Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that tracks sessions for MetaCatServlet users.

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *

 *   '$Author: tao $'

 *     '$Date: 2014-02-25 19:46:33 -0800 (Tue, 25 Feb 2014) $'

 * '$Revision: 8652 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import java.util.HashMap;

import java.util.Vector;

import javax.servlet.http.HttpSession;

import javax.servlet.http.HttpServletRequest;

import org.apache.log4j.Logger;

import edu.ucsb.nceas.metacat.properties.PropertyService;

import edu.ucsb.nceas.metacat.shared.MetacatUtilException;

import edu.ucsb.nceas.metacat.util.AuthUtil;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

/**

 * A Class that implements session tracking for MetaCatServlet users.

 * User's login data are stored in the session object.

 * User authentication is done through a dynamically determined AuthInterface.

 */

public class AuthSession {

	private String authClass = null;

	private HttpSession session = null;

	private AuthInterface authService = null;

	private String statusMessage = null;

	private static Logger logMetacat = Logger.getLogger(AuthSession.class);

	/**

	 * Construct an AuthSession

	 * @throws ClassNotFoundException 

	 * @throws IllegalAccessException 

	 * @throws InstantiationException 

	 */

	public AuthSession() throws InstantiationException, IllegalAccessException, ClassNotFoundException {

		// Determine our session authentication method and

		// create an instance of the auth class

		try {

            this.authClass = PropertyService.getProperty("auth.class");

        } catch (PropertyNotFoundException e) {

            // TODO Auto-generated catch block

            e.printStackTrace();

        }

		this.authService = (AuthInterface) createObject(authClass);

	}

	/**

	 * Get the new session

	 */

	public HttpSession getSessions() {

		return this.session;

	}

	/**

	 * determine if the credentials for this session are valid by

	 * authenticating them using the authService configured for this session.

	 *

	 * @param request the request made from the client

	 * @param username the username entered when login

	 * @param password the password entered when login

	 */

	public boolean authenticate(HttpServletRequest request, String username,

			String password) {

		String message = null;

		try {

			if (authService.authenticate(username, password)) {

				// getGroups returns groupname along with their description.

				// hence groups[] is generated from groupsWithDescription[][]

				String[][] groupsWithDescription = authService.getGroups(username,

						password, username);

				String groups[] = null;

				if(groupsWithDescription != null) {

				    groups = new String[groupsWithDescription.length];

	                for (int i = 0; i < groupsWithDescription.length; i++) {

	                    groups[i] = groupsWithDescription[i][0];

	                }

				}

				if (groups == null) {

                    groups = new String[0];

                }

				String[] userInfo = null;

				try {

				     userInfo = authService.getUserInfo(username, password);

				} catch (ConnectException e) {

				    logMetacat.warn("AuthSession.authenticate - can't get the user info for user "+ username+" since "+e.getMessage());;

				}

				this.session = createSession(request, username, password, groups,

						userInfo);

				String sessionId = session.getId();

				message = "Authentication successful for user: " + username;

				this.statusMessage = formatOutput("login", message, sessionId, username,

						groups, userInfo);

				return true;

			} else {

				message = "Authentication failed for user: " + username;

				this.statusMessage = formatOutput("unauth_login", message);

				return false;

			}

		} catch (ConnectException ce) {

			message = "Connection to the authentication service failed in "

					+ "AuthSession.authenticate: " + ce.getMessage();

		} catch (IllegalStateException ise) {

			message = ise.getMessage();

		}

		this.statusMessage = formatOutput("error_login", message);

		return false;

	}

	/** Get new HttpSession and store username & password in it */

	private HttpSession createSession(HttpServletRequest request, String username,

			String password, String[] groups, String[] userInfo)

			throws IllegalStateException {

		// get the current session object, create one if necessary

		HttpSession session = request.getSession(true);

		// if it is still in use invalidate and get a new one

		if (!session.isNew()) {

			logMetacat.info("in session is not new");

			logMetacat.info("the old session id is : " + session.getId());

			logMetacat.info("the old session username : "

					+ session.getAttribute("username"));

			session.invalidate();

			logMetacat.info("in session is not new");

			session = request.getSession(true);

		}

		// store the username, password, and groupname (the first only)

		// in the session obj for use on subsequent calls to Metacat servlet

		session.setMaxInactiveInterval(-1);

		session.setAttribute("username", username);

		session.setAttribute("password", password);

		if (userInfo != null && userInfo.length == 3) {

			session.setAttribute("name", userInfo[0]);

			session.setAttribute("organization", userInfo[1]);

			session.setAttribute("email", userInfo[2]);

		}

		if (groups.length > 0) {

			session.setAttribute("groupnames", groups);

		}

		logMetacat.info("the new session id is : " + session.getId());

		logMetacat.info("the new session username : " + session.getAttribute("username"));

		return session;

	}

	/**

	 * Get the message associated with authenticating this session. The

	 * message is formatted in XML.

