org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java

   1 package org.argeo.cms.auth;
   2
   3 import static org.argeo.util.naming.LdapAttrs.cn;
   4
   5 import java.io.IOException;
   6 import java.security.PrivilegedAction;
   7 import java.util.Arrays;
   8 import java.util.HashSet;
   9 import java.util.List;
  10 import java.util.Locale;
  11 import java.util.Map;
  12 import java.util.Set;
  13
  14 import javax.naming.ldap.LdapName;
  15 import javax.security.auth.Subject;
  16 import javax.security.auth.callback.Callback;
  17 import javax.security.auth.callback.CallbackHandler;
  18 import javax.security.auth.callback.LanguageCallback;
  19 import javax.security.auth.callback.NameCallback;
  20 import javax.security.auth.callback.PasswordCallback;
  21 import javax.security.auth.callback.UnsupportedCallbackException;
  22 import javax.security.auth.kerberos.KerberosPrincipal;
  23 import javax.security.auth.login.CredentialNotFoundException;
  24 import javax.security.auth.login.LoginException;
  25 import javax.security.auth.spi.LoginModule;
  26
  27 import org.argeo.api.cms.CmsConstants;
  28 import org.argeo.api.cms.CmsLog;
  29 import org.argeo.cms.internal.runtime.CmsContextImpl;
  30 import org.argeo.osgi.useradmin.AuthenticatingUser;
  31 import org.argeo.osgi.useradmin.TokenUtils;
  32 import org.argeo.util.directory.ldap.IpaUtils;
  33 import org.argeo.util.naming.LdapAttrs;
  34 import org.osgi.service.useradmin.Authorization;
  35 import org.osgi.service.useradmin.Group;
  36 import org.osgi.service.useradmin.User;
  37 import org.osgi.service.useradmin.UserAdmin;
  38
  39 /**
  40  * Use the {@link UserAdmin} in the OSGi registry as the basis for
  41  * authentication.
  42  */
  43 public class UserAdminLoginModule implements LoginModule {
  44         private final static CmsLog log = CmsLog.getLog(UserAdminLoginModule.class);
  45
  46         private Subject subject;
  47         private CallbackHandler callbackHandler;
  48         private Map<String, Object> sharedState = null;
  49
  50         private List<String> indexedUserProperties = Arrays.asList(new String[] { LdapAttrs.mail.name(),
  51                         LdapAttrs.uid.name(), LdapAttrs.employeeNumber.name(), LdapAttrs.authPassword.name() });
  52
  53         // private state
  54 //      private BundleContext bc;
  55         private User authenticatedUser = null;
  56         private Locale locale;
  57
  58         private Authorization bindAuthorization = null;
  59
  60 //      private boolean singleUser = Activator.isSingleUser();
  61
  62         @SuppressWarnings("unchecked")
  63         @Override
  64         public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
  65                         Map<String, ?> options) {
  66                 this.subject = subject;
  67                 try {
  68 //                      bc = FrameworkUtil.getBundle(UserAdminLoginModule.class).getBundleContext();
  69                         this.callbackHandler = callbackHandler;
  70                         this.sharedState = (Map<String, Object>) sharedState;
  71                 } catch (Exception e) {
  72                         throw new IllegalStateException("Cannot initialize login module", e);
  73                 }
  74         }
  75
  76         @Override
  77         public boolean login() throws LoginException {
  78                 UserAdmin userAdmin = CmsContextImpl.getCmsContext().getUserAdmin();
  79                 final String username;
  80                 final char[] password;
  81                 Object certificateChain = null;
  82                 boolean preauth = false;
  83                 if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  84                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_PWD)) {
  85                         // NB: required by Basic http auth
  86                         username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
  87                         password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
  88                         // // TODO locale?
