X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.ext.jackrabbit%2Fsrc%2Forg%2Fargeo%2Fsecurity%2Fjackrabbit%2FArgeoSecurityManager.java;h=15199c0ce6df15eee4c9692d1d15ef9048bc3916;hb=134d034cdb103158b6462c8728c68baa523dcf22;hp=046829fe51b6d3d8db552a85e4c0b7ca6c75e1b1;hpb=7e333073d07b780efe681306a1842a750cbea83c;p=lgpl%2Fargeo-commons.git

diff --git a/org.argeo.ext.jackrabbit/src/org/argeo/security/jackrabbit/ArgeoSecurityManager.java b/org.argeo.ext.jackrabbit/src/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
index 046829fe5..15199c0ce 100644
--- a/org.argeo.ext.jackrabbit/src/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
+++ b/org.argeo.ext.jackrabbit/src/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
@@ -28,69 +28,78 @@ import org.apache.jackrabbit.core.DefaultSecurityManager;
 import org.apache.jackrabbit.core.security.AMContext;
 import org.apache.jackrabbit.core.security.AccessManager;
 import org.apache.jackrabbit.core.security.SecurityConstants;
+import org.apache.jackrabbit.core.security.SystemPrincipal;
 import org.apache.jackrabbit.core.security.authorization.WorkspaceAccessManager;
+import org.apache.jackrabbit.core.security.principal.AdminPrincipal;
 import org.argeo.node.NodeConstants;
 import org.argeo.node.security.AnonymousPrincipal;
+import org.argeo.node.security.DataAdminPrincipal;
 
-/** Integrates Spring Security and Jackrabbit Security users and roles. */
+/** Customises Jackrabbit security. */
 public class ArgeoSecurityManager extends DefaultSecurityManager {
 	@Override
-	public AccessManager getAccessManager(Session session, AMContext amContext)
-			throws RepositoryException {
+	public AccessManager getAccessManager(Session session, AMContext amContext) throws RepositoryException {
 		synchronized (getSystemSession()) {
 			return super.getAccessManager(session, amContext);
 		}
 	}
 
 	@Override
-	public UserManager getUserManager(Session session)
-			throws RepositoryException {
+	public UserManager getUserManager(Session session) throws RepositoryException {
 		synchronized (getSystemSession()) {
 			return super.getUserManager(session);
 		}
 	}
 
-	/**
-	 * Since this is called once when the session is created, we take the
-	 * opportunity to make sure that Jackrabbit users and groups reflect Spring
-	 * Security name and authorities.
-	 */
+	/** Called once when the session is created */
 	@Override
-	public String getUserID(Subject subject, String workspaceName)
-			throws RepositoryException {
-		Set<AnonymousPrincipal> anonymousPrincipal = subject
-				.getPrincipals(AnonymousPrincipal.class);
-		if(!anonymousPrincipal.isEmpty())
-			return NodeConstants.ROLE_ANONYMOUS;
-		Set<X500Principal> userPrincipal = subject
-				.getPrincipals(X500Principal.class);
-		if (userPrincipal.isEmpty())
-			throw new IllegalStateException("Subject is neither anonymous nor logged-in");
-//			return super.getUserID(subject, workspaceName);
-		if (userPrincipal.size() > 1) {
-			StringBuilder buf = new StringBuilder();
-			for (X500Principal principal : userPrincipal)
-				buf.append(' ').append('\"').append(principal).append('\"');
-			throw new RuntimeException("Multiple user principals:" + buf);
+	public String getUserID(Subject subject, String workspaceName) throws RepositoryException {
+		boolean isAnonymous = !subject.getPrincipals(AnonymousPrincipal.class).isEmpty();
+		boolean isDataAdmin = !subject.getPrincipals(DataAdminPrincipal.class).isEmpty();
+		boolean isJackrabbitSystem = !subject.getPrincipals(SystemPrincipal.class).isEmpty();
+		Set<X500Principal> userPrincipal = subject.getPrincipals(X500Principal.class);
+		boolean isRegularUser = !userPrincipal.isEmpty();
+		if (isAnonymous) {
+			if (isDataAdmin || isJackrabbitSystem || isRegularUser)
+				throw new IllegalStateException("Inconsistent " + subject);
+			else
+				return NodeConstants.ROLE_ANONYMOUS;
+		} else if (isRegularUser) {// must be before DataAdmin
+			if (isAnonymous || isJackrabbitSystem)
+				throw new IllegalStateException("Inconsistent " + subject);
+			else {
+				if (userPrincipal.size() > 1) {
+					StringBuilder buf = new StringBuilder();
+					for (X500Principal principal : userPrincipal)
+						buf.append(' ').append('\"').append(principal).append('\"');
+					throw new RuntimeException("Multiple user principals:" + buf);
+				}
+				return userPrincipal.iterator().next().getName();
+			}
+		} else if (isDataAdmin) {
+			if (isAnonymous || isJackrabbitSystem || isRegularUser)
+				throw new IllegalStateException("Inconsistent " + subject);
+			else {
+				assert !subject.getPrincipals(AdminPrincipal.class).isEmpty();
+				return NodeConstants.ROLE_DATA_ADMIN;
+			}
+		} else if (isJackrabbitSystem) {
+			if (isAnonymous || isDataAdmin || isRegularUser)
+				throw new IllegalStateException("Inconsistent " + subject);
+			else
+				return super.getUserID(subject, workspaceName);
+		} else {
+			throw new IllegalStateException("Unrecognized subject type: " + subject);
 		}
-		return userPrincipal.iterator().next().getName();
-		// Authentication authentication = SecurityContextHolder.getContext()
-		// .getAuthentication();
-		// if (authentication != null)
-		// return authentication.getName();
-		// else
-		// return super.getUserID(subject, workspaceName);
 	}
 
 	@Override
 	protected WorkspaceAccessManager createDefaultWorkspaceAccessManager() {
-		WorkspaceAccessManager wam = super
-				.createDefaultWorkspaceAccessManager();
+		WorkspaceAccessManager wam = super.createDefaultWorkspaceAccessManager();
 		return new ArgeoWorkspaceAccessManagerImpl(wam);
 	}
 
-	private class ArgeoWorkspaceAccessManagerImpl implements SecurityConstants,
-			WorkspaceAccessManager {
+	private class ArgeoWorkspaceAccessManagerImpl implements SecurityConstants, WorkspaceAccessManager {
 		private final WorkspaceAccessManager wam;
 
 		public ArgeoWorkspaceAccessManagerImpl(WorkspaceAccessManager wam) {
@@ -105,8 +114,7 @@ public class ArgeoSecurityManager extends DefaultSecurityManager {
 		public void close() throws RepositoryException {
 		}
 
-		public boolean grants(Set<Principal> principals, String workspaceName)
-				throws RepositoryException {
+		public boolean grants(Set<Principal> principals, String workspaceName) throws RepositoryException {
 			// TODO: implements finer access to workspaces
 			return true;
 		}