content: /**
   * Licensed to the Apache Software Foundation (ASF) under one or more
   * contributor license agreements.  See the NOTICE file distributed with
   * this work for additional information regarding copyright ownership.
   * The ASF licenses this file to You under the Apache License, Version 2.0
   * (the "License"); you may not use this file except in compliance with
   * the License.  You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  package org.apache.activemq.shiro.authc;
  
  import org.apache.activemq.broker.ConnectionContext;
  import org.apache.activemq.command.ConnectionInfo;
  import org.apache.activemq.security.SecurityContext;
  import org.apache.activemq.shiro.ConnectionReference;
  import org.apache.activemq.shiro.env.EnvironmentFilter;
  import org.apache.activemq.shiro.subject.ConnectionSubjectResolver;
  import org.apache.activemq.shiro.subject.SubjectConnectionReference;
  import org.apache.activemq.shiro.subject.SubjectSecurityContext;
  import org.apache.shiro.authc.AuthenticationException;
  import org.apache.shiro.authc.AuthenticationToken;
  import org.apache.shiro.subject.Subject;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  /**
   * The {@code AuthenticationFilter} enforces if authentication is required before allowing the broker filter chain
   * to continue.
   * <p/>
   * This implementation performs a connection-level authentication assertion:  If the {@link Subject} associated with the
   * connection<b>*</b> is not authenticated, and the
   * {@link AuthenticationPolicy AuthenticationPolicy} requires the {@code Subject} to be authenticated, it will attempt
   * to {@link Subject#login(org.apache.shiro.authc.AuthenticationToken) login} the Subject automatically.  The
   * {@link AuthenticationToken} used to login is created by the
   * {@link #getAuthenticationTokenFactory() authenticationTokenFactory}, typically by acquiring any credentials
   * associated with the connection.
   * <p/>
   * Once the connection's {@code Subject} is authenticated as necessary, the broker filter chain will continue
   * as expected.
   * <p/>
   * <b>*</b>: The upstream {@link org.apache.activemq.shiro.subject.SubjectFilter} is expected to execute before this one, ensuring a Subject instance
   * is already associated with the connection.
   *
   * @since 5.10.0
   */
  public class AuthenticationFilter extends EnvironmentFilter {
  
      private static final Logger LOG = LoggerFactory.getLogger(AuthenticationFilter.class);
  
      private AuthenticationPolicy authenticationPolicy;
      private AuthenticationTokenFactory authenticationTokenFactory;
  
      public AuthenticationFilter() {
          this.authenticationPolicy = new DefaultAuthenticationPolicy();
          this.authenticationTokenFactory = new DefaultAuthenticationTokenFactory();
      }
  
      public AuthenticationPolicy getAuthenticationPolicy() {
          return authenticationPolicy;
      }
  
      public void setAuthenticationPolicy(AuthenticationPolicy authenticationPolicy) {
          this.authenticationPolicy = authenticationPolicy;
      }
  
      public AuthenticationTokenFactory getAuthenticationTokenFactory() {
          return authenticationTokenFactory;
      }
  
      public void setAuthenticationTokenFactory(AuthenticationTokenFactory authenticationTokenFactory) {
          this.authenticationTokenFactory = authenticationTokenFactory;
      }
  
      protected Subject getSubject(ConnectionReference conn) {
          return new ConnectionSubjectResolver(conn).getSubject();
      }
  
      @Override
      public void addConnection(ConnectionContext context, ConnectionInfo info) throws Exception {
  
          if (isEnabled()) { //disabled means don't enforce authentication (i.e. allow anonymous access):
  
              Subject subject = getSubject(new ConnectionReference(context, info, getEnvironment()));
  
              if (!subject.isAuthenticated()) {
  
                  SubjectConnectionReference connection = new SubjectConnectionReference(context, info, getEnvironment(), subject);
  
                  if (this.authenticationPolicy.isAuthenticationRequired(connection)) {
                      AuthenticationToken token = this.authenticationTokenFactory.getAuthenticationToken(connection);
                      if (token == null) {
                          String msg = "Unable to obtain authentication credentials for newly established connection.  " +
                                  "Authentication is required.";
                          throw new AuthenticationException(msg);
                      }
                      //token is not null - login the current subject:
                      subject.login(token);
                  }
              }
          }
  
          super.addConnection(context, info);
      }
  
      @Override
      public void removeConnection(ConnectionContext context, ConnectionInfo info, Throwable error) throws Exception {
          try {
              super.removeConnection(context, info, error);
          } finally {
              SecurityContext secCtx = context.getSecurityContext();
  
              if (secCtx instanceof SubjectSecurityContext) {
  
                  SubjectSecurityContext subjectSecurityContext = (SubjectSecurityContext) secCtx;
                  Subject subject = subjectSecurityContext.getSubject();
  
                  if (subject != null) {
                      try {
                          subject.logout();
                      } catch (Throwable t) {
                          String msg = "Unable to cleanly logout connection Subject during connection removal.  This is " +
                                  "unexpected but not critical: it can be safely ignored because the " +
                                  "connection will no longer be used.";
                          LOG.info(msg, t);
                      }
                  }
              }
          }
      }
  }
  