1 /* 2 * Copyright 1995-2003 Sun Microsystems, Inc. All Rights Reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Sun designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Sun in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 22 * CA 95054 USA or visit www.sun.com if you need additional information or 23 * have any questions. 24 */ 25 26 package sun.net.www.protocol.http; 27 28 import java.io.IOException; 29 import java.io.ObjectInputStream; 30 import java.net.PasswordAuthentication; 31 import java.net.URL; 32 import java.util.HashMap; 33 34 import sun.net.www.HeaderParser; 35 36 37 /** 38 * AuthenticationInfo: Encapsulate the information needed to 39 * authenticate a user to a server. 40 * 41 * @author Jon Payne 42 * @author Herb Jellinek 43 * @author Bill Foote 44 */ 45 // REMIND: It would be nice if this class understood about partial matching. 46 // If you're authorized for foo.com, chances are high you're also 47 // authorized for baz.foo.com. 48 // NB: When this gets implemented, be careful about the uncaching 49 // policy in HttpURLConnection. A failure on baz.foo.com shouldn't 50 // uncache foo.com! 51 52 public abstract class AuthenticationInfo extends AuthCacheValue implements Cloneable { 53 54 // Constants saying what kind of authroization this is. This determines 55 // the namespace in the hash table lookup. 56 public static final char SERVER_AUTHENTICATION = 's'; 57 public static final char PROXY_AUTHENTICATION = 'p'; 58 59 /** 60 * If true, then simultaneous authentication requests to the same realm/proxy 61 * are serialized, in order to avoid a user having to type the same username/passwords 62 * repeatedly, via the Authenticator. Default is false, which means that this 63 * behavior is switched off. 64 */ 65 static boolean serializeAuth; 66 67 static { 68 serializeAuth = java.security.AccessController.doPrivileged( 69 new sun.security.action.GetBooleanAction( 70 "http.auth.serializeRequests")).booleanValue(); 71 } 72 73 /* AuthCacheValue: */ 74 75 transient protected PasswordAuthentication pw; 76 77 public PasswordAuthentication credentials() { 78 return pw; 79 } 80 81 public AuthCacheValue.Type getAuthType() { 82 return type == SERVER_AUTHENTICATION ? 83 AuthCacheValue.Type.Server: 84 AuthCacheValue.Type.Proxy; 85 } 86 87 AuthScheme getAuthScheme() { 88 return authScheme; 89 } 90 91 public String getHost() { 92 return host; 93 } 94 public int getPort() { 95 return port; 96 } 97 public String getRealm() { 98 return realm; 99 } 100 public String getPath() { 101 return path; 102 } 103 public String getProtocolScheme() { 104 return protocol; 105 } 106 107 /** 108 * requests is used to ensure that interaction with the 109 * Authenticator for a particular realm is single threaded. 110 * ie. if multiple threads need to get credentials from the user 111 * at the same time, then all but the first will block until 112 * the first completes its authentication. 113 */ 114 static private HashMap<String,Thread> requests = new HashMap<>(); 115 116 /* check if a request for this destination is in progress 117 * return false immediately if not. Otherwise block until 118 * request is finished and return true 119 */ 120 static private boolean requestIsInProgress (String key) { 121 if (!serializeAuth) { 122 /* behavior is disabled. Revert to concurrent requests */ 123 return false; 124 } 125 synchronized (requests) { 126 Thread t, c; 127 c = Thread.currentThread(); 128 if ((t = requests.get(key)) == null) { 129 requests.put (key, c); 130 return false; 131 } 132 if (t == c) { 133 return false; 134 } 135 while (requests.containsKey(key)) { 136 try { 137 requests.wait (); 138 } catch (InterruptedException e) {} 139 } 140 } 141 /* entry may be in cache now. */ 142 return true; 143 } 144 145 /* signal completion of an authentication (whether it succeeded or not) 146 * so that other threads can continue. 147 */ 148 static private void requestCompleted (String key) { 149 synchronized (requests) { 150 Thread thread = requests.get(key); 151 if (thread != null && thread == Thread.currentThread()) { 152 boolean waspresent = requests.remove(key) != null; 153 assert waspresent; 154 } 155 requests.notifyAll(); 156 } 157 } 158 159 //public String toString () { 160 //return ("{"+type+":"+authScheme+":"+protocol+":"+host+":"+port+":"+realm+":"+path+"}"); 161 //} 162 163 // REMIND: This cache just grows forever. We should put in a bounded 164 // cache, or maybe something using WeakRef's. 165 166 /** The type (server/proxy) of authentication this is. Used for key lookup */ 167 char type; 168 169 /** The authentication scheme (basic/digest). Also used for key lookup */ 170 AuthScheme authScheme; 171 172 /** The protocol/scheme (i.e. http or https ). Need to keep the caches 173 * logically separate for the two protocols. This field is only used 174 * when constructed with a URL (the normal case for server authentication) 175 * For proxy authentication the protocol is not relevant. 