Changeset 2674


Ignore:
Timestamp:
03/11/13 10:35:08 (11 years ago)
Author:
mwindhouwer
Message:

M mod-ISOcat-control-access/control/credentials.js

  • make sure we always pass the principal even when authentication went via HTTP BASIC, this is needed for the bind step
  • also look for eduPersonTargetedID

M mod-ISOcat-interface-rest/etc/HTTPBridgeConfig.xml

  • also pass on eduPersonTargetedID
Location:
cats/ISOcat/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • cats/ISOcat/trunk/mod-ISOcat-control-access/control/credentials.js

    r2519 r2674  
    1919// first try HTTP Basic authentication
    2020if (req.argumentExists("Authorization")) {
    21         auth = req.getArgument("Authorization");
    22         auth = auth.replace("data:text/plain,","");
    23         auth = java.net.URLDecoder.decode(auth,"UTF-8");
    24         auth = auth.trim();
    25         if (auth.startsWith("Basic ")) {
     21    auth = req.getArgument("Authorization");
     22    auth = auth.replace("data:text/plain,","");
     23    auth = java.net.URLDecoder.decode(auth,"UTF-8");
     24    auth = auth.trim();
     25    if (auth.startsWith("Basic ")) {
    2626        // the shibboleth token password can never come by BASIC authentication
    2727        if (!auth.endsWith(":shib")) {
    … …  
    3333            //java.lang.System.out.println("DBG:credentials.js:auth["+auth+"] without prefix");
    3434            cred = auth;
    35                 subreq.addArgument("credentials","data:text/plain,"+java.net.URLEncoder.encode(cred,"UTF-8"));
    36         }
    37         }
     35            subreq.addArgument("credentials","data:text/plain,"+java.net.URLEncoder.encode(cred,"UTF-8"));
     36        }
     37    }
    3838}
    3939
    4040// try Shibboleth EPPN authentication
    4141if ((req.argumentExists("eduPersonPrincipalName"))) {
    42         var auth = req.getArgument("eduPersonPrincipalName");
    43         auth = auth.replace("data:text/plain,","");
    44         //java.lang.System.out.println("DBG:credentials.js:principal["+auth+"]");
    45         if (auth != "") {
    46             shib = auth;
    47         }
     42    var auth = req.getArgument("eduPersonPrincipalName");
     43    auth = auth.replace("data:text/plain,","");
     44    //java.lang.System.out.println("DBG:credentials.js:principal["+auth+"]");
     45    if (auth != "") {
     46        shib = auth;
     47    }
     48}
     49
     50// if no principal yet, try Shibboleth EPTID authentication
     51if (shib == null) {
     52    if ((req.argumentExists("eduPersonTargetedID"))) {
     53        var auth = req.getArgument("eduPersonTargetedID");
     54        auth = auth.replace("data:text/plain,","");
     55        //java.lang.System.out.println("DBG:credentials.js:principal["+auth+"]");
     56        if (auth != "") {
     57            shib = auth;
     58        }
     59    }
    4860}
    4961
    … …  
    7688                            //java.lang.System.out.println("DBG:credentials.js:tokres["+tokres+"]");
    7789                            if (tokres != "") {
    78                                     shib = tokres;
     90                                shib = tokres;
    7991                            }
    8092                        }
    81                                         }
    82                                 }
    83                         }
    84                 }
     93                    }
     94                }
     95            }
     96        }
    8597    }
    8698}
    8799
    88100//java.lang.System.out.println("DBG:credentials.js:principal["+shib+"]");
     101if (shib == null) {
     102    subreq.addArgument("principal","data:text/plain,"+java.net.URLEncoder.encode(shib,"UTF-8"));
     103}
    89104
    90105// if no credentials but the principal is known, try to resolve principal to credentials
    91106if ((cred == null) && (shib != null)) {
    92     subreq.addArgument("principal","data:text/plain,"+java.net.URLEncoder.encode(shib,"UTF-8"));
    93107    // request the credentials for the principal
    94108    var credreq = context.createSubRequest();
    95         credreq.setURI("active:ISOcat.manage.access.shibboleth");
    96         credreq.addArgument("principal","data:text/plain,"+java.net.URLEncoder.encode(shib,"UTF-8"));
    97         credreq.setAspectClass(DOMXDAAspect);
    98         auth = context.issueSubRequest(credreq);
    99         if (auth != null) {
    100                 //java.lang.System.out.println("DBG:credentials.js:cred["+auth.getAspects()+"]");
    101                 if (auth.hasAspect(DOMXDAAspect)) {
    102                         auth = auth.getAspect(DOMXDAAspect);
    103                         //java.lang.System.out.println("DBG:credentials.js:XDA["+auth+"]");
    104                         if (auth != null) {
    105                                 auth = auth.getXDA();
    106                                 if (auth.isTrue("/string")) {
    107                                         auth =  auth.getText("/string",true);
    108                                         //java.lang.System.out.println("DBG:credentials.js:auth["+auth+"]");
    109                                         cred = auth;
    110                                         subreq.addArgument("credentials","data:text/plain,"+java.net.URLEncoder.encode(cred,"UTF-8"));
    111                                 } //else
    112                                         //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has no <string/> envelop");
    113                         } //else
    114                                 //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has NULL DOMXDAAspect");
    115                 } //else
    116                         //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has no DOMXDAAspect");
     109    credreq.setURI("active:ISOcat.manage.access.shibboleth");
     110    credreq.addArgument("principal","data:text/plain,"+java.net.URLEncoder.encode(shib,"UTF-8"));
     111    credreq.setAspectClass(DOMXDAAspect);
     112    auth = context.issueSubRequest(credreq);
     113    if (auth != null) {
     114        //java.lang.System.out.println("DBG:credentials.js:cred["+auth.getAspects()+"]");
     115        if (auth.hasAspect(DOMXDAAspect)) {
     116            auth = auth.getAspect(DOMXDAAspect);
