org.sakaiproject.hybrid.util
Class XSakaiToken

java.lang.Object
  org.sakaiproject.hybrid.util.XSakaiToken

public class XSakaiToken
extends Object

Utility class for dealing with x-sakai-token semantics. Note: Class is thread safe.

Field Summary

protected org.sakaiproject.component.api.ComponentManager	componentManager
static String	CONFIG_PREFIX
static String	CONFIG_SHARED_SECRET_SUFFIX
protected org.sakaiproject.component.api.ServerConfigurationService	serverConfigurationService
protected org.sakaiproject.tool.api.SessionManager	sessionManager
protected Signature	signature
static String	TOKEN_SEPARATOR
static String	X_SAKAI_TOKEN_HEADER

Constructor Summary

XSakaiToken(org.sakaiproject.component.api.ComponentManager componentManager)

Method Summary

String	createToken(String hostname) This is the preferred signature for the createToken methods as it looks up the current userId from the current session.
String	createToken(String hostname, String eid) Perform sharedSecret lookup from getSharedSecret(String), compute hash based on eid and return token.
String	getSharedSecret(String hostname) Look up a sharedSecret from sakai.properties.
String	getToken(javax.servlet.http.HttpServletRequest request) Simply grab the x-sakai-token from the request.
String	getValidatedEid(javax.servlet.http.HttpServletRequest request, String sharedSecret) Validate the token using the passed sharedSecret and return username.
String	getValidatedEid(String token, String sharedSecret) Validate the token using the passed sharedSecret and return username.
String	signMessage(String sharedSecret, String eid) Compute hash based on sharedSecret and eid.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

X_SAKAI_TOKEN_HEADER

public static final String X_SAKAI_TOKEN_HEADER

See Also:

Constant Field Values

CONFIG_PREFIX

public static final String CONFIG_PREFIX

See Also:

Constant Field Values

CONFIG_SHARED_SECRET_SUFFIX

public static final String CONFIG_SHARED_SECRET_SUFFIX

See Also:

Constant Field Values

TOKEN_SEPARATOR

public static final String TOKEN_SEPARATOR

See Also:

Constant Field Values

signature

protected transient Signature signature

componentManager

protected transient org.sakaiproject.component.api.ComponentManager componentManager

serverConfigurationService

protected transient org.sakaiproject.component.api.ServerConfigurationService serverConfigurationService

sessionManager

protected transient org.sakaiproject.tool.api.SessionManager sessionManager

Constructor Detail

XSakaiToken

public XSakaiToken(org.sakaiproject.component.api.ComponentManager componentManager)

Parameters:

componentManager - Used to obtain references to ServerConfigurationService, and SessionManager

Throws:

IllegalArgumentException

IllegalStateException

Method Detail

getToken

public String getToken(javax.servlet.http.HttpServletRequest request)

Simply grab the x-sakai-token from the request. Does not validate results; i.e. raw data retrieval from request.

Parameters:

request -

Returns:

token

Throws:

IllegalArgumentException

getValidatedEid

public String getValidatedEid(javax.servlet.http.HttpServletRequest request,
                              String sharedSecret)

Validate the token using the passed sharedSecret and return username.

Parameters:

request -

sharedSecret -

Returns:

eid

Throws:

IllegalArgumentException

getValidatedEid

public String getValidatedEid(String token,
                              String sharedSecret)

Validate the token using the passed sharedSecret and return username.

Parameters:

token - null values are acceptable.

sharedSecret -

Returns:

eid if valid. null if not valid.

Throws:

IllegalArgumentException

createToken

public String createToken(String hostname)

This is the preferred signature for the createToken methods as it looks up the current userId from the current session. Therefore it is a little safer.

Parameters:

hostname - Fully qualified domain name or an IP address. See: getSharedSecret(String).

Returns:

token

Throws:

IllegalArgumentException

createToken

public String createToken(String hostname,
                          String eid)
                   throws Error

Perform sharedSecret lookup from getSharedSecret(String), compute hash based on eid and return token. If possible, you should use the createToken(String) method signature as it is less error prone.

Parameters:

hostname - Fully qualified domain name or an IP address. See: getSharedSecret(String).

eid - Enterprise user id; usually a username.

Returns:

token

Throws:

Error - Wrapped exception if there is any unexpected trouble.

IllegalArgumentException

signMessage

public String signMessage(String sharedSecret,
                          String eid)

Compute hash based on sharedSecret and eid.

Parameters:

sharedSecret -

eid - Enterprise user id; usually a username.

Returns:

Fully computed token.

Throws:

Error - Wrapped exception if there is any unexpected trouble.

IllegalArgumentException

IllegalStateException - Wraps SignatureException into a RuntimeException.

getSharedSecret

public String getSharedSecret(String hostname)

Look up a sharedSecret from sakai.properties. For example:
x.sakai.token.server.domain.name.sharedSecret=yourSecret or
x.sakai.token.127.0.0.1.sharedSecret=yourSecret

Parameters:

hostname - Fully qualified domain name or an IP address.

Returns:

null if not found.

Throws:

IllegalArgumentException