Continue finalising security. Fix issues with login in web.

[lgpl/argeo-commons.git] / org.argeo.cms / src / org / argeo / cms / auth / UserAdminLoginModule.java

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
index d4c41022f62dff2dd07e5d138f720e7a422b8070..515f4dc0daee943e880b740f01bb69e9027b2c07 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
@@ -25,22 +25,21 @@ import org.osgi.service.useradmin.User;
 import org.osgi.service.useradmin.UserAdmin;
 
 public class UserAdminLoginModule implements LoginModule, AuthConstants {
-       // private final static Log log =
-       // LogFactory.getLog(UserAdminLoginModule.class);
-       //
-       // private Subject subject;
+       private Subject subject;
        private CallbackHandler callbackHandler;
        private Map<String, Object> sharedState = null;
 
        private boolean isAnonymous = false;
 
-       // private HttpServletRequest request = null;
+       // private state
        private BundleContext bc;
+       private Authorization authorization;
 
        @SuppressWarnings("unchecked")
        @Override
        public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
                        Map<String, ?> options) {
+               this.subject = subject;
                try {
                        bc = FrameworkUtil.getBundle(UserAdminLoginModule.class).getBundleContext();
                        assert bc != null;
@@ -57,11 +56,9 @@ public class UserAdminLoginModule implements LoginModule, AuthConstants {
        @Override
        public boolean login() throws LoginException {
                UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
-               Authorization authorization = null;
                if (isAnonymous) {
                        authorization = userAdmin.getAuthorization(null);
                } else {
-                       // HttpRequestCallback httpCallback = new HttpRequestCallback();
                        // ask for username and password
                        NameCallback nameCallback = new NameCallback("User");
                        PasswordCallback passwordCallback = new PasswordCallback("Password", false);
@@ -70,16 +67,13 @@ public class UserAdminLoginModule implements LoginModule, AuthConstants {
                                callbackHandler.handle(new Callback[] { nameCallback, passwordCallback, langCallback });
                        } catch (IOException e) {
                                throw new LoginException("Cannot handle callback: " + e.getMessage());
-                       } catch (ThreadDeath e) {
-                               throw new ThreadDeathLoginException("Callbackhandler thread died", e);
+                               // } catch (ThreadDeath e) {
+                               // throw new ThreadDeathLoginException("Callbackhandler thread
+                               // died", e);
                        } catch (UnsupportedCallbackException e) {
                                return false;
                        }
 
-                       // check http
-                       // request = httpCallback.getRequest();
-                       // authorization = checkHttp();
-
                        // i18n
                        Locale locale = langCallback.getLocale();
                        if (locale == null)
@@ -119,114 +113,41 @@ public class UserAdminLoginModule implements LoginModule, AuthConstants {
                }
                if (!sharedState.containsKey(SHARED_STATE_AUTHORIZATION))
                        sharedState.put(SHARED_STATE_AUTHORIZATION, authorization);
-               // subject.getPrivateCredentials().add(authorization);
-               return true;
+               return authorization != null;
        }
 
