org.eclipse.scout.rt.server/src/org/eclipse/scout/rt/server/SoapWsseJaasFilter.java - scout/org.eclipse.scout.rt - Git at Google

 /*******************************************************************************
  * Copyright (c) 2010 BSI Business Systems Integration AG.
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * which accompanies this distribution, and is available at
  * http://www.eclipse.org/legal/epl-v10.html
  *
  * Contributors:
  *     BSI Business Systems Integration AG - initial API and implementation
  ******************************************************************************/
 package org.eclipse.scout.rt.server;

 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.security.AccessController;
 import java.security.Principal;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;

 import javax.security.auth.Subject;
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletException;
 import javax.servlet.ServletInputStream;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;
 import javax.servlet.http.HttpServletResponse;
 import javax.xml.namespace.QName;
 import javax.xml.parsers.SAXParserFactory;

 import org.eclipse.scout.commons.Base64Utility;
 import org.eclipse.scout.commons.EncryptionUtility;
 import org.eclipse.scout.commons.SoapHandlingUtility;
 import org.eclipse.scout.commons.logger.IScoutLogger;
 import org.eclipse.scout.commons.logger.ScoutLogManager;
 import org.eclipse.scout.commons.security.SimplePrincipal;
 import org.eclipse.scout.http.servletfilter.FilterConfigInjection;
 import org.eclipse.scout.http.servletfilter.security.SecureHttpServletRequestWrapper;
 import org.eclipse.scout.rt.server.internal.Activator;
 import org.xml.sax.Attributes;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;

 /**
  * Transformation filter used to create a subject based on the soap headers containing a virtual request (from ajax,
  * rap)
  * <p>
  * If there is already a subject set as {@link Subject#getSubject(java.security.AccessControlContext)} then the filter
  * is transparent.
  * <p>
  * Reads the soap wsse header and transforms it to a subject with the user principal. The password is the triple-des
  * encoding of "${timestamp}:${username}" using the config.ini parameter <code>scout.ajax.token.key</code>
  * <p>
  * Normally this filters the alias /ajax
  * <p>
  * This filter is registered in the scout server plugin.xml as /ajax by default with order 1'000'010 and has the active
  * flag set to true
  */
 public class SoapWsseJaasFilter implements Filter {
   private static final IScoutLogger LOG = ScoutLogManager.getLogger(SoapWsseJaasFilter.class);

   private static final byte[] tripleDesKey;
   static {
     String key = Activator.getDefault().getBundle().getBundleContext().getProperty("scout.ajax.token.key");
     if (key == null) {
       tripleDesKey = null;
     }
     else {
       tripleDesKey = new byte[24];
       byte[] keyBytes;
       try {
         keyBytes = key.getBytes("UTF-8");
         System.arraycopy(keyBytes, 0, tripleDesKey, 0, Math.min(keyBytes.length, tripleDesKey.length));
       }
       catch (UnsupportedEncodingException e) {
         LOG.error("reading property 'scout.ajax.token.key'", e);
       }
     }
   }

   private SAXParserFactory m_saxParserFactory;
   private FilterConfigInjection m_injection;

   @Override
   public void init(FilterConfig config0) throws ServletException {
     m_injection = new FilterConfigInjection(config0, getClass());
     try {
       m_saxParserFactory = SoapHandlingUtility.createSaxParserFactory();
     }
     catch (Exception e) {
       throw new ServletException(e);
     }
   }

   @Override
   public void destroy() {
     m_saxParserFactory = null;
     m_injection = null;
   }

   @Override
   public void doFilter(ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException {
     if (isSubjectSet()) {
       chain.doFilter(request, response);
       return;
     }
     FilterConfigInjection.FilterConfig config = m_injection.getConfig(request);
     if (!config.isActive()) {
       chain.doFilter(request, response);
       return;
     }

