001/*
002 * (C) Copyright 2010-2016 Nuxeo SA (http://nuxeo.com/) and others.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *     http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 *
016 * Contributors:
017 *     Nuxeo - initial API and implementation
018 */
019package org.nuxeo.ecm.platform.ui.web.auth.cas2;
020
021import static org.nuxeo.ecm.platform.ui.web.auth.NXAuthConstants.SSO_INITIAL_URL_REQUEST_KEY;
022
023import java.io.IOException;
024import java.security.Principal;
025
026import javax.servlet.ServletException;
027import javax.servlet.http.Cookie;
028import javax.servlet.http.HttpServletRequest;
029import javax.servlet.http.HttpServletResponse;
030
031import org.nuxeo.ecm.core.api.NuxeoException;
032import org.nuxeo.ecm.core.api.NuxeoPrincipal;
033import org.nuxeo.ecm.platform.ui.web.auth.NXAuthConstants;
034import org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService;
035import org.nuxeo.ecm.platform.url.api.DocumentView;
036import org.nuxeo.ecm.platform.web.common.exceptionhandling.DefaultNuxeoExceptionHandler;
037import org.nuxeo.ecm.platform.web.common.exceptionhandling.ExceptionHelper;
038import org.nuxeo.runtime.api.Framework;
039
040public class SecurityExceptionHandler extends DefaultNuxeoExceptionHandler {
041
042    public static final String CAS_REDIRECTION_URL = "/cas2.jsp";
043
044    public static final String COOKIE_NAME_LOGOUT_URL = "cookie.name.logout.url";
045
046    Cas2Authenticator cas2Authenticator;
047
048    public SecurityExceptionHandler() {
049    }
050
051    @Override
052    public void handleException(HttpServletRequest request, HttpServletResponse response, Throwable t)
053            throws IOException, ServletException {
054
055        if (response.containsHeader("Cache-Control")) {
056            response.setHeader("Cache-Control", "no-cache");
057        }
058
059        Throwable unwrappedException = ExceptionHelper.unwrapException(t);
060
061        if (!ExceptionHelper.isSecurityError(unwrappedException)
062                && !response.containsHeader(SSO_INITIAL_URL_REQUEST_KEY)) {
063            super.handleException(request, response, t);
064            return;
065        }
066
067        Principal principal = getPrincipal(request);
068        if (principal instanceof NuxeoPrincipal) {
069            NuxeoPrincipal nuxeoPrincipal = (NuxeoPrincipal) principal;
070            // redirect to login than to requested page
071            if (nuxeoPrincipal.isAnonymous()) {
072                response.resetBuffer();
073
074                String urlToReach = getURLToReach(request);
075                Cookie cookieUrlToReach = new Cookie(NXAuthConstants.SSO_INITIAL_URL_REQUEST_KEY, urlToReach);
076                cookieUrlToReach.setPath("/");
077                cookieUrlToReach.setMaxAge(60);
078                response.addCookie(cookieUrlToReach);
079
080                if (!response.isCommitted()) {
081                    request.getRequestDispatcher(CAS_REDIRECTION_URL).forward(request, response);
082                }
083                parameters.getListener().responseComplete();
084                return;
085            }
086        }
087        // go back to default handler
088        super.handleException(request, response, t);
089    }
090
091    protected Cas2Authenticator getCasAuthenticator() {
092        if (cas2Authenticator != null) {
093            return cas2Authenticator;
094        }
095
096        PluggableAuthenticationService service = Framework.getService(PluggableAuthenticationService.class);
097        if (service == null) {
098            throw new NuxeoException("Can't initialize Nuxeo Pluggable Authentication Service");
099        }
100
101        cas2Authenticator = (Cas2Authenticator) service.getPlugin("CAS2_AUTH");
102
103        if (cas2Authenticator == null) {
104            throw new NuxeoException("Can't get CAS authenticator");
105        }
106        return cas2Authenticator;
107    }
108
109    protected String getURLToReach(HttpServletRequest request) {
110        return request.getRequestURL().toString() + "?" + request.getQueryString();
111    }
112
113}