package dk.itp.security.authentication;
import java.util.Properties;

import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;
import dk.itp.security.passticket.server.PTSServer;
import dk.itp.statistics.Statistics;
/**
 * This interface must be implemented by all authentication plugins, it combines the common characteristics for
 * all types of authentication.
 *
 * @author Kim Rasmussen
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyright(c) 2001, IT Practice A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public interface IAuthenticationPlugin {
	/**
	 * Tries to change the users password. Note that this does not work for all types of authentication
	 * e.g. CBT has a local password which is never seen by the server, so it requires change locally
	 * instead of at the server.
	 */
	void changePassword(User user, String oldPassword, String newPassword) throws PTException;

	/**
	 * This method checks user confirmations - a confirmation can be a digital signature, if the authentication method
	 * supports it, but it can also be a simple re-authentication, e.g. in case of userid/password authentication.
	 *
	 * Digital signatures is ofcourse preferred, since they offer improved security
	 *
	 */
	void confirm(User user, String signtext, Object credentials) throws PTException;

	/**
	 * Returns the authentication level, the higher the level, the more secure this authentication is considered to be.
	 * @return String null if no information is available
	 */
	int getAuthenticationLevel();

	/**
	 * Returns the type of authentication, all plugins have assigned a particular id identifying that specify type
	 * of authentication.
	 */
	int getAuthenticationType();

	/**
	 * Returns the name of this particular authentication method
	 */
	String getName();

	/**
	 * Try to login the specified user session, using the supplied userid and credentials.
	 */
	void login(User user, String userid, Object credentials) throws PTException;

	/**
	 * Try to validate the specified user session, using the supplied userid and credentials.
	 */
	void validate(User user, String userid, Object credentials) throws PTException;

	/**
	 * Try to login the specified user session, using the supplied userid and credentials.
	 */
	void login(User user, String userid, Object credentials, Object newPassword) throws PTException;

    /**
     * Return a authentication token based on the specified user. Token can be used for SSO to other systems
     * @param user
     * @return cryptographic SSO token. If the token is binary, return Base64 encoding of the binary token
     * @throws PTException
     */
    String newToken(User user) throws PTException;

    /**
     * Return a authentication token based on the specified user. Token can be used for SSO to other systems
     * @param user
     * @param inputToken 
     * @return cryptographic SSO token. If the token is binary, return Base64 encoding of the binary token
     * @throws PTException
     */
    String newToken(User user, String inputToken) throws PTException;

	/**
	 * Notifies the plugin that the users state will be changed, this gives it the oppertunity to save the state
	 * to a database, so it is persistent.
	 */
	void modifyState(User user, String key, String value);

	/**
	 * Notifies the plugin that the user has logged off
	 */
	void logoff(User user, boolean timeout);

	/**
	 * Updates the configuration for this plugin
	 */
	void setConfiguration(Properties props);

	/**
	 * Gives the plugin a chance to log an entry to the transaction log, if it has any
	 */
	void logToTransactionLog(User user, String context, String text, boolean signed);

	/**
	 * Return detailed html formattet information about plugin's information and/or current status.
	 * @return String null if no information is available
	 */
	String getStatusText();
	
	/**
	 * Return detailed html formattet information about plugin's information and/or current status.
	 * @param action Action supplied by the plugin previously - allows the plugin to perform actions
	 * @return String null if no information is available
	 */
	String getStatusText(String action);

	/**
	 * Gives the plugin a place to put its statistics, if any
	 */
	void setStatistics(Statistics stat);
	
	/**
	 * Gives the plugin a list of allowed environment IDs - only access to the plugin from a session in a listed
	 * environment is allowed.
	 * 
	 * @param ids List of environment IDs that are allowed.
	 */
	void setAllowedEnvironmentIDs(int[] ids);
	
	/**
	 * Query the list of allowed environment IDs
	 * @return Array of IDs, or null if no restrictions
	 */
	int[] getAllowedEnvironmentIDs();
	
	/**
	 * Checks if access to this plugin from a given environment ID is allowed
	 * @param id Environment ID to check against
	 * @return True if access is allowed, false if not
	 */
	boolean isEnvironmentAllowed(int id);
	
    /**
     * Gives the plugin a list of allowed segment IDs - only access to the plugin from a session in a listed
     * segment is allowed.
     * 
     * @param ids List of environment IDs that are allowed.
     */
    void setAllowedSegmentIDs(int[] ids);
    
    /**
     * Query the list of allowed segment IDs
     * @return Array of IDs, or null if no restrictions
     */
    int[] getAllowedSegmentIDs();
    
    /**
     * Checks if access to this plugin from a given segment ID is allowed
     * @param id Segment ID to check against
     * @return True if access is allowed, false if not
     */
    boolean isSegmentAllowed(int id);
    
	/**
	 * Called after stop() when the session controller is started again from the admin GUI.
	 * Note that a plugin cannot depend on start being called initially, it should only expect it to happen after stop
	 * has been called. 
	 */
	void start();

	/**
	 * Called if the administrator requested that the session controller should stop - gives the plugin a chance
	 * to do some cleanup, and close connections.
	 */
	void stop();

    /**
     * Called when the plugin is started, to give it the session controller instance - it can use it for doing advanced
     * stuff, such as sending commands to other session controllers if needed.
     * 
     * @param sessionController
     */
    void initialize(PTSServer sessionController);
    
    /**
     * Called when the plugin is about to be uninstalled/unloaded - it will give it a chance to unregister any listeners.
     */
    void uninstall();
    
    /**
     * Let the authentication plugin execute an arbitrary command - this is used to extend the plugin with new
     * functionality, such as letting it decrypt signed SOAP messages or anything that is in its nature plugin specific
     * which we do not want to create different methods for that all plugins would then have to implement.
     * 
     * @param user Session
     * @param input Input object, can be anything serializable
     * @return Whatever object the command returns
     */
    Object executeCommand(User user, String name, Object input) throws PTException;
    