     InputStream httpIn = request.getInputStream();
     ByteArrayOutputStream cacheOut = new ByteArrayOutputStream();
     Subject subject;
     try {
       subject = parseSubject(httpIn, cacheOut);
     }
     catch (Throwable t) {
       LOG.warn("WS-Security check", t);
       ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
       return;
     }
     final InputStream cacheIn = new ByteArrayInputStream(cacheOut.toByteArray());
     cacheOut = null;
     //
     final HttpServletRequestWrapper replayRequest = new HttpServletRequestWrapper((HttpServletRequest) request) {
       @Override
       public ServletInputStream getInputStream() throws IOException {
         return new ServletInputStream() {
           @Override
           public int read() throws IOException {
             return cacheIn.read();
           }
         };
       }
     };
     continueChainWithPrincipal(subject, replayRequest, (HttpServletResponse) response, chain);
   }

   private void continueChainWithPrincipal(Subject subject, final HttpServletRequest req, final HttpServletResponse res, final FilterChain chain) throws IOException, ServletException {
     try {
       Subject.doAs(
           subject,
           new PrivilegedExceptionAction<Object>() {
             @Override
             public Object run() throws Exception {
               Principal principal = Subject.getSubject(AccessController.getContext()).getPrincipals().iterator().next();
               HttpServletRequest secureReq = new SecureHttpServletRequestWrapper(req, principal);
               chain.doFilter(secureReq, res);
               return null;
             }
           }
           );
     }
     catch (PrivilegedActionException e) {
       Throwable t = e.getCause();
       if (t instanceof IOException) {
         throw (IOException) t;
       }
       else if (t instanceof ServletException) {
         throw (ServletException) t;
       }
       else {
         throw new ServletException(t);
       }
     }
   }

   protected Subject parseSubject(final InputStream httpIn, final ByteArrayOutputStream cacheOut) throws Exception {
     InputStream filterIn = new InputStream() {
       @Override
       public int read() throws IOException {
         int ch = httpIn.read();
         if (ch < 0) {
           return ch;
         }
         cacheOut.write(ch);
         return ch;
       }

       @Override
       public int read(byte[] b) throws IOException {
         int n = httpIn.read(b);
         if (n <= 0) {
           return n;
         }
         cacheOut.write(b, 0, n);
         return n;
       }

       @Override
       public int read(byte[] b, int off, int len) throws IOException {
         int n = httpIn.read(b, off, len);
         if (n <= 0) {
           return n;
         }
         cacheOut.write(b, off, n);
         return n;
       }
     };
     WSSEUserTokenHandler handler = new WSSEUserTokenHandler();
     SoapHandlingUtility.createSaxParser(m_saxParserFactory).parse(new InputSource(filterIn), handler);
     return createSubject(cleanString(handler.user), cleanString(handler.tokenRaw), cleanString(handler.tokenEncoding));
   }

   /**
    * override this method to do additional checks on credentials
    */
   protected Subject createSubject(String user, String tokenRaw, String tokenEncoding) throws Exception {
     if (user == null || tokenRaw == null) {
       LOG.error("Ajax back-end call contains no ws-security token. Check if the config.ini of the /rap and the /ajax webapp contains the property 'scout.ajax.token.key'.");
       throw new SecurityException("SOAP header contains no ws-security token");
     }
     byte[] token = Base64Utility.decode(tokenRaw);
     String msg = new String(EncryptionUtility.decrypt(token, tripleDesKey), "UTF-8");
     String[] tupel = msg.split(":", 2);
     long timestamp = Long.parseLong(tupel[0]);
     String userRef = tupel[1];
     if (timestamp < 0L || userRef == null || !userRef.equals(user)) {
       throw new SecurityException("SOAP header contains no ws-security token");
     }
     Subject subject = new Subject();
     subject.getPrincipals().add(new SimplePrincipal(user));
     subject.setReadOnly();
     return subject;
   }

   private boolean isSubjectSet() {
     Subject subject = Subject.getSubject(AccessController.getContext());
     if (subject == null) {
       return false;
     }
     if (subject.getPrincipals().size() == 0) {
       return false;
     }
     String name = subject.getPrincipals().iterator().next().getName();
     if (name == null || name.trim().length() == 0) {
       return false;
     }
     return true;
   }

   private String cleanString(String s) {
     if (s == null) {
       return null;
     }
     s = s.trim();
     if (s.length() == 0) {
       return null;
     }
     if (s.equalsIgnoreCase("null")) {
       return null;
     }
     return s;
   }

