SASLAuthentication.java

  1. /**
  2.  *
  3.  * Copyright 2003-2007 Jive Software.
  4.  *
  5.  * Licensed under the Apache License, Version 2.0 (the "License");
  6.  * you may not use this file except in compliance with the License.
  7.  * You may obtain a copy of the License at
  8.  *
  9.  *     http://www.apache.org/licenses/LICENSE-2.0
  10.  *
  11.  * Unless required by applicable law or agreed to in writing, software
  12.  * distributed under the License is distributed on an "AS IS" BASIS,
  13.  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14.  * See the License for the specific language governing permissions and
  15.  * limitations under the License.
  16.  */

  18. package org.jivesoftware.smack;

  20. import org.jivesoftware.smack.SmackException.NoResponseException;
  21. import org.jivesoftware.smack.XMPPException.XMPPErrorException;
  22. import org.jivesoftware.smack.packet.Mechanisms;
  23. import org.jivesoftware.smack.sasl.SASLAnonymous;
  24. import org.jivesoftware.smack.sasl.SASLErrorException;
  25. import org.jivesoftware.smack.sasl.SASLMechanism;
  26. import org.jivesoftware.smack.sasl.packet.SaslStreamElements.SASLFailure;
  27. import org.jivesoftware.smack.sasl.packet.SaslStreamElements.Success;

  29. import javax.security.auth.callback.CallbackHandler;

  31. import java.io.IOException;
  32. import java.util.ArrayList;
  33. import java.util.Collections;
  34. import java.util.HashMap;
  35. import java.util.HashSet;
  36. import java.util.Iterator;
  37. import java.util.List;
  38. import java.util.Map;
  39. import java.util.Set;
  40. import java.util.logging.Logger;

  42. /**
  43.  * <p>This class is responsible authenticating the user using SASL, binding the resource
  44.  * to the connection and establishing a session with the server.</p>
  45.  *
  46.  * <p>Once TLS has been negotiated (i.e. the connection has been secured) it is possible to
  47.  * register with the server or authenticate using SASL. If the
  48.  * server supports SASL then Smack will try to authenticate using SASL..</p>
  49.  *
  50.  * <p>The server may support many SASL mechanisms to use for authenticating. Out of the box
  51.  * Smack provides several SASL mechanisms, but it is possible to register new SASL Mechanisms. Use
  52.  * {@link #registerSASLMechanism(SASLMechanism)} to register a new mechanisms.
  53.  *
  54.  * @see org.jivesoftware.smack.sasl.SASLMechanism
  55.  *
  56.  * @author Gaston Dombiak
  57.  * @author Jay Kline
  58.  */
  59. public class SASLAuthentication {

  61.     private static final Logger LOGGER = Logger.getLogger(SASLAuthentication.class.getName());

  63.     private static final List<SASLMechanism> REGISTERED_MECHANISMS = new ArrayList<SASLMechanism>();

  65.     private static final Set<String> BLACKLISTED_MECHANISMS = new HashSet<String>();

  67.     /**
  68.      * Registers a new SASL mechanism
  69.      *
  70.      * @param mechanism a SASLMechanism subclass.
  71.      */
  72.     public static void registerSASLMechanism(SASLMechanism mechanism) {
  73.         synchronized (REGISTERED_MECHANISMS) {
  74.             REGISTERED_MECHANISMS.add(mechanism);
  75.             Collections.sort(REGISTERED_MECHANISMS);
  76.         }
  77.     }

  79.     /**
  80.      * Returns the registered SASLMechanism sorted by the level of preference.
  81.      *
  82.      * @return the registered SASLMechanism sorted by the level of preference.
  83.      */
  84.     public static Map<String, String> getRegisterdSASLMechanisms() {
  85.         Map<String, String> answer = new HashMap<String, String>();
  86.         synchronized (REGISTERED_MECHANISMS) {
  87.             for (SASLMechanism mechanism : REGISTERED_MECHANISMS) {
  88.                 answer.put(mechanism.getClass().getName(), mechanism.getName());
  89.             }
  90.         }
  91.         return answer;
  92.     }

