| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.jackrabbit.oak.security.authentication.token; |
| |
| import java.io.IOException; |
| import java.security.Principal; |
| import java.util.Collections; |
| import java.util.HashMap; |
| import java.util.Map; |
| import java.util.Set; |
| import javax.jcr.Credentials; |
| import javax.security.auth.callback.Callback; |
| import javax.security.auth.callback.UnsupportedCallbackException; |
| import javax.security.auth.login.LoginException; |
| |
| import org.apache.jackrabbit.api.security.authentication.token.TokenCredentials; |
| import org.apache.jackrabbit.oak.api.AuthInfo; |
| import org.apache.jackrabbit.oak.api.Root; |
| import org.apache.jackrabbit.oak.spi.security.SecurityProvider; |
| import org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule; |
| import org.apache.jackrabbit.oak.spi.security.authentication.AuthInfoImpl; |
| import org.apache.jackrabbit.oak.spi.security.authentication.callback.TokenProviderCallback; |
| import org.apache.jackrabbit.oak.spi.security.authentication.token.TokenConfiguration; |
| import org.apache.jackrabbit.oak.spi.security.authentication.token.TokenInfo; |
| import org.apache.jackrabbit.oak.spi.security.authentication.token.TokenProvider; |
| import org.jetbrains.annotations.NotNull; |
| import org.jetbrains.annotations.Nullable; |
| import org.slf4j.Logger; |
| import org.slf4j.LoggerFactory; |
| |
| /** |
| * {@code LoginModule} implementation that is able to handle login request |
| * based on {@link TokenCredentials}. In combination with another login module |
| * that handles other {@code Credentials} implementation this module will also |
| * take care of creating new login tokens and the corresponding credentials |
| * upon {@link #commit()}that it will be able to deal with in subsequent |
| * login calls. |
| * |
| * <h2>Login and Commit</h2> |
| * <h3>Login</h3> |
| * This {@code LoginModule} implementation performs the following tasks upon |
| * {@link #login()}. |
| * |
| * <ol> |
| * <li>Try to retrieve {@link TokenCredentials} credentials (see also |
| * {@link AbstractLoginModule#getCredentials()})</li> |
| * <li>Validates the credentials based on the functionality provided by |
| * {@link TokenAuthentication#authenticate(javax.jcr.Credentials)}</li> |
| * <li>Upon success it retrieves {@code userId} from the {@link org.apache.jackrabbit.oak.spi.security.authentication.token.TokenInfo} |
| * and calculates the principals associated with that user,</li> |
| * <li>and finally puts the credentials on the shared state.</li> |
| * </ol> |
| * |
| * If no {@code TokenProvider} has been configured {@link #login()} or if |
| * no {@code TokenCredentials} can be obtained this module will return {@code false}. |
| * |
| * <h3>Commit</h3> |
| * If login was successfully handled by this module the {@link #commit()} will |
| * just populate the subject.<p> |
| * |
| * If the login was successfully handled by another module in the chain, the |
| * {@code TokenLoginModule} will test if the login was associated with a |
| * request for login token generation. This mandates that there are credentials |
| * present on the shared state that fulfill the requirements defined by |
| * {@link org.apache.jackrabbit.oak.spi.security.authentication.token.TokenProvider#doCreateToken(javax.jcr.Credentials)}. |
| * |
| * <h3>Example Configurations</h3> |
| * The authentication configuration using this {@code LoginModule} could for |
| * example look as follows: |
| * |
| * <h4>TokenLoginModule in combination with another LoginModule</h4> |
| * <pre> |
| * jackrabbit.oak { |
| * org.apache.jackrabbit.oak.security.authentication.token.TokenLoginModule sufficient; |
| * org.apache.jackrabbit.oak.security.authentication.user.LoginModuleImpl required; |
| * }; |
| * </pre> |
| * In this case the TokenLoginModule would handle any login issued with |
| * {@link TokenCredentials} while the second module would take care any other |
| * credentials implementations as long they are supported by the module. In |
| * addition the {@link TokenLoginModule} will issue a new token if the login |
| * succeeded and the credentials provided by the shared state can be used |
| * to issue a new login token (see {@link org.apache.jackrabbit.oak.spi.security.authentication.token.TokenProvider#doCreateToken(javax.jcr.Credentials)}. |
| * |
| * <h4>TokenLoginModule as single way to login</h4> |
| * <pre> |
| * jackrabbit.oak { |
| * org.apache.jackrabbit.oak.security.authentication.token.TokenLoginModule required; |
| * }; |
| * </pre> |
| * If the {@code TokenLoginModule} as single entry in the login configuration |
| * the login token must be generated by the application by calling |
| * {@link org.apache.jackrabbit.oak.spi.security.authentication.token.TokenProvider#createToken(Credentials)} or |
| * {@link org.apache.jackrabbit.oak.spi.security.authentication.token.TokenProvider#createToken(String, java.util.Map)}. |
| */ |
| public final class TokenLoginModule extends AbstractLoginModule { |
| |
| /** |
| * logger instance |
| */ |
| private static final Logger log = LoggerFactory.getLogger(TokenLoginModule.class); |
| |
| private TokenProvider tokenProvider; |
| |
| private TokenCredentials tokenCredentials; |
