X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Finternal%2Fkernel%2FNodeUserAdmin.java;h=e8977fa37466858eb32698ae2db94b2e03db3f3f;hb=0435920b5f0246af061fc68e5f3814d978686f23;hp=caadadefa8785054696476473892a90419b5262d;hpb=6decc943ce5bca1b57ef407b7e9c6bb6ad6f3c97;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeUserAdmin.java b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeUserAdmin.java
index caadadefa..e8977fa37 100644
--- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeUserAdmin.java
+++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/NodeUserAdmin.java
@@ -14,6 +14,7 @@ import java.util.HashMap;
 import java.util.Hashtable;
 import java.util.Iterator;
 import java.util.Map;
+import java.util.Set;
 
 import javax.naming.ldap.LdapName;
 import javax.security.auth.Subject;
@@ -28,14 +29,12 @@ import javax.transaction.TransactionManager;
 
 import org.apache.commons.httpclient.auth.AuthPolicy;
 import org.apache.commons.httpclient.auth.CredentialsProvider;
-import org.apache.commons.httpclient.cookie.CookiePolicy;
 import org.apache.commons.httpclient.params.DefaultHttpParams;
 import org.apache.commons.httpclient.params.HttpMethodParams;
 import org.apache.commons.httpclient.params.HttpParams;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.argeo.cms.CmsException;
-import org.argeo.cms.internal.http.NodeHttp;
 import org.argeo.cms.internal.http.client.HttpCredentialProvider;
 import org.argeo.cms.internal.http.client.SpnegoAuthScheme;
 import org.argeo.naming.DnsBrowser;
@@ -44,6 +43,7 @@ import org.argeo.osgi.useradmin.AbstractUserDirectory;
 import org.argeo.osgi.useradmin.AggregatingUserAdmin;
 import org.argeo.osgi.useradmin.LdapUserAdmin;
 import org.argeo.osgi.useradmin.LdifUserAdmin;
+import org.argeo.osgi.useradmin.OsUserDirectory;
 import org.argeo.osgi.useradmin.UserAdminConf;
 import org.argeo.osgi.useradmin.UserDirectory;
 import org.ietf.jgss.GSSCredential;
@@ -57,6 +57,7 @@ import org.osgi.framework.FrameworkUtil;
 import org.osgi.framework.ServiceRegistration;
 import org.osgi.service.cm.ConfigurationException;
 import org.osgi.service.cm.ManagedServiceFactory;
+import org.osgi.service.useradmin.Authorization;
 import org.osgi.service.useradmin.UserAdmin;
 import org.osgi.util.tracker.ServiceTracker;
 
@@ -84,6 +85,9 @@ class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactor
 	private Path nodeKeyTab = KernelUtils.getOsgiInstancePath(KernelConstants.NODE_KEY_TAB_PATH);
 	private GSSCredential acceptorCredentials;
 
+	private boolean singleUser = false;
+	private boolean systemRolesAvailable = false;
+
 	public NodeUserAdmin(String systemRolesBaseDn) {
 		super(systemRolesBaseDn);
 		tmTracker = new ServiceTracker<>(bc, TransactionManager.class, null);
@@ -95,14 +99,27 @@ class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactor
 		String uri = (String) properties.get(UserAdminConf.uri.name());
 		URI u;
 		try {
-			u = new URI(uri);
+			if (uri == null) {
+				String baseDn = (String) properties.get(UserAdminConf.baseDn.name());
+				u = KernelUtils.getOsgiInstanceUri(KernelConstants.DIR_NODE + '/' + baseDn + ".ldif");
+			} else
+				u = new URI(uri);
 		} catch (URISyntaxException e) {
 			throw new CmsException("Badly formatted URI " + uri, e);
 		}
 
 		// Create
-		AbstractUserDirectory userDirectory = u.getScheme().equals("ldap") ? new LdapUserAdmin(properties)
-				: new LdifUserAdmin(properties);
+		AbstractUserDirectory userDirectory;
+		if (UserAdminConf.SCHEME_LDAP.equals(u.getScheme())) {
+			userDirectory = new LdapUserAdmin(properties);
+		} else if (UserAdminConf.SCHEME_FILE.equals(u.getScheme())) {
+			userDirectory = new LdifUserAdmin(u, properties);
+		} else if (UserAdminConf.SCHEME_OS.equals(u.getScheme())) {
+			userDirectory = new OsUserDirectory(u, properties);
+			singleUser = true;
+		} else {
+			throw new CmsException("Unsupported scheme " + u.getScheme());
+		}
 		Object realm = userDirectory.getProperties().get(UserAdminConf.realm.name());
 		addUserDirectory(userDirectory);
 
@@ -121,7 +138,13 @@ class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactor
 			log.debug("User directory " + userDirectory.getBaseDn() + " [" + u.getScheme() + "] enabled."
 					+ (realm != null ? " " + realm + " realm." : ""));
 
-		if (!isSystemRolesBaseDn(baseDn)) {
+		if (isSystemRolesBaseDn(baseDn))
+			systemRolesAvailable = true;
+
+		// start publishing only when system roles are available
+		if (systemRolesAvailable) {
+			// The list of baseDns is published as properties
+			// TODO clients should rather reference USerDirectory services
 			if (userAdminReg != null)
 				userAdminReg.unregister();
 			// register self as main user admin
@@ -146,6 +169,15 @@ class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactor
 		return "Node User Admin";
 	}
 
+	@Override
+	protected void addAbstractSystemRoles(Authorization rawAuthorization, Set<String> sysRoles) {
+		if (rawAuthorization.getName() == null) {
+			sysRoles.add(NodeConstants.ROLE_ANONYMOUS);
+		} else {
+			sysRoles.add(NodeConstants.ROLE_USER);
+		}
+	}
+
 	protected void postAdd(AbstractUserDirectory userDirectory) {
 		// JTA
 		TransactionManager tm = tmTracker.getService();
@@ -187,7 +219,7 @@ class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactor
 			// schemes.add(AuthPolicy.BASIC);// incompatible with Basic
 			params.setParameter(AuthPolicy.AUTH_SCHEME_PRIORITY, schemes);
 			params.setParameter(CredentialsProvider.PROVIDER, new HttpCredentialProvider());
-			params.setParameter(HttpMethodParams.COOKIE_POLICY, CookiePolicy.BROWSER_COMPATIBILITY);
+			params.setParameter(HttpMethodParams.COOKIE_POLICY, KernelConstants.COOKIE_POLICY_BROWSER_COMPATIBILITY);
 			// params.setCookiePolicy(CookiePolicy.BROWSER_COMPATIBILITY);
 		}
 	}
@@ -268,6 +300,10 @@ class NodeUserAdmin extends AggregatingUserAdmin implements ManagedServiceFactor
 		return acceptorCredentials;
 	}
 
+	public boolean isSingleUser() {
+		return singleUser;
+	}
+
 	public final static Oid KERBEROS_OID;
 	static {
 		try {