org.argeo.cms/src/org/argeo/cms/internal/kernel/HomeRepository.java

   1 package org.argeo.cms.internal.kernel;
   2
   3 import java.security.PrivilegedAction;
   4 import java.util.HashSet;
   5 import java.util.Set;
   6
   7 import javax.jcr.LoginException;
   8 import javax.jcr.Node;
   9 import javax.jcr.Repository;
  10 import javax.jcr.RepositoryException;
  11 import javax.jcr.Session;
  12 import javax.jcr.security.Privilege;
  13 import javax.naming.InvalidNameException;
  14 import javax.naming.ldap.LdapName;
  15 import javax.security.auth.Subject;
  16 import javax.security.auth.login.LoginContext;
  17
  18 import org.argeo.ArgeoException;
  19 import org.argeo.cms.CmsException;
  20 import org.argeo.cms.auth.AuthConstants;
  21 import org.argeo.jcr.ArgeoJcrConstants;
  22 import org.argeo.jcr.ArgeoNames;
  23 import org.argeo.jcr.ArgeoTypes;
  24 import org.argeo.jcr.JcrRepositoryWrapper;
  25 import org.argeo.jcr.JcrUtils;
  26 import org.argeo.jcr.UserJcrUtils;
  27
  28 /**
  29  * Make sure each user has a home directory available in the default workspace.
  30  */
  31 class HomeRepository extends JcrRepositoryWrapper implements KernelConstants, ArgeoJcrConstants {
  32         // private final Kernel kernel;
  33
  34         /** The home base path. */
  35         private String homeBasePath = "/home";
  36         private String peopleBasePath = ArgeoJcrConstants.PEOPLE_BASE_PATH;
  37
  38         private Set<String> checkedUsers = new HashSet<String>();
  39
  40         public HomeRepository(Repository repository) {
  41                 // this.kernel = kernel;
  42                 setRepository(repository);
  43                 LoginContext lc;
  44                 try {
  45                         lc = new LoginContext(AuthConstants.LOGIN_CONTEXT_DATA_ADMIN);
  46                         lc.login();
  47                 } catch (javax.security.auth.login.LoginException e1) {
  48                         throw new CmsException("Cannot login as systrem", e1);
  49                 }
  50                 Subject.doAs(lc.getSubject(), new PrivilegedAction<Void>() {
  51
  52                         @Override
  53                         public Void run() {
  54                                 try {
  55                                         initJcr(getRepository().login());
  56                                 } catch (RepositoryException e) {
  57                                         throw new CmsException("Cannot init JCR home", e);
  58                                 }
  59                                 return null;
  60                         }
  61
  62                 });
  63         }
  64
  65         @Override
  66         public Session login() throws LoginException, RepositoryException {
  67                 Session session = super.login();
  68                 String username = session.getUserID();
  69                 if (username == null)
  70                         return session;
  71                 if (session.getUserID().equals(AuthConstants.ROLE_ANONYMOUS))
  72                         return session;
  73
  74                 if (checkedUsers.contains(username))
  75                         return session;
  76                 Session adminSession = KernelUtils.openAdminSession(getRepository(), session.getWorkspace().getName());
  77                 try {
  78                         syncJcr(adminSession, username);
  79                         checkedUsers.add(username);
  80                 } finally {
  81                         JcrUtils.logoutQuietly(adminSession);
  82                 }
  83                 return session;
  84         }
  85
  86         /*
  87          * JCR
  88          */
  89         /** Session is logged out. */
  90         private void initJcr(Session adminSession) {
  91                 try {
  92                         JcrUtils.mkdirs(adminSession, homeBasePath);
  93                         JcrUtils.mkdirs(adminSession, peopleBasePath);
  94                         adminSession.save();
  95
  96                         JcrUtils.addPrivilege(adminSession, homeBasePath, AuthConstants.ROLE_USER_ADMIN, Privilege.JCR_READ);
  97                         JcrUtils.addPrivilege(adminSession, peopleBasePath, AuthConstants.ROLE_USER_ADMIN, Privilege.JCR_ALL);
  98                         adminSession.save();
  99                 } catch (RepositoryException e) {
 100                         throw new CmsException("Cannot initialize node user admin", e);
 101                 } finally {
 102                         JcrUtils.logoutQuietly(adminSession);
 103                 }
 104         }
 105
 106         private Node syncJcr(Session session, String username) {
 107                 try {
 108                         Node userHome = UserJcrUtils.getUserHome(session, username);
