Add security

git-svn-id: https://svn.argeo.org/slc/trunk@2687 4cfe0d0a-d680-48aa-b62c-e0a02a3f76cc

diff --git a/runtime/org.argeo.slc.server/pom.xml b/runtime/org.argeo.slc.server/pom.xml
index 2303e9f5dece10ab11d1ce2f73198c5c2717e933..6f1792043bfd457244edcd36ef3a203dea081798 100644 (file)
--- a/runtime/org.argeo.slc.server/pom.xml
+++ b/runtime/org.argeo.slc.server/pom.xml
@@ -106,5 +106,22 @@
                        <groupId>com.lowagie.text</groupId>
                        <artifactId>com.springsource.com.lowagie.text</artifactId>
                </dependency>
+
+               <!-- Security -->
+               <dependency>
+                       <groupId>org.springframework.security</groupId>
+                       <artifactId>org.springframework.security</artifactId>
+               </dependency>
+
+               <dependency>
+                       <groupId>com.springsource.json</groupId>
+                       <artifactId>com.springsource.json</artifactId>
+                       <version>1.0.1.RELEASE</version>
+               </dependency>
+               <dependency>
+                       <groupId>org.antlr</groupId>
+                       <artifactId>com.springsource.org.antlr</artifactId>
+               </dependency>
+
        </dependencies>
 </project>

diff --git a/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/JsonView.java b/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/JsonView.java
new file mode 100644 (file)
index 0000000..10537ed
--- /dev/null
+++ b/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/JsonView.java
@@ -0,0 +1,52 @@
+package org.argeo.slc.web.mvc;
+
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.transform.stream.StreamResult;
+
+import org.argeo.slc.SlcException;
+import org.springframework.oxm.Marshaller;
+import org.springframework.web.servlet.view.AbstractView;
+
+import com.springsource.json.writer.JSONObject;
+
+/** Marshal one of the object of the map to the output. */
+public class JsonView extends AbstractView {
+       private String modelKey = null;
+
+       public JsonView() {
+       }
+
+       @Override
+       @SuppressWarnings(value = { "unchecked" })
+       protected void renderMergedOutputModel(Map model,
+                       HttpServletRequest request, HttpServletResponse response)
+                       throws Exception {
+               final Object answer;
+               if (modelKey != null) {
+                       if (!model.containsKey(modelKey))
+                               throw new SlcException("Key " + modelKey
+                                               + " not found in model.");
+                       answer = model.get(modelKey);
+               } else {
+                       if (model.size() != 1)
+                               throw new SlcException(
+                                               "Model has a size different from 1. Specify a modelKey.");
+                       answer = model.values().iterator().next();
+               }
+
+               if (answer instanceof JSONObject) {
+                       ((JSONObject) answer).write(response.getWriter());
+               } else {
+                       JSONObject jsonObject = new JSONObject(answer);
+                       jsonObject.write(response.getWriter());
+               }
+       }
+
+       public void setModelKey(String modelKey) {
+               this.modelKey = modelKey;
+       }
+
+}

diff --git a/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/management/GetCredentials.java b/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/management/GetCredentials.java
new file mode 100644 (file)
index 0000000..0e68ffe
--- /dev/null
+++ b/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/management/GetCredentials.java
@@ -0,0 +1,34 @@
+package org.argeo.slc.web.mvc.management;
+
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.web.HttpRequestHandler;
+
+import com.springsource.json.writer.JSONWriter;
+import com.springsource.json.writer.JSONWriterImpl;
+
+public class GetCredentials implements HttpRequestHandler {
+
+       public void handleRequest(HttpServletRequest request,
+                       HttpServletResponse response) throws ServletException, IOException {
+               Authentication authentication = SecurityContextHolder.getContext()
+                               .getAuthentication();
+
+               JSONWriter jsonWriter = new JSONWriterImpl(response.getWriter())
+                               .object().key("user").value(authentication.getName());
+               jsonWriter.key("roles").array();
+               for (GrantedAuthority ga : authentication.getAuthorities()) {
+                       jsonWriter.value(ga.getAuthority());
+               }
+               jsonWriter.endArray();
+               jsonWriter.endObject();
+       }
+
+}

diff --git a/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/result/ListResultsController.java b/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/result/ListResultsController.java
index 1759449f5d80aea535cb625f2d1b86fc328986a1..d63d5ddb428aed303a963179286669f848814c65 100644 (file)
--- a/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/result/ListResultsController.java
+++ b/runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/result/ListResultsController.java
@@ -33,7 +33,7 @@ public class ListResultsController extends AbstractServiceController {
                        throws Exception {\r
 \r
                log.debug("userPrincipal=" + request.getUserPrincipal());\r
-               log.debug("authType= " + request.getAuthType());\r
+               log.debug("authType=" + request.getAuthType());\r
                log.debug("remoteUser=" + request.getRemoteUser());\r
                log.debug("cookies=" + request.getCookies());\r
                log.debug("requestedSessionId=" + request.getRequestedSessionId());\r