	/**
	 * Allows the plugin to respond to ping requests - ie. it can be called by an application who wishes to query
	 * the state of all authentication plugins and their backend databases.
	 * The plugin can add any properties it wishes to the properties object it gets called with - these properties
	 * will be returned to the requesting application. 
	 *  
	 * @param props read/write list of properties the plugin can use to report its detailed status, such as connections to backend servers/databases.
	 * @return true if the plugin considers itself functional and if all backend server connections are ok - false otherwise.
	 */
    boolean ping(Properties props);
    
    /**
     * Called when a persisted session (where the user is identified using this plugin) is restored so it can give
     * the plugin a chance to update its backend servers with the new session
     * 
     * @param sessionID Session ID of user who is doing the restore
     * @param user Session of user who is doing the restore
     * @param restoredSession The restored session
     * @throws PTException
     */
    void persistedSessionRestored(String sessionID, User user, User restoredSession) throws PTException;
    
    /**
     * Called to give the plugin a chance to reload its private keys. Called if Luna security provider is reloaded so
     * the private keys need to be reloaded from the JCE provider.
     */
    void reloadPrivateKeys();
    
    /**
     * A new user has just been created based upon a ticket, e.g. an OAuth ticket - so the plugin can fill the session with whatever
     * information it can obtain from the ticket.
     * 
     * @param user
     * @throws PTException
     */
    void createFromTicket(User user) throws PTException;
    
}

package dk.itp.security.passticket;
import java.io.DataOutputStream;
import java.io.Externalizable;
import java.io.ObjectInput;
import java.io.ObjectOutput;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Iterator;
import java.util.Vector;

import dk.itp.peer2peer.AbstractPeer;
import dk.itp.peer2peer.Peer;
import dk.itp.security.utils.RFC822Date;

/**
 * Contains all known data about a user/session that is currently in use.
 *
 * @author Kim Rasmussen
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyright(c) 2001, IT Practice A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public class User implements Externalizable, Cloneable {
	public volatile long lastAccessed;

	public volatile String sessionID;

	public volatile String password;
	public volatile String userid;
	public volatile boolean isLoggedOn;
	public volatile Vector aclList;

	public volatile String customerID;
	public volatile String agreementID;
	public volatile boolean isInternalUser;

	public volatile String cicsUser;
	public volatile String cicsPassword;

	public volatile String username;

	public volatile long modifySerial;
	public volatile long lastModified;
	public volatile Hashtable<String, String> stateVariables;

	public volatile int authenticationMethod;
	public volatile int authenticationLevel;

	public volatile Vector<String> sessionHistory;

	public volatile String userGroups[];
	
	public volatile Hashtable<String, Object> stateObjects;
	
	/** Session controller which owns this session */
	public volatile String owner;
	
	/** Name of agent who created this session, if available */
	public String creatingAgent;  
	
	// If nonzero, this is the time the session will automatically be logged off if it is not accessed before
	public volatile long delayedLogoffAt;

	/** OAuth or similar ticket this session was created with - must not be changed after creation */
	public String ticket;
	
	/**
	 * Used by sessioncontroller to track which agents have an interest in this session - note that this is
	 * transient, and only kept on the server.
	 */
	public transient ArrayList interestedAgents;
	public transient HashMap agentNotifyCount;

	/**
	 * Creates a deep clone of the user
	 */
	public Object clone();
	
	/**
	 * Copies all content of this session to the supplied user
	 */
	public void copyTo(User usr);

	/**
	 * Adds a history text to this session - the session history can be used for debugging to determine what
	 * has occurred with the particular session during its lifetime.
	 */
	public synchronized void addHistory(String text);

	public synchronized Vector getHistory();

	/**
	 * This method returns a list of groups that the user is a member of
	 */
	public String[] getGroups();

	/** 
	 * This method allows to change the groups that this user is a member of
	 */
	public void setGroups(String groups[]);
	public void setStateObject(String key, Serializable value);
	
	public Object getStateObject(String key);

	public void setStateVariable(String key, String value);
	public String getStateVariable(String key);
	
	public Object removeStateObject(String key);
	public String removeStateVariable(String key);
}

package dk.itp.security.passticket.server;
import java.util.Vector;

import dk.itp.security.authentication.DefaultAuthenticationPlugin;
import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;

/**
 * Copyright (c) IT Practice A/S
 *
 * Dummy login handler, which accepts all userids and passwords without validating them.
 * This should only be used for testing, since in production we want to validate the user
 * with some real information.
 *
 * @author Kim Rasmussen
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyright(c) 2001, IT Practice A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public class DummyLogin extends DefaultAuthenticationPlugin {
	/**
	 * Try to change the userid and password for this user
	 */
	public void changePassword(User user, java.lang.String oldPassword, java.lang.String newPassword) {
		if (user.isLoggedOn && oldPassword.equals(user.password)) {
			user.password = newPassword;
		}
	}

	/**
	 * This method checks user confirmations - a confirmation can be a digital signature, if the authentication method
	 * supports it, but it can also be a simple re-authentication, e.g. in case of userid/password authentication.
	 *
	 * Digital signatures is ofcourse preferred, since they offer improved security
	 *
	 */
	public void confirm(dk.itp.security.passticket.User user, java.lang.String signtext, java.lang.Object confirmObject)
		throws dk.itp.security.passticket.PTException {
		throw new PTException("Confirmation not supported by this authentication plugin");
	}

	/**
	 * Returns the authentication level, the higher the level, the more secure this authentication is considered to be.
	 */
	public int getAuthenticationLevel() {
		return 0;
	}

