1   /**
2    * Copyright (c) 2000-2009 Liferay, Inc. All rights reserved.
3    *
4    * The contents of this file are subject to the terms of the Liferay Enterprise
5    * Subscription License ("License"). You may not use this file except in
6    * compliance with the License. You can obtain a copy of the License by
7    * contacting Liferay, Inc. See the License for the specific language governing
8    * permissions and limitations under the License, including but not limited to
9    * distribution rights of the Software.
10   *
11   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
12   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
14   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
15   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
16   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
17   * SOFTWARE.
18   */
19  
20  package com.liferay.portal.security.auth;
21  
22  import com.liferay.portal.NoSuchUserException;
23  import com.liferay.portal.kernel.log.Log;
24  import com.liferay.portal.kernel.log.LogFactoryUtil;
25  import com.liferay.portal.kernel.util.Base64;
26  import com.liferay.portal.kernel.util.GetterUtil;
27  import com.liferay.portal.kernel.util.StringPool;
28  import com.liferay.portal.service.UserLocalServiceUtil;
29  
30  import java.util.StringTokenizer;
31  
32  import javax.servlet.http.HttpServletRequest;
33  import javax.servlet.http.HttpServletResponse;
34  
35  /**
36   * <a href="BasicAuthHeaderAutoLogin.java.html"><b><i>View Source</i></b></a>
37   *
38   * <p>
39   * 1. Install Firefox. These instructions assume you have Firefox 2.0.0.1.
40   * Previous version of Firefox have been tested and are known to work.
41   * </p>
42   *
43   * <p>
44   * 2. Install the Modify Headers 0.5.4 Add-on. Tools > Add Ons. Click the get
45   * extensions link at the bottom of the window. Type in "Modify Headers" in the
46   * Search box. Find Modify Headers in the results page and click on it. Then
47   * click the install now link.
48   * </p>
49   *
50   * <p>
51   * 3. Configure Modify Headers to add a basic authentication header. Tools >
52   * Modify Headers. In the Modify Headers window select the Add drop down. Type
53   * in "Authorization" in the next box. Type in "Basic bGlmZXJheS5jb20uMTp0ZXN0"
54   * in the next box. Click the Add button.
55   * </p>
56   *
57   * <p>
58   * 4. Make sure your header modification is enabled and point your browser to
59   * the Liferay portal.
60   * </p>
61   *
62   * <p>
63   * 5. You should now be authenticated as Joe Bloggs.
64   * </p>
65   *
66   * @author Britt Courtney
67   * @author Brian Wing Shun Chan
68   *
69   */
70  public class BasicAuthHeaderAutoLogin implements AutoLogin {
71  
72      public String[] login(
73              HttpServletRequest request, HttpServletResponse response)
74          throws AutoLoginException {
75  
76          try {
77              String[] credentials = null;
78  
79              // Get the Authorization header, if one was supplied
80  
81              String authorization = request.getHeader("Authorization");
82  
83              if (authorization == null) {
84                  return credentials;
85              }
86  
87              StringTokenizer st = new StringTokenizer(authorization);
88  
89              if (!st.hasMoreTokens()) {
90                  return credentials;
91              }
92  
93              String basic = st.nextToken();
94  
95              // We only handle HTTP Basic authentication
96  
97              if (!basic.equalsIgnoreCase(HttpServletRequest.BASIC_AUTH)) {
98                  return credentials;
99              }
100 
101             String encodedCredentials = st.nextToken();
102 
103             if (_log.isDebugEnabled()) {
104                 _log.debug("Encoded credentials are " + encodedCredentials);
105             }
106 
107             String decodedCredentials = new String(
108                 Base64.decode(encodedCredentials));
109 
110             if (_log.isDebugEnabled()) {
111                 _log.debug("Decoded credentials are " + decodedCredentials);
112             }
113 
114             int pos = decodedCredentials.indexOf(StringPool.COLON);
115 
116             if (pos == -1) {
117                 return credentials;
118             }
119 
120             long userId = GetterUtil.getLong(
121                 decodedCredentials.substring(0, pos));
122             String password = decodedCredentials.substring(pos + 1);
123 
124             try {
125                 UserLocalServiceUtil.getUserById(userId);
126 
127                 credentials = new String[3];
128 
129                 credentials[0] = String.valueOf(userId);
130                 credentials[1] = password;
131                 credentials[2] = Boolean.TRUE.toString();
132             }
133             catch (NoSuchUserException nsue) {
134                 if (_log.isWarnEnabled()) {
135                     _log.warn(userId + " is not a valid user id");
136                 }
137             }
138 
139             return credentials;
140         }
141         catch (Exception e) {
142             throw new AutoLoginException(e);
143         }
144     }
145 
146     private static Log _log =
147         LogFactoryUtil.getLog(BasicAuthHeaderAutoLogin.class);
148 
149 }