src/org/cacert/gigi/Gigi.java

   1 package org.cacert.gigi;
   2
   3 import java.io.IOException;
   4 import java.security.cert.X509Certificate;
   5
   6 import javax.servlet.ServletException;
   7 import javax.servlet.http.HttpServlet;
   8 import javax.servlet.http.HttpServletRequest;
   9 import javax.servlet.http.HttpServletResponse;
  10 import javax.servlet.http.HttpSession;
  11
  12 public class Gigi extends HttpServlet {
  13         @Override
  14         protected void service(HttpServletRequest req, HttpServletResponse resp)
  15                         throws ServletException, IOException {
  16                 X509Certificate[] cert = (X509Certificate[]) req
  17                                 .getAttribute("javax.servlet.request.X509Certificate");
  18                 HttpSession hs = req.getSession(false);
  19                 if (hs == null || !((Boolean) hs.getAttribute("loggedin"))) {
  20                         if (cert != null) {
  21                                 tryAuthWithCertificate(req, cert[0]);
  22                                 hs = req.getSession(false);
  23                         }
  24                 }
  25                 if (req.getMethod().equals("POST") && req.getPathInfo() != null
  26                                 && req.getPathInfo().equals("/login")) {
  27                         authWithUnpw(req);
  28                         resp.sendRedirect("/");
  29                         return;
  30                 }
  31                 if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
  32                         if (hs != null) {
  33                                 hs.setAttribute("loggedin", false);
  34                                 hs.invalidate();
  35                         }
  36                         authWithUnpw(req);
  37                         resp.sendRedirect("/");
  38                         return;
  39                 }
  40
  41                 if (hs == null || !((Boolean) hs.getAttribute("loggedin"))) {
  42                         resp.setContentType("text/html");
  43                         resp.getWriter().println("Access denied. Sending login form.");
  44                         resp.getWriter()
  45                                         .println(
  46                                                         "<form method='POST' action='/login'>"
  47                                                                         + "<input type='text' name='username'>"
  48                                                                         + "<input type='password' name='password'> <input type='submit' value='login'></form>");
  49                         return;
  50                 }
  51                 resp.getWriter().println("Access granted.");
  52
  53         }
  54         private void authWithUnpw(HttpServletRequest req) {
  55                 String un = req.getParameter("username");
  56                 String pw = req.getParameter("password");
  57                 // TODO dummy password check if (un.equals(pw)) {
  58                 HttpSession hs = req.getSession();
  59                 hs.setAttribute("loggedin", true);
  60         }
  61         private void tryAuthWithCertificate(HttpServletRequest req,
  62                         X509Certificate x509Certificate) {
  63                 // TODO ckeck if certificate is valid
  64                 HttpSession hs = req.getSession();
  65                 hs.setAttribute("loggedin", true);
  66         }
  67 }