org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java

   1 package org.argeo.cms.auth;
   2
   3 import java.io.IOException;
   4 import java.security.PrivilegedAction;
   5 import java.util.ArrayList;
   6 import java.util.Arrays;
   7 import java.util.List;
   8 import java.util.Locale;
   9 import java.util.Map;
  10 import java.util.Set;
  11
  12 import javax.naming.ldap.LdapName;
  13 import javax.security.auth.Subject;
  14 import javax.security.auth.callback.Callback;
  15 import javax.security.auth.callback.CallbackHandler;
  16 import javax.security.auth.callback.LanguageCallback;
  17 import javax.security.auth.callback.NameCallback;
  18 import javax.security.auth.callback.PasswordCallback;
  19 import javax.security.auth.callback.UnsupportedCallbackException;
  20 import javax.security.auth.kerberos.KerberosPrincipal;
  21 import javax.security.auth.login.CredentialNotFoundException;
  22 import javax.security.auth.login.FailedLoginException;
  23 import javax.security.auth.login.LoginException;
  24 import javax.security.auth.spi.LoginModule;
  25 import javax.servlet.http.HttpServletRequest;
  26
  27 import org.apache.commons.logging.Log;
  28 import org.apache.commons.logging.LogFactory;
  29 import org.argeo.cms.CmsException;
  30 import org.argeo.eclipse.ui.specific.UiContext;
  31 import org.argeo.naming.LdapAttrs;
  32 import org.argeo.osgi.useradmin.IpaUtils;
  33 import org.osgi.framework.BundleContext;
  34 import org.osgi.framework.FrameworkUtil;
  35 import org.osgi.service.useradmin.Authorization;
  36 import org.osgi.service.useradmin.User;
  37 import org.osgi.service.useradmin.UserAdmin;
  38
  39 public class UserAdminLoginModule implements LoginModule {
  40         private final static Log log = LogFactory.getLog(UserAdminLoginModule.class);
  41
  42         private Subject subject;
  43         private CallbackHandler callbackHandler;
  44         private Map<String, Object> sharedState = null;
  45
  46         private List<String> indexedUserProperties = Arrays
  47                         .asList(new String[] { LdapAttrs.uid.name(), LdapAttrs.mail.name(), LdapAttrs.cn.name() });
  48
  49         // private state
  50         private BundleContext bc;
  51         private User authenticatedUser = null;
  52
  53         @SuppressWarnings("unchecked")
  54         @Override
  55         public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
  56                         Map<String, ?> options) {
  57                 this.subject = subject;
  58                 try {
  59                         bc = FrameworkUtil.getBundle(UserAdminLoginModule.class).getBundleContext();
  60                         this.callbackHandler = callbackHandler;
  61                         this.sharedState = (Map<String, Object>) sharedState;
  62                 } catch (Exception e) {
  63                         throw new CmsException("Cannot initialize login module", e);
  64                 }
  65         }
  66
  67         @Override
  68         public boolean login() throws LoginException {
  69                 // Authorization sharedAuth = (Authorization)
  70                 // sharedState.get(CmsAuthUtils.SHARED_STATE_AUTHORIZATION);
  71                 // if (sharedAuth != null) {
  72                 // if (callbackHandler == null && sharedAuth.getName() != null)
  73                 // throw new LoginException("Shared authorization should be anonymous");
  74                 // return false;
  75                 // }
  76                 UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
  77                 if (callbackHandler == null) {// anonymous
  78                         // authorization = userAdmin.getAuthorization(null);
  79                         // sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION,
  80                         // authorization);
  81                         return true;
  82                 }
  83
  84                 final String username;
  85                 final char[] password;
  86                 if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  87                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_PWD)) {
  88                         // NB: required by Basic http auth
  89                         username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
  90                         password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
  91                         // // TODO locale?
