import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
-import javax.transaction.TransactionManager;
import org.apache.commons.httpclient.auth.AuthPolicy;
import org.apache.commons.httpclient.auth.CredentialsProvider;
import org.apache.commons.httpclient.params.DefaultHttpParams;
import org.apache.commons.httpclient.params.HttpMethodParams;
import org.apache.commons.httpclient.params.HttpParams;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.argeo.api.NodeConstants;
-import org.argeo.cms.CmsException;
+import org.argeo.api.cms.CmsAuth;
+import org.argeo.api.cms.CmsConstants;
+import org.argeo.api.cms.CmsLog;
+import org.argeo.cms.CmsUserManager;
+import org.argeo.cms.internal.auth.CmsUserManagerImpl;
import org.argeo.cms.internal.http.client.HttpCredentialProvider;
import org.argeo.cms.internal.http.client.SpnegoAuthScheme;
-import org.argeo.naming.DnsBrowser;
+import org.argeo.osgi.transaction.WorkControl;
+import org.argeo.osgi.transaction.WorkTransaction;
import org.argeo.osgi.useradmin.AbstractUserDirectory;
import org.argeo.osgi.useradmin.AggregatingUserAdmin;
import org.argeo.osgi.useradmin.LdapUserAdmin;
import org.argeo.osgi.useradmin.OsUserDirectory;
import org.argeo.osgi.useradmin.UserAdminConf;
import org.argeo.osgi.useradmin.UserDirectory;
+import org.argeo.util.naming.DnsBrowser;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.Oid;
import org.osgi.framework.BundleContext;
import org.osgi.framework.Constants;
-import org.osgi.framework.FrameworkUtil;
-import org.osgi.framework.ServiceRegistration;
+import org.osgi.framework.ServiceReference;
import org.osgi.service.cm.ConfigurationException;
import org.osgi.service.cm.ManagedServiceFactory;
import org.osgi.service.useradmin.Authorization;
* roles.
*/
class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactory, KernelConstants {
- private final static Log log = LogFactory.getLog(NodeUserAdmin.class);
- private final BundleContext bc = FrameworkUtil.getBundle(getClass()).getBundleContext();
+ private final static CmsLog log = CmsLog.getLog(NodeUserAdmin.class);
+// private final BundleContext bc = FrameworkUtil.getBundle(getClass()).getBundleContext();
// OSGi
private Map<String, LdapName> pidToBaseDn = new HashMap<>();
- private Map<String, ServiceRegistration<UserDirectory>> pidToServiceRegs = new HashMap<>();
+// private Map<String, ServiceRegistration<UserDirectory>> pidToServiceRegs = new HashMap<>();
// private ServiceRegistration<UserAdmin> userAdminReg;
// JTA
- private final ServiceTracker<TransactionManager, TransactionManager> tmTracker;
+ private final ServiceTracker<WorkControl, WorkControl> tmTracker;
// private final String cacheName = UserDirectory.class.getName();
// GSS API
private boolean singleUser = false;
// private boolean systemRolesAvailable = false;
+ CmsUserManagerImpl userManager;
+
public NodeUserAdmin(String systemRolesBaseDn, String tokensBaseDn) {
super(systemRolesBaseDn, tokensBaseDn);
- tmTracker = new ServiceTracker<>(bc, TransactionManager.class, null);
- tmTracker.open();
+ BundleContext bc = Activator.getBundleContext();
+ if (bc != null) {
+ tmTracker = new ServiceTracker<>(bc, WorkControl.class, null) {
+
+ @Override
+ public WorkControl addingService(ServiceReference<WorkControl> reference) {
+ WorkControl workControl = super.addingService(reference);
+ userManager = new CmsUserManagerImpl();
+ userManager.setUserAdmin(NodeUserAdmin.this);
+ // FIXME make it more robust
+ userManager.setUserTransaction((WorkTransaction) workControl);
+ bc.registerService(CmsUserManager.class, userManager, null);
+ return workControl;
+ }
+ };
+ tmTracker.open();
+ } else {
+ tmTracker = null;
+ }
}
@Override
public void updated(String pid, Dictionary<String, ?> properties) throws ConfigurationException {
String uri = (String) properties.get(UserAdminConf.uri.name());
+ Object realm = properties.get(UserAdminConf.realm.name());
URI u;
try {
if (uri == null) {
String baseDn = (String) properties.get(UserAdminConf.baseDn.name());
u = KernelUtils.getOsgiInstanceUri(KernelConstants.DIR_NODE + '/' + baseDn + ".ldif");
- } else
+ } else if (realm != null) {
+ u = null;
+ } else {
u = new URI(uri);
+ }
} catch (URISyntaxException e) {
- throw new CmsException("Badly formatted URI " + uri, e);
+ throw new IllegalArgumentException("Badly formatted URI " + uri, e);
}
// Create
AbstractUserDirectory userDirectory;
- if (UserAdminConf.SCHEME_LDAP.equals(u.getScheme())) {