  94.     /**
  95.      * Unregister a SASLMechanism by it's full class name. For example
  96.      * "org.jivesoftware.smack.sasl.javax.SASLCramMD5Mechanism".
  97.      * 
  98.      * @param clazz the SASLMechanism class's name
  99.      * @return true if the given SASLMechanism was removed, false otherwise
  100.      */
  101.     public static boolean unregisterSASLMechanism(String clazz) {
  102.         synchronized (REGISTERED_MECHANISMS) {
  103.             Iterator<SASLMechanism> it = REGISTERED_MECHANISMS.iterator();
  104.             while (it.hasNext()) {
  105.                 SASLMechanism mechanism = it.next();
  106.                 if (mechanism.getClass().getName().equals(clazz)) {
  107.                     it.remove();
  108.                     return true;
  109.                 }
  110.             }
  111.         }
  112.         return false;
  113.     }

  115.     public static boolean blacklistSASLMechanism(String mechansim) {
  116.         synchronized(BLACKLISTED_MECHANISMS) {
  117.             return BLACKLISTED_MECHANISMS.add(mechansim);
  118.         }
  119.     }

  121.     public static boolean unBlacklistSASLMechanism(String mechanism) {
  122.         synchronized(BLACKLISTED_MECHANISMS) {
  123.             return BLACKLISTED_MECHANISMS.remove(mechanism);
  124.         }
  125.     }

  127.     public static Set<String> getBlacklistedSASLMechanisms() {
  128.         synchronized(BLACKLISTED_MECHANISMS) {
  129.             return new HashSet<String>(BLACKLISTED_MECHANISMS);
  130.         }
  131.     }

  133.     private final AbstractXMPPConnection connection;
  134.     private SASLMechanism currentMechanism = null;

  136.     /**
  137.      * Boolean indicating if SASL negotiation has finished and was successful.
  138.      */
  139.     private boolean authenticationSuccessful;

  141.     /**
  142.      * Either of type {@link SmackException} or {@link SASLErrorException}
  143.      */
  144.     private Exception saslException;

  146.     SASLAuthentication(AbstractXMPPConnection connection) {
  147.         this.connection = connection;
  148.         this.init();
  149.     }

  151.     /**
  152.      * Returns true if the server offered ANONYMOUS SASL as a way to authenticate users.
  153.      *
  154.      * @return true if the server offered ANONYMOUS SASL as a way to authenticate users.
  155.      */
  156.     public boolean hasAnonymousAuthentication() {
  157.         return serverMechanisms().contains("ANONYMOUS");
  158.     }

  160.     /**
  161.      * Returns true if the server offered SASL authentication besides ANONYMOUS SASL.
  162.      *
  163.      * @return true if the server offered SASL authentication besides ANONYMOUS SASL.
  164.      */
  165.     public boolean hasNonAnonymousAuthentication() {
  166.         return !serverMechanisms().isEmpty() && (serverMechanisms().size() != 1 || !hasAnonymousAuthentication());
  167.     }

  169.     /**
  170.      * Performs SASL authentication of the specified user. If SASL authentication was successful
  171.      * then resource binding and session establishment will be performed. This method will return
  172.      * the full JID provided by the server while binding a resource to the connection.<p>
  173.      *
  174.      * The server may assign a full JID with a username or resource different than the requested
  175.      * by this method.
  176.      *
  177.      * @param resource the desired resource.
  178.      * @param cbh the CallbackHandler used to get information from the user
  179.      * @throws IOException 
  180.      * @throws XMPPErrorException 
  181.      * @throws SASLErrorException 
  182.      * @throws SmackException 
  183.      * @throws InterruptedException 
  184.      */
  185.     public void authenticate(String resource, CallbackHandler cbh) throws IOException,
  186.                     XMPPErrorException, SASLErrorException, SmackException, InterruptedException {
  187.         SASLMechanism selectedMechanism = selectMechanism();
  188.         if (selectedMechanism != null) {
  189.             currentMechanism = selectedMechanism;
  190.             synchronized (this) {
  191.                 currentMechanism.authenticate(connection.getHost(), connection.getServiceName(), cbh);
  192.                 // Wait until SASL negotiation finishes
  193.                 wait(connection.getPacketReplyTimeout());
  194.             }

  196.             maybeThrowException();

  198.             if (!authenticationSuccessful) {
  199.                 throw NoResponseException.newWith(connection);
  200.             }
  201.         }
  202.         else {
  203.             throw new SmackException(
  204.                             "SASL Authentication failed. No known authentication mechanisims.");
  205.         }
  206.     }

