feat(jdk8): move files to new folder to avoid resources compiled.
This commit is contained in:
@@ -0,0 +1,346 @@
|
||||
/*
|
||||
* Copyright (c) 2004, 2008, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation. Oracle designates this
|
||||
* particular file as subject to the "Classpath" exception as provided
|
||||
* by Oracle in the LICENSE file that accompanied this code.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
package com.sun.jmx.remote.security;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.security.AccessController;
|
||||
import java.security.Principal;
|
||||
import java.security.PrivilegedAction;
|
||||
import java.security.PrivilegedActionException;
|
||||
import java.security.PrivilegedExceptionAction;
|
||||
import java.util.Collections;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import java.util.Properties;
|
||||
import javax.management.remote.JMXPrincipal;
|
||||
import javax.management.remote.JMXAuthenticator;
|
||||
import javax.security.auth.AuthPermission;
|
||||
import javax.security.auth.Subject;
|
||||
import javax.security.auth.callback.*;
|
||||
import javax.security.auth.login.AppConfigurationEntry;
|
||||
import javax.security.auth.login.Configuration;
|
||||
import javax.security.auth.login.LoginContext;
|
||||
import javax.security.auth.login.LoginException;
|
||||
import javax.security.auth.spi.LoginModule;
|
||||
import com.sun.jmx.remote.util.ClassLogger;
|
||||
import com.sun.jmx.remote.util.EnvHelp;
|
||||
|
||||
/**
|
||||
* <p>This class represents a
|
||||
* <a href="{@docRoot}/../guide/security/jaas/JAASRefGuide.html">JAAS</a>
|
||||
* based implementation of the {@link JMXAuthenticator} interface.</p>
|
||||
*
|
||||
* <p>Authentication is performed by passing the supplied user's credentials
|
||||
* to one or more authentication mechanisms ({@link LoginModule}) for
|
||||
* verification. An authentication mechanism acquires the user's credentials
|
||||
* by calling {@link NameCallback} and/or {@link PasswordCallback}.
|
||||
* If authentication is successful then an authenticated {@link Subject}
|
||||
* filled in with a {@link Principal} is returned. Authorization checks
|
||||
* will then be performed based on this <code>Subject</code>.</p>
|
||||
*
|
||||
* <p>By default, a single file-based authentication mechanism
|
||||
* {@link FileLoginModule} is configured (<code>FileLoginConfig</code>).</p>
|
||||
*
|
||||
* <p>To override the default configuration use the
|
||||
* <code>com.sun.management.jmxremote.login.config</code> management property
|
||||
* described in the JRE/lib/management/management.properties file.
|
||||
* Set this property to the name of a JAAS configuration entry and ensure that
|
||||
* the entry is loaded by the installed {@link Configuration}. In addition,
|
||||
* ensure that the authentication mechanisms specified in the entry acquire
|
||||
* the user's credentials by calling {@link NameCallback} and
|
||||
* {@link PasswordCallback} and that they return a {@link Subject} filled-in
|
||||
* with a {@link Principal}, for those users that are successfully
|
||||
* authenticated.</p>
|
||||
*/
|
||||
public final class JMXPluggableAuthenticator implements JMXAuthenticator {
|
||||
|
||||
/**
|
||||
* Creates an instance of <code>JMXPluggableAuthenticator</code>
|
||||
* and initializes it with a {@link LoginContext}.
|
||||
*
|
||||
* @param env the environment containing configuration properties for the
|
||||
* authenticator. Can be null, which is equivalent to an empty
|
||||
* Map.
|
||||
* @exception SecurityException if the authentication mechanism cannot be
|
||||
* initialized.
