org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java

   1 package org.argeo.cms.auth;
   2
   3 import java.io.IOException;
   4 import java.security.PrivilegedAction;
   5 import java.security.cert.X509Certificate;
   6 import java.util.Arrays;
   7 import java.util.HashSet;
   8 import java.util.List;
   9 import java.util.Locale;
  10 import java.util.Map;
  11 import java.util.Set;
  12
  13 import javax.naming.ldap.LdapName;
  14 import javax.security.auth.Subject;
  15 import javax.security.auth.callback.Callback;
  16 import javax.security.auth.callback.CallbackHandler;
  17 import javax.security.auth.callback.LanguageCallback;
  18 import javax.security.auth.callback.NameCallback;
  19 import javax.security.auth.callback.PasswordCallback;
  20 import javax.security.auth.callback.UnsupportedCallbackException;
  21 import javax.security.auth.kerberos.KerberosPrincipal;
  22 import javax.security.auth.login.CredentialNotFoundException;
  23 import javax.security.auth.login.LoginException;
  24 import javax.security.auth.spi.LoginModule;
  25 import javax.servlet.http.HttpServletRequest;
  26
  27 import org.apache.commons.logging.Log;
  28 import org.apache.commons.logging.LogFactory;
  29 import org.argeo.cms.CmsException;
  30 import org.argeo.cms.internal.kernel.Activator;
  31 import org.argeo.naming.LdapAttrs;
  32 import org.argeo.node.security.CryptoKeyring;
  33 import org.argeo.osgi.useradmin.AuthenticatingUser;
  34 import org.argeo.osgi.useradmin.IpaUtils;
  35 import org.argeo.osgi.useradmin.OsUserUtils;
  36 import org.osgi.framework.BundleContext;
  37 import org.osgi.framework.FrameworkUtil;
  38 import org.osgi.framework.ServiceReference;
  39 import org.osgi.service.useradmin.Authorization;
  40 import org.osgi.service.useradmin.User;
  41 import org.osgi.service.useradmin.UserAdmin;
  42
  43 public class UserAdminLoginModule implements LoginModule {
  44         private final static Log log = LogFactory.getLog(UserAdminLoginModule.class);
  45
  46         private Subject subject;
  47         private CallbackHandler callbackHandler;
  48         private Map<String, Object> sharedState = null;
  49
  50         private List<String> indexedUserProperties = Arrays
  51                         .asList(new String[] { LdapAttrs.mail.name(), LdapAttrs.uid.name(), LdapAttrs.authPassword.name() });
  52
  53         // private state
  54         private BundleContext bc;
  55         private User authenticatedUser = null;
  56         private Locale locale;
  57
  58         private Authorization bindAuthorization = null;
  59
  60         private boolean singleUser = Activator.isSingleUser();
  61
  62         @SuppressWarnings("unchecked")
  63         @Override
  64         public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
  65                         Map<String, ?> options) {
  66                 this.subject = subject;
  67                 try {
  68                         bc = FrameworkUtil.getBundle(UserAdminLoginModule.class).getBundleContext();
  69                         this.callbackHandler = callbackHandler;
  70                         this.sharedState = (Map<String, Object>) sharedState;
  71                 } catch (Exception e) {
  72                         throw new CmsException("Cannot initialize login module", e);
  73                 }
  74         }
  75
  76         @Override
  77         public boolean login() throws LoginException {
  78                 UserAdmin userAdmin = Activator.getUserAdmin();
  79                 final String username;
  80                 final char[] password;
  81                 X509Certificate[] certificateChain = null;
  82                 if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  83                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_PWD)) {
  84                         // NB: required by Basic http auth
  85                         username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
  86                         password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
  87                         // // TODO locale?
