X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.jackrabbit%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fjackrabbit%2FArgeoSecurityManager.java;h=96260b426f466ca5b69185c4f432d4672ca21df8;hb=19f918960dfca4fd10de1fbe33554b8e1ce3b62c;hp=c68a0c9785637d14693b932c0ffc40ffc87ef5cb;hpb=afd41f657b0eecb1e9a1db85af8bff0cc7bc4804;p=lgpl%2Fargeo-commons.git

diff --git a/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java b/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
index c68a0c978..96260b426 100644
--- a/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
+++ b/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
@@ -14,8 +14,6 @@ import javax.jcr.RepositoryException;
 import javax.jcr.Session;
 import javax.jcr.Value;
 import javax.jcr.ValueFactory;
-import javax.jcr.security.AccessControlPolicy;
-import javax.jcr.security.AccessControlPolicyIterator;
 import javax.jcr.security.Privilege;
 import javax.security.auth.Subject;
 
@@ -29,7 +27,6 @@ import org.apache.jackrabbit.api.security.user.User;
 import org.apache.jackrabbit.api.security.user.UserManager;
 import org.apache.jackrabbit.core.DefaultSecurityManager;
 import org.apache.jackrabbit.core.security.SecurityConstants;
-import org.apache.jackrabbit.core.security.SystemPrincipal;
 import org.apache.jackrabbit.core.security.authorization.WorkspaceAccessManager;
 import org.argeo.ArgeoException;
 import org.argeo.jcr.JcrUtils;
@@ -38,17 +35,22 @@ import org.springframework.security.GrantedAuthority;
 
 /** Intermediary class in order to have a consistent naming in config files. */
 public class ArgeoSecurityManager extends DefaultSecurityManager {
-	public final static String HOME_BASE_PATH = "/home";
-
 	private Log log = LogFactory.getLog(ArgeoSecurityManager.class);
 
+	/**
+	 * Since this is called once when the session is created, we take the
+	 * opportunity to make sure that Jackrabbit users and groups reflect Spring
+	 * Security name and authorities.
+	 */
 	@Override
-	/** Since this is called once when the session is created, we take the opportunity to synchronize Spring and Jackrabbit users and groups.*/
 	public String getUserID(Subject subject, String workspaceName)
 			throws RepositoryException {
 		long begin = System.currentTimeMillis();
 
-		if (!subject.getPrincipals(SystemPrincipal.class).isEmpty())
+		if (log.isTraceEnabled())
+			log.trace(subject);
+		// skip Jackrabbit system user
+		if (!subject.getPrincipals(ArgeoSystemPrincipal.class).isEmpty())
 			return super.getUserID(subject, workspaceName);
 
 		Authentication authen;
@@ -67,11 +69,10 @@ public class ArgeoSecurityManager extends DefaultSecurityManager {
 		if (user == null) {
 			user = systemUm.createUser(userId, authen.getCredentials()
 					.toString(), authen, null);
+			setSecurityHomeAuthorizations(user);
 			log.info(userId + " added as " + user);
 		}
 
-		setHomeNodeAuthorizations(user);
-
 		// process groups
 		List<String> userGroupIds = new ArrayList<String>();
 		for (GrantedAuthority ga : authen.getAuthorities()) {
@@ -83,7 +84,6 @@ public class ArgeoSecurityManager extends DefaultSecurityManager {
 			if (!group.isMember(user))
 				group.addMember(user);
 			userGroupIds.add(ga.getAuthority());
-
 		}
 
 		// check if user has not been removed from some groups
@@ -93,59 +93,52 @@ public class ArgeoSecurityManager extends DefaultSecurityManager {
 				group.removeMember(user);
 		}
 
-		if (log.isTraceEnabled())
-			log.trace("Spring and Jackrabbit Security synchronized for user "
+		if (log.isDebugEnabled())
+			log.debug("Spring and Jackrabbit Security synchronized for user "
 					+ userId + " in " + (System.currentTimeMillis() - begin)
 					+ " ms");
 		return userId;
 	}
 
-	protected void setHomeNodeAuthorizations(User user) {
-		// give all privileges on user home
-		// FIXME: fails on an empty repo
+	protected synchronized void setSecurityHomeAuthorizations(User user) {
+		// give read privileges on user home
 		String userId = "<not yet set>";
 		try {
 			userId = user.getID();
-			Node userHome = null;
-			try {
-				userHome = JcrUtils.getUserHome(getSystemSession(), userId);
-				if (userHome == null)
-					userHome = JcrUtils.createUserHome(getSystemSession(),
-							HOME_BASE_PATH, userId);
-			} catch (Exception e) {
-				// silent
+			Node userHome = JcrUtils.getUserHome(getSystemSession(), userId);
+			if (userHome == null)
+				throw new ArgeoException("No security home available for user "
+						+ userId);
+
+			String path = userHome.getPath();
+			Principal principal = user.getPrincipal();
+
+			JackrabbitAccessControlManager acm = (JackrabbitAccessControlManager) getSystemSession()
+					.getAccessControlManager();
+			JackrabbitAccessControlPolicy[] ps = acm
+					.getApplicablePolicies(principal);
+			if (ps.length == 0) {
+				// log.warn("No ACL found for " + user);
+				return;
 			}
 
-			if (userHome != null) {
-				String path = userHome.getPath();
-				Principal principal = user.getPrincipal();
-
-				JackrabbitAccessControlManager acm = (JackrabbitAccessControlManager) getSystemSession()
-						.getAccessControlManager();
-				JackrabbitAccessControlPolicy[] ps = acm
-						.getApplicablePolicies(principal);
-				if (ps.length == 0) {
-					log.warn("No ACL found for " + user);
-					return;
-				}
-
-				JackrabbitAccessControlList list = (JackrabbitAccessControlList) ps[0];
-
-				// add entry
-				Privilege[] privileges = new Privilege[] { acm
-						.privilegeFromName(Privilege.JCR_ALL) };
-				Map<String, Value> restrictions = new HashMap<String, Value>();
-				ValueFactory vf = getSystemSession().getValueFactory();
-				restrictions.put("rep:nodePath",
-						vf.createValue(path, PropertyType.PATH));
-				restrictions.put("rep:glob", vf.createValue("*"));
-				list.addEntry(principal, privileges, true /* allow or deny */,
-						restrictions);
-			}
+			JackrabbitAccessControlList list = (JackrabbitAccessControlList) ps[0];
+
+			// add entry
+			Privilege[] privileges = new Privilege[] { acm
+					.privilegeFromName(Privilege.JCR_READ) };
+			Map<String, Value> restrictions = new HashMap<String, Value>();
+			ValueFactory vf = getSystemSession().getValueFactory();
+			restrictions.put("rep:nodePath",
+					vf.createValue(path, PropertyType.PATH));
+			restrictions.put("rep:glob", vf.createValue("*"));
+			list.addEntry(principal, privileges, true /* allow or deny */,
+					restrictions);
 		} catch (Exception e) {
 			e.printStackTrace();
-			log.warn("Cannot set authorization on user node for " + userId
-					+ ": " + e.getMessage());
+			throw new ArgeoException(
+					"Cannot set authorization on security home for " + userId
+							+ ": " + e.getMessage());
 		}
 
 	}