|
||||
*/
|
||||
public JMXPluggableAuthenticator(Map<?, ?> env) {
|
||||
|
||||
String loginConfigName = null;
|
||||
String passwordFile = null;
|
||||
|
||||
if (env != null) {
|
||||
loginConfigName = (String) env.get(LOGIN_CONFIG_PROP);
|
||||
passwordFile = (String) env.get(PASSWORD_FILE_PROP);
|
||||
}
|
||||
|
||||
try {
|
||||
|
||||
if (loginConfigName != null) {
|
||||
// use the supplied JAAS login configuration
|
||||
loginContext =
|
||||
new LoginContext(loginConfigName, new JMXCallbackHandler());
|
||||
|
||||
} else {
|
||||
// use the default JAAS login configuration (file-based)
|
||||
SecurityManager sm = System.getSecurityManager();
|
||||
if (sm != null) {
|
||||
sm.checkPermission(
|
||||
new AuthPermission("createLoginContext." +
|
||||
LOGIN_CONFIG_NAME));
|
||||
}
|
||||
|
||||
final String pf = passwordFile;
|
||||
try {
|
||||
loginContext = AccessController.doPrivileged(
|
||||
new PrivilegedExceptionAction<LoginContext>() {
|
||||
public LoginContext run() throws LoginException {
|
||||
return new LoginContext(
|
||||
LOGIN_CONFIG_NAME,
|
||||
null,
|
||||
new JMXCallbackHandler(),
|
||||
new FileLoginConfig(pf));
|
||||
}
|
||||
});
|
||||
} catch (PrivilegedActionException pae) {
|
||||
throw (LoginException) pae.getException();
|
||||
}
|
||||
}
|
||||
|
||||
} catch (LoginException le) {
|
||||
authenticationFailure("authenticate", le);
|
||||
|
||||
} catch (SecurityException se) {
|
||||
authenticationFailure("authenticate", se);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Authenticate the <code>MBeanServerConnection</code> client
|
||||
* with the given client credentials.
|
||||
*
|
||||
* @param credentials the user-defined credentials to be passed in
|
||||
* to the server in order to authenticate the user before creating
|
||||
* the <code>MBeanServerConnection</code>. This parameter must
|
||||
* be a two-element <code>String[]</code> containing the client's
|
||||
* username and password in that order.
|
||||
*
|
||||
* @return the authenticated subject containing a
|
||||
* <code>JMXPrincipal(username)</code>.
|
||||
*
|
||||
* @exception SecurityException if the server cannot authenticate the user
|
||||
* with the provided credentials.
|
||||
*/
|
||||
public Subject authenticate(Object credentials) {
|
||||
// Verify that credentials is of type String[].
|
||||
//
|
||||
if (!(credentials instanceof String[])) {
|
||||
// Special case for null so we get a more informative message
|
||||
if (credentials == null)
|
||||
authenticationFailure("authenticate", "Credentials required");
|
||||
|
||||
final String message =
|
||||
"Credentials should be String[] instead of " +
|
||||
credentials.getClass().getName();
|
||||
authenticationFailure("authenticate", message);
|
||||
}
|
||||
// Verify that the array contains two elements.
|
||||
//
|
||||
final String[] aCredentials = (String[]) credentials;
|
||||
if (aCredentials.length != 2) {
|
||||
final String message =
|
||||
"Credentials should have 2 elements not " +
|
||||
aCredentials.length;
|
||||
authenticationFailure("authenticate", message);
|
||||
}
|
||||
// Verify that username exists and the associated
|
||||
// password matches the one supplied by the client.
|
||||
//
|
||||
username = aCredentials[0];
|
||||
password = aCredentials[1];
|
||||
if (username == null || password == null) {
|
||||
final String message = "Username or password is null";
|
||||
authenticationFailure("authenticate", message);
|
||||
}
|
||||
|
||||
// Perform authentication
|
||||
try {
|
||||
loginContext.login();
|
||||
final Subject subject = loginContext.getSubject();
|
||||
AccessController.doPrivileged(new PrivilegedAction<Void>() {
|
||||
public Void run() {
|
||||
subject.setReadOnly();
|
||||
return null;
|
||||
}
|
||||
});
|
||||
|
||||
return subject;
|
||||
|
||||
} catch (LoginException le) {
|
||||
authenticationFailure("authenticate", le);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private static void authenticationFailure(String method, String message)
|
||||
throws SecurityException {
|
||||
final String msg = "Authentication failed! " + message;
|
||||
final SecurityException e = new SecurityException(msg);
|
||||
logException(method, msg, e);
|
||||
throw e;
|
||||
}
|
||||
|
||||
private static void authenticationFailure(String method,
|
||||
Exception exception)
|