	/**
	 * Returns the type of authentication, all plugins have assigned a particular id identifying that specify type
	 * of authentication.
	 */
	public int getAuthenticationType() {
		return dk.itp.security.passticket.AuthTypes.AUTHTYPE_DUMMY;
	}

	/**
	 * Returns the name of this particular authentication method
	 */
	public String getName() {
		return "Dummy userid/password login";
	}

	/**
	 * Try to login the specified user session, using the supplied userid and password.
	 */
	public void login(User user, String userid, Object credentials) {
		login(user, userid, credentials, null);
	}

	/**
	 * Try to login the specified user session, using the supplied userid and password.
	 */
	public void login(User user, String userid, Object credentials, Object newPassword) {
		user.isLoggedOn = true;
		user.userid = userid;
		user.password = credentials.toString();
		user.isInternalUser = false;
		user.customerID = userid;

		user.aclList = new Vector();
		user.aclList.addElement("01234567.00");
		user.aclList.addElement("12345678.00");
		user.aclList.addElement("EBXX3006.00");
	}

	/**
	 * Sets the configuration - the login handler can read from the properties to determine its own configuration.
	 */
	public void setConfiguration(java.util.Properties props) {}

	public void modifyState(User user, String key, String value) {}
}

package dk.portalprotect.nodb.plugins;

import java.util.Hashtable;
import java.util.Properties;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import dk.itp.security.authentication.x509.AbstractX509CertificatePlugin;
import dk.itp.security.certificate.Subject;
import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;
import dk.itp.security.passticket.server.AuthErrorCodes;
import dk.itp.security.utils.Base64;

/**
 * X509 certificate plugin that uses useradmin database
 *
 * @author Kim Rasmussen
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyright(c) 2001, IT Practice A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public class X509CertificatePlugin extends AbstractX509CertificatePlugin {
	private Logger log = LoggerFactory.getLogger(X509CertificatePlugin.class);
	/**
	 * @see dk.itp.security.authentication.IAuthenticationPlugin#getName()
	 */
	public String getName() {
		return "X509 Certificate plugin";
	}

	public void confirm(User user, String signtext, Object credentials) throws PTException {
		try {
//			Subject subject = verifyCertificate(user, credentials.toString(), false, false, null, signtext);
			verifyCertificate(user, credentials.toString(), false, false, null, signtext);
			
			// Here, we could use subject if we want to check if the signer is the same as the one who authenticated
			
				
		} catch(PTException e) {
			throw e;
		} catch (Throwable t) {
			log.error("Got exception trying to  verify digital signature", t);
			throw new PTException("Unknown error occurred", AuthErrorCodes.ERROR_GENERALERROR, t.toString());
		}
	}

	/**
	 * logon with x.509 certificate.
	 * <ol>
	 * <li>Check RFC 3275 message integrity
	 * <lI>Check certificate from message for expiration
	 * <li>Check certificate against revocation-list 
	 * <li>Check certificate against CA issuer certificate.
	 * <li>Check certificate PID and CPR against CA PID-mapping database (if CA has implemented one).
	 * </ol>
	 * 1) verify integrity of RFC 3275 message
	 * 2) 
	 */
	public void login(User user, String userid, Object credentials) throws PTException {
		try {
			Subject subject;
			String xmldsig;
			
			// If credentials is a single string, we expect it to be the xmldsig from the applet
			if (credentials instanceof String) {
				xmldsig = (String)credentials;
				subject = verifyCertificate(user, xmldsig, false, false, null, null);
			} else if (credentials instanceof Object[]){
				// If credentials is an array, we expect it to be 2 elements, the first is the xmldsig, the second is the CPR number
				xmldsig = (String) ((Object[])credentials)[0];
				String cpr = (String) ((Object[])credentials)[1];
				subject = verifyCertificate(user, xmldsig, false, true, cpr, null);
				
				user.stateVariables.put("cpr", cpr);
			} else if (credentials == null) {
				throw new PTException("Credentials cannot be null");
			} else {
				throw new PTException("Unrecognized credentials of type: " + credentials.getClass().getName());
			}
			
			userid = subject.getSerialNumber();
			
			if (user.stateVariables == null)
				user.stateVariables = new Hashtable();
			user.stateVariables.put("company", subject.getO());
			user.stateVariables.put("country", subject.getC());
			user.stateVariables.put("full_subject", subject.getOrderedSubjectDN());
				
			String serial = userid;

			if (serial.startsWith("PID")) {
				user.stateVariables.put("pid", serial.substring(4));
			} else if (serial.startsWith("CVR")) {
				String cvr = serial.substring(4);
				if (cvr.indexOf('-') > 0)
					cvr = cvr.substring(0, cvr.indexOf('-'));
				user.stateVariables.put("cvr", cvr);

				int idx = serial.indexOf("-UID:");
				if (idx < 0) {
					idx = serial.indexOf("-RID:");
					if (idx >= 0) {
						// Medarbejder cert
						user.stateVariables.put("rid", serial.substring(idx + 5));
					}

				} else {
					// Virksomheds cert
					user.stateVariables.put("uid", serial.substring(idx + 5));
				}
			}

			if (Base64.isBase64(xmldsig))
				xmldsig = Base64.decode(xmldsig);
			
			user.stateVariables.put("xmldsig", xmldsig);
			user.customerID = userid;
			user.userid = userid;
			user.username = subject.getCn();
			
			// Here, we can have additional logic to load data from a backend system, and e.g. if we want the logon to fail
			// if we do not know the users CPR number, then we can throw an exception that signals the logon app that we
			// need the CPR number - it can then later call logon with both the saved xmldsig and the CPR number and we
			// can verify that they match.
			
