+++ /dev/null
-package org.argeo.cms.internal.kernel;
-
-import java.io.IOException;
-import java.io.Serializable;
-import java.net.URL;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.Properties;
-import java.util.StringTokenizer;
-
-import javax.jcr.Repository;
-import javax.jcr.RepositoryException;
-import javax.jcr.Session;
-import javax.security.auth.Subject;
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.NameCallback;
-import javax.security.auth.callback.PasswordCallback;
-import javax.security.auth.login.CredentialNotFoundException;
-import javax.security.auth.login.LoginContext;
-import javax.security.auth.login.LoginException;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.apache.jackrabbit.server.SessionProvider;
-import org.apache.jackrabbit.server.remoting.davex.JcrRemotingServlet;
-import org.apache.jackrabbit.webdav.simple.SimpleWebdavServlet;
-import org.argeo.cms.CmsException;
-import org.argeo.cms.auth.HttpRequestCallback;
-import org.argeo.cms.auth.HttpRequestCallbackHandler;
-import org.argeo.jcr.JcrUtils;
-import org.argeo.node.NodeConstants;
-import org.ietf.jgss.GSSContext;
-import org.ietf.jgss.GSSCredential;
-import org.ietf.jgss.GSSException;
-import org.ietf.jgss.GSSManager;
-import org.ietf.jgss.GSSName;
-import org.ietf.jgss.Oid;
-import org.osgi.framework.BundleContext;
-import org.osgi.framework.FrameworkUtil;
-import org.osgi.framework.ServiceReference;
-import org.osgi.service.http.HttpContext;
-import org.osgi.service.http.HttpService;
-import org.osgi.service.http.NamespaceException;
-import org.osgi.service.useradmin.Authorization;
-import org.osgi.util.tracker.ServiceTracker;
-import org.osgi.util.tracker.ServiceTrackerCustomizer;
-
-/**
- * Intercepts and enriches http access, mainly focusing on security and
- * transactionality.
- */
-class DataHttp implements KernelConstants {
- private final static Log log = LogFactory.getLog(DataHttp.class);
-
- // private final static String ATTR_AUTH = "auth";
- private final static String HEADER_AUTHORIZATION = "Authorization";
- private final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
-
- private final static String DEFAULT_PROTECTED_HANDLERS = "/org/argeo/cms/internal/kernel/protectedHandlers.xml";
-
- private final BundleContext bc;
- private final HttpService httpService;
- private final ServiceTracker<Repository, Repository> repositories;
-
- // FIXME Make it more unique
- private String httpAuthRealm = "Argeo";
-
- DataHttp(HttpService httpService) {
- this.bc = FrameworkUtil.getBundle(getClass()).getBundleContext();
- this.httpService = httpService;
- repositories = new ServiceTracker<>(bc, Repository.class, new RepositoriesStc());
- repositories.open();
- }
-
- public void destroy() {
- repositories.close();
- }
-
- void registerRepositoryServlets(String alias, Repository repository) {
- try {
- registerWebdavServlet(alias, repository);
- registerRemotingServlet(alias, repository);
- registerFilesServlet(alias, repository);
- if (log.isDebugEnabled())
- log.debug("Registered servlets for repository '" + alias + "'");
- } catch (Exception e) {
- throw new CmsException("Could not register servlets for repository '" + alias + "'", e);
- }
- }
-
- void unregisterRepositoryServlets(String alias) {
- try {
- httpService.unregister(webdavPath(alias));
- httpService.unregister(remotingPath(alias));
- httpService.unregister(filesPath(alias));
- if (log.isDebugEnabled())
- log.debug("Unregistered servlets for repository '" + alias + "'");
- } catch (Exception e) {
- log.error("Could not unregister servlets for repository '" + alias + "'", e);
- }
- }
-
- void registerWebdavServlet(String alias, Repository repository) throws NamespaceException, ServletException {
- WebdavServlet webdavServlet = new WebdavServlet(repository, new OpenInViewSessionProvider(alias));
