X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FHttpSessionLoginModule.java;h=cbd54063cbda19c4496a4930566000f3a735ef36;hb=ba9ea52d11b6ac81120f35351ee632191f251f7d;hp=9e05ac95aec0212b320dccb3424a573b06de83cc;hpb=e6ec864540db3fe0d39d99be294c7e402c2a4ce9;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java index 9e05ac95a..cbd54063c 100644 --- a/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java +++ b/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java @@ -2,7 +2,9 @@ package org.argeo.cms.auth; import java.io.IOException; import java.security.cert.X509Certificate; +import java.util.Base64; import java.util.Collection; +import java.util.Locale; import java.util.Map; import java.util.StringTokenizer; @@ -14,11 +16,12 @@ import javax.security.auth.login.LoginException; import javax.security.auth.spi.LoginModule; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; -import org.apache.commons.codec.binary.Base64; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.argeo.cms.CmsException; +import org.argeo.cms.internal.kernel.Activator; import org.osgi.framework.BundleContext; import org.osgi.framework.FrameworkUtil; import org.osgi.framework.InvalidSyntaxException; @@ -39,6 +42,7 @@ public class HttpSessionLoginModule implements LoginModule { private BundleContext bc; private Authorization authorization; + private Locale locale; @SuppressWarnings("unchecked") @Override @@ -68,7 +72,14 @@ public class HttpSessionLoginModule implements LoginModule { return false; authorization = (Authorization) request.getAttribute(HttpContext.AUTHORIZATION); if (authorization == null) {// search by session ID - String httpSessionId = request.getSession().getId(); + HttpSession httpSession = request.getSession(false); + if (httpSession == null) { + // TODO make sure this is always safe + if (log.isTraceEnabled()) + log.trace("Create http session"); + httpSession = request.getSession(true); + } + String httpSessionId = httpSession.getId(); // authorization = (Authorization) // request.getSession().getAttribute(HttpContext.AUTHORIZATION); // if (authorization == null) { @@ -81,7 +92,10 @@ public class HttpSessionLoginModule implements LoginModule { } if (sr.size() == 1) { CmsSession cmsSession = bc.getService(sr.iterator().next()); + locale = cmsSession.getLocale(); authorization = cmsSession.getAuthorization(); + if (authorization.getName() == null) + authorization = null;// anonymous is not sufficient if (log.isTraceEnabled()) log.trace("Retrieved authorization from " + cmsSession); } else if (sr.size() == 0) @@ -93,35 +107,15 @@ public class HttpSessionLoginModule implements LoginModule { sharedState.put(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST, request); extractHttpAuth(request); extractClientCertificate(request); - if (authorization == null) + if (authorization == null) { return false; - sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION, authorization); - return true; + } else { + return true; + } } @Override public boolean commit() throws LoginException { - if(authorization!=null){ - CmsAuthUtils.addAuthorization(subject, authorization,request); -// CmsAuthUtils.registerSessionAuthorization(bc, request, subject, authorization); - } - - // TODO create CmsSession in another module -// Authorization authorizationToRegister; -// if (authorization == null) { -// authorizationToRegister = (Authorization) sharedState.get(CmsAuthUtils.SHARED_STATE_AUTHORIZATION); -// } -// else { // this login module did the authorization -// CmsAuthUtils.addAuthentication(subject, authorization); -// authorizationToRegister = authorization; -// } -// if (authorizationToRegister == null) { -// return false; -// } -// if (request == null) -// return false; -// CmsAuthUtils.registerSessionAuthorization(bc, request, subject, authorizationToRegister); - byte[] outToken = (byte[]) sharedState.get(CmsAuthUtils.SHARED_STATE_SPNEGO_OUT_TOKEN); if (outToken != null) { response.setHeader(CmsAuthUtils.HEADER_WWW_AUTHENTICATE, @@ -129,7 +123,12 @@ public class HttpSessionLoginModule implements LoginModule { } if (authorization != null) { - // CmsAuthUtils.addAuthentication(subject, authorization); + // Locale locale = request.getLocale(); + if (locale == null) + locale = request.getLocale(); + subject.getPublicCredentials().add(locale); + CmsAuthUtils.addAuthorization(subject, authorization, locale, request); + CmsAuthUtils.registerSessionAuthorization(request, subject, authorization, locale); cleanUp(); return true; } else { @@ -151,7 +150,8 @@ public class HttpSessionLoginModule implements LoginModule { @Override public boolean logout() throws LoginException { - return CmsAuthUtils.logoutSession(bc, subject); + cleanUp(); + return true; } private void extractHttpAuth(final HttpServletRequest httpRequest) { @@ -163,7 +163,8 @@ public class HttpSessionLoginModule implements LoginModule { if (basic.equalsIgnoreCase("Basic")) { try { // TODO manipulate char[] - String credentials = new String(Base64.decodeBase64(st.nextToken()), "UTF-8"); + Base64.Decoder decoder = Base64.getDecoder(); + String credentials = new String(decoder.decode(st.nextToken()), "UTF-8"); // log.debug("Credentials: " + credentials); int p = credentials.indexOf(":"); if (p != -1) { @@ -179,19 +180,44 @@ public class HttpSessionLoginModule implements LoginModule { } } else if (basic.equalsIgnoreCase("Negotiate")) { String spnegoToken = st.nextToken(); - byte[] authToken = Base64.decodeBase64(spnegoToken); + Base64.Decoder decoder = Base64.getDecoder(); + byte[] authToken = decoder.decode(spnegoToken); sharedState.put(CmsAuthUtils.SHARED_STATE_SPNEGO_TOKEN, authToken); } } } + + // auth token + // String mail = request.getParameter(LdapAttrs.mail.name()); + // String authPassword = request.getParameter(LdapAttrs.authPassword.name()); + // if (authPassword != null) { + // sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, authPassword); + // if (mail != null) + // sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, mail); + // } } - private X509Certificate[] extractClientCertificate(HttpServletRequest req) { + private void extractClientCertificate(HttpServletRequest req) { X509Certificate[] certs = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate"); - if (null != certs && certs.length > 0) { - return certs; + if (null != certs && certs.length > 0) {// Servlet container verified the client certificate + String certDn = certs[0].getSubjectX500Principal().getName(); + sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, certDn); + sharedState.put(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN, certs); + if (log.isDebugEnabled()) + log.debug("Client certificate " + certDn + " verified by servlet container"); + } // Reverse proxy verified the client certificate + String clientDnHttpHeader = Activator.getHttpProxySslHeader(); + if (clientDnHttpHeader != null) { + String certDn = req.getHeader(clientDnHttpHeader); + // TODO retrieve more cf. https://httpd.apache.org/docs/current/mod/mod_ssl.html + // String issuerDn = req.getHeader("SSL_CLIENT_I_DN"); + if (certDn != null && !certDn.trim().equals("(null)")) { + sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, certDn); + sharedState.put(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN, ""); + if (log.isDebugEnabled()) + log.debug("Client certificate " + certDn + " verified by reverse proxy"); + } } - return null; } }