			// throw new PTException("Need CPR", AuthErrorCodes.ERROR_UNDER_CREATION, "Need CPR number");
			
			user.isLoggedOn = true;
		} catch(PTException e) {
			throw e;
		} catch (Throwable t) {
			log.error("Got exception trying to login", t);
			throw new PTException("unexpected error occurred", AuthErrorCodes.ERROR_GENERALERROR, t.toString());
		}
	}

	/**
	 * Cleanup when user is logging off, by removing all state variables and state objects.
	 * Note that by removing stateobjects, we risk interfering with internal PP state, but in this case we want to
	 * make sure we delete any references to old http cookies that might be stored by the dispatcher when the user
	 * logs off to ensure that the http session is also removed towards the application servers.
	 */
	public void logoff(User user, boolean timeout) {
		if (user.stateVariables != null)
			user.stateVariables.clear();
		if (user.stateObjects != null)
			user.stateObjects.clear();
	}
	
	public void setConfiguration(Properties props) {
		super.setConfiguration(props);		
	}
}

package dk.portalprotect.simpledb.plugins;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Hashtable;
import java.util.Properties;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import dk.itp.security.authentication.x509.AbstractX509CertificatePlugin;
import dk.itp.security.certificate.Subject;
import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;
import dk.itp.security.passticket.server.AuthErrorCodes;
import dk.itp.security.utils.Base64;
import dk.itp.security.utils.jdbc.DBPool;
import dk.itp.statistics.Statistics;

/**
 * X509 certificate plugin that uses useradmin database
 *
 * @author Kim Rasmussen
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyright(c) 2001, IT Practice A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public class X509CertificatePlugin extends AbstractX509CertificatePlugin {
	private Logger log = LoggerFactory.getLogger(X509CertificatePlugin.class);
	
	DBPool dbPool = DBPool.getPool("simpledb");
	
	/**
	 * @see dk.itp.security.authentication.IAuthenticationPlugin#getName()
	 */
	public String getName() {
		return "X509 Certificate plugin";
	}

	public void confirm(User user, String signtext, Object credentials) throws PTException {
		try {
//			Subject subject = verifyCertificate(user, credentials.toString(), false, false, null, signtext);
			verifyCertificate(user, credentials.toString(), false, false, null, signtext);
			
			// Here, we could use subject if we want to check if the signer is the same as the one who authenticated
			
				
		} catch(PTException e) {
			throw e;
		} catch (Throwable t) {
			log.error("Got exception trying to  verify digital signature", t);
			throw new PTException("Unknown error occurred", AuthErrorCodes.ERROR_GENERALERROR, t.toString());
		}
	}

	/**
	 * logon with x.509 certificate.
	 * <ol>
	 * <li>Check RFC 3275 message integrity
	 * <lI>Check certificate from message for expiration
	 * <li>Check certificate against revocation-list 
	 * <li>Check certificate against CA issuer certificate.
	 * <li>Check certificate PID and CPR against CA PID-mapping database (if CA has implemented one).
	 * </ol>
	 * 1) verify integrity of RFC 3275 message
	 * 2) 
	 */
	@SuppressWarnings({ "rawtypes", "unchecked" })
	public void login(User user, String userid, Object credentials) throws PTException {
		try {
			Subject subject;
			String xmldsig;
			
			if (user.stateVariables == null)
				user.stateVariables = new Hashtable();
			
			// If credentials is a single string, we expect it to be the xmldsig from the applet
			if (credentials instanceof String) {
				xmldsig = (String)credentials;
				subject = verifyCertificate(user, xmldsig, false, false, null, null);
			} else if (credentials instanceof Object[]){
				// If credentials is an array, we expect it to be 2 elements, the first is the xmldsig, the second is the CPR number
				xmldsig = (String) ((Object[])credentials)[0];
				String cpr = (String) ((Object[])credentials)[1];
				subject = verifyCertificate(user, xmldsig, false, true, cpr, null);
				
				user.stateVariables.put("cpr", cpr);
				
				storeCpr(subject.getSerialNumber(), cpr);
			} else if (credentials == null) {
				throw new PTException("Credentials cannot be null");
			} else {
				throw new PTException("Unrecognized credentials of type: " + credentials.getClass().getName());
			}
			
			userid = subject.getSerialNumber();
			
			user.stateVariables.put("company", subject.getO());
			user.stateVariables.put("country", subject.getC());
			user.stateVariables.put("full_subject", subject.getOrderedSubjectDN());
				
			String serial = userid;

			if (serial.startsWith("PID")) {
				user.stateVariables.put("pid", serial.substring(4));
			} else if (serial.startsWith("CVR")) {
				String cvr = serial.substring(4);
				if (cvr.indexOf('-') > 0)
					cvr = cvr.substring(0, cvr.indexOf('-'));
				user.stateVariables.put("cvr", cvr);

				int idx = serial.indexOf("-UID:");
				if (idx < 0) {
					idx = serial.indexOf("-RID:");
					if (idx >= 0) {
						// Medarbejder cert
						user.stateVariables.put("rid", serial.substring(idx + 5));
					}

				} else {
					// Virksomheds cert
					user.stateVariables.put("uid", serial.substring(idx + 5));
				}
			}

			if (Base64.isBase64(xmldsig))
				xmldsig = Base64.decode(xmldsig);
			
			user.stateVariables.put("xmldsig", xmldsig);
			user.customerID = userid;
			user.userid = userid;
			user.username = subject.getCn();
			
			// Here, we can have additional logic to load data from a backend system if needed