 109                         if (userHome == null) {
 110                                 String homePath = generateUserPath(homeBasePath, username);
 111                                 if (session.itemExists(homePath))// duplicate user id
 112                                         userHome = session.getNode(homePath).getParent().addNode(JcrUtils.lastPathElement(homePath));
 113                                 else
 114                                         userHome = JcrUtils.mkdirs(session, homePath);
 115                                 // userHome = JcrUtils.mkfolders(session, homePath);
 116                                 userHome.addMixin(ArgeoTypes.ARGEO_USER_HOME);
 117                                 userHome.setProperty(ArgeoNames.ARGEO_USER_ID, username);
 118                                 session.save();
 119
 120                                 JcrUtils.clearAccessControList(session, homePath, username);
 121                                 JcrUtils.addPrivilege(session, homePath, username, Privilege.JCR_ALL);
 122                         }
 123
 124                         Node userProfile = UserJcrUtils.getUserProfile(session, username);
 125                         // new user
 126                         if (userProfile == null) {
 127                                 String personPath = generateUserPath(peopleBasePath, username);
 128                                 Node personBase;
 129                                 if (session.itemExists(personPath))// duplicate user id
 130                                         personBase = session.getNode(personPath).getParent().addNode(JcrUtils.lastPathElement(personPath));
 131                                 else
 132                                         personBase = JcrUtils.mkdirs(session, personPath);
 133                                 userProfile = personBase.addNode(ArgeoNames.ARGEO_PROFILE);
 134                                 userProfile.addMixin(ArgeoTypes.ARGEO_USER_PROFILE);
 135                                 userProfile.setProperty(ArgeoNames.ARGEO_USER_ID, username);
 136 //                              userProfile.setProperty(ArgeoNames.ARGEO_ENABLED, true);
 137 //                              userProfile.setProperty(ArgeoNames.ARGEO_ACCOUNT_NON_EXPIRED, true);
 138 //                              userProfile.setProperty(ArgeoNames.ARGEO_ACCOUNT_NON_LOCKED, true);
 139 //                              userProfile.setProperty(ArgeoNames.ARGEO_CREDENTIALS_NON_EXPIRED, true);
 140                                 session.save();
 141
 142                                 JcrUtils.clearAccessControList(session, userProfile.getPath(), username);
 143                                 JcrUtils.addPrivilege(session, userProfile.getPath(), username, Privilege.JCR_READ);
 144                         }
 145
 146                         // Remote roles
 147                         // if (roles != null) {
 148                         // writeRemoteRoles(userProfile, roles);
 149                         // }
 150                         if (session.hasPendingChanges())
 151                                 session.save();
 152                         return userProfile;
 153                 } catch (RepositoryException e) {
 154                         JcrUtils.discardQuietly(session);
 155                         throw new ArgeoException("Cannot sync node security model for " + username, e);
 156                 }
 157         }
 158
 159         /** Generate path for a new user home */
 160         private String generateUserPath(String base, String username) {
 161                 LdapName dn;
 162                 try {
 163                         dn = new LdapName(username);
 164                 } catch (InvalidNameException e) {
 165                         throw new ArgeoException("Invalid name " + username, e);
 166                 }
 167                 String userId = dn.getRdn(dn.size() - 1).getValue().toString();
 168                 int atIndex = userId.indexOf('@');
 169                 if (atIndex > 0) {
 170                         String domain = userId.substring(0, atIndex);
 171                         String name = userId.substring(atIndex + 1);
 172                         return base + '/' + JcrUtils.firstCharsToPath(domain, 2) + '/' + domain + '/'
 173                                         + JcrUtils.firstCharsToPath(name, 2) + '/' + name;
 174                 } else if (atIndex == 0 || atIndex == (userId.length() - 1)) {
 175                         throw new ArgeoException("Unsupported username " + userId);
 176                 } else {
 177                         return base + '/' + JcrUtils.firstCharsToPath(userId, 2) + '/' + userId;
 178                 }
 179         }
 180
 181 }