X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FUserAdminLoginModule.java;h=515f4dc0daee943e880b740f01bb69e9027b2c07;hb=7e333073d07b780efe681306a1842a750cbea83c;hp=53e48e8c1ea4089eb13e7d5bd336c98619dc60c9;hpb=ad9eb24753d1486113cfbc19d8080f15ce5ff68a;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java index 53e48e8c1..515f4dc0d 100644 --- a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java +++ b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java @@ -1,10 +1,8 @@ package org.argeo.cms.auth; import java.io.IOException; -import java.util.Iterator; import java.util.Locale; import java.util.Map; -import java.util.Set; import javax.security.auth.Subject; import javax.security.auth.callback.Callback; @@ -14,16 +12,14 @@ import javax.security.auth.callback.NameCallback; import javax.security.auth.callback.PasswordCallback; import javax.security.auth.callback.UnsupportedCallbackException; import javax.security.auth.login.CredentialNotFoundException; +import javax.security.auth.login.FailedLoginException; import javax.security.auth.login.LoginException; import javax.security.auth.spi.LoginModule; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpSession; -import org.argeo.ArgeoException; -import org.argeo.cms.internal.kernel.Activator; +import org.argeo.cms.CmsException; import org.argeo.eclipse.ui.specific.UiContext; import org.osgi.framework.BundleContext; -import org.osgi.service.http.HttpContext; +import org.osgi.framework.FrameworkUtil; import org.osgi.service.useradmin.Authorization; import org.osgi.service.useradmin.User; import org.osgi.service.useradmin.UserAdmin; @@ -31,56 +27,52 @@ import org.osgi.service.useradmin.UserAdmin; public class UserAdminLoginModule implements LoginModule, AuthConstants { private Subject subject; private CallbackHandler callbackHandler; + private Map sharedState = null; + private boolean isAnonymous = false; - private HttpServletRequest request = null; + // private state + private BundleContext bc; + private Authorization authorization; + @SuppressWarnings("unchecked") @Override - public void initialize(Subject subject, CallbackHandler callbackHandler, - Map sharedState, Map options) { + public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, + Map options) { + this.subject = subject; try { - this.subject = subject; + bc = FrameworkUtil.getBundle(UserAdminLoginModule.class).getBundleContext(); + assert bc != null; + // this.subject = subject; this.callbackHandler = callbackHandler; + this.sharedState = (Map) sharedState; if (options.containsKey("anonymous")) - isAnonymous = Boolean.parseBoolean(options.get("anonymous") - .toString()); + isAnonymous = Boolean.parseBoolean(options.get("anonymous").toString()); } catch (Exception e) { - throw new ArgeoException("Cannot initialize login module", e); + throw new CmsException("Cannot initialize login module", e); } } @Override public boolean login() throws LoginException { - BundleContext bc = Activator.getBundleContext(); - UserAdmin userAdmin = bc.getService(bc - .getServiceReference(UserAdmin.class)); - Authorization authorization = null; + UserAdmin userAdmin = bc.getService(bc.getServiceReference(UserAdmin.class)); if (isAnonymous) { authorization = userAdmin.getAuthorization(null); } else { - HttpRequestCallback httpCallback = new HttpRequestCallback(); // ask for username and password NameCallback nameCallback = new NameCallback("User"); - PasswordCallback passwordCallback = new PasswordCallback( - "Password", false); + PasswordCallback passwordCallback = new PasswordCallback("Password", false); LanguageCallback langCallback = new LanguageCallback(); try { - callbackHandler.handle(new Callback[] { httpCallback, - nameCallback, passwordCallback, langCallback }); + callbackHandler.handle(new Callback[] { nameCallback, passwordCallback, langCallback }); } catch (IOException e) { - throw new LoginException("Cannot handle http callback: " - + e.getMessage()); + throw new LoginException("Cannot handle callback: " + e.getMessage()); + // } catch (ThreadDeath e) { + // throw