metron-streaming/Metron-DataServices/src/main/java/org/apache/metron/dataservices/servlet/LoginServlet.java

/**
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.metron.dataservices.servlet;

import java.io.IOException;
import java.util.Properties;

import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.ExcessiveAttemptsException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.google.inject.Inject;
import org.apache.metron.dataservices.auth.AuthToken;

public class LoginServlet extends HttpServlet 
{
	private static final Logger logger = LoggerFactory.getLogger( LoginServlet.class );
	
	private static final long serialVersionUID = 1L;

	@Inject
	private Properties configProps;
	
	@Override
	public void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException 
	{
		doPost( req, resp );
	}
	
	@Override
	public void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException 
	{	
		String username = req.getParameter("username" );
		String password = req.getParameter("password" );
		UsernamePasswordToken token = new UsernamePasswordToken(username, password);
	
		logger.info( "Doing login for user: " + username );
		
		Subject currentUser = SecurityUtils.getSubject();

		try 
		{
		    currentUser.login(token);
		} 
		catch ( UnknownAccountException uae ) 
		{
			logger.warn( "Failing login with 401:", uae );
			resp.sendError(405);
			return;
		} 
		catch ( IncorrectCredentialsException ice ) 
		{
			logger.warn( "Failing login with 401:", ice );
			resp.sendError(405);
			return;
		} 
		catch ( LockedAccountException lae ) 
		{
			logger.warn( "Failing login with 401:", lae ); 
			resp.sendError(401);
			return;
		} 
		catch ( ExcessiveAttemptsException eae ) 
		{
			logger.warn( "Failing login with 401:", eae );
			resp.sendError(401);
			return;
		}  
		catch ( AuthenticationException ae ) 
		{
			logger.warn( "Failing login with 401:", ae );
			resp.sendError(401);
			return;
		}
		
		
		if( currentUser.hasRole("ShiroUsersRole") )
		{
			try
			{
			
				Cookie authTokenCookie = new Cookie("authToken", AuthToken.generateToken(configProps));
				resp.addCookie(authTokenCookie);
				
				// resp.setStatus(HttpServletResponse.SC_OK);
				resp.sendRedirect( "/withsocket.jsp" );
			}
			catch( Exception e )
			{
				logger.error( "Failed creating authToken cookie.", e );
				resp.sendError( 500 );
				return;
			}
		}
		else
		{
			logger.error("User does not have required role!");
			resp.sendError(401);
			return;
		}
	}	
}