContext |
Principal |
authenticate(GSSName gssName,
GSSCredential gssCredential)
Try to authenticate using a
GSSName |
Principal |
authenticate(String username)
Return the Principal associated with the specified username, if there
is one; otherwise return
null. |
Principal |
authenticate(String username,
String credentials)
Return the Principal associated with the specified username and
credentials, if there is one; otherwise return
null. |
Principal |
authenticate(String username,
String clientDigest,
String nonce,
String nc,
String cnonce,
String qop,
String realm,
String md5a2)
Try to authenticate with the specified username, which
matches the digest calculated using the given parameters using the
method described in RFC 2617 (which is a superset of RFC 2069).
|
Principal |
authenticate(X509Certificate[] certs)
Return the Principal associated with the specified chain of X509
client certificates.
|
void |
backgroundProcess()
Execute a periodic task, such as reloading, etc.
|
static String |
Digest(String credentials,
String algorithm,
String encoding)
Deprecated.
Unused. This will be removed in Tomcat 9.
|
SecurityConstraint[] |
findSecurityConstraints(Request request,
Context context)
Return the SecurityConstraints configured to guard the request URI for
this request, or
null if there is no such constraint. |
String |
getAllRolesMode()
Return the all roles mode.
|
Container |
getContainer()
Return the Container with which this Realm has been associated.
|
CredentialHandler |
getCredentialHandler() |
protected String |
getDigest(String username,
String realmName)
Return the digest associated with given principal's user name.
|
String |
getDomainInternal()
Method implemented by sub-classes to identify the domain in which MBeans
should be registered.
|
protected abstract String |
getName()
Deprecated.
This will be removed in Tomcat 9 onwards. Use
Class.getSimpleName() instead. |
String |
getObjectNameKeyProperties()
Allow sub-classes to specify the key properties component of the
ObjectName that will be used to register this component. |
protected abstract String |
getPassword(String username)
Get the password for the specified user.
|
protected Principal |
getPrincipal(GSSName gssName,
GSSCredential gssCredential)
Get the principal associated with the specified
GSSName. |
protected abstract Principal |
getPrincipal(String username)
Get the principal associated with the specified user.
|
protected Principal |
getPrincipal(String username,
GSSCredential gssCredential)
Deprecated.
This will be removed in Tomcat 10 onwards. Use
getPrincipal(GSSName, GSSCredential) instead. |
protected Principal |
getPrincipal(X509Certificate usercert)
Get the principal associated with the specified certificate.
|
String |
getRealmPath() |
protected String |
getRealmSuffix() |
String[] |
getRoles(Principal principal)
Return roles associated with given principal
|
protected Server |
getServer()
Return the Server object that is the ultimate parent for the container
with which this Realm is associated.
|
int |
getTransportGuaranteeRedirectStatus() |
boolean |
getValidate()
Return the "validate certificate chains" flag.
|
String |
getX509UsernameRetrieverClassName()
Gets the name of the class that will be used to extract user names
from X509 client certificates.
|
protected boolean |
hasMessageDigest() |
boolean |
hasResourcePermission(Request request,
Response response,
SecurityConstraint[] constraints,
Context context)
Perform access control based on the specified authorization constraint.
|
boolean |
hasRole(Wrapper wrapper,
Principal principal,
String role)
Check if the specified Principal has the specified
security role, within the context of this Realm.
|
protected boolean |
hasRoleInternal(Principal principal,
String role)
Check if the specified Principal has the specified
security role, within the context of this Realm.
|
boolean |
hasUserDataPermission(Request request,
Response response,
SecurityConstraint[] constraints)
Enforce any user data constraint required by the security constraint
guarding this request URI.
|
protected void |
initInternal()
Sub-classes wishing to perform additional initialization should override
this method, ensuring that super.initInternal() is the first call in the
overriding method.
|
boolean |
isAvailable()
Return the availability of the realm for authentication.
|
boolean |
isStripRealmForGss() |
static void |
main(String[] args)
Generate a stored credential string for the given password and associated
parameters.
|
void |
removePropertyChangeListener(PropertyChangeListener listener)
Remove a property change listener from this component.
|
void |
setAllRolesMode(String allRolesMode)
Set the all roles mode.
|
void |
setContainer(Container container)
Set the Container with which this Realm has been associated.
|
void |
setCredentialHandler(CredentialHandler credentialHandler)
Set the CredentialHandler to be used by this Realm.
