AuthenticationFilter.java

/*
 * Copyright (c) 2002-2022, City of Paris
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *  1. Redistributions of source code must retain the above copyright notice
 *     and the following disclaimer.
 *
 *  2. Redistributions in binary form must reproduce the above copyright notice
 *     and the following disclaimer in the documentation and/or other materials
 *     provided with the distribution.
 *
 *  3. Neither the name of 'Mairie de Paris' nor 'Lutece' nor the names of its
 *     contributors may be used to endorse or promote products derived from
 *     this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * License 1.0
 */
package fr.paris.lutece.portal.web.user;

import java.io.IOException;
import java.util.Enumeration;
import java.util.HashSet;
import java.util.Set;
import java.util.StringTokenizer;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang3.StringUtils;
import fr.paris.lutece.portal.service.admin.AccessDeniedException;
import fr.paris.lutece.portal.service.admin.AdminAuthenticationService;
import fr.paris.lutece.portal.service.admin.AdminUserService;
import fr.paris.lutece.portal.service.admin.PasswordResetException;
import fr.paris.lutece.portal.service.message.AdminMessage;
import fr.paris.lutece.portal.service.message.AdminMessageService;
import fr.paris.lutece.portal.service.security.SecurityTokenService;
import fr.paris.lutece.portal.service.security.UserNotSignedException;
import fr.paris.lutece.portal.service.util.AppLogService;
import fr.paris.lutece.portal.service.util.AppPathService;
import fr.paris.lutece.portal.service.util.AppPropertiesService;
import fr.paris.lutece.portal.web.constants.Messages;
import fr.paris.lutece.portal.web.constants.Parameters;
import fr.paris.lutece.util.url.UrlItem;

/**
 * Filter to prevent unauthenticated access to admin
 */
public class AuthenticationFilter implements Filter
{
    private static final String PROPERTY_URL_PREFIX = "path.jsp.admin.public.";
    private static final String PROPERTY_URL_SUFFIX_LIST = "list";
    private static final String CONSTANT_LIST_SEPARATOR = ",";
    private static final String PROPERTY_RESET_EXCEPTION_MESSAGE = "User must reset his password.";
    private static final String PROPERTY_JSP_URL_ADMIN_LOGOUT = "lutece.admin.logout.url";
    private static final String JSP_URL_ADMIN_LOGIN = "jsp/admin/AdminLogin.jsp";

    /**
     * {@inheritDoc}
     */
    @Override
    public void init( FilterConfig config ) throws ServletException
    {
        // Do nothing
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public void destroy( )
    {
        // Do nothing
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public void doFilter( ServletRequest request, ServletResponse response, FilterChain chain ) throws IOException, ServletException
    {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;

        AppLogService.debug( "Accessing url : {}", ( ) -> getResquestedUrl( req ) );

        if ( isPrivateUrl( req ) )
        {
            try
            {
                filterAccess( req );
            }
            catch( UserNotSignedException e )
            {
                AdminAuthenticationService.getInstance( ).setLoginNextUrl( req );

                String strRedirectUrl = null;

                if ( AdminAuthenticationService.getInstance( ).isExternalAuthentication( ) )
                {
                    AppLogService.debug( "New session behind external authentication : {}", ( ) -> getResquestedUrl( req ) );

                    strRedirectUrl = AdminMessageService.getMessageUrl( req, Messages.MESSAGE_USER_NEW_SESSION, getRedirectUrlExternalAuthentication( req ),
                            AdminMessage.TYPE_INFO );
                }
                else
                {
                    AppLogService.debug( "Access NOT granted to url : {}", ( ) -> getResquestedUrl( req ) );

                    strRedirectUrl = AdminMessageService.getMessageUrl( req, Messages.MESSAGE_USER_NOT_AUTHENTICATED, getRedirectUrl( req ),
                            AdminMessage.TYPE_WARNING );
                }

                resp.sendRedirect( getAbsoluteUrl( req, strRedirectUrl ) );

                return;
            }
            catch( AccessDeniedException e )
            {
                AppLogService.debug( "Access NOT granted to url : {}", getResquestedUrl( req ) );

                String strRedirectUrl = AdminMessageService.getMessageUrl( req, Messages.MESSAGE_AUTH_FAILURE, getRedirectUrl( req ), AdminMessage.TYPE_ERROR );
                resp.sendRedirect( getAbsoluteUrl( req, strRedirectUrl ) );

                return;
            }
            catch( PasswordResetException e )
            {
                if ( !getResquestedUrl( req ).equals( getChangePasswordUrl( req ) ) && !getResquestedUrl( req ).equals( getLoginUrl( req ) ) )
                {
                    String strRedirectUrl = AdminMessageService.getMessageUrl( req, Messages.MESSAGE_USER_MUST_CHANGE_PASSWORD, getChangePasswordUrl( req ),
                            AdminMessage.TYPE_ERROR );
                    resp.sendRedirect( getAbsoluteUrl( req, strRedirectUrl ) );

                    return;
                }
            }
        }

        chain.doFilter( request, response );
    }

    /**
     * Build the url to redirect to if not logged. This is actually the login page of the authentication module, completed with the request parameters.
     * 
     * @param request
     *            the http request
     * @return the string representation of the redirection url - absolute - with request parameters.
     */
    private String getRedirectUrl( HttpServletRequest request )
    {
        String strLoginUrl = getLoginUrl( request );

        if ( strLoginUrl == null )
        {
            return null;
        }

        UrlItem url = new UrlItem( strLoginUrl );

        return url.getUrl( );
    }

    /**
     * Get the absolute login url
     *
     * @param request
     *            the http request
     * @return the login url, in its absolute form
     *
     */
    private String getLoginUrl( HttpServletRequest request )
    {
        String strLoginUrl = AdminAuthenticationService.getInstance( ).getLoginPageUrl( );

        return getAbsoluteUrl( request, strLoginUrl );
    }

    /**
     * Gets the logout url.
     *
     * @param request
     *            the request
     * @return the logout url
     */
    private String getLogoutUrl( HttpServletRequest request )
    {
        return getAbsoluteUrl( request, AppPropertiesService.getProperty( PROPERTY_JSP_URL_ADMIN_LOGOUT ) );
    }

