X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=eclipse%2Forg.argeo.cms.servlet%2Fsrc%2Forg%2Fargeo%2Fcms%2Fintegration%2FCmsPrivateServletContext.java;fp=eclipse%2Forg.argeo.cms.servlet%2Fsrc%2Forg%2Fargeo%2Fcms%2Fintegration%2FCmsPrivateServletContext.java;h=cec04d230714edda51cefe4fcc0f575fdfd14138;hb=d0c5e5d0aa3a75e256333d47a3c711f1c1c73b14;hp=0000000000000000000000000000000000000000;hpb=85015a7cbfe5343c88477d828fa2f8fb754a65cd;p=lgpl%2Fargeo-commons.git

diff --git a/eclipse/org.argeo.cms.servlet/src/org/argeo/cms/integration/CmsPrivateServletContext.java b/eclipse/org.argeo.cms.servlet/src/org/argeo/cms/integration/CmsPrivateServletContext.java
new file mode 100644
index 000000000..cec04d230
--- /dev/null
+++ b/eclipse/org.argeo.cms.servlet/src/org/argeo/cms/integration/CmsPrivateServletContext.java
@@ -0,0 +1,82 @@
+package org.argeo.cms.integration;
+
+import java.io.IOException;
+import java.security.AccessControlContext;
+import java.security.PrivilegedAction;
+import java.util.Map;
+
+import javax.security.auth.Subject;
+import javax.security.auth.login.LoginContext;
+import javax.security.auth.login.LoginException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.argeo.api.cms.CmsAuth;
+import org.argeo.cms.auth.RemoteAuthCallbackHandler;
+import org.argeo.cms.auth.RemoteAuthUtils;
+import org.argeo.cms.servlet.ServletHttpRequest;
+import org.argeo.cms.servlet.ServletHttpResponse;
+import org.osgi.service.http.context.ServletContextHelper;
+
+/** Manages security access to servlets. */
+public class CmsPrivateServletContext extends ServletContextHelper {
+	public final static String LOGIN_PAGE = "argeo.cms.integration.loginPage";
+	public final static String LOGIN_SERVLET = "argeo.cms.integration.loginServlet";
+	private String loginPage;
+	private String loginServlet;
+
+	public void init(Map<String, String> properties) {
+		loginPage = properties.get(LOGIN_PAGE);
+		loginServlet = properties.get(LOGIN_SERVLET);
+	}
+
+	/**
+	 * Add the {@link AccessControlContext} as a request attribute, or redirect to
+	 * the login page.
+	 */
+	@Override
+	public boolean handleSecurity(final HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		LoginContext lc = null;
+		ServletHttpRequest request = new ServletHttpRequest(req);
+		ServletHttpResponse response = new ServletHttpResponse(resp);
+
+		String pathInfo = req.getPathInfo();
+		String servletPath = req.getServletPath();
+		if ((pathInfo != null && (servletPath + pathInfo).equals(loginPage)) || servletPath.contentEquals(loginServlet))
+			return true;
+		try {
+			lc = new LoginContext(CmsAuth.LOGIN_CONTEXT_USER, new RemoteAuthCallbackHandler(request, response));
+			lc.login();
+		} catch (LoginException e) {
+			lc = processUnauthorized(req, resp);
+			if (lc == null)
+				return false;
+		}
+		Subject.doAs(lc.getSubject(), new PrivilegedAction<Void>() {
+
+			@Override
+			public Void run() {
+				// TODO also set login context in order to log out ?
+				RemoteAuthUtils.configureRequestSecurity(request);
+				return null;
+			}
+
+		});
+
+		return true;
+	}
+
+	@Override
+	public void finishSecurity(HttpServletRequest req, HttpServletResponse resp) {
+		RemoteAuthUtils.clearRequestSecurity(new ServletHttpRequest(req));
+	}
+
+	protected LoginContext processUnauthorized(HttpServletRequest request, HttpServletResponse response) {
+		try {
+			response.sendRedirect(loginPage);
+		} catch (IOException e) {
+			throw new RuntimeException("Cannot redirect to login page", e);
+		}
+		return null;
+	}
+}