From 2269ea30965426d0eb91b5b014a5ad974536df87 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Thu, 12 Feb 2015 17:23:08 +0100 Subject: [PATCH] starting to implement an access token generator --- .../SailingGWT sdm.launch | 2 +- .../Security UI sdm.launch | 98 +++++++++---------- .../com/sap/sse/security/SecurityService.java | 8 ++ .../security/impl/SecurityServiceImpl.java | 18 ++++ .../security/jaxrs/api/SecurityResource.java | 19 ++++ 5 files changed, 95 insertions(+), 50 deletions(-) diff --git a/java/com.sap.sailing.gwt.ui/SailingGWT sdm.launch b/java/com.sap.sailing.gwt.ui/SailingGWT sdm.launch index b0332ffab3a..81118d7d4af 100755 --- a/java/com.sap.sailing.gwt.ui/SailingGWT sdm.launch +++ b/java/com.sap.sailing.gwt.ui/SailingGWT sdm.launch @@ -69,7 +69,7 @@ - + diff --git a/java/com.sap.sse.security.ui/Security UI sdm.launch b/java/com.sap.sse.security.ui/Security UI sdm.launch index c74715a12d6..7750b7dbad8 100644 --- a/java/com.sap.sse.security.ui/Security UI sdm.launch +++ b/java/com.sap.sse.security.ui/Security UI sdm.launch @@ -1,49 +1,49 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java index b3840233f21..a934dd1710e 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java @@ -139,4 +139,12 @@ public interface SecurityService extends ReplicableWithObjectInputStreamnull otherwise + */ + String getAccessToken(); + } diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java index db50118e4bc..72554df2998 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java @@ -101,6 +101,8 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica private static final Logger logger = Logger.getLogger(SecurityServiceImpl.class.getName()); + private static final String ACCESS_TOKEN_KEY = "access_token"; + private CachingSecurityManager securityManager; /** @@ -900,6 +902,22 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica + " does not have permission to read preferences of user " + username); } } + + @Override + public String getAccessToken() { + Subject subject = SecurityUtils.getSubject(); + final String token; + if (subject.isAuthenticated()) { + RandomNumberGenerator rng = new SecureRandomNumberGenerator(); + byte[] salt = rng.nextBytes().getBytes(); + token = hashPassword(new String(rng.nextBytes().getBytes()), salt); + User user = getCurrentUser(); + apply(s->s.internalSetPreference(user.getName(), ACCESS_TOKEN_KEY, token)); + } else { + token = null; + } + return token; + } // ----------------- Replication ------------- @Override diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java index a2199c495bd..f2dde163646 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java @@ -11,6 +11,8 @@ import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import javax.ws.rs.core.Response.Status; +import org.json.simple.JSONObject; + import com.sap.sse.security.jaxrs.AbstractSecurityResource; import com.sap.sse.security.shared.UserManagementException; @@ -42,6 +44,23 @@ public class SecurityResource extends AbstractSecurityResource { } return Response.ok("Logged in!", MediaType.TEXT_PLAIN).build(); } + + @POST + @Path("/access_token") + @Produces("application/json;charset=UTF-8") + public Response accessToken(@FormParam("username") String username, @FormParam("password") String password) { + try { + getService().login(username, password); + logger.info("Successfully logged in " + username + " with password"); + JSONObject response = new JSONObject(); + response.put("username", username); + response.put("access_token", getService().getAccessToken()); + } catch (UserManagementException e) { + logger.info("Logging in " + username + " with password failed: "+e.getMessage()); + return getSecurityErrorResponse(e.getMessage()); + } + return Response.ok("Logged in!", MediaType.TEXT_PLAIN).build(); + } @GET @Path("/logout")