Source code

001/*
002    Licensed to the Apache Software Foundation (ASF) under one
003    or more contributor license agreements.  See the NOTICE file
004    distributed with this work for additional information
005    regarding copyright ownership.  The ASF licenses this file
006    to you under the Apache License, Version 2.0 (the
007    "License"); you may not use this file except in compliance
008    with the License.  You may obtain a copy of the License at
009
010       http://www.apache.org/licenses/LICENSE-2.0
011
012    Unless required by applicable law or agreed to in writing,
013    software distributed under the License is distributed on an
014    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015    KIND, either express or implied.  See the License for the
016    specific language governing permissions and limitations
017    under the License.
018 */
019package org.apache.wiki.auth.login;
020
021import org.apache.logging.log4j.LogManager;
022import org.apache.logging.log4j.Logger;
023import org.apache.wiki.api.core.Engine;
024import org.apache.wiki.auth.WikiPrincipal;
025import org.apache.wiki.util.FileUtil;
026import org.apache.wiki.util.HttpUtil;
027import org.apache.wiki.util.TextUtil;
028
029import javax.security.auth.callback.Callback;
030import javax.security.auth.callback.UnsupportedCallbackException;
031import javax.security.auth.login.LoginException;
032import javax.servlet.http.Cookie;
033import javax.servlet.http.HttpServletRequest;
034import javax.servlet.http.HttpServletResponse;
035import java.io.BufferedReader;
036import java.io.BufferedWriter;
037import java.io.File;
038import java.io.IOException;
039import java.io.InputStreamReader;
040import java.io.OutputStreamWriter;
041import java.io.Reader;
042import java.io.StringReader;
043import java.io.Writer;
044import java.nio.charset.StandardCharsets;
045import java.nio.file.Files;
046import java.util.UUID;
047
048
049/**
050 * Logs in a user based on a cookie stored in the user's computer.  The cookie
051 * information is stored in the <code>jspwiki.workDir</code>, under the directory
052 * {@value #COOKIE_DIR}.  For security purposes it is a very, very good idea
053 * to prevent access to this directory by everyone except the web server process;
054 * otherwise people having read access to this directory may be able to spoof
055 * other users.
056 * <p>
057 * The cookie directory is scrubbed of old entries at regular intervals.
058 * <p>
059 * This module must be used with a CallbackHandler (such as
060 * {@link WebContainerCallbackHandler}) that supports the following Callback
061 * types:
062 * </p>
063 *  <ol>
064 *  <li>{@link HttpRequestCallback}- supplies the cookie, which should contain
065 *      an unique id for fetching the UID.</li>
066 *  <li>{@link WikiEngineCallback} - allows access to the Engine itself.
067 *  </ol>
068 * <p>
069 * After authentication, a generic WikiPrincipal based on the username will be
070 * created and associated with the Subject.
071 * </p>
072 * @see javax.security.auth.spi.LoginModule#commit()
073 * @see CookieAssertionLoginModule
074 * @since 2.5.62
075 */
076public class CookieAuthenticationLoginModule extends AbstractLoginModule {
077
078    private static final Logger LOG = LogManager.getLogger( CookieAuthenticationLoginModule.class );
079    private static final String LOGIN_COOKIE_NAME = "JSPWikiUID";
080
081    /** The directory name under which the cookies are stored.  The value is {@value}. */
082    protected static final String COOKIE_DIR = "logincookies";
083
084    /**
085     * User property for setting how long the cookie is stored on the user's computer.
086     * The value is {@value}.  The default expiry time is 14 days.
087     */
088    public static final String PROP_LOGIN_EXPIRY_DAYS = "jspwiki.cookieAuthentication.expiry";
089
090    /**
091     * Built-in value for storing the cookie.
092     */
093    private static final int DEFAULT_EXPIRY_DAYS = 14;
094
095    private static long c_lastScrubTime;
096
097    /**
098     * Describes how often we scrub the cookieDir directory.
