JResourceLoginModule.java

package org.objectweb.jonas.security.auth.spi;

import java.util.ArrayList;
import java.util.Map;

import javax.naming.InitialContext;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;

import org.objectweb.jonas.security.auth.JGroup;
import org.objectweb.jonas.security.auth.JPrincipal;
import org.objectweb.jonas.security.auth.JRole;
import org.objectweb.jonas.security.auth.callback.CertificateCallback;
import org.objectweb.jonas.security.realm.factory.JResource;
import org.objectweb.jonas.security.realm.factory.JResourceException;
import org.objectweb.jonas.security.realm.principals.User;

public class JResourceLoginModule implements LoginModule {

    private Subject subject = null;

    private CallbackHandler callbackHandler = null;

    private Map options = null;

    private String principalName = null;

    private String password = null;

    private ArrayList principalRoles = null;

    private boolean loginWasDoneWithSuccess = false;;

    public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) {
        this.subject = subject;
        this.callbackHandler = callbackHandler;
        this.options = options;
    }

    public boolean login() throws LoginException {

        // No handler
        if (callbackHandler == null) {
            throw new LoginException("No handler has been defined.");
        }

        // Resource to be used (jndi name)
        String resourceName = (String) options.get("resourceName");

        // Use certificate callback
        String certCallback = (String) options.get("certCallback");

        // No resource is specified -> fail
        if (resourceName == null) {
            throw new LoginException(
                    "You have to give an argument to this login module. The 'resourceName' parameter is required.");
        }

        // Get the resource and perform authentication
        try {
            InitialContext ictx = new InitialContext();
            JResource jResource = null;
            try {
                jResource = (JResource) ictx.lookup(resourceName);
            } catch (Exception e) {
                throw createChainedLoginException("Cannot retrieve the resource '" + resourceName
                        + "'. Check that this resource is bound in the registry", e);
            }

            // Handle callbacks
            NameCallback nameCallback = new NameCallback("User :");
            // False to hide password when it is entered
            PasswordCallback passwordCallback = new PasswordCallback("Password :", false);
            CertificateCallback certificateCallback = new CertificateCallback();
            Callback[] callbacks = null;

            if ((certCallback != null) && (Boolean.valueOf(certCallback).booleanValue())) {
                callbacks = new Callback[] {nameCallback, passwordCallback, certificateCallback};
            } else {
                callbacks = new Callback[] {nameCallback, passwordCallback};
            }
            callbackHandler.handle(callbacks);

            // Get values
            principalName = nameCallback.getName();
            if (principalName == null) {
                throw new LoginException("A null username is not a valid username");
            }
            if (principalName.startsWith("##DN##") && (certificateCallback.getUserCertificate() == null)) {
                throw new LoginException("Name must have a certificate to access this certificate based access login");
            }
            char[] arrayPass = passwordCallback.getPassword();
            if (arrayPass == null) {
                throw new LoginException("A null password is not a valid password");
            }

            // Authentication - step 1 (user)
            User user = null;
            try {
                user = jResource.findUser(principalName);
            } catch (Exception jre) {
                // could not retrieve user
                throw createChainedLoginException("Can not find the user", jre);
            }
            // User was not found
            if (user == null) {
                throw new LoginException("User '" + principalName + "' not found.");
            }

            // Authentication - step 2 (password)
            boolean validated = jResource.isValidUser(user, new String(arrayPass));
            if (!validated) {
                throw new LoginException("The password for the user '" + principalName + "' is not valid");
            }
            this.password = user.getPassword();
            // Authentication - step 3 (roles)
            try {
                principalRoles = jResource.getArrayListCombinedRoles(user);
            } catch (JResourceException jre) {
                throw createChainedLoginException(jre.getMessage(), jre);
            }

        } catch (Exception e) {
            throw createChainedLoginException("Error during the login phase : " + e.getMessage(), e);
        }
        loginWasDoneWithSuccess = true;
        return true;
    }

    private static LoginException createChainedLoginException(String msg, Exception e) {
        LoginException le = new LoginException(msg);
        le.initCause(e);
        return le;
    }

    public boolean commit() throws LoginException {

            //overall authentication succeeded
        if (loginWasDoneWithSuccess) {
            // Add principal to the current subject
            subject.getPrincipals().add(new JPrincipal(principalName));
            subject.getPrivateCredentials().add(password);
            JGroup group = new JGroup("Roles");

            // Convert list into array
            String[] roles = new String[principalRoles.size()];
            roles = (String[]) principalRoles.toArray(roles);
            int size = principalRoles.size();
            for (int i = 0; i < size; i++) {
                group.addMember(new JRole(roles[i]));
            }

            // Add group
            subject.getPrincipals().add(group);
        }
        return loginWasDoneWithSuccess;
    }

    public boolean abort() throws LoginException {
        //overall authentication succeeded
        if (loginWasDoneWithSuccess) {
            // Reset temp values
            principalName = null;
            principalRoles = null;
        }
        return loginWasDoneWithSuccess;
    }

    public boolean logout() throws LoginException {

        //overall authentication succeeded
        if (loginWasDoneWithSuccess) {
            // Remove principal name
            subject.getPrincipals().remove(new JPrincipal(principalName));
        }

        return loginWasDoneWithSuccess;
    }

}

---