			// If we are logging in using a POCES certificate, lookup the CPR - if we do not know it, fail.
			if (serial.startsWith("PID")) {
				// Lookup the CPR
				String cpr = lookupCpr(serial);
				if (cpr == null) {
					throw new PTException("Need CPR", AuthErrorCodes.ERROR_UNDER_CREATION, "Need CPR number");					
				} else {
					user.stateVariables.put("cpr", cpr);					
				}
			}
			
			user.isLoggedOn = true;
		} catch(PTException e) {
			throw e;
		} catch (Throwable t) {
			log.error("Got exception trying to login", t);
			throw new PTException("unexpected error occurred", AuthErrorCodes.ERROR_GENERALERROR, t.toString());
		}
	}

	/**
	 * Cleanup when user is logging off, by removing all state variables and state objects.
	 * Note that by removing stateobjects, we risk interfering with internal PP state, but in this case we want to
	 * make sure we delete any references to old http cookies that might be stored by the dispatcher when the user
	 * logs off to ensure that the http session is also removed towards the application servers.
	 */
	public void logoff(User user, boolean timeout) {
		if (user.stateVariables != null)
			user.stateVariables.clear();
		if (user.stateObjects != null)
			user.stateObjects.clear();
	}
	
	
	@Override
	public void setStatistics(Statistics stat) {
		super.setStatistics(stat);
		dbPool.setStatistics(stat);
	}
	
	public void setConfiguration(Properties props) {
		super.setConfiguration(props);
				
		try {
			dbPool.initialize(props);
		} catch (SQLException e) {
			log.error("Problem initializing database", e);
		}
	}
	
	private void storeCpr(String pid, String cpr) throws SQLException {
		Connection conn = dbPool.getConnection();
		try {
			PreparedStatement stmt = dbPool.prepareStatement(conn, "insert into PIDCPR (PID, CPR) values(?, ?)");
			stmt.setString(1, pid);
			stmt.setString(2, cpr);
			stmt.executeUpdate();
		} finally {
			dbPool.releaseConnection(conn);
		}
	}
	
	private String lookupCpr(String pid) throws SQLException {
		Connection conn = dbPool.getConnection();
		try {
			PreparedStatement stmt = dbPool.prepareStatement(conn, "select CPR from PIDCPR where PID=?");
			stmt.setString(1, pid);
			ResultSet result = stmt.executeQuery();
			
			if (result.next()) {
				return result.getString(1);
			}
			return null;
		} finally {
			dbPool.releaseConnection(conn);
		}
	}
}

package dk.portalprotect.sample.oauth2;

import java.io.IOException;
import java.util.Hashtable;
import java.util.Properties;
import java.util.UUID;

import dk.itp.caching.lru.LruCache;
import dk.itp.security.authentication.oauth.AbstractOAuth2AuthenticationPlugin;
import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;
import dk.itp.security.passticket.server.AuthErrorCodes;
import dk.itp.security.utils.Base64;
import dk.portalprotect.oauth.OAuth2Helper;

/**
 * Demonstration OAuth2 plugin - not suitable for production use.
 * It issues a new ticket by generating a random key and returning it as the grantticket. It then persists the issuing
 * users ticket and saves it in a memory cache for up to an hour - during that our, the grant ticket gets access to the
 * previously saved session contents.
 * 
 * Please note that a production OAuth plugin must take care to validate the provided client_id and ensure that it
 * already exists in a known registry - it needs to ensure that the client id is valid for the attempted operation, 
 * especially it needs to ensure that implicity grant is only used if explicitly allowed.
 * 
 * Also, the provided scope must be validated for content which has meaning to the application, and the application
 * needs to use this information when authorizing a request and allowing access to data on the users behalf.
 *  
 * @author Kim Rasmussen
 * @version $Revision$
 *
 * <pre>
 * Ceptor
 * 
 * This source code is confidential.
 * </pre>
 */
public class DemoOAuth2AuthenticationPlugin extends AbstractOAuth2AuthenticationPlugin {
	private LruCache cache = new LruCache();
	private LruCache authCache = new LruCache();
	
	private class AuthCacheEntry {
		String bearertoken;
		String clientid;
		String clientSecret = "password";
		String redirectUri;
	}
	
	public DemoOAuth2AuthenticationPlugin() {
		cache.setCacheSize(1000);
		cache.setTimeout(60000*60); // 1 hour
		cache.setForceTimeout(60000*60); // 1 hour

		authCache.setCacheSize(1000);
		authCache.setTimeout(120000); // 2 minutes
		authCache.setForceTimeout(120000); // 2 minutes
	}
	
	@Override
	protected Properties validateAuthRequest(User user, Properties input) throws PTException {
		Properties p = super.validateAuthRequest(user, input);
		
		// Validate that client_id / redirect_uri is valid
		// Could also check if state or other input parameters are valid
		
		return p;
	}

	@Override
	protected Properties handleTokenRequest(User user, Properties input) throws PTException {
		Properties p = validateTokenRequest(user, input);

		// Exchange authorization_code with a grant token
		
		if (OAuth2Helper.AUTHORIZATION_CODE.equals(input.getProperty(OAuth2Helper.GRANT_TYPE))) {
			String authorizationCode = input.getProperty(OAuth2Helper.CODE);
			
			AuthCacheEntry entry = (AuthCacheEntry) authCache.get(authorizationCode);
			
			if (entry == null || !entry.clientid.equals(input.getProperty(OAuth2Helper.CLIENT_ID )) || !input.getProperty(OAuth2Helper.CLIENT_SECRET).equals(entry.clientSecret)) {
				throw new PTException("Invalid authorization_code, client ID or client secret", AuthErrorCodes.ERROR_INVALIDCREDENTIALS, "Invalid authorization_code, client_id or client_secret");				
			}
			if (!entry.redirectUri.equals(input.getProperty(OAuth2Helper.REDIRECT_URI ))) {
				throw new PTException("Invalid redirect URI", AuthErrorCodes.ERROR_INVALIDCREDENTIALS, "Invalid redirect URI");				
			}

			p.setProperty(OAuth2Helper.ACCESS_TOKEN, entry.bearertoken);
			p.setProperty(OAuth2Helper.TOKEN_TYPE, "Bearer");
			p.setProperty(OAuth2Helper.EXPIRES_IN, "3600");
			
