1 package org
.argeo
.cms
.integration
;
3 import java
.io
.IOException
;
4 import java
.util
.Locale
;
7 import javax
.security
.auth
.Subject
;
8 import javax
.security
.auth
.callback
.Callback
;
9 import javax
.security
.auth
.callback
.NameCallback
;
10 import javax
.security
.auth
.callback
.PasswordCallback
;
11 import javax
.security
.auth
.callback
.UnsupportedCallbackException
;
12 import javax
.security
.auth
.login
.LoginContext
;
13 import javax
.security
.auth
.login
.LoginException
;
14 import javax
.servlet
.ServletException
;
15 import javax
.servlet
.http
.HttpServlet
;
16 import javax
.servlet
.http
.HttpServletRequest
;
17 import javax
.servlet
.http
.HttpServletResponse
;
19 import org
.argeo
.cms
.auth
.CmsSessionId
;
20 import org
.argeo
.cms
.auth
.HttpRequestCallback
;
21 import org
.argeo
.cms
.auth
.HttpRequestCallbackHandler
;
22 import org
.argeo
.node
.NodeConstants
;
23 import org
.osgi
.service
.useradmin
.Authorization
;
25 import com
.fasterxml
.jackson
.core
.JsonGenerator
;
26 import com
.fasterxml
.jackson
.databind
.ObjectMapper
;
28 /** Externally authenticate an http session. */
29 public class CmsLoginServlet
extends HttpServlet
{
30 public final static String PARAM_USERNAME
= "username";
31 public final static String PARAM_PASSWORD
= "password";
33 private static final long serialVersionUID
= 2478080654328751539L;
34 // private Gson gson = new GsonBuilder().setPrettyPrinting().create();
35 private ObjectMapper objectMapper
= new ObjectMapper();
38 protected void doGet(HttpServletRequest request
, HttpServletResponse response
)
39 throws ServletException
, IOException
{
40 doPost(request
, response
);
44 protected void doPost(HttpServletRequest request
, HttpServletResponse response
)
45 throws ServletException
, IOException
{
46 LoginContext lc
= null;
47 String username
= request
.getParameter(PARAM_USERNAME
);
48 String password
= request
.getParameter(PARAM_PASSWORD
);
50 lc
= new LoginContext(NodeConstants
.LOGIN_CONTEXT_USER
, new HttpRequestCallbackHandler(request
, response
) {
51 public void handle(Callback
[] callbacks
) throws IOException
, UnsupportedCallbackException
{
52 for (Callback callback
: callbacks
) {
53 if (callback
instanceof NameCallback
&& username
!= null)
54 ((NameCallback
) callback
).setName(username
);
55 else if (callback
instanceof PasswordCallback
&& password
!= null)
56 ((PasswordCallback
) callback
).setPassword(password
.toCharArray());
57 else if (callback
instanceof HttpRequestCallback
) {
58 ((HttpRequestCallback
) callback
).setRequest(request
);
59 ((HttpRequestCallback
) callback
).setResponse(response
);
66 Subject subject
= lc
.getSubject();
67 CmsSessionId cmsSessionId
= extractFrom(subject
.getPrivateCredentials(CmsSessionId
.class));
68 if (cmsSessionId
== null) {
69 response
.setStatus(HttpServletResponse
.SC_UNAUTHORIZED
);
72 Authorization authorization
= extractFrom(subject
.getPrivateCredentials(Authorization
.class));
73 Locale locale
= extractFrom(subject
.getPublicCredentials(Locale
.class));
75 CmsSessionDescriptor cmsSessionDescriptor
= new CmsSessionDescriptor(authorization
.getName(),
76 cmsSessionId
.getUuid().toString(), authorization
.getRoles(), authorization
.toString(),
77 locale
!= null ? locale
.toString() : null);
79 response
.setContentType("application/json");
80 JsonGenerator jg
= objectMapper
.getFactory().createGenerator(response
.getWriter());
81 jg
.writeObject(cmsSessionDescriptor
);
83 // JsonWriter jsonWriter = gson.newJsonWriter(response.getWriter());
84 // jsonWriter.beginObject();
86 // jsonWriter.name("username").value(authorization.getName());
87 // jsonWriter.name("displayName").value(authorization.toString());
89 // jsonWriter.name("roles").beginArray();
90 // for (String role : authorization.getRoles())
91 // if (!role.equals(authorization.getName()))
92 // jsonWriter.value(role);
93 // jsonWriter.endArray();
95 // jsonWriter.name("cmsSession").beginObject();
96 // jsonWriter.name("uuid").value(cmsSessionId.getUuid().toString());
97 // jsonWriter.endObject();
100 // enrichJson(jsonWriter);
102 // jsonWriter.endObject();
104 String redirectTo
= redirectTo(request
);
105 if (redirectTo
!= null)
106 response
.sendRedirect(redirectTo
);
107 } catch (LoginException e
) {
108 response
.setStatus(HttpServletResponse
.SC_UNAUTHORIZED
);
113 protected <T
> T
extractFrom(Set
<T
> creds
) {
114 if (creds
.size() > 0)
115 return creds
.iterator().next();
121 * To be overridden in order to return a richer {@link CmsSessionDescriptor} to
124 protected CmsSessionDescriptor
enrichJson(CmsSessionDescriptor cmsSessionDescriptor
) {
125 return cmsSessionDescriptor
;
128 protected String
redirectTo(HttpServletRequest request
) {