import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
private boolean authenticateViaGateway(RequiredAuthentication required, boolean isGuest, String authenticatorKey, String remoteUser)
{
    // Validate the authenticator key, and if valid set the fully authenticated user.
    if (validAuthenticatorKeys.contains(authenticatorKey))
    {
        AuthenticationUtil.setFullyAuthenticatedUser(remoteUser);
        proxyListener.userAuthenticated(new PublicApiCredentials(authenticatorKey, remoteUser, getOutboundHeaders(servletReq)));
        return true;
    }
    else
    {
        logger.error("Invalid authenticator key:- " + authenticatorKey);
        proxyListener.authenticationFailed(new PublicApiCredentials(authenticatorKey, remoteUser, getOutboundHeaders(servletReq)));
        return false;
    }
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Test
public void testLogInWithNonExistingPerson()
{
    // Random non existing person
    final String username = GUID.generate();

    // Mock a request with a username in the header
    HttpServletRequest mockHttpRequest = mock(HttpServletRequest.class);
    when(mockHttpRequest.getHeader("X-Alfresco-Remote-User")).thenReturn(username);
    when(mockHttpRequest.getScheme()).thenReturn("http");
    WebScriptServletRequest mockRequest = mock(WebScriptServletRequest.class);
    when(mockRequest.getHttpServletRequest()).thenReturn(mockHttpRequest);

    HttpServletResponse mockHttpResponse = mock(HttpServletResponse.class);
    WebScriptServletResponse mockResponse = mock(WebScriptServletResponse.class);
    when(mockResponse.getHttpServletResponse()).thenReturn(mockHttpResponse);

    Authenticator authenticator = remoteUserAuthenticatorFactory.create(mockRequest, mockResponse);
    assertTrue("The non existing user should be authenticated.", authenticator.authenticate(RequiredAuthentication.user, false));
    assertTrue("The user should be auto created.", personService.personExists(username));
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Override
protected void service(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException
{
    ServletContext context = getServletContext();
    boolean isGuest = (Boolean) req.getAttribute(ATTR_IS_GUEST);
    RequiredAuthentication required = (RequiredAuthentication) req.getAttribute(ATTR_REQUIRED_AUTH);
    AuthenticationStatus status;
    if (isGuest && RequiredAuthentication.guest == required)
    {
        if (logger.isDebugEnabled())
            logger.debug("Authenticating as Guest");

        status = AuthenticationHelper.authenticate(context, req, res, true);
    }
    else
    {
        if (logger.isDebugEnabled())
            logger.debug("Authenticating session");

        status = AuthenticationHelper.authenticate(context, req, res, false, false);
    }
    req.setAttribute(ATTR_AUTH_STATUS, status);
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Override
public boolean authenticate(RequiredAuthentication required, boolean isGuest)
{
    if (! emptyCredentials())
    {
        AuthenticationUtil.setRunAsUser(userName);
        return true;
    }
    return false;
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Override
public RequiredAuthentication getRequiredAuthentication()
{
    if (AuthenticationUtil.isMtEnabled())
    {
        return RequiredAuthentication.guest; // user or guest (ie. at least guest)
    }
    
    return RequiredAuthentication.none;
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Override
public boolean authenticate(Authenticator auth, RequiredAuthentication required)
{
    if (auth != null)
    {
        AuthenticationUtil.clearCurrentSecurityContext();
        
        return auth.authenticate(required, false);
    }
    
    return false;
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
public boolean authenticate(RequiredAuthentication required, boolean isGuest)
{
    // first look for the username key in the session - we add this by hand for some portals
    // when the WebScriptPortletRequest is created
    String portalUser = (String)req.getPortletSession().getAttribute(WebScriptPortletRequest.ALFPORTLETUSERNAME);
    if (portalUser == null)
    {
        portalUser = req.getRemoteUser();
    }
    
    if (logger.isDebugEnabled())
    {
        logger.debug("JSR-168 Remote user: " + portalUser);
    }
    
    if (isGuest || portalUser == null)
    {
        if (logger.isDebugEnabled())
            logger.debug("Authenticating as Guest");
        
        // authenticate as guest
        AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil.getGuestUserName());
    }
    else
    {
        if (logger.isDebugEnabled())
            logger.debug("Authenticating as user " + portalUser);