  89                 } else if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  90                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_SPNEGO_TOKEN)) {
  91                         // SPNEGO login has succeeded, that's enough for us at this stage
  92                         return true;
  93                 } else if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
  94                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN)) {
  95                         String certDn = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
  96                         username = certDn;
  97                         certificateChain = sharedState.get(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN);
  98                         password = null;
  99                 } else if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
 100                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_REMOTE_ADDR)
 101                                 && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_REMOTE_PORT)) {// ident
 102                         username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
 103                         password = null;
 104                         preauth = true;
 105                 } else {
 106
 107                         // ask for username and password
 108                         NameCallback nameCallback = new NameCallback("User");
 109                         PasswordCallback passwordCallback = new PasswordCallback("Password", false);
 110                         LanguageCallback langCallback = new LanguageCallback();
 111                         try {
 112                                 callbackHandler.handle(new Callback[] { nameCallback, passwordCallback, langCallback });
 113                         } catch (IOException e) {
 114                                 throw new LoginException("Cannot handle callback: " + e.getMessage());
 115                         } catch (UnsupportedCallbackException e) {
 116                                 return false;
 117                         }
 118
 119                         // i18n
 120                         locale = langCallback.getLocale();
 121                         if (locale == null)
 122                                 locale = Locale.getDefault();
 123                         // FIXME add it to Subject
 124                         // Locale.setDefault(locale);
 125
 126                         username = nameCallback.getName();
 127                         if (username == null || username.trim().equals("")) {
 128                                 // authorization = userAdmin.getAuthorization(null);
 129                                 throw new CredentialNotFoundException("No credentials provided");
 130                         }
 131                         if (passwordCallback.getPassword() != null)
 132                                 password = passwordCallback.getPassword();
 133                         else
 134                                 throw new CredentialNotFoundException("No credentials provided");
 135                         sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, username);
 136                         sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, password);
 137                 }
 138                 User user = searchForUser(userAdmin, username);
 139
 140                 // Tokens
 141                 if (user == null) {
 142                         String token = username;
 143                         Group tokenGroup = searchForToken(userAdmin, token);
 144                         if (tokenGroup != null) {
 145                                 Authorization tokenAuthorization = getAuthorizationFromToken(userAdmin, tokenGroup);
 146                                 if (tokenAuthorization != null) {
 147                                         bindAuthorization = tokenAuthorization;
 148                                         authenticatedUser = (User) userAdmin.getRole(bindAuthorization.getName());
 149                                         return true;
 150                                 }
 151                         }
 152                 }
 153
 154                 if (user == null)
 155                         return true;// expect Kerberos
 156
 157                 if (password != null) {
 158                         // try bind first
 159                         try {
 160                                 AuthenticatingUser authenticatingUser = new AuthenticatingUser(user.getName(), password);
 161                                 bindAuthorization = userAdmin.getAuthorization(authenticatingUser);
 162                                 // TODO check tokens as well
 163                                 if (bindAuthorization != null) {
 164                                         authenticatedUser = user;
 165                                         return true;
 166                                 }
 167                         } catch (Exception e) {
 168                                 // silent
 169                                 if (log.isTraceEnabled())
 170                                         log.trace("Bind failed", e);
 171                         }
 172
 173                         // works only if a connection password is provided
 174                         if (!user.hasCredential(null, password)) {
 175                                 return false;
 176                         }
 177                 } else if (certificateChain != null) {
 178                         // TODO check CRLs/OSCP validity?
 179                         // NB: authorization in commit() will work only if an LDAP connection password
 180                         // is provided
 181 //              } else if (singleUser) {
 182 //                      // TODO verify IP address?
 183                 } else if (preauth) {
 184                         // ident
 185                 } else {
 186                         throw new CredentialNotFoundException("No credentials provided");
 187                 }
 188
 189                 authenticatedUser = user;
 190                 return true;
 191         }
 192
 193         @Override
 194         public boolean commit() throws LoginException {
 195                 if (locale != null)
 196                         subject.getPublicCredentials().add(locale);
 197
 198 //              if (singleUser) {
 199 //                      OsUserUtils.loginAsSystemUser(subject);
 200 //              }
 201                 UserAdmin userAdmin = CmsContextImpl.getCmsContext().getUserAdmin();
 202                 Authorization authorization;
 203                 if (callbackHandler == null) {// anonymous
 204                         authorization = userAdmin.getAuthorization(null);
 205                 } else if (bindAuthorization != null) {// bind
 206                         authorization = bindAuthorization;
 207                 } else {// Kerberos
 208                         User authenticatingUser;
 209                         Set<KerberosPrincipal> kerberosPrincipals = subject.getPrincipals(KerberosPrincipal.class);
 210                         if (kerberosPrincipals.isEmpty()) {
 211                                 if (authenticatedUser == null) {
 212                                         if (log.isTraceEnabled())
 213                                                 log.trace("Neither kerberos nor user admin login succeeded. Login failed.");
 214                                         throw new CredentialNotFoundException("Bad credentials.");
 215                                 } else {
