org.argeo.cms/src/org/argeo/cms/integration/CmsLoginServlet.java

   1 package org.argeo.cms.integration;
   2
   3 import java.io.IOException;
   4 import java.util.Locale;
   5 import java.util.Set;
   6
   7 import javax.security.auth.Subject;
   8 import javax.security.auth.callback.Callback;
   9 import javax.security.auth.callback.NameCallback;
  10 import javax.security.auth.callback.PasswordCallback;
  11 import javax.security.auth.callback.UnsupportedCallbackException;
  12 import javax.security.auth.login.LoginContext;
  13 import javax.security.auth.login.LoginException;
  14 import javax.servlet.ServletException;
  15 import javax.servlet.http.HttpServlet;
  16 import javax.servlet.http.HttpServletRequest;
  17 import javax.servlet.http.HttpServletResponse;
  18
  19 import org.argeo.cms.auth.CmsSessionId;
  20 import org.argeo.cms.auth.HttpRequestCallback;
  21 import org.argeo.cms.auth.HttpRequestCallbackHandler;
  22 import org.argeo.node.NodeConstants;
  23 import org.osgi.service.useradmin.Authorization;
  24
  25 import com.fasterxml.jackson.core.JsonGenerator;
  26 import com.fasterxml.jackson.databind.ObjectMapper;
  27
  28 /** Externally authenticate an http session. */
  29 public class CmsLoginServlet extends HttpServlet {
  30         public final static String PARAM_USERNAME = "username";
  31         public final static String PARAM_PASSWORD = "password";
  32
  33         private static final long serialVersionUID = 2478080654328751539L;
  34 //      private Gson gson = new GsonBuilder().setPrettyPrinting().create();
  35         private ObjectMapper objectMapper = new ObjectMapper();
  36
  37         @Override
  38         protected void doGet(HttpServletRequest request, HttpServletResponse response)
  39                         throws ServletException, IOException {
  40                 doPost(request, response);
  41         }
  42
  43         @Override
  44         protected void doPost(HttpServletRequest request, HttpServletResponse response)
  45                         throws ServletException, IOException {
  46                 LoginContext lc = null;
  47                 String username = request.getParameter(PARAM_USERNAME);
  48                 String password = request.getParameter(PARAM_PASSWORD);
  49                 try {
  50                         lc = new LoginContext(NodeConstants.LOGIN_CONTEXT_USER, new HttpRequestCallbackHandler(request, response) {
  51                                 public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
  52                                         for (Callback callback : callbacks) {
  53                                                 if (callback instanceof NameCallback && username != null)
  54                                                         ((NameCallback) callback).setName(username);
  55                                                 else if (callback instanceof PasswordCallback && password != null)
  56                                                         ((PasswordCallback) callback).setPassword(password.toCharArray());
  57                                                 else if (callback instanceof HttpRequestCallback) {
  58                                                         ((HttpRequestCallback) callback).setRequest(request);
  59                                                         ((HttpRequestCallback) callback).setResponse(response);
  60                                                 }
  61                                         }
  62                                 }
  63                         });
  64                         lc.login();
  65
  66                         Subject subject = lc.getSubject();
  67                         CmsSessionId cmsSessionId = extractFrom(subject.getPrivateCredentials(CmsSessionId.class));
  68                         if (cmsSessionId == null) {
  69                                 response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
  70                                 return;
  71                         }
  72                         Authorization authorization = extractFrom(subject.getPrivateCredentials(Authorization.class));
  73                         Locale locale = extractFrom(subject.getPublicCredentials(Locale.class));
  74
  75                         CmsSessionDescriptor cmsSessionDescriptor = new CmsSessionDescriptor(authorization.getName(),
  76                                         cmsSessionId.getUuid().toString(), authorization.getRoles(), authorization.toString(),
  77                                         locale != null ? locale.toString() : null);
  78
  79                         response.setContentType("application/json");
  80                         JsonGenerator jg = objectMapper.getFactory().createGenerator(response.getWriter());
  81                         jg.writeObject(cmsSessionDescriptor);
  82
  83 //                              JsonWriter jsonWriter = gson.newJsonWriter(response.getWriter());
  84 //                              jsonWriter.beginObject();
  85 //                              // Authorization
  86 //                              jsonWriter.name("username").value(authorization.getName());
  87 //                              jsonWriter.name("displayName").value(authorization.toString());
  88 //                              // Roles
  89 //                              jsonWriter.name("roles").beginArray();
  90 //                              for (String role : authorization.getRoles())
  91 //                                      if (!role.equals(authorization.getName()))
  92 //                                              jsonWriter.value(role);
  93 //                              jsonWriter.endArray();
  94 //                              // CMS session
  95 //                              jsonWriter.name("cmsSession").beginObject();
  96 //                              jsonWriter.name("uuid").value(cmsSessionId.getUuid().toString());
  97 //                              jsonWriter.endObject();
  98 //
  99 //                              // extensions
 100 //                              enrichJson(jsonWriter);
 101 //
 102 //                              jsonWriter.endObject();
 103
 104                         String redirectTo = redirectTo(request);
 105                         if (redirectTo != null)
 106                                 response.sendRedirect(redirectTo);
 107                 } catch (LoginException e) {
 108                         response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
 109                         return;
 110                 }
 111         }
 112
 113         protected <T> T extractFrom(Set<T> creds) {
 114                 if (creds.size() > 0)
 115                         return creds.iterator().next();
 116                 else
 117                         return null;
 118         }
 119
 120         /**
 121          * To be overridden in order to return a richer {@link CmsSessionDescriptor} to
 122          * be serialized.
 123          */
 124         protected CmsSessionDescriptor enrichJson(CmsSessionDescriptor cmsSessionDescriptor) {
 125                 return cmsSessionDescriptor;
 126         }
 127
 128         protected String redirectTo(HttpServletRequest request) {
 129                 return null;
 130         }
 131 }