X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FCmsAuthUtils.java;h=37992072482e0cf36b1a08ed899de0afcf2f8601;hb=e75cf778a87f1b2ef7cfc57339ccbf9657282e92;hp=54824e140763b07787ab8b8fef83153ad98243f2;hpb=eb4324be6ac9cdff15828a21ee7d3f6ca2f19fb9;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java b/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java
index 54824e140..379920724 100644
--- a/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java
@@ -20,14 +20,14 @@ import javax.security.auth.x500.X500Principal;
 
 import org.argeo.api.cms.AnonymousPrincipal;
 import org.argeo.api.cms.CmsConstants;
+import org.argeo.api.cms.CmsSession;
 import org.argeo.api.cms.CmsSessionId;
 import org.argeo.api.cms.DataAdminPrincipal;
 import org.argeo.cms.internal.auth.CmsSessionImpl;
 import org.argeo.cms.internal.auth.ImpliedByPrincipal;
-import org.argeo.cms.internal.http.WebCmsSessionImpl;
+import org.argeo.cms.internal.auth.RemoteCmsSessionImpl;
 import org.argeo.cms.internal.runtime.CmsContextImpl;
-import org.argeo.osgi.useradmin.AuthenticatingUser;
-import org.osgi.service.http.HttpContext;
+import org.argeo.cms.osgi.useradmin.AuthenticatingUser;
 import org.osgi.service.useradmin.Authorization;
 
 /** Centralises security related registrations. */
@@ -35,8 +35,8 @@ class CmsAuthUtils {
 	// Standard
 	final static String SHARED_STATE_NAME = AuthenticatingUser.SHARED_STATE_NAME;
 	final static String SHARED_STATE_PWD = AuthenticatingUser.SHARED_STATE_PWD;
-	final static String HEADER_AUTHORIZATION = "Authorization";
-	final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
+//	final static String HEADER_AUTHORIZATION = "Authorization";
+//	final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
 
 	// Argeo specific
 	final static String SHARED_STATE_HTTP_REQUEST = "org.argeo.cms.auth.http.request";
@@ -45,6 +45,7 @@ class CmsAuthUtils {
 	final static String SHARED_STATE_CERTIFICATE_CHAIN = "org.argeo.cms.auth.certificateChain";
 	final static String SHARED_STATE_REMOTE_ADDR = "org.argeo.cms.auth.remote.addr";
 	final static String SHARED_STATE_REMOTE_PORT = "org.argeo.cms.auth.remote.port";
+	final static String SHARED_STATE_OS_USERNAME = "org.argeo.cms.os.username";
 
 	final static String SINGLE_USER_LOCAL_ID = "single-user";
 
@@ -136,23 +137,22 @@ class CmsAuthUtils {
 		// TODO move it to a service in order to avoid static synchronization
 		if (request != null) {
 			RemoteAuthSession httpSession = request.getSession();
-			assert httpSession != null;
-			String httpSessId = httpSession.getId();
+			String httpSessId = httpSession != null ? httpSession.getId() : null;
 			boolean anonymous = authorization.getName() == null;
 			String remoteUser = !anonymous ? authorization.getName() : CmsConstants.ROLE_ANONYMOUS;
-			request.setAttribute(HttpContext.REMOTE_USER, remoteUser);
-			request.setAttribute(HttpContext.AUTHORIZATION, authorization);
+			request.setAttribute(RemoteAuthRequest.REMOTE_USER, remoteUser);
+			request.setAttribute(RemoteAuthRequest.AUTHORIZATION, authorization);
 
 			CmsSessionImpl cmsSession;
 			CmsSessionImpl currentLocalSession = CmsContextImpl.getCmsContext().getCmsSessionByLocalId(httpSessId);
 			if (currentLocalSession != null) {
-				boolean currentLocalSessionAnonymous = currentLocalSession.getAuthorization().getName() == null;
+				boolean currentLocalSessionAnonymous = currentLocalSession.isAnonymous();
 				if (!anonymous) {
 					if (currentLocalSessionAnonymous) {
 						currentLocalSession.close();
 						// new CMS session
 						UUID cmsSessionUuid = CmsContextImpl.getCmsContext().getUuidFactory().timeUUID();
-						cmsSession = new WebCmsSessionImpl(cmsSessionUuid, subject, authorization, locale, request);
+						cmsSession = new RemoteCmsSessionImpl(cmsSessionUuid, subject, authorization, locale, request);
 						CmsContextImpl.getCmsContext().registerCmsSession(cmsSession);
 					} else if (!authorization.getName().equals(currentLocalSession.getAuthorization().getName())) {
 						throw new IllegalStateException("Inconsistent user " + authorization.getName()
@@ -160,8 +160,10 @@ class CmsAuthUtils {
 					} else {
 						// keep current session
 						cmsSession = currentLocalSession;
-						// keyring
-						subject.getPrivateCredentials().addAll(cmsSession.getSecretKeys());
+						// credentials
+						// TODO control it more??
+						subject.getPrivateCredentials().addAll(cmsSession.getSubject().getPrivateCredentials());
+						subject.getPublicCredentials().addAll(cmsSession.getSubject().getPublicCredentials());
 					}
 				} else {// anonymous
 					if (!currentLocalSessionAnonymous) {
@@ -175,7 +177,7 @@ class CmsAuthUtils {
 			} else {
 				// new CMS session
 				UUID cmsSessionUuid = CmsContextImpl.getCmsContext().getUuidFactory().timeUUID();
-				cmsSession = new WebCmsSessionImpl(cmsSessionUuid, subject, authorization, locale, request);
+				cmsSession = new RemoteCmsSessionImpl(cmsSessionUuid, subject, authorization, locale, request);
 				CmsContextImpl.getCmsContext().registerCmsSession(cmsSession);
 			}
 
@@ -187,10 +189,11 @@ class CmsAuthUtils {
 				subject.getPrivateCredentials().add(nodeSessionId);
 			} else {
 				UUID storedSessionId = subject.getPrivateCredentials(CmsSessionId.class).iterator().next().getUuid();
-				// if (storedSessionId.equals(httpSessionId.getValue()))
-				throw new IllegalStateException(
-						"Subject already logged with session " + storedSessionId + " (not " + nodeSessionId + ")");
+				if (!storedSessionId.equals(nodeSessionId.getUuid()))
+					throw new IllegalStateException(
+							"Subject already logged with session " + storedSessionId + " (not " + nodeSessionId + ")");
 			}
+			request.setAttribute(CmsSession.class.getName(), cmsSession);
 		} else {
 			CmsSessionImpl cmsSession = CmsContextImpl.getCmsContext().getCmsSessionByLocalId(SINGLE_USER_LOCAL_ID);
 			if (cmsSession == null) {