X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Finternal%2Fkernel%2FNodeSecurity.java;h=910953e30e60a1b1ad742de376cbaf37f1fe262c;hb=0b3ea4f2c08f00100e962272bf21f4f32346fd61;hp=6ad8fb15c582f61968813cfae4c0d6c7f0202788;hpb=559786a622e24c7d213960a7873e105db82a03ab;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java index 6ad8fb15c..910953e30 100644 --- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java +++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java @@ -1,116 +1,145 @@ package org.argeo.cms.internal.kernel; -import javax.jcr.RepositoryException; -import javax.security.auth.spi.LoginModule; +import java.io.File; +import java.io.IOException; +import java.net.URL; +import java.nio.file.ProviderNotFoundException; +import java.security.KeyStore; +import java.security.Provider; +import java.security.Security; +import java.util.Arrays; +import java.util.Hashtable; + +import javax.security.auth.Subject; +import javax.security.auth.callback.Callback; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.callback.NameCallback; +import javax.security.auth.callback.PasswordCallback; +import javax.security.auth.callback.UnsupportedCallbackException; +import javax.security.auth.login.LoginContext; +import javax.security.auth.login.LoginException; +import javax.security.auth.x500.X500Principal; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.argeo.cms.CmsException; -import org.argeo.security.UserAdminService; -import org.argeo.security.core.InternalAuthentication; -import org.argeo.security.core.InternalAuthenticationProvider; -import org.argeo.security.core.ThreadedLoginModule; -import org.argeo.security.jcr.SimpleJcrSecurityModel; -import org.argeo.security.jcr.jackrabbit.JackrabbitUserAdminService; -import org.eclipse.rap.rwt.RWT; -import org.eclipse.swt.widgets.Display; +import org.argeo.cms.KernelHeader; +import org.argeo.security.crypto.PkiUtils; +import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.osgi.framework.BundleContext; import org.osgi.framework.ServiceRegistration; -import org.springframework.security.authentication.AnonymousAuthenticationProvider; -import org.springframework.security.authentication.AnonymousAuthenticationToken; -import org.springframework.security.authentication.AuthenticationManager; -import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; -import org.springframework.security.core.Authentication; -import org.springframework.security.core.AuthenticationException; -import org.springframework.security.provisioning.UserDetailsManager; +import org.osgi.service.useradmin.UserAdmin; /** Authentication and user management. */ -class NodeSecurity implements AuthenticationManager { - private final static Log log = LogFactory.getLog(NodeSecurity.class); +class NodeSecurity { + private final static Log log; + static { + log = LogFactory.getLog(NodeSecurity.class); + // Make Bouncy Castle the default provider + Provider provider = new BouncyCastleProvider(); + int position = Security.insertProviderAt(provider, 1); + if (position == -1) + log.error("Provider " + provider.getName() + + " already installed and could not be set as default"); + Provider defaultProvider = Security.getProviders()[0]; + if (!defaultProvider.getName().equals(KernelHeader.SECURITY_PROVIDER)) + log.error("Provider name is " + defaultProvider.getName() + + " but it should be " + KernelHeader.SECURITY_PROVIDER); + } private final BundleContext bundleContext; + private final NodeUserAdmin userAdmin; + private final Subject kernelSubject; - private final InternalAuthenticationProvider internalAuth; - private final AnonymousAuthenticationProvider anonymousAuth; - private final JackrabbitUserAdminService jackrabbitUserAdmin; - private Login loginModule; + private ServiceRegistration userAdminReg; - private ServiceRegistration authenticationManagerReg; - private ServiceRegistration userAdminReg; - private ServiceRegistration userDetailsManagerReg; - private ServiceRegistration loginModuleReg; + public NodeSecurity(BundleContext bundleContext) { + // Configure JAAS first + URL url = getClass().getClassLoader().getResource( + KernelConstants.JAAS_CONFIG); + System.setProperty("java.security.auth.login.config", + url.toExternalForm()); - public NodeSecurity(BundleContext bundleContext, JackrabbitNode node) - throws RepositoryException { this.bundleContext = bundleContext; + this.kernelSubject = logKernel(); + userAdmin = new NodeUserAdmin(); + } - internalAuth = new InternalAuthenticationProvider( - KernelConstants.DEFAULT_SECURITY_KEY); - anonymousAuth = new AnonymousAuthenticationProvider( - KernelConstants.DEFAULT_SECURITY_KEY); - - // user admin - jackrabbitUserAdmin = new JackrabbitUserAdminService(); - jackrabbitUserAdmin.setRepository(node); - jackrabbitUserAdmin.setSecurityModel(new SimpleJcrSecurityModel()); - jackrabbitUserAdmin.init(); - - loginModule = new Login(); + private Subject logKernel() { + final Subject kernelSubject = new Subject(); + createKeyStoreIfNeeded(); + + CallbackHandler cbHandler = new CallbackHandler() { + + @Override + public void handle(Callback[] callbacks) throws IOException, + UnsupportedCallbackException { + // alias + ((NameCallback) callbacks[1]).setName(KernelHeader.ROLE_KERNEL); + // store pwd + ((PasswordCallback) callbacks[2]).setPassword("changeit" + .toCharArray()); + // key pwd + ((PasswordCallback) callbacks[3]).setPassword("changeit" + .toCharArray()); + } + }; + try { + LoginContext kernelLc = new LoginContext( + KernelConstants.LOGIN_CONTEXT_KERNEL, kernelSubject, + cbHandler); + kernelLc.login(); + } catch (LoginException e) { + throw new CmsException("Cannot log in kernel", e); + } + return kernelSubject; } public void publish() { - authenticationManagerReg = bundleContext.registerService( - AuthenticationManager.class, this, null); - userAdminReg = bundleContext.registerService(UserAdminService.class, - jackrabbitUserAdmin, null); - userDetailsManagerReg = bundleContext.registerService( - UserDetailsManager.class, jackrabbitUserAdmin, null); - // userAdminReg = - // bundleContext.registerService(UserDetailsService.class, - // jackrabbitUserAdmin, null); - - loginModuleReg = bundleContext.registerService(LoginModule.class, - loginModule, null); - } + userAdminReg = bundleContext.registerService(UserAdmin.class, + userAdmin, userAdmin.currentState()); + } void destroy() { + userAdmin.destroy(); + userAdminReg.unregister(); + + // Logout kernel try { - jackrabbitUserAdmin.destroy(); - } catch (RepositoryException e) { - log.error("Error while destroying Jackrabbit useradmin"); + LoginContext kernelLc = new LoginContext( + KernelConstants.LOGIN_CONTEXT_KERNEL, kernelSubject); + kernelLc.logout(); + } catch (LoginException e) { + throw new CmsException("Cannot log in kernel", e); } - userDetailsManagerReg.unregister(); - userAdminReg.unregister(); - authenticationManagerReg.unregister(); - loginModuleReg.unregister(); - } - @Override - public Authentication authenticate(Authentication authentication) - throws AuthenticationException { - Authentication auth = null; - if (authentication instanceof InternalAuthentication) - auth = internalAuth.authenticate(authentication); - else if (authentication instanceof AnonymousAuthenticationToken) - auth = anonymousAuth.authenticate(authentication); - else if (authentication instanceof UsernamePasswordAuthenticationToken) - auth = jackrabbitUserAdmin.authenticate(authentication); - if (auth == null) - throw new CmsException("Could not authenticate " + authentication); - return auth; + Security.removeProvider(KernelHeader.SECURITY_PROVIDER); } - private class Login extends ThreadedLoginModule { + public NodeUserAdmin getUserAdmin() { + return userAdmin; + } - @Override - protected LoginModule createLoginModule() { - SpringLoginModule springLoginModule = new SpringLoginModule(); - springLoginModule.setAuthenticationManager(NodeSecurity.this); - if (Display.getCurrent() != null) { + public Subject getKernelSubject() { + return kernelSubject; + } + private void createKeyStoreIfNeeded() { + char[] ksPwd = "changeit".toCharArray(); + char[] keyPwd = Arrays.copyOf(ksPwd, ksPwd.length); + File keyStoreFile = new File(KernelUtils.getOsgiInstanceDir(), + "node.p12"); + if (!keyStoreFile.exists()) { + try { + keyStoreFile.getParentFile().mkdirs(); + KeyStore keyStore = PkiUtils.getKeyStore(keyStoreFile, ksPwd); + PkiUtils.generateSelfSignedCertificate(keyStore, + new X500Principal(KernelHeader.ROLE_KERNEL), keyPwd); + PkiUtils.saveKeyStore(keyStoreFile, ksPwd, keyStore); + } catch (Exception e) { + throw new CmsException("Cannot create key store " + + keyStoreFile, e); } - return springLoginModule; } - } }