<%@ page language="java" contentType="text/html;charset=UTF-8"%>
 <h1>Multi Factor Login</h1> 
 <form method="post" action="login"> 
 <input type="hidden" name="originalRequest" value="<%=request.getParameter("originalRequest") 
%>"/>
<br> 
   <input type="text" name="j_username" value=""/><br> 
   <input type="password" name="j_password" value=""/><br> 
   <input type="submit" name="submit" title="submit" value="submit"> 
</form>

<%@ page language="java" contentType="text/html;charset=ISO-8859-1" 
pageEncoding="ISO-8859-1"%> 
<h1>Multi Factor Login</h1> 
<form method="post" action="login"> 
   <input type="text" name="OTP" value=""/><br> 
   <input type="submit" name="submit" title="submit" value="submit"> 
</form>

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>login</web-resource-name>
      <url-pattern>/login</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>secured</role-name>
    </auth-constraint>
    </security-constraint>
    <security-role>
      <role-name>authenticatedusers</role-name>
  </security-role>

public final class MultiFactorIdentityAsserterProviderImpl implements
  AuthenticationProviderV2, ChallengeIdentityAsserterV2,
  ServletAuthenticationFilter {	
		
......................................................................

  public javax.servlet.Filter[] getServletAuthenticationFilters() {
    System.out.println("You are getting my filters....");
    return new Filter[] { new MultiFactorFilter(this.config), new SampleFilter() };
  }
  
  @Override
  public ProviderChallengeContext assertChallengeIdentity(String token,
	Object value, ContextHandler ctx) throws IdentityAssertionException {
      System.out.println("AssertChallengeIdentity");
      System.out.println("AssertChallengeContext " + token + " " + value
        + " " + Arrays.asList(ctx.getNames()));
		MultiFactorChallengeContext challengeCtx = 
			new MultiFactorChallengeContext(this.config);

		try {
			challengeCtx.processRequest(ctx);
		} catch (Exception e) {
			throw new IdentityAssertionException(e.getMessage());
		}

		if (challengeCtx.hasChallengeIdentityCompleted()) {

			complete(challengeCtx,ctx);

		}

		return challengeCtx;
	}

  @Override
  public void continueChallengeIdentity(
			ProviderChallengeContext providerChallengeContext, String arg1,
			Object arg2, ContextHandler ctx) throws IdentityAssertionException {
		// TODO Auto-generated method stub
		System.out.println("Continuing....");
		System.out.println("AssertChallengeContext " + arg1 + " " + arg2 + " "
				+ Arrays.asList(ctx.getNames()));

		MultiFactorChallengeContext challengeCtx = 
			(MultiFactorChallengeContext) providerChallengeContext;

		try {
			challengeCtx.processRequest(ctx);
		} catch (Exception e) {
			throw new IdentityAssertionException(e.getMessage());
		}}}

public class MultiFactorAuthenticationFilter implements Filter {

	private String [] protectedPaths;
	private String webAppPath;
	
	public MultiFactorAuthenticationFilter(MultiFactorAuthenticationProviderMBean config){
		// TODO Auto-generated constructor stub
		this.protectedPaths = config.getProtectedPaths();
		this.webAppPath = config.getMultiFactorWebAppPath();
		System.out.println("Filtering: "+Arrays.asList(this.protectedPaths));
	}

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		
	}

	@Override
	public void doFilter(ServletRequest req, ServletResponse resp,
			FilterChain chain) throws IOException, ServletException {
		// TODO Auto-generated method stub
		
		
		HttpServletRequest hReq = (HttpServletRequest)req;
		HttpServletResponse hResp = ((HttpServletResponse)resp);
		
		System.out.println("In MultiFactorFilter requestURI="+hReq.getRequestURI());
		
		if (!hReq.getRequestURI().startsWith(this.webAppPath)) {
		
			boolean isProtectedPath = false;
			
			for (int i=0; i<this.protectedPaths.length; i++) {
			
		if(hReq.getRequestURI().startsWith(this.protectedPaths[i])) {
					isProtectedPath = true;
					break;
				}
				
				
			}
			
			if (!isProtectedPath) {
				chain.doFilter(req, resp);
				return;
			}
		
		//This is not the /webAppPath path, so the user is accessing
		//a protected resource in a protected application.
		//Redirect the user over to the /webAppPath application for 
            //multifactor authentication.
			hResp.sendRedirect(this.webAppPath+"/?originalRequest="
				+URLEncoder.encode(hReq.getRequestURI()));
			return;
			
		}
		
		
		if (hReq.getMethod().equalsIgnoreCase("HEAD") ||
hReq.getHeader("Accept").contains("application/xrds+xml")) {
			
			System.out.println("Ignoring....REALM DISCOVERY");
			hResp.setStatus(HttpServletResponse.SC_OK);
			return;
			
