X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Fauth%2FHttpSessionLoginModule.java;h=cbd54063cbda19c4496a4930566000f3a735ef36;hb=ba9ea52d11b6ac81120f35351ee632191f251f7d;hp=da0fe2d46c3864c9f914f6a0e3dc158023cd0320;hpb=a444205e81419d439635a9e0ff3382ae3f5d9947;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java index da0fe2d46..cbd54063c 100644 --- a/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java +++ b/org.argeo.cms/src/org/argeo/cms/auth/HttpSessionLoginModule.java @@ -1,8 +1,12 @@ package org.argeo.cms.auth; import java.io.IOException; +import java.security.cert.X509Certificate; +import java.util.Base64; import java.util.Collection; +import java.util.Locale; import java.util.Map; +import java.util.StringTokenizer; import javax.security.auth.Subject; import javax.security.auth.callback.Callback; @@ -11,12 +15,13 @@ import javax.security.auth.callback.UnsupportedCallbackException; import javax.security.auth.login.LoginException; import javax.security.auth.spi.LoginModule; import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.argeo.cms.CmsException; -import org.argeo.cms.internal.kernel.WebCmsSessionImpl; +import org.argeo.cms.internal.kernel.Activator; import org.osgi.framework.BundleContext; import org.osgi.framework.FrameworkUtil; import org.osgi.framework.InvalidSyntaxException; @@ -32,10 +37,12 @@ public class HttpSessionLoginModule implements LoginModule { private Map sharedState = null; private HttpServletRequest request = null; + private HttpServletResponse response = null; private BundleContext bc; private Authorization authorization; + private Locale locale; @SuppressWarnings("unchecked") @Override @@ -65,20 +72,30 @@ public class HttpSessionLoginModule implements LoginModule { return false; authorization = (Authorization) request.getAttribute(HttpContext.AUTHORIZATION); if (authorization == null) {// search by session ID - String httpSessionId = request.getSession().getId(); + HttpSession httpSession = request.getSession(false); + if (httpSession == null) { + // TODO make sure this is always safe + if (log.isTraceEnabled()) + log.trace("Create http session"); + httpSession = request.getSession(true); + } + String httpSessionId = httpSession.getId(); // authorization = (Authorization) // request.getSession().getAttribute(HttpContext.AUTHORIZATION); // if (authorization == null) { - Collection> sr; + Collection> sr; try { - sr = bc.getServiceReferences(WebCmsSession.class, - "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")"); + sr = bc.getServiceReferences(CmsSession.class, + "(" + CmsSession.SESSION_LOCAL_ID + "=" + httpSessionId + ")"); } catch (InvalidSyntaxException e) { throw new CmsException("Cannot get CMS session for id " + httpSessionId, e); } if (sr.size() == 1) { - WebCmsSession cmsSession = bc.getService(sr.iterator().next()); + CmsSession cmsSession = bc.getService(sr.iterator().next()); + locale = cmsSession.getLocale(); authorization = cmsSession.getAuthorization(); + if (authorization.getName() == null) + authorization = null;// anonymous is not sufficient if (log.isTraceEnabled()) log.trace("Retrieved authorization from " + cmsSession); } else if (sr.size() == 0) @@ -87,74 +104,31 @@ public class HttpSessionLoginModule implements LoginModule { throw new CmsException(sr.size() + ">1 web sessions detected for http session " + httpSessionId); } - if (authorization == null) + sharedState.put(CmsAuthUtils.SHARED_STATE_HTTP_REQUEST, request); + extractHttpAuth(request); + extractClientCertificate(request); + if (authorization == null) { return false; - sharedState.put(CmsAuthUtils.SHARED_STATE_AUTHORIZATION, authorization); - return true; + } else { + return true; + } } - // private Authorization checkHttp() { - // Authorization authorization = null; - // if (request != null) { - // authorization = (Authorization) - // request.getAttribute(HttpContext.AUTHORIZATION); - // if (authorization == null) { - // String httpSessionId = request.getSession().getId(); - // authorization = (Authorization) - // request.getSession().getAttribute(HttpContext.AUTHORIZATION); - // if (authorization == null) { - // Collection> sr; - // try { - // sr = bc.getServiceReferences(WebCmsSession.class, - // "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")"); - // } catch (InvalidSyntaxException e) { - // throw new CmsException("Cannot get CMS session for id " + httpSessionId, - // e); - // } - // if (sr.size() == 1) { - // WebCmsSession cmsSession = bc.getService(sr.iterator().next()); - // authorization = cmsSession.getAuthorization(); - // if (log.isTraceEnabled()) - // log.trace("Retrieved authorization from " + cmsSession); - // } else if (sr.size() == 0) - // return null; - // else - // throw new CmsException( - // sr.size() + ">1 web sessions detected for http session " + - // httpSessionId); - // } - // } - // } - // return authorization; - // } - @Override public boolean commit() throws LoginException { - // TODO create CmsSession in another module - Authorization authorizationToRegister; - if (authorization == null) { - authorizationToRegister = (Authorization) sharedState.get(CmsAuthUtils.SHARED_STATE_AUTHORIZATION); - } else { // this login module did the authorization - CmsAuthUtils.addAuthentication(subject, authorization); - authorizationToRegister = authorization; - } - if (authorizationToRegister == null) { - return false; - } - if (request == null) - return false; - HttpSessionId httpSessionId = registerAuthorization(request, authorizationToRegister); - if (subject.getPrivateCredentials(HttpSessionId.class).size() == 0) - subject.getPrivateCredentials().add(httpSessionId); - else { - String storedSessionId = subject.getPrivateCredentials(HttpSessionId.class).iterator().next().getValue(); - // if (storedSessionId.equals(httpSessionId.getValue())) - throw new LoginException( - "Subject already logged with session " + storedSessionId + " (not " + httpSessionId + ")"); + byte[] outToken = (byte[]) sharedState.get(CmsAuthUtils.SHARED_STATE_SPNEGO_OUT_TOKEN); + if (outToken != null) { + response.setHeader(CmsAuthUtils.HEADER_WWW_AUTHENTICATE, + "Negotiate " + java.util.Base64.getEncoder().encodeToString(outToken)); } if (authorization != null) { - // CmsAuthUtils.addAuthentication(subject, authorization); + // Locale locale = request.getLocale(); + if (locale == null) + locale = request.getLocale(); + subject.getPublicCredentials().add(locale); + CmsAuthUtils.addAuthorization(subject, authorization, locale, request); + CmsAuthUtils.registerSessionAuthorization(request, subject, authorization, locale); cleanUp(); return true; } else { @@ -163,47 +137,6 @@ public class HttpSessionLoginModule implements LoginModule { } } - private HttpSessionId registerAuthorization(HttpServletRequest request, Authorization authorization) { - String httpSessionId = request.getSession().getId(); - if (authorization.getName() != null) { - request.setAttribute(HttpContext.REMOTE_USER, authorization.getName()); - request.setAttribute(HttpContext.AUTHORIZATION, authorization); - - HttpSession httpSession = request.getSession(); - if (httpSession.getAttribute(HttpContext.AUTHORIZATION) == null) { - - Collection> sr; - try { - sr = bc.getServiceReferences(WebCmsSession.class, - "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")"); - } catch (InvalidSyntaxException e) { - throw new CmsException("Cannot get CMS session for id " + httpSessionId, e); - } - ServiceReference cmsSessionRef; - if (sr.size() == 1) { - cmsSessionRef = sr.iterator().next(); - } else if (sr.size() == 0) { - WebCmsSessionImpl cmsSessionImpl = new WebCmsSessionImpl(httpSessionId, authorization); - cmsSessionRef = cmsSessionImpl.getServiceRegistration().getReference(); - if (log.isDebugEnabled()) - log.debug("Initialized " + cmsSessionImpl + " for " + authorization.getName()); - } else - throw new CmsException(sr.size() + " CMS sessions registered for " + httpSessionId); - - WebCmsSessionImpl cmsSession = (WebCmsSessionImpl) bc.getService(cmsSessionRef); - cmsSession.addHttpSession(request); - if (log.isTraceEnabled()) - log.trace("Added " + request.getServletPath() + " to " + cmsSession + " (" + request.getRequestURI() - + ")"); - // httpSession.setAttribute(HttpContext.REMOTE_USER, - // authorization.getName()); - // httpSession.setAttribute(HttpContext.AUTHORIZATION, - // authorization); - } - } - return new