Introduce node runner

[lgpl/argeo-commons.git] / org.argeo.cms / src / org / argeo / cms / auth / UserAdminLoginModule.java

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
index c77a5929f868dd3d4a45788a51a40a59b938caed..0f7f0bdeed37c6e489f67cd9a67bd4cd965d99aa 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
@@ -81,8 +81,9 @@ public class UserAdminLoginModule implements LoginModule {
                }
                UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
                if (callbackHandler == null) {// anonymous
-//                     authorization = userAdmin.getAuthorization(null);
-//                     sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION, authorization);
+                       // authorization = userAdmin.getAuthorization(null);
+                       // sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION,
+                       // authorization);
                        return true;
                }
 
@@ -138,11 +139,6 @@ public class UserAdminLoginModule implements LoginModule {
                authenticatedUser = user;
                // return false;
 
-               // Log and monitor new login
-               // if (log.isDebugEnabled())
-               // log.debug("Logged in to CMS with username [" + username +
-               // "]");
-
                // authorization = userAdmin.getAuthorization(user);
                // assert authorization != null;
                //
@@ -161,51 +157,61 @@ public class UserAdminLoginModule implements LoginModule {
                // return true;
                // }
                UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
-               Authorization authorization = null;
-               User authenticatingUser;
-               Set<KerberosPrincipal> kerberosPrincipals = subject.getPrincipals(KerberosPrincipal.class);
-               if (kerberosPrincipals.isEmpty()) {
-                       if (callbackHandler == null) {
-                               authorization = userAdmin.getAuthorization(null);
-                       }
-                       if (authenticatedUser == null) {
-                               return false;
+               Authorization authorization;
+               if (callbackHandler == null) {// anonymous
+                       authorization = userAdmin.getAuthorization(null);
+               } else {
+                       User authenticatingUser;
+                       Set<KerberosPrincipal> kerberosPrincipals = subject.getPrincipals(KerberosPrincipal.class);
+                       if (kerberosPrincipals.isEmpty()) {
+                               if (authenticatedUser == null) {
+                                       if(log.isTraceEnabled())
+                                               log.trace("Neither kerberos nor user admin login succeeded. Login failed.");
+                                       return false;
+                               } else {
+                                       authenticatingUser = authenticatedUser;
+                               }
                        } else {
-                               authenticatingUser = authenticatedUser;
+                               KerberosPrincipal kerberosPrincipal = kerberosPrincipals.iterator().next();
+                               LdapName dn = IpaUtils.kerberosToDn(kerberosPrincipal.getName());
+                               authenticatingUser = new AuthenticatingUser(dn);
+                               if (authenticatedUser != null && !authenticatingUser.getName().equals(authenticatedUser.getName()))
+                                       throw new LoginException("Kerberos login " + authenticatingUser.getName()
+                                                       + " is inconsistent with user admin login " + authenticatedUser.getName());
                        }
-               } else {
-                       KerberosPrincipal kerberosPrincipal = kerberosPrincipals.iterator().next();
-                       LdapName dn = IpaUtils.kerberosToDn(kerberosPrincipal.getName());
-                       authenticatingUser = new AuthenticatingUser(dn);
-               }
-               if (authorization == null)
-                       authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
+                               authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
 
-                               @Override
-                               public Authorization run() {
-                                       Authorization authorization = userAdmin.getAuthorization(authenticatingUser);
-                                       return authorization;
-                               }
+                                       @Override
+                                       public Authorization run() {
+                                               Authorization authorization = userAdmin.getAuthorization(authenticatingUser);
+                                               return authorization;
+                                       }
 
-                       });
-               if (authorization == null)
-                       return false;
-               CmsAuthUtils.addAuthentication(subject, authorization);
-               HttpServletRequest request = (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST);
-               if (request != null) {
-                       CmsAuthUtils.registerSessionAuthorization(bc, request, subject, authorization);
+                               });
+                       if (authorization == null)
+                               throw new LoginException("User admin found no authorization for authenticated user "+authenticatingUser.getName());
                }
+               // Log and monitor new login
+               CmsAuthUtils.addAuthorization(subject, authorization, (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST));
+//             HttpServletRequest request = (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST);
+//             if (request != null) {
+//                     CmsAuthUtils.registerSessionAuthorization(bc, request, subject, authorization);
+//             }
+               if (log.isDebugEnabled())
+                       log.debug("Logged in to CMS: " + subject);
                return true;
        }
 
        @Override
        public boolean abort() throws LoginException {
-//             authorization = null;
+               // authorization = null;
                return true;
        }
 
        @Override
        public boolean logout() throws LoginException {
+               if (log.isDebugEnabled())
+                       log.debug("Logging out from CMS... " + subject);
                CmsAuthUtils.cleanUp(subject);
                return true;
        }