			// Here, we could also add a refresh_token if we had one to add.
		} else { // Must be refresh_token, since validateTokenRequest ensures nothing else can pass
			@SuppressWarnings("unused")
			String refreshToken = input.getProperty(OAuth2Helper.REFRESH_TOKEN);
		
			throw new PTException("Refresh tokens are not supported at the moment", AuthErrorCodes.ERROR_INVALIDCREDENTIALS, "refresh_token not supported");
		}
		
		return p;
	}
	
	@SuppressWarnings({ "rawtypes", "unchecked" })
	@Override
	protected java.util.Properties handleAuthRequest(dk.itp.security.passticket.User user, java.util.Properties input) throws PTException {
		Properties p = validateAuthRequest(user, input);
		
		String clientid = input.getProperty(OAuth2Helper.CLIENT_ID);

		// Create a new clone and use this to avoid altering the current users original session
		User newUser = (User) user.clone();
		if (newUser.stateVariables == null)
			newUser.stateVariables = new Hashtable();
						
		// Save the requested scope for later use when the session is restored
		newUser.stateVariables.put("pp_oauth2_scope", input.getProperty(OAuth2Helper.SCOPE));
		// Save the client ID too for later use
		newUser.stateVariables.put("pp_oauth2_clientid", input.getProperty(OAuth2Helper.CLIENT_ID));
		
		byte[] persistedSession;
		try {
			persistedSession = persistSession(newUser);
		} catch (IOException e) {
			throw new PTException(e);
		}

		if (input.getProperty(OAuth2Helper.RESPONSE_TYPE).equalsIgnoreCase(OAuth2Helper.CODE)) {
			// Tell dispatcher to disable IP checking for this particular session(bearer token), since it is meant
			// to be used by another server instead of the same client
			newUser.stateVariables.put("pp_disable_ipchecking", "true");			
		}

		String bearertoken = Base64.encode(UUID.randomUUID().toString());
		cache.put(bearertoken, persistedSession);
						
		
		if (input.getProperty(OAuth2Helper.RESPONSE_TYPE).equalsIgnoreCase(OAuth2Helper.TOKEN)) {
			// Implicit grant
			p.setProperty(OAuth2Helper.ACCESS_TOKEN, bearertoken);
			p.setProperty(OAuth2Helper.TOKEN_TYPE, "Bearer");
			p.setProperty(OAuth2Helper.EXPIRES_IN, "3600");
			return p;			
		} else {
			// Normal flow
			String authorizationToken = UUID.randomUUID().toString();
			
			AuthCacheEntry entry = new AuthCacheEntry();
			entry.bearertoken = bearertoken;
			entry.clientid = clientid;
			entry.redirectUri = input.getProperty(OAuth2Helper.REDIRECT_URI);
			authCache.put(authorizationToken, entry);
			
			p.setProperty(OAuth2Helper.AUTHORIZATION_CODE, authorizationToken);
			return p;			
		}
	}
	
	
	@Override
	public void createFromTicket(User user) throws PTException {
		// Ticket is in user.ticket
		
		byte[] ba = (byte[]) cache.get(user.ticket);
		
		if (ba == null)
			throw new PTException("Invalid OAuth ticket", AuthErrorCodes.ERROR_INVALIDCREDENTIALS, "Invalid or expired OAuth ticket");
		
		try {
			User restoredUser = restorePersistedSession(ba);
			
			// Save the ticket and session ID so we do not overwrite them
			restoredUser.ticket = user.ticket;
			restoredUser.sessionID = user.sessionID;
			
			// Restore everything from the persisted session to this one
			restoredUser.copyTo(user);
			
			user.addHistory("Session restored from persisted session using OAuth ticket: " + user.ticket);
		} catch (IOException e) {
			throw new PTException("Unable to restore persisted session", AuthErrorCodes.ERROR_GENERALERROR, "Unable to restore session", e);
		}
	}
}

package dk.portalprotect.sample.plugins.ldap;
import java.io.IOException;
import java.util.Properties;
import java.util.Vector;

import netscape.ldap.LDAPException;
import netscape.ldap.util.DN;
import org.slf4j.LoggerFactory;
import dk.itp.configuration.ConfigurationMacroHandler;
import dk.itp.managed.service.gui.ListNameValuePairs;
import dk.itp.security.authentication.DefaultAuthenticationPlugin;
import dk.itp.security.authentication.IAuthenticationPlugin;
import dk.itp.security.authorization.client.PasswordSSHA;
import dk.itp.security.exception.NotFoundException;
import dk.itp.security.exception.NotUniqueException;
import dk.itp.security.ldap.LdapAuthorizationPlugin;
import dk.itp.security.ldap.LdapGroupConnection;
import dk.itp.security.ldap.LdapUser;
import dk.itp.security.ldap.LdapUserConnection;
import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;
import dk.itp.security.utils.PasswordUtils;

/**
 * @author Bo Friis
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyright(c) 2001, IT Practice A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public class LoginHandlerLdapImpl extends DefaultAuthenticationPlugin {
	protected org.slf4j.Logger log = LoggerFactory.getLogger(this.getClass().getName());

	private LdapUserConnection ldapUsers;
	private LdapGroupConnection ldapGroups;
	
	private String servers = "localhost:389";
	private String baseDN = ""; // "dc=itpractice";
	private String systemuser = ""; // "uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot";
	private String systempassword = ""; // "password";
	private String usersRDNName = "ou=People"; // "ou=People";
	private String useridName = "uid"; //"uid";
    private String ldap_userAttributes = "cn,uid,sn,initials,userpassword,memberof,ibm-allGroups";
    
    private boolean bindUsers = false;

    private String impersonateFile = null; 
    