HttpSessionId(httpSessionId); - } - @Override public boolean abort() throws LoginException { cleanUp(); @@ -217,30 +150,74 @@ public class HttpSessionLoginModule implements LoginModule { @Override public boolean logout() throws LoginException { - String httpSessionId; - if (subject.getPrivateCredentials(HttpSessionId.class).size() == 1) - httpSessionId = subject.getPrivateCredentials(HttpSessionId.class).iterator().next().getValue(); - else - return false; - Collection> srs; - try { - srs = bc.getServiceReferences(WebCmsSession.class, - "(" + WebCmsSession.CMS_SESSION_ID + "=" + httpSessionId + ")"); - } catch (InvalidSyntaxException e) { - throw new CmsException("Cannot retrieve CMS session #" + httpSessionId, e); + cleanUp(); + return true; + } + + private void extractHttpAuth(final HttpServletRequest httpRequest) { + String authHeader = httpRequest.getHeader(CmsAuthUtils.HEADER_AUTHORIZATION); + if (authHeader != null) { + StringTokenizer st = new StringTokenizer(authHeader); + if (st.hasMoreTokens()) { + String basic = st.nextToken(); + if (basic.equalsIgnoreCase("Basic")) { + try { + // TODO manipulate char[] + Base64.Decoder decoder = Base64.getDecoder(); + String credentials = new String(decoder.decode(st.nextToken()), "UTF-8"); + // log.debug("Credentials: " + credentials); + int p = credentials.indexOf(":"); + if (p != -1) { + final String login = credentials.substring(0, p).trim(); + final char[] password = credentials.substring(p + 1).trim().toCharArray(); + sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, login); + sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, password); + } else { + throw new CmsException("Invalid authentication token"); + } + } catch (Exception e) { + throw new CmsException("Couldn't retrieve authentication", e); + } + } else if (basic.equalsIgnoreCase("Negotiate")) { + String spnegoToken = st.nextToken(); + Base64.Decoder decoder = Base64.getDecoder(); + byte[] authToken = decoder.decode(spnegoToken); + sharedState.put(CmsAuthUtils.SHARED_STATE_SPNEGO_TOKEN, authToken); + } + } } - if (srs.size() == 0) - throw new CmsException("No CMS web session found for http session " + httpSessionId); - else if (srs.size() > 1) - throw new CmsException(srs.size() + " CMS web sessions found for http session " + httpSessionId); + // auth token + // String mail = request.getParameter(LdapAttrs.mail.name()); + // String authPassword = request.getParameter(LdapAttrs.authPassword.name()); + // if (authPassword != null) { + // sharedState.put(CmsAuthUtils.SHARED_STATE_PWD, authPassword); + // if (mail != null) + // sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, mail); + // } + } - WebCmsSessionImpl cmsSession = (WebCmsSessionImpl) bc.getService(srs.iterator().next()); - cmsSession.cleanUp(); - subject.getPrivateCredentials().removeAll(subject.getPrivateCredentials(HttpSessionId.class)); - if (log.isDebugEnabled()) - log.debug("Cleaned up " + cmsSession); - return true; + private void extractClientCertificate(HttpServletRequest req) { + X509Certificate[] certs = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate"); + if (null != certs && certs.length > 0) {// Servlet container verified the client certificate + String certDn = certs[0].getSubjectX500Principal().getName(); + sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, certDn); + sharedState.put(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN, certs); + if (log.isDebugEnabled()) + log.debug("Client certificate " + certDn + " verified by servlet container"); + } // Reverse proxy verified the client certificate + String clientDnHttpHeader = Activator.getHttpProxySslHeader(); + if (clientDnHttpHeader != null) { + String certDn = req.getHeader(clientDnHttpHeader); + // TODO retrieve more cf. https://httpd.apache.org/docs/current/mod/mod_ssl.html + // String issuerDn = req.getHeader("SSL_CLIENT_I_DN"); + if (certDn != null && !certDn.trim().equals("(null)")) { + sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, certDn); + sharedState.put(CmsAuthUtils.SHARED_STATE_CERTIFICATE_CHAIN, ""); + if (log.isDebugEnabled()) + log.debug("Client certificate " + certDn + " verified by reverse proxy"); + } + } } }