- String path = webdavPath(alias);
- Properties ip = new Properties();
- ip.setProperty(WebdavServlet.INIT_PARAM_RESOURCE_CONFIG, WEBDAV_CONFIG);
- ip.setProperty(WebdavServlet.INIT_PARAM_RESOURCE_PATH_PREFIX, path);
- httpService.registerServlet(path, webdavServlet, ip, new DataHttpContext());
- }
-
- void registerFilesServlet(String alias, Repository repository) throws NamespaceException, ServletException {
- WebdavServlet filesServlet = new WebdavServlet(repository, new OpenInViewSessionProvider(alias));
- String path = filesPath(alias);
- Properties ip = new Properties();
- ip.setProperty(WebdavServlet.INIT_PARAM_RESOURCE_CONFIG, WEBDAV_CONFIG);
- ip.setProperty(WebdavServlet.INIT_PARAM_RESOURCE_PATH_PREFIX, path);
- httpService.registerServlet(path, filesServlet, ip, new FilesHttpContext());
- }
-
- void registerRemotingServlet(String alias, Repository repository) throws NamespaceException, ServletException {
- RemotingServlet remotingServlet = new RemotingServlet(repository, new OpenInViewSessionProvider(alias));
- String path = remotingPath(alias);
- Properties ip = new Properties();
- ip.setProperty(JcrRemotingServlet.INIT_PARAM_RESOURCE_PATH_PREFIX, path);
-
- // Looks like a bug in Jackrabbit remoting init
- ip.setProperty(RemotingServlet.INIT_PARAM_HOME, KernelUtils.getOsgiInstanceDir() + "/tmp/remoting_" + alias);
- ip.setProperty(RemotingServlet.INIT_PARAM_TMP_DIRECTORY, "remoting_" + alias);
- ip.setProperty(RemotingServlet.INIT_PARAM_PROTECTED_HANDLERS_CONFIG, DEFAULT_PROTECTED_HANDLERS);
- ip.setProperty(RemotingServlet.INIT_PARAM_CREATE_ABSOLUTE_URI, "false");
- httpService.registerServlet(path, remotingServlet, ip, new RemotingHttpContext());
- }
-
- private String webdavPath(String alias) {
- return NodeConstants.PATH_DATA + "/" + alias;
- }
-
- private String remotingPath(String alias) {
- return NodeConstants.PATH_JCR + "/" + alias;
- }
-
- private String filesPath(String alias) {
- return NodeConstants.PATH_FILES + "/" + alias;
- }
-
- private Subject subjectFromRequest(HttpServletRequest request, HttpServletResponse response) {
- Authorization authorization = (Authorization) request.getAttribute(HttpContext.AUTHORIZATION);
- if (authorization == null)
- throw new CmsException("Not authenticated");
- try {
- LoginContext lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER,
- new HttpRequestCallbackHandler(request, response));
- lc.login();
- return lc.getSubject();
- } catch (LoginException e) {
- throw new CmsException("Cannot login", e);
- }
- }
-
- private void askForWwwAuth(HttpServletRequest request, HttpServletResponse response) {
- response.setStatus(401);
- response.setHeader(HEADER_WWW_AUTHENTICATE, "basic realm=\"" + httpAuthRealm + "\"");
-
- // SPNEGO
- // response.setHeader(HEADER_WWW_AUTHENTICATE, "Negotiate");
- // response.setDateHeader("Date", System.currentTimeMillis());
- // response.setDateHeader("Expires", System.currentTimeMillis() + (24 *
- // 60 * 60 * 1000));
- // response.setHeader("Accept-Ranges", "bytes");
- // response.setHeader("Connection", "Keep-Alive");
- // response.setHeader("Keep-Alive", "timeout=5, max=97");
- // response.setContentType("text/html; charset=UTF-8");
-
- }
-
- private CallbackHandler extractHttpAuth(final HttpServletRequest httpRequest, HttpServletResponse httpResponse) {
- String authHeader = httpRequest.getHeader(HEADER_AUTHORIZATION);
- if (authHeader != null) {
- StringTokenizer st = new StringTokenizer(authHeader);
- if (st.hasMoreTokens()) {
- String basic = st.nextToken();
- if (basic.equalsIgnoreCase("Basic")) {
- try {
- // TODO manipulate char[]
- String credentials = new String(Base64.decodeBase64(st.nextToken()), "UTF-8");
- // log.debug("Credentials: " + credentials);
- int p = credentials.indexOf(":");
- if (p != -1) {
- final String login = credentials.substring(0, p).trim();
