|
1 |
| |
|
2 |
| |
|
3 |
| |
|
4 |
| |
|
5 |
| |
|
6 |
| |
|
7 |
| |
|
8 |
| |
|
9 |
| |
|
10 |
| |
|
11 |
| |
|
12 |
| |
|
13 |
| |
|
14 |
| |
|
15 |
| |
|
16 |
| package org.acegisecurity.providers.x509.populator; |
|
17 |
| |
|
18 |
| import java.security.cert.X509Certificate; |
|
19 |
| |
|
20 |
| import org.acegisecurity.AcegiMessageSource; |
|
21 |
| import org.acegisecurity.AuthenticationException; |
|
22 |
| import org.acegisecurity.BadCredentialsException; |
|
23 |
| import org.acegisecurity.providers.x509.X509AuthoritiesPopulator; |
|
24 |
| import org.acegisecurity.userdetails.UserDetails; |
|
25 |
| import org.acegisecurity.userdetails.UserDetailsService; |
|
26 |
| import org.apache.commons.logging.Log; |
|
27 |
| import org.apache.commons.logging.LogFactory; |
|
28 |
| import org.apache.oro.text.regex.MalformedPatternException; |
|
29 |
| import org.apache.oro.text.regex.MatchResult; |
|
30 |
| import org.apache.oro.text.regex.Pattern; |
|
31 |
| import org.apache.oro.text.regex.PatternMatcher; |
|
32 |
| import org.apache.oro.text.regex.Perl5Compiler; |
|
33 |
| import org.apache.oro.text.regex.Perl5Matcher; |
|
34 |
| import org.springframework.beans.factory.InitializingBean; |
|
35 |
| import org.springframework.context.MessageSource; |
|
36 |
| import org.springframework.context.MessageSourceAware; |
|
37 |
| import org.springframework.context.support.MessageSourceAccessor; |
|
38 |
| import org.springframework.util.Assert; |
|
39 |
| |
|
40 |
| |
|
41 |
| |
|
42 |
| |
|
43 |
| |
|
44 |
| |
|
45 |
| public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, |
|
46 |
| InitializingBean, MessageSourceAware { |
|
47 |
| |
|
48 |
| |
|
49 |
| private static final Log logger = LogFactory.getLog(DaoX509AuthoritiesPopulator.class); |
|
50 |
| |
|
51 |
| |
|
52 |
| |
|
53 |
| private UserDetailsService userDetailsService; |
|
54 |
| protected MessageSourceAccessor messages = AcegiMessageSource.getAccessor(); |
|
55 |
| private Pattern subjectDNPattern; |
|
56 |
| private String subjectDNRegex = "CN=(.*?),"; |
|
57 |
| |
|
58 |
| |
|
59 |
| |
|
60 |
6
| public void afterPropertiesSet() throws Exception {
|
|
61 |
6
| Assert.notNull(userDetailsService, "An authenticationDao must be set");
|
|
62 |
5
| Assert.notNull(this.messages, "A message source must be set");
|
|
63 |
| |
|
64 |
5
| Perl5Compiler compiler = new Perl5Compiler();
|
|
65 |
| |
|
66 |
5
| try {
|
|
67 |
5
| subjectDNPattern = compiler.compile(subjectDNRegex,
|
|
68 |
| Perl5Compiler.READ_ONLY_MASK |
|
69 |
| | Perl5Compiler.CASE_INSENSITIVE_MASK); |
|
70 |
| } catch (MalformedPatternException mpe) { |
|
71 |
1
| throw new IllegalArgumentException("Malformed regular expression: "
|
|
72 |
| + subjectDNRegex); |
|
73 |
| } |
|
74 |
| } |
|
75 |
| |
|
76 |
4
| public UserDetails getUserDetails(X509Certificate clientCert)
|
|
77 |
| throws AuthenticationException { |
|
78 |
4
| String subjectDN = clientCert.getSubjectDN().getName();
|
|
79 |
4
| PatternMatcher matcher = new Perl5Matcher();
|
|
80 |
| |
|
81 |
4
| if (!matcher.contains(subjectDN, subjectDNPattern)) {
|
|
82 |
1
| throw new BadCredentialsException(messages.getMessage(
|
|
83 |
| "DaoX509AuthoritiesPopulator.noMatching", |
|
84 |
| new Object[] {subjectDN}, |
|
85 |
| "No matching pattern was found in subjectDN: {0}")); |
|
86 |
| } |
|
87 |
| |
|
88 |
3
| MatchResult match = matcher.getMatch();
|
|
89 |
| |
|
90 |
3
| if (match.groups() != 2) {
|
|
91 |
1
| throw new IllegalArgumentException(
|
|
92 |
| "Regular expression must contain a single group "); |
|
93 |
| } |
|
94 |
| |
|
95 |
2
| String userName = match.group(1);
|
|
96 |
| |
|
97 |
2
| return this.userDetailsService.loadUserByUsername(userName);
|
|
98 |
| } |
|
99 |
| |
|
100 |
5
| public void setUserDetailsService(UserDetailsService authenticationDao) {
|
|
101 |
5
| this.userDetailsService = authenticationDao;
|
|
102 |
| } |
|
103 |
| |
|
104 |
0
| public void setMessageSource(MessageSource messageSource) {
|
|
105 |
0
| this.messages = new MessageSourceAccessor(messageSource);
|
|
106 |
| } |
|
107 |
| |
|
108 |
| |
|
109 |
| |
|
110 |
| |
|
111 |
| |
|
112 |
| |
|
113 |
| |
|
114 |
| |
|
115 |
| |
|
116 |
| |
|
117 |
| |
|
118 |
| |
|
119 |
| |
|
120 |
| |
|
121 |
| |
|
122 |
| |
|
123 |
| |
|
124 |
4
| public void setSubjectDNRegex(String subjectDNRegex) {
|
|
125 |
4
| this.subjectDNRegex = subjectDNRegex;
|
|
126 |
| } |
|
127 |
| } |