| | |
| | | /* |
| | | * Conditions Of Use |
| | | * |
| | | * This software was developed by employees of the National Institute of |
| | | * Standards and Technology (NIST), an agency of the Federal Government. |
| | | * Pursuant to title 15 Untied States Code Section 105, works of NIST |
| | | * employees are not subject to copyright protection in the United States |
| | | * and are considered to be in the public domain. As a result, a formal |
| | | * license is not needed to use the software. |
| | | * |
| | | * This software is provided by NIST as a service and is expressly |
| | | * provided "AS IS." NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED |
| | | * OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF |
| | | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT |
| | | * AND DATA ACCURACY. NIST does not warrant or make any representations |
| | | * regarding the use of the software or the results thereof, including but |
| | | * not limited to the correctness, accuracy, reliability or usefulness of |
| | | * the software. |
| | | * |
| | | * Permission to use this software is contingent upon your acceptance |
| | | * of the terms of this agreement |
| | | * |
| | | * . |
| | | * |
| | | */ |
| | | * Conditions Of Use |
| | | * |
| | | * This software was developed by employees of the National Institute of |
| | | * Standards and Technology (NIST), an agency of the Federal Government. |
| | | * Pursuant to title 15 Untied States Code Section 105, works of NIST |
| | | * employees are not subject to copyright protection in the United States |
| | | * and are considered to be in the public domain. As a result, a formal |
| | | * license is not needed to use the software. |
| | | * |
| | | * This software is provided by NIST as a service and is expressly |
| | | * provided "AS IS." NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED |
| | | * OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF |
| | | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT |
| | | * AND DATA ACCURACY. NIST does not warrant or make any representations |
| | | * regarding the use of the software or the results thereof, including but |
| | | * not limited to the correctness, accuracy, reliability or usefulness of |
| | | * the software. |
| | | * |
| | | * Permission to use this software is contingent upon your acceptance |
| | | * of the terms of this agreement |
| | | * |
| | | * . |
| | | * |
| | | */ |
| | | package com.genersoft.iot.vmp.gb28181.auth; |
| | | |
| | | import java.security.MessageDigest; |
| | |
| | | |
| | | /** |
| | | * Implements the HTTP digest authentication method server side functionality. |
| | | * |
| | | * |
| | | * @author M. Ranganathan |
| | | * @author Marc Bednarek |
| | | */ |
| | | |
| | | public class DigestServerAuthenticationHelper { |
| | | |
| | | |
| | | private MessageDigest messageDigest; |
| | | |
| | | |
| | | public static final String DEFAULT_ALGORITHM = "MD5"; |
| | | public static final String DEFAULT_SCHEME = "Digest"; |
| | | |
| | | |
| | | |
| | | |
| | | |
| | |
| | | |
| | | /** |
| | | * Default constructor. |
| | | * @throws NoSuchAlgorithmException |
| | | * @throws NoSuchAlgorithmException |
| | | */ |
| | | public DigestServerAuthenticationHelper() |
| | | throws NoSuchAlgorithmException { |
| | | messageDigest = MessageDigest.getInstance(DEFAULT_ALGORITHM); |
| | | public DigestServerAuthenticationHelper() |
| | | throws NoSuchAlgorithmException { |
| | | messageDigest = MessageDigest.getInstance(DEFAULT_ALGORITHM); |
| | | } |
| | | |
| | | public static String toHexString(byte b[]) { |
| | |
| | | } |
| | | return new String(c); |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Generate the challenge string. |
| | | * |
| | |
| | | * |
| | | * @param request - the request to authenticate. |
| | | * @param hashedPassword -- the MD5 hashed string of username:realm:plaintext password. |
| | | * |
| | | * |
| | | * @return true if authentication succeded and false otherwise. |
| | | */ |
| | | public boolean doAuthenticateHashedPassword(Request request, String hashedPassword) { |
| | | AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME); |
| | | AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME); |
| | | if ( authHeader == null ) return false; |
| | | String realm = authHeader.getRealm(); |
| | | String username = authHeader.getUsername(); |
| | | |
| | | |
| | | if ( username == null || realm == null ) { |
| | | return false; |
| | | } |
| | | |
| | | |
| | | String nonce = authHeader.getNonce(); |
| | | URI uri = authHeader.getURI(); |
| | | if (uri == null) { |
| | | return false; |
| | | } |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | String A2 = request.getMethod().toUpperCase() + ":" + uri.toString(); |
| | | String HA1 = hashedPassword; |
| | | |
| | | |
| | | |
| | | byte[] mdbytes = messageDigest.digest(A2.getBytes()); |
| | | String HA2 = toHexString(mdbytes); |
| | | |
| | | |
| | | String cnonce = authHeader.getCNonce(); |
| | | String KD = HA1 + ":" + nonce; |
| | | if (cnonce != null) { |
| | |
| | | mdbytes = messageDigest.digest(KD.getBytes()); |
| | | String mdString = toHexString(mdbytes); |
| | | String response = authHeader.getResponse(); |
| | | |
| | | |
| | | |
| | | return mdString.equals(response); |
| | | } |
| | |
| | | * |
| | | * @param request - the request to authenticate. |
| | | * @param pass -- the plain text password. |
| | | * |
| | | * |
| | | * @return true if authentication succeded and false otherwise. |
| | | */ |
| | | public boolean doAuthenticatePlainTextPassword(Request request, String pass) { |
| | | AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME); |
| | | AuthorizationHeader authHeader = (AuthorizationHeader) request.getHeader(AuthorizationHeader.NAME); |
| | | if ( authHeader == null ) return false; |
| | | String realm = authHeader.getRealm().trim(); |
| | | String username = authHeader.getUsername().trim(); |
| | |
| | | String nonce = authHeader.getNonce(); |
| | | URI uri = authHeader.getURI(); |
| | | if (uri == null) { |
| | | return false; |
| | | return false; |
| | | } |
| | | // qop 保护质量 包含auth(默认的)和auth-int(增加了报文完整性检测)两种策略 |
| | | String qop = authHeader.getQop(); |
| | |
| | | String response = authHeader.getResponse(); |
| | | System.out.println("response: " + response); |
| | | return mdString.equals(response); |
| | | |
| | | |
| | | } |
| | | } |