inteligr8/alfresco-keycloak
1
0
Fork 0
mirror of https://github.com/bmlong137/alfresco-keycloak.git synced 2025-09-10 14:11:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add suport for user name correction in Share

Browse Source 
- effectively support login by alternative identity attributes, e.g.
  Keycloak login by email
This commit is contained in:
AFaust
2020-09-04 21:39:32 +02:00
parent 96746690b3
commit 74f79afa8a
4 changed files with 273 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
repository/src/main/webscripts/de/acosix/keycloak/effectiveUserName.get.desc.xml Normal file
View File

@@ -0,0 +1,9 @@
<?xml version="1.0" encoding="utf-8"?>
<webscript>
<shortname>Get effective user name</shortname>
<description>Retrieves the effective name for the currently authenticated user</description>
<url>/acosix/api/keycloak/effectiveUserName</url>
<format default="json">argument</format>
<authentication>user</authentication>
<transaction buffersize="4096" allow="readonly">required</transaction>
</webscript>

3
repository/src/main/webscripts/de/acosix/keycloak/effectiveUserName.get.json.ftl Normal file
View File

@@ -0,0 +1,3 @@
<#compress><#escape x as jsonUtils.encodeJSONString(x)>{
"userName": "${person.properties.userName}"
}</#escape></#compress>

17
share/src/main/config/module-context.xml
View File

@@ -61,6 +61,23 @@
<property name="merge" value="true" />
</bean>
<bean id="${moduleId}.userNameCorrectingLoginControllerImplementationPatch"
class="de.acosix.alfresco.utility.common.spring.ImplementationClassReplacingBeanFactoryPostProcessor">
<property name="targetBeanName" value="loginController" />
<property name="originalClassName" value="org.alfresco.web.site.servlet.SlingshotLoginController" />
<property name="replacementClassName" value="${project.artifactId}.web.UserNameCorrectingSlingshotLoginController" />
<property name="enabled" value="true" />
</bean>
<bean id="${moduleId}.userNameCorrectingLoginControllerConnectorServicePatch"
class="de.acosix.alfresco.utility.common.spring.PropertyAlteringBeanFactoryPostProcessor">
<property name="targetBeanName" value="loginController" />
<property name="expectedClassName" value="${project.artifactId}.web.UserNameCorrectingSlingshotLoginController" />
<property name="propertyName" value="connectorService" />
<property name="beanReferenceName" value="connector.service" />
<property name="enabled" value="true" />
</bean>
<bean id="${moduleId}.SessionIdMapper" class="${project.artifactId}.web.DefaultSessionIdMapper">
<property name="configService" ref="web.config" />
</bean>

244
share/src/main/java/de/acosix/alfresco/keycloak/share/web/UserNameCorrectingSlingshotLoginController.java Normal file
View File