-       // private Authorization checkHttp() {
-       // Authorization authorization = null;
-       // if (request != null) {
-       // authorization = (Authorization)
-       // request.getAttribute(HttpContext.AUTHORIZATION);
-       // if (authorization == null) {
-       // String sessionId = request.getSession().getId();
-       // authorization = (Authorization)
-       // request.getSession().getAttribute(HttpContext.AUTHORIZATION);
-       // if (authorization == null) {
-       // Collection<ServiceReference<CmsSession>> sr;
-       // try {
-       // sr = bc.getServiceReferences(CmsSession.class,
-       // "(" + CmsSession.CMS_SESSION_ID + "=" + sessionId + ")");
-       // } catch (InvalidSyntaxException e) {
-       // throw new CmsException("Cannot get CMS session for id " + sessionId, e);
-       // }
-       // if (sr.size() == 1) {
-       // CmsSession cmsSession = bc.getService(sr.iterator().next());
-       // authorization = cmsSession.getAuthorization();
-       // if (log.isTraceEnabled())
-       // log.trace("Retrieved authorization from " + cmsSession);
-       // }
-       // }
-       // }
-       // }
-       // return authorization;
-       // }
-
        @Override
        public boolean commit() throws LoginException {
-               // Authorization authorization =
-               // subject.getPrivateCredentials(Authorization.class).iterator().next();
-               // if (request != null && authorization.getName() != null) {
-               // request.setAttribute(HttpContext.REMOTE_USER,
-               // authorization.getName());
-               // request.setAttribute(HttpContext.AUTHORIZATION, authorization);
-               //
-               // HttpSession httpSession = request.getSession();
-               // if (httpSession.getAttribute(HttpContext.AUTHORIZATION) == null) {
-               //
-               // String sessionId = request.getSession().getId();
-               // Collection<ServiceReference<CmsSession>> sr;
-               // try {
-               // sr = bc.getServiceReferences(CmsSession.class,
-               // "(" + CmsSession.CMS_SESSION_ID + "=" + sessionId + ")");
-               // } catch (InvalidSyntaxException e) {
-               // throw new CmsException("Cannot get CMS session for id " + sessionId,
-               // e);
+               // Set<KerberosPrincipal> kerberosPrincipals =
+               // subject.getPrincipals(KerberosPrincipal.class);
+               // if (kerberosPrincipals.size() != 0) {
+               // KerberosPrincipal kerberosPrincipal =
+               // kerberosPrincipals.iterator().next();
+               // System.out.println(kerberosPrincipal);
+               // UserAdmin userAdmin =
+               // bc.getService(bc.getServiceReference(UserAdmin.class));
+               // User user = userAdmin.getUser(null, kerberosPrincipal.getName());
+               // Authorization authorization = userAdmin.getAuthorization(user);
+               // sharedState.put(SHARED_STATE_AUTHORIZATION, authorization);
                // }
-               // CmsSession cmsSession;
-               // if (sr.size() == 1) {
-               // cmsSession = bc.getService(sr.iterator().next());
-               // } else if (sr.size() == 0) {
-               // Hashtable<String, String> props = new Hashtable<>();
-               // props.put(CmsSession.CMS_DN, authorization.getName());
-               // props.put(CmsSession.CMS_SESSION_ID, sessionId);
-               // cmsSession = new CmsSessionImpl(sessionId, authorization);
-               // bc.registerService(CmsSession.class, cmsSession, props);
-               // if (log.isDebugEnabled())
-               // log.debug("Initialized " + cmsSession + " for " +
-               // authorization.getName());
-               // } else
-               // throw new CmsException(sr.size() + " CMS sessions registered for " +
-               // sessionId);
-               // cmsSession.addHttpSession(request);
-               // if (log.isTraceEnabled())
-               // log.trace("Added " + request.getServletPath() + " to " + cmsSession +
-               // " (" + request.getRequestURI()
-               // + ")");
-               // httpSession.setAttribute(HttpContext.AUTHORIZATION, authorization);
-               // }
-               // subject.getPrivateCredentials().add(request.getSession());
-               // }
-               return true;
+               if (authorization == null) {
+                       return false;
+                       // throw new LoginException("Authorization should not be null");
+               } else {
+                       CmsAuthUtils.addAuthentication(subject, authorization);
+                       return true;
+               }
        }
 
        @Override
        public boolean abort() throws LoginException {
-               // cleanUp();
+               authorization = null;
                return true;
        }
 
        @Override
        public boolean logout() throws LoginException {
-               // Set<HttpSession> httpSession =
-               // subject.getPrivateCredentials(HttpSession.class);
-               // Iterator<HttpSession> it = httpSession.iterator();
-               // while (it.hasNext()) {
-               // HttpSession sess = it.next();
-               // sess.setAttribute(HttpContext.AUTHORIZATION, null);
-               // // sess.setMaxInactiveInterval(1);// invalidate session
-               //
-               // // TODO log out CMS session
-               // }
-               // subject.getPrivateCredentials().removeAll(httpSession);
-               //
-               // cleanUp();
+               CmsAuthUtils.cleanUp(subject);
                return true;
        }
-
-       // private void cleanUp() {
-       // subject.getPrivateCredentials().removeAll(subject.getPrivateCredentials(Authorization.class));
-       // subject = null;
-       // }
-
 }