[gatein-commits] gatein SVN: r7404 - in epp/portal/branches/EPP_5_2_Branch: distribution/jboss-epp/serverAddon/src/main/resources/conf/gatein/gadgets and 1 other directories.

Author: theute Date: 2011-09-14 04:05:34 -0400 (Wed, 14 Sep 2011) New Revision: 7404 Added: epp/portal/branches/EPP_5_2_Branch/distribution/jboss-epp/serverAddon/src/main/resources/conf/gatein/gadgets/ epp/portal/branches/EPP_5_2_Branch/distribution/jboss-epp/serverAddon/src/main/resources/conf/gatein/gadgets/oauthkey.pem Modified: epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoContainerConfig.java epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoDefaultSecurityTokenGenerator.java epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoOAuthModule.java Log: JBEPP-1167: Gadgets dont work under loadbalancing Added: epp/portal/branches/EPP_5_2_Branch/distribution/jboss-epp/serverAddon/src/main/resources/conf/gatein/gadgets/oauthkey.pem =================================================================== --- epp/portal/branches/EPP_5_2_Branch/distribution/jboss-epp/serverAddon/src/main/resources/conf/gatein/gadgets/oauthkey.pem (rev 0) +++ epp/portal/branches/EPP_5_2_Branch/distribution/jboss-epp/serverAddon/src/main/resources/conf/gatein/gadgets/oauthkey.pem 2011-09-14 08:05:34 UTC (rev 7404) @@ -0,0 +1,16 @@ +-----BEGIN PRIVATE KEY----- +MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMxjO7Zklvoy3z1H +GNhw9vTVyUydrs8lOb5Sd4NgQsqMboRng276/wOLt7Y/Gk2VbhwLBSISSJYGtkfx +LVxrPgJggAb5WYpdlcGCY0Ig2BFXM22PT8TjGLljP4bW4YKRoH7WaF4laR7Ws7pK +Avq0nkuYRgIYa7SaP6/EPxbaLicHAgMBAAECgYAlLXPCJJ/12OUUj2csj7fMJ0sb +fZ87nMjZHsUQh6T+lPbRbMbSnCNg8Lw1EVtme2TxAuwnG25Ko+PqSCt5ISTBFH9g +ZUij/Eivjq/CX9bJ0wsomWO+74TtjjKNgdtfj4UNFIv6G44w02seCczLxaemW+25 +bks1XiQPeLNTfuPFAQJBAPXmt77wncLw7qbC3z7kR3pr7X4Eh0WCAUWlXigLYAoT +XX52fDEPlnIHvuyDqwJtxZstNc7Kn8IIBjxuSn1ls4ECQQDUyA/tkpRSu2sgiDRV +hpNMfbiIxZM6w9uA1aD0OUvOYhqAceaaYsI7qAVPTluw09wW/lrbmb6NPXJ++O4o +s36HAkEAkcPnjj9SNZnezmncLorhuDc8PCRxD4oGOQPTMce0caSTGoEgE3EbDJN8 +4PUYLUNnDRqat++zDjD1iWMTswvTgQJAetcg8uube4O9neNkKzftE8zE2xkNHXDy +6Rbru/LUA8r5N8wJ8HkxXxVqM1Wuc5Br0E55j6vbqVifIBSAEblGQwJAdbmoUNia +AmNvfz67DF3nfMbLqb4l3uR2caaz1Xik93VvbVYD/mdzGukVrPk4U8u2/bOsphUE +CPS2uizmGzwXCQ== +-----END PRIVATE KEY----- Modified: epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoContainerConfig.java =================================================================== --- epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoContainerConfig.java 2011-09-14 08:03:19 UTC (rev 7403) +++ epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoContainerConfig.java 2011-09-14 08:05:34 UTC (rev 7404) @@ -29,8 +29,9 @@ import org.apache.shindig.config.ContainerConfigException; import org.apache.shindig.config.JsonContainerConfig; import org.apache.shindig.expressions.Expressions; +import org.exoplatform.commons.utils.PropertyManager; import org.exoplatform.commons.utils.Safe; -import org.exoplatform.container.monitor.jvm.J2EEServerInfo; +import org.exoplatform.container.RootContainer; import org.exoplatform.services.log.ExoLogger; import org.exoplatform.services.log.Log; @@ -42,19 +43,19 @@ import java.security.SecureRandom; /** - * <p>The goal of the container config subclass is to integrate security key file along + * <p>The goal of the container config subclass is to integrate security key files along * with exo configuration.