import org.argeo.node.security.AnonymousPrincipal;
import org.argeo.node.security.DataAdminPrincipal;
import org.argeo.node.security.NodeSecurityUtils;
+import org.argeo.osgi.useradmin.AuthenticatingUser;
import org.osgi.service.http.HttpContext;
import org.osgi.service.useradmin.Authorization;
class CmsAuthUtils {
- /** Shared HTTP request */
- final static String SHARED_STATE_HTTP_REQUEST = "org.argeo.cms.auth.http.request";
- /** From org.osgi.service.http.HttpContext */
- // final static String SHARED_STATE_AUTHORIZATION =
- // "org.osgi.service.useradmin.authorization";
- /** From com.sun.security.auth.module.*LoginModule */
- final static String SHARED_STATE_NAME = "javax.security.auth.login.name";
- /** From com.sun.security.auth.module.*LoginModule */
- final static String SHARED_STATE_PWD = "javax.security.auth.login.password";
+ // Standard
+ final static String SHARED_STATE_NAME = AuthenticatingUser.SHARED_STATE_NAME;
+ final static String SHARED_STATE_PWD = AuthenticatingUser.SHARED_STATE_PWD;
+ final static String HEADER_AUTHORIZATION = "Authorization";
+ final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
+ // Argeo specific
+ final static String SHARED_STATE_HTTP_REQUEST = "org.argeo.cms.auth.http.request";
final static String SHARED_STATE_SPNEGO_TOKEN = "org.argeo.cms.auth.spnegoToken";
final static String SHARED_STATE_SPNEGO_OUT_TOKEN = "org.argeo.cms.auth.spnegoOutToken";
- final static String HEADER_AUTHORIZATION = "Authorization";
- final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
-
static void addAuthorization(Subject subject, Authorization authorization, Locale locale,
HttpServletRequest request) {
assert subject != null;
// subject.getPrincipals().removeAll(subject.getPrincipals(AnonymousPrincipal.class));
}
- private static void registerSessionAuthorization(HttpServletRequest request, Subject subject,
+ private synchronized static void registerSessionAuthorization(HttpServletRequest request, Subject subject,
Authorization authorization, Locale locale) {
+ // synchronized in order to avoid multiple registrations
+ // TODO move it to a service in order to avoid static synchronization
if (request != null) {
HttpSession httpSession = request.getSession(false);
+ assert httpSession != null;
String httpSessId = httpSession.getId();
String remoteUser = authorization.getName() != null ? authorization.getName()
: NodeConstants.ROLE_ANONYMOUS;
if (cmsSession != null) {
if (authorization.getName() != null) {
if (cmsSession.getAuthorization().getName() == null) {
- // FIXME make it more generic
cmsSession.close();
cmsSession = null;
} else if (!authorization.getName().equals(cmsSession.getAuthorization().getName())) {
}
} else {// anonymous
if (cmsSession.getAuthorization().getName() != null) {
- // FIXME make it more generic
cmsSession.close();
+ // TODO rather throw an exception ? log a warning ?
cmsSession = null;
}
}