	 */

	public String getMessage() {

		return this.statusMessage;

	}

	/**

	 * Get all groups and users from authentication scheme.

	 * The output is formatted in XML.

	 * @param user the user which requests the information

	 * @param password the user's password

	 */

	public String getPrincipals(String user, String password) throws ConnectException {

		return authService.getPrincipals(user, password);

	}

	/**

	 * Get attributes describing a user or group

	 * 

	 * @param foruser

	 *            the user for which the attribute list is requested

	 * @returns HashMap a map of attribute name to a Vector of values

	 */

	public HashMap<String, Vector<String>> getAttributes(String foruser)

			throws ConnectException {

		return authService.getAttributes(foruser);

	}

	/*

	 * format the output in xml for processing from client applications

	 * 

	 * @param tag the root element tag for the message (error or success) @param

	 * message the message content of the root element

	 */

	private String formatOutput(String tag, String message) {

		return formatOutput(tag, message, null, null, null, null);

	}

	/*

	 * format the output in xml for processing from client applications

	 *

	 * @param tag the root element tag for the message (error or success)

	 * @param message the message content of the root element

	 * @param sessionId the session identifier for a successful login

	 */

	private String formatOutput(String tag, String message, String sessionId,

			String username, String[] groups, String userInfo[]) {

		StringBuffer out = new StringBuffer();

		out.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");

		out.append("<" + tag + ">");

		out.append("\n  <message>" + message + "</message>\n");

		if (sessionId != null) {

			out.append("\n  <sessionId>" + sessionId + "</sessionId>\n");

			if (userInfo != null && userInfo[0] != null) {

				out.append("\n<name>\n");

				out.append(userInfo[0]);

				out.append("\n</name>\n");

			}

			if(userInfo != null && userInfo[1]!=null){

				out.append("\n<organization>\n");

				out.append(userInfo[1]);

				out.append("\n</organization>\n");

			}

			if(userInfo != null && userInfo[2]!=null){

				out.append("\n<email>\n");

				out.append(userInfo[2]);

				out.append("\n</email>\n");

			}

			try {

				// insert <isAdministrator> tag if the user is an administrator

				if (AuthUtil.isAdministrator(username, groups)) {

					out.append("\n  <isAdministrator></isAdministrator>\n");

				}

			} catch (MetacatUtilException ue) {

				logMetacat.error("Could not determine if user is administrator. "

						+ "Omitting from xml output: " + ue.getMessage());

			}

			try {

				// insert <isModerator> tag if the user is a Moderator

				if (AuthUtil.isModerator(username, groups)) {

					out.append("\n  <isModerator></isModerator>\n");

				}

			} catch (MetacatUtilException ue) {

				logMetacat.error("Could not determine if user is moderator. "

						+ "Omitting from xml output: " + ue.getMessage());

			}

		}

		out.append("</" + tag + ">");

		return out.toString();

	}

	/**

	 * Instantiate a class using the name of the class at runtime

	 *

	 * @param className the fully qualified name of the class to instantiate

	 */

	private static Object createObject(String className) throws InstantiationException, IllegalAccessException, ClassNotFoundException {

		Object object = null;

//		try {

			Class classDefinition = Class.forName(className);

			object = classDefinition.newInstance();

//		} catch (InstantiationException e) {

//			throw e;

//		} catch (IllegalAccessException e) {

//			throw e;

//		} catch (ClassNotFoundException e) {

//			throw e;

//		}

		return object;

	}

	/**

	 * Instantiate a class using the name of the class at runtime

	 *

	 * @param className the fully qualified name of the class to instantiate

	 */

	private static Object createObject(String className, String orgName) throws Exception {

		Object object = null;

		try {

			Class classDefinition = Class.forName(className);

			object = classDefinition.newInstance();

		} catch (InstantiationException e) {

			throw e;

		} catch (IllegalAccessException e) {

			throw e;

		} catch (ClassNotFoundException e) {

			throw e;

		}

		return object;

	}

}