   /**
    * <pre>
    * <wsse:Security soapenv:mustUnderstand="1">
    *   <wsse:UsernameToken>
    *     <wsse:Username>user</wsse:Username>
    *     <wsse:Password Type="http://...#Virtual">QDgxVkqYnuqk...==</wsse:Password>
    *   </wsse:UsernameToken>
    * </wsse:Security>
    * </pre>
    */
   private static class WSSEUserTokenHandler extends DefaultHandler {
     public String user;
     public String tokenEncoding;
     public String tokenRaw;
     //
     private boolean insideEnvelope;
     private boolean insideHeader;
     private boolean insideSecurity;
     private boolean insideUsernameToken;
     private boolean insideUsername;
     private boolean insidePasswort;
     private boolean done;

     @Override
     public void startElement(String namespaceURI, String localName, String qNameText, Attributes attributes) throws SAXException {
       if (done) {
         return;
       }
       QName qname = new QName(namespaceURI, localName);
       if (SoapHandlingUtility.SOAPENV_ENVELOPE_ELEMENT.equals(qname)) {
         insideEnvelope = true;
         return;
       }
       if (SoapHandlingUtility.SOAPENV_HEADER_ELEMENT.equals(qname)) {
         insideHeader = true;
         return;
       }
       if (SoapHandlingUtility.WSSE_SECURITY_ELEMENT.equals(qname)) {
         insideSecurity = true;
         return;
       }
       if (SoapHandlingUtility.WSSE_USERNAME_TOKEN_ELEMENT.equals(qname)) {
         insideUsernameToken = true;
         return;
       }
       if (SoapHandlingUtility.WSSE_USERNAME_ELEMENT.equals(qname)) {
         insideUsername = true;
         return;
       }
       if (SoapHandlingUtility.WSSE_PASSWORD_ELEMENT.equals(qname)) {
         insidePasswort = true;
         tokenEncoding = attributes.getValue("", SoapHandlingUtility.WSSE_PASSWORD_TYPE_ATTRIBUTE);
         return;
       }
     }

     @Override
     public void characters(char[] ch, int start, int length) throws SAXException {
       if (done) {
         return;
       }
       if (insideEnvelope && insideHeader && insideSecurity && insideUsernameToken) {
         if (insideUsername) {
           user = new String(ch, start, length);
         }
         if (insidePasswort) {
           tokenRaw = new String(ch, start, length);
         }
       }

     }

     @Override
     public void endElement(String namespaceURI, String localName, String qNameText) throws SAXException {
       if (done) {
         return;
       }
       QName qname = new QName(namespaceURI, localName);
       if (SoapHandlingUtility.SOAPENV_ENVELOPE_ELEMENT.equals(qname)) {
         insideEnvelope = false;
         done = true;
         return;
       }
       if (SoapHandlingUtility.SOAPENV_HEADER_ELEMENT.equals(qname)) {
         insideHeader = false;
         return;
       }
       if (SoapHandlingUtility.WSSE_SECURITY_ELEMENT.equals(qname)) {
         insideSecurity = false;
         return;
       }
       if (SoapHandlingUtility.WSSE_USERNAME_TOKEN_ELEMENT.equals(qname)) {
         insideUsernameToken = false;
         return;
       }
       if (SoapHandlingUtility.WSSE_USERNAME_ELEMENT.equals(qname)) {
         insideUsername = false;
         return;
       }
       if (SoapHandlingUtility.WSSE_PASSWORD_ELEMENT.equals(qname)) {
         insidePasswort = false;
         return;
       }
     }
   }
 }
	/*******************************************************************************
	* Copyright (c) 2010 BSI Business Systems Integration AG.
	* All rights reserved. This program and the accompanying materials
	* are made available under the terms of the Eclipse Public License v1.0
	* which accompanies this distribution, and is available at
	* http://www.eclipse.org/legal/epl-v10.html
	*
	* Contributors:
	* BSI Business Systems Integration AG - initial API and implementation
	******************************************************************************/
	package org.eclipse.scout.rt.server;

