pegasus/src/Pegasus/Security/Authentication/AuthenticationManager.cpp - diff

Return to AuthenticationManager.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Security / Authentication

Diff for /pegasus/src/Pegasus/Security/Authentication/AuthenticationManager.cpp between version 1.9 and 1.33

version 1.9, 2002/06/01 00:57:24

version 1.33, 2008/05/12 09:14:56

Line 1

//%/////////////////////////////////////////////////////////////////////////////

//%2006////////////////////////////////////////////////////////////////////////

// The Open Group, Tivoli Systems

// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.

// IBM Corp.; EMC Corporation, The Open Group.

// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.

// EMC Corporation; VERITAS Software Corporation; The Open Group.

// EMC Corporation; Symantec Corporation; The Open Group.

// Permission is hereby granted, free of charge, to any person obtaining a copy

// of this software and associated documentation files (the "Software"), to

Line 21

Line 29

//==============================================================================

// Author: Nag Boranna, Hewlett-Packard Company(nagaraja_boranna@hp.com)

// Modified By:

//%/////////////////////////////////////////////////////////////////////////////

#include <Pegasus/Common/System.h>

#include <Pegasus/Common/XmlWriter.h>

#include <Pegasus/Common/Destroyer.h>

#include <Pegasus/Common/Tracer.h>

#include <Pegasus/Common/PegasusVersion.h>

#include <Pegasus/Common/HTTPMessage.h>

#include <Pegasus/Config/ConfigManager.h>

Line 39

Line 43

#include "BasicAuthenticationHandler.h"

#include "AuthenticationManager.h"

#include <Pegasus/Common/AutoPtr.h>

#ifdef PEGASUS_KERBEROS_AUTHENTICATION

#include "KerberosAuthenticationHandler.h"

#endif

PEGASUS_USING_STD;

PEGASUS_NAMESPACE_BEGIN

Line 72

Line 83

// delete authentication handlers

if ( _localAuthHandler )

{

delete _localAuthHandler;

}

if ( _httpAuthHandler )

{

delete _httpAuthHandler;

}

PEG_METHOD_EXIT();

}

Boolean AuthenticationManager::isRemotePrivilegedUserAccessAllowed(

String & userName)

{

// Reject access if the user is privileged and remote privileged user

// access is not enabled.

if (!ConfigManager::parseBooleanValue(ConfigManager::getInstance()->

getCurrentValue("enableRemotePrivilegedUserAccess"))

&& System::isPrivilegedUser(userName))

{

PEG_TRACE((TRC_AUTHENTICATION, Tracer::LEVEL2,

"Authentication failed for user '%s' because "

"enableRemotePrivilegedUserAccess is not set to 'true'.",

(const char*) userName.getCString()));

Logger::put_l(

Logger::STANDARD_LOG, System::CIMSERVER, Logger::INFORMATION,

"Security.Authentication.BasicAuthenticationHandler."

"PRIVILEGED_ACCESS_DISABLED",

"Authentication failed for user '$0' because "

"enableRemotePrivilegedUserAccess is not set to 'true'.",

userName);

return false;

}

return true;

}

// Perform http authentication

Boolean AuthenticationManager::performHttpAuthentication

Boolean AuthenticationManager::performHttpAuthentication(

(

const String& authHeader,

AuthenticationInfo* authInfo

AuthenticationInfo* authInfo)

)

{

PEG_METHOD_ENTER(

PEG_METHOD_ENTER(TRC_AUTHENTICATION,

TRC_AUTHENTICATION, "AuthenticationManager::performHttpAuthentication()");

"AuthenticationManager::performHttpAuthentication()");

String authType = String::EMPTY;

String cookie = String::EMPTY;

String authType;

String cookie;

// Parse the HTTP authentication header for authentication information

if ( !_parseHttpAuthHeader(authHeader, authType, cookie) )

if ( !HTTPMessage::parseHttpAuthHeader(authHeader, authType, cookie) )

{

PEG_TRACE((

TRC_DISCARDED_DATA,

Tracer::LEVEL2,

"HTTPAuthentication failed. "

"Malformed HTTP authentication header: %s",

(const char*)authHeader.getCString()));

PEG_METHOD_EXIT();

return false;

}

Line 119

Line 154

{

authenticated = _httpAuthHandler->authenticate(cookie, authInfo);

}

#ifdef PEGASUS_KERBEROS_AUTHENTICATION

else if ( String::equalNoCase(authType, "Negotiate") &&

String::equalNoCase(_httpAuthType, "Kerberos") )

{

authenticated = _httpAuthHandler->authenticate(cookie, authInfo);

}

#endif

// FUTURE: Add code to check for "Digest" when digest

// authentication is implemented.

if ( authenticated )

{

authInfo->setAuthStatus(AuthenticationInfoRep::AUTHENTICATED);

authInfo->setAuthType(authType);

