X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.ldap%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fldap%2Fjcr%2FJcrLdapSynchronizer.java;h=178785602d5aa7eff0ad8d5583c39210f0350fb0;hb=2134dd19734711b05710c1250b665c32fbe7263c;hp=632ea58c8778e8c92fab438744faf1cfc98885be;hpb=6a3abb7baeb17b06ab05fb9a35056e3e224698ad;p=lgpl%2Fargeo-commons.git

diff --git a/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java b/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java
index 632ea58c8..178785602 100644
--- a/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java
+++ b/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java
@@ -1,3 +1,18 @@
+/*
+ * Copyright (C) 2007-2012 Mathieu Baudier
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package org.argeo.security.ldap.jcr;
 
 import java.security.NoSuchAlgorithmException;
@@ -20,6 +35,7 @@ import javax.jcr.observation.Event;
 import javax.jcr.observation.EventIterator;
 import javax.jcr.observation.EventListener;
 import javax.jcr.query.Query;
+import javax.jcr.version.VersionManager;
 import javax.naming.Binding;
 import javax.naming.Name;
 import javax.naming.NamingException;
@@ -43,6 +59,7 @@ import org.argeo.ArgeoException;
 import org.argeo.jcr.ArgeoNames;
 import org.argeo.jcr.ArgeoTypes;
 import org.argeo.jcr.JcrUtils;
+import org.argeo.jcr.security.SecurityJcrUtils;
 import org.argeo.security.jcr.JcrUserDetails;
 import org.springframework.ldap.core.ContextExecutor;
 import org.springframework.ldap.core.ContextMapper;
@@ -185,10 +202,21 @@ public class JcrLdapSynchronizer implements UserDetailsContextMapper,
 				Node userProfile = it.nextNode();
 				String path = userProfile.getPath();
 				if (!userPaths.contains(path)) {
+					log.warn("Path "
+							+ path
+							+ " not found in LDAP, disabling user "
+							+ userProfile.getProperty(ArgeoNames.ARGEO_USER_ID)
+									.getString());
+					VersionManager versionManager = securitySession
+							.getWorkspace().getVersionManager();
+					versionManager.checkout(userProfile.getPath());
 					userProfile.setProperty(ArgeoNames.ARGEO_ENABLED, false);
+					securitySession.save();
+					versionManager.checkin(userProfile.getPath());
 				}
 			}
 		} catch (Exception e) {
+			JcrUtils.discardQuietly(securitySession);
 			throw new ArgeoException("Cannot synchronized LDAP and JCR", e);
 		}
 	}
@@ -196,11 +224,12 @@ public class JcrLdapSynchronizer implements UserDetailsContextMapper,
 	/** Called during authentication in order to retrieve user details */
 	public UserDetails mapUserFromContext(final DirContextOperations ctx,
 			final String username, GrantedAuthority[] authorities) {
+		log.debug("mapUserFromContext");
 		if (ctx == null)
 			throw new ArgeoException("No LDAP information for user " + username);
-		Node userHome = JcrUtils.getUserHome(securitySession, username);
-		if (userHome == null)
-			throw new ArgeoException("No JCR information for user " + username);
+		Node userProfile = SecurityJcrUtils.createUserProfileIfNeeded(securitySession,
+				username);
+		JcrUserDetails.checkAccountStatus(userProfile);
 
 		// password
 		SortedSet<?> passwordAttributes = ctx
@@ -216,8 +245,7 @@ public class JcrLdapSynchronizer implements UserDetailsContextMapper,
 		}
 
 		try {
-			return new JcrUserDetails(userHome.getNode(ARGEO_PROFILE),
-					password, authorities);
+			return new JcrUserDetails(userProfile, password, authorities);
 		} catch (RepositoryException e) {
 			throw new ArgeoException("Cannot retrieve user details for "
 					+ username, e);
@@ -234,7 +262,7 @@ public class JcrLdapSynchronizer implements UserDetailsContextMapper,
 		try {
 			// process
 			String username = ctx.getStringAttribute(usernameAttribute);
-			Node userHome = JcrUtils.createUserHomeIfNeeded(session, username);
+			Node userHome = SecurityJcrUtils.createUserHomeIfNeeded(session, username);
 			Node userProfile; // = userHome.getNode(ARGEO_PROFILE);
 			if (userHome.hasNode(ARGEO_PROFILE)) {
 				userProfile = userHome.getNode(ARGEO_PROFILE);
@@ -253,7 +281,7 @@ public class JcrLdapSynchronizer implements UserDetailsContextMapper,
 							.checkin(userProfile.getPath());
 				}
 			} else {
-				userProfile = JcrUtils.createUserProfile(securitySession,
+				userProfile = SecurityJcrUtils.createUserProfile(securitySession,
 						username);
 				userProfile.getSession().save();
 				userProfile.getSession().getWorkspace().getVersionManager()