JResourceDS.java

package org.objectweb.jonas.security.realm.factory;

import java.security.NoSuchAlgorithmException;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;

import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import javax.sql.DataSource;

import org.objectweb.jonas.dbm.ConnectionManager;
import org.objectweb.jonas.security.realm.lib.HashHelper;
import org.objectweb.jonas.security.realm.principals.User;

import org.objectweb.util.monolog.api.BasicLevel;

public class JResourceDS extends JResource implements JResourceDSMBean {

    private static final String FACTORY_TYPE = "org.objectweb.jonas.security.realm.factory.JResourceDS";

    private static final String FACTORY_NAME = "org.objectweb.jonas.security.realm.factory.JResourceDSFactory";

    private String dsName = null;

    private String userTable = null;

    private String userTableUsernameCol = null;

    private String userTablePasswordCol = null;

    private String roleTable = null;

    private String roleTableUsernameCol = null;

    private String roleTableRolenameCol = null;

    private String algorithm = null;

    private DataSource dataSource = null;

    private String userPrincipalsQuery = null;

    private String userRolesQuery = null;

    public JResourceDS() throws Exception {
        super();

    }

    public void setDsName(String dsName) {
        this.dsName = dsName;
    }

    public void setUserTable(String userTable) {
        this.userTable = userTable;
    }

    public void setUserTableUsernameCol(String userTableUsernameCol) {
        this.userTableUsernameCol = userTableUsernameCol;
    }

    public void setUserTablePasswordCol(String userTablePasswordCol) {
        this.userTablePasswordCol = userTablePasswordCol;
    }

    public void setRoleTable(String roleTable) {
        this.roleTable = roleTable;
    }

    public void setRoleTableUsernameCol(String roleTableUsernameCol) {
        this.roleTableUsernameCol = roleTableUsernameCol;
    }

    public void setRoleTableRolenameCol(String roleTableRolenameCol) {
        this.roleTableRolenameCol = roleTableRolenameCol;
    }

    public void setAlgorithm(String algorithm) {
        this.algorithm = algorithm;
    }

    public void setUserPrincipalsQuery(String userPrincipalsQuery) {
        this.userPrincipalsQuery = userPrincipalsQuery;
    }

    public void setUserRolesQuery(String userRolesQuery) {
        this.userRolesQuery = userRolesQuery;
    }

    public String getDsName() {
        return dsName;
    }

    public String getUserTable() {
        return userTable;
    }

    public String getUserTableUsernameCol() {
        return userTableUsernameCol;
    }

    public String getUserTablePasswordCol() {
        return userTablePasswordCol;
    }

    public String getRoleTable() {
        return roleTable;
    }

    public String getRoleTableUsernameCol() {
        return roleTableUsernameCol;
    }

    public String getRoleTableRolenameCol() {
        return roleTableRolenameCol;
    }

    public String getAlgorithm() {
        return algorithm;
    }

    public String setUserPrincipalsQuery() {
        return userPrincipalsQuery;
    }

    public String setUserRolesQuery() {
        return userRolesQuery;
    }

    public User findUser(String username) throws JResourceException {

        if (username == null) {
            return null;
        }

        // Build new user
        User user = new User();

        Connection connection = getConnection();

        user.setName(username);

        // Get the password of the user
        ResultSet rs = null;
        String password = null;
        try {
            PreparedStatement usrStmt = userStatement(connection, username);
            rs = usrStmt.executeQuery();
            if (rs == null || !rs.next()) {
                throw new JResourceException("No user found with username '" + username + "'.");
            }

            int records = rs.getRow();
            if (records > 1) {
                getLogger().log(BasicLevel.ERROR, "There are more than one user with the name" + username);
            }
            password = rs.getString(1).trim();
            rs.close();
            usrStmt.close();
        } catch (SQLException sqle) {
            closeConnection(connection);
            throw new JResourceException(sqle.getMessage());
        }

        if (password == null) {
            closeConnection(connection);
            return null;
        }
        user.setPassword(password);

        // Get the roles of the user
        try {
            PreparedStatement rlStmt = roleStatement(connection, username);
            rs = rlStmt.executeQuery();

            while (rs.next()) {
                String role = rs.getString(1).trim();
                user.addRole(role);
            }
            rs.close();
            rlStmt.close();
        } catch (SQLException sqle) {
            closeConnection(connection);
            throw new JResourceException(sqle.getMessage());
        }

        // Commit the connection if it is not automatic
        try {
            if (!connection.getAutoCommit()) {
                connection.commit();
            }
        } catch (SQLException sqle) {
            getLogger().log(BasicLevel.DEBUG, "Cannot commit on the current connection :  : '"
                            + sqle.getMessage() + "'");
        }
        closeConnection(connection);
        return user;
    }

    public boolean isValidUser(User user, String credentials) {

        boolean validated = false;