}

PEG_METHOD_EXIT();

return ( authenticated );

return authenticated;

}

// Perform pegasus sepcific local authentication

Boolean AuthenticationManager::performPegasusAuthentication

Boolean AuthenticationManager::performPegasusAuthentication(

(

const String& authHeader,

AuthenticationInfo* authInfo

AuthenticationInfo* authInfo)

)

{

PEG_METHOD_ENTER(

PEG_METHOD_ENTER(TRC_AUTHENTICATION,

TRC_AUTHENTICATION, "AuthenticationManager::performPegasusAuthentication()");

"AuthenticationManager::performPegasusAuthentication()");

Boolean authenticated = false;

String authType = String::EMPTY;

String authType;

String userName = String::EMPTY;

String userName;

String cookie = String::EMPTY;

String cookie;

// Parse the pegasus authentication header authentication information

if ( !_parseLocalAuthHeader(authHeader, authType, userName, cookie) )

if ( !HTTPMessage::parseLocalAuthHeader(authHeader,

{

authType, userName, cookie) )

PEG_METHOD_EXIT();

return false;

}

// Note: Pegasus LocalPrivileged authentication is not being used, but the

// code is kept here so that we can use it in the future if needed.

#if defined(PEGASUS_LOCAL_PRIVILEGED_AUTHENTICATION)

if ( String::equalNoCase(authType, "LocalPrivileged") )

{

if (authInfo->isAuthenticated() && authInfo->isPrivileged() &&

String::equal(userName, authInfo->getAuthenticatedUser()))

{

PEG_METHOD_EXIT();

return true;

}

#endif

if ( String::equalNoCase(authType, "Local") )

{

if (authInfo->isAuthenticated() &&

String::equal(userName, authInfo->getAuthenticatedUser()))

{

PEG_METHOD_EXIT();

return true;

}

else

{

PEG_TRACE((

TRC_DISCARDED_DATA,

Tracer::LEVEL2,

"PegasusAuthentication failed. "

"Malformed Pegasus authentication header: %s",

(const char*)authHeader.getCString()));

PEG_METHOD_EXIT();

return false;

}

// The HTTPAuthenticatorDelegator ensures only local authentication

// Check if the authentication information is present

// requests get here.

PEGASUS_ASSERT(authType == "Local");

if ( String::equal(cookie, String::EMPTY) )

{

PEG_METHOD_EXIT();

return false;

}

authenticated =

_localAuthHandler->authenticate(cookie, authInfo);

if ( authenticated )

{

authInfo->setAuthStatus(AuthenticationInfoRep::AUTHENTICATED);

#if defined(PEGASUS_LOCAL_PRIVILEGED_AUTHENTICATION)

if ( String::equal(authType, "LocalPrivileged") )

{

authInfo->setPrivileged(true);

}

else

{

authInfo->setPrivileged(false);

}

#endif

authInfo->setAuthType(authType);

}

PEG_METHOD_EXIT();

return ( authenticated );

return authenticated;

}

// Validate user.

Boolean AuthenticationManager::validateUserForHttpAuth (const String& userName)

{

return _httpAuthHandler->validateUser(userName);

}

// Get pegasus/local authentication response header

String AuthenticationManager::getPegasusAuthResponseHeader

String AuthenticationManager::getPegasusAuthResponseHeader(

(

const String& authHeader,

AuthenticationInfo* authInfo

AuthenticationInfo* authInfo)

)

{

PEG_METHOD_ENTER(

PEG_METHOD_ENTER(TRC_AUTHENTICATION,

TRC_AUTHENTICATION, "AuthenticationManager::getPegasusAuthResponseHeader()");

"AuthenticationManager::getPegasusAuthResponseHeader()");

String respHeader = String::EMPTY;

String respHeader;

String authType = String::EMPTY;

String authType;

String userName = String::EMPTY;

String userName;

String cookie = String::EMPTY;

String cookie;

// Parse the pegasus authentication header authentication information

if ( !_parseLocalAuthHeader(authHeader, authType, userName, cookie) )

if ( !HTTPMessage::parseLocalAuthHeader(authHeader,

authType, userName, cookie) )

{

PEG_METHOD_EXIT();

return (respHeader);

return respHeader;

}

Line 260

Line 263

if ( String::equal(userName, String::EMPTY) )

{

PEG_METHOD_EXIT();

return (respHeader);

return respHeader;

}

respHeader =

Line 268

Line 271

PEG_METHOD_EXIT();

return (respHeader);

return respHeader;

}

// Get HTTP authentication response header

#ifdef PEGASUS_KERBEROS_AUTHENTICATION

String AuthenticationManager::getHttpAuthResponseHeader(

AuthenticationInfo* authInfo)

#else

String AuthenticationManager::getHttpAuthResponseHeader()

#endif

{

PEG_METHOD_ENTER(

PEG_METHOD_ENTER(TRC_AUTHENTICATION,

TRC_AUTHENTICATION, "AuthenticationManager::getHttpAuthResponseHeader()");

