SecurityService.java

/*
 * Copyright (c) 2002-2022, City of Paris
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *  1. Redistributions of source code must retain the above copyright notice
 *     and the following disclaimer.
 *
 *  2. Redistributions in binary form must reproduce the above copyright notice
 *     and the following disclaimer in the documentation and/or other materials
 *     provided with the distribution.
 *
 *  3. Neither the name of 'Mairie de Paris' nor 'Lutece' nor the names of its
 *     contributors may be used to endorse or promote products derived from
 *     this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * License 1.0
 */
package fr.paris.lutece.portal.service.security;

import fr.paris.lutece.portal.business.event.LuteceUserEvent;
import fr.paris.lutece.portal.service.datastore.DatastoreService;
import fr.paris.lutece.portal.service.event.LuteceUserEventManager;
import fr.paris.lutece.portal.service.init.LuteceInitException;
import fr.paris.lutece.portal.service.util.AppLogService;
import fr.paris.lutece.portal.service.util.AppPropertiesService;
import fr.paris.lutece.util.url.UrlItem;

import java.security.Principal;

import java.util.Collection;
import java.util.Enumeration;
import java.util.List;

import javax.security.auth.login.LoginException;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

/**
 * This class provides a security service to register and check user authentication
 */
public final class SecurityService
{
    /**
     * Session attribute that stores the LuteceUser object attached to the session
     */
    private static final String ATTRIBUTE_LUTECE_USER = "lutece_user";

    private static final String PROPERTY_AUTHENTICATION_CLASS = "mylutece.authentication.class";
    private static final String PROPERTY_AUTHENTICATION_ENABLE = "mylutece.authentication.enable";
    private static final String PROPERTY_PORTAL_AUTHENTICATION_REQUIRED = "mylutece.portal.authentication.required";

    private static final String URL_INTERROGATIVE = "?";
    private static final String URL_AMPERSAND = "&";
    private static final String URL_EQUAL = "=";

    private static final String CONSTANT_ACTION_LOGIN_USER = "user.loginUser";
    private static final String CONSTANT_ACTION_LOGOUT_USER = "user.logoutUser";
    private static final String CONSTANT_FO = "FO";

    private static SecurityService _singleton = new SecurityService( );
    private static LuteceAuthentication _authenticationService;
    private static boolean _bEnable;

    /**
     * Private constructor
     */
    private SecurityService( )
    {
    }

    /**
     * Initialize service
     * 
     * @throws LuteceInitException
     *             if an error occurs
     */
    public static synchronized void init( ) throws LuteceInitException
    {
        _bEnable = false;

        String strEnable = AppPropertiesService.getProperty( PROPERTY_AUTHENTICATION_ENABLE, "false" );

        if ( strEnable.equalsIgnoreCase( "true" ) )
        {
            _authenticationService = getPortalAuthentication( );

            if ( _authenticationService != null )
            {
                _bEnable = true;
            }
        }
        else
        {
            // in case authentication is disabled after having been enabled
            _authenticationService = null;
        }
    }

    /**
     * Get the unique instance of the Security Service
     * 
     * @return The instance
     */
    public static SecurityService getInstance( )
    {
        return _singleton;
    }

    /**
     * Returns the authentication's activation : enable or disable
     * 
     * @return true if the authentication is active, false otherwise
     */
    public static boolean isAuthenticationEnable( )
    {
        return _bEnable;
    }

    /**
     * Gets the LuteceUser attached to the current Http session
     * 
     * @param request
     *            The Http request
     * @return A LuteceUser object if found
     * @throws UserNotSignedException
     *             If there is no current user
     */
    public LuteceUser getRemoteUser( HttpServletRequest request ) throws UserNotSignedException
    {
        LuteceUser user = getRegisteredUser( request );

        if ( user == null )
        {
            // User is not registered by Lutece, but it may be authenticated by another
            // system
            if ( _authenticationService.isExternalAuthentication( ) || _authenticationService.isMultiAuthenticationSupported( ) )
            {
                user = _authenticationService.getHttpAuthenticatedUser( request );

                if ( ( user == null ) && isPortalAuthenticationRequired( ) )
                {
                    throw new UserNotSignedException( );
                }

                registerUser( request, user );
            }
            else
            {
                throw new UserNotSignedException( );
            }
        }

        return user;
    }

    /**
     * Returns the user's principal
     * 
     * @param request
     *            The HTTP request
     * @return The user's principal
     * @throws UserNotSignedException
     *             The UserNotSignedException
     */
    public Principal getUserPrincipal( HttpServletRequest request ) throws UserNotSignedException
    {
        return getRemoteUser( request );
    }

