Fix IPA initialisation

[lgpl/argeo-commons.git] / org.argeo.cms / src / org / argeo / cms / internal / runtime / CmsUserAdmin.java

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/runtime/CmsUserAdmin.java b/org.argeo.cms/src/org/argeo/cms/internal/runtime/CmsUserAdmin.java
index ecb7b8c1c3355afe214ca32b933651b6f863bf42..2e294722046e9aed1b9e8315cad7a36495c934dd 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/internal/runtime/CmsUserAdmin.java
+++ b/org.argeo.cms/src/org/argeo/cms/internal/runtime/CmsUserAdmin.java
@@ -29,14 +29,14 @@ import org.argeo.api.cms.CmsAuth;
 import org.argeo.api.cms.CmsConstants;
 import org.argeo.api.cms.CmsLog;
 import org.argeo.api.cms.CmsState;
+import org.argeo.api.cms.directory.UserDirectory;
+import org.argeo.api.cms.transaction.WorkControl;
+import org.argeo.api.cms.transaction.WorkTransaction;
 import org.argeo.cms.CmsDeployProperty;
-import org.argeo.osgi.useradmin.AggregatingUserAdmin;
-import org.argeo.osgi.useradmin.DirectoryUserAdmin;
-import org.argeo.osgi.useradmin.UserDirectory;
-import org.argeo.util.directory.DirectoryConf;
-import org.argeo.util.naming.dns.DnsBrowser;
-import org.argeo.util.transaction.WorkControl;
-import org.argeo.util.transaction.WorkTransaction;
+import org.argeo.cms.dns.DnsBrowser;
+import org.argeo.cms.osgi.useradmin.AggregatingUserAdmin;
+import org.argeo.cms.osgi.useradmin.DirectoryUserAdmin;
+import org.argeo.cms.runtime.DirectoryConf;
 import org.ietf.jgss.GSSCredential;
 import org.ietf.jgss.GSSException;
 import org.ietf.jgss.GSSManager;
@@ -54,7 +54,7 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
        private final static CmsLog log = CmsLog.getLog(CmsUserAdmin.class);
 
        // GSS API
-       private Path nodeKeyTab = KernelUtils.getOsgiInstancePath(KernelConstants.NODE_KEY_TAB_PATH);
+       private Path nodeKeyTab = null;
        private GSSCredential acceptorCredentials;
 
        private boolean singleUser = false;
@@ -65,7 +65,7 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
        private CmsState cmsState;
 
        public CmsUserAdmin() {
-               super(CmsConstants.ROLES_BASEDN, CmsConstants.TOKENS_BASEDN);
+               super(CmsConstants.SYSTEM_ROLES_BASEDN, CmsConstants.TOKENS_BASEDN);
        }
 
        public void start() {
@@ -93,7 +93,7 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
 
                // node roles
                String nodeRolesUri = null;// getFrameworkProp(CmsConstants.ROLES_URI);
-               String baseNodeRoleDn = CmsConstants.ROLES_BASEDN;
+               String baseNodeRoleDn = CmsConstants.SYSTEM_ROLES_BASEDN;
                if (nodeRolesUri == null && nodeBase != null) {
                        nodeRolesUri = baseNodeRoleDn + ".ldif";
                        Path nodeRolesFile = nodeBase.resolve(nodeRolesUri);
@@ -219,14 +219,14 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
 //             } else {
 //                     throw new IllegalArgumentException("Unsupported scheme " + u.getScheme());
 //             }
-               String basePath = userDirectory.getContext();
+               String basePath = userDirectory.getBase();
 
                addUserDirectory(userDirectory);
                if (isSystemRolesBaseDn(basePath)) {
                        addStandardSystemRoles();
                }
                if (log.isDebugEnabled()) {
-                       log.debug("User directory " + userDirectory.getContext() + (u != null ? " [" + u.getScheme() + "]" : "")
+                       log.debug("User directory " + userDirectory.getBase() + (u != null ? " [" + u.getScheme() + "]" : "")
                                        + " enabled." + (realm != null ? " " + realm + " realm." : ""));
                }
                return userDirectory;
@@ -271,7 +271,7 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
                Optional<String> realm = userDirectory.getRealm();
                if (realm.isPresent()) {
                        loadIpaJaasConfiguration();
-                       if (Files.exists(nodeKeyTab)) {
+                       if (nodeKeyTab != null && Files.exists(nodeKeyTab)) {
                                String servicePrincipal = getKerberosServicePrincipal(realm.get());
                                if (servicePrincipal != null) {
                                        CallbackHandler callbackHandler = new CallbackHandler() {
@@ -313,6 +313,17 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
 
        private void loadIpaJaasConfiguration() {
                if (CmsStateImpl.getDeployProperty(cmsState, CmsDeployProperty.JAVA_LOGIN_CONFIG) == null) {
+                       if (System.getProperty(KernelConstants.PROP_ARGEO_NODE_KRB5_KEYTAB) == null) {
+                               System.setProperty(KernelConstants.PROP_ARGEO_NODE_KRB5_KEYTAB,
+                                               KernelUtils.getOsgiInstancePath(KernelConstants.NODE_KEY_TAB_PATH).toString());
+                       }
+                       Path kt = Paths.get(System.getProperty(KernelConstants.PROP_ARGEO_NODE_KRB5_KEYTAB));
+                       if (nodeKeyTab != null) {
+                               if (!nodeKeyTab.equals(kt))
+                                       throw new IllegalStateException("A node keytab is already set");
+                       } else {
+                               nodeKeyTab = kt;
+                       }
                        String jaasConfig = KernelConstants.JAAS_CONFIG_IPA;
                        URL url = getClass().getClassLoader().getResource(jaasConfig);
                        KernelUtils.setJaasConfiguration(url);
@@ -321,7 +332,7 @@ public class CmsUserAdmin extends AggregatingUserAdmin {
        }
 
        protected String getKerberosServicePrincipal(String realm) {
-               if (!Files.exists(nodeKeyTab))
+               if (nodeKeyTab == null || !Files.exists(nodeKeyTab))
                        return null;
                List<String> dns = CmsStateImpl.getDeployProperties(cmsState, CmsDeployProperty.DNS);
                String hostname = CmsStateImpl.getDeployProperty(cmsState, CmsDeployProperty.HOST);