Author: bdaw Date: 2010-07-08 16:26:09 -0400 (Thu, 08 Jul 2010) New Revision: 3597 Added: portal/trunk/component/identity/src/main/java/org/exoplatform/services/organization/idm/CustomMembershipLoginModule.java Modified: portal/trunk/server/jboss/patch-ear/src/main/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml Log: GTNPORTAL-1347 - Mechanism to auto assign users to /platform/users group Added: portal/trunk/component/identity/src/main/java/org/exoplatform/services/organization/idm/CustomMembershipLoginModule.java =================================================================== --- portal/trunk/component/identity/src/main/java/org/exoplatform/services/organization/idm/CustomMembershipLoginModule.java (rev 0) +++ portal/trunk/component/identity/src/main/java/org/exoplatform/services/organization/idm/CustomMembershipLoginModule.java 2010-07-08 20:26:09 UTC (rev 3597) @@ -0,0 +1,180 @@ +/** +* Copyright (C) 2009 eXo Platform SAS. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.exoplatform.services.organization.idm; + +import javax.security.auth.login.LoginException; +import org.exoplatform.container.component.ComponentRequestLifecycle; +import org.exoplatform.container.component.RequestLifeCycle; +import org.exoplatform.services.log.ExoLogger; +import org.exoplatform.services.log.Log; +import org.exoplatform.services.organization.Group; +import org.exoplatform.services.organization.MembershipType; +import org.exoplatform.services.organization.OrganizationService; +import org.exoplatform.services.organization.User; +import org.exoplatform.services.security.Authenticator; +import org.exoplatform.services.security.Identity; +import org.exoplatform.services.security.MembershipEntry; +import org.exoplatform.services.security.jaas.AbstractLoginModule; + +/** + * Login module can be used to add authenticated user to some group after successful login.<br> + * For example, user can be add as "member" to group "/platform/users" after his login. Group name and Membership + * type are configurable and if they are not provided by configuration, then value "member" is used as default + * value for membership type and "/platform/users" for group. + * + * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a> + * @author <a href="mailto:vrockai@redhat.com">Viliam Rockai</a> + * @author <a href="mailto:boleslaw.dawidowicz at redhat.com">Boleslaw Dawidowicz</a> + */ +public class CustomMembershipLoginModule extends AbstractLoginModule +{ + /** Logger. */ + private static final Log log = ExoLogger.getLogger(CustomMembershipLoginModule.class); + + private static final String OPTION_MEMBERSHIP_TYPE = "membershipType"; + + private static final String OPTION_GROUP_ID = "groupId"; + + // values obtained from configuration options + private String membershipType; + + private String groupId; + + // MembershipEntry with values provided from configuration. We will use it to check if user is not already presented in our group. + private MembershipEntry requestedMembershipEntry; + + /** + * Read values from configuration. Default values ("member" and "/platform/users") are used if options are missing in configuration. + */ + protected void afterInitialize() + { + membershipType = options.get(OPTION_MEMBERSHIP_TYPE) != null ? (String)options.get(OPTION_MEMBERSHIP_TYPE) : "member"; + groupId = options.get(OPTION_GROUP_ID) != null ? (String)options.get(OPTION_GROUP_ID) : "/platform/users"; + // membershipType is * so we are not checking exact value of membershipType in method login + requestedMembershipEntry = new MembershipEntry(groupId); + } + /** + * @see javax.security.auth.spi.LoginModule#login() + */ + @SuppressWarnings("unchecked") + public boolean login() throws LoginException + { + if (log.isDebugEnabled()) + { + log.debug("login invoked!"); + } + try + { + // get identity set by SharedStateLoginModule in case of succesfful authentication + Identity identity = null; + if (sharedState.containsKey("exo.security.identity")) + { + identity = (Identity)sharedState.get("exo.security.identity"); + } + // return if identity is not present (this means that user authentication failed in SharedStateLoginModule) + if (identity == null) + { + return true; + } + // check if user is already added to our group with given membershipType. If yes, we don't need to do something. + if (identity.getMemberships().contains(requestedMembershipEntry)) + { + return true; + } + // Now add our user to requested group + log.info("User " + identity.getUserId() + " will be added to group " + groupId + " as " + membershipType + "."); + addUserToPlatformUsers(identity.getUserId()); + // recreate identity + Authenticator authenticator = (Authenticator)getContainer().getComponentInstanceOfType(Authenticator.class); + identity = authenticator.createIdentity(identity.getUserId()); + sharedState.put("exo.security.identity", identity); + return true; + } + catch (Exception e) + { + LoginException le = new LoginException(); + le.initCause(e); + throw le; + } + } + /** + * @see javax.security.auth.spi.LoginModule#commit() + */ + public boolean commit() throws LoginException + { + return true; + } + /** + * @see javax.security.auth.spi.LoginModule#abort() + */ + public boolean abort() throws LoginException + { + return true; + } + /** + * @see javax.security.auth.spi.LoginModule#logout() + */ + public boolean logout() throws LoginException + { + return true; + } + @Override + protected Log getLogger() + { + return log; + } + /** + * Add given user to our group with given membershipType. + * + * @param userId + */ + private void addUserToPlatformUsers(String userId) throws Exception + { + try + { + OrganizationService orgService = (OrganizationService)getContainer().getComponentInstanceOfType(OrganizationService.class); + begin(orgService); + User user = orgService.getUserHandler().findUserByName(userId); + MembershipType memberType = orgService.getMembershipTypeHandler().findMembershipType(membershipType); + Group platformUsersGroup = orgService.getGroupHandler().findGroupById(groupId); + orgService.getMembershipHandler().linkMembership(user, platformUsersGroup, memberType, true); + end(orgService); + } + catch (Exception e) + { + log.error("Failed to add user " + userId + " to group " + groupId + ".", e); + // don't rethrow login exception in case of failure. + // throw e; + } + } + private void begin(OrganizationService orgService) throws Exception + { + if (orgService instanceof ComponentRequestLifecycle) + { + RequestLifeCycle.begin((ComponentRequestLifecycle)orgService); + } + } + private void end(OrganizationService orgService) throws Exception + { + if (orgService instanceof ComponentRequestLifecycle) + { + RequestLifeCycle.end(); + } + } +} Modified: portal/trunk/server/jboss/patch-ear/src/main/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml =================================================================== --- portal/trunk/server/jboss/patch-ear/src/main/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml 2010-07-07 09:15:18 UTC (rev 3596) +++ portal/trunk/server/jboss/patch-ear/src/main/jboss/server/default/deploy/gatein.ear/META-INF/gatein-jboss-beans.xml 2010-07-08 20:26:09 UTC (rev 3597) @@ -10,6 +10,18 @@ <module-option name="portalContainerName">portal</module-option> <module-option name="realmName">gatein-domain</module-option> </login-module> + + <!-- Uncomment this part to check on each login if user is member of "/platform/users" group and if not + create such membership --> + <!-- + <login-module code="org.exoplatform.services.organization.idm.CustomMembershipLoginModule" flag="required"> + <module-option name="portalContainerName">portal</module-option> + <module-option name="realmName">gatein-domain</module-option> + <module-option name="membershipType">member</module-option> + <module-option name="groupId">/platform/users</module-option> + </login-module> + --> + <login-module code="org.exoplatform.services.security.j2ee.JbossLoginModule" flag="required"> <module-option name="portalContainerName">portal</module-option> <module-option name="realmName">gatein-domain</module-option>