Merge pull request #237 from dwd/proxy-auth

Add Proxy Authorization to DefaultAuthorizationPolicy

src/java/org/jivesoftware/openfire/auth/DefaultAuthorizationPolicy.java

@@ -23,6 +23,7 @@ package org.jivesoftware.openfire.auth;
 import java.util.StringTokenizer;
 import java.util.Vector;
 
+import org.jivesoftware.openfire.admin.AdminManager;
 import org.jivesoftware.util.JiveGlobals;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -62,9 +63,11 @@ public class DefaultAuthorizationPolicy implements AuthorizationPolicy {
 	private static final Logger Log = LoggerFactory.getLogger(DefaultAuthorizationPolicy.class);
 
     private Vector<String> approvedRealms;
+    private boolean proxyAuth;
 
     public DefaultAuthorizationPolicy() {
         approvedRealms = new Vector<String>();
+        proxyAuth = false;
         
         String realmList = JiveGlobals.getProperty("sasl.approvedRealms");
         if(realmList != null) {
@@ -73,6 +76,7 @@ public class DefaultAuthorizationPolicy implements AuthorizationPolicy {
                 approvedRealms.add(st.nextToken());
             }
         }
+        proxyAuth = JiveGlobals.getBooleanProperty("sasl.proxyAuth", false);
     }
 
     /**
@@ -100,6 +104,7 @@ public class DefaultAuthorizationPolicy implements AuthorizationPolicy {
             authenRealm = authenID.substring((authenID.lastIndexOf("@")+1));
         }
 
+        if (!proxyAuth || !AdminManager.getInstance().isUserAdmin(authenUser, true)) {
             if(!userUser.equals(authenUser)) {
                 //for this policy the user portion of both must match, so lets short circut here if we can
                 if(JiveGlobals.getBooleanProperty("xmpp.auth.ignorecase",true)) {
@@ -114,6 +119,7 @@ public class DefaultAuthorizationPolicy implements AuthorizationPolicy {
                     return false;
                 }
             }
+        }
         Log.debug("DefaultAuthorizationPolicy: Checking authenID realm");
         // Next up, check if the authenID realm is acceptable. 
         if(authenRealm != null) {