176 */ 177 String protocol; 178 179 /** The host we're authenticating against. */ 180 String host; 181 182 /** The port on the host we're authenticating against. */ 183 int port; 184 185 /** The realm we're authenticating against. */ 186 String realm; 187 188 /** The shortest path from the URL we authenticated against. */ 189 String path; 190 191 /** Use this constructor only for proxy entries */ 192 public AuthenticationInfo(char type, AuthScheme authScheme, String host, int port, String realm) { 193 this.type = type; 194 this.authScheme = authScheme; 195 this.protocol = ""; 196 this.host = host.toLowerCase(); 197 this.port = port; 198 this.realm = realm; 199 this.path = null; 200 } 201 202 public Object clone() { 203 try { 204 return super.clone (); 205 } catch (CloneNotSupportedException e) { 206 // Cannot happen because Cloneable implemented by AuthenticationInfo 207 return null; 208 } 209 } 210 211 /* 212 * Constructor used to limit the authorization to the path within 213 * the URL. Use this constructor for origin server entries. 214 */ 215 public AuthenticationInfo(char type, AuthScheme authScheme, URL url, String realm) { 216 this.type = type; 217 this.authScheme = authScheme; 218 this.protocol = url.getProtocol().toLowerCase(); 219 this.host = url.getHost().toLowerCase(); 220 this.port = url.getPort(); 221 if (this.port == -1) { 222 this.port = url.getDefaultPort(); 223 } 224 this.realm = realm; 225 226 String urlPath = url.getPath(); 227 if (urlPath.length() == 0) 228 this.path = urlPath; 229 else { 230 this.path = reducePath (urlPath); 231 } 232 233 } 234 235 /* 236 * reduce the path to the root of where we think the 237 * authorization begins. This could get shorter as 238 * the url is traversed up following a successful challenge. 239 */ 240 static String reducePath (String urlPath) { 241 int sepIndex = urlPath.lastIndexOf('/'); 242 int targetSuffixIndex = urlPath.lastIndexOf('.'); 243 if (sepIndex != -1) 244 if (sepIndex < targetSuffixIndex) 245 return urlPath.substring(0, sepIndex+1); 246 else 247 return urlPath; 248 else 249 return urlPath; 250 } 251 252 /** 253 * Returns info for the URL, for an HTTP server auth. Used when we 254 * don't yet know the realm 255 * (i.e. when we're preemptively setting the auth). 256 */ 257 static AuthenticationInfo getServerAuth(URL url) { 258 int port = url.getPort(); 259 if (port == -1) { 260 port = url.getDefaultPort(); 261 } 262 String key = SERVER_AUTHENTICATION + ":" + url.getProtocol().toLowerCase() 263 + ":" + url.getHost().toLowerCase() + ":" + port; 264 return getAuth(key, url); 265 } 266 267 /** 268 * Returns info for the URL, for an HTTP server auth. Used when we 269 * do know the realm (i.e. when we're responding to a challenge). 270 * In this case we do not use the path because the protection space 271 * is identified by the host:port:realm only 272 */ 273 static AuthenticationInfo getServerAuth(URL url, String realm, AuthScheme scheme) { 274 int port = url.getPort(); 275 if (port == -1) { 276 port = url.getDefaultPort(); 277 } 278 String key = SERVER_AUTHENTICATION + ":" + scheme + ":" + url.getProtocol().toLowerCase() 279 + ":" + url.getHost().toLowerCase() + ":" + port + ":" + realm; 280 AuthenticationInfo cached = getAuth(key, null); 281 if ((cached == null) && requestIsInProgress (key)) { 282 /* check the cache again, it might contain an entry */ 283 cached = getAuth(key, null); 284 } 285 return cached; 286 } 287 288 289 /** 290 * Return the AuthenticationInfo object from the cache if it's path is 291 * a substring of the supplied URLs path. 292 */ 293 static AuthenticationInfo getAuth(String key, URL url) { 294 if (url == null) { 295 return (AuthenticationInfo)cache.get (key, null); 296 } else { 297 return (AuthenticationInfo)cache.get (key, url.getPath()); 298 } 299 } 300 301 /** 302 * Returns a firewall authentication, for the given host/port. Used 303 * for preemptive header-setting. Note, the protocol field is always 304 * blank for proxies. 