 216                                         authenticatingUser = authenticatedUser;
 217                                 }
 218                         } else {
 219                                 KerberosPrincipal kerberosPrincipal = kerberosPrincipals.iterator().next();
 220                                 LdapName dn = IpaUtils.kerberosToDn(kerberosPrincipal.getName());
 221                                 authenticatingUser = new AuthenticatingUser(dn);
 222                                 if (authenticatedUser != null && !authenticatingUser.getName().equals(authenticatedUser.getName()))
 223                                         throw new LoginException("Kerberos login " + authenticatingUser.getName()
 224                                                         + " is inconsistent with user admin login " + authenticatedUser.getName());
 225                         }
 226                         if (log.isTraceEnabled())
 227                                 log.trace("Retrieve authorization for " + authenticatingUser + "... ");
 228                         authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
 229
 230                                 @Override
 231                                 public Authorization run() {
 232                                         Authorization authorization = userAdmin.getAuthorization(authenticatingUser);
 233                                         return authorization;
 234                                 }
 235
 236                         });
 237                         if (authorization == null)
 238                                 throw new LoginException(
 239                                                 "User admin found no authorization for authenticated user " + authenticatingUser.getName());
 240                 }
 241
 242                 // Log and monitor new login
 243                 RemoteAuthRequest request = (RemoteAuthRequest) sharedState.get(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST);
 244                 CmsAuthUtils.addAuthorization(subject, authorization);
 245
 246                 // Unlock keyring (underlying login to the JCR repository)
 247 //              char[] password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
 248 //              if (password != null) {
 249 //                      ServiceReference<CryptoKeyring> keyringSr = bc.getServiceReference(CryptoKeyring.class);
 250 //                      if (keyringSr != null) {
 251 //                              CryptoKeyring keyring = bc.getService(keyringSr);
 252 //                              Subject.doAs(subject, new PrivilegedAction<Void>() {
 253 //
 254 //                                      @Override
 255 //                                      public Void run() {
 256 //                                              try {
 257 //                                                      keyring.unlock(password);
 258 //                                              } catch (Exception e) {
 259 //                                                      e.printStackTrace();
 260 //                                                      log.warn("Could not unlock keyring with the password provided by " + authorization.getName()
 261 //                                                                      + ": " + e.getMessage());
 262 //                                              }
 263 //                                              return null;
 264 //                                      }
 265 //
 266 //                              });
 267 //                      }
 268 //              }
 269
 270                 // Register CmsSession with initial subject
 271                 CmsAuthUtils.registerSessionAuthorization(request, subject, authorization, locale);
 272
 273                 if (log.isDebugEnabled())
 274                         log.debug("Logged in to CMS: " + subject);
 275                 return true;
 276         }
 277
 278         @Override
 279         public boolean abort() throws LoginException {
 280                 return true;
 281         }
 282
 283         @Override
 284         public boolean logout() throws LoginException {
 285                 if (log.isTraceEnabled())
 286                         log.trace("Logging out from CMS... " + subject);
 287                 CmsAuthUtils.cleanUp(subject);
 288                 return true;
 289         }
 290
 291         protected User searchForUser(UserAdmin userAdmin, String providedUsername) {
 292                 try {
 293                         // TODO check value null or empty
 294                         Set<User> collectedUsers = new HashSet<>();
 295                         // try dn
 296                         User user = null;
 297                         user = null;
 298                         // try all indexes
 299                         for (String attr : indexedUserProperties) {
 300                                 user = userAdmin.getUser(attr, providedUsername);
 301                                 if (user != null)
 302                                         collectedUsers.add(user);
 303                         }
 304                         if (collectedUsers.size() == 1) {
 305                                 user = collectedUsers.iterator().next();
 306                                 return user;
 307                         } else if (collectedUsers.size() > 1) {
 308                                 log.warn(collectedUsers.size() + " users for provided username" + providedUsername);
 309                         }
 310                         // try DN as a last resort
 311                         try {
 312                                 user = (User) userAdmin.getRole(providedUsername);
 313                                 if (user != null)
 314                                         return user;
 315                         } catch (Exception e) {
 316                                 // silent
 317                         }
 318                         return null;
 319                 } catch (Exception e) {
 320                         if (log.isTraceEnabled())
 321                                 log.warn("Cannot search for user " + providedUsername, e);
 322                         return null;
 323                 }
 324
 325         }
 326
 327         protected Group searchForToken(UserAdmin userAdmin, String token) {
 328                 String dn = cn + "=" + token + "," + CmsConstants.TOKENS_BASEDN;
 329                 Group tokenGroup = (Group) userAdmin.getRole(dn);
 330                 return tokenGroup;
 331         }
 332
 333         protected Authorization getAuthorizationFromToken(UserAdmin userAdmin, Group tokenGroup) {
 334                 if (TokenUtils.isExpired(tokenGroup))
 335                         return null;
 336 //              String expiryDateStr = (String) tokenGroup.getProperties().get(description.name());
 337 //              if (expiryDateStr != null) {
 338 //                      Instant expiryDate = NamingUtils.ldapDateToInstant(expiryDateStr);
 339 //                      if (expiryDate.isBefore(Instant.now())) {
 340 //                              if (log.isDebugEnabled())
 341 //                                      log.debug("Token " + tokenGroup.getName() + " has expired.");
 342 //                              return null;
 343 //                      }
 344 //              }
 345                 String userDn = TokenUtils.userDn(tokenGroup);
 346                 User user = (User) userAdmin.getRole(userDn);
 347                 Authorization auth = userAdmin.getAuthorization(user);
 348                 return auth;
 349         }
 350 }