        UserTransaction txn = null;
        try
        {
        	txn = txnService.getUserTransaction();
        	txn.begin();

        	if (!unprotAuthenticationService.authenticationExists(portalUser))
        	{
        		throw new WebScriptException(HttpServletResponse.SC_FORBIDDEN, "User " + portalUser + " is not a known Alfresco user");
        	}
        	AuthenticationUtil.setFullyAuthenticatedUser(portalUser);
        }
        catch (Throwable err)
        {
        	throw new AlfrescoRuntimeException("Error authenticating user: " + portalUser, err);
        }
        finally
        {
        	try
        	{
        		if (txn != null)
        		{
        			txn.rollback();
        		}
        	}
        	catch (Exception tex)
        	{
        		// nothing useful we can do with this
        	}
        }
    }
    
    return true;
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
private void initWebScript(WebScript webScript, String name)
{
    DescriptionImpl serviceDesc = new DescriptionImpl(name, name, name, name);
    serviceDesc.setRequiredAuthentication(RequiredAuthentication.user);
    TransactionParameters transactionParameters = new TransactionParameters();
    transactionParameters.setRequired(RequiredTransaction.required);
    transactionParameters.setCapability(TransactionCapability.readonly);
    serviceDesc.setRequiredTransactionParameters(transactionParameters);
    serviceDesc.setFormatStyle(FormatStyle.argument);
    serviceDesc.setDefaultFormat("json");
    serviceDesc.setUris(new String[] { name });
    webScript.init(container, serviceDesc);
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Test
public void testEnabledUser() throws Exception
{
    final String username = transactionService.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<String>()
    {
        @Override
        public String execute() throws Throwable
        {
            return AuthenticationUtil.runAs(new RunAsWork<String>()
            {
                @Override
                public String doWork() throws Exception
                {
                    return createPerson(true);
                }
            }, AuthenticationUtil.SYSTEM_USER_NAME);
        }
    }, false, true);

    // Mock a request with a username in the header
    HttpServletRequest mockHttpRequest = mock(HttpServletRequest.class);
    when(mockHttpRequest.getHeader("X-Alfresco-Remote-User")).thenReturn(username);
    when(mockHttpRequest.getScheme()).thenReturn("http");
    WebScriptServletRequest mockRequest = mock(WebScriptServletRequest.class);
    when(mockRequest.getHttpServletRequest()).thenReturn(mockHttpRequest);

    HttpServletResponse mockHttpResponse = mock(HttpServletResponse.class);
    WebScriptServletResponse mockResponse = mock(WebScriptServletResponse.class);
    when(mockResponse.getHttpServletResponse()).thenReturn(mockHttpResponse);

    Authenticator authenticator = remoteUserAuthenticatorFactory.create(mockRequest, mockResponse);
    assertTrue(authenticator.authenticate(RequiredAuthentication.user, false));
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
protected void executeScriptImpl(final WebScriptRequest scriptReq, final WebScriptResponse scriptRes, final Authenticator auth)
        throws IOException
{
    // Handle authentication of scripts on a case-by-case basis.
    // Currently we assume that if a webscript servlet has any authenticator
    // applied then it must be for some kind of remote user auth as supplied.
    final WebScript script = scriptReq.getServiceMatch().getWebScript();
    script.setURLModelFactory(this.getUrlModelFactory());
    final Description desc = script.getDescription();
    final RequiredAuthentication required = desc.getRequiredAuthentication();
    if (auth == null || RequiredAuthentication.none == required || auth.authenticate(required, false))
    {
        script.execute(scriptReq, scriptRes);
    }
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
private void initWebScript(WebScript webScript, String name)
{
	DescriptionImpl serviceDesc = new DescriptionImpl(name, name, name, name);
	serviceDesc.setRequiredAuthentication(RequiredAuthentication.user);
	TransactionParameters transactionParameters = new TransactionParameters();
	transactionParameters.setRequired(RequiredTransaction.required);
	transactionParameters.setCapability(TransactionCapability.readonly);
	serviceDesc.setRequiredTransactionParameters(transactionParameters);
	serviceDesc.setFormatStyle(FormatStyle.argument);
	serviceDesc.setDefaultFormat("json");
	serviceDesc.setUris(new String[] { name });
    webScript.init(container, serviceDesc);
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
public void doFilter(ServletContext context, ServletRequest sreq, ServletResponse sresp, FilterChain chain)
        throws IOException, ServletException
{
    // Get the HTTP request/response
    HttpServletRequest req = (HttpServletRequest)sreq;
    
    // find a webscript match for the requested URI
    String requestURI = req.getRequestURI();
    String pathInfo = requestURI.substring((req.getContextPath() + req.getServletPath()).length());
    
    if (getLogger().isDebugEnabled())
        getLogger().debug("Processing request: " + requestURI + " SID:" +
                (req.getSession(false) != null ? req.getSession().getId() : null));
    