305 */ 306 static AuthenticationInfo getProxyAuth(String host, int port) { 307 String key = PROXY_AUTHENTICATION + "::" + host.toLowerCase() + ":" + port; 308 AuthenticationInfo result = (AuthenticationInfo) cache.get(key, null); 309 return result; 310 } 311 312 /** 313 * Returns a firewall authentication, for the given host/port and realm. 314 * Used in response to a challenge. Note, the protocol field is always 315 * blank for proxies. 316 */ 317 static AuthenticationInfo getProxyAuth(String host, int port, String realm, AuthScheme scheme) { 318 String key = PROXY_AUTHENTICATION + ":" + scheme + "::" + host.toLowerCase() 319 + ":" + port + ":" + realm; 320 AuthenticationInfo cached = (AuthenticationInfo) cache.get(key, null); 321 if ((cached == null) && requestIsInProgress (key)) { 322 /* check the cache again, it might contain an entry */ 323 cached = (AuthenticationInfo) cache.get(key, null); 324 } 325 return cached; 326 } 327 328 329 /** 330 * Add this authentication to the cache 331 */ 332 void addToCache() { 333 cache.put (cacheKey(true), this); 334 if (supportsPreemptiveAuthorization()) { 335 cache.put (cacheKey(false), this); 336 } 337 endAuthRequest(); 338 } 339 340 void endAuthRequest () { 341 if (!serializeAuth) { 342 return; 343 } 344 synchronized (requests) { 345 requestCompleted (cacheKey(true)); 346 } 347 } 348 349 /** 350 * Remove this authentication from the cache 351 */ 352 void removeFromCache() { 353 cache.remove(cacheKey(true), this); 354 if (supportsPreemptiveAuthorization()) { 355 cache.remove(cacheKey(false), this); 356 } 357 } 358 359 /** 360 * @return true if this authentication supports preemptive authorization 361 */ 362 public abstract boolean supportsPreemptiveAuthorization(); 363 364 /** 365 * @return the name of the HTTP header this authentication wants set. 366 * This is used for preemptive authorization. 367 */ 368 public String getHeaderName() { 369 if (type == SERVER_AUTHENTICATION) { 370 return "Authorization"; 371 } else { 372 return "Proxy-authorization"; 373 } 374 } 375 376 /** 377 * Calculates and returns the authentication header value based 378 * on the stored authentication parameters. If the calculation does not depend 379 * on the URL or the request method then these parameters are ignored. 380 * @param url The URL 381 * @param method The request method 382 * @return the value of the HTTP header this authentication wants set. 383 * Used for preemptive authorization. 384 */ 385 public abstract String getHeaderValue(URL url, String method); 386 387 /** 388 * Set header(s) on the given connection. Subclasses must override 389 * This will only be called for 390 * definitive (i.e. non-preemptive) authorization. 391 * @param conn The connection to apply the header(s) to 392 * @param p A source of header values for this connection, if needed. 393 * @param raw The raw header field (if needed) 394 * @return true if all goes well, false if no headers were set. 395 */ 396 public abstract boolean setHeaders(HttpURLConnection conn, HeaderParser p, String raw); 397 398 /** 399 * Check if the header indicates that the current auth. parameters are stale. 400 * If so, then replace the relevant field with the new value 401 * and return true. Otherwise return false. 402 * returning true means the request can be retried with the same userid/password 403 * returning false means we have to go back to the user to ask for a new 404 * username password. 405 */ 406 public abstract boolean isAuthorizationStale (String header); 407 408 /** 409 * Give a key for hash table lookups. 410 * @param includeRealm if you want the realm considered. Preemptively 411 * setting an authorization is done before the realm is known. 412 */ 413 String cacheKey(boolean includeRealm) { 414 // This must be kept in sync with the getXXXAuth() methods in this 415 // class. 416 if (includeRealm) { 417 return type + ":" + authScheme + ":" + protocol + ":" 418 + host + ":" + port + ":" + realm; 419 } else { 420 return type + ":" + protocol + ":" + host + ":" + port; 421 } 422 } 423 424 String s1, s2; /* used for serialization of pw */ 425 426 private void readObject(ObjectInputStream s) 427 throws IOException, ClassNotFoundException 428 { 429 s.defaultReadObject (); 430 pw = new PasswordAuthentication (s1, s2.toCharArray()); 431 s1 = null; s2= null; 432 } 433 434 private synchronized void writeObject(java.io.ObjectOutputStream s) 435 throws IOException 436 { 437 s1 = pw.getUserName(); 438 s2 = new String (pw.getPassword()); 439 s.defaultWriteObject (); 440 } 441 }