</p> - * - * <p>The implementation first determine the most relevant directory for performing the key lookup. - * It will look for a <i>gadgets</i> directory under the configuration directory returned by the - * {@link org.exoplatform.container.monitor.jvm.J2EEServerInfo#getExoConfigurationDirectory()} - * method. If no such valid directory can be found then the implementation use the current execution directory + * <p> + * The implementation first determine the most relevant locations of key files for performing the lookup. + * Ideally it will take ones configured as properties <i>gatein.gadgets.securityTokenKeyFile</i> + * and <i>gatein.gadgets.signingKeyFile</i> in the <i>configuration.properties</i>. + * If these properties are not configured, then the implementation uses the current execution directory * (which should be /bin in tomcat and jboss).</p> * - * <p>When the lookup directory is determined, the implementation looks for a file named key.txt. - * If no such file is found, then it will attempt to create it with a base 64 value encoded from + * <p>When the lookup file locations are determined, the implementation looks for these key files. + * If no such files are found, then it will attempt to create them with a base 64 value encoded from * a 32 bytes random sequence generated by {@link SecureRandom} seeded by the current time. If the - * file exist already but is a directory then no acton is done.<p> + * file exist already but is a directory then no action is done.<p> * * @author <a href="mailto:julien.viet@exoplatform.com">Julien Viet</a> * @version $Revision$ @@ -69,7 +70,8 @@ private Log log = ExoLogger.getLogger(ExoContainerConfig.class); /** . */ - private static volatile String _keyPath; + private static volatile String tokenKey_; + private String signingKey_; @Inject public ExoContainerConfig((a)Named(&quot;shindig.containers.default&quot;) String s, Expressions expressions) @@ -77,109 +79,134 @@ { super(s, expressions); - // - J2EEServerInfo info = new J2EEServerInfo(); + // This ensures RootContainer initialized first + // to populate properties in configuration.properties into PropertyManager + RootContainer.getInstance(); + + initializeTokenKeyFile(); + initializeSigningKeyFile(); + } + + private void initializeTokenKeyFile() + { + String keyPath = PropertyManager.getProperty("gatein.gadgets.securityTokenKeyFile"); + + File tokenKeyFile = null; + if (keyPath == null) + { + log.warn("The gadgets token key is not configured. The default key.txt file in /bin will be used"); + tokenKeyFile = new File("key.txt"); + } + else + { + tokenKeyFile = new File(keyPath); + } + + boolean isCreated = initializeKeyFile(tokenKeyFile); + if (isCreated) + { + setTokenKeyPath(tokenKeyFile.getAbsolutePath()); + } + } - // - String confPath = info.getExoConfigurationDirectory(); - - File keyFile = null; - if (confPath != null) + private void initializeSigningKeyFile() + { + String signingKey = PropertyManager.getProperty("gatein.gadgets.signingKeyFile"); + + File signingKeyFile; + if (signingKey == null) { - File confDir = new File(confPath); - if (!confDir.exists()) + log.warn("The gadgets signing key is not configured. The default oauthkey.pem file in /bin will be used"); + signingKeyFile = new File("oauthkey.pem"); + } + else + { + signingKeyFile = new File(signingKey); + } + + boolean isCreated = initializeKeyFile(signingKeyFile); + if (isCreated) + { + signingKey_ = signingKeyFile.getAbsolutePath(); + } + } + + private boolean initializeKeyFile(File file) + { + String keyPath = file.getAbsolutePath(); + if (file.exists()) + { + if (file.isFile()) { - log.debug("Exo conf directory (" + confPath + ") does not exist"); + log.info("Found key file " + keyPath + " for gadgets security"); } else { - if (!confDir.isDirectory()) - { - log.debug("Exo conf directory (" + confPath + ") is not a directory"); - } - else - { - keyFile = new File(confDir, "gadgets/key.txt"); - } + log.error("Found path file " + keyPath + " but it's not a key file"); } } - - if (keyFile == null) + else { - keyFile = new File("key.txt"); - } - - String keyPath = keyFile.getAbsolutePath(); - - if (!keyFile.exists()) - { - log.debug("No key file found at path " + keyPath + " generating a new key and saving it"); - File fic = keyFile.getAbsoluteFile(); + log.debug("No key file found at path " + keyPath + ". it's generating a new key and saving it"); + File fic = file.getAbsoluteFile(); File parentFolder = fic.getParentFile(); - if (!parentFolder.exists()) - parentFolder.mkdirs(); + if (!parentFolder.exists()) { + if (!parentFolder.mkdirs()) + { + log.error("Coult not create parent folder/s for the key file " + keyPath); + return false; + } + } String key = generateKey(); Writer out = null; try { - out = new FileWriter(keyFile); + out = new FileWriter(file); out.write(key); out.write('\n'); - log.info("Generated key file " + keyPath + " for eXo Gadgets"); - setKeyPath(keyPath); + log.debug("Generated key file " + keyPath + " for eXo Gadgets"); } catch (IOException e) { - log.error("Coult not create key file " + keyPath, e); + log.error("Could not create key file " + keyPath, e); + return false; } finally { Safe.close(out); } } - else if (!keyFile.isFile()) - { - log.debug("Found key file " + keyPath + " but it's not a file"); - } - else - { - log.info("Found key file " + keyPath + " for gadgets security"); - setKeyPath(keyPath); - } + return true; } - - private void setKeyPath(String keyPath) + + private void setTokenKeyPath(String keyPath) { // _keyPath is volatile so no concurrent writes and read are safe synchronized (ExoContainerConfig.class) { - if (_keyPath != null && !_keyPath.equals(keyPath)) + if (tokenKey_ != null && !tokenKey_.equals(keyPath)) { - throw new IllegalStateException("There is already a configured key path old=" + _keyPath + " new=" + throw new IllegalStateException("There is already a configured key path old=" + tokenKey_ + " new=" + keyPath); } - _keyPath = keyPath; + tokenKey_ = keyPath; } } @Override public Object getProperty(String container, String property) { - if (property.equals(BlobCrypterSecurityTokenCodec.SECURITY_TOKEN_KEY_FILE) && _keyPath != null) + if (property.equals(BlobCrypterSecurityTokenCodec.SECURITY_TOKEN_KEY_FILE) && tokenKey_ != null) { - return _keyPath; + return tokenKey_; } + if (property.equals(ExoOAuthModule.SIGNING_KEY_FILE) && signingKey_ != null) + { + return signingKey_; + } return super.getProperty(container, property); } - // @Override - // public Object getJson(String container, String parameter) { - // if (parameter.equals(BlobCrypterSecurityTokenDecoder.SECURITY_TOKEN_KEY_FILE) && _keyPath != null) { - // return _keyPath; - // } - // return super.getJson(container, parameter); - // } - /** * It's not public as we don't want to expose it to the outter world. The fact that this class * is instantiated by Guice and the ExoDefaultSecurityTokenGenerator is managed by exo kernel @@ -187,9 +214,9 @@ * * @return the key path */ - static String getKeyPath() + static String getTokenKeyPath() { - return _keyPath; + return tokenKey_; } /** Modified: epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoDefaultSecurityTokenGenerator.java =================================================================== --- epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoDefaultSecurityTokenGenerator.java 2011-09-14 08:03:19 UTC (rev 7403) +++ epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoDefaultSecurityTokenGenerator.java 2011-09-14 08:05:34 UTC (rev 7404) @@ -27,70 +27,23 @@ import org.apache.shindig.common.crypto.BlobCrypter; import org.apache.shindig.common.crypto.BlobCrypterException; import org.apache.shindig.common.util.TimeSource; -import org.exoplatform.container.monitor.jvm.J2EEServerInfo; import org.exoplatform.web.application.RequestContext; public class ExoDefaultSecurityTokenGenerator