    Match match = container.getRegistry().findWebScript(req.getMethod(), URLDecoder.decode(pathInfo));
    if (match != null && match.getWebScript() != null)
    {
        // check the authentication required - if none then we don't want any of
        // the filters down the chain to require any authentication checks
        if (RequiredAuthentication.none == match.getWebScript().getDescription().getRequiredAuthentication())
        {
            if (getLogger().isDebugEnabled())
                getLogger().debug("Found webscript with no authentication - set NO_AUTH_REQUIRED flag.");
            req.setAttribute(NO_AUTH_REQUIRED, Boolean.TRUE);
        }
    }

    chain.doFilter(sreq, sresp);
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Override
public boolean doAuthorize(String username, RequiredAuthentication role)
{
    return username != null && username.equals(permittedUsername);
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
public boolean authenticate(RequiredAuthentication required, boolean isGuest)
{
    boolean authorized = false;
    try
    {
        String authenticatorKey = servletReq.getHeader(authenticatorKeyHeader);
        String remoteUser = getRemoteUser();
        if (authenticatorKey != null && remoteUser != null)
        {
            // Trusted auth. Validate key and setup authentication context.
            authorized = authenticateViaGateway(required, isGuest, authenticatorKey, remoteUser);
        }
        else
        {
            // Fallback to parent authenticator
            try
            {
                authorized = super.authenticate(required, isGuest);
            }
            catch (AuthenticationException ae)
            {
                // e.g. guest
                if (logger.isDebugEnabled())
                    logger.debug("TenantBasicHttpAuthenticator: required="+required+", isGuest="+isGuest+" - "+ae.getMessage());
            }
        }
        if (authorized)
        {
            // check tenant validity
            final String tenant = servletReq.getTenant();
            final String email = AuthenticationUtil.getFullyAuthenticatedUser();
            try
            {
                authorized = retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Boolean>()
                {
                    public Boolean execute() throws Exception
                    {
                        return tenantAuthentication.authenticateTenant(email, tenant);
                    }
                }, true, false);
            }
            finally
            {
                if (!authorized)
                {
                    listener.authenticationFailed(new TenantCredentials(tenant, email, proxyListener.getOrignalCredentials()));
                    AuthenticationUtil.clearCurrentSecurityContext();
                }
                else
                {
                    listener.userAuthenticated(new TenantCredentials(tenant, email, proxyListener.getOrignalCredentials()));
                }
            }
        }
        return authorized;
    }
    finally
    {
        if (!authorized)
        {
            servletRes.setStatus(401);
            String scheme = useBasicAuth ? "Basic" : "AlfTicket";
            String challenge = scheme + " realm=\"Alfresco " + servletReq.getTenant() + " tenant\"";
            servletRes.setHeader("WWW-Authenticate", challenge);
        }
    }
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Test
public void testDisabledUser() throws Exception
{
    final String username = transactionService.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<String>()
    {
        @Override
        public String execute() throws Throwable
        {
            return AuthenticationUtil.runAs(new RunAsWork<String>()
            {
                @Override
                public String doWork() throws Exception
                {
                    return createPerson(false);
                }
            }, AuthenticationUtil.SYSTEM_USER_NAME);
        }
    }, false, true);

    transactionService.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<Void>()
    {
        @Override
        public Void execute() throws Throwable
        {
            return AuthenticationUtil.runAs(new RunAsWork<Void>()
            {
                @Override
                public Void doWork() throws Exception
                {
                    // Mock a request with a username in the header
                    HttpServletRequest mockHttpRequest = mock(HttpServletRequest.class);
                    when(mockHttpRequest.getHeader("X-Alfresco-Remote-User")).thenReturn(username);
                    when(mockHttpRequest.getScheme()).thenReturn("http");
                    WebScriptServletRequest mockRequest = mock(WebScriptServletRequest.class);
                    when(mockRequest.getHttpServletRequest()).thenReturn(mockHttpRequest);

                    HttpServletResponse mockHttpResponse = mock(HttpServletResponse.class);
                    WebScriptServletResponse mockResponse = mock(WebScriptServletResponse.class);
                    when(mockResponse.getHttpServletResponse()).thenReturn(mockHttpResponse);

                    Authenticator authenticator = remoteUserAuthenticatorFactory.create(mockRequest, mockResponse);
                    assertFalse(authenticator.authenticate(RequiredAuthentication.user, false));

                    return null;
                }
            }, AuthenticationUtil.SYSTEM_USER_NAME);
        }
    }, false, true);
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
@Override
public boolean authenticate(RequiredAuthentication required, boolean isGuest)
{
    boolean authenticated = false;
    