  92                         // // NB: raw user name is used
  93                         // AuthenticatingUser authenticatingUser = new
  94                         // AuthenticatingUser(username, password);
  95                         // authorization = userAdmin.getAuthorization(authenticatingUser);
  96                 } else {
  97                         // ask for username and password
  98                         NameCallback nameCallback = new NameCallback("User");
  99                         PasswordCallback passwordCallback = new PasswordCallback("Password", false);
 100                         LanguageCallback langCallback = new LanguageCallback();
 101                         try {
 102                                 callbackHandler.handle(new Callback[] { nameCallback, passwordCallback, langCallback });
 103                         } catch (IOException e) {
 104                                 throw new LoginException("Cannot handle callback: " + e.getMessage());
 105                         } catch (UnsupportedCallbackException e) {
 106                                 return false;
 107                         }
 108
 109                         // i18n
 110                         Locale locale = langCallback.getLocale();
 111                         if (locale == null)
 112                                 locale = Locale.getDefault();
 113                         UiContext.setLocale(locale);
 114
 115                         username = nameCallback.getName();
 116                         if (username == null || username.trim().equals("")) {
 117                                 // authorization = userAdmin.getAuthorization(null);
 118                                 throw new CredentialNotFoundException("No credentials provided");
 119                         }
 120                         if (passwordCallback.getPassword() != null)
 121                                 password = passwordCallback.getPassword();
 122                         else
 123                                 throw new CredentialNotFoundException("No credentials provided");
 124                 }
 125
 126                 // User user = userAdmin.getUser(null, username);
 127                 User user = searchForUser(userAdmin, username);
 128                 if (user == null)
 129                         return true;// expect Kerberos
 130                 // throw new FailedLoginException("Invalid credentials");
 131                 if (!user.hasCredential(null, password))
 132                         throw new FailedLoginException("Invalid credentials");
 133                 authenticatedUser = user;
 134                 return true;
 135         }
 136
 137         @Override
 138         public boolean commit() throws LoginException {
 139                 UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
 140                 Authorization authorization;
 141                 if (callbackHandler == null) {// anonymous
 142                         authorization = userAdmin.getAuthorization(null);
 143                 } else {
 144                         User authenticatingUser;
 145                         Set<KerberosPrincipal> kerberosPrincipals = subject.getPrincipals(KerberosPrincipal.class);
 146                         if (kerberosPrincipals.isEmpty()) {
 147                                 if (authenticatedUser == null) {
 148                                         if (log.isTraceEnabled())
 149                                                 log.trace("Neither kerberos nor user admin login succeeded. Login failed.");
 150                                         return false;
 151                                 } else {
 152                                         authenticatingUser = authenticatedUser;
 153                                 }
 154                         } else {
 155                                 KerberosPrincipal kerberosPrincipal = kerberosPrincipals.iterator().next();
 156                                 LdapName dn = IpaUtils.kerberosToDn(kerberosPrincipal.getName());
 157                                 authenticatingUser = new AuthenticatingUser(dn);
 158                                 if (authenticatedUser != null && !authenticatingUser.getName().equals(authenticatedUser.getName()))
 159                                         throw new LoginException("Kerberos login " + authenticatingUser.getName()
 160                                                         + " is inconsistent with user admin login " + authenticatedUser.getName());
 161                         }
 162                         authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
 163
 164                                 @Override
 165                                 public Authorization run() {
 166                                         Authorization authorization = userAdmin.getAuthorization(authenticatingUser);
 167                                         return authorization;
 168                                 }
 169
 170                         });
 171                         if (authorization == null)
 172                                 throw new LoginException(
 173                                                 "User admin found no authorization for authenticated user " + authenticatingUser.getName());
 174                 }
 175                 // Log and monitor new login
 176                 CmsAuthUtils.addAuthorization(subject, authorization,
 177                                 (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST));
 178                 if (log.isDebugEnabled())
 179                         log.debug("Logged in to CMS: " + subject);
 180                 return true;
 181         }
 182
 183         @Override
 184         public boolean abort() throws LoginException {
 185                 return true;
 186         }
 187
 188         @Override
 189         public boolean logout() throws LoginException {
 190                 if (log.isDebugEnabled())
 191                         log.debug("Logging out from CMS... " + subject);
 192                 // boolean httpSessionLogoutOk = CmsAuthUtils.logoutSession(bc,
 193                 // subject);
 194                 CmsAuthUtils.cleanUp(subject);
 195                 return true;
 196         }
 197
 198         protected User searchForUser(UserAdmin userAdmin, String providedUsername) {
 199                 try {
 200                         // TODO check value null or empty
 201                         List<User> collectedUsers = new ArrayList<User>();
 202                         // try dn
 203                         User user = null;
 204                         try {
 205                                 user = (User) userAdmin.getRole(providedUsername);
 206                                 if (user != null)
 207                                         collectedUsers.add(user);
 208                         } catch (Exception e) {
 209                                 // silent
 210                         }
 211                         // try all indexes
 212                         for (String attr : indexedUserProperties) {
 213                                 user = userAdmin.getUser(attr, providedUsername);
 214                                 if (user != null)
 215                                         collectedUsers.add(user);
 216                         }
 217                         if (collectedUsers.size() == 1)
 218                                 return collectedUsers.get(0);
 219                         else if (collectedUsers.size() > 1)
 220                                 log.warn(collectedUsers.size() + " users for provided username" + providedUsername);
 221                         return null;
 222                 } catch (Exception e) {
 223                         if (log.isTraceEnabled())
 224                                 log.warn("Cannot search for user " + providedUsername, e);
 225                         return null;
 226                 }
 227
 228         }
 229 }