1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34 package info.magnolia.jaas.sp.jcr;
35
36 import info.magnolia.cms.security.MgnlUser;
37 import info.magnolia.cms.security.MgnlUserManager;
38 import info.magnolia.cms.security.SecuritySupport;
39 import info.magnolia.cms.security.User;
40 import info.magnolia.cms.security.UserManager;
41 import info.magnolia.jaas.sp.AbstractLoginModule;
42 import info.magnolia.jaas.sp.UserAwareLoginModule;
43
44 import java.io.Serializable;
45 import java.security.Principal;
46 import java.util.Collections;
47 import java.util.HashMap;
48 import java.util.Map;
49
50 import javax.security.auth.login.AccountLockedException;
51 import javax.security.auth.login.AccountNotFoundException;
52 import javax.security.auth.login.FailedLoginException;
53 import javax.security.auth.login.LoginException;
54
55 import org.apache.commons.codec.binary.Base64;
56 import org.apache.commons.lang3.StringUtils;
57 import org.apache.jackrabbit.core.security.UserPrincipal;
58 import org.apache.jackrabbit.core.security.principal.AdminPrincipal;
59
60
61
62
63
64
65 @Deprecated
66
67 public class MagnoliaAuthenticationModule extends AbstractLoginModule implements UserAwareLoginModule, Serializable {
68 protected User user;
69
70
71
72
73 public class MagnoliaJRAdminPrincipal extends AdminPrincipal implements Principal, Serializable {
74 public MagnoliaJRAdminPrincipal(String name) {
75 super(name);
76 }
77 }
78
79
80
81
82
83
84 @Override
85 public void validateUser() throws LoginException {
86 initUser();
87
88 if (this.user == null) {
89 throw new AccountNotFoundException("User account " + this.name + " not found.");
90 }
91
92 matchPassword();
93
94 if (!this.user.isEnabled()) {
95 throw new AccountLockedException("User account " + this.name + " is locked.");
96 }
97
98 if (!UserManager.ANONYMOUS_USER.equals(user.getName()) && !isAdmin()) {
99
100 getUserManager().updateLastAccessTimestamp(user);
101 }
102 }
103
104 private UserManager getUserManager() {
105
106 if (!"admin".equals(name)) {
107 log.debug("getting user manager for realm {}", realm.getName());
108 }
109 return SecuritySupport.Factory.getInstance().getUserManager(realm.getName());
110 }
111
112
113 protected void initUser() throws LoginException {
114 if (!"admin".equals(name)) {
115 log.debug("initializing user {}", name);
116 }
117
118
119 if (isAdmin()) {
120 Map<String, String> props = new HashMap<String, String>();
121
122 props.put(MgnlUserManager.PROPERTY_PASSWORD, new String(Base64.encodeBase64("admin".getBytes())));
123 MgnlUser user = new MgnlUser(name, null, Collections.EMPTY_LIST, Collections.EMPTY_LIST, props);
124 this.user = user;
125
126 return;
127 }
128
129 long start = System.currentTimeMillis();
130 this.user = getUserManager().getUser(name);
131 if (!"admin".equals(name)) {
132 log.debug("initialized user {} in {}ms", name, (System.currentTimeMillis() - start));
133 }
134 }
135
136 protected void matchPassword() throws LoginException {
137 String serverPassword = user.getPassword();
138
139 if (StringUtils.isEmpty(serverPassword)) {
140 throw new FailedLoginException("we do not allow users with no password");
141 }
142
143 if (!StringUtils.equals(serverPassword, new String(this.pswd))) {
144 throw new FailedLoginException("passwords do not match");
145 }
146 }
147
148
149
150
151 @Override
152 public void setEntity() {
153 if (isAdmin()) {
154
155 this.subject.getPrincipals().add(new MagnoliaJRAdminPrincipal(name));
156
157 return;
158 } else if ("superuser".equals(name)) {
159
160 this.subject.getPrincipals().add(new MagnoliaJRAdminPrincipal(name));
161 } else {
162
163
164 this.subject.getPrincipals().add(new UserPrincipal(name));
165
166 }
167
168
169 this.subject.getPrincipals().add(this.user);
170 this.subject.getPrincipals().add(this.realm);
171
172
173 collectGroupNames();
174 collectRoleNames();
175 }
176
177 private boolean isAdmin() {
178 return this.name != null && this.name.equals("admin");
179 }
180
181
182
183
184 @Override
185 public void setACL() {
186 }
187
188
189
190
191 public void collectRoleNames() {
192 for (String role : this.user.getAllRoles()) {
193 addRoleName(role);
194 }
195 }
196
197
198
199
200 public void collectGroupNames() {
201 for (String group : this.user.getAllGroups()) {
202 addGroupName(group);
203 }
204 }
205
206 @Override
207 public User getUser() {
208 return user;
209 }
210 }