- final char[] password = credentials.substring(p + 1).trim().toCharArray();
- return new CallbackHandler() {
- public void handle(Callback[] callbacks) {
- for (Callback cb : callbacks) {
- if (cb instanceof NameCallback)
- ((NameCallback) cb).setName(login);
- else if (cb instanceof PasswordCallback)
- ((PasswordCallback) cb).setPassword(password);
- else if (cb instanceof HttpRequestCallback) {
- ((HttpRequestCallback) cb).setRequest(httpRequest);
- ((HttpRequestCallback) cb).setResponse(httpResponse);
- }
- }
- }
- };
- } else {
- throw new CmsException("Invalid authentication token");
- }
- } catch (Exception e) {
- throw new CmsException("Couldn't retrieve authentication", e);
- }
- } else if (basic.equalsIgnoreCase("Negotiate")) {
- // FIXME generalise
- String _targetName = "HTTP/mostar.desktop.argeo.pro";
- String spnegoToken = st.nextToken();
- byte[] authToken = Base64.decodeBase64(spnegoToken);
- GSSManager manager = GSSManager.getInstance();
- try {
- Oid krb5Oid = new Oid("1.3.6.1.5.5.2"); // http://java.sun.com/javase/6/docs/technotes/guides/security/jgss/jgss-features.html
- GSSName gssName = manager.createName(_targetName, null);
- GSSCredential serverCreds = manager.createCredential(gssName, GSSCredential.INDEFINITE_LIFETIME,
- krb5Oid, GSSCredential.ACCEPT_ONLY);
- GSSContext gContext = manager.createContext(serverCreds);
-
- if (gContext == null) {
- log.debug("SpnegoUserRealm: failed to establish GSSContext");
- } else {
- while (!gContext.isEstablished()) {
- byte[] outToken = gContext.acceptSecContext(authToken, 0, authToken.length);
- String outTokenStr = Base64.encodeBase64String(outToken);
- httpResponse.setHeader("WWW-Authenticate", "Negotiate " + outTokenStr);
- }
- if (gContext.isEstablished()) {
- String clientName = gContext.getSrcName().toString();
- String role = clientName.substring(clientName.indexOf('@') + 1);
-
- log.debug("SpnegoUserRealm: established a security context");
- log.debug("Client Principal is: " + gContext.getSrcName());
- log.debug("Server Principal is: " + gContext.getTargName());
- log.debug("Client Default Role: " + role);
-
- // TODO log in
- }
- }
-
- } catch (GSSException gsse) {
- log.warn(gsse, gsse);
- }
-
- }
- }
- }
- return null;
- }
-
- private class RepositoriesStc implements ServiceTrackerCustomizer<Repository, Repository> {
-
- @Override
- public Repository addingService(ServiceReference<Repository> reference) {
- Repository repository = bc.getService(reference);
- Object jcrRepoAlias = reference.getProperty(NodeConstants.CN);
- if (jcrRepoAlias != null) {
- String alias = jcrRepoAlias.toString();
- registerRepositoryServlets(alias, repository);
- }
- return repository;
- }
-
- @Override
- public void modifiedService(ServiceReference<Repository> reference, Repository service) {
- }
-
- @Override
- public void removedService(ServiceReference<Repository> reference, Repository service) {
- Object jcrRepoAlias = reference.getProperty(NodeConstants.CN);
- if (jcrRepoAlias != null) {
- String alias = jcrRepoAlias.toString();
- unregisterRepositoryServlets(alias);
- }
- }
- }
-
- private class DataHttpContext implements HttpContext {
- @Override
- public boolean handleSecurity(final HttpServletRequest request, HttpServletResponse response)
- throws IOException {
-
- if (log.isTraceEnabled())
- KernelUtils.logRequestHeaders(log, request);
- LoginContext lc;
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER,
- new HttpRequestCallbackHandler(request, response));
- lc.login();
- // return true;
- } catch (LoginException e) {
- CallbackHandler token = extractHttpAuth(request, response);
- if (token != null) {
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER, token);
- lc.login();
- // Note: this is impossible to reliably clear the
- // authorization header when access from a browser.
