Disable unused keyring

[lgpl/argeo-commons.git] / org.argeo.cms / src / org / argeo / cms / auth / UserAdminLoginModule.java

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
index f6832ad35af4cfc86bad5c3ab6c9ad5ec3880fd5..dd65755382ce727cc935374b87fdff52bace1841 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/UserAdminLoginModule.java
@@ -26,16 +26,13 @@ import javax.security.auth.spi.LoginModule;
 
 import org.argeo.api.cms.CmsConstants;
 import org.argeo.api.cms.CmsLog;
-import org.argeo.cms.internal.osgi.NodeUserAdmin;
 import org.argeo.cms.internal.runtime.CmsContextImpl;
-import org.argeo.cms.security.CryptoKeyring;
 import org.argeo.osgi.useradmin.AuthenticatingUser;
 import org.argeo.osgi.useradmin.TokenUtils;
 import org.argeo.util.directory.ldap.IpaUtils;
 import org.argeo.util.naming.LdapAttrs;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.FrameworkUtil;
-import org.osgi.framework.ServiceReference;
 import org.osgi.service.useradmin.Authorization;
 import org.osgi.service.useradmin.Group;
 import org.osgi.service.useradmin.User;
@@ -52,8 +49,8 @@ public class UserAdminLoginModule implements LoginModule {
        private CallbackHandler callbackHandler;
        private Map<String, Object> sharedState = null;
 
-       private List<String> indexedUserProperties = Arrays
-                       .asList(new String[] { LdapAttrs.mail.name(), LdapAttrs.uid.name(), LdapAttrs.authPassword.name() });
+       private List<String> indexedUserProperties = Arrays.asList(new String[] { LdapAttrs.mail.name(),
+                       LdapAttrs.uid.name(), LdapAttrs.employeeNumber.name(), LdapAttrs.authPassword.name() });
 
        // private state
        private BundleContext bc;
@@ -91,17 +88,13 @@ public class UserAdminLoginModule implements LoginModule {
                        username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
                        password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
                        // // TODO locale?
+               } else if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
+                               && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_SPNEGO_TOKEN)) {
+                       // SPNEGO login has succeeded, that's enough for us at this stage
+                       return true;
                } else if (sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)
                                && sharedState.containsKey(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN)) {
                        String certDn = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
-//                     LdapName ldapName;
-//                     try {
-//                             ldapName = new LdapName(certificateName);
-//                     } catch (InvalidNameException e) {
-//                             e.printStackTrace();
-//                             return false;
-//                     }
-//                     username = ldapName.getRdn(ldapName.size() - 1).getValue().toString();
                        username = certDn;
                        certificateChain = sharedState.get(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN);
                        password = null;
@@ -111,11 +104,6 @@ public class UserAdminLoginModule implements LoginModule {
                        username = (String) sharedState.get(CmsAuthUtils.SHARED_STATE_NAME);
                        password = null;
                        preauth = true;
-//             } else if (singleUser) {
-//                     username = OsUserUtils.getOsUsername();
-//                     password = null;
-//                     // TODO retrieve from http session
-//                     locale = Locale.getDefault();
                } else {
 
                        // ask for username and password
@@ -237,6 +225,8 @@ public class UserAdminLoginModule implements LoginModule {
                                        throw new LoginException("Kerberos login " + authenticatingUser.getName()
                                                        + " is inconsistent with user admin login " + authenticatedUser.getName());
                        }
+                       if (log.isTraceEnabled())
+                               log.trace("Retrieve authorization for " + authenticatingUser + "... ");
                        authorization = Subject.doAs(subject, new PrivilegedAction<Authorization>() {
 
                                @Override
@@ -256,28 +246,28 @@ public class UserAdminLoginModule implements LoginModule {
                CmsAuthUtils.addAuthorization(subject, authorization);
 
                // Unlock keyring (underlying login to the JCR repository)
-               char[] password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
-               if (password != null) {
-                       ServiceReference<CryptoKeyring> keyringSr = bc.getServiceReference(CryptoKeyring.class);
-                       if (keyringSr != null) {
-                               CryptoKeyring keyring = bc.getService(keyringSr);
-                               Subject.doAs(subject, new PrivilegedAction<Void>() {
-
-                                       @Override
-                                       public Void run() {
-                                               try {
-                                                       keyring.unlock(password);
-                                               } catch (Exception e) {
-                                                       e.printStackTrace();
-                                                       log.warn("Could not unlock keyring with the password provided by " + authorization.getName()
-                                                                       + ": " + e.getMessage());
-                                               }
-                                               return null;
-                                       }
-
-                               });
-                       }
-               }
+//             char[] password = (char[]) sharedState.get(CmsAuthUtils.SHARED_STATE_PWD);
+//             if (password != null) {
+//                     ServiceReference<CryptoKeyring> keyringSr = bc.getServiceReference(CryptoKeyring.class);
+//                     if (keyringSr != null) {
+//                             CryptoKeyring keyring = bc.getService(keyringSr);
+//                             Subject.doAs(subject, new PrivilegedAction<Void>() {
+//
+//                                     @Override
+//                                     public Void run() {
+//                                             try {
+//                                                     keyring.unlock(password);
+//                                             } catch (Exception e) {
+//                                                     e.printStackTrace();
+//                                                     log.warn("Could not unlock keyring with the password provided by " + authorization.getName()
+//                                                                     + ": " + e.getMessage());
+//                                             }
+//                                             return null;
+//                                     }
+//
+//                             });
+//                     }
+//             }
 
                // Register CmsSession with initial subject
                CmsAuthUtils.registerSessionAuthorization(request, subject, authorization, locale);