    /**
     * Checks if the user is associated to a given role
     * 
     * @param request
     *            The Http request
     * @param strRole
     *            The Role name
     * @return Returns true if the user is associated to the given role
     */
    public boolean isUserInRole( HttpServletRequest request, String strRole )
    {
        LuteceUser user;

        if ( !isAuthenticationEnable( ) )
        {
            return true;
        }

        try
        {
            user = getRemoteUser( request );
        }
        catch( UserNotSignedException e )
        {
            return false;
        }

        return _authenticationService.isUserInRole( user, request, strRole );
    }

    /**
     * Checks if the user is associated to a at least a role
     * 
     * @param request
     *            The Http request
     * @param listRoles
     *            The Role list
     * @return Returns true if the user is associated to any role
     */
    public boolean isUserInAnyRole( HttpServletRequest request, List<String> listRoles )
    {
        boolean bAutorized = false;
        for ( String strRole : listRoles )
        {
            if ( isUserInRole( request, strRole ) )
            {
                bAutorized = true;
                break;
            }
        }
        return bAutorized;
    }

    /**
     * get all roles for this user : - user's roles - user's groups roles
     *
     * @param user
     *            The user
     * @return Array of roles
     */
    public String [ ] getRolesByUser( LuteceUser user )
    {
        return _authenticationService.getRolesByUser( user );
    }

    /**
     * Checks user's login with the Authentication service.
     * 
     * @param request
     *            The Http request
     * @param strUserName
     *            The user's login
     * @param strPassword
     *            The user's password
     * @throws LoginException
     *             The LoginException
     * @throws LoginRedirectException
     *             if redirect exception
     */
    public void loginUser( HttpServletRequest request, final String strUserName, final String strPassword ) throws LoginException, LoginRedirectException
    {
        LuteceUser user = _authenticationService.login( strUserName, strPassword, request );

        _authenticationService.updateDateLastLogin( user, request );

        if ( _authenticationService.findResetPassword( request, strUserName ) )
        {
            String redirect = _authenticationService.getResetPasswordPageUrl( request );
            registerUser( request, user );
            AccessLogService.getInstance( ).info( AccessLoggerConstants.EVENT_TYPE_CONNECT, CONSTANT_ACTION_LOGIN_USER, user, null, CONSTANT_FO );

            throw new LoginRedirectException( redirect );
        }

        registerUser( request, user );

        AccessLogService.getInstance( ).info( AccessLoggerConstants.EVENT_TYPE_CONNECT, CONSTANT_ACTION_LOGIN_USER, user, null, CONSTANT_FO );

    }

    /**
     * Logout the user
     * 
     * @param request
     *            The HTTP request
     */
    public void logoutUser( HttpServletRequest request )
    {
        LuteceUser user;

        try
        {
            user = getRemoteUser( request );
        }
        catch( UserNotSignedException e )
        {
            return;
        }

        _authenticationService.logout( user );
        HttpSession session = request.getSession( false );
        if(session!=null)
        {
            session.invalidate();
        }
        LuteceUserEventManager.getInstance().notifyListeners( new LuteceUserEvent( user,LuteceUserEvent.EventType.LOGOUT ) );
        AccessLogService.getInstance( ).info( AccessLoggerConstants.EVENT_TYPE_DISCONNECT, CONSTANT_ACTION_LOGOUT_USER, user, null, CONSTANT_FO );
    }