  88                 } else if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  89                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN)) {
  90                         // NB: required by Basic http auth
  91                         username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
  92                         certificateChain = (X509Certificate[]) sharedState.get(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN);
  93                         password = null;
  94                 } else if (singleUser) {
  95                         username = OsUserUtils.getOsUsername();
  96                         password = null;
  97                 } else {
  98
  99                         // ask for username and password
 100                         NameCallback nameCallback = new NameCallback("User");
 101                         PasswordCallback passwordCallback = new PasswordCallback("Password", false);
 102                         LanguageCallback langCallback = new LanguageCallback();
 103                         try {
 104                                 callbackHandler.handle(new Callback[] { nameCallback, passwordCallback, langCallback });
 105                         } catch (IOException e) {
 106                                 throw new LoginException("Cannot handle callback: " + e.getMessage());
 107                         } catch (UnsupportedCallbackException e) {
 108                                 return false;
 109                         }
 110
 111                         // i18n
 112                         locale = langCallback.getLocale();
 113                         if (locale == null)
 114                                 locale = Locale.getDefault();
 115                         // FIXME add it to Subject
 116                         // Locale.setDefault(locale);
 117
 118                         username = nameCallback.getName();
 119                         if (username == null || username.trim().equals("")) {
 120                                 // authorization = userAdmin.getAuthorization(null);
 121                                 throw new CredentialNotFoundException("No credentials provided");
 122                         }
 123                         if (passwordCallback.getPassword() != null)
 124                                 password = passwordCallback.getPassword();
 125                         else
 126                                 throw new CredentialNotFoundException("No credentials provided");
 127                         sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, username);
 128                         sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, password);
 129                 }
 130                 User user = searchForUser(userAdmin, username);
 131                 if (user == null)
 132                         return true;// expect Kerberos
 133
 134                 if (password != null) {
 135                         // try bind first
 136                         try {
 137                                 AuthenticatingUser authenticatingUser = new AuthenticatingUser(user.getName(), password);
 138                                 bindAuthorization = userAdmin.getAuthorization(authenticatingUser);
 139                                 // TODO check tokens as well
 140                                 if (bindAuthorization != null) {
 141                                         authenticatedUser = user;
 142                                         return true;
 143                                 }
 144                         } catch (Exception e) {
 145                                 // silent
 146                                 if (log.isTraceEnabled())
 147                                         log.trace("Bind failed", e);
 148                         }
 149
 150                         // works only if a connection password is provided
 151                         if (!user.hasCredential(null, password)) {
 152                                 return false;
 153                         }
 154                 } else if (certificateChain != null) {
 155                         // TODO check CRLs/OSCP validity?
 156                         // NB: authorization in commit() will work only if an LDAP connection password
 157                         // is provided
 158                 } else if (singleUser) {
 159                         // TODO verify IP address?
 160                 } else {
 161                         throw new CredentialNotFoundException("No credentials provided");
 162                 }
 163
 164                 authenticatedUser = user;
 165                 return true;
 166         }
 167
 168         @Override
 169         public boolean commit() throws LoginException {
 170                 if (locale == null)
 171                         subject.getPublicCredentials().add(Locale.getDefault());
 172                 else
 173                         subject.getPublicCredentials().add(locale);
 174
 175                 if (singleUser) {
 176                         OsUserUtils.loginAsSystemUser(subject);
 177                 }
 178                 UserAdmin userAdmin = Activator.getUserAdmin();
 179                 Authorization authorization;
 180                 if (callbackHandler == null) {// anonymous
 181                         authorization = userAdmin.getAuthorization(null);
 182                 } else if (bindAuthorization != null) {// bind
 183                         authorization = bindAuthorization;
 184                 } else {// Kerberos
 185                         User authenticatingUser;
 186                         Set<KerberosPrincipal> kerberosPrincipals = subject.getPrincipals(KerberosPrincipal.class);
 187                         if (kerberosPrincipals.isEmpty()) {
 188                                 if (authenticatedUser == null) {
 189                                         if (log.isTraceEnabled())
 190                                                 log.trace("Neither kerberos nor user admin login succeeded. Login failed.");
 191                                         return false;
 192                                 } else {
