---

AuthTool.java

Go to the documentation of this file.

package net.threebit.utils.sosc;

/*
        Copyright 2003 Shawn Deleurme
        Copyright 2003 Kevin O'Donnell

        This program is free software; you can redistribute it and/or modify
        it under the terms of the GNU General Public License as published by
        the Free Software Foundation; either version 2 of the License, or
        (at your option) any later version.

        This program is distributed in the hope that it will be useful,
        but WITHOUT ANY WARRANTY; without even the implied warranty of
        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        GNU General Public License for more details.

        You should have received a copy of the GNU General Public License
        along with this program; if not, write to the Free Software
        Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

import javax.xml.transform.*;
import javax.xml.transform.stream.*;
import java.sql.*;
import java.io.*;
import java.util.*;
import javax.servlet.http.*;
import javax.servlet.jsp.*;

public class AuthTool {

        private DbTool db = null;
        private String tableNamePrefix = null;

        public AuthTool () throws Exception {
        }

        public AuthTool (DbTool db, String tableNamePrefix) throws Exception {
                setDbTool(db);
                setTableNamePrefix(tableNamePrefix);
        }

        public void setDbTool (DbTool db) throws Exception {
                this.db = db;
        }

        public void setTableNamePrefix (String tableNamePrefix) throws Exception {
                this.tableNamePrefix = tableNamePrefix;
        }

        public String getTableNamePrefix() throws Exception {
                return tableNamePrefix;
        }

        public void sanityCheck() throws Exception {
                List errors = new ArrayList();
                if (tableNamePrefix == null) { errors.add("No tableNamePrefix has been set"); }
                if (db == null) { errors.add("No dbTool has been set."); }
                if (errors.size() > 0) {
                        String message = "";
                        for (Iterator i = errors.iterator(); i.hasNext(); ) {
                                message = message + "\n" + i.next();
                        }
                        throw new Exception(message);
                }
        }

        public void refreshSchema() throws Exception {
                db.update(
                        " delete from " + userTable() + "; " +
                        " delete from " + groupTable() + "; " +
                        " delete from " + groupMemberTable() + "; "
                );
        }

        public String userTable() throws Exception {
                return tableNamePrefix + "Users";
        }

        public String groupTable() throws Exception {
                return tableNamePrefix + "Groups";
        }

        public String groupMemberTable() throws Exception {
                return tableNamePrefix + "GroupMembers";
        }


        public void addUser (String userName, String password) throws Exception {
                sanityCheck();
                if (userName == null || userName.length() == 0) { throw new Exception("Username is null or empty ('"+userName+"')"); }
                if (password == null || password.length() == 0) { throw new Exception("Password is null or empty ('"+password+"')"); }

                userName.replaceAll("'","''");
                password.replaceAll("'","''");
                db.update( "insert into " + userTable() + " (name,password) values ('" + userName + "','" + password + "'); ");
        };

        public void addUser (String userName, String password, String email) throws Exception {
                addUser(userName,password);
                setUserEmail(userName,email);
        }

        public void setUserEmail (String userName, String email) throws Exception {
                db.update(
                        " update " + userTable() + 
                        " set email = " + db.quote(email) + 
                        " where name = " + db.quote(userName) +
                        " ; "
                );
        }

        public void setUserPassword (String userName, String password) throws Exception {
                db.update(
                        " update " + userTable() + 
                        " set password = " + db.quote(password) + 
                        " where name = " + db.quote(userName) +
                        " ; "
                );
        }

        public void changePassword (String userName, String newPassword) throws Exception {
                sanityCheck();
                userName = db.quote(userName);
                newPassword = db.quote(newPassword);
                db.update(" update " + userTable() + " set password = '" + newPassword + "' where name = '" + userName + "'");
        }

        public void removeUser (String userName) throws Exception {
                if (userName == null || userName.length() == 0) { throw new Exception("Username is null or empty ('"+userName+"')"); }
                sanityCheck();
                db.update(
                        " delete from " + groupMemberTable() + " where userid = ( select id from " + userTable() + " where name = '" + userName + "') ; " +
                        " delete from " + userTable() + " where name = '" + userName + "' ; "
                );
        }

        private Map getIdNames (String sql) throws Exception {
                Map result = new LinkedHashMap();
                ResultSet r = db.query(sql);
                while (r.next()) { result.put(r.getString("name"), r.getString("id")); }
                return result;
        }

        public Map getUsers () throws Exception {
                return getIdNames("select id,name from " + userTable() + " order by lower(name) ");
        }

        public Map getGroups () throws Exception {
                return getIdNames("select id,name from " + groupTable() + " order by lower(name) ");
        }

        public Map getGroupMembers(String groupName) throws Exception {
                groupName = db.quote(groupName);
                return getIdNames(
                        " select u.id,u.name " +
                        " from " + 
                        "   " + userTable() + " as u, " +
                        "   " + groupTable() + " as g, " +
                        "   " + groupMemberTable() + " as gm " +
                        " where " +
                        "   gm.userid = u.id " +
                        "   and gm.groupid = g.id " +
                        "   and g.name = " + groupName
                );
        }

