1
19
20 package com.liferay.portal.security.auth;
21
22 import com.liferay.portal.NoSuchUserException;
23 import com.liferay.portal.kernel.log.Log;
24 import com.liferay.portal.kernel.log.LogFactoryUtil;
25 import com.liferay.portal.kernel.util.Base64;
26 import com.liferay.portal.kernel.util.GetterUtil;
27 import com.liferay.portal.kernel.util.StringPool;
28 import com.liferay.portal.service.UserLocalServiceUtil;
29
30 import java.util.StringTokenizer;
31
32 import javax.servlet.http.HttpServletRequest;
33 import javax.servlet.http.HttpServletResponse;
34
35
70 public class BasicAuthHeaderAutoLogin implements AutoLogin {
71
72 public String[] login(
73 HttpServletRequest request, HttpServletResponse response)
74 throws AutoLoginException {
75
76 try {
77 String[] credentials = null;
78
79
81 String authorization = request.getHeader("Authorization");
82
83 if (authorization == null) {
84 return credentials;
85 }
86
87 StringTokenizer st = new StringTokenizer(authorization);
88
89 if (!st.hasMoreTokens()) {
90 return credentials;
91 }
92
93 String basic = st.nextToken();
94
95
97 if (!basic.equalsIgnoreCase(HttpServletRequest.BASIC_AUTH)) {
98 return credentials;
99 }
100
101 String encodedCredentials = st.nextToken();
102
103 if (_log.isDebugEnabled()) {
104 _log.debug("Encoded credentials are " + encodedCredentials);
105 }
106
107 String decodedCredentials = new String(
108 Base64.decode(encodedCredentials));
109
110 if (_log.isDebugEnabled()) {
111 _log.debug("Decoded credentials are " + decodedCredentials);
112 }
113
114 int pos = decodedCredentials.indexOf(StringPool.COLON);
115
116 if (pos == -1) {
117 return credentials;
118 }
119
120 long userId = GetterUtil.getLong(
121 decodedCredentials.substring(0, pos));
122 String password = decodedCredentials.substring(pos + 1);
123
124 try {
125 UserLocalServiceUtil.getUserById(userId);
126
127 credentials = new String[3];
128
129 credentials[0] = String.valueOf(userId);
130 credentials[1] = password;
131 credentials[2] = Boolean.TRUE.toString();
132 }
133 catch (NoSuchUserException nsue) {
134 if (_log.isWarnEnabled()) {
135 _log.warn(userId + " is not a valid user id");
136 }
137 }
138
139 return credentials;
140 }
141 catch (Exception e) {
142 throw new AutoLoginException(e);
143 }
144 }
145
146 private static Log _log =
147 LogFactoryUtil.getLog(BasicAuthHeaderAutoLogin.class);
148
149 }