Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that tracks sessions for MetaCatServlet users.

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *    Release: @release@

 *

 *   '$Author: bojilova $'

 *     '$Date: 2001-03-22 15:49:18 -0800 (Thu, 22 Mar 2001) $'

 * '$Revision: 728 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.servlet.http.HttpSession;

import javax.servlet.http.HttpServletRequest;

/**

 * A Class that implements session tracking for MetaCatServlet users.

 * User's login data are stored in the session object.

 * User authentication is done through a dynamically determined AuthInterface.

 */

public class AuthSession {

  private String authClass = null;

  private HttpSession session = null;

  private AuthInterface authService = null;

  private String ldapUrl;

  private String ldapBase;

  private String statusMessage = null;

  /** 

   * Construct an AuthSession

   */

  public AuthSession() throws Exception {

    // Determine our session authentication method and

    // create an instance of the auth class

    MetaCatUtil util = new MetaCatUtil();

    this.authClass = util.getOption("authclass");

    this.authService = (AuthInterface)createObject(authClass);

    this.ldapUrl = util.getOption("ldapurl");

    this.ldapBase = util.getOption("ldapbase");

  }

  /** 

   * determine if the credentials for this session are valid by 

   * authenticating them using the authService configured for this session.

   *

   * @param request the request made from the client

   * @param username the username entered when login

   * @param password the password entered when login

   */

  public boolean authenticate(HttpServletRequest request, 

                              String username, String password)  {

    String message = null;

    try { 

      if ( authService.authenticate(username, password) ) {

        String[] groups = authService.getGroups(username,password,username);

        this.session = getSession(request, username, password, groups);

        message = "Authentication successful for user: " + username;

        this.statusMessage = formatOutput("login", message);

        return true;

      } else {  

        message = "Authentication failed for user: " + username;

        this.statusMessage = formatOutput("unauth_login", message);

        return false;

      }    

    } catch ( ConnectException ce ) {

      message = "Connection to the authentication service failed in " +

                "AuthSession.authenticate: " + ce.getMessage();

    } catch ( IllegalStateException ise ) {

      message = ise.getMessage();

    }

    this.statusMessage = formatOutput("error_login", message);

    return false;

  }

  /** Get new HttpSession and store username & password in it */

  private HttpSession getSession(HttpServletRequest request, 

                                 String username, String password,

                                 String[] groups)  

                      throws IllegalStateException {

    // get the current session object, create one if necessary

    HttpSession session = request.getSession(true);

    // if it is still in use invalidate and get a new one

    if ( !session.isNew() ) {

      session.invalidate();

      session = request.getSession(true);

    }

    // store the username, password, and groupname (the first only)

    // in the session obj for use on subsequent calls to Metacat servlet

    session.setMaxInactiveInterval(-1);

    session.setAttribute("username", username);

    session.setAttribute("password", password);

    if ( groups.length > 0 ) {

      session.setAttribute("groupname", groups[0]);

    }

    return session;

  }

  /**

   * Get the message associated with authenticating this session. The

   * message is formatted in XML.

   */

  public String getMessage() 

  {

    return this.statusMessage;

  }

  /**

   * Get list of all groups and users from authentication scheme.

   * The output is formatted in XML.

   */

  public String getPrincipals(String user, String password)

                throws ConnectException

  {

    StringBuffer out = new StringBuffer();

    String[] groups = authService.getGroups(user, password);

    out.append("<?xml version=\"1.0\"?>\n");

    out.append("<principals authSystemURI=\"" + ldapUrl + ldapBase + "\">\n");

    // for the groups and users that belong to them

    if ( groups.length > 0 ) {

      for (int i=0; i < groups.length; i++ ) {

        out.append("  <group>\n");

        out.append("    <groupname>" + groups[i] + "<groupname>\n");

        String[] usersForGroup = authService.getUsers(user,password,groups[i]);

        for (int j=0; j < usersForGroup.length; j++ ) {

          out.append("    <user>\n");

          out.append("      <username>" + usersForGroup[j] + "<username>\n");

          out.append("    </user>\n");

        }

        out.append("</group>\n");

      }

    // for the users only when there are no any groups defined

    } else {

      String[] users = authService.getUsers(user, password);

      for (int j=0; j < users.length; j++ ) {

        out.append("  <user>\n");

        out.append("    <username>" + users[j] + "<username>\n");

        out.append("  </user>\n");

      }

    }

    out.append("</principals>");

    return out.toString();

  }

  /* 

   * format the output in xml for processing from client applications

   *

   * @param tag the root element tag for the message (error or success)

   * @param message the message content of the root element

   */

  private String formatOutput(String tag, String message) {

    StringBuffer out = new StringBuffer();

    out.append("<?xml version=\"1.0\"?>\n");

    out.append("<" + tag + ">");

    out.append("\n  <message>" + message + "</message>\n");

    out.append("</" + tag + ">");

    return out.toString();

  }

  /**

   * Instantiate a class using the name of the class at runtime

   *

   * @param className the fully qualified name of the class to instantiate

   */

  private static Object createObject(String className) throws Exception {

    Object object = null;

    try {

      Class classDefinition = Class.forName(className);

      object = classDefinition.newInstance();

    } catch (InstantiationException e) {

      throw e;

    } catch (IllegalAccessException e) {

      throw e;

    } catch (ClassNotFoundException e) {

      throw e;

    }

    return object;

  }

}