Massive package refactoring

[lgpl/argeo-commons.git] / org.argeo.cms.ee / src / org / argeo / cms / servlet / CmsServletContext.java

diff --git a/org.argeo.cms.ee/src/org/argeo/cms/servlet/CmsServletContext.java b/org.argeo.cms.ee/src/org/argeo/cms/servlet/CmsServletContext.java
index 9cb48b212d38b5db6054c6fefac76dc00a9a00e3..d3c0eb5402d45b5e25bb4b0bfe62d4b782f27d5b 100644 (file)
--- a/org.argeo.cms.ee/src/org/argeo/cms/servlet/CmsServletContext.java
+++ b/org.argeo.cms.ee/src/org/argeo/cms/servlet/CmsServletContext.java
@@ -2,10 +2,8 @@ package org.argeo.cms.servlet;
 
 import java.io.IOException;
 import java.net.URL;
-import java.security.PrivilegedAction;
 import java.util.Map;
 
-import javax.security.auth.Subject;
 import javax.security.auth.login.LoginContext;
 import javax.security.auth.login.LoginException;
 import javax.servlet.http.HttpServletRequest;
@@ -14,6 +12,8 @@ import javax.servlet.http.HttpServletResponse;
 import org.argeo.api.cms.CmsAuth;
 import org.argeo.api.cms.CmsLog;
 import org.argeo.cms.auth.RemoteAuthCallbackHandler;
+import org.argeo.cms.auth.RemoteAuthRequest;
+import org.argeo.cms.auth.RemoteAuthResponse;
 import org.argeo.cms.auth.RemoteAuthUtils;
 import org.argeo.cms.servlet.internal.HttpUtils;
 import org.osgi.framework.Bundle;
@@ -29,6 +29,9 @@ public class CmsServletContext extends ServletContextHelper {
        // use CMS bundle for resources
        private Bundle bundle = FrameworkUtil.getBundle(getClass());
 
+       private final String httpAuthRealm = "Argeo";
+       private final boolean forceBasic = false;
+
        public void init(Map<String, String> properties) {
 
        }
@@ -41,61 +44,72 @@ public class CmsServletContext extends ServletContextHelper {
        public boolean handleSecurity(HttpServletRequest request, HttpServletResponse response) throws IOException {
                if (log.isTraceEnabled())
                        HttpUtils.logRequestHeaders(log, request);
+               RemoteAuthRequest remoteAuthRequest = new ServletHttpRequest(request);
+               RemoteAuthResponse remoteAuthResponse = new ServletHttpResponse(response);
                ClassLoader currentThreadContextClassLoader = Thread.currentThread().getContextClassLoader();
                Thread.currentThread().setContextClassLoader(CmsServletContext.class.getClassLoader());
                LoginContext lc;
                try {
-                       lc = CmsAuth.USER.newLoginContext(
-                                       new RemoteAuthCallbackHandler(new ServletHttpRequest(request), new ServletHttpResponse(response)));
+                       lc = CmsAuth.USER.newLoginContext(new RemoteAuthCallbackHandler(remoteAuthRequest, remoteAuthResponse));
                        lc.login();
                } catch (LoginException e) {
-                       lc = processUnauthorized(request, response);
-                       if (log.isTraceEnabled())
-                               HttpUtils.logResponseHeaders(log, response);
+                       if (authIsRequired(remoteAuthRequest, remoteAuthResponse)) {
+                               int statusCode = RemoteAuthUtils.askForWwwAuth(remoteAuthRequest,
+                                               remoteAuthResponse, httpAuthRealm,
+                                               forceBasic);
+                               response.setStatus(statusCode);
+                               return false;
+
+                       } else {
+                               lc = RemoteAuthUtils.anonymousLogin(remoteAuthRequest, remoteAuthResponse);
+                       }
                        if (lc == null)
                                return false;
                } finally {
                        Thread.currentThread().setContextClassLoader(currentThreadContextClassLoader);
                }
 
-               Subject subject = lc.getSubject();
-               // log.debug("SERVLET CONTEXT: "+subject);
-               Subject.doAs(subject, new PrivilegedAction<Void>() {
-
-                       @Override
-                       public Void run() {
-                               // TODO also set login context in order to log out ?
-                               RemoteAuthUtils.configureRequestSecurity(new ServletHttpRequest(request));
-                               return null;
-                       }
-
-               });
+//             Subject subject = lc.getSubject();
+//             Subject.doAs(subject, new PrivilegedAction<Void>() {
+//
+//                     @Override
+//                     public Void run() {
+//                             // TODO also set login context in order to log out ?
+//                             RemoteAuthUtils.configureRequestSecurity(remoteAuthRequest);
+//                             return null;
+//                     }
+//
+//             });
                return true;
        }
 
-       @Override
-       public void finishSecurity(HttpServletRequest request, HttpServletResponse response) {
-               RemoteAuthUtils.clearRequestSecurity(new ServletHttpRequest(request));
-       }
+//     @Override
+//     public void finishSecurity(HttpServletRequest request, HttpServletResponse response) {
+//             RemoteAuthUtils.clearRequestSecurity(new ServletHttpRequest(request));
+//     }
 
-       protected LoginContext processUnauthorized(HttpServletRequest request, HttpServletResponse response) {
-               // anonymous
-               ClassLoader currentContextClassLoader = Thread.currentThread().getContextClassLoader();
-               try {
-                       Thread.currentThread().setContextClassLoader(CmsServletContext.class.getClassLoader());
-                       LoginContext lc = CmsAuth.ANONYMOUS.newLoginContext(
-                                       new RemoteAuthCallbackHandler(new ServletHttpRequest(request), new ServletHttpResponse(response)));
-                       lc.login();
-                       return lc;
-               } catch (LoginException e1) {
-                       if (log.isDebugEnabled())
-                               log.error("Cannot log in as anonymous", e1);
-                       return null;
-               } finally {
-                       Thread.currentThread().setContextClassLoader(currentContextClassLoader);
-               }
+       protected boolean authIsRequired(RemoteAuthRequest remoteAuthRequest, RemoteAuthResponse remoteAuthResponse) {
+               return false;
        }
 
+//     protected LoginContext processUnauthorized(HttpServletRequest request, HttpServletResponse response) {
+//             // anonymous
+//             ClassLoader currentContextClassLoader = Thread.currentThread().getContextClassLoader();
+//             try {
+//                     Thread.currentThread().setContextClassLoader(CmsServletContext.class.getClassLoader());
+//                     LoginContext lc = CmsAuth.ANONYMOUS.newLoginContext(
+//                                     new RemoteAuthCallbackHandler(new ServletHttpRequest(request), new ServletHttpResponse(response)));
+//                     lc.login();
+//                     return lc;
+//             } catch (LoginException e1) {
+//                     if (log.isDebugEnabled())
+//                             log.error("Cannot log in as anonymous", e1);
+//                     return null;
+//             } finally {
+//                     Thread.currentThread().setContextClassLoader(currentContextClassLoader);
+//             }
+//     }
+
        @Override
        public URL getResource(String name) {
                // TODO make it more robust and versatile