org.apache.derby.impl.jdbc.authentication

Class AuthenticationServiceBase

java.lang.Object

org.apache.derby.impl.jdbc.authentication.AuthenticationServiceBase

All Implemented Interfaces:

AuthenticationService, ModuleControl, ModuleSupportable, PropertySetCallback

Direct Known Subclasses:

BasicAuthenticationServiceImpl, JNDIAuthenticationService, NativeAuthenticationServiceImpl, NoneAuthenticationServiceImpl, SpecificAuthenticationServiceImpl

public abstract class AuthenticationServiceBase
extends java.lang.Object
implements AuthenticationService, ModuleControl, ModuleSupportable, PropertySetCallback

This is the authentication service base class.

There can be 1 Authentication Service for the whole Derby system and/or 1 authentication per database. In a near future, we intend to allow multiple authentication services per system and/or per database.

It should be extended by the specialized authentication services.

IMPORTANT NOTE:

User passwords are hashed using a message digest algorithm if they're stored in the database. They are not hashed if they were defined at the system level.

The passwords can be hashed using two different schemes:

• The SHA-1 authentication scheme, which was the only available scheme in Derby 10.5 and earlier. This scheme uses the SHA-1 message digest algorithm.
• The configurable hash authentication scheme, which allows the users to specify which message digest algorithm to use.

In order to use the configurable hash authentication scheme, the users have to set the derby.authentication.builtin.algorithm property (on system level or database level) to the name of an algorithm that's available in one of the security providers registered on the system. If this property is not set, or if it's set to NULL or an empty string, the SHA-1 authentication scheme is used.

Which scheme to use is decided when a password is about to be stored in the database. One database may therefore contain passwords stored using different schemes. In order to determine which scheme to use when comparing a user's credentials with those stored in the database, the stored password is prefixed with an identifier that tells which scheme is being used. Passwords stored using the SHA-1 authentication scheme are prefixed with PasswordHasher.ID_PATTERN_SHA1_SCHEME. Passwords that are stored using the configurable hash authentication scheme are prefixed with PasswordHasher.ID_PATTERN_CONFIGURABLE_HASH_SCHEME and suffixed with the name of the message digest algorithm.

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	AuthenticationTrace Trace flag to trace authentication operations

Fields inherited from interface org.apache.derby.iapi.jdbc.AuthenticationService

MODULE

Constructor Summary

Constructors

Constructor and Description
AuthenticationServiceBase()

Method Summary

Modifier and Type	Method and Description
Serviceable	apply(java.lang.String key, java.io.Serializable value, java.util.Dictionary p) Apply a property change.
boolean	authenticate(java.lang.String databaseName, java.util.Properties userInfo) Authenticate a User inside JBMS.T his is an overload method.
void	boot(boolean create, java.util.Properties properties) Start this module.
java.lang.String	getDatabaseProperty(java.lang.String key)
java.lang.String	getProperty(java.lang.String key) Returns a property if it was set at the database or system level.
java.lang.String	getSystemCredentialsDatabaseName() Get the name of the credentials database used to authenticate system-wide operations.
java.lang.String	getSystemProperty(java.lang.String key)
void	init(boolean dbOnly, java.util.Dictionary p) Initialize the properties for this callback.
java.io.Serializable	map(java.lang.String key, java.io.Serializable value, java.util.Dictionary p) Map a proposed new value for a property to an official value.
void	stop() Stop the module.
boolean	validate(java.lang.String key, java.io.Serializable value, java.util.Dictionary p) Validate a property change.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.derby.iapi.services.monitor.ModuleSupportable

canSupport

Field Detail

AuthenticationTrace

public static final java.lang.String AuthenticationTrace

Trace flag to trace authentication operations

Constructor Detail

AuthenticationServiceBase

public AuthenticationServiceBase()

Method Detail

boot

public void boot(boolean create,
                 java.util.Properties properties)
          throws StandardException

Start this module. In this case, nothing needs to be done.

Specified by:

boot in interface ModuleControl

Throws:

StandardException - upon failure to load/boot the expected authentication service.

