X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.jackrabbit%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fjackrabbit%2FArgeoLoginModule.java;h=49bd304ed3564450adb53df65ae25b36cf3a8037;hb=72c5c4c7e5348ad96a451ef866a1e231db976dc7;hp=73ec76a8f7c72b83c18a1de5b7390fa6a7b68bd9;hpb=2745f0c8c57d9468855179d56f858fb2448f779c;p=lgpl%2Fargeo-commons.git

diff --git a/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoLoginModule.java b/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoLoginModule.java
index 73ec76a8f..49bd304ed 100644
--- a/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoLoginModule.java
+++ b/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoLoginModule.java
@@ -22,9 +22,30 @@ import org.springframework.security.GrantedAuthority;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.anonymous.AnonymousAuthenticationToken;
 
+/** Jackrabbit login mechanism based on Spring Security */
 public class ArgeoLoginModule extends AbstractLoginModule {
 	private String adminRole = "ROLE_ADMIN";
 
+	@Override
+	public boolean login() throws LoginException {
+		boolean loginOk = super.login();
+		if (!loginOk) {
+			org.springframework.security.Authentication authen = (org.springframework.security.Authentication) SecurityContextHolder
+					.getContext().getAuthentication();
+		}
+		return loginOk;
+	}
+
+	@Override
+	public boolean commit() throws LoginException {
+		boolean commitOk = super.commit();
+		if (!commitOk) {
+			org.springframework.security.Authentication authen = (org.springframework.security.Authentication) SecurityContextHolder
+					.getContext().getAuthentication();
+		}
+		return commitOk;
+	}
+
 	/**
 	 * Returns the Spring {@link org.springframework.security.Authentication}
 	 * (which can be null)
@@ -37,27 +58,44 @@ public class ArgeoLoginModule extends AbstractLoginModule {
 	}
 
 	protected Set<Principal> getPrincipals() {
+		// clear already registered Jackrabbit principals
+		// clearPrincipals(AdminPrincipal.class);
+		// clearPrincipals(AnonymousPrincipal.class);
+		// clearPrincipals(GrantedAuthorityPrincipal.class);
+
+		return syncPrincipals();
+	}
+
+	protected Set<Principal> syncPrincipals() {
 		// use linked HashSet instead of HashSet in order to maintain the order
 		// of principals (as in the Subject).
-		Set<Principal> principals = new LinkedHashSet<Principal>();
-		principals.add(principal);
-
 		org.springframework.security.Authentication authen = (org.springframework.security.Authentication) principal;
 
-		if (authen instanceof SystemAuthentication)
+		Set<Principal> principals = new LinkedHashSet<Principal>();
+		principals.add(authen);
+
+		if (authen instanceof SystemAuthentication) {
 			principals.add(new AdminPrincipal(authen.getName()));
-		else if (authen instanceof AnonymousAuthenticationToken)
+			principals.add(new ArgeoSystemPrincipal(authen.getName()));
+		} else if (authen instanceof AnonymousAuthenticationToken) {
 			principals.add(new AnonymousPrincipal());
-		else
+		} else {
 			for (GrantedAuthority ga : authen.getAuthorities()) {
+				principals.add(new GrantedAuthorityPrincipal(ga));
 				// FIXME: make it more generic
 				if (adminRole.equals(ga.getAuthority()))
 					principals.add(new AdminPrincipal(authen.getName()));
 			}
+		}
 
+		// remove previous credentials
+		Set<SimpleCredentials> thisCredentials = subject
+				.getPublicCredentials(SimpleCredentials.class);
+		if (thisCredentials != null)
+			thisCredentials.clear();
 		// override credentials since we did not used the one passed to us
-		credentials = new SimpleCredentials(authen.getName(), authen
-				.getCredentials().toString().toCharArray());
+		// credentials = new SimpleCredentials(authen.getName(), authen
+		// .getCredentials().toString().toCharArray());
 
 		return principals;
 	}
@@ -69,21 +107,25 @@ public class ArgeoLoginModule extends AbstractLoginModule {
 	 */
 	@Override
 	public boolean logout() throws LoginException {
-		Set<AdminPrincipal> adminPrincipals = subject
-				.getPrincipals(AdminPrincipal.class);
-		Set<AnonymousPrincipal> anonymousPrincipals = subject
-				.getPrincipals(AnonymousPrincipal.class);
-		Set<SimpleCredentials> thisCredentials = subject
-				.getPublicCredentials(SimpleCredentials.class);
-		if (thisCredentials != null)
-			thisCredentials.clear();
-		if (adminPrincipals != null)
-			adminPrincipals.clear();
-		if (anonymousPrincipals != null)
-			anonymousPrincipals.clear();
+		clearPrincipals(AdminPrincipal.class);
+		clearPrincipals(ArgeoSystemPrincipal.class);
+		clearPrincipals(AnonymousPrincipal.class);
+		clearPrincipals(GrantedAuthorityPrincipal.class);
+
+		// we resync with Spring Security since the subject may have been reused
+		// in beetween
+		// TODO: check if this is clean
+		// subject.getPrincipals().addAll(syncPrincipals());
+
 		return true;
 	}
 
+	private <T extends Principal> void clearPrincipals(Class<T> clss) {
+		Set<T> principals = subject.getPrincipals(clss);
+		if (principals != null)
+			principals.clear();
+	}
+
 	@SuppressWarnings("rawtypes")
 	@Override
 	protected void doInit(CallbackHandler callbackHandler, Session session,