Introduce Single User login

git-svn-id: https://svn.argeo.org/commons/trunk@8308 4cfe0d0a-d680-48aa-b62c-e0a02a3f76cc

diff --git a/org.argeo.cms/src/org/argeo/cms/KernelHeader.java b/org.argeo.cms/src/org/argeo/cms/KernelHeader.java
index 94477c3d460869c968e2de04fa8863f3b6d70d19..c2dd2cae7dfe76cc57a107a5ecc46545846beb7b 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/KernelHeader.java
+++ b/org.argeo.cms/src/org/argeo/cms/KernelHeader.java
@@ -6,6 +6,7 @@ public interface KernelHeader {
        final static String LOGIN_CONTEXT_USER = "USER";
        final static String LOGIN_CONTEXT_ANONYMOUS = "ANONYMOUS";
        final static String LOGIN_CONTEXT_SYSTEM = "SYSTEM";
+       final static String LOGIN_CONTEXT_SINGLE_USER = "SINGLE_USER";
 
        // RESERVED ROLES
        public final static String ROLE_ADMIN = "ROLE_ADMIN";

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/auth/AbstractLoginModule.java b/org.argeo.cms/src/org/argeo/cms/internal/auth/AbstractLoginModule.java
index baf6b63175eb3b952bedee3cca530e2d00103196..89312a3dca2d1c7c95ee0df20875c6cd42e39a0b 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/internal/auth/AbstractLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/internal/auth/AbstractLoginModule.java
@@ -161,11 +161,13 @@ public abstract class AbstractLoginModule implements LoginModule {
                SecurityContextHolder.getContext().setAuthentication(null);
                if (Display.getCurrent() != null) {
                        HttpServletRequest httpRequest = RWT.getRequest();
-                       HttpSession httpSession = httpRequest.getSession();
-                       if (httpSession.getAttribute(SPRING_SECURITY_CONTEXT_KEY) != null)
-                               httpSession.setAttribute(SPRING_SECURITY_CONTEXT_KEY, null);
-                       // expire session
-                       httpSession.setMaxInactiveInterval(0);
+                       if (httpRequest != null) {
+                               HttpSession httpSession = httpRequest.getSession();
+                               if (httpSession.getAttribute(SPRING_SECURITY_CONTEXT_KEY) != null)
+                                       httpSession.setAttribute(SPRING_SECURITY_CONTEXT_KEY, null);
+                               // expire session
+                               httpSession.setMaxInactiveInterval(0);
+                       }
                }
                return true;
        }

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/auth/SingleUserLoginModule.java b/org.argeo.cms/src/org/argeo/cms/internal/auth/SingleUserLoginModule.java
new file mode 100644 (file)
index 0000000..a00c922
--- /dev/null
+++ b/org.argeo.cms/src/org/argeo/cms/internal/auth/SingleUserLoginModule.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2007-2012 Argeo GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.argeo.cms.internal.auth;
+
+import java.io.IOException;
+
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.login.LoginException;
+
+import org.argeo.security.OsAuthenticationToken;
+import org.springframework.security.core.Authentication;
+
+/** Login module which caches one subject per thread. */
+public class SingleUserLoginModule extends AbstractLoginModule {
+       @Override
+       protected Authentication processLogin(CallbackHandler callbackHandler)
+                       throws LoginException, UnsupportedCallbackException, IOException,
+                       InterruptedException {
+               OsAuthenticationToken token = new OsAuthenticationToken();
+               return getAuthenticationManager().authenticate(token);
+       }
+}

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java
index e841bfc3db187cb8c2f896ea66e511758d72047a..f279ba5eab329d02ed5010ee2a848475c2d3b47d 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java
+++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeSecurity.java
@@ -10,9 +10,11 @@ import org.argeo.cms.CmsException;
 import org.argeo.cms.internal.useradmin.JcrUserAdmin;
 import org.argeo.cms.internal.useradmin.SimpleJcrSecurityModel;
 import org.argeo.cms.internal.useradmin.jackrabbit.JackrabbitUserAdminService;
+import org.argeo.security.OsAuthenticationToken;
 import org.argeo.security.UserAdminService;
 import org.argeo.security.core.InternalAuthentication;
 import org.argeo.security.core.InternalAuthenticationProvider;
+import org.argeo.security.core.OsAuthenticationProvider;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.ServiceRegistration;
 import org.osgi.service.useradmin.UserAdmin;
@@ -30,6 +32,7 @@ class NodeSecurity implements AuthenticationManager {
 
        private final BundleContext bundleContext;
 
+       private final OsAuthenticationProvider osAuth;
        private final InternalAuthenticationProvider internalAuth;
        private final AnonymousAuthenticationProvider anonymousAuth;
        private final JackrabbitUserAdminService userAdminService;
@@ -50,6 +53,7 @@ class NodeSecurity implements AuthenticationManager {
 
                this.bundleContext = bundleContext;
 
+               osAuth = new OsAuthenticationProvider();
                internalAuth = new InternalAuthenticationProvider(
                                Activator.getSystemKey());
                anonymousAuth = new AnonymousAuthenticationProvider(
@@ -100,6 +104,8 @@ class NodeSecurity implements AuthenticationManager {
                        auth = anonymousAuth.authenticate(authentication);
                else if (authentication instanceof UsernamePasswordAuthenticationToken)
                        auth = userAdminService.authenticate(authentication);
+               else if (authentication instanceof OsAuthenticationToken)
+                       auth = osAuth.authenticate(authentication);
                if (auth == null)
                        throw new CmsException("Could not authenticate " + authentication);
                return auth;

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/jaas.cfg b/org.argeo.cms/src/org/argeo/cms/internal/kernel/jaas.cfg
index cc1a07499c135d0f077e5f91c47cd3471ac60d3f..c8033b1bd7bf070ef605d17ee48005beb47f2288 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/jaas.cfg
+++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/jaas.cfg
@@ -16,3 +16,9 @@ SYSTEM {
 KEYRING {
     org.argeo.security.crypto.KeyringLoginModule required;
 };
+
+SINGLE_USER {
+    com.sun.security.auth.module.UnixLoginModule requisite;
+    org.argeo.cms.internal.auth.SingleUserLoginModule requisite;
+    org.springframework.security.authentication.jaas.SecurityContextLoginModule requisite;
+};