]> git.argeo.org Git - lgpl/argeo-commons.git/blob - cms/auth/CmsAuthUtils.java
Prepare next development cycle
[lgpl/argeo-commons.git] / cms / auth / CmsAuthUtils.java
1 package org.argeo.cms.auth;
2
3 import static org.argeo.api.cms.CmsConstants.ROLE_ADMIN;
4 import static org.argeo.api.cms.CmsConstants.ROLE_ANONYMOUS;
5 import static org.argeo.api.cms.CmsConstants.ROLE_USER;
6 import static org.argeo.api.cms.CmsConstants.ROLE_USER_ADMIN;
7
8 import java.security.Principal;
9 import java.util.Arrays;
10 import java.util.Collections;
11 import java.util.List;
12 import java.util.Locale;
13 import java.util.Set;
14 import java.util.UUID;
15
16 //import javax.naming.InvalidNameException;
17 //import javax.naming.ldap.LdapName;
18 import javax.security.auth.Subject;
19 import javax.security.auth.x500.X500Principal;
20
21 import org.argeo.api.cms.AnonymousPrincipal;
22 import org.argeo.api.cms.CmsConstants;
23 import org.argeo.api.cms.CmsSessionId;
24 import org.argeo.api.cms.DataAdminPrincipal;
25 import org.argeo.cms.internal.auth.CmsSessionImpl;
26 import org.argeo.cms.internal.auth.ImpliedByPrincipal;
27 import org.argeo.cms.internal.auth.RemoteCmsSessionImpl;
28 import org.argeo.cms.internal.runtime.CmsContextImpl;
29 import org.argeo.osgi.useradmin.AuthenticatingUser;
30 import org.osgi.service.useradmin.Authorization;
31
32 /** Centralises security related registrations. */
33 class CmsAuthUtils {
34 // Standard
35 final static String SHARED_STATE_NAME = AuthenticatingUser.SHARED_STATE_NAME;
36 final static String SHARED_STATE_PWD = AuthenticatingUser.SHARED_STATE_PWD;
37 // final static String HEADER_AUTHORIZATION = "Authorization";
38 // final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
39
40 // Argeo specific
41 final static String SHARED_STATE_HTTP_REQUEST = "org.argeo.cms.auth.http.request";
42 final static String SHARED_STATE_SPNEGO_TOKEN = "org.argeo.cms.auth.spnegoToken";
43 final static String SHARED_STATE_SPNEGO_OUT_TOKEN = "org.argeo.cms.auth.spnegoOutToken";
44 final static String SHARED_STATE_CERTIFICATE_CHAIN = "org.argeo.cms.auth.certificateChain";
45 final static String SHARED_STATE_REMOTE_ADDR = "org.argeo.cms.auth.remote.addr";
46 final static String SHARED_STATE_REMOTE_PORT = "org.argeo.cms.auth.remote.port";
47
48 final static String SINGLE_USER_LOCAL_ID = "single-user";
49
50 private final static List<String> RESERVED_ROLES = Collections
51 .unmodifiableList(Arrays.asList(new String[] { ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_USER, ROLE_USER_ADMIN }));
52
53 static void addAuthorization(Subject subject, Authorization authorization) {
54 assert subject != null;
55 checkSubjectEmpty(subject);
56 assert authorization != null;
57
58 // required for display name:
59 subject.getPrivateCredentials().add(authorization);
60
61 boolean singleUser = authorization instanceof SingleUserAuthorization;
62
63 Set<Principal> principals = subject.getPrincipals();
64 // try {
65 String authName = authorization.getName();
66
67 // determine user's principal
68 // final LdapName name;
69 final Principal userPrincipal;
70 if (authName == null) {
71 // name = NodeSecurityUtils.ROLE_ANONYMOUS_NAME;
72 userPrincipal = new AnonymousPrincipal();
73 principals.add(userPrincipal);
74 } else {
75 // name = new LdapName(authName);
76 checkUserName(authName);
77 userPrincipal = new X500Principal(authName.toString());
78 principals.add(userPrincipal);
79
80 if (singleUser) {
81 principals.add(new ImpliedByPrincipal(CmsConstants.ROLE_ADMIN, userPrincipal));
82 principals.add(new DataAdminPrincipal());
83 }
84 }
85
86 // Add roles provided by authorization
87 for (String role : authorization.getRoles()) {
88 // LdapName roleName = new LdapName(role);