	import java.io.ByteArrayInputStream;
	import java.io.ByteArrayOutputStream;
	import java.io.IOException;
	import java.io.InputStream;
	import java.io.UnsupportedEncodingException;
	import java.security.AccessController;
	import java.security.Principal;
	import java.security.PrivilegedActionException;
	import java.security.PrivilegedExceptionAction;

	import javax.security.auth.Subject;
	import javax.servlet.Filter;
	import javax.servlet.FilterChain;
	import javax.servlet.FilterConfig;
	import javax.servlet.ServletException;
	import javax.servlet.ServletInputStream;
	import javax.servlet.ServletRequest;
	import javax.servlet.ServletResponse;
	import javax.servlet.http.HttpServletRequest;
	import javax.servlet.http.HttpServletRequestWrapper;
	import javax.servlet.http.HttpServletResponse;
	import javax.xml.namespace.QName;
	import javax.xml.parsers.SAXParserFactory;

	import org.eclipse.scout.commons.Base64Utility;
	import org.eclipse.scout.commons.EncryptionUtility;
	import org.eclipse.scout.commons.SoapHandlingUtility;
	import org.eclipse.scout.commons.logger.IScoutLogger;
	import org.eclipse.scout.commons.logger.ScoutLogManager;
	import org.eclipse.scout.commons.security.SimplePrincipal;
	import org.eclipse.scout.http.servletfilter.FilterConfigInjection;
	import org.eclipse.scout.http.servletfilter.security.SecureHttpServletRequestWrapper;
	import org.eclipse.scout.rt.server.internal.Activator;
	import org.xml.sax.Attributes;
	import org.xml.sax.InputSource;
	import org.xml.sax.SAXException;
	import org.xml.sax.helpers.DefaultHandler;

	/**
	* Transformation filter used to create a subject based on the soap headers containing a virtual request (from ajax,
	* rap)
	* <p>
	* If there is already a subject set as {@link Subject#getSubject(java.security.AccessControlContext)} then the filter
	* is transparent.
	* <p>
	* Reads the soap wsse header and transforms it to a subject with the user principal. The password is the triple-des
	* encoding of "${timestamp}:${username}" using the config.ini parameter <code>scout.ajax.token.key</code>
	* <p>
	* Normally this filters the alias /ajax
	* <p>
	* This filter is registered in the scout server plugin.xml as /ajax by default with order 1'000'010 and has the active
	* flag set to true
	*/
	public class SoapWsseJaasFilter implements Filter {
	private static final IScoutLogger LOG = ScoutLogManager.getLogger(SoapWsseJaasFilter.class);

	private static final byte[] tripleDesKey;
	static {
	String key = Activator.getDefault().getBundle().getBundleContext().getProperty("scout.ajax.token.key");
	if (key == null) {
	tripleDesKey = null;
	}
	else {
	tripleDesKey = new byte[24];
	byte[] keyBytes;
	try {
	keyBytes = key.getBytes("UTF-8");
	System.arraycopy(keyBytes, 0, tripleDesKey, 0, Math.min(keyBytes.length, tripleDesKey.length));
	}
	catch (UnsupportedEncodingException e) {
	LOG.error("reading property 'scout.ajax.token.key'", e);
	}
	}
	}

	private SAXParserFactory m_saxParserFactory;
	private FilterConfigInjection m_injection;

	@Override
	public void init(FilterConfig config0) throws ServletException {
	m_injection = new FilterConfigInjection(config0, getClass());
	try {
	m_saxParserFactory = SoapHandlingUtility.createSaxParserFactory();
	}
	catch (Exception e) {
	throw new ServletException(e);
	}
	}

	@Override
	public void destroy() {
	m_saxParserFactory = null;
	m_injection = null;
	}

	@Override
	public void doFilter(ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException {
	if (isSubjectSet()) {
	chain.doFilter(request, response);
	return;
	}
	FilterConfigInjection.FilterConfig config = m_injection.getConfig(request);
	if (!config.isActive()) {
	chain.doFilter(request, response);
	return;
	}