  208.     /**
  209.      * Performs SASL authentication of the specified user. If SASL authentication was successful
  210.      * then resource binding and session establishment will be performed. This method will return
  211.      * the full JID provided by the server while binding a resource to the connection.<p>
  212.      *
  213.      * The server may assign a full JID with a username or resource different than the requested
  214.      * by this method.
  215.      *
  216.      * @param username the username that is authenticating with the server.
  217.      * @param password the password to send to the server.
  218.      * @param resource the desired resource.
  219.      * @throws XMPPErrorException 
  220.      * @throws SASLErrorException 
  221.      * @throws IOException 
  222.      * @throws SmackException 
  223.      * @throws InterruptedException 
  224.      */
  225.     public void authenticate(String username, String password, String resource)
  226.                     throws XMPPErrorException, SASLErrorException, IOException,
  227.                     SmackException, InterruptedException {
  228.         SASLMechanism selectedMechanism = selectMechanism();
  229.         if (selectedMechanism != null) {
  230.             currentMechanism = selectedMechanism;

  232.             synchronized (this) {
  233.                 currentMechanism.authenticate(username, connection.getHost(),
  234.                                 connection.getServiceName(), password);
  235.                 // Wait until SASL negotiation finishes
  236.                 wait(connection.getPacketReplyTimeout());
  237.             }

  239.             maybeThrowException();

  241.             if (!authenticationSuccessful) {
  242.                 throw NoResponseException.newWith(connection);
  243.             }
  244.         }
  245.         else {
  246.             throw new SmackException(
  247.                             "SASL Authentication failed. No known authentication mechanisims.");
  248.         }
  249.     }

  251.     /**
  252.      * Performs ANONYMOUS SASL authentication. If SASL authentication was successful
  253.      * then resource binding and session establishment will be performed. This method will return
  254.      * the full JID provided by the server while binding a resource to the connection.<p>
  255.      *
  256.      * The server will assign a full JID with a randomly generated resource and possibly with
  257.      * no username.
  258.      *
  259.      * @throws SASLErrorException 
  260.      * @throws XMPPErrorException if an error occures while authenticating.
  261.      * @throws SmackException if there was no response from the server.
  262.      * @throws InterruptedException 
  263.      */
  264.     public void authenticateAnonymously() throws SASLErrorException,
  265.                     SmackException, XMPPErrorException, InterruptedException {
  266.         currentMechanism = (new SASLAnonymous()).instanceForAuthentication(connection);

  268.         // Wait until SASL negotiation finishes
  269.         synchronized (this) {
  270.             currentMechanism.authenticate(null, null, null, "");
  271.             wait(connection.getPacketReplyTimeout());
  272.         }

  274.         maybeThrowException();

  276.         if (!authenticationSuccessful) {
  277.             throw NoResponseException.newWith(connection);
  278.         }
  279.     }

  281.     private void maybeThrowException() throws SmackException, SASLErrorException {
  282.         if (saslException != null){
  283.             if (saslException instanceof SmackException) {
  284.                 throw (SmackException) saslException;
  285.             } else if (saslException instanceof SASLErrorException) {
  286.                 throw (SASLErrorException) saslException;
  287.             } else {
  288.                 throw new IllegalStateException("Unexpected exception type" , saslException);
  289.             }
  290.         }
  291.     }

  293.     /**
  294.      * Wrapper for {@link #challengeReceived(String, boolean)}, with <code>finalChallenge</code> set
  295.      * to <code>false</code>.
  296.      * 
  297.      * @param challenge a base64 encoded string representing the challenge.
  298.      * @throws SmackException
  299.      * @throws InterruptedException 
  300.      */
  301.     public void challengeReceived(String challenge) throws SmackException, InterruptedException {
  302.         challengeReceived(challenge, false);
  303.     }

