org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java

   1 package org.argeo.cms.auth;
   2
   3 import java.io.IOException;
   4 import java.security.PrivilegedAction;
   5 import java.util.Arrays;
   6 import java.util.HashSet;
   7 import java.util.List;
   8 import java.util.Locale;
   9 import java.util.Map;
  10 import java.util.Set;
  11
  12 import javax.naming.ldap.LdapName;
  13 import javax.security.auth.Subject;
  14 import javax.security.auth.callback.Callback;
  15 import javax.security.auth.callback.CallbackHandler;
  16 import javax.security.auth.callback.LanguageCallback;
  17 import javax.security.auth.callback.NameCallback;
  18 import javax.security.auth.callback.PasswordCallback;
  19 import javax.security.auth.callback.UnsupportedCallbackException;
  20 import javax.security.auth.kerberos.KerberosPrincipal;
  21 import javax.security.auth.login.CredentialNotFoundException;
  22 import javax.security.auth.login.LoginException;
  23 import javax.security.auth.spi.LoginModule;
  24 import javax.servlet.http.HttpServletRequest;
  25
  26 import org.apache.commons.logging.Log;
  27 import org.apache.commons.logging.LogFactory;
  28 import org.argeo.cms.CmsException;
  29 import org.argeo.naming.LdapAttrs;
  30 import org.argeo.osgi.useradmin.AuthenticatingUser;
  31 import org.argeo.osgi.useradmin.IpaUtils;
  32 import org.osgi.framework.BundleContext;
  33 import org.osgi.framework.FrameworkUtil;
  34 import org.osgi.service.useradmin.Authorization;
  35 import org.osgi.service.useradmin.User;
  36 import org.osgi.service.useradmin.UserAdmin;
  37
  38 public class UserAdminLoginModule implements LoginModule {
  39         private final static Log log = LogFactory.getLog(UserAdminLoginModule.class);
  40
  41         private Subject subject;
  42         private CallbackHandler callbackHandler;
  43         private Map<String, Object> sharedState = null;
  44
  45         private List<String> indexedUserProperties = Arrays
  46                         .asList(new String[] { LdapAttrs.mail.name(), LdapAttrs.uid.name(), LdapAttrs.authPassword.name() });
  47
  48         // private state
  49         private BundleContext bc;
  50         private User authenticatedUser = null;
  51         private Locale locale;
  52
  53         private Authorization bindAuthorization = null;
  54
  55         @SuppressWarnings("unchecked")
  56         @Override
  57         public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
  58                         Map<String, ?> options) {
  59                 this.subject = subject;
  60                 try {
  61                         bc = FrameworkUtil.getBundle(UserAdminLoginModule.class).getBundleContext();
  62                         this.callbackHandler = callbackHandler;
  63                         this.sharedState = (Map<String, Object>) sharedState;
  64                 } catch (Exception e) {
  65                         throw new CmsException("Cannot initialize login module", e);
  66                 }
  67         }
  68
  69         @Override
  70         public boolean login() throws LoginException {
  71                 UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
  72                 final String username;
  73                 final char[] password;
  74                 if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  75                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_PWD)) {
  76                         // NB: required by Basic http auth
  77                         username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
  78                         password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
  79                         // // TODO locale?
  80                 } else {
  81                         // ask for username and password
  82                         NameCallback nameCallback = new NameCallback("User");
  83                         PasswordCallback passwordCallback = new PasswordCallback("Password", false);
  84                         LanguageCallback langCallback = new LanguageCallback();
  85                         try {
  86                                 callbackHandler.handle(new Callback[] { nameCallback, passwordCallback, langCallback });
  87                         } catch (IOException e) {
  88                                 throw new LoginException("Cannot handle callback: " + e.getMessage());
  89                         } catch (UnsupportedCallbackException e) {
  90                                 return false;
  91                         }
  92
  93                         // i18n
  94                         locale = langCallback.getLocale();
  95                         if (locale == null)
  96                                 locale = Locale.getDefault();
  97                         // FIXME add it to Subject
  98 //                      Locale.setDefault(locale);
  99
 100                         username = nameCallback.getName();
 101                         if (username == null || username.trim().equals("")) {
 102                                 // authorization = userAdmin.getAuthorization(null);
 103                                 throw new CredentialNotFoundException("No credentials provided");
 104                         }
 105                         if (passwordCallback.getPassword() != null)
 106                                 password = passwordCallback.getPassword();
 107                         else
 108                                 throw new CredentialNotFoundException("No credentials provided");
 109                 }
 110
 111                 User user = searchForUser(userAdmin, username);
 112                 if (user == null)
 113                         return true;// expect Kerberos
 114
 115                 // try bind first
 116                 try {
 117                         AuthenticatingUser authenticatingUser = new AuthenticatingUser(user.getName(), password);
 118                         bindAuthorization = userAdmin.getAuthorization(authenticatingUser);
 119                         // TODO check tokens as well
 120                         if (bindAuthorization != null) {
 121                                 authenticatedUser = user;