    /**
     * Get the absolute login url
     *
     * @param request
     *            the http request
     * @return the login url, in its absolute form
     *
     */
    private String getChangePasswordUrl( HttpServletRequest request )
    {
        String strChangePasswordUrl = AdminAuthenticationService.getInstance( ).getChangePasswordPageUrl( );

        return getAbsoluteUrl( request, strChangePasswordUrl );
    }

    /**
     * Check wether a given url is to be considered as private (ie that needs a successful authentication to be accessed) or public (ie that can be access
     * without being authenticated)
     * 
     * @param request
     *            the http request
     * @return true if the url needs to be authenticated, false otherwise
     *
     */
    private boolean isPrivateUrl( HttpServletRequest request )
    {
        String strUrl = getResquestedUrl( request );
        Set<String> allowedUrlSet = createAllowedUrlSet( request );
        return !allowedUrlSet.contains( strUrl ) && !isInPublicUrlList( request, strUrl );
    }

    private Set<String> createAllowedUrlSet( HttpServletRequest request )
    {
        Set<String> set = new HashSet<>( );
        set.add( getAbsoluteUrl( request, JSP_URL_ADMIN_LOGIN ) );
        set.add( getLoginUrl( request ) );
        set.add( getLogoutUrl( request ) );
        return set;
    }

    /**
     * check that the access is granted
     * 
     * @param request
     *            The HTTP request
     * @throws AccessDeniedException
     *             If the user is not allowed
     * @throws UserNotSignedException
     *             If the user is not signed
     *
     **/
    private static void filterAccess( HttpServletRequest request ) throws UserNotSignedException, AccessDeniedException
    {
        if ( AdminAuthenticationService.getInstance( ).isExternalAuthentication( ) )
        {
            // The authentication is external
            // Should register the user if it's not already done
            AdminAuthenticationService.getInstance( ).getRemoteUser( request );
        }
        else
        {
            if ( AdminAuthenticationService.getInstance( ).getRegisteredUser( request ) == null )
            {
                // Authentication is required to access to the admin
                throw new UserNotSignedException( );
            }

            if ( AdminUserService.getAdminUser( request ).isPasswordReset( ) )
            {
                throw new PasswordResetException( PROPERTY_RESET_EXCEPTION_MESSAGE );
            }
        }
    }

    /**
     * Checks if the requested is in the list of urls that are under jsp/admin but shouldn't be protected
     * 
     * @param request
     *            the http request (provides the base path if needed)
     * @param strRequestedUrl
     *            the url to test : it should start with "http://" is absolute, or should be relative to the webapp root otherwise
     * @return true if the url is in the list, false otherwise
     *
     */
    private boolean isInPublicUrlList( HttpServletRequest request, String strRequestedUrl )
    {
        // recovers list from the
        String strList = AppPropertiesService.getProperty( PROPERTY_URL_PREFIX + PROPERTY_URL_SUFFIX_LIST );

        // extracts each item (separated by a comma) from the includes list
        StringTokenizer strTokens = new StringTokenizer( strList, CONSTANT_LIST_SEPARATOR );

        while ( strTokens.hasMoreTokens( ) )
        {
            String strName = strTokens.nextToken( );
            String strUrl = AppPropertiesService.getProperty( PROPERTY_URL_PREFIX + strName );
            strUrl = getAbsoluteUrl( request, strUrl );

            if ( strRequestedUrl.equals( strUrl ) )
            {
                return true;
            }
        }

        return false;
    }

    /**
     * Returns the absolute url corresponding to the given one, if the later was found to be relative. An url starting with "http://" is absolute. A relative
     * url should be given relatively to the webapp root.
     * 
     * @param request
     *            the http request (provides the base path if needed)
     * @param strUrl
     *            the url to transform
     * @return the corresponding absolute url
     *
     */
    private String getAbsoluteUrl( HttpServletRequest request, String strUrl )
    {
        if ( ( strUrl != null ) && !strUrl.startsWith( "http://" ) && !strUrl.startsWith( "https://" ) )
        {
            return AppPathService.getBaseUrl( request ) + strUrl;
        }

        return strUrl;
    }

    /**
     * Return the absolute representation of the requested url
     * 
     * @param request
     *            the http request (provides the base path if needed)
     * @return the requested url has a string
     *
     */
    private String getResquestedUrl( HttpServletRequest request )
    {
        return AppPathService.getBaseUrl( request ) + request.getServletPath( ).substring( 1 );
    }

    /**
     * Build the url to redirect after opening a new session when using external admin authentication. This is actually the requested url if provided; else the
     * admin autentication admin menu.
     * 
     * @param request
     *            the http request
     * @return the string representation of the redirection url - absolute - when using external admin authentication.
     */
    private String getRedirectUrlExternalAuthentication( HttpServletRequest request )
    {
        String strNextUrl = AdminAuthenticationService.getInstance( ).getLoginNextUrl( request );

        if ( StringUtils.isEmpty( strNextUrl ) )
        {
            strNextUrl = AppPathService.getAdminMenuUrl( );
        }

        return strNextUrl;
    }
}