/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package com.sun.security.auth.module;

import java.util.*;

import java.io.IOException;

import javax.security.auth.*;

import javax.security.auth.callback.*;

import javax.security.auth.login.*;

import javax.security.auth.spi.*;

import com.sun.security.auth.UnixPrincipal;

import com.sun.security.auth.UnixNumericUserPrincipal;

import com.sun.security.auth.UnixNumericGroupPrincipal;

/**

 * <p> This <code>LoginModule</code> imports a user's Unix

 * <code>Principal</code> information (<code>UnixPrincipal</code>,

 * <code>UnixNumericUserPrincipal</code>,

 * and <code>UnixNumericGroupPrincipal</code>)

 * and associates them with the current <code>Subject</code>.

 *

 * <p> This LoginModule recognizes the debug option.

 * If set to true in the login Configuration,

 * debug messages will be output to the output stream, System.out.

 *

 */

public class UnixLoginModule implements LoginModule {

    // initial state

    private Subject subject;

    private CallbackHandler callbackHandler;

    private Map<String, ?> sharedState;

    private Map<String, ?> options;

    // configurable option

    private boolean debug = true;

    // UnixSystem to retrieve underlying system info

    private UnixSystem ss;

    // the authentication status

    private boolean succeeded = false;

    private boolean commitSucceeded = false;

    // Underlying system info

    private UnixPrincipal userPrincipal;

    private UnixNumericUserPrincipal UIDPrincipal;

    private UnixNumericGroupPrincipal GIDPrincipal;

    private LinkedList<UnixNumericGroupPrincipal> supplementaryGroups =

                new LinkedList<>();

    /**

     * Initialize this <code>LoginModule</code>.

     *

     * <p>

     *

     * @param subject the <code>Subject</code> to be authenticated. <p>

     *

     * @param callbackHandler a <code>CallbackHandler</code> for communicating

     *                  with the end user (prompting for usernames and

     *                  passwords, for example). <p>

     *

     * @param sharedState shared <code>LoginModule</code> state. <p>

     *

     * @param options options specified in the login

     *                  <code>Configuration</code> for this particular

     *                  <code>LoginModule</code>.

     */

    public void initialize(Subject subject, CallbackHandler callbackHandler,

                           Map<String,?> sharedState,

                           Map<String,?> options) {

        this.subject = subject;

        this.callbackHandler = callbackHandler;

        this.sharedState = sharedState;

        this.options = options;

        // initialize any configured options

        debug = "true".equalsIgnoreCase((String)options.get("debug"));

    }

    /**

     * Authenticate the user (first phase).

     *

     * <p> The implementation of this method attempts to retrieve the user's

     * Unix <code>Subject</code> information by making a native Unix

     * system call.

     *

     * <p>

     *

     * @exception FailedLoginException if attempts to retrieve the underlying

     *          system information fail.

     *

     * @return true in all cases (this <code>LoginModule</code>

     *          should not be ignored).

     */

    public boolean login() throws LoginException {

        long[] unixGroups = null;

        ss = new UnixSystem();

        if (ss == null) {

            succeeded = false;

            throw new FailedLoginException

                                ("Failed in attempt to import " +

                                "the underlying system identity information");

        } else {

            userPrincipal = new UnixPrincipal(ss.getUsername());

            UIDPrincipal = new UnixNumericUserPrincipal(ss.getUid());

            GIDPrincipal = new UnixNumericGroupPrincipal(ss.getGid(), true);

            if (ss.getGroups() != null && ss.getGroups().length > 0) {

                unixGroups = ss.getGroups();

                for (int i = 0; i < unixGroups.length; i++) {

                    UnixNumericGroupPrincipal ngp =

                        new UnixNumericGroupPrincipal

                        (unixGroups[i], false);

                    if (!ngp.getName().equals(GIDPrincipal.getName()))

                        supplementaryGroups.add(ngp);

                }

            }

            if (debug) {

                System.out.println("\t\t[UnixLoginModule]: " +

                        "succeeded importing info: ");

                System.out.println("\t\t\tuid = " + ss.getUid());

                System.out.println("\t\t\tgid = " + ss.getGid());

                unixGroups = ss.getGroups();

                for (int i = 0; i < unixGroups.length; i++) {

                    System.out.println("\t\t\tsupp gid = " + unixGroups[i]);

                }

            }

            succeeded = true;

            return true;

        }

    }

    /**

     * Commit the authentication (second phase).