- return true;
- } catch (LoginException e1) {
- throw new CmsException("Could not login", e1);
- }
- } else {
- // anonymous
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER);
- lc.login();
- } catch (LoginException e1) {
- if (log.isDebugEnabled())
- log.error("Cannot log in anonynous", e1);
- return false;
- }
- }
- }
- request.setAttribute(NodeConstants.LOGIN_CONTEXT_USER, lc);
- return true;
- }
-
- @Override
- public URL getResource(String name) {
- return KernelUtils.getBundleContext(DataHttp.class).getBundle().getResource(name);
- }
-
- @Override
- public String getMimeType(String name) {
- return null;
- }
-
- }
-
- private class FilesHttpContext implements HttpContext {
- @Override
- public boolean handleSecurity(final HttpServletRequest request, HttpServletResponse response)
- throws IOException {
-
- if (log.isTraceEnabled())
- KernelUtils.logRequestHeaders(log, request);
- LoginContext lc;
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER,
- new HttpRequestCallbackHandler(request, response));
- lc.login();
- // return true;
- } catch (LoginException e) {
- CallbackHandler token = extractHttpAuth(request, response);
- if (token != null) {
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER, token);
- lc.login();
- // Note: this is impossible to reliably clear the
- // authorization header when access from a browser.
- } catch (LoginException e1) {
- throw new CmsException("Could not login", e1);
- }
- } else {
- askForWwwAuth(request, response);
- lc = null;
- return false;
- }
- }
- request.setAttribute(NodeConstants.LOGIN_CONTEXT_USER, lc);
- return true;
- }
-
- @Override
- public URL getResource(String name) {
- return KernelUtils.getBundleContext(DataHttp.class).getBundle().getResource(name);
- }
-
- @Override
- public String getMimeType(String name) {
- return null;
- }
-
- }
-
- private class RemotingHttpContext implements HttpContext {
- // private final boolean anonymous;
-
- RemotingHttpContext() {
- // this.anonymous = anonymous;
- }
-
- @Override
- public boolean handleSecurity(final HttpServletRequest request, HttpServletResponse response)
- throws IOException {
-
- // if (anonymous) {
- // Subject subject = KernelUtils.anonymousLogin();
- // Authorization authorization =
- // subject.getPrivateCredentials(Authorization.class).iterator().next();
- // request.setAttribute(REMOTE_USER, NodeConstants.ROLE_ANONYMOUS);
- // request.setAttribute(AUTHORIZATION, authorization);
- // return true;
- // }
-
- if (log.isTraceEnabled())
- KernelUtils.logRequestHeaders(log, request);
- LoginContext lc;
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER,
- new HttpRequestCallbackHandler(request, response));
- lc.login();
- } catch (CredentialNotFoundException e) {
- CallbackHandler token = extractHttpAuth(request, response);
- if (token != null) {
- try {
- lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER, token);
- lc.login();
- // Note: this is impossible to reliably clear the
- // authorization header when access from a browser.
