org.knopflerfish.util.http
Class HttpContextAdapter

java.lang.Object
  |
  +--org.knopflerfish.util.http.HttpContextAdapter

All Implemented Interfaces:

HttpContext

public class HttpContextAdapter

extends java.lang.Object

implements HttpContext

The HttpContextAdapter is a utility class that can be used to implement UserAdmin authorization for HTTP server resources. The getResource and getMimeType methods have the "default" implementations, see respective method for details.

A simple use case is when a certain role is required (the remote user must imply the role) for access to a resource. Use an instance of this class as HttpContext, supply the required role in the constructor. Basic HTTP authentication will be used to authenticate the remote user. If the user can be authenticated and is authorized for the supplied role, access to the resource is granted.

In situations where specific implementations of getResource and getMimeType are desired, this class can be used as a base class to simplify the authentication and authorization checks. In the following example, getResource will only be called if the remote user has been authenticated with Basic authentication and is member of the UserAdmin group "mygroup".

 public class MyContext extends HttpContextAdapter {
   public MyContext( BundleContext bc ) {
     super( bc, null );
   }

   public boolean handleSecurity(HttpServletRequest request,
                                 HttpServletResponse response)
   throws IOException
   {
     return authenticate( request, response, BASIC, "mygroup" );
   }

   public URL getResource( String name ) { ... }

   public String getMimeType( String name ) { ... }
 }
 

As another example, a servlet that uses a login servlet at URL "/login/index.shtml" to authenticate the remote user:

 public class MyContext extends HttpContextAdapter {
   public boolean handleSecurity(HttpServletRequest request,
                                 HttpServletResponse response)
   throws IOException
   {
     if (!authenticate( request, response, SERVLET, "mygroup" )) {
       response.sendRedirect( "/login/index.shtml" );
       response.flushBuffer();

       return false;
     }

     return true;
   }
 }
 

Field Summary

static int	BASIC Constants for different types of authentication.
static int	SERVLET Authentication using servlet code.

Fields inherited from interface org.osgi.service.http.HttpContext

AUTHENTICATION_TYPE, AUTHORIZATION, REMOTE_USER

Constructor Summary

HttpContextAdapter(BundleContext b, java.lang.String role)
Constructs a http context with a handleSecurity method that requires that the remote user has been authenticated with basic authentication and is authorized for the specified role.

Method Summary

protected boolean	authenticate(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, int auth_type, java.lang.String role) A convenience method to authenticate the remote user.
java.lang.String	getMimeType(java.lang.String name) Leaves it to the HTTP service to determine MIME type, that is null is returned.
java.net.URL	getResource(java.lang.String name) The bundle associated with the bundle context that the adapter was initialized with is used to fetch the named resource.
boolean	handleSecurity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Performs basic HTTP authentication and checks that the remote user is authorized for the role that this adapter was initalized with.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

BASIC

public static final int BASIC

Constants for different types of authentication. Basic is basic HTTP authentication as described in RFC 2617.

SERVLET

public static final int SERVLET

Authentication using servlet code. For example, a form with user name and password fields is posted to a servlet that performs authentication and sets the corresponding attributes on the session.

Constructor Detail

HttpContextAdapter

public HttpContextAdapter(BundleContext b,
                          java.lang.String role)

Constructs a http context with a handleSecurity method that requires that the remote user has been authenticated with basic authentication and is authorized for the specified role.

Parameters:

b - a bundle context

role - required role, this can be null when subclassing (role is provided in call to authenticate)

Method Detail

handleSecurity

public boolean handleSecurity(javax.servlet.http.HttpServletRequest request,
                              javax.servlet.http.HttpServletResponse response)
                       throws java.io.IOException

Performs basic HTTP authentication and checks that the remote user is authorized for the role that this adapter was initalized with.

Specified by:

handleSecurity in interface HttpContext

Parameters:

request - the request

response - the response

Returns:

true if the remote user has been authenticated and is authorized for the required role

getResource

public java.net.URL getResource(java.lang.String name)

The bundle associated with the bundle context that the adapter was initialized with is used to fetch the named resource.

Specified by:

getResource in interface HttpContext

Parameters:

name - the name of the resource

Returns:

an URL to the specified resource, or null if the resource could not be found

getMimeType

public java.lang.String getMimeType(java.lang.String name)

Leaves it to the HTTP service to determine MIME type, that is null is returned.

Specified by:

getMimeType in interface HttpContext

Parameters:

name - the resource name

Returns:

null

authenticate

protected boolean authenticate(javax.servlet.http.HttpServletRequest request,
                               javax.servlet.http.HttpServletResponse response,
                               int auth_type,
                               java.lang.String role)
                        throws java.io.IOException

A convenience method to authenticate the remote user.

Parameters:

request - the request to authenticate. Will after the call contain AUTHORIZATION (an Authorization object), REMOTE_USER (a String) and AUTHENTICATION_TYPE (also String) if the headers of the request contain the correct information to authenticate the remote user (Basic HTTP authentication) or if the session contained an Authorization object (Servlet), regardless of the remote user being authorized as the specified role or not).

response - for authentication type BASIC: if autentication information from the client is not satisfactory (missing or wrong user/password or user not authorized) the response will be modified to contain the information necessary to require Basic authorization from the client. The realm will be [platform name] + " " + [required role].

For authentication type SERVLET: response will not be modified, it is up the caller to modify the response (if the return value of the call indicate that authentication failed) to contain suitable information, for exampel a "Please log in" page or a redirect to the URL of a login servlet.

auth_type - desired authorization method, can be BASIC or SERVLET. If BASIC, authentication is requested with the Unauthorized response. SERVLET assumes that login is handled by a login servlet that attaches an Authorization object on the session attribute AUTHORIZATION.

role - role that the remote user is required to be authorized as, will be forwarded to the client as realm for the authentication (for auth type BASIC).

Returns:

true if a remote user has been authenticated and is authorized for the specified role, otherwise false.