        public void addGroup (String groupName) throws Exception {
                sanityCheck();
                if (groupName == null || groupName.length() == 0) { throw new Exception("groupname is null or empty ('"+groupName+"')"); }

                groupName.replaceAll("'","''");
                db.update( "insert into " + groupTable() + " (name) values ('" + groupName + "'); ");
        }

        public void removeGroup (String groupName) throws Exception {
                sanityCheck();
                if (groupName == null || groupName.length() == 0) { throw new Exception("groupname is null or empty ('"+groupName+"')"); }
                db.update(
                        " delete from " + groupMemberTable() + " where groupid = ( select id from " + groupTable() + " where name = '" + groupName + "') ; " +
                        " delete from " + groupTable() + " where name = '" + groupName + "' ; "
                );
        }

        public boolean authenticate (String userName, String password) throws Exception {
                sanityCheck();
                if (userName == null || userName.length() == 0) { throw new Exception("Username is null or empty ('"+userName+"')"); }
                if (password == null) { throw new Exception("Password is null or empty ('"+password+"')"); }

                ResultSet r = db.query(" select password from " + userTable() + " where name = " + db.quote(userName));
                if (! r.first()) { return false; }
                String dbPass = r.getString("password");

                if (dbPass == null) { return false; }
                return dbPass.equals(password);
        }

        public void addGroupMember (String groupName, String userName) throws Exception {
                sanityCheck();
                if (userName == null || userName.length() == 0) { throw new Exception("Username is null or empty ('"+userName+"')"); }
                if (groupName == null || groupName.length() == 0) { throw new Exception("groupname is null or empty ('"+groupName+"')"); }

                db.update(
                        " insert into " + groupMemberTable() + " (groupId,userId) " +
                        " values ( " +
                        "   (select id from " + groupTable() + " where name = '" + groupName + "') " +
                        "   , " +
                        "   (select id from " + userTable() + " where name = '" + userName + "') " +
                        " ); "
                );

                // Sanity
                if (! isGroupMember(groupName, userName)) {
                        throw new Exception("An error occurred while adding " + userName + " to group " + groupName);
                }
        }

        public boolean isGroupMember (String groupName, HttpServletRequest request) throws Exception {
                return isGroupMember(groupName, getCurrentUser(request));
        }

        public boolean isGroupMember (String groupName, String userName) throws Exception {
                sanityCheck();
                if (userName == null || userName.length() == 0) { throw new Exception("Username is null or empty ('"+userName+"')"); }
                if (groupName == null || groupName.length() == 0) { throw new Exception("groupname is null or empty ('"+groupName+"')"); }

                ResultSet r = db.query(
                        " select count(*) as count " +
                        " from " + groupMemberTable() + " as gm, " + userTable() + " as u," + groupTable() + " as g " +
                        " where " +
                        "   g.name = '" + groupName + "' " +
                        "   and u.name = '" + userName + "' " +
                        "   and gm.groupId = g.id " +
                        "   and gm.userId = u.id "
                );
                if (! r.first()) { return false; }
                int count = r.getInt("count");
                if (count > 0) { return true; }
                return false;
        }

        public void removeGroupMember (String groupName, String userName) throws Exception {
                sanityCheck();
                if (userName == null || userName.length() == 0) { throw new Exception("Username is null or empty ('"+userName+"')"); }
                if (groupName == null || groupName.length() == 0) { throw new Exception("groupname is null or empty ('"+groupName+"')"); }

                db.update(
                        " delete from " + groupMemberTable() +
                        " where " +
                        "   groupId = (select id from " + groupTable() + " where name = '" + groupName + "') " +
                        "   and userId = (select id from " + userTable() + " where name = '" + userName + "') "
                );

        }

        public String getCurrentUser(HttpServletRequest request) throws Exception {
                Cookie[] cookies = request.getCookies();
                String username = null;
                if (cookies != null) {
                        for (int x = 0; x < cookies.length; x++) {
                                Cookie cookie = cookies[x];
                                // out.println("["+x+"]: " + cookie.getName() + ": " + cookie.getValue() + "<br>" );
                                if (cookie.getName().equals("AuthToolUserName")) {
                                        username = cookie.getValue();
                                        break;
                                }
                        }
                }
                return username;
        }

        public String getUserEmail (String userName) throws Exception {
                ResultSet r = db.query(" select email from " + userTable() + " where name = " + db.quote(userName));
                if (! r.first()) { throw new Exception("No such user"); }
                return r.getString("email");
        }

        public void setCurrentUser (HttpServletResponse response, String userName) {
                Cookie c = new Cookie("AuthToolUserName", userName);
                response.addCookie(c);
        }

        public void setCurrentUser (HttpServletResponse response, String userName, String password) throws Exception {
                sanityCheck();
                if (! authenticate(userName, password)) { 
                        throw new Exception("Could not set user because authentication failed for ('" + userName + "')"); 
                }
                setCurrentUser(response,userName);
        }
}

---