89 if (role.equals(authName)) {
90 // skip
91 } else if (role.equals(CmsConstants.ROLE_ANONYMOUS)) {
92 // skip
93 } else {
94 // NodeSecurityUtils.checkImpliedPrincipalName(role);
95 principals.add(new ImpliedByPrincipal(role, userPrincipal));
96 if (role.equals(CmsConstants.ROLE_ADMIN))
97 principals.add(new DataAdminPrincipal());
98 }
99 }
100
101 // } catch (InvalidNameException e) {
102 // throw new IllegalArgumentException("Cannot commit", e);
103 // }
104 }
105
106 private static void checkSubjectEmpty(Subject subject) {
107 if (!subject.getPrincipals(AnonymousPrincipal.class).isEmpty())
108 throw new IllegalStateException("Already logged in as anonymous: " + subject);
109 if (!subject.getPrincipals(X500Principal.class).isEmpty())
110 throw new IllegalStateException("Already logged in as user: " + subject);
111 if (!subject.getPrincipals(DataAdminPrincipal.class).isEmpty())
112 throw new IllegalStateException("Already logged in as data admin: " + subject);
113 if (!subject.getPrincipals(ImpliedByPrincipal.class).isEmpty())
114 throw new IllegalStateException("Already authorized: " + subject);
115 }
116
117 static void cleanUp(Subject subject) {
118 // Argeo
119 subject.getPrincipals().removeAll(subject.getPrincipals(X500Principal.class));
120 subject.getPrincipals().removeAll(subject.getPrincipals(ImpliedByPrincipal.class));
121 subject.getPrincipals().removeAll(subject.getPrincipals(AnonymousPrincipal.class));
122 subject.getPrincipals().removeAll(subject.getPrincipals(DataAdminPrincipal.class));
123
124 subject.getPrivateCredentials().removeAll(subject.getPrivateCredentials(CmsSessionId.class));
125 subject.getPrivateCredentials().removeAll(subject.getPrivateCredentials(Authorization.class));
126 // Jackrabbit
127 // subject.getPrincipals().removeAll(subject.getPrincipals(AdminPrincipal.class));
128 // subject.getPrincipals().removeAll(subject.getPrincipals(AnonymousPrincipal.class));
129 }
130
131 @SuppressWarnings("unused")
132 synchronized static void registerSessionAuthorization(RemoteAuthRequest request, Subject subject,
133 Authorization authorization, Locale locale) {
134 // synchronized in order to avoid multiple registrations
135 // TODO move it to a service in order to avoid static synchronization
136 if (request != null) {
137 RemoteAuthSession httpSession = request.getSession();
138 String httpSessId = httpSession != null ? httpSession.getId() : null;
139 boolean anonymous = authorization.getName() == null;
140 String remoteUser = !anonymous ? authorization.getName() : CmsConstants.ROLE_ANONYMOUS;
141 request.setAttribute(RemoteAuthRequest.REMOTE_USER, remoteUser);
142 request.setAttribute(RemoteAuthRequest.AUTHORIZATION, authorization);
143
144 CmsSessionImpl cmsSession;
145 CmsSessionImpl currentLocalSession = CmsContextImpl.getCmsContext().getCmsSessionByLocalId(httpSessId);
146 if (currentLocalSession != null) {
147 boolean currentLocalSessionAnonymous = currentLocalSession.getAuthorization().getName() == null;
148 if (!anonymous) {
149 if (currentLocalSessionAnonymous) {
150 currentLocalSession.close();
151 // new CMS session
152 UUID cmsSessionUuid = CmsContextImpl.getCmsContext().getUuidFactory().timeUUID();
153 cmsSession = new RemoteCmsSessionImpl(cmsSessionUuid, subject, authorization, locale, request);
154 CmsContextImpl.getCmsContext().registerCmsSession(cmsSession);
155 } else if (!authorization.getName().equals(currentLocalSession.getAuthorization().getName())) {
156 throw new IllegalStateException("Inconsistent user " + authorization.getName()
157 + " for existing CMS session " + currentLocalSession);
158 } else {
159 // keep current session
160 cmsSession = currentLocalSession;
161 // credentials
162 // TODO control it more??