     117            //java.lang.System.out.println("DBG:credentials.js:XDA["+auth+"]");
     118            if (auth != null) {
     119                auth = auth.getXDA();
     120                if (auth.isTrue("/string")) {
     121                    auth =  auth.getText("/string",true);
     122                    //java.lang.System.out.println("DBG:credentials.js:auth["+auth+"]");
     123                    cred = auth;
     124                    subreq.addArgument("credentials","data:text/plain,"+java.net.URLEncoder.encode(cred,"UTF-8"));
     125                } //else
     126                    //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has no <string/> envelop");
     127            } //else
     128                //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has NULL DOMXDAAspect");
     129        } //else
     130            //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has no DOMXDAAspect");
    117131    } //else
    118                 //java.lang.System.out.println("ERR:credentials.js:auth is NULL");
     132        //java.lang.System.out.println("ERR:credentials.js:auth is NULL");
    119133}
    120134
    121 java.lang.System.out.println("DBG:credentials.js:authorization credentials["+cred+"]");
    122 java.lang.System.out.println("DBG:credentials.js:shiboleth principal["+shib+"]");
     135//java.lang.System.out.println("DBG:credentials.js:authorization credentials["+cred+"]");
     136//java.lang.System.out.println("DBG:credentials.js:shiboleth principal["+shib+"]");
    123137
    124138for(iter = req.getArguments(); iter.hasNext(); ) {
    125         arg = iter.next();
    126         if (arg.equals("Authorization")) {
    127                 continue;
    128         } else if (arg.equals("eduPersonPrincipalName")) {
    129                 continue;
    130         } else if (arg.equals("principal")) {
    131                 continue;
    132         } else if (arg.equals("uri")) {
    133                 continue;
    134         } else if (arg.equals("operator")) {
    135                 continue;
    136         } else {
    137                 //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]");
    138                 argURI = req.getArgument(arg);
    139                 if (argURI != null) {
    140                         //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"]");
    141                         argValue = req.getArgumentValue(argURI);
    142                         //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"]["+argValue+"]");
    143                         if (argValue != null) {
    144                                 //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argValue+"] value");
    145                                 subreq.addArgument(arg,argValue);
    146                         //} else if (argURI.startsWith("data:text/plain,")) {
    147                         //      var val = java.net.URLEncoder.encode(argURI.replaceFirst("data:text/plain,",""),"UTF-8");
    148                         //      val = val.replace("\+","%20");// we don't want + to escape spaces but %20, as + has a special meaning in an active URI
    149                         //      java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"][data:text/plain,"+val+"] encoded URI");
    150                         //      subreq.addArgument(arg,"data:text/plain,"+val);
    151                         } else {
    152                                 //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"] URI");
    153                                 subreq.addArgument(arg,argURI);
    154                         }
    155                 }// else
    156                 //      java.lang.System.out.println("DBG:credentials.js:arg["+arg+"] null");
    157         }
     139    arg = iter.next();
     140    if (arg.equals("Authorization")) {
     141        continue;
     142    } else if (arg.equals("eduPersonPrincipalName")) {
     143        continue;
     144    } else if (arg.equals("eduPersonTargetedID")) {
     145        continue;
     146    } else if (arg.equals("principal")) {
     147        continue;
     148    } else if (arg.equals("uri")) {
     149        continue;
     150    } else if (arg.equals("operator")) {
     151        continue;
     152    } else {
     153        //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]");
     154        argURI = req.getArgument(arg);
     155        if (argURI != null) {
     156            //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"]");
     157            argValue = req.getArgumentValue(argURI);
     158            //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"]["+argValue+"]");
     159            if (argValue != null) {
     160                //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argValue+"] value");
     161                subreq.addArgument(arg,argValue);
     162            //} else if (argURI.startsWith("data:text/plain,")) {
     163            //    var val = java.net.URLEncoder.encode(argURI.replaceFirst("data:text/plain,",""),"UTF-8");
     164            //    val = val.replace("\+","%20");// we don't want + to escape spaces but %20, as + has a special meaning in an active URI
     165            //    java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"][data:text/plain,"+val+"] encoded URI");
     166            //    subreq.addArgument(arg,"data:text/plain,"+val);
     167            } else {
     168                //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"] URI");
     169                subreq.addArgument(arg,argURI);
     170            }
     171        }// else
     172        //    java.lang.System.out.println("DBG:credentials.js:arg["+arg+"] null");
     173    }
    158174}
    159175

  • cats/ISOcat/trunk/mod-ISOcat-interface-rest/etc/HTTPBridgeConfig.xml

    r2029 r2674  
    55                <passMethod/>
    66                <passCookies/>
    7                 <passHeaders>User-Agent X-Forwarded-For Referer Authorization Accept eduPersonPrincipalName</passHeaders>
     7                <passHeaders>User-Agent X-Forwarded-For Referer Authorization Accept eduPersonPrincipalName eduPersonTargetedID</passHeaders>
    88                <passRemoteHost/>
    99                <passByURI/>
Note: See TracChangeset for help on using the changeset viewer.