		}		
		
		
Authentication auth = new weblogic.security.services.Authentication();
		
		try {
			
			HttpSession session = hReq.getSession(true);
			
			AppChallengeContext acc = 
				(AppChallengeContext)session.getAttribute("ChallengeCtx");
			
MultiFactorAuthenticationChallengeContext ctx = 
	new MultiFactorAuthenticationChallengeContext (req,resp);
	if (acc==null) {			
				
			acc = auth.assertChallengeIdentity("multi","multi",ctx);
				
		//This session is for the target application
		session.setAttribute("ChallengeCtx", acc);
	} else {
				
		auth.continueChallengeIdentity(acc, "multi", "multi",ctx);
	}
			
	if (acc.hasChallengeIdentityCompleted()) {
				
	String originalRequest = (String)hReq.getAttribute("originalRequest");
				
			System.out.println("Redirecting to: "+originalRequest);
				
		//Done -> if they don't get access, they'll need to log in again
		session.removeAttribute("ChallengeCtx");
				
           Subject subject = (Subject)session.getAttribute("subject");
		ServletAuthentication.runAs(subject, hReq);
				
           
	} else {
			
		Object challengeToken = acc.getChallengeToken();			
			
	if (challengeToken == null) {
			//Redirect to Login
			throw new ServletException("Challenge Token is NULL");
					
	} else {
					
		hResp.sendRedirect(this.webAppPath+"/otp.jsp");
			
	  }
				
				
				
	    }
			
	} catch (Exception e) {
			e.printStackTrace();
			throw new ServletException(e.getMessage());
	 }
		
		
	}

	@Override
	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub
		
		System.out.println("Initializing.....");
		
	}

}

public class MultiFactorAuthenticationChallengeContext implements ProviderChallengeContext {

	private boolean completed = false;
	private Object challengeToken = null;
	private CallbackHandler handler = null;

	private Subject discovered = null;
	
	private String originalRequest;
	
	private String webAppPath = null;
	
	public MultiFactorAuthenticationChallengeContext
		(MultiFactorAuthenticationProviderMBean config) {
		super();
		try {
					
			this.webAppPath = config.getMultiFactorWebAppPath();
			
		} catch (Exception e) {
			throw new SecurityException(e.getMessage());
		}
	}
................................................................................

	@Override
	public boolean hasChallengeIdentityCompleted() {
		// TODO Auto-generated method stub
		return completed;
	}

	
void processRequest(ContextHandler ctx) throws Exception {

	HttpServletRequest req = (HttpServletRequest) ctx.getValue("req");
		HttpSession session = req.getSession(true);

		if (session.getAttribute("subject") == null) {

			String userName = req.getParameter("j_username");
			String password = req.getParameter("j_password");

			if (userName == null || password == null) {
				
throw new Exception("No user name and password in request");
	} else {

		this.originalRequest = req.getParameter("originalRequest");
		System.out.println("Saving the original request: "+this.originalRequest);
		//validate the user name password
		Authentication auth = new weblogic.security.services.Authentication();
		
		try{
		Subject s = auth.login(new MyCallBackHandler(userName, password));
		session.setAttribute("subject", s);
		}catch(LoginException le){
			throw new Exception("Invalid user name/password", le);
		}
		this.generateOTP(req);

	}

    } else {
    
    	this.validateResponse(req);
    
    }

	}

	private void validateResponse(HttpServletRequest req)
			throws Exception {
		// TODO Auto-generated method stub

		System.out.println("Getting Validated....");
        String token = req.getParameter("OTP");
        if(token == null || token.length() == 0 || !this.challengeToken.equals(token)){
        	throw new Exception("Invalid OTP");
        }
        
        
        
		this.completed = true;
		if (this.originalRequest!=null) {
		//Set it as an attribute on the request, so the filter can use it
		req.setAttribute("originalRequest", this.originalRequest);
	} else {
		throw new Exception("Couldn't locate original request in ChallengeContext");
	}
	
	//return verified;  // success

	}

	private void generateOTP(HttpServletRequest req)
			throws Exception {
    // TODO Auto-generated method stub
       /*
        *this is for demo only. Write your custom code to 
		*generate a token and send it to user
        *using a mechanism which works for your env.
this.challengeToken = "0123456789";

	}

}

<MBeanAttribute  
  Name 		= "MultiFactorWebAppPath"
  Type 		= "java.lang.String"
  Default 	= ""/multifactor""
  Description = "The Path (Context Root) of the custom Web App 
  which is responsible for collecting user's credentials and OTP"
 /> 
<MBeanAttribute  
  Name 		= "ProtectedPaths"
  Type 		= "java.lang.String[]"
  Default 	= "new String[] { "/App" }"
  Description = "The paths of web apps that are protected by 
  multi factor authentication"
 />