[portal-commits] JBoss Portal SVN: r5903 - in trunk: core/src/resources/portal-core-sar/conf identity/src/main/org/jboss/portal/identity/auth

[portal-commits at lists.jboss.org]

Author: bdaw
Date: 2006-12-19 12:42:51 -0500 (Tue, 19 Dec 2006)
New Revision: 5903

Added:
   trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java
Modified:
   trunk/core/src/resources/portal-core-sar/conf/login-config.xml
Log:
- dummy extension of DatabaseServerLoginModule class that inject "additionalRole" to anable authenticate against portal DB while using LDAP modules with IdentityLoginModules

Modified: trunk/core/src/resources/portal-core-sar/conf/login-config.xml
===================================================================
--- trunk/core/src/resources/portal-core-sar/conf/login-config.xml	2006-12-19 17:29:13 UTC (rev 5902)
+++ trunk/core/src/resources/portal-core-sar/conf/login-config.xml	2006-12-19 17:42:51 UTC (rev 5903)
@@ -35,6 +35,21 @@
    
    <application-policy name="portal">
       <authentication>
+         <!--Uncomment this if you want to fall down to users kept in DB after LDAP authentication fails
+             This may be usefull if you want to use Admin user provided with portal database schema-->
+         <!--Note that this may lead to the security risk - with LDAP  when storing user profile information
+             that are not mapped as attribute you may have LDAP user synchronized into DB with no password set.
+             Please see HibernateUserProfileImpl module options "synchronizeNonExistingUsers", "acceptOtherImplementations"
+             "defaultSynchronizePassword" or "randomSynchronizePassword" to manage this behaviour-->
+         <!--<login-module code = "org.jboss.portal.identity.auth.DBIdentityLoginModule" flag="sufficient">
+            <module-option name="dsJndiName">java:/PortalDS</module-option>
+            <module-option name="principalsQuery">SELECT jbp_password FROM jbp_users WHERE jbp_uname=?</module-option>
+            <module-option name="rolesQuery">SELECT jbp_roles.jbp_name, 'Roles' FROM  jbp_role_membership INNER JOIN jbp_roles ON jbp_role_membership.jbp_rid = jbp_roles.jbp_rid INNER JOIN jbp_users ON jbp_role_membership.jbp_uid = jbp_users.jbp_uid WHERE jbp_users.jbp_uname=?</module-option>
+            <module-option name="hashAlgorithm">MD5</module-option>
+            <module-option name="hashEncoding">HEX</module-option>
+            <module-option name="additionalRole">Authenticated</module-option>
+         </login-module>
+-->
          <login-module code="org.jboss.portal.identity.auth.IdentityLoginModule" flag="required">
             <module-option name="unauthenticatedIdentity">guest</module-option>
             <module-option name="userModuleJNDIName">java:/portal/UserModule</module-option>

Added: trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java
===================================================================
--- trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java	2006-12-19 17:29:13 UTC (rev 5902)
+++ trunk/identity/src/main/org/jboss/portal/identity/auth/DBIdentityLoginModule.java	2006-12-19 17:42:51 UTC (rev 5903)
@@ -0,0 +1,85 @@
+/*
+* JBoss, a division of Red Hat
+* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated
+* by the @authors tag. See the copyright.txt in the distribution for a
+* full listing of individual contributors.
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/
+package org.jboss.portal.identity.auth;
+
+import org.jboss.security.auth.spi.DatabaseServerLoginModule;
+
+import javax.security.auth.Subject;
+import javax.security.auth.login.LoginException;
+import javax.security.auth.callback.CallbackHandler;
+import java.util.Map;
+import java.util.Collections;
+import java.util.Arrays;
+import java.security.Principal;
+import java.security.acl.Group;
+
+/**
+ * @author <a href="mailto:boleslaw dot dawidowicz at jboss.org">Boleslaw Dawidowicz</a>
+ * @version $Revision: 1.1 $
+ */
+public class DBIdentityLoginModule extends DatabaseServerLoginModule
+{
+   private String additionalRole;
+
+   public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options)
+   {
+      super.initialize(subject, callbackHandler, sharedState, options);
+
+      // Get data
+      additionalRole = (String)options.get("additionalRole");
+
+      // Some info
+      log.trace("additionalRole = " + additionalRole);
+   }
+
+
+   protected Group[] getRoleSets() throws LoginException
+   {
+      Group[] rolesGroup =  super.getRoleSets();
+      if (additionalRole != null)
+      {
+         try
+         {
+            for (int i = 0; i < rolesGroup.length; i++)
+            {
+               Group group = rolesGroup[i];
+               if (group.getName().equals("Roles"))
+               {
+                  group.addMember(createIdentity(additionalRole));
+               }
+            }
+         }
+         catch (Exception e)
+         {
+            //just a try
+            log.error("Error when adding additional role: ", e);
+         }
+      }
+      return rolesGroup; 
+   }
+
+   /** Subclass to use the PortalPrincipal to make the username easier to retrieve by the portal. */
+   protected Principal createIdentity(String username) throws Exception
+   {
+      return new UserPrincipal(username);
+   }
+}