 122                                 return true;
 123                         }
 124                 } catch (Exception e) {
 125                         // silent
 126                         if(log.isTraceEnabled())
 127                                 log.trace("Bind failed", e);
 128                 }
 129
 130                 // works only if a connection password is provided
 131                 if (!user.hasCredential(null, password)) {
 132                         return false;
 133                 }
 134                 authenticatedUser = user;
 135                 return true;
 136         }
 137
 138         @Override
 139         public boolean commit() throws LoginException {
 140                 UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
 141                 Authorization authorization;
 142                 if (callbackHandler == null) {// anonymous
 143                         authorization = userAdmin.getAuthorization(null);
 144                 } else if (bindAuthorization != null) {// bind
 145                         authorization = bindAuthorization;
 146                 } else {// Kerberos
 147                         User authenticatingUser;
 148                         Set<KerberosPrincipal> kerberosPrincipals = subject.getPrincipals(KerberosPrincipal.class);
 149                         if (kerberosPrincipals.isEmpty()) {
 150                                 if (authenticatedUser == null) {
 151                                         if (log.isTraceEnabled())
 152                                                 log.trace("Neither kerberos nor user admin login succeeded. Login failed.");
 153                                         return false;
 154                                 } else {
 155                                         authenticatingUser = authenticatedUser;
 156                                 }
 157                         } else {
 158                                 KerberosPrincipal kerberosPrincipal = kerberosPrincipals.iterator().next();
 159                                 LdapName dn = IpaUtils.kerberosToDn(kerberosPrincipal.getName());
 160                                 authenticatingUser = new AuthenticatingUser(dn);
 161                                 if (authenticatedUser != null && !authenticatingUser.getName().equals(authenticatedUser.getName()))
 162                                         throw new LoginException("Kerberos login " + authenticatingUser.getName()
 163                                                         + " is inconsistent with user admin login " + authenticatedUser.getName());
 164                         }
 165                         authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
 166
 167                                 @Override
 168                                 public Authorization run() {
 169                                         Authorization authorization = userAdmin.getAuthorization(authenticatingUser);
 170                                         return authorization;
 171                                 }
 172
 173                         });
 174                         if (authorization == null)
 175                                 throw new LoginException(
 176                                                 "User admin found no authorization for authenticated user " + authenticatingUser.getName());
 177                 }
 178                 // Log and monitor new login
 179                 CmsAuthUtils.addAuthorization(subject, authorization, locale,
 180                                 (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST));
 181                 if (log.isDebugEnabled())
 182                         log.debug("Logged in to CMS: " + subject);
 183                 return true;
 184         }
 185
 186         @Override
 187         public boolean abort() throws LoginException {
 188                 return true;
 189         }
 190
 191         @Override
 192         public boolean logout() throws LoginException {
 193                 if (log.isTraceEnabled())
 194                         log.trace("Logging out from CMS... " + subject);
 195                 // boolean httpSessionLogoutOk = CmsAuthUtils.logoutSession(bc,
 196                 // subject);
 197                 CmsAuthUtils.cleanUp(subject);
 198                 return true;
 199         }
 200
 201         protected User searchForUser(UserAdmin userAdmin, String providedUsername) {
 202                 try {
 203                         // TODO check value null or empty
 204                         Set<User> collectedUsers = new HashSet<>();
 205                         // try dn
 206                         User user = null;
 207                         // try all indexes
 208                         for (String attr : indexedUserProperties) {
 209                                 user = userAdmin.getUser(attr, providedUsername);
 210                                 if (user != null)
 211                                         collectedUsers.add(user);
 212                         }
 213                         if (collectedUsers.size() == 1) {
 214                                 user = collectedUsers.iterator().next();
 215                                 return user;
 216                         } else if (collectedUsers.size() > 1) {
 217                                 log.warn(collectedUsers.size() + " users for provided username" + providedUsername);
 218                         }
 219                         // try DN as a last resort
 220                         try {
 221                                 user = (User) userAdmin.getRole(providedUsername);
 222                                 if (user != null)
 223                                         return user;
 224                         } catch (Exception e) {
 225                                 // silent
 226                         }
 227                         return null;
 228                 } catch (Exception e) {
 229                         if (log.isTraceEnabled())
 230                                 log.warn("Cannot search for user " + providedUsername, e);
 231                         return null;
 232                 }
 233
 234         }
 235 }