/* * Copyright (c) 2004, 2008, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */ package com.sun.jmx.remote.security; import java.io.IOException;import java.security.AccessController;import java.security.Principal;import java.security.PrivilegedAction;import java.security.PrivilegedActionException;import java.security.PrivilegedExceptionAction;import java.util.Collections;import java.util.HashMap;import java.util.Map;import java.util.Properties;import javax.management.remote.JMXPrincipal;import javax.management.remote.JMXAuthenticator;import javax.security.auth.AuthPermission;import javax.security.auth.Subject;import javax.security.auth.callback.*;import javax.security.auth.login.AppConfigurationEntry;import javax.security.auth.login.Configuration;import javax.security.auth.login.LoginContext;import javax.security.auth.login.LoginException;import javax.security.auth.spi.LoginModule;import com.sun.jmx.remote.util.ClassLogger;import com.sun.jmx.remote.util.EnvHelp; /** * <p>This class represents a * <a href="{@docRoot}/../guide/security/jaas/JAASRefGuide.html">JAAS</a> * based implementation of the {@link JMXAuthenticator} interface.</p> * * <p>Authentication is performed by passing the supplied user's credentials * to one or more authentication mechanisms ({@link LoginModule}) for * verification. An authentication mechanism acquires the user's credentials * by calling {@link NameCallback} and/or {@link PasswordCallback}. * If authentication is successful then an authenticated {@link Subject} * filled in with a {@link Principal} is returned.  Authorization checks * will then be performed based on this <code>Subject</code>.</p> * * <p>By default, a single file-based authentication mechanism * {@link FileLoginModule} is configured (<code>FileLoginConfig</code>).</p> * * <p>To override the default configuration use the * <code>com.sun.management.jmxremote.login.config</code> management property * described in the JRE/lib/management/management.properties file. * Set this property to the name of a JAAS configuration entry and ensure that * the entry is loaded by the installed {@link Configuration}. In addition, * ensure that the authentication mechanisms specified in the entry acquire * the user's credentials by calling {@link NameCallback} and * {@link PasswordCallback} and that they return a {@link Subject} filled-in * with a {@link Principal}, for those users that are successfully * authenticated.</p> */public final class JMXPluggableAuthenticator implements JMXAuthenticator {     /**     * Creates an instance of <code>JMXPluggableAuthenticator</code>     * and initializes it with a {@link LoginContext}.     *     * @param env the environment containing configuration properties for the     *            authenticator. Can be null, which is equivalent to an empty     *            Map.     * @exception SecurityException if the authentication mechanism cannot be     *            initialized.     */    public JMXPluggableAuthenticator(Map<?, ?> env) {         String loginConfigName = null;        String passwordFile = null;         if (env != null) {            loginConfigName = (String) env.get(LOGIN_CONFIG_PROP);            passwordFile = (String) env.get(PASSWORD_FILE_PROP);        }         try {             if (loginConfigName != null) {                // use the supplied JAAS login configuration                loginContext =                    new LoginContext(loginConfigName, new JMXCallbackHandler());             } else {                // use the default JAAS login configuration (file-based)                SecurityManager sm = System.getSecurityManager();                if (sm != null) {                    sm.checkPermission(                            new AuthPermission("createLoginContext." +                                               LOGIN_CONFIG_NAME));                }                 final String pf = passwordFile;                try {                    loginContext = AccessController.doPrivileged(                        new PrivilegedExceptionAction<LoginContext>() {                            public LoginContext run() throws LoginException {                                return new LoginContext(                                                LOGIN_CONFIG_NAME,                                                null,                                                new JMXCallbackHandler(),                                                new FileLoginConfig(pf));                            }                        });                } catch (PrivilegedActionException pae) {                    throw (LoginException) pae.getException();                }            }         } catch (LoginException le) {            authenticationFailure("authenticate", le);         } catch (SecurityException se) {            authenticationFailure("authenticate", se);        }    }     /**     * Authenticate the <code>MBeanServerConnection</code> client     * with the given client credentials.     *     * @param credentials the user-defined credentials to be passed in     * to the server in order to authenticate the user before creating     * the <code>MBeanServerConnection</code>.  This parameter must     * be a two-element <code>String[]</code> containing the client's     * username and password in that order.     *     * @return the authenticated subject containing a     * <code>JMXPrincipal(username)</code>.     *     * @exception SecurityException if the server cannot authenticate the user     * with the provided credentials.     */    public Subject authenticate(Object credentials) {        // Verify that credentials is of type String[].        //        if (!(credentials instanceof String[])) {            // Special case for null so we get a more informative message            if (credentials == null)                authenticationFailure("authenticate", "Credentials required");             final String message =                "Credentials should be String[] instead of " +                 credentials.getClass().getName();            authenticationFailure("authenticate", message);        }        // Verify that the array contains two elements.        //        final String[] aCredentials = (String[]) credentials;        if (aCredentials.length != 2) {            final String message =                "Credentials should have 2 elements not " +                aCredentials.length;            authenticationFailure("authenticate", message);        }        // Verify that username exists and the associated        // password matches the one supplied by the client.        //        username = aCredentials[0];        password = aCredentials[1];        if (username == null || password == null) {            final String message = "Username or password is null";            authenticationFailure("authenticate", message);        }         // Perform authentication        try {            loginContext.login();            final Subject subject = loginContext.getSubject();            AccessController.doPrivileged(new PrivilegedAction<Void>() {                    public Void run() {                        subject.setReadOnly();                        return null;                    }                });             return subject;         } catch (LoginException le) {            authenticationFailure("authenticate", le);        }        return null;    }     private static void authenticationFailure(String method, String message)        throws SecurityException {        final String msg = "Authentication failed! " + message;        final SecurityException e = new SecurityException(msg);        logException(method, msg, e);        throw e;    }     private static void authenticationFailure(String method,                                              Exception exception)        throws SecurityException {        String msg;        SecurityException se;        if (exception instanceof SecurityException) {            msg = exception.getMessage();            se = (SecurityException) exception;        } else {            msg = "Authentication failed! " + exception.getMessage();            final SecurityException e = new SecurityException(msg);            EnvHelp.initCause(e, exception);            se = e;        }        logException(method, msg, se);        throw se;    }     private static void logException(String method,                                     String message,                                     Exception e) {        if (logger.traceOn()) {            logger.trace(method, message);        }        if (logger.debugOn()) {            logger.debug(method, e);        }    }     private LoginContext loginContext;    private String username;    private String password;    private static final String LOGIN_CONFIG_PROP =        "jmx.remote.x.login.config";    private static final String LOGIN_CONFIG_NAME = "JMXPluggableAuthenticator";    private static final String PASSWORD_FILE_PROP =        "jmx.remote.x.password.file";    private static final ClassLogger logger =        new ClassLogger("javax.management.remote.misc", LOGIN_CONFIG_NAME); /** * This callback handler supplies the username and password (which was * originally supplied by the JMX user) to the JAAS login module performing * the authentication. No interactive user prompting is required because the * credentials are already available to this class (via its enclosing class). */private final class JMXCallbackHandler implements CallbackHandler {     /**     * Sets the username and password in the appropriate Callback object.     */    public void handle(Callback[] callbacks)        throws IOException, UnsupportedCallbackException {         for (int i = 0; i < callbacks.length; i++) {            if (callbacks[i] instanceof NameCallback) {                ((NameCallback)callbacks[i]).setName(username);             } else if (callbacks[i] instanceof PasswordCallback) {                ((PasswordCallback)callbacks[i])                    .setPassword(password.toCharArray());             } else {                throw new UnsupportedCallbackException                    (callbacks[i], "Unrecognized Callback");            }        }    }} /** * This class defines the JAAS configuration for file-based authentication. * It is equivalent to the following textual configuration entry: * <pre> *     JMXPluggableAuthenticator { *         com.sun.jmx.remote.security.FileLoginModule required; *     }; * </pre> */private static class FileLoginConfig extends Configuration {     // The JAAS configuration for file-based authentication    private AppConfigurationEntry[] entries;     // The classname of the login module for file-based authentication    private static final String FILE_LOGIN_MODULE =        FileLoginModule.class.getName();     // The option that identifies the password file to use    private static final String PASSWORD_FILE_OPTION = "passwordFile";     /**     * Creates an instance of <code>FileLoginConfig</code>     *     * @param passwordFile A filepath that identifies the password file to use.     *                     If null then the default password file is used.     */    public FileLoginConfig(String passwordFile) {         Map<String, String> options;        if (passwordFile != null) {            options = new HashMap<String, String>(1);            options.put(PASSWORD_FILE_OPTION, passwordFile);        } else {            options = Collections.emptyMap();        }         entries = new AppConfigurationEntry[] {            new AppConfigurationEntry(FILE_LOGIN_MODULE,                AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,                    options)        };    }     /**     * Gets the JAAS configuration for file-based authentication     */    public AppConfigurationEntry[] getAppConfigurationEntry(String name) {         return name.equals(LOGIN_CONFIG_NAME) ? entries : null;    }     /**     * Refreshes the configuration.     */    public void refresh() {        // the configuration is fixed    }} }