"AuthenticationManager::getHttpAuthResponseHeader()");

#ifdef PEGASUS_KERBEROS_AUTHENTICATION

String respHeader = _httpAuthHandler->getAuthResponseHeader(

String::EMPTY, String::EMPTY, authInfo);

#else

String respHeader = _httpAuthHandler->getAuthResponseHeader();

#endif

PEG_METHOD_EXIT();

return (respHeader);

return respHeader;

}

// parse the local authentication header

Boolean AuthenticationManager::_parseLocalAuthHeader(

const String& authHeader, String& authType, String& userName, String& cookie)

{

PEG_METHOD_ENTER(

TRC_AUTHENTICATION, "AuthenticationManager::_parseLocalAuthHeader()");

// Extract the authentication type:

Uint32 space = authHeader.find(' ');

if ( space == PEGASUS_NOT_FOUND )

{

PEG_METHOD_EXIT();

return false;

}

authType = authHeader.subString(0, space);

Uint32 startQuote = authHeader.find(space, '"');

if ( startQuote == PEG_NOT_FOUND )

{

PEG_METHOD_EXIT();

return false;

}

Uint32 endQuote = authHeader.find(startQuote + 1, '"');

if ( endQuote == PEG_NOT_FOUND )

{

PEG_METHOD_EXIT();

return false;

}

String temp = authHeader.subString(

startQuote + 1, (endQuote - startQuote - 1));

// Extract the user name and cookie:

Uint32 colon = temp.find(0, ':');

if ( colon == PEG_NOT_FOUND )

{

userName = temp;

}

else

{

userName = temp.subString(0, colon);

cookie = temp;

}

PEG_METHOD_EXIT();

return true;

}

// parse the HTTP authentication header

Boolean AuthenticationManager::_parseHttpAuthHeader(

const String& authHeader, String& authType, String& cookie)

{

PEG_METHOD_ENTER(

TRC_AUTHENTICATION, "AuthenticationManager::_parseHttpAuthHeader()");

// Extract the authentication type:

Uint32 space = authHeader.find(' ');

if ( space == PEGASUS_NOT_FOUND )

{

PEG_METHOD_EXIT();

return false;

}

authType = authHeader.subString(0, space);

// Extract the cookie:

cookie = authHeader.subString(space + 1);

PEG_METHOD_EXIT();

return true;

}

// Get local authentication handler

Authenticator* AuthenticationManager::_getLocalAuthHandler()

Line 391

Line 312

// create and return a local authentication handler.

return (new LocalAuthenticationHandler());

return new LocalAuthenticationHandler();

}

Line 402

Line 323

{

PEG_METHOD_ENTER(

TRC_AUTHENTICATION, "AuthenticationManager::_getHttpAuthHandler()");

AutoPtr<Authenticator> handler;

Authenticator* handler = 0;

// get the configured authentication type

ConfigManager* configManager = ConfigManager::getInstance();

AutoPtr<ConfigManager> configManager(ConfigManager::getInstance());

_httpAuthType = configManager->getCurrentValue("httpAuthType");

configManager.release();

// create a authentication handler.

if ( String::equalNoCase(_httpAuthType, "Basic") )

{

handler = (Authenticator* ) new BasicAuthenticationHandler( );

handler.reset((Authenticator* ) new BasicAuthenticationHandler( ));

}

#ifdef PEGASUS_KERBEROS_AUTHENTICATION

else if ( String::equalNoCase(_httpAuthType, "Kerberos") )

{

handler.reset((Authenticator*) new KerberosAuthenticationHandler());

AutoPtr<KerberosAuthenticationHandler> kerberosHandler(

(KerberosAuthenticationHandler *)handler.get());

int itFailed = kerberosHandler->initialize();

kerberosHandler.release();

if (itFailed)

{

if (handler.get())

{

handler.reset(0);

}

Logger::put_l(Logger::ERROR_LOG, System::CIMSERVER, Logger::SEVERE,

"Security.Authentication.AuthenticationManager."

"AUTHENTICATION_HANDLER_KERBEROS_FAILED_TO_INITIALIZE",

"CIMOM server authentication handler for Kerberos failed to "

"initialize properly.");

MessageLoaderParms parms(

"Security.Authentication.AuthenticationManager."

"AUTHENTICATION_HANDLER_KERBEROS_FAILED_TO_INITIALIZE",

"CIMOM server authentication handler for Kerberos failed to "

"initialize properly.");

throw Exception(parms);

}

#endif

// FUTURE: uncomment these line when Digest authentication

// is implemented.

Line 436

Line 384

}

PEG_METHOD_EXIT();

return handler.release();

return ( handler );

}

PEGASUS_NAMESPACE_END

Legend:

Removed from v.1.9
changed lines
	Added in v.1.33

No CVS admin address has been configured