- } catch (LoginException e1) {
- throw new CmsException("Could not login", e1);
- }
- } else {
- askForWwwAuth(request, response);
- lc = null;
- }
- } catch (LoginException e) {
- throw new CmsException("Could not login", e);
- }
-
- if (lc != null) {
- request.setAttribute(NodeConstants.LOGIN_CONTEXT_USER, lc);
- return true;
- } else {
- return false;
- }
- }
-
- @Override
- public URL getResource(String name) {
- return KernelUtils.getBundleContext(DataHttp.class).getBundle().getResource(name);
- }
-
- @Override
- public String getMimeType(String name) {
- return null;
- }
-
- }
-
- /**
- * Implements an open session in view patter: a new JCR session is created
- * for each request
- */
- private class OpenInViewSessionProvider implements SessionProvider, Serializable {
- private static final long serialVersionUID = 2270957712453841368L;
- private final String alias;
-
- public OpenInViewSessionProvider(String alias) {
- this.alias = alias;
- }
-
- public Session getSession(HttpServletRequest request, Repository rep, String workspace)
- throws javax.jcr.LoginException, ServletException, RepositoryException {
- return login(request, rep, workspace);
- }
-
- protected Session login(HttpServletRequest request, Repository repository, String workspace)
- throws RepositoryException {
- if (log.isTraceEnabled())
- log.trace("Repo " + alias + ", login to workspace " + (workspace == null ? "<default>" : workspace)
- + " in web session " + request.getSession().getId());
- LoginContext lc = (LoginContext) request.getAttribute(NodeConstants.LOGIN_CONTEXT_USER);
- if (lc == null)
- throw new CmsException("No login context available");
- try {
- // LoginContext lc = new
- // LoginContext(NodeConstants.LOGIN_CONTEXT_USER,
- // new HttpRequestCallbackHandler(request));
- // lc.login();
- return Subject.doAs(lc.getSubject(), new PrivilegedExceptionAction<Session>() {
- @Override
- public Session run() throws Exception {
- return repository.login(workspace);
- }
- });
- } catch (Exception e) {
- throw new CmsException("Cannot log in to JCR", e);
- }
- // return repository.login(workspace);
- }
-
- public void releaseSession(Session session) {
- JcrUtils.logoutQuietly(session);
- if (log.isTraceEnabled())
- log.trace("Logged out remote JCR session " + session);
- }
- }
-
- private class WebdavServlet extends SimpleWebdavServlet {
- private static final long serialVersionUID = -4687354117811443881L;
- private final Repository repository;
-
- public WebdavServlet(Repository repository, SessionProvider sessionProvider) {
- this.repository = repository;
- setSessionProvider(sessionProvider);
- }
-
- public Repository getRepository() {
- return repository;
- }
-
- @Override
- protected void service(final HttpServletRequest request, final HttpServletResponse response)
- throws ServletException, IOException {
- WebdavServlet.super.service(request, response);
- // try {
- // Subject subject = subjectFromRequest(request);
- // // TODO make it stronger, with eTags.
- // // if (CurrentUser.isAnonymous(subject) &&
- // // request.getMethod().equals("GET")) {
- // // response.setHeader("Cache-Control", "no-transform, public,
- // // max-age=300, s-maxage=900");
- // // }
- //
- // Subject.doAs(subject, new PrivilegedExceptionAction<Void>() {
- // @Override
- // public Void run() throws Exception {
- // WebdavServlet.super.service(request, response);
- // return null;
- // }
- // });
- // } catch (PrivilegedActionException e) {
- // throw new CmsException("Cannot process webdav request",
- // e.getException());
- // }
- }
- }
-
- private class RemotingServlet extends JcrRemotingServlet {
- private static final long serialVersionUID = 4605238259548058883L;
- private final Repository repository;
- private final SessionProvider sessionProvider;
-
- public RemotingServlet(Repository repository, SessionProvider sessionProvider) {
- this.repository = repository;
- this.sessionProvider = sessionProvider;
- }
-
- @Override
- protected Repository getRepository() {
- return repository;
- }
-
- @Override
- protected SessionProvider getSessionProvider() {
- return sessionProvider;
- }
-
- @Override
- protected void service(final HttpServletRequest request, final HttpServletResponse response)
- throws ServletException, IOException {
- try {
- Subject subject = subjectFromRequest(request, response);
- Subject.doAs(subject, new PrivilegedExceptionAction<Void>() {
- @Override
- public Void run() throws Exception {
- RemotingServlet.super.service(request, response);
- return null;
- }
- });
- } catch (PrivilegedActionException e) {
- throw new CmsException("Cannot process JCR remoting request", e.getException());
- }
- }
- }
-}
projects / lgpl / argeo-commons.git / blobdiff