Support multiple authenticate headers

[lgpl/argeo-commons.git] / org.argeo.cms / src / org / argeo / cms / auth / RemoteAuthUtils.java

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java b/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java
index 757bf73bfc43513fab8c004aaa3eb363a005f22a..3c436ba1fc40edd772e161d65ea1c70bc5f39cea 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/RemoteAuthUtils.java
@@ -1,7 +1,5 @@
 package org.argeo.cms.auth;
 
-import java.security.AccessControlContext;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Base64;
 import java.util.function.Supplier;
@@ -14,8 +12,10 @@ import javax.security.auth.login.LoginException;
 import org.argeo.api.cms.CmsAuth;
 import org.argeo.api.cms.CmsLog;
 import org.argeo.api.cms.CmsSession;
+import org.argeo.cms.http.HttpHeader;
+import org.argeo.cms.http.HttpStatus;
 import org.argeo.cms.internal.runtime.CmsContextImpl;
-import org.argeo.util.http.HttpHeader;
+import org.argeo.cms.util.CurrentSubject;
 import org.ietf.jgss.GSSContext;
 import org.ietf.jgss.GSSException;
 import org.ietf.jgss.GSSManager;
@@ -44,47 +44,49 @@ public class RemoteAuthUtils {
         * Useful to log in to JCR.
         */
        public final static <T> T doAs(Supplier<T> supplier, RemoteAuthRequest req) {
-               ClassLoader currentContextCl = Thread.currentThread().getContextClassLoader();
-               Thread.currentThread().setContextClassLoader(RemoteAuthUtils.class.getClassLoader());
-               try {
-                       return Subject.doAs(
-                                       Subject.getSubject((AccessControlContext) req.getAttribute(AccessControlContext.class.getName())),
-                                       new PrivilegedAction<T>() {
-
-                                               @Override
-                                               public T run() {
-                                                       return supplier.get();
-                                               }
-
-                                       });
-               } finally {
-                       Thread.currentThread().setContextClassLoader(currentContextCl);
-               }
+               CmsSession cmsSession = getCmsSession(req);
+               return CurrentSubject.callAs(cmsSession.getSubject(), () -> supplier.get());
+//             ClassLoader currentContextCl = Thread.currentThread().getContextClassLoader();
+//             Thread.currentThread().setContextClassLoader(RemoteAuthUtils.class.getClassLoader());
+//             try {
+//                     return Subject.doAs(
+//                                     Subject.getSubject((AccessControlContext) req.getAttribute(AccessControlContext.class.getName())),
+//                                     new PrivilegedAction<T>() {
+//
+//                                             @Override
+//                                             public T run() {
+//                                                     return supplier.get();
+//                                             }
+//
+//                                     });
+//             } finally {
+//                     Thread.currentThread().setContextClassLoader(currentContextCl);
+//             }
        }
 
-       public final static void configureRequestSecurity(RemoteAuthRequest req) {
-               if (req.getAttribute(AccessControlContext.class.getName()) != null)
-                       throw new IllegalStateException("Request already authenticated.");
-               AccessControlContext acc = AccessController.getContext();
-               req.setAttribute(REMOTE_USER, CurrentUser.getUsername());
-               req.setAttribute(AccessControlContext.class.getName(), acc);
-       }
-
-       public final static void clearRequestSecurity(RemoteAuthRequest req) {
-               if (req.getAttribute(AccessControlContext.class.getName()) == null)
-                       throw new IllegalStateException("Cannot clear non-authenticated request.");
-               req.setAttribute(REMOTE_USER, null);
-               req.setAttribute(AccessControlContext.class.getName(), null);
-       }
+//     public final static void configureRequestSecurity(RemoteAuthRequest req) {
+//             if (req.getAttribute(AccessControlContext.class.getName()) != null)
+//                     throw new IllegalStateException("Request already authenticated.");
+//             AccessControlContext acc = AccessController.getContext();
+//             req.setAttribute(REMOTE_USER, CurrentUser.getUsername());
+//             req.setAttribute(AccessControlContext.class.getName(), acc);
+//     }
+//
+//     public final static void clearRequestSecurity(RemoteAuthRequest req) {
+//             if (req.getAttribute(AccessControlContext.class.getName()) == null)
+//                     throw new IllegalStateException("Cannot clear non-authenticated request.");
+//             req.setAttribute(REMOTE_USER, null);
+//             req.setAttribute(AccessControlContext.class.getName(), null);
+//     }
 
