001package org.apache.archiva.redback.integration.filter.authentication.digest;
002
003/*
004 * Licensed to the Apache Software Foundation (ASF) under one
005 * or more contributor license agreements.  See the NOTICE file
006 * distributed with this work for additional information
007 * regarding copyright ownership.  The ASF licenses this file
008 * to you under the Apache License, Version 2.0 (the
009 * "License"); you may not use this file except in compliance
010 * with the License.  You may obtain a copy of the License at
011 *
012 * http://www.apache.org/licenses/LICENSE-2.0
013 *
014 * Unless required by applicable law or agreed to in writing,
015 * software distributed under the License is distributed on an
016 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
017 * KIND, either express or implied.  See the License for the
018 * specific language governing permissions and limitations
019 * under the License.
020 */
021
022import org.apache.archiva.redback.authentication.AuthenticationException;
023import org.apache.archiva.redback.integration.filter.authentication.AbstractHttpAuthenticationFilter;
024import org.apache.archiva.redback.integration.filter.authentication.HttpAuthenticator;
025import org.apache.archiva.redback.integration.filter.authentication.basic.HttpBasicAuthentication;
026
027import javax.servlet.FilterChain;
028import javax.servlet.FilterConfig;
029import javax.servlet.ServletException;
030import javax.servlet.ServletRequest;
031import javax.servlet.ServletResponse;
032import javax.servlet.http.HttpServletRequest;
033import javax.servlet.http.HttpServletResponse;
034import java.io.IOException;
035
036/**
037 * HttpDigestAuthenticationFilter.
038 *
039 * Uses RFC 2617 and RFC 2069 to perform Digest authentication against the incoming client.
040 *
041 * <ul>
042 * <li><a href="http://www.faqs.org/rfcs/rfc2617.html">RFC 2617</a> - HTTP Authentication: Basic and Digest Access Authentication</li>
043 * <li><a href="http://www.faqs.org/rfcs/rfc2069.html">RFC 2069</a> - An Extension to HTTP : Digest Access Authentication</li>
044 * </ul>
045 *
046 * @author <a href="mailto:joakim@erdfelt.com">Joakim Erdfelt</a>
047 *
048 */
049public class HttpDigestAuthenticationFilter
050    extends AbstractHttpAuthenticationFilter
051{
052    private HttpDigestAuthentication httpAuthentication;
053
054    @Override
055    public void init( FilterConfig filterConfig )
056        throws ServletException
057    {
058        super.init( filterConfig );
059
060        httpAuthentication =
061            getApplicationContext().getBean( "httpAuthenticator#digest", HttpDigestAuthentication.class );
062
063    }
064
065    public void doFilter( ServletRequest request, ServletResponse response, FilterChain chain )
066        throws IOException, ServletException
067    {
068        if ( !( request instanceof HttpServletRequest ) )
069        {
070            throw new ServletException( "Can only process HttpServletRequest" );
071        }
072
073        if ( !( response instanceof HttpServletResponse ) )
074        {
075            throw new ServletException( "Can only process HttpServletResponse" );
076        }
077
078        HttpServletRequest httpRequest = (HttpServletRequest) request;
079        HttpServletResponse httpResponse = (HttpServletResponse) response;
080
081        try
082        {
083            httpAuthentication.setRealm( getRealmName() );
084            httpAuthentication.authenticate( httpRequest, httpResponse );
085        }
086        catch ( AuthenticationException e )
087        {
088            HttpAuthenticator httpauthn = new HttpBasicAuthentication();
089            httpauthn.challenge( httpRequest, httpResponse, getRealmName(), e );
090            return;
091        }
092
093        chain.doFilter( request, response );
094    }
095
096}