	InputStream httpIn = request.getInputStream();
	ByteArrayOutputStream cacheOut = new ByteArrayOutputStream();
	Subject subject;
	try {
	subject = parseSubject(httpIn, cacheOut);
	}
	catch (Throwable t) {
	LOG.warn("WS-Security check", t);
	((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
	return;
	}
	final InputStream cacheIn = new ByteArrayInputStream(cacheOut.toByteArray());
	cacheOut = null;
	//
	final HttpServletRequestWrapper replayRequest = new HttpServletRequestWrapper((HttpServletRequest) request) {
	@Override
	public ServletInputStream getInputStream() throws IOException {
	return new ServletInputStream() {
	@Override
	public int read() throws IOException {
	return cacheIn.read();
	}
	};
	}
	};
	continueChainWithPrincipal(subject, replayRequest, (HttpServletResponse) response, chain);
	}

	private void continueChainWithPrincipal(Subject subject, final HttpServletRequest req, final HttpServletResponse res, final FilterChain chain) throws IOException, ServletException {
	try {
	Subject.doAs(
	subject,
	new PrivilegedExceptionAction<Object>() {
	@Override
	public Object run() throws Exception {
	Principal principal = Subject.getSubject(AccessController.getContext()).getPrincipals().iterator().next();
	HttpServletRequest secureReq = new SecureHttpServletRequestWrapper(req, principal);
	chain.doFilter(secureReq, res);
	return null;
	}
	}
	);
	}
	catch (PrivilegedActionException e) {
	Throwable t = e.getCause();
	if (t instanceof IOException) {
	throw (IOException) t;
	}
	else if (t instanceof ServletException) {
	throw (ServletException) t;
	}
	else {
	throw new ServletException(t);
	}
	}
	}

	protected Subject parseSubject(final InputStream httpIn, final ByteArrayOutputStream cacheOut) throws Exception {
	InputStream filterIn = new InputStream() {
	@Override
	public int read() throws IOException {
	int ch = httpIn.read();
	if (ch < 0) {
	return ch;
	}
	cacheOut.write(ch);
	return ch;
	}

	@Override
	public int read(byte[] b) throws IOException {
	int n = httpIn.read(b);
	if (n <= 0) {
	return n;
	}
	cacheOut.write(b, 0, n);
	return n;
	}

	@Override
	public int read(byte[] b, int off, int len) throws IOException {
	int n = httpIn.read(b, off, len);
	if (n <= 0) {
	return n;
	}
	cacheOut.write(b, off, n);
	return n;
	}
	};
	WSSEUserTokenHandler handler = new WSSEUserTokenHandler();
	SoapHandlingUtility.createSaxParser(m_saxParserFactory).parse(new InputSource(filterIn), handler);
	return createSubject(cleanString(handler.user), cleanString(handler.tokenRaw), cleanString(handler.tokenEncoding));
	}

	/**
	* override this method to do additional checks on credentials
	*/
	protected Subject createSubject(String user, String tokenRaw, String tokenEncoding) throws Exception {
	if (user == null \|\| tokenRaw == null) {
	LOG.error("Ajax back-end call contains no ws-security token. Check if the config.ini of the /rap and the /ajax webapp contains the property 'scout.ajax.token.key'.");
	throw new SecurityException("SOAP header contains no ws-security token");
	}
	byte[] token = Base64Utility.decode(tokenRaw);
	String msg = new String(EncryptionUtility.decrypt(token, tripleDesKey), "UTF-8");
	String[] tupel = msg.split(":", 2);
	long timestamp = Long.parseLong(tupel[0]);
	String userRef = tupel[1];
	if (timestamp < 0L \|\| userRef == null \|\| !userRef.equals(user)) {
	throw new SecurityException("SOAP header contains no ws-security token");
	}
	Subject subject = new Subject();
	subject.getPrincipals().add(new SimplePrincipal(user));
	subject.setReadOnly();
	return subject;
	}

	private boolean isSubjectSet() {
	Subject subject = Subject.getSubject(AccessController.getContext());
	if (subject == null) {
	return false;
	}
	if (subject.getPrincipals().size() == 0) {
	return false;
	}
	String name = subject.getPrincipals().iterator().next().getName();
	if (name == null \|\| name.trim().length() == 0) {
	return false;
	}
	return true;
	}

	private String cleanString(String s) {
	if (s == null) {
	return null;
	}
	s = s.trim();
	if (s.length() == 0) {
	return null;
	}
	if (s.equalsIgnoreCase("null")) {
	return null;
	}
	return s;
	}