    // retrieve the remote user if configured and available - authenticate that user directly
    final String userId = getRemoteUser();
    if (userId != null)
    {
        authenticationComponent.setCurrentUser(userId);
        listener.userAuthenticated(new TicketCredentials(authenticationService.getCurrentTicket()));
        authenticated = true;
    }
    else
    {
        // is there a Session which might contain a valid user ticket?
        HttpSession session = servletReq.getHttpServletRequest().getSession(false);
        if (session != null)
        {
            try
            {
                SessionUser user = (SessionUser)session.getAttribute(AuthenticationDriver.AUTHENTICATION_USER);
                if (user != null)
                {
                    // Validate the ticket for the current SessionUser
                    authenticationService.validate(user.getTicket());
                    if (logger.isDebugEnabled())
                        logger.debug("Ticket is valid; retaining cached user in session.");
                    listener.userAuthenticated(new TicketCredentials(user.getTicket()));
                    authenticated = true;
                }
                else
                {
                    authenticated = super.authenticate(required, isGuest);
                }
            }
            catch (AuthenticationException authErr)
            {
                if (logger.isDebugEnabled())
                    logger.debug("An Authentication error occur, removing User session: ", authErr);
                session.removeAttribute(AuthenticationDriver.AUTHENTICATION_USER);
                session.invalidate();
                listener.authenticationFailed(new WebCredentials() {});
            }
        }
        else
        {
            authenticated = super.authenticate(required, isGuest);
        }
    }
    return authenticated;
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
public boolean authenticate(RequiredAuthentication required, boolean isGuest)
{
    boolean authorized = false;
    try
    {
        String authenticatorKey = servletReq.getHeader(authenticatorKeyHeader);
        String remoteUser = getRemoteUser();
        if (authenticatorKey != null && remoteUser != null)
        {
            // Trusted auth. Validate key and setup authentication context.
            authorized = authenticateViaGateway(required, isGuest, authenticatorKey, remoteUser);
        }
        else
        {
            // Fallback to parent authenticator
            try
            {
                authorized = super.authenticate(required, isGuest);
            }
            catch (AuthenticationException ae)
            {
                // e.g. guest
                if (logger.isDebugEnabled())
                    logger.debug("TenantBasicHttpAuthenticator: required="+required+", isGuest="+isGuest+" - "+ae.getMessage());
            }
        }
        if (authorized)
        {
            // check tenant validity
            final String tenant = servletReq.getTenant();
            final String email = AuthenticationUtil.getFullyAuthenticatedUser();
            try
            {
                authorized = retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Boolean>()
                {
                    public Boolean execute() throws Exception
                    {
                        return tenantAuthentication.authenticateTenant(email, tenant);
                    }
                }, true, false);
            }
            finally
            {
                if (!authorized)
                {
                    listener.authenticationFailed(new TenantCredentials(tenant, email, proxyListener.getOrignalCredentials()));
                    AuthenticationUtil.clearCurrentSecurityContext();
                }
                else
                {
                    listener.userAuthenticated(new TenantCredentials(tenant, email, proxyListener.getOrignalCredentials()));
                }
            }
        }
        return authorized;
    }
    finally
    {
        if (!authorized)
        {
            servletRes.setStatus(401);
            servletRes.setHeader("WWW-Authenticate", "Basic realm=\"Alfresco " + servletReq.getTenant() + " tenant\"");
        }
    }
}
 

import org.springframework.extensions.webscripts.Description.RequiredAuthentication; //导入依赖的package包/类
public boolean authenticate(RequiredAuthentication required, boolean isGuest)
{
    AuthenticationStatus status = null;
    
    try
    {
        //
        // validate credentials
        // 
        HttpServletRequest req = servletReq.getHttpServletRequest();
        HttpServletResponse res = servletRes.getHttpServletResponse();
        
        
        if (logger.isDebugEnabled())
        {
            logger.debug("Alfresco ticket provided: " + (ticket != null && ticket.length() > 0));
        }
    
        if (! emptyCredentials())
        {
            if (logger.isDebugEnabled())
                logger.debug("Authenticating ticket " + ticket);
            
            status = AuthenticationHelper.authenticate(context, req, res, ticket);
        }
        else
        {
            if (isGuest && RequiredAuthentication.guest == required)
            {
                if (logger.isDebugEnabled())
                    logger.debug("Authenticating as Guest");
                
                status = AuthenticationHelper.authenticate(context, req, res, true);
            }
            else
            {
                if (logger.isDebugEnabled())
                    logger.debug("Authenticating session");
                
                status = AuthenticationHelper.authenticate(context, req, res, false, false);
            }
        }

        //
        // if not authorized, redirect to login page
        //
        if (status == null || status == AuthenticationStatus.Failure)
        {
            // ALF-13194: The client has asserted itself as guest, but guest authentication is forbidden. Signal
            // with a 401 response rather than the login page!
            if (isGuest && RequiredAuthentication.guest == required)
            {
                res.setStatus(401);
            }
            else
            {
                // authentication failed - now need to display the login page to the user, if asked to
                if (logger.isDebugEnabled())
                    logger.debug("Redirecting to Alfresco Login");

                BaseServlet.redirectToLoginPage(req, res, context);
            }
        }
    }
    catch(IOException e)
    {
        throw new WebScriptException("Failed to authenticate", e);
    }
    
    return !(status == null || status == AuthenticationStatus.Failure);
}