@@ -0,0 +1,244 @@
/*
* Copyright 2019 - 2020 Acosix GmbH
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package de.acosix.alfresco.keycloak.share.web;
import java.util.HashMap;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.alfresco.error.AlfrescoRuntimeException;
import org.alfresco.util.PropertyCheck;
import org.alfresco.web.site.servlet.SlingshotLoginController;
import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
import org.json.simple.parser.ParseException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.extensions.surf.RequestContext;
import org.springframework.extensions.surf.RequestContextUtil;
import org.springframework.extensions.surf.UserFactory;
import org.springframework.extensions.surf.exception.ConnectorServiceException;
import org.springframework.extensions.surf.exception.RequestContextException;
import org.springframework.extensions.surf.support.AlfrescoUserFactory;
import org.springframework.extensions.surf.support.ThreadLocalRequestContext;
import org.springframework.extensions.webscripts.Status;
import org.springframework.extensions.webscripts.connector.Connector;
import org.springframework.extensions.webscripts.connector.ConnectorContext;
import org.springframework.extensions.webscripts.connector.ConnectorService;
import org.springframework.extensions.webscripts.connector.CredentialVault;
import org.springframework.extensions.webscripts.connector.Credentials;
import org.springframework.extensions.webscripts.connector.HttpMethod;
import org.springframework.extensions.webscripts.connector.Response;
/**
* This specialised variant of a login controller performs user name corrections upon successful authantication of a user, in case the
* Repository tier authentication has resulted in any deviation from the user-provided user name. This may be the case because of case
* matching or alternative login attributes (like email) being supported that resolve back to a preferred user name.
*
* @author Axel Faust
*/
public class UserNameCorrectingSlingshotLoginController extends SlingshotLoginController implements InitializingBean
{
private static final Logger LOGGER = LoggerFactory.getLogger(UserNameCorrectingSlingshotLoginController.class);
protected ConnectorService connectorService;
/**
*
* {@inheritDoc}
*/
@Override
public void afterPropertiesSet()
{
PropertyCheck.mandatory(this, "connectorService", this.connectorService);
}
/**
* @param connectorService
* the connectorService to set
*/
public void setConnectorService(final ConnectorService connectorService)
{
this.connectorService = connectorService;
}
/**
*
* {@inheritDoc}
*/
@Override
protected void onSuccess(final HttpServletRequest request, final HttpServletResponse response) throws Exception
{
final HttpSession session = request.getSession();
String userName = request.getParameter(PARAM_USERNAME);
if (userName == null)
{
userName = (String) session.getAttribute(UserFactory.SESSION_ATTRIBUTE_KEY_USER_ID);
}
final String effectiveUserName = this.loadEffectiveUserName(request, session, userName);
HttpServletRequest effectiveRequest = request;
if (effectiveUserName != null && !effectiveUserName.equals(userName))
{
// store the proper user ID in session and facade the servlet request for the remainder of the operation to expose only the
// effective user name
session.setAttribute(UserFactory.SESSION_ATTRIBUTE_KEY_USER_ID, effectiveUserName);
effectiveRequest = new HttpServletRequestWrapper(request)
{
/**
*
* {@inheritDoc}
*/
@Override
public String getParameter(final String name)
{
if (PARAM_USERNAME.equals(name))
{
return effectiveUserName;
}
return super.getParameter(name);
}
/**
*
* {@inheritDoc}
*/
@Override
public String[] getParameterValues(final String name)
{
if (PARAM_USERNAME.equals(name))
{
return new String[] { effectiveUserName };
}
return super.getParameterValues(name);
}
/**
*
* {@inheritDoc}
*/
@Override
public Map<String, String[]> getParameterMap()
{
final Map<String, String[]> map = new HashMap<>(super.getParameterMap());
map.put(PARAM_USERNAME, this.getParameterValues(PARAM_USERNAME));
return map;
}
};
// map existing credentials to the new user name
final CredentialVault credentialVault = this.connectorService.getCredentialVault(session, userName);
if (credentialVault != null)
{
final CredentialVault newCredentialVault = this.connectorService.getCredentialVault(session, effectiveUserName);
for (final String storeId : credentialVault.getStoredIds())
{
final Credentials credentials = credentialVault.retrieve(storeId);
final Credentials newCredentials = newCredentialVault.newCredentials(storeId);
newCredentials.setProperty(Credentials.CREDENTIAL_USERNAME, effectiveUserName);
newCredentials.setProperty(Credentials.CREDENTIAL_PASSWORD, credentials.getProperty(Credentials.CREDENTIAL_PASSWORD));
}
}
}
super.onSuccess(effectiveRequest, response);
}
/**
* Attempts to load the effective user name for the authenticated user from the backend.
*
* @param request
* the servlet request being processed
* @param session
* the currently active session
* @param userId
* the ID of the user as provided by the user themselves
* @return the effective user name or {@code null} if the effective user name could not be loaded for whatever reason (will be logged)
*/
protected String loadEffectiveUserName(final HttpServletRequest request, final HttpSession session, final String userId)
{
String effectiveUserName;
try
{
final Connector connector = this.connectorService.getConnector(AlfrescoUserFactory.ALFRESCO_ENDPOINT_ID, userId, session);
// bug in default Alfresco RequestCachingConnector: with ConnectorContext having HttpMethod.GET, null check of
// ThreadLocalRequestContext.getRequestContext() is short-circuited, causing NPE on access
final RequestContext requestContext = ThreadLocalRequestContext.getRequestContext();
if (requestContext == null)
{
try
{
RequestContextUtil.initRequestContext(this.getApplicationContext(), request, true);
}
catch (final RequestContextException e)
{
LOGGER.error("Failed to initialise request context", e);
throw new AlfrescoRuntimeException("Failed to initialise request context", e);
}
}
final ConnectorContext c = new ConnectorContext(HttpMethod.GET);
c.setContentType("application/json");
final Response res = connector.call("/acosix/api/keycloak/effectiveUserName", c);
if (res.getStatus().getCode() == Status.STATUS_OK)
{
final String responseText = res.getResponse();
final JSONParser jsonParser = new JSONParser();
final Object userData = jsonParser.parse(responseText.toString());
if (userData instanceof JSONObject)
{
effectiveUserName = (String) ((JSONObject) userData).get("userName");
}
else
{
LOGGER.warn("Response in call to load effective user name for {} was not a proper JSON object", userId);
effectiveUserName = null;
}
}
else
{
if (res.getStatus().getCode() == 401)
{
LOGGER.debug("Failed to load effective user name for {} with backend call as authentication was not / no longer active",
userId);
}
else
{
LOGGER.warn("Failed to load effective user name for {} with backend call resulting in HTTP response with status {} {}",
userId, res.getStatus().getCode(), res.getStatus().getMessage());
}
effectiveUserName = null;
}
}
catch (final ConnectorServiceException | ParseException ex)
{
LOGGER.error("Failed to load effective user name for {}", userId, ex);
effectiveUserName = null;
}
return effectiveUserName;
}
}