1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34 package info.magnolia.jaas.sp.jcr;
35
36 import info.magnolia.cms.security.MgnlUser;
37 import info.magnolia.cms.security.MgnlUserManager;
38 import info.magnolia.cms.security.SecuritySupport;
39 import info.magnolia.cms.security.User;
40 import info.magnolia.cms.security.UserManager;
41 import info.magnolia.jaas.sp.AbstractLoginModule;
42 import info.magnolia.jaas.sp.UserAwareLoginModule;
43
44 import java.io.Serializable;
45 import java.security.Principal;
46 import java.util.Collections;
47 import java.util.HashMap;
48 import java.util.Map;
49
50 import javax.security.auth.login.AccountLockedException;
51 import javax.security.auth.login.AccountNotFoundException;
52 import javax.security.auth.login.FailedLoginException;
53 import javax.security.auth.login.LoginException;
54
55 import org.apache.commons.codec.binary.Base64;
56 import org.apache.commons.lang.StringUtils;
57 import org.apache.jackrabbit.core.security.UserPrincipal;
58 import org.apache.jackrabbit.core.security.principal.AdminPrincipal;
59
60
61
62
63
64 public class MagnoliaAuthenticationModule extends AbstractLoginModule implements UserAwareLoginModule, Serializable {
65
66 private static final boolean logAdmin = false;
67 protected User user;
68
69
70
71
72 public class MagnoliaJRAdminPrincipal extends AdminPrincipal implements Principal, Serializable {
73 public MagnoliaJRAdminPrincipal(String name) {
74 super(name);
75 }
76 }
77
78
79
80
81
82 @Override
83 public void validateUser() throws LoginException {
84 initUser();
85
86 if (this.user == null) {
87 throw new AccountNotFoundException("User account " + this.name + " not found.");
88 }
89
90 matchPassword();
91
92 if (!this.user.isEnabled()) {
93 throw new AccountLockedException("User account " + this.name + " is locked.");
94 }
95
96 if (!UserManager.ANONYMOUS_USER.equals(user.getName()) && !isAdmin()) {
97
98 getUserManager().updateLastAccessTimestamp(user);
99 }
100 }
101
102 private UserManager getUserManager() {
103
104 if (logAdmin || !"admin".equals(name)) {
105 log.debug("getting user manager for realm " + realm.getName());
106 }
107 return SecuritySupport.Factory.getInstance().getUserManager(realm.getName());
108 }
109
110
111
112 protected void initUser() throws LoginException {
113 if (logAdmin || !"admin".equals(name)) {
114 log.debug("initializing user {}", name);
115 }
116
117
118 if (isAdmin()) {
119 Map<String, String> props = new HashMap<String, String>();
120
121 props.put(MgnlUserManager.PROPERTY_PASSWORD, new String(Base64.encodeBase64("admin".getBytes())));
122 MgnlUser user = new MgnlUser(name, null, Collections.EMPTY_LIST, Collections.EMPTY_LIST,props);
123 this.user = user;
124
125 return;
126 }
127
128 long start = System.currentTimeMillis();
129 this.user = getUserManager().getUser(name);
130 if (logAdmin || !"admin".equals(name)) {
131 log.debug("initialized user {} in {}ms", name, (System.currentTimeMillis() - start));
132 }
133 }
134
135 protected void matchPassword() throws LoginException {
136 String serverPassword = user.getPassword();
137
138 if (StringUtils.isEmpty(serverPassword)) {
139 throw new FailedLoginException("we do not allow users with no password");
140 }
141
142 if (!StringUtils.equals(serverPassword, new String(this.pswd))) {
143 throw new FailedLoginException("passwords do not match");
144 }
145 }
146
147
148
149
150 @Override
151 public void setEntity() {
152 if (isAdmin()) {
153
154 this.subject.getPrincipals().add(new MagnoliaJRAdminPrincipal(name));
155
156 return;
157 } else if ("superuser".equals(name)) {
158
159 this.subject.getPrincipals().add(new MagnoliaJRAdminPrincipal(name));
160 } else {
161
162
163 this.subject.getPrincipals().add(new UserPrincipal(name));
164
165 }
166
167
168 this.subject.getPrincipals().add(this.user);
169 this.subject.getPrincipals().add(this.realm);
170
171
172 collectGroupNames();
173 collectRoleNames();
174 }
175
176 private boolean isAdmin() {
177
178 return this.name != null && this.name.equals("admin");
179 }
180
181
182
183
184 @Override
185 public void setACL() {
186 }
187
188
189
190
191 public void collectRoleNames() {
192 for (String role : this.user.getAllRoles()) {
193 addRoleName(role);
194 }
195 }
196
197
198
199
200 public void collectGroupNames() {
201 for (String group : this.user.getAllGroups()) {
202 addGroupName(group);
203 }
204 }
205
206 @Override
207 public User getUser() {
208 return user;
209 }
210 }