import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.argeo.api.cms.CmsConstants;
+import org.argeo.api.cms.CmsLog;
import org.argeo.cms.internal.auth.CmsSessionImpl;
-import org.argeo.cms.internal.kernel.Activator;
-import org.osgi.framework.BundleContext;
-import org.osgi.framework.FrameworkUtil;
+import org.argeo.cms.internal.runtime.CmsContextImpl;
+import org.argeo.cms.internal.runtime.KernelUtils;
import org.osgi.service.http.HttpContext;
import org.osgi.service.useradmin.Authorization;
/** Use the HTTP session as the basis for authentication. */
public class RemoteSessionLoginModule implements LoginModule {
- private final static Log log = LogFactory.getLog(RemoteSessionLoginModule.class);
+ private final static CmsLog log = CmsLog.getLog(RemoteSessionLoginModule.class);
private Subject subject = null;
private CallbackHandler callbackHandler = null;
private RemoteAuthRequest request = null;
private RemoteAuthResponse response = null;
- private BundleContext bc;
+// private BundleContext bc;
private Authorization authorization;
private Locale locale;
@Override
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
Map<String, ?> options) {
- bc = FrameworkUtil.getBundle(RemoteSessionLoginModule.class).getBundleContext();
- assert bc != null;
+// bc = FrameworkUtil.getBundle(RemoteSessionLoginModule.class).getBundleContext();
+// assert bc != null;
this.subject = subject;
this.callbackHandler = callbackHandler;
this.sharedState = (Map<String, Object>) sharedState;
String httpSessionId = httpSession.getId();
// if (log.isTraceEnabled())
// log.trace("HTTP login: " + request.getPathInfo() + " #" + httpSessionId);
- CmsSessionImpl cmsSession = CmsAuthUtils.cmsSessionFromHttpSession(bc, httpSessionId);
- if (cmsSession != null) {
+ CmsSessionImpl cmsSession = CmsContextImpl.getCmsContext().getCmsSessionByLocalId(httpSessionId);
+ if (cmsSession != null && !cmsSession.isAnonymous()) {
authorization = cmsSession.getAuthorization();
locale = cmsSession.getLocale();
if (log.isTraceEnabled())
String httpSessionId = httpSession.getId();
// if (log.isTraceEnabled())
// log.trace("HTTP login: " + request.getPathInfo() + " #" + httpSessionId);
- CmsSessionImpl cmsSession = CmsAuthUtils.cmsSessionFromHttpSession(bc, httpSessionId);
- if (cmsSession != null) {
+ CmsSessionImpl cmsSession = CmsContextImpl.getCmsContext().getCmsSessionByLocalId(httpSessionId);
+ if (cmsSession != null && !cmsSession.isAnonymous()) {
authorization = cmsSession.getAuthorization();
locale = cmsSession.getLocale();
if (log.isTraceEnabled())
if (log.isDebugEnabled())
log.debug("Client certificate " + certDn + " verified by servlet container");
} // Reverse proxy verified the client certificate
- String clientDnHttpHeader = Activator.getHttpProxySslHeader();
+ String clientDnHttpHeader = KernelUtils.getFrameworkProp(CmsConstants.HTTP_PROXY_SSL_DN);
if (clientDnHttpHeader != null) {
String certDn = req.getHeader(clientDnHttpHeader);
// TODO retrieve more cf. https://httpd.apache.org/docs/current/mod/mod_ssl.html