Merged HEAD (5.2) to 5.2.N (5.2.1)

127556 jkaabimofrad: Merged API-STRIKES-BACK (5.2.0) to HEAD (5.2)
      125604 jkaabimofrad: RA-933: Initial commit for ticket base authentication.


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/BRANCHES/DEV/5.2.N/root@127650 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

source/java/org/alfresco/rest/api/Authentications.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2005-2016 Alfresco Software Limited.
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.alfresco.rest.api;
+
+import org.alfresco.rest.api.model.LoginTicket;
+import org.alfresco.rest.api.model.LoginTicketResponse;
+import org.alfresco.rest.framework.resource.parameters.Parameters;
+import org.alfresco.rest.framework.webscripts.WithResponse;
+
+/**
+ * @author Jamal Kaabi-Mofrad
+ */
+public interface Authentications
+{
+
+    LoginTicketResponse createTicket(LoginTicket loginRequest, Parameters parameters);
+
+    LoginTicketResponse validateTicket(String ticket, Parameters parameters, WithResponse withResponse);
+
+    void deleteTicket(String ticket, Parameters parameters, WithResponse withResponse);
+}

source/java/org/alfresco/rest/api/PublicApiDeclarativeRegistry.java

@@ -36,15 +36,9 @@ import java.util.Set;
 import org.alfresco.rest.framework.Api;
 import org.alfresco.rest.framework.core.ResourceLocator;
 import org.alfresco.rest.framework.core.ResourceWithMetadata;
-import org.alfresco.rest.framework.core.exceptions.DeletedResourceException;
-import org.alfresco.rest.framework.core.exceptions.UnsupportedResourceOperationException;
 import org.alfresco.rest.framework.resource.actions.interfaces.BinaryResourceAction;
 import org.alfresco.rest.framework.resource.actions.interfaces.EntityResourceAction;
-import org.alfresco.rest.framework.resource.actions.interfaces.RelationshipResourceAction;
 import org.alfresco.rest.framework.resource.actions.interfaces.RelationshipResourceBinaryAction;
-import org.alfresco.rest.framework.resource.actions.interfaces.ResourceAction;
-import org.alfresco.rest.framework.resource.content.BinaryResource;
-import org.alfresco.rest.framework.resource.parameters.CollectionWithPagingInfo;
 import org.apache.commons.lang.StringUtils;
 import org.springframework.extensions.webscripts.ArgumentTypeDescription;
 import org.springframework.extensions.webscripts.Container;
@@ -109,19 +103,20 @@ public class PublicApiDeclarativeRegistry extends DeclarativeRegistry
         Match match = null;
 
         HttpMethod httpMethod = HttpMethod.valueOf(method);
-        if (httpMethod.equals(HttpMethod.GET))
+        boolean isPost = httpMethod.equals(HttpMethod.POST);
+        if (httpMethod.equals(HttpMethod.GET) || isPost)
         {
-            if (uri.equals(PublicApiTenantWebScriptServletRequest.NETWORKS_PATH))
+            if (!isPost && uri.equals(PublicApiTenantWebScriptServletRequest.NETWORKS_PATH))
             {
-                Map<String, String> templateVars = new HashMap<String, String>();
+                Map<String, String> templateVars = new HashMap<>();
                 templateVars.put("apiScope", "public");
                 templateVars.put("apiVersion", "1");
                 templateVars.put("apiName", "networks");
                 match = new Match("", templateVars, "", getNetworksWebScript);
             }
-            else if (uri.equals(PublicApiTenantWebScriptServletRequest.NETWORK_PATH))
+            else if (!isPost && uri.equals(PublicApiTenantWebScriptServletRequest.NETWORK_PATH))
             {
-                Map<String, String> templateVars = new HashMap<String, String>();
+                Map<String, String> templateVars = new HashMap<>();
                 templateVars.put("apiScope", "public");
                 templateVars.put("apiVersion", "1");
                 templateVars.put("apiName", "network");
@@ -162,6 +157,10 @@ public class PublicApiDeclarativeRegistry extends DeclarativeRegistry
                                 {
                                     resAction = EntityResourceAction.Read.class;
                                 }
+                                else if (EntityResourceAction.Create.class.isAssignableFrom(rwm.getResource().getClass()))
+                                {
+                                    resAction = EntityResourceAction.Create.class;
+                                }
                             }
                             break;
                         case PROPERTY:

source/java/org/alfresco/rest/api/authentications/AuthenticationTicketsEntityResource.java

