forked from sakaiproject/sakai
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
SAK-32699 IP whitelist for internal user authentication (sakaiproject…
…#4633) * SAK-32699 IP whitelisting for internal user authentication * SAK-32699 Change authentication for SakaiLogin so that whitelist is effective * SAK-32699 Update entitybroker session provider to use authenticationManager
- Loading branch information
Showing
19 changed files
with
292 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
84 changes: 84 additions & 0 deletions
84
kernel/kernel-util/src/main/java/org/sakaiproject/util/IPAddrUtil.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| /********************************************************************************** | ||
| * $URL$ | ||
| * $Id$ | ||
| *********************************************************************************** | ||
| * | ||
| * Copyright (c) 2017 Apereo Foundation | ||
| * | ||
| * Licensed under the Educational Community License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.opensource.org/licenses/ECL-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| **********************************************************************************/ | ||
|
|
||
| package org.sakaiproject.util; | ||
|
|
||
| import java.util.Arrays; | ||
| import java.util.List; | ||
|
|
||
| import org.apache.commons.lang.StringUtils; | ||
| import org.apache.commons.net.util.SubnetUtils; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| /** | ||
| * <p> | ||
| * IPAddrUtil contains utility methods for working with IP addresses. | ||
| * </p> | ||
| */ | ||
| public class IPAddrUtil | ||
| { | ||
| private static final Logger log = LoggerFactory.getLogger(IPAddrUtil.class); | ||
|
|
||
| /** | ||
| * Match an address against a list of IP CIDR addresses | ||
| * | ||
| * @param addrlist | ||
| * The comma-separated list of addresses | ||
| * @param addr | ||
| * The IP address to match | ||
| * @return true if address is contained in one or more of the CIDR network blocks listed in addrlist, false if not | ||
| */ | ||
| public static boolean matchIPList(String addrlist, String addr) | ||
| { | ||
| log.info("Checking login IP '" + addr + "' is contained in whitelist '" + addrlist + "'"); | ||
|
|
||
| // TODO Support IPv6 | ||
|
|
||
| if (StringUtils.isBlank(addrlist) || StringUtils.isBlank(addr)) | ||
| return false; | ||
|
|
||
| boolean match = false; | ||
|
|
||
| for (String netaddr : Arrays.asList(addrlist.split(","))) { | ||
| if (netaddr.contains("/")) { | ||
| // Contained in subnet? | ||
| try { | ||
| SubnetUtils.SubnetInfo subnet = new SubnetUtils(netaddr.trim()).getInfo(); | ||
| if (subnet.isInRange(addr)) { | ||
| log.debug("IP Address " + addr + " is in network range " + subnet.getCidrSignature()); | ||
| match = true; | ||
| break; | ||
| } | ||
| } catch (IllegalArgumentException e) { | ||
| log.warn("IP network address '" + netaddr + "' is not a valid CIDR format"); | ||
| } | ||
| } else { | ||
| // Exact match? | ||
| if (netaddr.trim().equals(addr)) { | ||
| match = true; | ||
| break; | ||
| } | ||
| } | ||
| } | ||
| return match; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
75 changes: 75 additions & 0 deletions
75
kernel/kernel-util/src/test/java/org/sakaiproject/util/IPAddrUtilTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| /********************************************************************************** | ||
| * $URL:$ | ||
| * $Id:$ | ||
| *********************************************************************************** | ||
| * | ||
| * Copyright (c) 2007, 2008 Sakai Foundation | ||
| * | ||
| * Licensed under the Educational Community License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.opensource.org/licenses/ECL-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| **********************************************************************************/ | ||
|
|
||
| package org.sakaiproject.util; | ||
|
|
||
| import org.junit.Assert; | ||
| import org.junit.Ignore; | ||
| import org.junit.Test; | ||
| import org.sakaiproject.util.IPAddrUtil; | ||
|
|
||
|
|
||
| /** | ||
| * Testing the IPAddrUtil | ||
| */ | ||
| public class IPAddrUtilTest { | ||
|
|
||
| /** | ||
| * Test method for {@link org.sakaiproject.content.util.IPAddrUtil#matchIPList()}. | ||
| * | ||
| */ | ||
| @Test | ||
| public void testMatchIPList() { | ||
|
|
||
| String privateRanges = "10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 , 198.51.100.0/24, 127.0.0.0/8"; | ||
|
|
||
| // null or empty list never matches | ||
| Assert.assertFalse(IPAddrUtil.matchIPList("", "1.2.3.4")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(null, "1.2.3.4")); | ||
|
|
||
| // Inside the range | ||
| Assert.assertTrue(IPAddrUtil.matchIPList(privateRanges, "10.0.3.1")); | ||
| Assert.assertTrue(IPAddrUtil.matchIPList(privateRanges, "172.25.3.250")); | ||
| Assert.assertTrue(IPAddrUtil.matchIPList(privateRanges, "192.168.4.10")); | ||
| Assert.assertTrue(IPAddrUtil.matchIPList(privateRanges, "127.0.0.1")); | ||
|
|
||
| // Outside the range | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "11.0.3.1")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "172.32.0.0")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "192.169.0.1")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "128.3.2.1")); | ||
|
|
||
| // Invalid address format | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "301.3.2.1")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "10.0.3")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList(privateRanges, "address")); | ||
|
|
||
| // Invalid format inside the list | ||
| Assert.assertTrue(IPAddrUtil.matchIPList("10.0.0.0/8,address,127.0.0.0/8", "10.0.0.1")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList("10.0.0.0:8,address,127.0.0.0/8", "10.0.0.1")); | ||
|
|
||
| // Single address | ||
| Assert.assertTrue(IPAddrUtil.matchIPList("10.0.0.33,address,127.0.0.0/8", "10.0.0.33")); | ||
| Assert.assertFalse(IPAddrUtil.matchIPList("10.0.0.33,address,127.0.0.0/8", "10.0.0.32")); | ||
|
|
||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.