        //Get algorithm and hashpassword
        String pass = user.getHashPassword().getPassword();
        String algo = user.getHashPassword().getAlgorithm();

        // Crypt password ?
        if (algo != null) {
            try {
                validated = HashHelper.hashPassword(credentials, algo)
                        .equalsIgnoreCase(pass);
            } catch (NoSuchAlgorithmException nsae) {
                getLogger().log(
                        BasicLevel.ERROR,
                        "Can't make a password with the algorithm " + algo
                                + ". " + nsae.getMessage());
            }
        } else if ((algorithm != null) && (!algorithm.equals(""))) {
            // Encode password with the specified algorithm (no clear)
            try {
                validated = HashHelper.hashPassword(credentials, algorithm)
                        .equalsIgnoreCase(pass);
            } catch (NoSuchAlgorithmException nsae) {
                getLogger().log(
                        BasicLevel.ERROR,
                        "Can't make a password with the algorithm " + algorithm
                                + ". " + nsae.getMessage());
            }
        } else {
            // clear password
            validated = credentials.equals(pass);
        }
        return validated;
    }

    public ArrayList getArrayListCombinedRoles(User user)
            throws JResourceException {

        ArrayList allCombinedRoles = new ArrayList();

        // Return empty array if user null
        if (user == null) {
            return allCombinedRoles;
        }
        // Add all user roles
        String[] userRoles = user.getArrayRoles();
        for (int r = 0; r < userRoles.length; r++) {
            String roleName = userRoles[r];
            if (!allCombinedRoles.contains(roleName)) {
                allCombinedRoles.add(roleName);
            }
        }
        user.setCombinedRoles(allCombinedRoles);

        return allCombinedRoles;
    }

    public String toXML() {
        StringBuffer xml = new StringBuffer("    <dsrealm name=\"");
        xml.append(getName());
        xml.append("\"\n             dsName=\"");
        if (dsName != null) {
            xml.append(dsName);
        }
        xml.append("\"\n             userTable=\"");
        if (userTable != null) {
            xml.append(userTable);
        }
        xml.append("\" userTableUsernameCol=\"");
        if (userTableUsernameCol != null) {
            xml.append(userTableUsernameCol);
        }
        xml.append("\" userTablePasswordCol=\"");
        if (userTablePasswordCol != null) {
            xml.append(userTablePasswordCol);
        }
        xml.append("\"\n             roleTable=\"");
        if (roleTable != null) {
            xml.append(roleTable);
        }
        xml.append("\" roleTableUsernameCol=\"");
        if (roleTableUsernameCol != null) {
            xml.append(roleTableUsernameCol);
        }
        xml.append("\" roleTableRolenameCol=\"");
        if (roleTableRolenameCol != null) {
            xml.append(roleTableRolenameCol);
        }

        if ((userPrincipalsQuery != null) && (!userPrincipalsQuery.equals(""))) {
            xml.append("\"\n             userPrincipalsQuery=\"");
            xml.append(userPrincipalsQuery);
        }

        if ((userRolesQuery != null) && (!userRolesQuery.equals(""))) {
            xml.append("\"\n             userRolesQuery=\"");
            xml.append(userRolesQuery);
        }

        if ((algorithm != null) && (!algorithm.equals(""))) {
            xml.append("\"\n             algorithm=\"");
            xml.append(algorithm);
        }

        xml.append("\" />");
        return xml.toString();
    }

    public String toString() {
        return this.toXML();
    }

    public Reference getReference() throws NamingException {

        // Build the reference to the factory FACTORY_TYPE
        Reference reference = new Reference(FACTORY_TYPE, FACTORY_NAME, null);

        // Add ref addr
        reference.add(new StringRefAddr("name", getName()));
        reference.add(new StringRefAddr("dsName", dsName));
        reference.add(new StringRefAddr("userTable", userTable));
        reference.add(new StringRefAddr("userTableUsernameCol",
                userTableUsernameCol));
        reference.add(new StringRefAddr("userTablePasswordCol",
                userTablePasswordCol));
        reference.add(new StringRefAddr("roleTable", roleTable));
        reference.add(new StringRefAddr("roleTableUsernameCol",
                roleTableUsernameCol));
        reference.add(new StringRefAddr("roleTableRolenameCol",
                roleTableRolenameCol));
        reference.add(new StringRefAddr("userPrincipalsQuery",
                userPrincipalsQuery));
        reference.add(new StringRefAddr("userRolesQuery", userRolesQuery));
        reference.add(new StringRefAddr("algorithm", algorithm));

        return reference;
    }

    private void closeConnection(Connection c) {
        if (c == null) {
            return;
        }
        try {
            c.close();
        } catch (Exception e) {
            getLogger().log(BasicLevel.DEBUG, "Can not close the connection");
        }