    /**
     * Retrieves the portal authentication service configured in the config.properties
     * 
     * @return A PortalAuthentication object
     * @throws LuteceInitException
     *             If an error occurred
     */
    private static LuteceAuthentication getPortalAuthentication( ) throws LuteceInitException
    {
        String strAuthenticationClass = AppPropertiesService.getProperty( PROPERTY_AUTHENTICATION_CLASS );
        LuteceAuthentication authentication = null;

        if ( ( strAuthenticationClass != null ) && !strAuthenticationClass.equals( "" ) )
        {
            try
            {
                authentication = (LuteceAuthentication) Class.forName( strAuthenticationClass ).newInstance( );
                AppLogService.info( "Authentication service loaded : {}", authentication.getAuthServiceName( ) );
            }
            catch( InstantiationException | IllegalAccessException | ClassNotFoundException e )
            {
                throw new LuteceInitException( "Error instantiating Authentication Class", e );
            }
        }

        return authentication;
    }

    /**
     * Register the user in the Http session
     * 
     * @param request
     *            The Http request
     * @param user
     *            The current user
     */
    public void registerUser( HttpServletRequest request, LuteceUser user )
    {
        HttpSession session = request.getSession( true );
        session.setAttribute( ATTRIBUTE_LUTECE_USER, user );
        
        if ( user != null )
        {
            LuteceUserEventManager.getInstance().notifyListeners( new LuteceUserEvent( user, LuteceUserEvent.EventType.LOGIN_SUCCESSFUL ) );
        }
    }

    /**
     * Unregister the user in the Http session
     * 
     * @param request
     *            The Http request     
     */
    public void unregisterUser( HttpServletRequest request )
    {
        HttpSession session = request.getSession( true );
        LuteceUser user = (LuteceUser)session.getAttribute( ATTRIBUTE_LUTECE_USER );
        
        if ( user != null )
        {
            session.removeAttribute( ATTRIBUTE_LUTECE_USER );
        }
    }

    /**
     * Gets the Lutece user registered in the Http session
     * 
     * @param request
     *            The HTTP request
     * @return The User registered or null if the user has not been registered
     */
    public LuteceUser getRegisteredUser( HttpServletRequest request )
    {
        HttpSession session = ( request != null ) ? request.getSession( false ) : null;

        if ( session != null )
        {
            return (LuteceUser) session.getAttribute( ATTRIBUTE_LUTECE_USER );
        }

        return null;
    }

    /**
     * Returns the authentication type : External or Lutece portal based
     * 
     * @return true if the user is already authenticated or false if it needs to login.
     */
    public boolean isExternalAuthentication( )
    {
        return _authenticationService.isExternalAuthentication( );
    }

    /**
     * Returns the Login page URL of the Authentication Service
     * 
     * @return The URL
     */
    public String getLoginPageUrl( )
    {
        return _authenticationService.getLoginPageUrl( );
    }

    /**
     * Returns the DoLogin URL of the Authentication Service
     * 
     * @return The URL
     */
    public String getDoLoginUrl( )
    {
        return _authenticationService.getDoLoginUrl( );
    }

    /**
     * Returns the DoLogout URL of the Authentication Service
     * 
     * @return The URL
     */
    public String getDoLogoutUrl( )
    {
        return _authenticationService.getDoLogoutUrl( );
    }

    /**
     * Returns the new account page URL of the Authentication Service
     * 
     * @return The URL
     */
    public String getNewAccountPageUrl( )
    {
        return _authenticationService.getNewAccountPageUrl( );
    }

    /**
     * Returns the view account page URL of the Authentication Service
     * 
     * @return The URL
     */
    public String getViewAccountPageUrl( )
    {
        return _authenticationService.getViewAccountPageUrl( );
    }

    /**
     * Returns the lost password URL of the Authentication Service
     * 
     * @return The URL
     */
    public String getLostPasswordPageUrl( )
    {
        return _authenticationService.getLostPasswordPageUrl( );
    }

    // Added in v1.3

    /**
     * Returns the access denied template
     * 
     * @return The template
     */
    public String getAccessDeniedTemplate( )
    {
        return _authenticationService.getAccessDeniedTemplate( );
    }

