X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;ds=sidebyside;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FHttpSessionLoginModule.java;h=be8a693baa2c9a6da376fc11c929e2defa1b2995;hb=baccdf322cf7c6dda7b61f68d3a873be86c3089d;hp=eac68036d51c2862bec9db79bfbb08c05cc94c7a;hpb=76a7e65ffa515c0dbd7a5587b29ffc9bba449542;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java
index eac68036d..be8a693ba 100644
--- a/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java
@@ -1,8 +1,10 @@
 package org.argeo.cms.auth;
 
 import java.io.IOException;
+import java.security.cert.X509Certificate;
 import java.util.Collection;
 import java.util.Map;
+import java.util.StringTokenizer;
 
 import javax.security.auth.Subject;
 import javax.security.auth.callback.Callback;
@@ -11,11 +13,12 @@ import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.security.auth.login.LoginException;
 import javax.security.auth.spi.LoginModule;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 
+import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.argeo.cms.CmsException;
-import org.argeo.cms.internal.kernel.WebCmsSessionImpl;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.FrameworkUtil;
 import org.osgi.framework.InvalidSyntaxException;
@@ -31,6 +34,7 @@ public class HttpSessionLoginModule implements LoginModule {
 	private Map<String, Object> sharedState = null;
 
 	private HttpServletRequest request = null;
+	private HttpServletResponse response = null;
 
 	private BundleContext bc;
 
@@ -68,15 +72,15 @@ public class HttpSessionLoginModule implements LoginModule {
 			// authorization = (Authorization)
 			// request.getSession().getAttribute(HttpContext.AUTHORIZATION);
 			// if (authorization == null) {
-			Collection<ServiceReference<WebCmsSession>> sr;
+			Collection<ServiceReference<CmsSession>> sr;
 			try {
-				sr = bc.getServiceReferences(WebCmsSession.class,
-						"(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")");
+				sr = bc.getServiceReferences(CmsSession.class,
+						"(" + CmsSession.SESSION_LOCAL_ID + "=" + httpSessionId + ")");
 			} catch (InvalidSyntaxException e) {
 				throw new CmsException("Cannot get CMS session for id " + httpSessionId, e);
 			}
 			if (sr.size() == 1) {
-				WebCmsSession cmsSession = bc.getService(sr.iterator().next());
+				CmsSession cmsSession = bc.getService(sr.iterator().next());
 				authorization = cmsSession.getAuthorization();
 				if (log.isTraceEnabled())
 					log.trace("Retrieved authorization from " + cmsSession);
@@ -87,47 +91,14 @@ public class HttpSessionLoginModule implements LoginModule {
 
 		}
 		sharedState.put(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST, request);
+		extractHttpAuth(request);
+		extractClientCertificate(request);
 		if (authorization == null)
 			return false;
 		sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION, authorization);
 		return true;
 	}
 
-	// private Authorization checkHttp() {
-	// Authorization authorization = null;
-	// if (request != null) {
-	// authorization = (Authorization)
-	// request.getAttribute(HttpContext.AUTHORIZATION);
-	// if (authorization == null) {
-	// String httpSessionId = request.getSession().getId();
-	// authorization = (Authorization)
-	// request.getSession().getAttribute(HttpContext.AUTHORIZATION);
-	// if (authorization == null) {
-	// Collection<ServiceReference<WebCmsSession>> sr;
-	// try {
-	// sr = bc.getServiceReferences(WebCmsSession.class,
-	// "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")");
-	// } catch (InvalidSyntaxException e) {
-	// throw new CmsException("Cannot get CMS session for id " + httpSessionId,
-	// e);
-	// }
-	// if (sr.size() == 1) {
-	// WebCmsSession cmsSession = bc.getService(sr.iterator().next());
-	// authorization = cmsSession.getAuthorization();
-	// if (log.isTraceEnabled())
-	// log.trace("Retrieved authorization from " + cmsSession);
-	// } else if (sr.size() == 0)
-	// return null;
-	// else
-	// throw new CmsException(
-	// sr.size() + ">1 web sessions detected for http session " +
-	// httpSessionId);
-	// }
-	// }
-	// }
-	// return authorization;
-	// }
-
 	@Override
 	public boolean commit() throws LoginException {
 		// TODO create CmsSession in another module
@@ -145,6 +116,12 @@ public class HttpSessionLoginModule implements LoginModule {
 			return false;
 		CmsAuthUtils.registerSessionAuthorization(bc, request, subject, authorizationToRegister);
 
+		byte[] outToken = (byte[]) sharedState.get(CmsAuthUtils.SHARED_STATE_SPNEGO_OUT_TOKEN);
+		if (outToken != null) {
+			response.setHeader(CmsAuthUtils.HEADER_WWW_AUTHENTICATE,
+					"Negotiate " + java.util.Base64.getEncoder().encodeToString(outToken));
+		}
+
 		if (authorization != null) {
 			// CmsAuthUtils.addAuthentication(subject, authorization);
 			cleanUp();
@@ -171,4 +148,44 @@ public class HttpSessionLoginModule implements LoginModule {
 		return CmsAuthUtils.logoutSession(bc, subject);
 	}
 
+	private void extractHttpAuth(final HttpServletRequest httpRequest) {
+		String authHeader = httpRequest.getHeader(CmsAuthUtils.HEADER_AUTHORIZATION);
+		if (authHeader != null) {
+			StringTokenizer st = new StringTokenizer(authHeader);
+			if (st.hasMoreTokens()) {
+				String basic = st.nextToken();
+				if (basic.equalsIgnoreCase("Basic")) {
+					try {
+						// TODO manipulate char[]
+						String credentials = new String(Base64.decodeBase64(st.nextToken()), "UTF-8");
+						// log.debug("Credentials: " + credentials);
+						int p = credentials.indexOf(":");
+						if (p != -1) {
+							final String login = credentials.substring(0, p).trim();
+							final char[] password = credentials.substring(p + 1).trim().toCharArray();
+							sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, login);
+							sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, password);
+						} else {
+							throw new CmsException("Invalid authentication token");
+						}
+					} catch (Exception e) {
+						throw new CmsException("Couldn't retrieve authentication", e);
+					}
+				} else if (basic.equalsIgnoreCase("Negotiate")) {
+					String spnegoToken = st.nextToken();
+					byte[] authToken = Base64.decodeBase64(spnegoToken);
+					sharedState.put(CmsAuthUtils.SHARED_STATE_SPNEGO_TOKEN, authToken);
+				}
+			}
+		}
+	}
+
+	private X509Certificate[] extractClientCertificate(HttpServletRequest req) {
+		X509Certificate[] certs = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
+		if (null != certs && certs.length > 0) {
+			return certs;
+		}
+		return null;
+	}
+
 }