X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FUserAdminLoginModule.java;h=4862c57ac03a0faf0ddc5cb0e4f14f2e298f2562;hb=6f9397330d081d7bad20b30fb43650981d073175;hp=e39918e4002d40d18584ad91819a2a86545c92e5;hpb=54e74b900b1c0f7b1de0def771de35e50a8d4071;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
index e39918e40..4862c57ac 100644
--- a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
@@ -29,11 +29,13 @@ import org.apache.commons.logging.LogFactory;
 import org.argeo.cms.CmsException;
 import org.argeo.cms.internal.kernel.Activator;
 import org.argeo.naming.LdapAttrs;
+import org.argeo.node.security.CryptoKeyring;
 import org.argeo.osgi.useradmin.AuthenticatingUser;
 import org.argeo.osgi.useradmin.IpaUtils;
 import org.argeo.osgi.useradmin.OsUserUtils;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.FrameworkUtil;
+import org.osgi.framework.ServiceReference;
 import org.osgi.service.useradmin.Authorization;
 import org.osgi.service.useradmin.User;
 import org.osgi.service.useradmin.UserAdmin;
@@ -73,7 +75,7 @@ public class UserAdminLoginModule implements LoginModule {
 
 	@Override
 	public boolean login() throws LoginException {
-		UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
+		UserAdmin userAdmin = Activator.getUserAdmin();
 		final String username;
 		final char[] password;
 		X509Certificate[] certificateChain = null;
@@ -122,6 +124,8 @@ public class UserAdminLoginModule implements LoginModule {
 				password = passwordCallback.getPassword();
 			else
 				throw new CredentialNotFoundException("No credentials provided");
+			sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, username);
+			sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, password);
 		}
 		User user = searchForUser(userAdmin, username);
 		if (user == null)
@@ -163,10 +167,15 @@ public class UserAdminLoginModule implements LoginModule {
 
 	@Override
 	public boolean commit() throws LoginException {
+		if (locale == null)
+			subject.getPublicCredentials().add(Locale.getDefault());
+		else
+			subject.getPublicCredentials().add(locale);
+
 		if (singleUser) {
 			OsUserUtils.loginAsSystemUser(subject);
 		}
-		UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class));
+		UserAdmin userAdmin = Activator.getUserAdmin();
 		Authorization authorization;
 		if (callbackHandler == null) {// anonymous
 			authorization = userAdmin.getAuthorization(null);
@@ -204,9 +213,38 @@ public class UserAdminLoginModule implements LoginModule {
 				throw new LoginException(
 						"User admin found no authorization for authenticated user " + authenticatingUser.getName());
 		}
+
 		// Log and monitor new login
-		CmsAuthUtils.addAuthorization(subject, authorization, locale,
-				(HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST));
+		HttpServletRequest request = (HttpServletRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST);
+		CmsAuthUtils.addAuthorization(subject, authorization, locale, request);
+
+		// Unlock keyring (underlying login to the JCR repository)
+		char[] password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
+		if (password != null) {
+			ServiceReference<CryptoKeyring> keyringSr = bc.getServiceReference(CryptoKeyring.class);
+			if (keyringSr != null) {
+				CryptoKeyring keyring = bc.getService(keyringSr);
+				Subject.doAs(subject, new PrivilegedAction<Void>() {
+
+					@Override
+					public Void run() {
+						try {
+							keyring.unlock(password);
+						} catch (Exception e) {
+							e.printStackTrace();
+							log.warn("Could not unlock keyring with the password provided by " + authorization.getName()
+									+ ": " + e.getMessage());
+						}
+						return null;
+					}
+
+				});
+			}
+		}
+
+		// Register CmsSession with initial subject
+		CmsAuthUtils.registerSessionAuthorization(request, subject, authorization, locale);
+
 		if (log.isDebugEnabled())
 			log.debug("Logged in to CMS: " + subject);
 		return true;