    /**
     * Returns the access controled template
     * 
     * @return The template
     */
    public String getAccessControledTemplate( )
    {
        return _authenticationService.getAccessControledTemplate( );
    }

    /**
     * Returns whether or not the portal needs authentication
     * 
     * @return true if the access needs authentication, otherwise
     * @since 1.3.1
     */
    public boolean isPortalAuthenticationRequired( )
    {
        String strAuthenticationRequired = DatastoreService.getDataValue( PROPERTY_PORTAL_AUTHENTICATION_REQUIRED, "false" );

        return strAuthenticationRequired.equals( "true" );
    }

    /**
     * Checks user's login with the Authentication service. Used during remote authentication validation We don't have to put user informations in session,
     * since it is only used in external applications
     * 
     * @param request
     *            the request
     * @param strUserName
     *            The user's login
     * @param strPassword
     *            The user's password
     * @return user's informations
     * @throws LoginException
     *             The LoginException
     * @throws LoginRedirectException
     *             The redirect exception
     */
    public LuteceUser remoteLoginUser( final HttpServletRequest request, final String strUserName, final String strPassword )
            throws LoginException, LoginRedirectException
    {
        return _authenticationService.login( strUserName, strPassword, request );
    }

    /**
     * Return true if the requested url is equal to LoginUrl
     * 
     * @param request
     *            The Http servlet request
     * @return True if the requested url is equal to LoginUrl, false else.
     */
    public boolean isLoginUrl( HttpServletRequest request )
    {
        if ( ( getLoginPageUrl( ) == null ) || ( request == null ) )
        {
            return false;
        }

        String strRequestUrl = request.getRequestURI( );
        UrlItem url = new UrlItem( strRequestUrl );

        for ( String strParamValueLoginPageUrl : getLoginPageUrl( ).substring( getLoginPageUrl( ).indexOf( URL_INTERROGATIVE ) + 1 ).split( URL_AMPERSAND ) )
        {
            String [ ] arrayParamValueLoginPageUrl = strParamValueLoginPageUrl.split( URL_EQUAL );
            Enumeration<String> enumParams = request.getParameterNames( );

            while ( enumParams.hasMoreElements( ) )
            {
                String strRequestParameter = enumParams.nextElement( );

                if ( arrayParamValueLoginPageUrl [0].equals( strRequestParameter )
                        && arrayParamValueLoginPageUrl [1].equals( request.getParameter( strRequestParameter ) ) )
                {
                    url.addParameter( strRequestParameter, request.getParameter( strRequestParameter ) );
                }
            }
        }

        return url.getUrl( ).endsWith( getLoginPageUrl( ) ) && !getLoginPageUrl( ).equals( "" );
    }

    /**
     * Tells whether or not the authentication service can provide a list of all its users
     * 
     * @return true if the service can return a users list
     */
    boolean isUsersListAvailable( )
    {
        return _authenticationService.isUsersListAvailable( );
    }

    /**
     * Returns all users managed by the authentication service if this feature is available.
     * 
     * @return A collection of Lutece users or null if the service doesn't provide a users list
     */
    public Collection<LuteceUser> getUsers( )
    {
        return _authenticationService.getUsers( );
    }

    /**
     * Returns user managed by the authentication service if this feature is available.
     * 
     * @param strUserLogin
     *            the user login
     * @return A Lutece user or null if the service doesn't provide LuteceUser
     */
    public LuteceUser getUser( String strUserLogin )
    {
        return _authenticationService.getUser( strUserLogin );
    }

    /**
     * <b>true</b> when the service provides multi authentication support
     * 
     * @return <code>true</code> if multi authentication is supported, <code>false</code> otherwise.
     */
    public boolean isMultiAuthenticationSupported( )
    {
        return _authenticationService.isMultiAuthenticationSupported( );
    }

    /**
     * Gets the actual authentication implementation
     * 
     * @return {@link LuteceAuthentication} implementation
     */
    public LuteceAuthentication getAuthenticationService( )
    {
        return _authenticationService;
    }
}