  305.     /**
  306.      * The server is challenging the SASL authentication we just sent. Forward the challenge
  307.      * to the current SASLMechanism we are using. The SASLMechanism will eventually send a response to
  308.      * the server. The length of the challenge-response sequence varies according to the
  309.      * SASLMechanism in use.
  310.      *
  311.      * @param challenge a base64 encoded string representing the challenge.
  312.      * @param finalChallenge true if this is the last challenge send by the server within the success stanza
  313.      * @throws SmackException
  314.      * @throws InterruptedException
  315.      */
  316.     public void challengeReceived(String challenge, boolean finalChallenge) throws SmackException, InterruptedException {
  317.         try {
  318.             currentMechanism.challengeReceived(challenge, finalChallenge);
  319.         } catch (InterruptedException | SmackException e) {
  320.             authenticationFailed(e);
  321.             throw e;
  322.         }
  323.     }

  325.     /**
  326.      * Notification message saying that SASL authentication was successful. The next step
  327.      * would be to bind the resource.
  328.      * @throws SmackException 
  329.      * @throws InterruptedException 
  330.      */
  331.     public void authenticated(Success success) throws SmackException, InterruptedException {
  332.         // RFC6120 6.3.10 "At the end of the authentication exchange, the SASL server (the XMPP
  333.         // "receiving entity") can include "additional data with success" if appropriate for the
  334.         // SASL mechanism in use. In XMPP, this is done by including the additional data as the XML
  335.         // character data of the <success/> element." The used SASL mechanism should be able to
  336.         // verify the data send by the server in the success stanza, if any.
  337.         if (success.getData() != null) {
  338.             challengeReceived(success.getData(), true);
  339.         }
  340.         currentMechanism.checkIfSuccessfulOrThrow();
  341.         authenticationSuccessful = true;
  342.         // Wake up the thread that is waiting in the #authenticate method
  343.         synchronized (this) {
  344.             notify();
  345.         }
  346.     }

  348.     /**
  349.      * Notification message saying that SASL authentication has failed. The server may have
  350.      * closed the connection depending on the number of possible retries.
  351.      * 
  352.      * @param saslFailure the SASL failure as reported by the server
  353.      * @see <a href="https://tools.ietf.org/html/rfc6120#section-6.5">RFC6120 6.5</a>
  354.      */
  355.     public void authenticationFailed(SASLFailure saslFailure) {
  356.         authenticationFailed(new SASLErrorException(currentMechanism.getName(), saslFailure));
  357.     }

  359.     public void authenticationFailed(Exception exception) {
  360.         saslException = exception;
  361.         // Wake up the thread that is waiting in the #authenticate method
  362.         synchronized (this) {
  363.             notify();
  364.         }
  365.     }

  367.     public boolean authenticationSuccessful() {
  368.         return authenticationSuccessful;
  369.     }

  371.     /**
  372.      * Initializes the internal state in order to be able to be reused. The authentication
  373.      * is used by the connection at the first login and then reused after the connection
  374.      * is disconnected and then reconnected.
  375.      */
  376.     protected void init() {
  377.         authenticationSuccessful = false;
  378.         saslException = null;
  379.     }

  381.     private SASLMechanism selectMechanism() {
  382.         // Locate the SASLMechanism to use
  383.         SASLMechanism selectedMechanism = null;
  384.         Iterator<SASLMechanism> it = REGISTERED_MECHANISMS.iterator();
  385.         // Iterate in SASL Priority order over registered mechanisms
  386.         while (it.hasNext()) {
  387.             SASLMechanism mechanism = it.next();
  388.             String mechanismName = mechanism.getName();
  389.             synchronized (BLACKLISTED_MECHANISMS) {
  390.                 if (BLACKLISTED_MECHANISMS.contains(mechanismName)) {
  391.                     continue;
  392.                 }
  393.             }
  394.             if (serverMechanisms().contains(mechanismName)) {
  395.                 // Create a new instance of the SASLMechanism for every authentication attempt.
  396.                 selectedMechanism = mechanism.instanceForAuthentication(connection);
  397.                 break;
  398.             }
  399.         }
  400.         return selectedMechanism;
  401.     }

  403.     private List<String> serverMechanisms() {
  404.         Mechanisms mechanisms = connection.getFeature(Mechanisms.ELEMENT, Mechanisms.NAMESPACE);
  405.         if (mechanisms == null) {
  406.             LOGGER.warning("Server did not report any SASL mechanisms");
  407.             return Collections.emptyList();
  408.         }
  409.         return mechanisms.getMechanisms();
  410.     }
  411. }
Created with JaCoCo 0.7.4.201502262128