org.argeo.security.jackrabbit/src/org/argeo/security/jackrabbit/SystemJackrabbitLoginModule.java

   1 package org.argeo.security.jackrabbit;
   2
   3 import java.util.Map;
   4 import java.util.Set;
   5
   6 import javax.security.auth.Subject;
   7 import javax.security.auth.callback.CallbackHandler;
   8 import javax.security.auth.login.LoginException;
   9 import javax.security.auth.spi.LoginModule;
  10 import javax.security.auth.x500.X500Principal;
  11
  12 import org.apache.jackrabbit.core.security.SecurityConstants;
  13 import org.apache.jackrabbit.core.security.principal.AdminPrincipal;
  14 import org.argeo.security.SystemAuth;
  15
  16 public class SystemJackrabbitLoginModule implements LoginModule {
  17
  18         private Subject subject;
  19
  20         @Override
  21         public void initialize(Subject subject, CallbackHandler callbackHandler,
  22                         Map<String, ?> sharedState, Map<String, ?> options) {
  23                 this.subject = subject;
  24         }
  25
  26         @Override
  27         public boolean login() throws LoginException {
  28                 return true;
  29         }
  30
  31         @Override
  32         public boolean commit() throws LoginException {
  33                 Set<SystemAuth> initPrincipal = subject
  34                                 .getPrincipals(SystemAuth.class);
  35                 if (!initPrincipal.isEmpty()) {
  36                         subject.getPrincipals().add(
  37                                         new AdminPrincipal(SecurityConstants.ADMIN_ID));
  38                         return true;
  39                 }
  40
  41                 Set<X500Principal> userPrincipal = subject
  42                                 .getPrincipals(X500Principal.class);
  43                 if (userPrincipal.isEmpty())
  44                         throw new LoginException("Subject must be pre-authenticated");
  45                 if (userPrincipal.size() > 1)
  46                         throw new LoginException("Multiple user principals "
  47                                         + userPrincipal);
  48
  49                 return true;
  50
  51                 // Set<Principal> principals = subject.getPrincipals();
  52                 // if (principals.isEmpty()) {// system
  53                 // throw new LoginException("Subject must be pre-authenticated");
  54                 // // subject.getPrincipals().add(new AdminPrincipal("admin"));
  55                 // // return true;
  56                 // }
  57                 // boolean isAdmin = false;
  58                 // boolean isAnonymous = false;
  59                 // // FIXME make it more generic
  60                 // for (Principal principal : principals) {
  61                 // if (principal.getName().equalsIgnoreCase(
  62                 // "cn=admin,ou=roles,ou=node"))
  63                 // isAdmin = true;
  64                 // else if (principal.getName().equalsIgnoreCase(
  65                 // "cn=anonymous,ou=roles,ou=node"))
  66                 // isAnonymous = true;
  67                 // }
  68                 //
  69                 // if (isAnonymous && isAdmin)
  70                 // throw new LoginException("Cannot be admin and anonymous");
  71                 //
  72                 // // Add special Jackrabbit roles
  73                 // if (isAdmin)
  74                 // principals.add(new AdminPrincipal(SecurityConstants.ADMIN_ID));
  75                 // if (isAnonymous)// anonymous
  76                 // principals.add(new AnonymousPrincipal());
  77                 // return true;
  78         }
  79
  80         @Override
  81         public boolean abort() throws LoginException {
  82                 return true;
  83         }
  84
  85         @Override
  86         public boolean logout() throws LoginException {
  87                 Set<SystemAuth> initPrincipal = subject
  88                                 .getPrincipals(SystemAuth.class);
  89                 if (!initPrincipal.isEmpty()) {
  90                         subject.getPrincipals(AdminPrincipal.class);
  91                         return true;
  92                 }
  93                 // subject.getPrincipals().removeAll(
  94                 // subject.getPrincipals(AdminPrincipal.class));
  95                 return true;
  96         }
  97 }