implements SecurityTokenGenerator { - private String containerKey; - private final TimeSource timeSource; public ExoDefaultSecurityTokenGenerator() throws Exception { - // TODO should be moved to config - // generateKeys("RSA", 1024); - this.containerKey = getKeyFilePath(); this.timeSource = new TimeSource(); } - // private static void generateKeys(String keyAlgorithm, int numBits) { - // FileOutputStream keyFile = null; - // try { - // keyFile = new FileOutputStream("exokey.pem"); - // - // // RSA private key - // - // CertAndKeyGen cakg = new CertAndKeyGen(keyAlgorithm, "SHA1WithRSA"); - // cakg.generate(1024); - // - // PrivateKey privateKey = cakg.getPrivateKey(); - // - // keyFile.write("-----BEGIN RSA PRIVATE KEY-----\n".getBytes()); - // // wrap at 64 - // int wrapIndex = 64; - // StringBuffer sb = new StringBuffer(new String(Base64.encode(privateKey.getEncoded()))); - // for (int i = wrapIndex; i < sb.length(); i = i + wrapIndex + 1) { - // sb.insert(i, "\n"); - // } - // keyFile.write((sb.toString()).getBytes()); - // keyFile.write("\n-----END RSA PRIVATE KEY-----\n".getBytes()); - // - // X500Name name = new X500Name("One", "Two", "Three", "Four", "Five", "Six"); - // - // X509Certificate certificate = cakg.getSelfCertificate(name, 2000000); - // System.out.println("\n CN: " + certificate.getSubjectDN()); - // keyFile.write("-----BEGIN CERTIFICATE-----\n".getBytes()); - // // wrap at 64 - // wrapIndex = 64; - // sb = new StringBuffer(new String(Base64.encode(certificate.getEncoded()))); - // for (int i = wrapIndex; i < sb.length(); i = i + wrapIndex + 1) { - // sb.insert(i, "\n"); - // } - // keyFile.write(sb.toString().getBytes()); - // keyFile.write("\n-----END CERTIFICATE-----".getBytes()); - // } catch (Exception e) { - // e.printStackTrace(); - // } finally { - // Safe.close(keyFile); - // } - // } - protected String createToken(String gadgetURL, String owner, String viewer, Long moduleId, String container) { try { - BlobCrypterSecurityToken t = new BlobCrypterSecurityToken(getBlobCrypter(this.containerKey), container, null); + BlobCrypter blobCrypter = getBlobCrypter(); + BlobCrypterSecurityToken t = new BlobCrypterSecurityToken(blobCrypter, container, null); t.setAppUrl(gadgetURL); t.setModuleId(moduleId); @@ -102,13 +55,11 @@ } catch (IOException e) { - e.printStackTrace(); // To change body of catch statement use File | - // Settings | File Templates. + e.printStackTrace(); } catch (BlobCrypterException e) { - e.printStackTrace(); // To change body of catch statement use File | - // Settings | File Templates. + e.printStackTrace(); } return null; } @@ -123,8 +74,9 @@ return createToken(gadgetURL, viewer, rUser, moduleId, "default"); } - private BlobCrypter getBlobCrypter(String fileName) throws IOException + protected BlobCrypter getBlobCrypter() throws IOException { + String fileName = getKeyFilePath(); BasicBlobCrypter c = new BasicBlobCrypter(new File(fileName)); c.timeSource = timeSource; return c; @@ -133,22 +85,19 @@ /** * Method returns a path to the file containing the encryption key */ - private String getKeyFilePath(){ - J2EEServerInfo info = new J2EEServerInfo(); - String confPath = info.getExoConfigurationDirectory(); - File keyFile = null; - - if (confPath != null) { - File confDir = new File(confPath); - if (confDir != null && confDir.exists() && confDir.isDirectory()) { - keyFile = new File(confDir, "gadgets/key.txt"); - } - } + protected String getKeyFilePath() + { + String keyPath = ExoContainerConfig.getTokenKeyPath(); + File keyFile = null; + if (keyPath != null) + { + keyFile = new File(keyPath); + } + else + { + keyFile = new File("key.txt"); + } - if (keyFile == null) { - keyFile = new File("key.txt"); - } - - return keyFile.getAbsolutePath(); + return