Package org.eclipse.jetty.security.authentication

Class DigestAuthenticator

java.lang.Object

org.eclipse.jetty.security.authentication.LoginAuthenticator

org.eclipse.jetty.security.authentication.DigestAuthenticator

All Implemented Interfaces:

Authenticator

public class DigestAuthenticator
extends LoginAuthenticator

The nonce max age in ms can be set with the SecurityHandler.setInitParameter(String, String) using the name "maxNonceAge". The nonce max count can be set with SecurityHandler.setInitParameter(String, String) using the name "maxNonceCount". When the age or count is exceeded, the nonce is considered stale.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static class	DigestAuthenticator.Digest
private static class	DigestAuthenticator.Nonce

Nested classes/interfaces inherited from interface org.eclipse.jetty.security.Authenticator

Authenticator.AuthConfiguration, Authenticator.Factory

Field Summary

Fields

Modifier and Type	Field	Description
private java.lang.String	_algorithm
private long	_maxNonceAgeMs
private int	_maxNonceCount
private java.util.Map<java.lang.String,DigestAuthenticator.Nonce>	_nonces
private java.security.SecureRandom	_random
private javax.crypto.SecretKey	_secretKey
private boolean	_userHashing
private static Logger	LOG

Fields inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator

_identityService, _loginService

Constructor Summary

Constructors

Constructor	Description
DigestAuthenticator()

Method Summary

Modifier and Type	Method	Description
private int	checkNonce(DigestAuthenticator.Digest digest)
java.lang.String	getAlgorithm()
java.lang.String	getAuthMethod()
long	getMaxNonceAge()
int	getMaxNonceCount()
boolean	isUserHashing()
UserIdentity	login(java.lang.String username, java.lang.Object credentials, javax.servlet.ServletRequest request)	If the UserIdentity is not null after this method calls LoginService.login(String, Object, ServletRequest), it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability.
private javax.crypto.Mac	newMac()
java.lang.String	newNonce(Request request)
private java.lang.String	newOpaque(java.lang.String nonce)
private DigestAuthenticator.Digest	parseDigest(java.lang.String method, java.lang.String credentials)
protected java.lang.String	resolveEncodedUserName(java.lang.String encodedUserName)
protected java.lang.String	resolveHashedUserName(java.lang.String hashedUserName)
boolean	secureResponse(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory, Authentication.User validatedUser)	is response secure
void	setAlgorithm(java.lang.String algorithm)
void	setConfiguration(Authenticator.AuthConfiguration configuration)	Configure the Authenticator
void	setMaxNonceAge(long maxNonceAgeInMillis)
void	setMaxNonceCount(int maxNonceCount)
void	setUserHashing(boolean userHashing)
Authentication	validateRequest(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory)	Validate a request
private boolean	verifyOpaque(DigestAuthenticator.Digest digest)

Methods inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator

getLoginService, logout, prepareRequest, renewSession

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOG

private static final Logger LOG

_random

private final java.security.SecureRandom _random

_nonces

private final java.util.Map<java.lang.String,DigestAuthenticator.Nonce> _nonces

_secretKey

private final javax.crypto.SecretKey _secretKey

_maxNonceAgeMs

private long _maxNonceAgeMs

_maxNonceCount

private int _maxNonceCount

_algorithm

private java.lang.String _algorithm

_userHashing

private boolean _userHashing

Constructor Detail

DigestAuthenticator

public DigestAuthenticator()

Method Detail

setConfiguration

public void setConfiguration(Authenticator.AuthConfiguration configuration)

Description copied from interface: Authenticator

Configure the Authenticator

Specified by:

setConfiguration in interface Authenticator

Overrides:

setConfiguration in class LoginAuthenticator

Parameters:

configuration - the configuration

getMaxNonceCount

public int getMaxNonceCount()

setMaxNonceCount

public void setMaxNonceCount(int maxNonceCount)

getMaxNonceAge

public long getMaxNonceAge()

setMaxNonceAge

public void setMaxNonceAge(long maxNonceAgeInMillis)

getAlgorithm

public java.lang.String getAlgorithm()

setAlgorithm

public void setAlgorithm(java.lang.String algorithm)

isUserHashing

public boolean isUserHashing()

setUserHashing

public void setUserHashing(boolean userHashing)

getAuthMethod

public java.lang.String getAuthMethod()

Returns:

The name of the authentication method

secureResponse

public boolean secureResponse(javax.servlet.ServletRequest req,
                              javax.servlet.ServletResponse res,
                              boolean mandatory,
                              Authentication.User validatedUser)
                       throws ServerAuthException

Description copied from interface: Authenticator

is response secure

Parameters:

req - the request

res - the response

mandatory - if security is mandator

validatedUser - the user that was validated

Returns:

true if response is secure

Throws:

ServerAuthException - if unable to test response

validateRequest

public Authentication validateRequest(javax.servlet.ServletRequest req,
                                      javax.servlet.ServletResponse res,
                                      boolean mandatory)
                               throws ServerAuthException

Description copied from interface: Authenticator

Validate a request

Parameters:

req - The request

res - The response

mandatory - True if authentication is mandatory.

Returns:

An Authentication. If Authentication is successful, this will be a Authentication.User. If a response has been sent by the Authenticator (which can be done for both successful and unsuccessful authentications), then the result will implement Authentication.ResponseSent. If Authentication is not mandatory, then a Authentication.Deferred may be returned.

Throws:

ServerAuthException - if unable to validate request

parseDigest

private DigestAuthenticator.Digest parseDigest(java.lang.String method,
                                               java.lang.String credentials)

resolveHashedUserName

protected java.lang.String resolveHashedUserName(java.lang.String hashedUserName)

resolveEncodedUserName

protected java.lang.String resolveEncodedUserName(java.lang.String encodedUserName)

login

public UserIdentity login(java.lang.String username,
                          java.lang.Object credentials,
                          javax.servlet.ServletRequest request)

Description copied from class: LoginAuthenticator

If the UserIdentity is not null after this method calls LoginService.login(String, Object, ServletRequest), it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability. If the UserIdentity is not necessarily fully authenticated, then subclasses must override this method and determine when the UserIdentity IS fully authenticated and renew the session id.

Overrides:

login in class LoginAuthenticator

Parameters:

username - the username of the client to be authenticated

credentials - the user's credential

request - the inbound request that needs authentication

newNonce

public java.lang.String newNonce(Request request)

checkNonce

private int checkNonce(DigestAuthenticator.Digest digest)

newOpaque

private java.lang.String newOpaque(java.lang.String nonce)

verifyOpaque

private boolean verifyOpaque(DigestAuthenticator.Digest digest)

newMac

private javax.crypto.Mac newMac()