001
014
015 package com.liferay.portal.servlet.filters.sso.ntlm;
016
017 import com.liferay.portal.kernel.log.Log;
018 import com.liferay.portal.kernel.log.LogFactoryUtil;
019 import com.liferay.portal.kernel.servlet.BrowserSnifferUtil;
020 import com.liferay.portal.kernel.servlet.HttpHeaders;
021 import com.liferay.portal.kernel.servlet.HttpMethods;
022 import com.liferay.portal.kernel.util.GetterUtil;
023 import com.liferay.portal.security.ldap.LDAPSettingsUtil;
024 import com.liferay.portal.servlet.filters.BasePortalFilter;
025 import com.liferay.portal.util.PortalInstances;
026
027 import javax.servlet.FilterChain;
028 import javax.servlet.http.HttpServletRequest;
029 import javax.servlet.http.HttpServletResponse;
030
031 import jcifs.ntlmssp.Type1Message;
032 import jcifs.ntlmssp.Type2Message;
033
034 import jcifs.util.Base64;
035
036
039 public class NtlmPostFilter extends BasePortalFilter {
040
041 protected Log getLog() {
042 return _log;
043 }
044
045 protected void processFilter(
046 HttpServletRequest request, HttpServletResponse response,
047 FilterChain filterChain)
048 throws Exception {
049
050 long companyId = PortalInstances.getCompanyId(request);
051
052 if (LDAPSettingsUtil.isNtlmEnabled(companyId) &&
053 BrowserSnifferUtil.isIe(request) &&
054 request.getMethod().equals(HttpMethods.POST)) {
055
056 String authorization = GetterUtil.getString(
057 request.getHeader(HttpHeaders.AUTHORIZATION));
058
059 if (authorization.startsWith("NTLM ")) {
060 byte[] src = Base64.decode(authorization.substring(5));
061
062 if (src[8] == 1) {
063 Type1Message type1 = new Type1Message(src);
064 Type2Message type2 = new Type2Message(
065 type1, new byte[8], null);
066
067 authorization = Base64.encode(type2.toByteArray());
068
069 response.setHeader(
070 HttpHeaders.WWW_AUTHENTICATE, "NTLM " + authorization);
071 response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
072 response.setContentLength(0);
073
074 response.flushBuffer();
075
076 return;
077 }
078 }
079 }
080
081 processFilter(NtlmPostFilter.class, request, response, filterChain);
082 }
083
084 private static Log _log = LogFactoryUtil.getLog(NtlmPostFilter.class);
085
086 }