| private TokenInfo tokenInfo; |
| private String userId; |
| private Principal principal; |
| |
| //--------------------------------------------------------< LoginModule >--- |
| @Override |
| public boolean login() throws LoginException { |
| tokenProvider = getTokenProvider(); |
| if (tokenProvider == null) { |
| return false; |
| } |
| |
| Credentials credentials = getCredentials(); |
| if (credentials instanceof TokenCredentials) { |
| TokenCredentials tc = (TokenCredentials) credentials; |
| TokenAuthentication authentication = new TokenAuthentication(tokenProvider); |
| if (authentication.authenticate(tc)) { |
| tokenCredentials = tc; |
| tokenInfo = authentication.getTokenInfo(); |
| userId = authentication.getUserId(); |
| principal = authentication.getUserPrincipal(); |
| |
| log.debug("Login: adding login name to shared state."); |
| sharedState.put(SHARED_KEY_LOGIN_NAME, userId); |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| @Override |
| public boolean commit() throws LoginException { |
| if (tokenCredentials != null && userId != null) { |
| Set<? extends Principal> principals = (principal != null) ? getPrincipals(principal) : getPrincipals(userId); |
| updateSubject(tokenCredentials, getAuthInfo(tokenInfo, principals), principals); |
| return true; |
| } |
| try{ |
| if (tokenProvider != null && sharedState.containsKey(SHARED_KEY_CREDENTIALS)) { |
| Credentials shared = getSharedCredentials(); |
| if (shared != null && tokenProvider.doCreateToken(shared)) { |
| Root r = getRoot(); |
| if (r != null) { |
| r.refresh(); // refresh root, in case the external login module created users |
| } |
| TokenInfo ti = tokenProvider.createToken(shared); |
| if (ti != null) { |
| TokenCredentials tc = new TokenCredentials(ti.getToken()); |
| Map<String, String> attributes = ti.getPrivateAttributes(); |
| for (String name : attributes.keySet()) { |
| tc.setAttribute(name, attributes.get(name)); |
| } |
| attributes = ti.getPublicAttributes(); |
| for (String name : attributes.keySet()) { |
| tc.setAttribute(name, attributes.get(name)); |
| } |
| sharedState.put(SHARED_KEY_ATTRIBUTES, attributes); |
| updateSubject(tc, null, null); |
| } else { |
| // failed to create token -> fail commit() |
| Object logId = (userId != null) ? userId : sharedState.get(SHARED_KEY_LOGIN_NAME); |
| log.debug("TokenProvider failed to create a login token for user " + logId); |
| throw new LoginException("Failed to create login token for user " + logId); |
| } |
| } |
| } |
| } finally { |
| // the login attempt on this module did not succeed: clear state |
| clearState(); |
| } |
| |
| return false; |
| } |
| |
| //------------------------------------------------< AbstractLoginModule >--- |
| @NotNull |
| @Override |
| protected Set<Class> getSupportedCredentials() { |
| return Collections.<Class>singleton(TokenCredentials.class); |
| } |
| |
| @Override |
| protected void clearState() { |
| super.clearState(); |
| |
| tokenCredentials = null; |
| tokenInfo = null; |
| userId = null; |
| } |
| |
| //------------------------------------------------------------< private >--- |
| |
| /** |
| * Retrieve the token provider |
| * @return the token provider or {@code null}. |
| */ |
| @Nullable |
| private TokenProvider getTokenProvider() { |
| TokenProvider provider = null; |
| SecurityProvider securityProvider = getSecurityProvider(); |
| Root root = getRoot(); |
| if (root != null && securityProvider != null) { |
| TokenConfiguration tokenConfig = securityProvider.getConfiguration(TokenConfiguration.class); |
| provider = tokenConfig.getTokenProvider(root); |
| } |
| if (provider == null && callbackHandler != null) { |
| try { |
| TokenProviderCallback tcCallback = new TokenProviderCallback(); |
| callbackHandler.handle(new Callback[] {tcCallback}); |
| provider = tcCallback.getTokenProvider(); |
| } catch (IOException e) { |
| log.warn(e.getMessage()); |
| } catch (UnsupportedCallbackException e) { |
| log.warn(e.getMessage()); |
| } |
| } |
| return provider; |
| } |
| |
| /** |
| * Create the {@code AuthInfo} for the specified {@code tokenInfo} as well as |
| * userId and principals, that have been set upon {@link #login}. |
| * |
| * @param tokenInfo The tokenInfo to retrieve attributes from. |
| * @return The {@code AuthInfo} resulting from the successful login. |
| */ |
| @Nullable |
| private AuthInfo getAuthInfo(@Nullable TokenInfo tokenInfo, @NotNull Set<? extends Principal> principals) { |
| if (tokenInfo != null) { |
| Map<String, Object> attributes = new HashMap<String, Object>(); |
| Map<String, String> publicAttributes = tokenInfo.getPublicAttributes(); |
| for (String attrName : publicAttributes.keySet()) { |
| attributes.put(attrName, publicAttributes.get(attrName)); |
| } |
| return new AuthInfoImpl(tokenInfo.getUserId(), attributes, principals); |
| } else { |
| return null; |
| } |
| } |
| |
| private void updateSubject(@NotNull TokenCredentials tc, @Nullable AuthInfo authInfo, |
| @Nullable Set<? extends Principal> principals) { |
| if (!subject.isReadOnly()) { |
| subject.getPublicCredentials().add(tc); |
| |
| if (principals != null) { |
| subject.getPrincipals().addAll(principals); |
| } |
| |
| if (authInfo != null) { |
| setAuthInfo(authInfo, subject); |
| } |
| } |
| } |
| } |