	/**
	 * Try to change the userid and password for this user
	 */
	public void changePassword(User user, String oldPassword, String newPassword) throws PTException {
		LdapUserConnection lc = null;
		try {
			if (bindUsers) {
				String uid;
				if (usersRDNName.length() > 0)
					uid = useridName + "="+user.userid+", " +  usersRDNName + ", " + baseDN;
				else
					uid = useridName + "="+user.userid+", " +  baseDN;
				
				lc = new LdapUserConnection(servers, new DN(baseDN), uid, user.password, usersRDNName, ldap_userAttributes);
				LdapUser lu =lc.getUser(useridName, user.userid);
				lc.setPassword(lu.dn, newPassword);
				log.debug("password changed for user: " + user.userid);
			} else {
				LdapUser lu = getLdapUserConnection().getUser(useridName, user.userid);
				if (user.password.equals(oldPassword)) {
					getLdapUserConnection().setPassword(lu.dn, newPassword);
					log.debug("password changed for user: " + user.userid);
				} else {
					throw new PTException("invalid credentials");
				}
			}
		} catch(PTException e) {
			throw e;
		} catch (Throwable t) {
			log.error("Exception changing users password in LDAP", t);
			throw new PTException("ldap login handler");
		}
		finally {
			if (lc != null)
				try {lc.disconnect(); } catch(Exception t) {}
		}
	}

	/**
	 * This method checks user confirmations - a confirmation can be a digital signature, if the authentication method
	 * supports it, but it can also be a simple re-authentication, e.g. in case of userid/password authentication.
	 *
	 * Digital signatures is ofcourse preferred, since they offer improved security
	 *
	 */
	public void confirm(dk.itp.security.passticket.User user, java.lang.String signtext, java.lang.Object confirmObject)
		throws dk.itp.security.passticket.PTException {
		throw new PTException("Confirmation not supported by this authentication plugin");
	}

	/**
	 * Returns the authentication level, the higher the level, the more secure this authentication is considered to be.
	 */
	public int getAuthenticationLevel() {
		return 2;
	}

	/**
	 * Returns the type of authentication, all plugins have assigned a particular id identifying that specify type
	 * of authentication.
	 */
	public int getAuthenticationType() {
		return dk.itp.security.passticket.AuthTypes.AUTHTYPE_LDAPUIDPW;
	}

	private synchronized LdapUserConnection getLdapUserConnection() {
		if (ldapUsers == null) {
			ldapUsers = new LdapUserConnection(servers, new DN(baseDN), systemuser, systempassword, usersRDNName, ldap_userAttributes);
		}
		return ldapUsers;
	}
	
	private synchronized LdapGroupConnection getLdapGroupConnection() {
		if (ldapGroups == null) {
			ldapGroups = new LdapGroupConnection(servers, new DN(baseDN), systemuser, systempassword, usersRDNName, ldap_userAttributes);
		}
		return ldapGroups;
	}

	/**
	 * Returns the name of this particular authentication method
	 */
	public java.lang.String getName() {
		return "LDAP userid/password authentication";
	}

	/**
	 * Try to login the specified user session, using the supplied userid and password.
	 */
	public void login(User user, String userid, Object credentials) throws PTException {
		login(user, userid, credentials, null);
	}


    public LdapUser loginUser(String userid, Object credentials) throws PTException, LDAPException, NotUniqueException, NotFoundException {
        LdapUserConnection lc = null;
        LdapUser lu;
        try {
            if(bindUsers) {
				String uid;
				if (usersRDNName.length() > 0)
					uid = useridName + "="+userid+", " +  usersRDNName + ", " + baseDN;
				else
					uid = useridName + "="+userid+", " +  baseDN;
                lc = new LdapUserConnection(servers, new DN(baseDN), uid, credentials.toString(), usersRDNName, ldap_userAttributes);
                lu = lc.getUser(useridName, userid);
            } else {
                lu = getLdapUserConnection().getUser(useridName, userid);
                if(lu.userPassword == null || !PasswordSSHA.checkPassword(lu.userPassword, credentials.toString()))
                    throw new PTException("invalid credentials");
            }
        } finally {
            if (lc != null)
                try {lc.disconnect(); } catch(Exception t) {}
        }
        
        return lu;
    }
    
    public Vector getGroupsForUser(String userDN, String groupMemberAttr) throws PTException, LDAPException, NotUniqueException, NotFoundException {
        LdapGroupConnection lc = null;
        try {
           	lc = getLdapGroupConnection();
           	return lc.getGroupsForUser(userDN, groupMemberAttr);
        } finally {
            if (lc != null)
                try {lc.disconnect(); } catch(Exception t) {}
        }
    }
    
    /**
     * Reads a user record without doing any password checking - note that this method only works if bindUsers is turned off.
     * 
     * @param userid
     * @throws LDAPException 
     * @throws NotFoundException 
     * @throws NotUniqueException 
     */
    public LdapUser getUserRecord(String userid) throws NotUniqueException, NotFoundException, LDAPException {
        LdapUserConnection lc = null;
        LdapUser lu;
        try {
        	String impersonatedUserid  = impersonate(userid); 
            lu = getLdapUserConnection().getUser(useridName, impersonatedUserid);
            
            return lu;
        } finally {
            if (lc != null)
                try {lc.disconnect(); } catch(Exception t) {}
        }
    }
    
