@ -25,80 +25,68 @@
package net.yacy.http ;
import java.io.IOException ;
import java.security.Principal ;
import javax.security.auth.Subject ;
import java.util.ArrayList ;
import net.yacy.data.UserDB.AccessRight ;
import net.yacy.data.UserDB.Entry ;
import net.yacy.search.Switchboard ;
import net.yacy.search.SwitchboardConstants ;
import org.eclipse.jetty.security.IdentityService ;
import org.eclipse.jetty.security.LoginService ;
import org.eclipse.jetty.security.MappedLoginService ;
import org.eclipse.jetty.server.UserIdentity ;
import org.eclipse.jetty.util.security.Credential ;
/ * *
* jetty login service , provides one admin user
* jetty login service , provides admin and YaCy . UserDB users with role assignment
* with DIGEST auth by default Jetty uses the name of the loginSevice as realmname ( which is part of all password hashes )
* /
public class YaCyLoginService extends MappedLoginService implements LoginService {
@Override
public String getName ( ) {
return "YaCy 'admin' Account (reset your password with bin/passwd.sh <new password>)" ;
}
@Override
protected UserIdentity loadUser ( String username ) {
if ( username = = null | | username . isEmpty ( ) ) return null ; // quick exit
final Switchboard sb = Switchboard . getSwitchboard ( ) ;
String adminuser = sb . getConfig ( SwitchboardConstants . ADMIN_ACCOUNT_USER_NAME , "admin" ) ;
Credential credential = null ;
String [ ] roles = null ;
if ( username . equals ( adminuser ) ) {
final String adminAccountBase64MD5 = sb . getConfig ( SwitchboardConstants . ADMIN_ACCOUNT_B64MD5 , "" ) ;
// in YaCy the credential hash is composed of username:pwd so the username is needed to create valid credential
// not just the password (as usually in Jetty). As the accountname for the std. adminuser is not stored a useridentity
// is created for current user (and the pwd checked against the stored username:pwd setting)
Credential credential = YaCyLegacyCredential . getCredential sFromConfig ( username , adminAccountBase64MD5 ) ;
= YaCyLegacyCredential . getCredential ForAdmin ( username , adminAccountBase64MD5 ) ;
// TODO: YaCy user:pwd hashes should longterm likely be switched to separable username + pwd-hash entries
// and/or the standard admin account username shuld be fix = "admin"
Principal userPrincipal = new MappedLoginService . KnownUser ( username , credential ) ;
Subject subject = new Subject ( ) ;
subject . getPrincipals ( ) . add ( userPrincipal ) ;
subject . getPrivateCredentials ( ) . add ( credential ) ;
subject . setReadOnly ( ) ;
IdentityService is = getIdentityService ( ) ;
return is . newUserIdentity ( subject , userPrincipal , new String [ ] { AccessRight . ADMIN_RIGHT . toString ( ) } ) ;
}
Entry user = sb . userDB . getEntry ( username ) ;
if ( user ! = null ) {
// assigning roles from userDB
String [ ] role = new String [ AccessRight . values ( ) . length ] ;
int i = 0 ;
for ( final AccessRight right : AccessRight . values ( ) ) {
if ( user . hasRight ( right ) ) {
role [ i ] = right . toString ( ) ;
i + + ;
roles = new String [ ] { AccessRight . ADMIN_RIGHT . toString ( ) } ;
} else {
Entry user = sb . userDB . getEntry ( username ) ;
if ( user ! = null & & user . getMD5EncodedUserPwd ( ) ! = null ) {
// assigning roles from userDB
ArrayList < String > roletmp = new ArrayList < String > ( ) ;
for ( final AccessRight right : AccessRight . values ( ) ) {
if ( user . hasRight ( right ) ) {
roletmp . add ( right . toString ( ) ) ;
}
}
if ( roletmp . size ( ) > 0 ) roles = roletmp . toArray ( new String [ roletmp . size ( ) ] ) ;
credential = YaCyLegacyCredential . getCredentialForUserDB ( username , user . getMD5EncodedUserPwd ( ) ) ;
}
}
if ( credential ! = null ) {
if ( roles ! = null ) {
return putUser ( username , credential , roles ) ;
} else {
return putUser ( username , credential ) ; // w/o role makes not much sense, but succeeds login....
}
Credential credential = YaCyLegacyCredential . getCredentials ( username , user . getMD5EncodedUserPwd ( ) ) ;
Principal userPrincipal = new MappedLoginService . KnownUser ( username , credential ) ;
Subject subject = new Subject ( ) ;
subject . getPrincipals ( ) . add ( userPrincipal ) ;
subject . getPrivateCredentials ( ) . add ( credential ) ;
subject . setReadOnly ( ) ;
IdentityService is = getIdentityService ( ) ;
return is . newUserIdentity ( subject , userPrincipal , role ) ;
}
return null ;
}
@Override
protected void loadUsers ( ) throws IOException {
// don't load any users into MappedLoginService on startup
// we use loadUser for dynamic checking
}
@Override
protected void loadUsers ( ) throws IOException {
// don't load any users into MappedLoginService on startup
// we use loadUser for dynamic checking
}
}
reger
11 years ago