    }

    private Connection getConnection() throws JResourceException {

        // If no dataSource, get an instance
        if (dataSource == null) {
            // Finds DataSource from JNDI
            Context initialContext = null;
            try {
                initialContext = new InitialContext();
                dataSource = (DataSource) initialContext.lookup(dsName);
            } catch (Exception e) {
                String err = "Could not found resource " + dsName
                        + " in the registry" + e.getMessage();
                getLogger().log(BasicLevel.ERROR, err);
                throw new JResourceException(err);
            }
        }

        Connection c = null;

        // Check if the request come from a client or inside the server
        // Required until a dbm datasource can be called from a client
        if (dataSource instanceof ConnectionManager) {
            ConnectionManager cm = (ConnectionManager) dataSource;
            // Client or server case ?
            if (cm.isClientCase()) {
                // Build a JDBC connection with getting parameters from the object
                // ConnectionManager
                try {
                    // Load driver
                    Class.forName(cm.getClassName());
                    // create the connection
                    c = DriverManager.getConnection(cm.getUrl(), cm.getUserName(),
                            cm.getPassword());
                } catch (Exception de) {
                    getLogger().log(BasicLevel.ERROR, de.getMessage());
                    throw new JResourceException(
                            "Can not build a connection using the jdbc parameters :"
                                    + de.getMessage());
                }
            }
        }

        if (c == null) {
            //Use the datasource
            // Retrieve connection from the datasource
            try {
                c = dataSource.getConnection();
            } catch (SQLException sqle) {
                getLogger().log(BasicLevel.ERROR, sqle.getMessage());
                throw new JResourceException(sqle.getMessage());
            }

        }

        return c;
    }

    private String userQuery() {

        if (userPrincipalsQuery != null) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(
                        BasicLevel.DEBUG,
                        "Return user defined SQL query for user"
                                + userPrincipalsQuery);
            }
            return userPrincipalsQuery;
        } else {

            /*
             * SELECT userTablePasswordCol FROM userTable WHERE
             * userTableUsernameCol = ?
             */
            StringBuffer stringBuffer = new StringBuffer("SELECT ");
            stringBuffer.append(userTablePasswordCol);
            stringBuffer.append(" FROM ");
            stringBuffer.append(userTable);
            stringBuffer.append(" WHERE ");
            stringBuffer.append(userTableUsernameCol);
            stringBuffer.append(" = ?");
            return (stringBuffer.toString());
        }
    }

    private String rolesOfUserQuery() {

        if (userRolesQuery != null) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(
                        BasicLevel.DEBUG,
                        "Return user defined SQL query for roles"
                                + userRolesQuery);
            }
            return userRolesQuery;
        } else {

            /*
             * SELECT r.roleTableRolenameCol FROM userTable u, roleTable r WHERE
             * u.userTableUsernameCol = r.roleTableUsernameCol AND
             * u.userTableUsernameCol = ?
             */

            StringBuffer stringBuffer = new StringBuffer("SELECT r.");
            stringBuffer.append(roleTableRolenameCol);
            stringBuffer.append(" FROM ");
            stringBuffer.append(userTable);
            stringBuffer.append(" u, ");
            stringBuffer.append(roleTable);
            stringBuffer.append(" r WHERE u.");
            stringBuffer.append(userTableUsernameCol);
            stringBuffer.append(" = r.");
            stringBuffer.append(roleTableUsernameCol);
            stringBuffer.append(" AND u.");
            stringBuffer.append(userTableUsernameCol);
            stringBuffer.append(" = ?");
            return stringBuffer.toString();
        }
    }

    private PreparedStatement userStatement(Connection connection,
            String username) throws SQLException {

        if (getLogger().isLoggable(BasicLevel.DEBUG)) {
            getLogger().log(BasicLevel.DEBUG,
                    "Creating user statement for the user '" + username + "'");
        }

        PreparedStatement userStatement = connection.prepareStatement(userQuery());

        userStatement.setString(1, username);
        return userStatement;
    }

    private PreparedStatement roleStatement(Connection connection,
            String username) throws SQLException {

        if (getLogger().isLoggable(BasicLevel.DEBUG)) {
            getLogger().log(BasicLevel.DEBUG,
                    "Creating role statement for the user " + username + "'");
        }
        PreparedStatement roleStatement = connection.prepareStatement(rolesOfUserQuery());

        roleStatement.setString(1, username);

        return roleStatement;
    }

    public void removeMBeans() throws JResourceException {
        //no MBeans
    }

}

---