	/**
	 * Try to login the specified user session, using the supplied userid and password.
	 */
	public void login(User user, String userid, Object credentials, Object newPassword) throws PTException {
		try {
			LdapUser lu = loginUser(userid, credentials);
			
			user.customerID = userid; // not currently stored in ldap
			user.password = credentials.toString();
			user.isInternalUser = false; // not currently stored in ldap
			user.isLoggedOn = true;
			user.password = credentials.toString();
			user.userid = lu.dn.toString();
			user.username = lu.cn;
			if (lu.memberOf.size() > 0) {
				user.userGroups = new String[lu.memberOf.size()];
				lu.memberOf.copyInto(user.userGroups);
			}
			
		} catch(PTException e) {
			throw e;
		} catch (LDAPException e) {
			log.warn("Exception trying to log user " + userid + " into LDAP server", e);
			throw new PTException("LDAP: " + e.toString());
		} catch (NotFoundException e) {
			throw new PTException("user " + userid + " does not exist");
		} catch (NotUniqueException e) {
			throw new PTException("not valid user, user " + userid + " not unique");
		}
	}

	/**
	 * Sets the configuration - the login handler can read from the properties to determine its own configuration.
	 */
	public synchronized void setConfiguration(java.util.Properties props) {
		boolean mustRestart = false;

		String newServers = props.getProperty("ldap.servers", servers);
		String newBaseDN = props.getProperty("ldap.basedn", baseDN);
		String newSystemuser = props.getProperty("ldap.systemuser", systemuser);
		String newSystempassword = PasswordUtils.getPassword(props.getProperty("ldap.systempassword", systempassword));
		String newusersRDNName = props.getProperty("ldap.usersRDN", usersRDNName);
		boolean newBindUsers = props.getProperty("ldap.bindUsers", "false").equalsIgnoreCase("true");
        String newldap_userAttributes = props.getProperty("ldap.userattributes", "cn,uid,sn,initials,userpassword,memberof,ibm-allGroups,mail,userPrincipalName");

		if (!servers.equals(newServers)
			|| !baseDN.equals(newBaseDN)
			|| !systemuser.equals(newSystemuser)
			|| !systempassword.equals(newSystempassword)
			|| !usersRDNName.equals(newusersRDNName)
			|| bindUsers != newBindUsers)
			mustRestart = true;

		servers = newServers;
		baseDN = newBaseDN;
		systemuser = newSystemuser;
		systempassword = newSystempassword;
		usersRDNName = newusersRDNName;
		bindUsers = newBindUsers;
        ldap_userAttributes = newldap_userAttributes;

		if (mustRestart) {
			ldapGroups = null;
			ldapUsers = null;
		}

		// Properties that does not require restart			
		useridName = props.getProperty("ldap.useridName", "uid");
		
		// Only attempt to login if bindusers is true
		if (bindUsers) {
			try {
				getLdapUserConnection().getUser(useridName, systemuser);
			} catch (LDAPException e) {
				log.error("Exception trying to connect to LDAP", e);
			} catch (NotUniqueException e) {
				log.error("Could not find system user " + systemuser);
			} catch (NotFoundException e) {
				log.error("Could not find system user " + systemuser);
			}
		}
		
		impersonateFile = props.getProperty("ldap.impersonate");

	}
	
	private String impersonate(String userid) {
		if (impersonateFile==null)
			return userid;
		
		java.io.FileInputStream fis = null;
		try {
			fis = new java.io.FileInputStream(ConfigurationMacroHandler.expandSystemMacro(impersonateFile));
			Properties mapping = new Properties();
			mapping.load(fis);
			if (mapping.getProperty(userid)==null) {
				log.debug("could not find user "+userid+" in impersonation mapping");
				return userid;
			} else {
				return mapping.getProperty(userid);
			}
		} catch(IOException e) {
			log.error("could not impersonate user",e);
			return userid;
		} finally {
			if (fis!=null)
				try {
					fis.close();
				} catch (IOException e) {
				}
		}
		
	}
	
	/**
	 * @see IAuthenticationPlugin#modifyState(User, String, String)
	 */
	public void modifyState(User user, String key, String value) {}

	public String getStatusText() {
		ListNameValuePairs lvp = new ListNameValuePairs("LDAP connections");
		lvp.setProperty("user connection", getLdapUserConnection().getStatusText());
		lvp.setProperty("group connection", getLdapGroupConnection().getStatusText());
		return lvp.toHtml();
	}
}

var AuthTypes = Java.type('dk.itp.security.passticket.AuthTypes');
var PTException = Java.type('dk.itp.security.passticket.PTException');
var AuthErrorCodes = Java.type('dk.itp.security.passticket.server.AuthErrorCodes');

var MyPlugin = Java.extend(Java.type('dk.itp.security.authentication.AbstractScriptAuthenticationPlugin'));

var plugin = new MyPlugin() {
    getName: function() {
        return 'Dummy script based authentication plugin';
    },
   
    getAuthenticationType: function() {
        return AuthTypes.AUTHTYPE_DUMMY;
    },
    
    getAuthenticationLevel: function() {
    	return 1;
    },
    
    login: function(session, userid, credentials) {
        if (userid === 'test' && credentials == 'password') {
            session.userid='Dummy';
            session.groups = null;
            session.stateVariables = null;
            session.isLoggedOn=true;
        } else {
            throw new PTException("Only test user is allowed", AuthErrorCodes.ERROR_INVALIDCREDENTIALS, "Invalid credentials");
        }
    }
}
plugin;

public class LogonScriptContext {
	/** Session Controller */
	public PTSServer sessionController;
	/** The users session */
	public User session;
	/** The remote client making the login call */
	public Peer peer;
	/** Userid, or null in postlogin script */
	public String userid;
	/** Credentials, or null in postlogin script */
	public Object credentials;
	/** New password, if available, or null in postlogin script */
	public Object newPassword;
	/** Authentication plugin type - see AuthTypes class for details */
	public int authType;
}