099     */
100    private static final long SCRUB_PERIOD = 60 * 60 * 1_000L; // In milliseconds
101
102    /**
103     * {@inheritDoc}
104     *
105     * @see javax.security.auth.spi.LoginModule#login()
106     */
107    @Override
108    public boolean login() throws LoginException {
109        // Otherwise, let's go and look for the cookie!
110        final HttpRequestCallback hcb = new HttpRequestCallback();
111        final WikiEngineCallback wcb = new WikiEngineCallback();
112        final Callback[] callbacks = new Callback[] { hcb, wcb };
113
114        try {
115            m_handler.handle( callbacks );
116            final HttpServletRequest request = hcb.getRequest();
117            final String uid = getLoginCookie( request );
118
119            if( uid != null ) {
120                final Engine engine = wcb.getEngine();
121                final File cookieFile = getCookieFile( engine, uid );
122                if( cookieFile != null && cookieFile.exists() && cookieFile.canRead() ) {
123                    try( final Reader in = new BufferedReader( new InputStreamReader( Files.newInputStream( cookieFile.toPath() ), StandardCharsets.UTF_8 ) ) ) {
124                        final String username = FileUtil.readContents( in );
125                        LOG.debug( "Logged in cookie authenticated name={}", username );
126
127                        // If login succeeds, commit these principals/roles
128                        m_principals.add( new WikiPrincipal( username, WikiPrincipal.LOGIN_NAME ) );
129
130                        // Tag the file so that we know that it has been accessed recently.
131                        return cookieFile.setLastModified( System.currentTimeMillis() );
132
133                    } catch( final IOException e ) {
134                        return false;
135                    }
136                }
137            }
138        } catch( final IOException e ) {
139            final String message = "IO exception; disallowing login.";
140            LOG.error( message, e );
141            throw new LoginException( message );
142        } catch( final UnsupportedCallbackException e ) {
143            final String message = "Unable to handle callback; disallowing login.";
144            LOG.error( message, e );
145            throw new LoginException( message );
146        }
147        return false;
148    }
149
150    /**
151     * Attempts to locate the cookie file.
152     *
153     * @param engine Engine
154     * @param uid An unique ID fetched from the user cookie
155     * @return A File handle, or null, if there was a problem.
156     */
157    private static File getCookieFile( final Engine engine, final String uid ) {
158        final File cookieDir = new File( engine.getWorkDir(), COOKIE_DIR );
159        if( !cookieDir.exists() ) {
160            cookieDir.mkdirs();
161        }
162        if( !cookieDir.canRead() ) {
163            LOG.error( "Cannot read from cookie directory! {}", cookieDir.getAbsolutePath() );
164            return null;
165        }
166        if( !cookieDir.canWrite() ) {
167            LOG.error( "Cannot write to cookie directory! {}", cookieDir.getAbsolutePath() );
168            return null;
169        }
170
171        //  Scrub away old files
172        final long now = System.currentTimeMillis();
173        if( now > ( c_lastScrubTime + SCRUB_PERIOD ) ) {
174            scrub( TextUtil.getIntegerProperty( engine.getWikiProperties(), PROP_LOGIN_EXPIRY_DAYS, DEFAULT_EXPIRY_DAYS ), cookieDir );
175            c_lastScrubTime = now;
176        }
177
178        //  Find the cookie file
179        final File file = new File( cookieDir, uid );
180        try {
181            if( file.getCanonicalPath().startsWith( cookieDir.getCanonicalPath() ) ) {
182                return file;
183            }
184        } catch( final IOException e ) {
185            LOG.error( "Problem retrieving login cookie, returning null: {}", e.getMessage() );
186            return null;
187        }
188        return null;
189    }
190
191    /**
192     * Extracts the login cookie UID from the servlet request.
193     *
194     * @param request The HttpServletRequest
195     * @return The UID value from the cookie, or null, if no such cookie exists.