@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2005-2016 Alfresco Software Limited.
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.alfresco.rest.api.authentications;
+
+import org.alfresco.rest.api.Authentications;
+import org.alfresco.rest.api.model.LoginTicket;
+import org.alfresco.rest.framework.WebApiDescription;
+import org.alfresco.rest.framework.WebApiNoAuth;
+import org.alfresco.rest.framework.core.exceptions.InvalidArgumentException;
+import org.alfresco.rest.framework.resource.EntityResource;
+import org.alfresco.rest.framework.resource.actions.interfaces.EntityResourceAction;
+import org.alfresco.rest.framework.resource.parameters.Parameters;
+import org.alfresco.rest.framework.webscripts.WithResponse;
+import org.alfresco.util.PropertyCheck;
+import org.springframework.beans.factory.InitializingBean;
+
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * @author Jamal Kaabi-Mofrad
+ */
+@EntityResource(name = "tickets", title = "Authentication tickets")
+public class AuthenticationTicketsEntityResource implements EntityResourceAction.Create<LoginTicket>,
+            EntityResourceAction.ReadByIdWithResponse<LoginTicket>,
+            EntityResourceAction.DeleteWithResponse,
+            InitializingBean
+{
+    private Authentications authentications;
+
+    public void setAuthentications(Authentications authentications)
+    {
+        this.authentications = authentications;
+    }
+
+    @Override
+    public void afterPropertiesSet() throws Exception
+    {
+        PropertyCheck.mandatory(this, "authentications", authentications);
+    }
+
+    @WebApiDescription(title = "Login", description = "Login.")
+    @WebApiNoAuth
+    @Override
+    public List<LoginTicket> create(List<LoginTicket> entity, Parameters parameters)
+    {
+        if (entity == null || entity.size() != 1)
+        {
+            throw new InvalidArgumentException("Please specify one login request only.");
+        }
+        LoginTicket result = authentications.createTicket(entity.get(0), parameters);
+        return Collections.singletonList(result);
+    }
+
+    @WebApiDescription(title = "Validate login ticket", description = "Validates the specified ticket is still valid.")
+    @Override
+    public LoginTicket readById(String ticket, Parameters parameters, WithResponse withResponse)
+    {
+        return authentications.validateTicket(ticket, parameters, withResponse);
+    }
+
+    @WebApiDescription(title = "Logout", description = "Logout.")
+    @Override
+    public void delete(String ticket, Parameters parameters, WithResponse withResponse)
+    {
+        authentications.deleteTicket(ticket, parameters, withResponse);
+    }
+}

source/java/org/alfresco/rest/api/authentications/package-info.java

@@ -0,0 +1,5 @@
+@WebApi(name = "alfresco", scope = Api.SCOPE.PUBLIC, version = 1)
+package org.alfresco.rest.api.authentications;
+
+import org.alfresco.rest.framework.Api;
+import org.alfresco.rest.framework.WebApi;