	/**
	* <pre>
	* <wsse:Security soapenv:mustUnderstand="1">
	* <wsse:UsernameToken>
	* <wsse:Username>user</wsse:Username>
	* <wsse:Password Type="http://...#Virtual">QDgxVkqYnuqk...==</wsse:Password>
	* </wsse:UsernameToken>
	* </wsse:Security>
	* </pre>
	*/
	private static class WSSEUserTokenHandler extends DefaultHandler {
	public String user;
	public String tokenEncoding;
	public String tokenRaw;
	//
	private boolean insideEnvelope;
	private boolean insideHeader;
	private boolean insideSecurity;
	private boolean insideUsernameToken;
	private boolean insideUsername;
	private boolean insidePasswort;
	private boolean done;

	@Override
	public void startElement(String namespaceURI, String localName, String qNameText, Attributes attributes) throws SAXException {
	if (done) {
	return;
	}
	QName qname = new QName(namespaceURI, localName);
	if (SoapHandlingUtility.SOAPENV_ENVELOPE_ELEMENT.equals(qname)) {
	insideEnvelope = true;
	return;
	}
	if (SoapHandlingUtility.SOAPENV_HEADER_ELEMENT.equals(qname)) {
	insideHeader = true;
	return;
	}
	if (SoapHandlingUtility.WSSE_SECURITY_ELEMENT.equals(qname)) {
	insideSecurity = true;
	return;
	}
	if (SoapHandlingUtility.WSSE_USERNAME_TOKEN_ELEMENT.equals(qname)) {
	insideUsernameToken = true;
	return;
	}
	if (SoapHandlingUtility.WSSE_USERNAME_ELEMENT.equals(qname)) {
	insideUsername = true;
	return;
	}
	if (SoapHandlingUtility.WSSE_PASSWORD_ELEMENT.equals(qname)) {
	insidePasswort = true;
	tokenEncoding = attributes.getValue("", SoapHandlingUtility.WSSE_PASSWORD_TYPE_ATTRIBUTE);
	return;
	}
	}

	@Override
	public void characters(char[] ch, int start, int length) throws SAXException {
	if (done) {
	return;
	}
	if (insideEnvelope && insideHeader && insideSecurity && insideUsernameToken) {
	if (insideUsername) {
	user = new String(ch, start, length);
	}
	if (insidePasswort) {
	tokenRaw = new String(ch, start, length);
	}
	}

	}

	@Override
	public void endElement(String namespaceURI, String localName, String qNameText) throws SAXException {
	if (done) {
	return;
	}
	QName qname = new QName(namespaceURI, localName);
	if (SoapHandlingUtility.SOAPENV_ENVELOPE_ELEMENT.equals(qname)) {
	insideEnvelope = false;
	done = true;
	return;
	}
	if (SoapHandlingUtility.SOAPENV_HEADER_ELEMENT.equals(qname)) {
	insideHeader = false;
	return;
	}
	if (SoapHandlingUtility.WSSE_SECURITY_ELEMENT.equals(qname)) {
	insideSecurity = false;
	return;
	}
	if (SoapHandlingUtility.WSSE_USERNAME_TOKEN_ELEMENT.equals(qname)) {
	insideUsernameToken = false;
	return;
	}
	if (SoapHandlingUtility.WSSE_USERNAME_ELEMENT.equals(qname)) {
	insideUsername = false;
	return;
	}
	if (SoapHandlingUtility.WSSE_PASSWORD_ELEMENT.equals(qname)) {
	insidePasswort = false;
	return;
	}
	}
	}
	}