||||
throws SecurityException {
|
||||
String msg;
|
||||
SecurityException se;
|
||||
if (exception instanceof SecurityException) {
|
||||
msg = exception.getMessage();
|
||||
se = (SecurityException) exception;
|
||||
} else {
|
||||
msg = "Authentication failed! " + exception.getMessage();
|
||||
final SecurityException e = new SecurityException(msg);
|
||||
EnvHelp.initCause(e, exception);
|
||||
se = e;
|
||||
}
|
||||
logException(method, msg, se);
|
||||
throw se;
|
||||
}
|
||||
|
||||
private static void logException(String method,
|
||||
String message,
|
||||
Exception e) {
|
||||
if (logger.traceOn()) {
|
||||
logger.trace(method, message);
|
||||
}
|
||||
if (logger.debugOn()) {
|
||||
logger.debug(method, e);
|
||||
}
|
||||
}
|
||||
|
||||
private LoginContext loginContext;
|
||||
private String username;
|
||||
private String password;
|
||||
private static final String LOGIN_CONFIG_PROP =
|
||||
"jmx.remote.x.login.config";
|
||||
private static final String LOGIN_CONFIG_NAME = "JMXPluggableAuthenticator";
|
||||
private static final String PASSWORD_FILE_PROP =
|
||||
"jmx.remote.x.password.file";
|
||||
private static final ClassLogger logger =
|
||||
new ClassLogger("javax.management.remote.misc", LOGIN_CONFIG_NAME);
|
||||
|
||||
/**
|
||||
* This callback handler supplies the username and password (which was
|
||||
* originally supplied by the JMX user) to the JAAS login module performing
|
||||
* the authentication. No interactive user prompting is required because the
|
||||
* credentials are already available to this class (via its enclosing class).
|
||||
*/
|
||||
private final class JMXCallbackHandler implements CallbackHandler {
|
||||
|
||||
/**
|
||||
* Sets the username and password in the appropriate Callback object.
|
||||
*/
|
||||
public void handle(Callback[] callbacks)
|
||||
throws IOException, UnsupportedCallbackException {
|
||||
|
||||
for (int i = 0; i < callbacks.length; i++) {
|
||||
if (callbacks[i] instanceof NameCallback) {
|
||||
((NameCallback)callbacks[i]).setName(username);
|
||||
|
||||
} else if (callbacks[i] instanceof PasswordCallback) {
|
||||
((PasswordCallback)callbacks[i])
|
||||
.setPassword(password.toCharArray());
|
||||
|
||||
} else {
|
||||
throw new UnsupportedCallbackException
|
||||
(callbacks[i], "Unrecognized Callback");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* This class defines the JAAS configuration for file-based authentication.
|
||||
* It is equivalent to the following textual configuration entry:
|
||||
* <pre>
|
||||
* JMXPluggableAuthenticator {
|
||||
* com.sun.jmx.remote.security.FileLoginModule required;
|
||||
* };
|
||||
* </pre>
|
||||
*/
|
||||
private static class FileLoginConfig extends Configuration {
|
||||
|
||||
// The JAAS configuration for file-based authentication
|
||||
private AppConfigurationEntry[] entries;
|
||||
|
||||
// The classname of the login module for file-based authentication
|
||||
private static final String FILE_LOGIN_MODULE =
|
||||
FileLoginModule.class.getName();
|
||||
|
||||
// The option that identifies the password file to use
|
||||
private static final String PASSWORD_FILE_OPTION = "passwordFile";
|
||||
|
||||
/**
|
||||
* Creates an instance of <code>FileLoginConfig</code>
|
||||
*
|
||||
* @param passwordFile A filepath that identifies the password file to use.
|
||||
* If null then the default password file is used.
|
||||
*/
|
||||
public FileLoginConfig(String passwordFile) {
|
||||
|
||||
Map<String, String> options;
|
||||
if (passwordFile != null) {
|
||||
options = new HashMap<String, String>(1);
|
||||
options.put(PASSWORD_FILE_OPTION, passwordFile);
|
||||
} else {
|
||||
options = Collections.emptyMap();
|
||||
}
|
||||
|
||||
entries = new AppConfigurationEntry[] {
|
||||
new AppConfigurationEntry(FILE_LOGIN_MODULE,
|
||||
AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
|
||||
options)
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the JAAS configuration for file-based authentication
|
||||
*/
|
||||
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
|
||||
|
||||
return name.equals(LOGIN_CONFIG_NAME) ? entries : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Refreshes the configuration.
|
||||
*/
|
||||
public void refresh() {
|
||||
// the configuration is fixed
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user