001package org.apache.archiva.redback.integration.filter.authentication.digest; 002 003/* 004 * Licensed to the Apache Software Foundation (ASF) under one 005 * or more contributor license agreements. See the NOTICE file 006 * distributed with this work for additional information 007 * regarding copyright ownership. The ASF licenses this file 008 * to you under the Apache License, Version 2.0 (the 009 * "License"); you may not use this file except in compliance 010 * with the License. You may obtain a copy of the License at 011 * 012 * http://www.apache.org/licenses/LICENSE-2.0 013 * 014 * Unless required by applicable law or agreed to in writing, 015 * software distributed under the License is distributed on an 016 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 017 * KIND, either express or implied. See the License for the 018 * specific language governing permissions and limitations 019 * under the License. 020 */ 021 022import org.apache.archiva.redback.authentication.AuthenticationException; 023import org.apache.archiva.redback.integration.filter.authentication.AbstractHttpAuthenticationFilter; 024import org.apache.archiva.redback.integration.filter.authentication.HttpAuthenticator; 025import org.apache.archiva.redback.integration.filter.authentication.basic.HttpBasicAuthentication; 026 027import javax.servlet.FilterChain; 028import javax.servlet.FilterConfig; 029import javax.servlet.ServletException; 030import javax.servlet.ServletRequest; 031import javax.servlet.ServletResponse; 032import javax.servlet.http.HttpServletRequest; 033import javax.servlet.http.HttpServletResponse; 034import java.io.IOException; 035 036/** 037 * HttpDigestAuthenticationFilter. 038 * 039 * Uses RFC 2617 and RFC 2069 to perform Digest authentication against the incoming client. 040 * 041 * <ul> 042 * <li><a href="http://www.faqs.org/rfcs/rfc2617.html">RFC 2617</a> - HTTP Authentication: Basic and Digest Access Authentication</li> 043 * <li><a href="http://www.faqs.org/rfcs/rfc2069.html">RFC 2069</a> - An Extension to HTTP : Digest Access Authentication</li> 044 * </ul> 045 * 046 * @author <a href="mailto:joakim@erdfelt.com">Joakim Erdfelt</a> 047 * 048 */ 049public class HttpDigestAuthenticationFilter 050 extends AbstractHttpAuthenticationFilter 051{ 052 private HttpDigestAuthentication httpAuthentication; 053 054 @Override 055 public void init( FilterConfig filterConfig ) 056 throws ServletException 057 { 058 super.init( filterConfig ); 059 060 httpAuthentication = 061 getApplicationContext().getBean( "httpAuthenticator#digest", HttpDigestAuthentication.class ); 062 063 } 064 065 public void doFilter( ServletRequest request, ServletResponse response, FilterChain chain ) 066 throws IOException, ServletException 067 { 068 if ( !( request instanceof HttpServletRequest ) ) 069 { 070 throw new ServletException( "Can only process HttpServletRequest" ); 071 } 072 073 if ( !( response instanceof HttpServletResponse ) ) 074 { 075 throw new ServletException( "Can only process HttpServletResponse" ); 076 } 077 078 HttpServletRequest httpRequest = (HttpServletRequest) request; 079 HttpServletResponse httpResponse = (HttpServletResponse) response; 080 081 try 082 { 083 httpAuthentication.setRealm( getRealmName() ); 084 httpAuthentication.authenticate( httpRequest, httpResponse ); 085 } 086 catch ( AuthenticationException e ) 087 { 088 HttpAuthenticator httpauthn = new HttpBasicAuthentication(); 089 httpauthn.challenge( httpRequest, httpResponse, getRealmName(), e ); 090 return; 091 } 092 093 chain.doFilter( request, response ); 094 } 095 096}