+ if (realm != null || UserAdminConf.SCHEME_LDAP.equals(u.getScheme())
+ || UserAdminConf.SCHEME_LDAPS.equals(u.getScheme())) {
userDirectory = new LdapUserAdmin(properties);
} else if (UserAdminConf.SCHEME_FILE.equals(u.getScheme())) {
userDirectory = new LdifUserAdmin(u, properties);
userDirectory = new OsUserDirectory(u, properties);
singleUser = true;
} else {
- throw new CmsException("Unsupported scheme " + u.getScheme());
+ throw new IllegalArgumentException("Unsupported scheme " + u.getScheme());
}
- Object realm = userDirectory.getProperties().get(UserAdminConf.realm.name());
addUserDirectory(userDirectory);
// OSGi
LdapName baseDn = userDirectory.getBaseDn();
- Dictionary<String, Object> regProps = new Hashtable<>();
+ Hashtable<String, Object> regProps = new Hashtable<>();
regProps.put(Constants.SERVICE_PID, pid);
if (isSystemRolesBaseDn(baseDn))
regProps.put(Constants.SERVICE_RANKING, Integer.MAX_VALUE);
regProps.put(UserAdminConf.baseDn.name(), baseDn);
- ServiceRegistration<UserDirectory> reg = bc.registerService(UserDirectory.class, userDirectory, regProps);
+ // ServiceRegistration<UserDirectory> reg =
+ // bc.registerService(UserDirectory.class, userDirectory, regProps);
+ Activator.registerService(UserDirectory.class, userDirectory, regProps);
+ userManager.addUserDirectory(userDirectory, regProps);
pidToBaseDn.put(pid, baseDn);
- pidToServiceRegs.put(pid, reg);
+ // pidToServiceRegs.put(pid, reg);
- if (log.isDebugEnabled())
- log.debug("User directory " + userDirectory.getBaseDn() + " [" + u.getScheme() + "] enabled."
- + (realm != null ? " " + realm + " realm." : ""));
+ if (log.isDebugEnabled()) {
+ log.debug("User directory " + userDirectory.getBaseDn() + (u != null ? " [" + u.getScheme() + "]" : "")
+ + " enabled." + (realm != null ? " " + realm + " realm." : ""));
+ }
if (isSystemRolesBaseDn(baseDn)) {
// publishes only when system roles are available
Dictionary<String, Object> userAdminregProps = new Hashtable<>();
- userAdminregProps.put(NodeConstants.CN, NodeConstants.DEFAULT);
+ userAdminregProps.put(CmsConstants.CN, CmsConstants.DEFAULT);
userAdminregProps.put(Constants.SERVICE_RANKING, Integer.MAX_VALUE);
- bc.registerService(UserAdmin.class, this, userAdminregProps);
+ Activator.registerService(UserAdmin.class, this, userAdminregProps);
}
// if (isSystemRolesBaseDn(baseDn))
@Override
public void deleted(String pid) {
- assert pidToServiceRegs.get(pid) != null;
+ // assert pidToServiceRegs.get(pid) != null;
assert pidToBaseDn.get(pid) != null;
- pidToServiceRegs.remove(pid).unregister();
+ // pidToServiceRegs.remove(pid).unregister();
LdapName baseDn = pidToBaseDn.remove(pid);
removeUserDirectory(baseDn);
}
@Override
protected void addAbstractSystemRoles(Authorization rawAuthorization, Set<String> sysRoles) {
if (rawAuthorization.getName() == null) {
- sysRoles.add(NodeConstants.ROLE_ANONYMOUS);
+ sysRoles.add(CmsConstants.ROLE_ANONYMOUS);
} else {
- sysRoles.add(NodeConstants.ROLE_USER);
+ sysRoles.add(CmsConstants.ROLE_USER);
}
}
protected void postAdd(AbstractUserDirectory userDirectory) {
// JTA
- TransactionManager tm = tmTracker.getService();
+ WorkControl tm = tmTracker != null ? tmTracker.getService() : null;
if (tm == null)
- throw new CmsException("A JTA transaction manager must be available.");
- userDirectory.setTransactionManager(tm);
+ throw new IllegalStateException("A JTA transaction manager must be available.");
+ userDirectory.setTransactionControl(tm);
// if (tmTracker.getService() instanceof BitronixTransactionManager)
// EhCacheXAResourceProducer.registerXAResource(cacheName, userDirectory.getXaResource());
}
};
try {
- LoginContext nodeLc = new LoginContext(NodeConstants.LOGIN_CONTEXT_NODE, callbackHandler);
+ LoginContext nodeLc = new LoginContext(CmsAuth.LOGIN_CONTEXT_NODE, callbackHandler);
nodeLc.login();
acceptorCredentials = logInAsAcceptor(nodeLc.getSubject(), servicePrincipal);
} catch (LoginException e) {
- throw new CmsException("Cannot log in kernel", e);
+ throw new IllegalStateException("Cannot log in kernel", e);
}
}
}
log.debug("GSS acceptor configured for " + krb5Principal);
return serverCredentials;
} catch (Exception gsse) {
- throw new CmsException("Cannot create acceptor credentials for " + krb5Principal, gsse);
+ throw new IllegalStateException("Cannot create acceptor credentials for " + krb5Principal, gsse);
}
}
projects / lgpl / argeo-commons.git / blobdiff