new ThreadDeathLoginException("Callbackhandler thread + // died", e); } catch (UnsupportedCallbackException e) { return false; } - request = httpCallback.getRequest(); - if (request != null) { - authorization = (Authorization) request - .getAttribute(HttpContext.AUTHORIZATION); - if (authorization == null) - authorization = (Authorization) request.getSession() - .getAttribute(HttpContext.AUTHORIZATION); - } // i18n Locale locale = langCallback.getLocale(); @@ -88,77 +80,74 @@ public class UserAdminLoginModule implements LoginModule, AuthConstants { locale = Locale.getDefault(); UiContext.setLocale(locale); + authorization = (Authorization) sharedState.get(SHARED_STATE_AUTHORIZATION); + if (authorization == null) { // create credentials final String username = nameCallback.getName(); if (username == null || username.trim().equals("")) { // authorization = userAdmin.getAuthorization(null); - throw new CredentialNotFoundException( - "No credentials provided"); + throw new CredentialNotFoundException("No credentials provided"); } else { char[] password = {}; if (passwordCallback.getPassword() != null) password = passwordCallback.getPassword(); else - throw new CredentialNotFoundException( - "No credentials provided"); + throw new CredentialNotFoundException("No credentials provided"); User user = userAdmin.getUser(null, username); if (user == null) - return false; + throw new FailedLoginException("Invalid credentials"); if (!user.hasCredential(null, password)) - return false; + throw new FailedLoginException("Invalid credentials"); + // return false; + + // Log and monitor new login + // if (log.isDebugEnabled()) + // log.debug("Logged in to CMS with username [" + username + + // "]"); + authorization = userAdmin.getAuthorization(user); } } - // } else { - // authorization = userAdmin.getAuthorization(null); - // } } - subject.getPrivateCredentials().add(authorization); - return true; + if (!sharedState.containsKey(SHARED_STATE_AUTHORIZATION)) + sharedState.put(SHARED_STATE_AUTHORIZATION, authorization); + return authorization != null; } @Override public boolean commit() throws LoginException { - Authorization authorization = subject - .getPrivateCredentials(Authorization.class).iterator().next(); - if (request != null) { - request.setAttribute(HttpContext.REMOTE_USER, - authorization.getName()); - request.setAttribute(HttpContext.AUTHORIZATION, authorization); - request.getSession().setAttribute(HttpContext.AUTHORIZATION, - authorization); - subject.getPrivateCredentials().add(request.getSession()); + // Set kerberosPrincipals = + // subject.getPrincipals(KerberosPrincipal.class); + // if (kerberosPrincipals.size() != 0) { + // KerberosPrincipal kerberosPrincipal = + // kerberosPrincipals.iterator().next(); + // System.out.println(kerberosPrincipal); + // UserAdmin userAdmin = + // bc.getService(bc.getServiceReference(UserAdmin.class)); + // User user = userAdmin.getUser(null, kerberosPrincipal.getName()); + // Authorization authorization = userAdmin.getAuthorization(user); + // sharedState.put(SHARED_STATE_AUTHORIZATION, authorization); + // } + if (authorization == null) { + return false; + // throw new LoginException("Authorization should not be null"); + } else { + CmsAuthUtils.addAuthentication(subject, authorization); + return true; } - return true; } @Override public boolean abort() throws LoginException { - cleanUp(); + authorization = null; return true; } @Override public boolean logout() throws LoginException { - Set httpSession = subject - .getPrivateCredentials(HttpSession.class); - Iterator it = httpSession.iterator(); - while (it.hasNext()) { - HttpSession sess = it.next(); - sess.setAttribute(HttpContext.AUTHORIZATION, null); - // sess.setMaxInactiveInterval(1);// invalidate session - } - subject.getPrivateCredentials().removeAll(httpSession); - cleanUp(); + CmsAuthUtils.cleanUp(subject); return true; } - - private void cleanUp() { - subject.getPrivateCredentials().removeAll( - subject.getPrivateCredentials(Authorization.class)); - subject = null; - } - }