163 subject.getPrivateCredentials().addAll(cmsSession.getSubject().getPrivateCredentials());
164 subject.getPublicCredentials().addAll(cmsSession.getSubject().getPublicCredentials());
165 }
166 } else {// anonymous
167 if (!currentLocalSessionAnonymous) {
168 currentLocalSession.close();
169 throw new IllegalStateException(
170 "Existing CMS session " + currentLocalSession + " was not logged out properly.");
171 }
172 // keep current session
173 cmsSession = currentLocalSession;
174 }
175 } else {
176 // new CMS session
177 UUID cmsSessionUuid = CmsContextImpl.getCmsContext().getUuidFactory().timeUUID();
178 cmsSession = new RemoteCmsSessionImpl(cmsSessionUuid, subject, authorization, locale, request);
179 CmsContextImpl.getCmsContext().registerCmsSession(cmsSession);
180 }
181
182 if (cmsSession == null)// should be dead code (cf. SuppressWarning of the method)
183 throw new IllegalStateException("CMS session cannot be null");
184
185 CmsSessionId nodeSessionId = new CmsSessionId(cmsSession.getUuid());
186 if (subject.getPrivateCredentials(CmsSessionId.class).size() == 0) {
187 subject.getPrivateCredentials().add(nodeSessionId);
188 } else {
189 UUID storedSessionId = subject.getPrivateCredentials(CmsSessionId.class).iterator().next().getUuid();
190 if (!storedSessionId.equals(nodeSessionId.getUuid()))
191 throw new IllegalStateException(
192 "Subject already logged with session " + storedSessionId + " (not " + nodeSessionId + ")");
193 }
194 } else {
195 CmsSessionImpl cmsSession = CmsContextImpl.getCmsContext().getCmsSessionByLocalId(SINGLE_USER_LOCAL_ID);
196 if (cmsSession == null) {
197 UUID cmsSessionUuid = CmsContextImpl.getCmsContext().getUuidFactory().timeUUID();
198 cmsSession = new CmsSessionImpl(cmsSessionUuid, subject, authorization, locale, SINGLE_USER_LOCAL_ID);
199 CmsContextImpl.getCmsContext().registerCmsSession(cmsSession);
200 }
201 CmsSessionId nodeSessionId = new CmsSessionId(cmsSession.getUuid());
202 subject.getPrivateCredentials().add(nodeSessionId);
203 }
204 }
205
206 // public static CmsSessionImpl cmsSessionFromHttpSession(BundleContext bc, String httpSessionId) {
207 // Authorization authorization = null;
208 // Collection<ServiceReference<CmsSession>> sr;
209 // try {
210 // sr = bc.getServiceReferences(CmsSession.class,
211 // "(" + CmsSession.SESSION_LOCAL_ID + "=" + httpSessionId + ")");
212 // } catch (InvalidSyntaxException e) {
213 // throw new IllegalArgumentException("Cannot get CMS session for id " + httpSessionId, e);
214 // }
215 // CmsSessionImpl cmsSession;
216 // if (sr.size() == 1) {
217 // cmsSession = (CmsSessionImpl) bc.getService(sr.iterator().next());
218 //// locale = cmsSession.getLocale();
219 // authorization = cmsSession.getAuthorization();
220 // if (authorization.getName() == null)
221 // return null;// anonymous is not sufficient
222 // } else if (sr.size() == 0)
223 // return null;
224 // else
225 // throw new IllegalStateException(sr.size() + ">1 web sessions detected for http session " + httpSessionId);
226 // return cmsSession;
227 // }
228
229 public static <T extends Principal> T getSinglePrincipal(Subject subject, Class<T> clss) {
230 Set<T> principals = subject.getPrincipals(clss);
231 if (principals.isEmpty())
232 return null;
233 if (principals.size() > 1)
234 throw new IllegalStateException("Only one " + clss + " principal expected in " + subject);
235 return principals.iterator().next();
236 }
237
238 private static void checkUserName(String name) throws IllegalArgumentException {
239 if (RESERVED_ROLES.contains(name))
240 throw new IllegalArgumentException(name + " is a reserved name");
241 }
242
243 private CmsAuthUtils() {
244
245 }
246
247 }