X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.core%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fjcr%2FOsJcrAuthenticationProvider.java;h=cb9146a8b662407593675de216655715d1c4504e;hb=0450e423bd759c9e27b43044670e659271392d71;hp=9abac5972a7f584fc1aaca81326d49877e4c41af;hpb=8b8ee149b20e2578a55e17413fa5f7399ff7ba14;p=lgpl%2Fargeo-commons.git diff --git a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/OsJcrAuthenticationProvider.java b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/OsJcrAuthenticationProvider.java index 9abac5972..cb9146a8b 100644 --- a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/OsJcrAuthenticationProvider.java +++ b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/OsJcrAuthenticationProvider.java @@ -1,8 +1,20 @@ +/* + * Copyright (C) 2007-2012 Mathieu Baudier + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ package org.argeo.security.jcr; -import java.util.Map; -import java.util.concurrent.Executor; - import javax.jcr.Node; import javax.jcr.Repository; import javax.jcr.RepositoryException; @@ -11,114 +23,102 @@ import javax.jcr.Session; import org.argeo.ArgeoException; import org.argeo.jcr.JcrUtils; import org.argeo.security.OsAuthenticationToken; -import org.argeo.security.SystemExecutionService; import org.argeo.security.core.OsAuthenticationProvider; import org.springframework.security.Authentication; import org.springframework.security.AuthenticationException; +import org.springframework.security.BadCredentialsException; +import org.springframework.security.providers.UsernamePasswordAuthenticationToken; import org.springframework.security.userdetails.UserDetails; +/** Relies on OS to authenticate and additionally setup JCR */ public class OsJcrAuthenticationProvider extends OsAuthenticationProvider { - private Executor systemExecutor; - private String homeBasePath = "/home"; private Repository repository; - private String workspace = null; - - private Long timeout = 5 * 60 * 1000l; + // private String securityWorkspace = "security"; + // private Session securitySession; + private Session nodeSession; - public Authentication authenticate(Authentication authentication) - throws AuthenticationException { - final OsAuthenticationToken authen = (OsAuthenticationToken) super - .authenticate(authentication); - final Repository repository = getRepositoryBlocking(); - systemExecutor.execute(new Runnable() { - public void run() { - Session session = null; - try { - session = repository.login(workspace); - // WARNING: at this stage we assume that the java properties - // will have the same value - String userName = System.getProperty("user.name"); - Node userHome = JcrUtils.getUserHome(session, userName); - if (userHome == null) - userHome = JcrUtils.createUserHome(session, - homeBasePath, userName); - // authen.setDetails(getUserDetails(userHome, authen)); - } catch (RepositoryException e) { - JcrUtils.discardQuietly(session); - throw new ArgeoException( - "Unexpected exception when synchronizing OS and JCR security ", - e); - } finally { - JcrUtils.logoutQuietly(session); - } - } - }); - return authen; - } + private UserDetails userDetails; + private JcrSecurityModel jcrSecurityModel = new JcrSecurityModel(); - /** Builds user details based on the authentication and the user home. */ - protected UserDetails getUserDetails(Node userHome, Authentication authen) { + public void init() { try { - // TODO: loads enabled, locked, etc. from the home node. - return new JcrUserDetails(userHome.getPath(), authen.getPrincipal() - .toString(), authen.getCredentials().toString(), - isEnabled(userHome), true, true, true, - authen.getAuthorities()); - } catch (Exception e) { - throw new ArgeoException("Cannot get user details for " + userHome, - e); + // securitySession = repository.login(); + nodeSession = repository.login(); + } catch (RepositoryException e) { + throw new ArgeoException("Cannot initialize", e); } } - protected Boolean isEnabled(Node userHome) { - return true; + public void destroy() { + // JcrUtils.logoutQuietly(securitySession); + JcrUtils.logoutQuietly(nodeSession); } - protected Repository getRepositoryBlocking() { - long begin = System.currentTimeMillis(); - while (repository == null) { - synchronized (this) { - try { - wait(500); - } catch (InterruptedException e) { - // silent - } + public Authentication authenticate(Authentication authentication) + throws AuthenticationException { + if (authentication instanceof UsernamePasswordAuthenticationToken) { + // deal with remote access to internal server + // FIXME very primitive and unsecure at this stage + // consider using the keyring for username / password authentication + // or certificate + UsernamePasswordAuthenticationToken upat = (UsernamePasswordAuthenticationToken) authentication; + if (!upat.getPrincipal().toString() + .equals(System.getProperty("user.name"))) + throw new BadCredentialsException("Wrong credentials"); + UsernamePasswordAuthenticationToken authen = new UsernamePasswordAuthenticationToken( + authentication.getPrincipal(), + authentication.getCredentials(), getBaseAuthorities()); + authen.setDetails(userDetails); + return authen; + } else if (authentication instanceof OsAuthenticationToken) { + OsAuthenticationToken authen = (OsAuthenticationToken) super + .authenticate(authentication); + try { + // WARNING: at this stage we assume that the java properties + // will have the same value + String username = System.getProperty("user.name"); + Node userProfile = jcrSecurityModel.sync(nodeSession, username); + JcrUserDetails.checkAccountStatus(userProfile); + + // each user should have a writable area in the default + // workspace of the node + // SecurityJcrUtils.createUserHomeIfNeeded(nodeSession, + // username); + userDetails = new JcrUserDetails(userProfile, authen + .getCredentials().toString(), getBaseAuthorities()); + authen.setDetails(userDetails); + return authen; + } catch (RepositoryException e) { + JcrUtils.discardQuietly(nodeSession); + throw new ArgeoException( + "Unexpected exception when synchronizing OS and JCR security ", + e); + } finally { + JcrUtils.logoutQuietly(nodeSession); } - if (System.currentTimeMillis() - begin > timeout) - throw new ArgeoException("No repository registered after " - + timeout + " ms"); + } else { + throw new ArgeoException("Unsupported authentication " + + authentication.getClass()); } - return repository; } - public synchronized void register(Repository repository, - Map parameters) { - this.repository = repository; - notifyAll(); - } - - public synchronized void unregister(Repository repository, - Map parameters) { - this.repository = null; - notifyAll(); - } + // public void setSecurityWorkspace(String securityWorkspace) { + // this.securityWorkspace = securityWorkspace; + // } - public void register(SystemExecutionService systemExecutor, - Map parameters) { - this.systemExecutor = systemExecutor; - } - - public void unregister(SystemExecutionService systemExecutor, - Map parameters) { - this.systemExecutor = null; + public void setRepository(Repository repository) { + this.repository = repository; } - public void setHomeBasePath(String homeBasePath) { - this.homeBasePath = homeBasePath; + public void setJcrSecurityModel(JcrSecurityModel jcrSecurityModel) { + this.jcrSecurityModel = jcrSecurityModel; } - public void setWorkspace(String workspace) { - this.workspace = workspace; + @SuppressWarnings("rawtypes") + public boolean supports(Class authentication) { + return OsAuthenticationToken.class.isAssignableFrom(authentication) + || UsernamePasswordAuthenticationToken.class + .isAssignableFrom(authentication); } }