DataHttpContext.java

   1 package org.argeo.cms.internal.http;
   2
   3 import java.io.IOException;
   4 import java.net.URL;
   5
   6 import javax.security.auth.login.LoginContext;
   7 import javax.security.auth.login.LoginException;
   8 import javax.servlet.http.HttpServletRequest;
   9 import javax.servlet.http.HttpServletResponse;
  10
  11 import org.apache.commons.logging.Log;
  12 import org.apache.commons.logging.LogFactory;
  13 import org.argeo.api.NodeConstants;
  14 import org.argeo.cms.auth.HttpRequestCallbackHandler;
  15 import org.osgi.framework.BundleContext;
  16 import org.osgi.framework.FrameworkUtil;
  17 import org.osgi.service.http.HttpContext;
  18
  19 public class DataHttpContext implements HttpContext {
  20         private final static Log log = LogFactory.getLog(DataHttpContext.class);
  21
  22         private final BundleContext bc = FrameworkUtil.getBundle(getClass()).getBundleContext();
  23
  24         // FIXME Make it more unique
  25         private final String httpAuthRealm;
  26         private final boolean forceBasic;
  27
  28         public DataHttpContext(String httpAuthrealm, boolean forceBasic) {
  29                 this.httpAuthRealm = httpAuthrealm;
  30                 this.forceBasic = forceBasic;
  31         }
  32
  33         public DataHttpContext(String httpAuthrealm) {
  34                 this(httpAuthrealm, false);
  35         }
  36
  37         @Override
  38         public boolean handleSecurity(final HttpServletRequest request, HttpServletResponse response) throws IOException {
  39
  40                 if (log.isTraceEnabled())
  41                         HttpUtils.logRequestHeaders(log, request);
  42                 LoginContext lc;
  43                 try {
  44                         lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER, new HttpRequestCallbackHandler(request, response));
  45                         lc.login();
  46                 } catch (LoginException e) {
  47                         lc = processUnauthorized(request, response);
  48                         if (lc == null)
  49                                 return false;
  50                 }
  51                 return true;
  52         }
  53
  54         @Override
  55         public URL getResource(String name) {
  56                 return bc.getBundle().getResource(name);
  57         }
  58
  59         @Override
  60         public String getMimeType(String name) {
  61                 return null;
  62         }
  63
  64         protected LoginContext processUnauthorized(HttpServletRequest request, HttpServletResponse response) {
  65                 // anonymous
  66                 try {
  67                         LoginContext lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_ANONYMOUS, new HttpRequestCallbackHandler(request, response));
  68                         lc.login();
  69                         return lc;
  70                 } catch (LoginException e1) {
  71                         if (log.isDebugEnabled())
  72                                 log.error("Cannot log in as anonymous", e1);
  73                         return null;
  74                 }
  75         }
  76         protected void askForWwwAuth(HttpServletRequest request, HttpServletResponse response) {
  77                 response.setStatus(401);
  78                 // response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "basic
  79                 // realm=\"" + httpAuthRealm + "\"");
  80                 if (org.argeo.cms.internal.kernel.Activator.getAcceptorCredentials() != null && !forceBasic)// SPNEGO
  81                         response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "Negotiate");
  82                 else
  83                         response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "Basic realm=\"" + httpAuthRealm + "\"");
  84
  85                 // response.setDateHeader("Date", System.currentTimeMillis());
  86                 // response.setDateHeader("Expires", System.currentTimeMillis() + (24 *
  87                 // 60 * 60 * 1000));
  88                 // response.setHeader("Accept-Ranges", "bytes");
  89                 // response.setHeader("Connection", "Keep-Alive");
  90                 // response.setHeader("Keep-Alive", "timeout=5, max=97");
  91                 // response.setContentType("text/html; charset=UTF-8");
  92
  93         }
  94
  95 }