196     */
197    private static String getLoginCookie( final HttpServletRequest request ) {
198        return HttpUtil.retrieveCookieValue( request, LOGIN_COOKIE_NAME );
199    }
200
201    /**
202     * Sets a login cookie based on properties set by the user.  This method also
203     * creates the cookie uid-username mapping in the work directory.
204     *
205     * @param engine   The Engine
206     * @param response The HttpServletResponse
207     * @param username The username for whom to create the cookie.
208     */
209    public static void setLoginCookie( final Engine engine, final HttpServletResponse response, final String username ) {
210        final UUID uid = UUID.randomUUID();
211        final int days = TextUtil.getIntegerProperty( engine.getWikiProperties(), PROP_LOGIN_EXPIRY_DAYS, DEFAULT_EXPIRY_DAYS );
212        final Cookie userId = getLoginCookie( uid.toString() );
213        userId.setMaxAge( days * 24 * 60 * 60 );
214        response.addCookie( userId );
215
216        final File cf = getCookieFile( engine, uid.toString() );
217        if( cf != null ) {
218            //  Write the cookie content to the cookie store file.
219            try( final Writer out = new BufferedWriter( new OutputStreamWriter( Files.newOutputStream( cf.toPath() ), StandardCharsets.UTF_8 ) ) ) {
220                FileUtil.copyContents( new StringReader( username ), out );
221                LOG.debug( "Created login cookie for user {} for {} days", username, days );
222            } catch( final IOException ex ) {
223                LOG.error( "Unable to create cookie file to store user id: {}", uid );
224            }
225        }
226    }
227
228    /**
229     * Clears away the login cookie, and removes the uid-username mapping file as well.
230     *
231     * @param engine   Engine
232     * @param request  Servlet request
233     * @param response Servlet response
234     */
235    public static void clearLoginCookie( final Engine engine, final HttpServletRequest request, final HttpServletResponse response ) {
236        final Cookie userId = getLoginCookie( "" );
237        userId.setMaxAge( 0 );
238        response.addCookie( userId );
239        final String uid = getLoginCookie( request );
240        if( uid != null ) {
241            final File cf = getCookieFile( engine, uid );
242            if( cf != null ) {
243                if( !cf.delete() ) {
244                    LOG.debug( "Error deleting cookie login {}", uid );
245                }
246            }
247        }
248    }
249
250    /**
251     * Helper function to get secure LOGIN cookie
252     *
253     * @param value of the cookie
254     */
255    private static Cookie getLoginCookie( final String value ) {
256        final Cookie c = new Cookie( LOGIN_COOKIE_NAME, value );
257        c.setHttpOnly( true ); // no browser access
258        c.setSecure( true ); // only access via encrypted https allowed
259        return c;
260    }
261
262    /**
263     * Goes through the cookie directory and removes any obsolete files.
264     * The scrubbing takes place one day after the cookie was supposed to expire.
265     * However, if the user has logged in during the expiry period, the expiry is
266     * reset, and the cookie file left here.
267     *
268     * @param days number of days that the cookie will survive
269     * @param cookieDir cookie directory
270     */
271    private static synchronized void scrub( final int days, final File cookieDir ) {
272        LOG.debug( "Scrubbing cookieDir..." );
273        final File[] files = cookieDir.listFiles();
274        final long obsoleteDateLimit = System.currentTimeMillis() - ( ( long )days + 1 ) * 24 * 60 * 60 * 1000L;
275        int deleteCount = 0;
276
277        for( int i = 0; i < files.length; i++ ) {
278            final File f = files[ i ];
279            final long lastModified = f.lastModified();
280            if( lastModified < obsoleteDateLimit ) {
281                if( f.delete() ) {
282                    deleteCount++;
283                } else {
284                    LOG.debug( "Error deleting cookie login with index {}", i );
285                }
286            }
287        }
288
289        LOG.debug( "Removed {} obsolete cookie logins", deleteCount );
290    }
291
292}