org.apache.catalina.authenticator

Class DigestAuthenticator

public class DigestAuthenticator extends AuthenticatorBase

An Authenticator and Valve implementation of HTTP DIGEST Authentication (see RFC 2069).

Version: $Revision: 467222 $ $Date: 2006-10-24 05:17:11 +0200 (Tue, 24 Oct 2006) $

Author: Craig R. McClanahan Remy Maucherat

Field Summary
protected static Stringinfo
Descriptive information about this implementation.
protected Stringkey
Private key.
protected static MD5Encodermd5Encoder
The MD5 helper object for this class.
protected static MessageDigestmd5Helper
MD5 message digest provider.
protected intnonceCacheSize
Maximum number of server nonces to keep in the cache.
protected Map<String,DigestAuthenticator.NonceInfo>nonces
List of the server nonce values currently being tracked
protected longnonceValidity
How long server nonces are valid for in milliseconds.
protected Stringopaque
Opaque Sting opaque;
protected static StringQOP
Tomcat's DIGEST implementation only supports auth quality of protection
protected booleanvalidateUri
Should the URI be validated as required by RFC2617?
Constructor Summary
DigestAuthenticator()
Method Summary
protected StringgenerateNonce(Request request)
Generate a unique token.
StringgetKey()
intgetNonceCacheSize()
longgetNonceValidity()
StringgetOpaque()
booleanisValidateUri()
protected StringparseUsername(String authorization)
Parse the username from the specified authorization string.
protected static StringremoveQuotes(String quotedString, boolean quotesRequired)
Removes the quotes on a string.
protected static StringremoveQuotes(String quotedString)
Removes the quotes on a string.
protected voidsetAuthenticateHeader(Request request, Response response, LoginConfig config, String nonce, boolean isNonceStale)
Generates the WWW-Authenticate header.
voidsetKey(String key)
voidsetNonceCacheSize(int nonceCacheSize)
voidsetNonceValidity(long nonceValidity)
voidsetOpaque(String opaque)
voidsetValidateUri(boolean validateUri)

Field Detail

info

protected static final String info
Descriptive information about this implementation.

key

protected String key
Private key.

md5Encoder

protected static final MD5Encoder md5Encoder
The MD5 helper object for this class.

md5Helper

protected static MessageDigest md5Helper
MD5 message digest provider.

nonceCacheSize

protected int nonceCacheSize
Maximum number of server nonces to keep in the cache. If not specified, the default value of 1000 is used

nonces

protected Map<String,DigestAuthenticator.NonceInfo> nonces
List of the server nonce values currently being tracked

nonceValidity

protected long nonceValidity
How long server nonces are valid for in milliseconds. Defaults to 5 minutes

opaque

protected String opaque
Opaque Sting opaque;

QOP

protected static final String QOP
Tomcat's DIGEST implementation only supports auth quality of protection

validateUri

protected boolean validateUri
Should the URI be validated as required by RFC2617? Can be disabled in reverse proxies where the proxy has modified the URI.

Constructor Detail

DigestAuthenticator

public DigestAuthenticator()

Method Detail

generateNonce

protected String generateNonce(Request request)
Generate a unique token. The token is generated according to the following pattern. NOnceToken = Base64 ( MD5 ( client-IP ":" time-stamp ":" private-key ) ).

Parameters: request HTTP Servlet request

getKey

public String getKey()

getNonceCacheSize

public int getNonceCacheSize()

getNonceValidity

public long getNonceValidity()

getOpaque

public String getOpaque()

isValidateUri

public boolean isValidateUri()

parseUsername

protected String parseUsername(String authorization)

Deprecated: unused. Will be removed in Tomcat 8.0.x

Parse the username from the specified authorization string. If none can be identified, return null

Parameters: authorization Authorization string to be parsed

removeQuotes

protected static String removeQuotes(String quotedString, boolean quotesRequired)
Removes the quotes on a string. RFC2617 states quotes are optional for all parameters except realm.

removeQuotes

protected static String removeQuotes(String quotedString)
Removes the quotes on a string.

setAuthenticateHeader

protected void setAuthenticateHeader(Request request, Response response, LoginConfig config, String nonce, boolean isNonceStale)
Generates the WWW-Authenticate header.

The header MUST follow this template :

      WWW-Authenticate    = "WWW-Authenticate" ":" "Digest"
                            digest-challenge

      digest-challenge    = 1#( realm | [ domain ] | nonce |
                  [ digest-opaque ] |[ stale ] | [ algorithm ] )

      realm               = "realm" "=" realm-value
      realm-value         = quoted-string
      domain              = "domain" "=" <"> 1#URI <">
      nonce               = "nonce" "=" nonce-value
      nonce-value         = quoted-string
      opaque              = "opaque" "=" quoted-string
      stale               = "stale" "=" ( "true" | "false" )
      algorithm           = "algorithm" "=" ( "MD5" | token )
 

Parameters: request HTTP Servlet request response HTTP Servlet response config Login configuration describing how authentication should be performed nonce nonce token

setKey

public void setKey(String key)

setNonceCacheSize

public void setNonceCacheSize(int nonceCacheSize)

setNonceValidity

public void setNonceValidity(long nonceValidity)

setOpaque

public void setOpaque(String opaque)

setValidateUri

public void setValidateUri(boolean validateUri)
Copyright © 2000-2013 Apache Software Foundation. All Rights Reserved.