     *

     * <p> This method is called if the LoginContext's

     * overall authentication succeeded

     * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules

     * succeeded).

     *

     * <p> If this LoginModule's own authentication attempt

     * succeeded (the importing of the Unix authentication information

     * succeeded), then this method associates the Unix Principals

     * with the <code>Subject</code> currently tied to the

     * <code>LoginModule</code>.  If this LoginModule's

     * authentication attempted failed, then this method removes

     * any state that was originally saved.

     *

     * <p>

     *

     * @exception LoginException if the commit fails

     *

     * @return true if this LoginModule's own login and commit attempts

     *          succeeded, or false otherwise.

     */

    public boolean commit() throws LoginException {

        if (succeeded == false) {

            if (debug) {

                System.out.println("\t\t[UnixLoginModule]: " +

                    "did not add any Principals to Subject " +

                    "because own authentication failed.");

            }

            return false;

        } else {

            if (subject.isReadOnly()) {

                throw new LoginException

                    ("commit Failed: Subject is Readonly");

            }

            if (!subject.getPrincipals().contains(userPrincipal))

                subject.getPrincipals().add(userPrincipal);

            if (!subject.getPrincipals().contains(UIDPrincipal))

                subject.getPrincipals().add(UIDPrincipal);

            if (!subject.getPrincipals().contains(GIDPrincipal))

                subject.getPrincipals().add(GIDPrincipal);

            for (int i = 0; i < supplementaryGroups.size(); i++) {

                if (!subject.getPrincipals().contains

                    (supplementaryGroups.get(i)))

                    subject.getPrincipals().add(supplementaryGroups.get(i));

            }

            if (debug) {

                System.out.println("\t\t[UnixLoginModule]: " +

                    "added UnixPrincipal,");

                System.out.println("\t\t\t\tUnixNumericUserPrincipal,");

                System.out.println("\t\t\t\tUnixNumericGroupPrincipal(s),");

                System.out.println("\t\t\t to Subject");

            }

            commitSucceeded = true;

            return true;

        }

    }

    /**

     * Abort the authentication (second phase).

     *

     * <p> This method is called if the LoginContext's

     * overall authentication failed.

     * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules

     * did not succeed).

     *

     * <p> This method cleans up any state that was originally saved

     * as part of the authentication attempt from the <code>login</code>

     * and <code>commit</code> methods.

     *

     * <p>

     *

     * @exception LoginException if the abort fails

     *

     * @return false if this LoginModule's own login and/or commit attempts

     *          failed, and true otherwise.

     */

    public boolean abort() throws LoginException {

        if (debug) {

            System.out.println("\t\t[UnixLoginModule]: " +

                "aborted authentication attempt");

        }

        if (succeeded == false) {

            return false;

        } else if (succeeded == true && commitSucceeded == false) {

            // Clean out state

            succeeded = false;

            ss = null;

            userPrincipal = null;

            UIDPrincipal = null;

            GIDPrincipal = null;

            supplementaryGroups = new LinkedList<UnixNumericGroupPrincipal>();

        } else {

            // overall authentication succeeded and commit succeeded,

            // but someone else's commit failed

            logout();

        }

        return true;

    }

    /**

     * Logout the user

     *

     * <p> This method removes the Principals associated

     * with the <code>Subject</code>.

     *

     * <p>

     *

     * @exception LoginException if the logout fails

     *

     * @return true in all cases (this <code>LoginModule</code>

     *          should not be ignored).

     */

    public boolean logout() throws LoginException {

        if (subject.isReadOnly()) {

                throw new LoginException

                    ("logout Failed: Subject is Readonly");

            }

        // remove the added Principals from the Subject

        subject.getPrincipals().remove(userPrincipal);

        subject.getPrincipals().remove(UIDPrincipal);

        subject.getPrincipals().remove(GIDPrincipal);

        for (int i = 0; i < supplementaryGroups.size(); i++) {

            subject.getPrincipals().remove(supplementaryGroups.get(i));

        }

        // clean out state

        ss = null;

        succeeded = false;

        commitSucceeded = false;

        userPrincipal = null;

        UIDPrincipal = null;

        GIDPrincipal = null;

        supplementaryGroups = new LinkedList<UnixNumericGroupPrincipal>();

        if (debug) {

            System.out.println("\t\t[UnixLoginModule]: " +

                "logged out Subject");

        }

        return true;

    }

}