 193                                         authenticatingUser = authenticatedUser;
 194                                 }
 195                         } else {
 196                                 KerberosPrincipal kerberosPrincipal = kerberosPrincipals.iterator().next();
 197                                 LdapName dn = IpaUtils.kerberosToDn(kerberosPrincipal.getName());
 198                                 authenticatingUser = new AuthenticatingUser(dn);
 199                                 if (authenticatedUser != null && !authenticatingUser.getName().equals(authenticatedUser.getName()))
 200                                         throw new LoginException("Kerberos login " + authenticatingUser.getName()
 201                                                         + " is inconsistent with user admin login " + authenticatedUser.getName());
 202                         }
 203                         authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
 204
 205                                 @Override
 206                                 public Authorization run() {
 207                                         Authorization authorization = userAdmin.getAuthorization(authenticatingUser);
 208                                         return authorization;
 209                                 }
 210
 211                         });
 212                         if (authorization == null)
 213                                 throw new LoginException(
 214                                                 "User admin found no authorization for authenticated user " + authenticatingUser.getName());
 215                 }
 216
 217                 // Log and monitor new login
 218                 HttpServletRequest request = (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST);
 219                 CmsAuthUtils.addAuthorization(subject, authorization, locale, request);
 220
 221                 // Unlock keyring (underlying login to the JCR repository)
 222                 char[] password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
 223                 if (password != null) {
 224                         ServiceReference<CryptoKeyring> keyringSr = bc.getServiceReference(CryptoKeyring.class);
 225                         if (keyringSr != null) {
 226                                 CryptoKeyring keyring = bc.getService(keyringSr);
 227                                 Subject.doAs(subject, new PrivilegedAction<Void>() {
 228
 229                                         @Override
 230                                         public Void run() {
 231                                                 try {
 232                                                         keyring.unlock(password);
 233                                                 } catch (Exception e) {
 234                                                         e.printStackTrace();
 235                                                         log.warn("Could not unlock keyring with the password provided by " + authorization.getName()
 236                                                                         + ": " + e.getMessage());
 237                                                 }
 238                                                 return null;
 239                                         }
 240
 241                                 });
 242                         }
 243                 }
 244
 245                 // Register CmsSession with initial subject
 246                 CmsAuthUtils.registerSessionAuthorization(request, subject, authorization, locale);
 247
 248                 if (log.isDebugEnabled())
 249                         log.debug("Logged in to CMS: " + subject);
 250                 return true;
 251         }
 252
 253         @Override
 254         public boolean abort() throws LoginException {
 255                 return true;
 256         }
 257
 258         @Override
 259         public boolean logout() throws LoginException {
 260                 if (log.isTraceEnabled())
 261                         log.trace("Logging out from CMS... " + subject);
 262                 // boolean httpSessionLogoutOk = CmsAuthUtils.logoutSession(bc,
 263                 // subject);
 264                 CmsAuthUtils.cleanUp(subject);
 265                 return true;
 266         }
 267
 268         protected User searchForUser(UserAdmin userAdmin, String providedUsername) {
 269                 try {
 270                         // TODO check value null or empty
 271                         Set<User> collectedUsers = new HashSet<>();
 272                         // try dn
 273                         User user = null;
 274                         // try all indexes
 275                         for (String attr : indexedUserProperties) {
 276                                 user = userAdmin.getUser(attr, providedUsername);
 277                                 if (user != null)
 278                                         collectedUsers.add(user);
 279                         }
 280                         if (collectedUsers.size() == 1) {
 281                                 user = collectedUsers.iterator().next();
 282                                 return user;
 283                         } else if (collectedUsers.size() > 1) {
 284                                 log.warn(collectedUsers.size() + " users for provided username" + providedUsername);
 285                         }
 286                         // try DN as a last resort
 287                         try {
 288                                 user = (User) userAdmin.getRole(providedUsername);
 289                                 if (user != null)
 290                                         return user;
 291                         } catch (Exception e) {
 292                                 // silent
 293                         }
 294                         return null;
 295                 } catch (Exception e) {
 296                         if (log.isTraceEnabled())
 297                                 log.warn("Cannot search for user " + providedUsername, e);
 298                         return null;
 299                 }
 300
 301         }
 302 }