HttpSessionLoginModule.java

   1 package org.argeo.cms.auth;
   2
   3 import java.io.IOException;
   4 import java.util.Collection;
   5 import java.util.Map;
   6
   7 import javax.security.auth.Subject;
   8 import javax.security.auth.callback.Callback;
   9 import javax.security.auth.callback.CallbackHandler;
  10 import javax.security.auth.callback.UnsupportedCallbackException;
  11 import javax.security.auth.login.LoginException;
  12 import javax.security.auth.spi.LoginModule;
  13 import javax.servlet.http.HttpServletRequest;
  14
  15 import org.apache.commons.logging.Log;
  16 import org.apache.commons.logging.LogFactory;
  17 import org.argeo.cms.CmsException;
  18 import org.argeo.cms.internal.kernel.WebCmsSessionImpl;
  19 import org.osgi.framework.BundleContext;
  20 import org.osgi.framework.FrameworkUtil;
  21 import org.osgi.framework.InvalidSyntaxException;
  22 import org.osgi.framework.ServiceReference;
  23 import org.osgi.service.http.HttpContext;
  24 import org.osgi.service.useradmin.Authorization;
  25
  26 public class HttpSessionLoginModule implements LoginModule {
  27         private final static Log log = LogFactory.getLog(HttpSessionLoginModule.class);
  28
  29         private Subject subject = null;
  30         private CallbackHandler callbackHandler = null;
  31         private Map<String, Object> sharedState = null;
  32
  33         private HttpServletRequest request = null;
  34
  35         private BundleContext bc;
  36
  37         private Authorization authorization;
  38
  39         @SuppressWarnings("unchecked")
  40         @Override
  41         public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
  42                         Map<String, ?> options) {
  43                 bc = FrameworkUtil.getBundle(HttpSessionLoginModule.class).getBundleContext();
  44                 assert bc != null;
  45                 this.subject = subject;
  46                 this.callbackHandler = callbackHandler;
  47                 this.sharedState = (Map<String, Object>) sharedState;
  48         }
  49
  50         @Override
  51         public boolean login() throws LoginException {
  52                 if (callbackHandler == null)
  53                         return false;
  54                 HttpRequestCallback httpCallback = new HttpRequestCallback();
  55                 try {
  56                         callbackHandler.handle(new Callback[] { httpCallback });
  57                 } catch (IOException e) {
  58                         throw new LoginException("Cannot handle http callback: " + e.getMessage());
  59                 } catch (UnsupportedCallbackException e) {
  60                         return false;
  61                 }
  62                 request = httpCallback.getRequest();
  63                 if (request == null)
  64                         return false;
  65                 authorization = (Authorization) request.getAttribute(HttpContext.AUTHORIZATION);
  66                 if (authorization == null) {// search by session ID
  67                         String httpSessionId = request.getSession().getId();
  68                         // authorization = (Authorization)
  69                         // request.getSession().getAttribute(HttpContext.AUTHORIZATION);
  70                         // if (authorization == null) {
  71                         Collection<ServiceReference<WebCmsSession>> sr;
  72                         try {
  73                                 sr = bc.getServiceReferences(WebCmsSession.class,
  74                                                 "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")");
  75                         } catch (InvalidSyntaxException e) {
  76                                 throw new CmsException("Cannot get CMS session for id " + httpSessionId, e);
  77                         }
  78                         if (sr.size() == 1) {
  79                                 WebCmsSession cmsSession = bc.getService(sr.iterator().next());
  80                                 authorization = cmsSession.getAuthorization();
  81                                 if (log.isTraceEnabled())
  82                                         log.trace("Retrieved authorization from " + cmsSession);
  83                         } else if (sr.size() == 0)
  84                                 authorization = null;
  85                         else
  86                                 throw new CmsException(sr.size() + ">1 web sessions detected for http session " + httpSessionId);
  87
  88                 }
  89                 sharedState.put(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST, request);
  90                 if (authorization == null)
  91                         return false;
  92                 sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION, authorization);
  93                 return true;
  94         }
  95
  96         // private Authorization checkHttp() {
  97         // Authorization authorization = null;
  98         // if (request != null) {
  99         // authorization = (Authorization)
 100         // request.getAttribute(HttpContext.AUTHORIZATION);
 101         // if (authorization == null) {
 102         // String httpSessionId = request.getSession().getId();
 103         // authorization = (Authorization)
 104         // request.getSession().getAttribute(HttpContext.AUTHORIZATION);
 105         // if (authorization == null) {
 106         // Collection<ServiceReference<WebCmsSession>> sr;
 107         // try {
 108         // sr = bc.getServiceReferences(WebCmsSession.class,
 109         // "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")");
 110         // } catch (InvalidSyntaxException e) {
 111         // throw new CmsException("Cannot get CMS session for id " + httpSessionId,
 112         // e);
 113         // }
 114         // if (sr.size() == 1) {
 115         // WebCmsSession cmsSession = bc.getService(sr.iterator().next());
 116         // authorization = cmsSession.getAuthorization();
 117         // if (log.isTraceEnabled())
 118         // log.trace("Retrieved authorization from " + cmsSession);
 119         // } else if (sr.size() == 0)
 120         // return null;
 121         // else
 122         // throw new CmsException(
 123         // sr.size() + ">1 web sessions detected for http session " +
 124         // httpSessionId);
 125         // }
 126         // }
 127         // }
 128         // return authorization;
 129         // }
 130
 131         @Override
 132         public boolean commit() throws LoginException {
 133                 // TODO create CmsSession in another module
 134                 Authorization authorizationToRegister;
 135                 if (authorization == null) {
 136                         authorizationToRegister = (Authorization) sharedState.get(CmsAuthUtils.SHARED_STATE_AUTHORIZATION);
 137                 } else { // this login module did the authorization
 138                         CmsAuthUtils.addAuthentication(subject, authorization);
 139                         authorizationToRegister = authorization;
 140                 }
 141                 if (authorizationToRegister == null) {
 142                         return false;
 143                 }
 144                 if (request == null)
 145                         return false;
 146                 CmsAuthUtils.registerSessionAuthorization(bc, request, subject, authorizationToRegister);
 147
 148                 if (authorization != null) {
 149                         // CmsAuthUtils.addAuthentication(subject, authorization);
 150                         cleanUp();
 151                         return true;
 152                 } else {
 153                         cleanUp();
 154                         return false;
 155                 }
 156         }
 157
 158         @Override
 159         public boolean abort() throws LoginException {
 160                 cleanUp();
 161                 return false;
 162         }
 163
 164         private void cleanUp() {
 165                 authorization = null;
 166                 request = null;
 167         }
 168
 169         @Override
 170         public boolean logout() throws LoginException {
 171                 return CmsAuthUtils.logoutSession(bc, subject);
 172         }
 173
 174 }