keyFile.getAbsolutePath(); } } Modified: epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoOAuthModule.java =================================================================== --- epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoOAuthModule.java 2011-09-14 08:03:19 UTC (rev 7403) +++ epp/portal/branches/EPP_5_2_Branch/gadgets/core/src/main/java/org/exoplatform/portal/gadget/core/ExoOAuthModule.java 2011-09-14 08:05:34 UTC (rev 7404) @@ -19,6 +19,8 @@ package org.exoplatform.portal.gadget.core; +import com.google.inject.Singleton; + import java.util.logging.Level; import java.util.logging.Logger; @@ -28,7 +30,6 @@ import org.apache.shindig.common.crypto.BlobCrypter; import org.apache.shindig.common.util.ResourceLoader; import org.apache.shindig.config.ContainerConfig; -import org.apache.shindig.gadgets.http.HttpFetcher; import org.apache.shindig.gadgets.oauth.BasicOAuthStore; import org.apache.shindig.gadgets.oauth.BasicOAuthStoreConsumerKeyAndSecret; import org.apache.shindig.gadgets.oauth.OAuthFetcherConfig; @@ -50,18 +51,14 @@ */ public class ExoOAuthModule extends OAuthModule { - private static final String SIGNING_KEY_FILE = "gadgets.signingKeyFile"; + public static final String SIGNING_KEY_FILE = "gadgets.signingKeyFile"; private static final String SIGNING_KEY_NAME = "gadgets.signingKeyName"; private static final String CALLBACK_URL = "gadgets.signing.global-callback-url"; private static final String OAUTH_CONFIG = "config/oauth.json"; - private static final String OAUTH_SIGNING_KEY_FILE = "shindig.signing.key-file"; - private static final String OAUTH_SIGNING_KEY_NAME = "shindig.signing.key-name"; - private static final String OAUTH_CALLBACK_URL = "shindig.signing.global-callback-url"; - private static final Logger logger = Logger.getLogger(OAuthModule.class.getName()); @Override @@ -80,6 +77,7 @@ Boolean.TRUE); } + @Singleton public static class ExoOAuthStoreProvider implements Provider<OAuthStore> { @@ -88,18 +86,13 @@ @Inject public ExoOAuthStoreProvider(ContainerConfig config) { - //super(config.getString(ContainerConfig.DEFAULT_CONTAINER, SIGNING_KEY_FILE), config.getString(ContainerConfig.DEFAULT_CONTAINER, SIGNING_KEY_NAME)); -// super(config.getString(ContainerConfig.DEFAULT_CONTAINER, SIGNING_KEY_FILE), config.getString( -// ContainerConfig.DEFAULT_CONTAINER, SIGNING_KEY_NAME), config.getString(ContainerConfig.DEFAULT_CONTAINER, -// CALLBACK_URL)); - store = new ExoOAuthStore(); String signingKeyFile = config.getString(ContainerConfig.DEFAULT_CONTAINER, SIGNING_KEY_FILE); String signingKeyName = config.getString(ContainerConfig.DEFAULT_CONTAINER, SIGNING_KEY_NAME); - String defaultCallbackUrl = config.getString(ContainerConfig.DEFAULT_CONTAINER,CALLBACK_URL); - loadDefaultKey(signingKeyFile, signingKeyName); + + String defaultCallbackUrl = config.getString(ContainerConfig.DEFAULT_CONTAINER,CALLBACK_URL); store.setDefaultCallbackUrl(defaultCallbackUrl); loadConsumers(); } @@ -128,8 +121,7 @@ " openssl pkcs8 -in testkey.pem -out oauthkey.pem -topk8 -nocrypt -outform PEM\n" + '\n' + "Then edit gadgets.properties and add these lines:\n" + - OAUTH_SIGNING_KEY_FILE + "=<path-to-oauthkey.pem>\n" + - OAUTH_SIGNING_KEY_NAME + "=mykey\n"); + SIGNING_KEY_FILE + "=<path-to-oauthkey.pem>\n"); } } @@ -146,24 +138,4 @@ return store; } } - - public static class ExoOAuthRequestProvider extends OAuthRequestProvider - { - private final HttpFetcher fetcher; - - private final OAuthFetcherConfig config; - - @Inject - public ExoOAuthRequestProvider(HttpFetcher fetcher, OAuthFetcherConfig config) - { - super(fetcher, config); - this.fetcher = fetcher; - this.config = config; - } - - public OAuthRequest get() - { - return new OAuthRequest(config, fetcher); - } - } }