AuthFilter.java

/*
** Module   : AuthFilter.css
** Abstract : Authentication servlet filter
**
** Copyright (c) 2017-2023, Golden Code Development Corporation.
**
** -#- -I- --Date-- ------------------------------Description----------------------------------
** 001 HC  20170612 Initial version.
** 002 GBB 20230825 SecurityManager context methods calls updated.
*/
/*
** This program is free software: you can redistribute it and/or modify
** it under the terms of the GNU Affero General Public License as
** published by the Free Software Foundation, either version 3 of the
** License, or (at your option) any later version.
**
** This program is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
** GNU Affero General Public License for more details.
**
** You may find a copy of the GNU Affero GPL version 3 at the following
** location: https://www.gnu.org/licenses/agpl-3.0.en.html
**
** Additional terms under GNU Affero GPL version 3 section 7:
**
**   Under Section 7 of the GNU Affero GPL version 3, the following additional
**   terms apply to the works covered under the License.  These additional terms
**   are non-permissive additional terms allowed under Section 7 of the GNU
**   Affero GPL version 3 and may not be removed by you.
**
**   0. Attribution Requirement.
**
**     You must preserve all legal notices or author attributions in the covered
**     work or Appropriate Legal Notices displayed by works containing the covered
**     work.  You may not remove from the covered work any author or developer
**     credit already included within the covered work.
**
**   1. No License To Use Trademarks.
**
**     This license does not grant any license or rights to use the trademarks
**     Golden Code, FWD, any Golden Code or FWD logo, or any other trademarks
**     of Golden Code Development Corporation. You are not authorized to use the
**     name Golden Code, FWD, or the names of any author or contributor, for
**     publicity purposes without written authorization.
**
**   2. No Misrepresentation of Affiliation.
**
**     You may not represent yourself as Golden Code Development Corporation or FWD.
**
**     You may not represent yourself for publicity purposes as associated with
**     Golden Code Development Corporation, FWD, or any author or contributor to
**     the covered work, without written authorization.
**
**   3. No Misrepresentation of Source or Origin.
**
**     You may not represent the covered work as solely your work.  All modified
**     versions of the covered work must be marked in a reasonable way to make it
**     clear that the modified work is not originating from Golden Code Development
**     Corporation or FWD.  All modified versions must contain the notices of
**     attribution required in this license.
*/
package com.goldencode.p2j.admin.server;

import com.goldencode.p2j.security.*;
import com.goldencode.p2j.security.SecurityManager;

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

/**
 * Authentication servlet filter. The class intercepts all HTTP requests and returns
 * 401 in case the request is not authenticated.
 */
public class AuthFilter
implements Filter
{
   /**
    * Filter initialization.
    *
    * @param   filterConfig
    *          Filter configuration.
    * 
    * @throws  ServletException
    *          The servlet exception
    */
   @Override
   public void init(FilterConfig filterConfig)
   throws ServletException
   {
   }

   /**
    * Main filter logic.
    *
    * @param   servletRequest
    *          Servlet request.
    * @param   servletResponse
    *          Servlet response.
    * @param   filterChain
    *          Filter chain.
    * 
    * @throws  IOException
    *          The IO exception
    * @throws  ServletException
    *          The servlet exception
    */
   @Override
   public void doFilter(ServletRequest servletRequest,
                        ServletResponse servletResponse,
                        FilterChain filterChain)
   throws IOException,
          ServletException
   {
      HttpServletRequest httpReq = (HttpServletRequest) servletRequest;
      HttpServletResponse httpResp = (HttpServletResponse) servletResponse;
      HttpSession session = httpReq.getSession();

      if (AuthServiceImpl.isAuthenticated(httpReq))
      {
         SecurityManager sm = SecurityManager.getInstance();
         try
         {
            sm.contextSm.setUniqueInitialSecurityContext();
            sm.contextSm.pushAndSwitchSecurityContextBySessionId(session.getId());
            try
            {
               filterChain.doFilter(servletRequest, servletResponse);
            }
            finally
            {
               sm.contextSm.popAndRestoreSecurityContext();
               sm.contextSm.dropInitialSecurityContext();
            }
         }
         catch (RestrictedUseException e)
         {
            throw new RuntimeException(e);
         }
      }
      else
      {
         httpResp.setStatus(401);
      }
   }

   /**
    * Filter finalization.
    */
   @Override
   public void destroy()
   {
      // no-op
   }
}