See Also:

ModuleControl.boot(boolean, java.util.Properties)

stop

public void stop()

Description copied from interface: ModuleControl

Stop the module. The module may be found via a findModule() method until some time after this method returns. Therefore the factory must be prepared to reject requests to it once it has been stopped. In addition other modules may cache a reference to the module and make requests of it after it has been stopped, these requests should be rejected as well.

Specified by:

stop in interface ModuleControl

See Also:

ModuleControl.stop()

authenticate

public boolean authenticate(java.lang.String databaseName,
                            java.util.Properties userInfo)
                     throws java.sql.SQLException

Authenticate a User inside JBMS.T his is an overload method. We're passed-in a Properties object containing user credentials information (as well as database name if user needs to be validated for a certain database access).

Specified by:

authenticate in interface AuthenticationService

userInfo - Connection properties info. failure.

Throws:

java.sql.SQLException

See Also:

AuthenticationService.authenticate(java.lang.String, java.util.Properties)

getSystemCredentialsDatabaseName

public java.lang.String getSystemCredentialsDatabaseName()

Description copied from interface: AuthenticationService

Get the name of the credentials database used to authenticate system-wide operations. This returns null for all implementations except NATIVE authentication.

Specified by:

getSystemCredentialsDatabaseName in interface AuthenticationService

getProperty

public java.lang.String getProperty(java.lang.String key)

Returns a property if it was set at the database or system level. Treated as SERVICE property by default.

Returns:

a property string value.

getDatabaseProperty

public java.lang.String getDatabaseProperty(java.lang.String key)

getSystemProperty

public java.lang.String getSystemProperty(java.lang.String key)

init

public void init(boolean dbOnly,
                 java.util.Dictionary p)

Description copied from interface: PropertySetCallback

Initialize the properties for this callback. Called when addPropertySetNotification() is called with a non-null transaction controller. This allows code to set read its initial property values at boot time.

Code within an init() method should use the 3 argument PropertyUtil method getPropertyFromSet() to obtain a property's value.

Specified by:

init in interface PropertySetCallback

Parameters:

dbOnly - true if only per-database properties are to be looked at

p - the complete set of per-database properties.

validate

public boolean validate(java.lang.String key,
                        java.io.Serializable value,
                        java.util.Dictionary p)
                 throws StandardException

Description copied from interface: PropertySetCallback

Validate a property change.

Specified by:

validate in interface PropertySetCallback

Parameters:

key - Property key for the property being set

value - proposed new value for the property being set or null if the property is being dropped.

p - Property set before the change. SettingProperty may read but must never change p.

Returns:

true if this object was interested in this property, false otherwise.

Throws:

StandardException - Oh well.

See Also:

PropertySetCallback.validate(java.lang.String, java.io.Serializable, java.util.Dictionary)

apply

public Serviceable apply(java.lang.String key,
                         java.io.Serializable value,
                         java.util.Dictionary p)

Description copied from interface: PropertySetCallback

Apply a property change. Will only be called after validate has been called and only if validate returned true. If this method is called then the new value is the value to be used, ie. the property is not set in the overriding JVM system set.

Specified by:

apply in interface PropertySetCallback

Parameters:

key - Property key for the property being set

value - proposed new value for the property being set or null if the property is being dropped.

p - Property set before the change. SettingProperty may read but must never change p.

Returns:

post commit work for the property change.

See Also:

PropertySetCallback.validate(java.lang.String, java.io.Serializable, java.util.Dictionary)

map

public java.io.Serializable map(java.lang.String key,
                                java.io.Serializable value,
                                java.util.Dictionary p)
                         throws StandardException

Description copied from interface: PropertySetCallback

Map a proposed new value for a property to an official value. Will only be called after apply() has been called.

Specified by:

map in interface PropertySetCallback

Parameters:

key - Property key for the property being set

value - proposed new value for the property being set or null if the property is being dropped.

p - Property set before the change. SettingProperty may read but must never change p.

Returns:

new value for the change

Throws:

StandardException - Thrown on error.

See Also:

PropertySetCallback.map(java.lang.String, java.io.Serializable, java.util.Dictionary)