        public static CmsSession getCmsSession(RemoteAuthRequest req) {
-               Subject subject = Subject
-                               .getSubject((AccessControlContext) req.getAttribute(AccessControlContext.class.getName()));
-               CmsSession cmsSession = CmsContextImpl.getCmsContext().getCmsSession(subject);
+               CmsSession cmsSession = (CmsSession) req.getAttribute(CmsSession.class.getName());
+               if (cmsSession == null)
+                       throw new IllegalStateException("Request must have a CMS session attribute");
                return cmsSession;
        }
 
-       public static String getGssToken(Subject subject, String service, String server) {
+       public static String createGssToken(Subject subject, String service, String server) {
                if (subject.getPrivateCredentials(KerberosTicket.class).isEmpty())
                        throw new IllegalArgumentException("Subject " + subject + " is not GSS authenticated.");
                return Subject.doAs(subject, (PrivilegedAction<String>) () -> {
@@ -144,14 +146,30 @@ public class RemoteAuthUtils {
                }
        }
 
-       public static int askForWwwAuth(RemoteAuthResponse remoteAuthResponse, String realm, boolean forceBasic) {
+       public static int askForWwwAuth(RemoteAuthRequest remoteAuthRequest, RemoteAuthResponse remoteAuthResponse,
+                       String realm, boolean forceBasic) {
+               boolean negotiateFailed = false;
+               if (remoteAuthRequest.getHeader(HttpHeader.AUTHORIZATION.getHeaderName()) != null) {
+                       // we already tried, so we give up in order not too loop endlessly
+                       if (remoteAuthRequest.getHeader(HttpHeader.AUTHORIZATION.getHeaderName())
+                                       .startsWith(HttpHeader.NEGOTIATE)) {
+                               negotiateFailed = true;
+                       } else {
+                               return HttpStatus.FORBIDDEN.getCode();
+                       }
+               }
+
                // response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "basic
                // realm=\"" + httpAuthRealm + "\"");
-               if (hasAcceptorCredentials() && !forceBasic)// SPNEGO
-                       remoteAuthResponse.setHeader(HttpHeader.WWW_AUTHENTICATE.getName(), HttpHeader.NEGOTIATE);
-               else
-                       remoteAuthResponse.setHeader(HttpHeader.WWW_AUTHENTICATE.getName(),
+               if (hasAcceptorCredentials() && !forceBasic && !negotiateFailed) {// SPNEGO
+                       remoteAuthResponse.addHeader(HttpHeader.WWW_AUTHENTICATE.getHeaderName(), HttpHeader.NEGOTIATE);
+                       // TODO make it configurable ?
+                       remoteAuthResponse.addHeader(HttpHeader.WWW_AUTHENTICATE.getHeaderName(),
+                                       HttpHeader.BASIC + " " + HttpHeader.REALM + "=\"" + realm + "\"");
+               } else {
+                       remoteAuthResponse.setHeader(HttpHeader.WWW_AUTHENTICATE.getHeaderName(),
                                        HttpHeader.BASIC + " " + HttpHeader.REALM + "=\"" + realm + "\"");
+               }
 
                // response.setDateHeader("Date", System.currentTimeMillis());
                // response.setDateHeader("Expires", System.currentTimeMillis() + (24 *
@@ -161,7 +179,7 @@ public class RemoteAuthUtils {
                // response.setHeader("Keep-Alive", "timeout=5, max=97");
                // response.setContentType("text/html; charset=UTF-8");
 
-               return 401;
+               return HttpStatus.UNAUTHORIZED.getCode();
        }
 
        private static boolean hasAcceptorCredentials() {