001/* 002 * (C) Copyright 2006-2007 Nuxeo SAS (http://nuxeo.com/) and contributors. 003 * 004 * All rights reserved. This program and the accompanying materials 005 * are made available under the terms of the GNU Lesser General Public License 006 * (LGPL) version 2.1 which accompanies this distribution, and is available at 007 * http://www.gnu.org/licenses/lgpl.html 008 * 009 * This library is distributed in the hope that it will be useful, 010 * but WITHOUT ANY WARRANTY; without even the implied warranty of 011 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 012 * Lesser General Public License for more details. 013 * 014 * Contributors: 015 * Thierry Delprat 016 * 017 * $Id: AnonymousAuthenticator.java 30865 2008-03-11 09:00:53Z arussel $ 018 */ 019 020package org.nuxeo.ecm.platform.ui.web.auth.plugins; 021 022import java.security.Principal; 023import java.util.List; 024import java.util.Map; 025 026import javax.servlet.http.HttpServletRequest; 027import javax.servlet.http.HttpServletResponse; 028import javax.servlet.http.HttpSession; 029 030import org.apache.commons.logging.Log; 031import org.apache.commons.logging.LogFactory; 032import org.nuxeo.ecm.core.api.NuxeoPrincipal; 033import org.nuxeo.ecm.platform.api.login.UserIdentificationInfo; 034import org.nuxeo.ecm.platform.ui.web.auth.interfaces.NuxeoAuthenticationPlugin; 035import org.nuxeo.ecm.platform.ui.web.auth.interfaces.NuxeoAuthenticationPluginLogoutExtension; 036import org.nuxeo.ecm.platform.usermanager.UserManager; 037import org.nuxeo.runtime.api.Framework; 038 039/** 040 * @author Thierry Delprat 041 */ 042public class AnonymousAuthenticator implements NuxeoAuthenticationPlugin, NuxeoAuthenticationPluginLogoutExtension { 043 044 public static final String BLOCK_ANONYMOUS_LOGIN_KEY = "org.nuxeo.ecm.platform.ui.web.auth.anonymous.block"; 045 046 private static final Log log = LogFactory.getLog(AnonymousAuthenticator.class); 047 048 protected boolean initialized; 049 050 protected String anonymousLogin; 051 052 // Called by JSP page 053 public static boolean isAnonymousRequest(HttpServletRequest httpRequest) { 054 Principal user = httpRequest.getUserPrincipal(); 055 if (user != null && user instanceof NuxeoPrincipal) { 056 return ((NuxeoPrincipal) user).isAnonymous(); 057 } 058 return false; 059 } 060 061 public UserIdentificationInfo handleRetrieveIdentity(HttpServletRequest httpRequest, 062 HttpServletResponse httpResponse) { 063 if (!initialized) { 064 UserManager userManager = Framework.getService(UserManager.class); 065 if (userManager != null) { 066 anonymousLogin = userManager.getAnonymousUserId(); 067 } 068 initialized = true; 069 } 070 if (anonymousLogin == null) { 071 return null; 072 } 073 074 if (isAnonymousLoginBlocked(httpRequest)) { 075 return null; 076 } 077 078 return new UserIdentificationInfo(anonymousLogin, anonymousLogin); 079 } 080 081 protected boolean isAnonymousLoginBlocked(HttpServletRequest httpRequest) { 082 if (Boolean.TRUE.equals(httpRequest.getAttribute(BLOCK_ANONYMOUS_LOGIN_KEY))) { 083 httpRequest.removeAttribute(BLOCK_ANONYMOUS_LOGIN_KEY); 084 return true; 085 } 086 087 HttpSession session = httpRequest.getSession(false); 088 if (session != null && Boolean.TRUE.equals(session.getAttribute(BLOCK_ANONYMOUS_LOGIN_KEY))) { 089 // next logout will clear the session anyway !! 090 // session.setAttribute(BLOCK_ANONYMOUS_LOGIN_KEY, false); 091 return true; 092 } 093 return false; 094 } 095 096 public void initPlugin(Map<String, String> parameters) { 097 // NOP 098 } 099 100 public Boolean needLoginPrompt(HttpServletRequest httpRequest) { 101 return Boolean.FALSE; 102 } 103 104 public List<String> getUnAuthenticatedURLPrefix() { 105 return null; 106 } 107 108 public Boolean handleLoginPrompt(HttpServletRequest httpRequest, HttpServletResponse httpResponse, String baseURL) { 109 return null; 110 } 111 112 public Boolean handleLogout(HttpServletRequest httpRequest, HttpServletResponse httpResponse) { 113 return Boolean.FALSE; 114 } 115 116}