org.argeo.security.core/src/org/argeo/security/jcr/jackrabbit/ScopedSessionProvider.java

   1 /*
   2  * Copyright (C) 2007-2012 Argeo GmbH
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *         http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16 package org.argeo.security.jcr.jackrabbit;
  17
  18 import java.io.Serializable;
  19
  20 import javax.jcr.LoginException;
  21 import javax.jcr.Repository;
  22 import javax.jcr.RepositoryException;
  23 import javax.jcr.Session;
  24 import javax.servlet.ServletException;
  25 import javax.servlet.http.HttpServletRequest;
  26 import javax.servlet.http.HttpSession;
  27
  28 import org.apache.commons.logging.Log;
  29 import org.apache.commons.logging.LogFactory;
  30 import org.apache.jackrabbit.server.SessionProvider;
  31 import org.argeo.ArgeoException;
  32 import org.argeo.jcr.ArgeoJcrConstants;
  33 import org.argeo.jcr.JcrUtils;
  34 import org.springframework.security.core.Authentication;
  35 import org.springframework.security.core.context.SecurityContextHolder;
  36
  37 /**
  38  * Session provider assuming a single workspace and a short life cycle,
  39  * typically a Spring bean of scope (web) 'session'.
  40  */
  41 public class ScopedSessionProvider implements SessionProvider, Serializable {
  42         private static final long serialVersionUID = 6589775984177317058L;
  43         private static final Log log = LogFactory
  44                         .getLog(ScopedSessionProvider.class);
  45         private transient HttpSession httpSession = null;
  46         private transient Session jcrSession = null;
  47
  48         private transient String currentRepositoryName = null;
  49         private transient String currentWorkspaceName = null;
  50         private transient String currentJcrUser = null;
  51
  52         // private transient String anonymousUserId = "anonymous";
  53
  54         public Session getSession(HttpServletRequest request, Repository rep,
  55                         String workspace) throws LoginException, ServletException,
  56                         RepositoryException {
  57
  58                 Authentication authentication = SecurityContextHolder.getContext()
  59                                 .getAuthentication();
  60                 if (authentication == null)
  61                         throw new ArgeoException(
  62                                         "Request not authenticated by Spring Security");
  63                 String springUser = authentication.getName();
  64
  65                 // HTTP
  66                 String requestJcrRepository = (String) request
  67                                 .getAttribute(ArgeoJcrConstants.JCR_REPOSITORY_ALIAS);
  68
  69                 // HTTP session
  70                 if (httpSession != null
  71                                 && !httpSession.getId().equals(request.getSession().getId()))
  72                         throw new ArgeoException(
  73                                         "Only session scope is supported in this mode");
  74                 if (httpSession == null)
  75                         httpSession = request.getSession();
  76
  77                 // Initializes current values
  78                 if (currentRepositoryName == null)
  79                         currentRepositoryName = requestJcrRepository;
  80                 if (currentWorkspaceName == null)
  81                         currentWorkspaceName = workspace;
  82                 if (currentJcrUser == null)
  83                         currentJcrUser = springUser;
  84
  85                 // logout if there was a change in session coordinates
  86                 if (jcrSession != null)
  87                         if (!currentRepositoryName.equals(requestJcrRepository)) {
  88                                 if (log.isDebugEnabled())
  89                                         log.debug(getHttpSessionId() + " Changed from repository '"
  90                                                         + currentRepositoryName + "' to '"
  91                                                         + requestJcrRepository
  92                                                         + "', logging out cached JCR session.");
  93                                 logout();
  94                         } else if (!currentWorkspaceName.equals(workspace)) {
  95                                 if (log.isDebugEnabled())
  96                                         log.debug(getHttpSessionId() + " Changed from workspace '"
  97                                                         + currentWorkspaceName + "' to '" + workspace
  98                                                         + "', logging out cached JCR session.");
  99                                 logout();
 100                         } else if (!currentJcrUser.equals(springUser)) {
 101                                 if (log.isDebugEnabled())
 102                                         log.debug(getHttpSessionId() + " Changed from user '"
 103                                                         + currentJcrUser + "' to '" + springUser
 104                                                         + "', logging out cached JCR session.");
 105                                 logout();
 106                         }
 107
 108                 // login if needed
 109                 if (jcrSession == null)
 110                         try {
 111                                 Session session = login(rep, workspace);
 112                                 if (!session.getUserID().equals(springUser)) {
 113                                         JcrUtils.logoutQuietly(session);
 114                                         throw new ArgeoException("Spring Security user '"
 115                                                         + springUser + "' not in line with JCR user '"
 116                                                         + session.getUserID() + "'");
 117                                 }
 118                                 currentRepositoryName = requestJcrRepository;
 119                                 // do not use workspace variable which may be null
 120                                 currentWorkspaceName = session.getWorkspace().getName();
 121                                 currentJcrUser = session.getUserID();
 122
 123                                 jcrSession = session;
 124                                 return jcrSession;
 125                         } catch (RepositoryException e) {
 126                                 throw new ArgeoException("Cannot open session to workspace "
 127                                                 + workspace, e);
 128                         }
 129
 130                 // returns cached session
 131                 return jcrSession;
 132         }
 133
 134         protected Session login(Repository repository, String workspace)
 135                         throws RepositoryException {
 136                 Session session = repository.login(workspace);
 137                 if (log.isDebugEnabled())
 138                         log.debug(getHttpSessionId() + " User '" + session.getUserID()
 139                                         + "' logged in workspace '"
 140                                         + session.getWorkspace().getName() + "' of repository '"
 141                                         + currentRepositoryName + "'");
 142                 return session;
 143         }
 144
 145         public void releaseSession(Session session) {
 146                 if (log.isTraceEnabled())
 147                         log.trace(getHttpSessionId() + " Releasing JCR session " + session);
 148         }
 149
 150         protected void logout() {
 151                 JcrUtils.logoutQuietly(jcrSession);
 152                 jcrSession = null;
 153         }
 154
 155         protected final String getHttpSessionId() {
 156                 return httpSession != null ? httpSession.getId() : "<null>";
 157         }
 158
 159         public void init() {
 160         }
 161
 162         public void destroy() {
 163                 logout();
 164                 if (getHttpSessionId() != null)
 165                         if (log.isDebugEnabled())
 166                                 log.debug(getHttpSessionId()
 167                                                 + " Cleaned up provider for web session ");
 168                 httpSession = null;
 169         }
 170
 171 }