|
void |
setRealmPath(String theRealmPath) |
void |
setStripRealmForGss(boolean stripRealmForGss) |
void |
setTransportGuaranteeRedirectStatus(int transportGuaranteeRedirectStatus)
Set the HTTP status code used when the container needs to issue an HTTP
redirect to meet the requirements of a configured transport guarantee.
|
void |
setValidate(boolean validate)
Set the "validate certificate chains" flag.
|
void |
setX509UsernameRetrieverClassName(String className)
Sets the name of the class that will be used to extract user names
from X509 client certificates.
|
protected void |
startInternal()
Prepare for the beginning of active use of the public methods of this
component and implement the requirements of
LifecycleBase.startInternal(). |
protected void |
stopInternal()
Gracefully terminate the active use of the public methods of this
component and implement the requirements of
LifecycleBase.stopInternal(). |
String |
toString()
Return a String representation of this component.
|
destroyInternal, getDomain, getObjectName, postDeregister, postRegister, preDeregister, preRegister, register, setDomain, unregisteraddLifecycleListener, destroy, findLifecycleListeners, fireLifecycleEvent, getState, getStateName, getThrowOnFailure, init, removeLifecycleListener, setState, setState, setThrowOnFailure, start, stopprotected Container container
protected Log containerLog
protected static final StringManager sm
protected final PropertyChangeSupport support
protected boolean validate
protected String x509UsernameRetrieverClassName
protected X509UsernameRetriever x509UsernameRetriever
protected RealmBase.AllRolesMode allRolesMode
protected boolean stripRealmForGss
protected String realmPath
public int getTransportGuaranteeRedirectStatus()
public void setTransportGuaranteeRedirectStatus(int transportGuaranteeRedirectStatus)
transportGuaranteeRedirectStatus - The status to use. This value is
not validatedpublic CredentialHandler getCredentialHandler()
getCredentialHandler in interface Realmpublic void setCredentialHandler(CredentialHandler credentialHandler)
RealmsetCredentialHandler in interface RealmcredentialHandler - the CredentialHandler to usepublic Container getContainer()
getContainer in interface Realmpublic void setContainer(Container container)
setContainer in interface Realmcontainer - The associated Containerpublic String getAllRolesMode()
public void setAllRolesMode(String allRolesMode)
allRolesMode - A string representation of the new all roles modepublic boolean getValidate()
public void setValidate(boolean validate)
validate - The new validate certificate chains flagpublic String getX509UsernameRetrieverClassName()
public void setX509UsernameRetrieverClassName(String className)
className - The name of the class that will be used to extract user names
from X509 client certificates.X509UsernameRetrieverpublic boolean isStripRealmForGss()
public void setStripRealmForGss(boolean stripRealmForGss)
public void addPropertyChangeListener(PropertyChangeListener listener)
addPropertyChangeListener in interface Realmlistener - The listener to addpublic Principal authenticate(String username)
null.authenticate in interface Realmusername - Username of the Principal to look upnull if none is
associated.public Principal authenticate(String username, String credentials)
null.authenticate in interface Realmusername - Username of the Principal to look upcredentials - Password or other credentials to use in
authenticating this usernamenull if there is none.public Principal authenticate(String username, String clientDigest, String nonce, String nc, String cnonce, String qop, String realm, String md5a2)
authenticate in interface Realmusername - Username of the Principal to look upclientDigest - Digest which has been submitted by the clientnonce - Unique (or supposedly unique) token which has been used
for this requestnc - the nonce countercnonce - the client chosen nonceqop - the "quality of protection" (nc and cnonce
will only be used, if qop is not null).realm - Realm namemd5a2 - Second MD5 digest used to calculate the digest :
MD5(Method + ":" + uri)null if there is none.public Principal authenticate(X509Certificate[] certs)
null.authenticate in interface Realmcerts - Array of client certificates, with the first one in
the array being the certificate of the client itself.null if there is nonepublic Principal authenticate(GSSContext gssContext, boolean storeCred)
GSSContextauthenticate in interface RealmgssContext - The gssContext processed by the Authenticator.storeCred - Should the realm attempt to store the delegated
credentials in the returned Principal?null if there is nonepublic Principal authenticate(GSSName gssName, GSSCredential gssCredential)
GSSNameauthenticate in interface GSSRealmgssName - The GSSName of the principal to look upgssCredential - The GSSCredential of the principal, may be
nullnull if there is nonepublic void backgroundProcess()
backgroundProcess in interface Realmpublic SecurityConstraint[] findSecurityConstraints(Request request, Context context)
