/src/edu/ucsb/nceas/metacat/AuthSession.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 509

Added by bojilova over 23 years ago

AuthMcat
- new class for authentication through MCA; implements AuthInterface
AuthSession
- assigning HttpSession obj only after successful athentication;
- cleared isAuthenticated field - not needed
- cleared invalidate() method - not needed
AuthInterface
- added input parameters: user and password for getGroups() and getUsers() interfaces
needed for making connection to the auth server
MetaCatServlet
- changed the values of action paramet to "login" and "logout"
- added handleLogoutAction() method

     public class AuthSession {
       private String authClass = null;
       private HttpSession session = null;
       private AuthInterface authService = null;
       private boolean isAuthenticated = false;
       private String statusMessage = null;
       /**
        * Construct an AuthSession
+       *
        * @param request the request made from the client
        * @param username the username entered when login
        * @param password the password entered when login
        */
       public AuthSession(HttpServletRequest request,
                          String username, String password)
                          throws IllegalStateException {
       public AuthSession() throws Exception {
         // Initialize attributes
         isAuthenticated = false;
         // Determine our session authentication method and
         // create an instance of the auth class
         MetaCatUtil util = new MetaCatUtil();
         authClass = util.getOption("authclass");
         authService = (AuthInterface)createObject(authClass);
         // get the current session object, create one if necessary
         session = request.getSession(true);
         // if it is still in use invalidate and get a new one
         if ( !session.isNew() ) {
           session.invalidate();
           session = request.getSession(true);
+        }
         // store username & password in the session for later use, especially by
         // the authenticate() method
         session.setMaxInactiveInterval(-1);
         session.setAttribute("username", username);
         session.setAttribute("password", password);
         session.setAttribute("isAuthenticated", new Boolean(isAuthenticated));
+      }
       /**
        * determine if the credentials for this session are valid by
        * authenticating them using the authService configured for this session.
        * Data for authenticating is derived from the attributes stored in
        * the session object.
+       *
        * @param request the request made from the client
        * @param username the username entered when login
        * @param password the password entered when login
        */
       public boolean authenticate()
+      {
         String out = null;
         String username = (String)session.getAttribute("username");
         String password = (String)session.getAttribute("password");
       public boolean authenticate(HttpServletRequest request,
                             String username, String password)  {
         String message = null;
         try {
           if ( authService.authenticate(username, password) ) {
             this.isAuthenticated = true;
             this.session.setAttribute("isAuthenticated",
                                       new Boolean(isAuthenticated));
             String message = "User Authentication successful";
             this.session = getSession(request, username, password);
             message = "User Authentication successful";
             this.statusMessage = formatOutput("success", message);
             return true;
           } else {
             String message = "Authentication failed for user: " + username;
             invalidate(message);
             message = "Authentication failed for user: " + username;
+          }
         } catch ( ConnectException ce ) {
           String message = "Connection to the authentication service failed. "
           message = "Connection to the authentication service failed. "
                            + ce.getMessage();
           invalidate(message);
         } catch ( IllegalStateException ise ) {
           message = ise.getMessage();
+        }
         return this.isAuthenticated;
         this.statusMessage = formatOutput("error", message);
         return false;
+      }
       /** Get new HttpSession and store username & password in it */
       private HttpSession getSession(HttpServletRequest request,
                                 String username, String password)
                                     throws IllegalStateException {
         // get the current session object, create one if necessary
         HttpSession session = request.getSession(true);
         // if it is still in use invalidate and get a new one
         if ( !session.isNew() ) {
           session.invalidate();
           session = request.getSession(true);
+        }
         // store username & password in the session for later use, especially by
         // the authenticate() method
         session.setMaxInactiveInterval(-1);
         session.setAttribute("username", username);
         session.setAttribute("password", password);
         return session;
+      }
       /**
        * Get the message associated with authenticating this session. The
        * message is formatted in XML.
-...
         return this.statusMessage;
+      }
     /* NOT NEEDED
       /**
        * Determine if the session has been successfully authenticated
        * @returns boolean true if authentication was successful, false otherwise
        */
     /*
       public boolean isAuthenticated()
+      {
         return this.isAuthenticated;
+      }
     */
     /* NOT NEEDED
       /**
        * Invalidate this HTTPSession object.
        * All objects stored in the session are unbound.
        */
     /*
       private void invalidate(String message)
+      {
         this.isAuthenticated = false;
-...
         this.session.setAttribute("statusMessage", this.statusMessage);
         this.session.invalidate();
+      }
     */
       /*
        * format the output in xml for processing from client applications
+       *
-...
+       *
        * @param className the fully qualified name of the class to instantiate
        */
       private static Object createObject(String className)
+      {
       private static Object createObject(String className) throws Exception {
         Object object = null;
         try {
           Class classDefinition = Class.forName(className);
           object = classDefinition.newInstance();
         } catch (InstantiationException e) {
           System.out.println(e);
           throw e;
         } catch (IllegalAccessException e) {
           System.out.println(e);
           throw e;
         } catch (ClassNotFoundException e) {
           System.out.println(e);
           throw e;
+        }
         return object;
+      }

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 509

Added by bojilova over 23 years ago