source/java/org/alfresco/rest/api/impl/AuthenticationsImpl.java

@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2005-2016 Alfresco Software Limited.
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.alfresco.rest.api.impl;
+
+import org.alfresco.repo.security.authentication.AuthenticationException;
+import org.alfresco.repo.security.authentication.AuthenticationUtil;
+import org.alfresco.repo.security.authentication.TicketComponent;
+import org.alfresco.rest.api.Authentications;
+import org.alfresco.rest.api.model.LoginTicket;
+import org.alfresco.rest.api.model.LoginTicketResponse;
+import org.alfresco.rest.framework.core.exceptions.InvalidArgumentException;
+import org.alfresco.rest.framework.core.exceptions.PermissionDeniedException;
+import org.alfresco.rest.framework.resource.parameters.Parameters;
+import org.alfresco.rest.framework.webscripts.WithResponse;
+import org.alfresco.service.cmr.security.AuthenticationService;
+import org.alfresco.util.PropertyCheck;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.extensions.webscripts.Status;
+
+/**
+ * @author Jamal Kaabi-Mofrad
+ */
+public class AuthenticationsImpl implements Authentications
+{
+    private AuthenticationService authenticationService;
+    private TicketComponent ticketComponent;
+
+    public void setAuthenticationService(AuthenticationService authenticationService)
+    {
+        this.authenticationService = authenticationService;
+    }
+
+    public void setTicketComponent(TicketComponent ticketComponent)
+    {
+        this.ticketComponent = ticketComponent;
+    }
+
+    public void init()
+    {
+        PropertyCheck.mandatory(this, "authenticationService", authenticationService);
+        PropertyCheck.mandatory(this, "ticketComponent", ticketComponent);
+    }
+
+    @Override
+    public LoginTicketResponse createTicket(LoginTicket loginRequest, Parameters parameters)
+    {
+        validateLoginRequest(loginRequest);
+        try
+        {
+            // get ticket
+            authenticationService.authenticate(loginRequest.getUsername(), loginRequest.getPassword().toCharArray());
+
+            LoginTicketResponse response = new LoginTicketResponse();
+            response.setUsername(loginRequest.getUsername());
+            response.setTicket(authenticationService.getCurrentTicket());
+
+            return response;
+        }
+        catch (AuthenticationException e)
+        {
+            throw new PermissionDeniedException("Login failed");
+        }
+        finally
+        {
+            AuthenticationUtil.clearCurrentSecurityContext();
+        }
+    }
+
+    @Override
+    public LoginTicketResponse validateTicket(String ticket, Parameters parameters, WithResponse withResponse)
+    {
+        if (StringUtils.isEmpty(ticket))
+        {
+            throw new InvalidArgumentException("ticket can't be null or empty.");
+        }
+
+        try
+        {
+            String ticketUser = ticketComponent.validateTicket(ticket);
+
+            String currentUser = AuthenticationUtil.getFullyAuthenticatedUser();
+            // do not go any further if tickets are different
+            // or the user is not fully authenticated
+            if (currentUser == null || !currentUser.equals(ticketUser))
+            {
+                withResponse.setStatus(Status.STATUS_NOT_FOUND);
+            }
+        }
+        catch (AuthenticationException e)
+        {
+            withResponse.setStatus(Status.STATUS_NOT_FOUND);
+        }
+        LoginTicketResponse response = new LoginTicketResponse();
+        response.setTicket(ticket);
+        return response;
+    }
+
+    @Override
+    public void deleteTicket(String ticket, Parameters parameters, WithResponse withResponse)
+    {
+        if (StringUtils.isEmpty(ticket))
+        {
+            throw new InvalidArgumentException("ticket can't be null or empty.");
+        }
+
+        try
+        {
+            String ticketUser = ticketComponent.validateTicket(ticket);
+
+            String currentUser = AuthenticationUtil.getFullyAuthenticatedUser();
+            // do not go any further if tickets are different
+            // or the user is not fully authenticated
+            if (currentUser == null || !currentUser.equals(ticketUser))
+            {
+                withResponse.setStatus(Status.STATUS_NOT_FOUND);
+            }
+            else
+            {
+                // delete the ticket
+                authenticationService.invalidateTicket(ticket);
+            }
+        }
+        catch (AuthenticationException e)
+        {
+            withResponse.setStatus(Status.STATUS_NOT_FOUND);
+        }
+    }
+
+    protected void validateLoginRequest(LoginTicket loginTicket)
+    {
+        if (loginTicket == null || loginTicket.getUsername() == null || loginTicket.getPassword() == null)
+        {
+            throw new InvalidArgumentException("Invalid login details.");
+        }
+    }
+}

source/java/org/alfresco/rest/api/model/LoginTicket.java

@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2005-2016 Alfresco Software Limited.
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.alfresco.rest.api.model;
+
+/**
+ * @author Jamal Kaabi-Mofrad
+ */
+public class LoginTicket
+{
+    protected String username;
+    protected String password;
+    protected String ticket;
+
+    public String getUsername()
+    {
+        return username;
+    }
+
+    public void setUsername(String username)
+    {
+        this.username = username;
+    }
+
+    public String getPassword()
+    {
+        return password;
+    }
+
+    public void setPassword(String password)
+    {
+        this.password = password;
+    }
+
+    public String getTicket()
+    {
+        return ticket;
+    }
+
+    public void setTicket(String ticket)
+    {
+        this.ticket = ticket;
+    }
+
+    @Override
+    public String toString()
+    {
+        final StringBuilder sb = new StringBuilder(150);
+        sb.append("LoginTicket [username=").append(username)
+                    .append(", password=").append(password)
+                    .append(", ticket=").append(ticket)
+                    .append(']');
+        return sb.toString();
+    }
+}

source/java/org/alfresco/rest/api/model/LoginTicketResponse.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2005-2016 Alfresco Software Limited.
+ *
+ * This file is part of Alfresco
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.alfresco.rest.api.model;
+
+/**
+ * @author Jamal Kaabi-Mofrad
+ */
+public class LoginTicketResponse extends LoginTicket
+{
+
+    public LoginTicketResponse()
+    {
+        this.password = null;
+    }
+
+    @Override
+    public String getPassword()
+    {
+        return null;
+    }
+
+    @Override
+    public void setPassword(String password)
+    {
+        // intentionally empty
+    }
+
+    @Override
+    public String toString()
+    {
+        final StringBuilder sb = new StringBuilder(150);
+        sb.append("LoginTicketResponse [username=").append(username)
+                    .append(", password=").append(password)
+                    .append(", ticket=").append(ticket)
+                    .append(']');
+        return sb.toString();
+    }
+}

source/java/org/alfresco/rest/framework/core/ResourceInspector.java

@@ -308,7 +308,7 @@ public class ResourceInspector
 
             if (isNoAuth(aMethod))
             {
-                if (! httpMethod.equals(HttpMethod.GET))
+                if (! (httpMethod.equals(HttpMethod.GET) || httpMethod.equals(HttpMethod.POST)))
                 {
                     throw new IllegalArgumentException("@WebApiNoAuth should only be on GET methods: "+operation.getTitle());
                 }