null if there is no such constraint.findSecurityConstraints in interface Realmrequest - Request we are processingcontext - Context the Request is mapped toSecurityConstraint, of null
if there is nonepublic boolean hasResourcePermission(Request request, Response response, SecurityConstraint[] constraints, Context context) throws IOException
true if this constraint is satisfied and processing
should continue, or false otherwise.hasResourcePermission in interface Realmrequest - Request we are processingresponse - Response we are creatingconstraints - Security constraint we are enforcingcontext - The Context to which client of this class is attached.true if this constraint is satisfied and processing
should continue, or false otherwiseIOException - if an input/output error occurspublic boolean hasRole(Wrapper wrapper, Principal principal, String role)
hasRoleInternal(Principal,
String) can be overridden by Realm implementations, but the default is
adequate when an instance of GenericPrincipal is used to
represent authenticated Principals from this Realm.hasRole in interface Realmwrapper - wrapper context for evaluating roleprincipal - Principal for whom the role is to be checkedrole - Security role to be checkedtrue if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false.protected boolean hasRoleInternal(Principal principal, String role)
hasRoleInternal(Principal,
String) can be overridden by Realm implementations, but the default is
adequate when an instance of GenericPrincipal is used to
represent authenticated Principals from this Realm.principal - Principal for whom the role is to be checkedrole - Security role to be checkedtrue if the specified Principal has the specified
security role, within the context of this Realm; otherwise return
false.public boolean hasUserDataPermission(Request request, Response response, SecurityConstraint[] constraints) throws IOException
true if this constraint
was not violated and processing should continue, or false
if we have created a response already.hasUserDataPermission in interface Realmrequest - Request we are processingresponse - Response we are creatingconstraints - Security constraint being checkedtrue if this constraint
was not violated and processing should continue, or false
if we have created a response already.IOException - if an input/output error occurspublic void removePropertyChangeListener(PropertyChangeListener listener)
removePropertyChangeListener in interface Realmlistener - The listener to removepublic boolean isAvailable()
RealmisAvailable in interface Realmtrue if the realm is able to perform authenticationprotected void initInternal()
throws LifecycleException
LifecycleMBeanBaseinitInternal in class LifecycleMBeanBaseLifecycleException - If the initialisation failsprotected void startInternal()
throws LifecycleException
LifecycleBase.startInternal().startInternal in class LifecycleBaseLifecycleException - if this component detects a fatal error
that prevents this component from being usedprotected void stopInternal()
throws LifecycleException
LifecycleBase.stopInternal().stopInternal in class LifecycleBaseLifecycleException - if this component detects a fatal error
that needs to be reportedpublic String toString()
protected boolean hasMessageDigest()
protected String getDigest(String username, String realmName)
username - the user namerealmName - the realm name@Deprecated protected abstract String getName()
Class.getSimpleName() instead.protected abstract String getPassword(String username)
username - The user nameprotected Principal getPrincipal(X509Certificate usercert)
usercert - The user certificateprotected abstract Principal getPrincipal(String username)
username - The user name@Deprecated protected Principal getPrincipal(String username, GSSCredential gssCredential)
getPrincipal(GSSName, GSSCredential) instead.username - The user namegssCredential - the GSS credential of the principalprotected Principal getPrincipal(GSSName gssName, GSSCredential gssCredential)
GSSName.gssName - The GSS namegssCredential - the GSS credential of the principalprotected Server getServer()
null is
returned.@Deprecated public static final String Digest(String credentials, String algorithm, String encoding)
credentials - Password or other credentials to use in authenticating
this usernamealgorithm - Algorithm used to do the digestencoding - Character encoding of the string to digestpublic static void main(String[] args)
The following parameters are supported:
Charset.defaultCharset()) will
be used.This generation process currently supports the following CredentialHandlers, the correct one being selected based on the algorithm specified:
args - The parameters passed on the command linepublic String getObjectNameKeyProperties()
LifecycleMBeanBaseObjectName that will be used to register this component.getObjectNameKeyProperties in class LifecycleMBeanBaseObjectNamepublic String getDomainInternal()
LifecycleMBeanBasegetDomainInternal in class LifecycleMBeanBasepublic String getRealmPath()
public void setRealmPath(String theRealmPath)
protected String getRealmSuffix()
Copyright © 2000-2021 Apache Software Foundation. All Rights Reserved.