import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.CredentialNotFoundException;
+import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
import org.argeo.ArgeoException;
import org.argeo.cms.internal.kernel.Activator;
import org.argeo.eclipse.ui.specific.UiContext;
import org.osgi.service.useradmin.UserAdmin;
public class UserAdminLoginModule implements LoginModule, AuthConstants {
+ private final static Log log = LogFactory
+ .getLog(UserAdminLoginModule.class);
+
private Subject subject;
private CallbackHandler callbackHandler;
private boolean isAnonymous = false;
User user = userAdmin.getUser(null, username);
if (user == null)
- return false;
+ throw new FailedLoginException("Invalid credentials");
if (!user.hasCredential(null, password))
- return false;
+ throw new FailedLoginException("Invalid credentials");
+ // return false;
+
+ // Log and monitor new login
+ if (log.isDebugEnabled())
+ log.debug("Logged in to CMS with username [" + username+"]");
+
authorization = userAdmin.getAuthorization(user);
}
}
public boolean commit() throws LoginException {
Authorization authorization = subject
.getPrivateCredentials(Authorization.class).iterator().next();
- if (request != null) {
+ if (request != null && authorization.getName() != null) {
request.setAttribute(HttpContext.REMOTE_USER,
authorization.getName());
request.setAttribute(HttpContext.AUTHORIZATION, authorization);