001    /**
002     * Copyright (c) 2000-present Liferay, Inc. All rights reserved.
003     *
004     * This library is free software; you can redistribute it and/or modify it under
005     * the terms of the GNU Lesser General Public License as published by the Free
006     * Software Foundation; either version 2.1 of the License, or (at your option)
007     * any later version.
008     *
009     * This library is distributed in the hope that it will be useful, but WITHOUT
010     * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
011     * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
012     * details.
013     */
014    
015    package com.liferay.portlet.login.action;
016    
017    import com.liferay.portal.CompanyMaxUsersException;
018    import com.liferay.portal.CookieNotSupportedException;
019    import com.liferay.portal.NoSuchUserException;
020    import com.liferay.portal.PasswordExpiredException;
021    import com.liferay.portal.UserEmailAddressException;
022    import com.liferay.portal.UserIdException;
023    import com.liferay.portal.UserLockoutException;
024    import com.liferay.portal.UserPasswordException;
025    import com.liferay.portal.UserScreenNameException;
026    import com.liferay.portal.kernel.log.Log;
027    import com.liferay.portal.kernel.log.LogFactoryUtil;
028    import com.liferay.portal.kernel.portlet.bridges.mvc.BaseMVCActionCommand;
029    import com.liferay.portal.kernel.security.auth.session.AuthenticatedSessionManagerUtil;
030    import com.liferay.portal.kernel.servlet.SessionErrors;
031    import com.liferay.portal.kernel.spring.osgi.OSGiBeanProperties;
032    import com.liferay.portal.kernel.util.Http;
033    import com.liferay.portal.kernel.util.HttpUtil;
034    import com.liferay.portal.kernel.util.ParamUtil;
035    import com.liferay.portal.kernel.util.Validator;
036    import com.liferay.portal.model.Layout;
037    import com.liferay.portal.security.auth.AuthException;
038    import com.liferay.portal.theme.ThemeDisplay;
039    import com.liferay.portal.util.PortalUtil;
040    import com.liferay.portal.util.PortletKeys;
041    import com.liferay.portal.util.PropsValues;
042    import com.liferay.portal.util.WebKeys;
043    import com.liferay.portlet.PortletPreferencesFactoryUtil;
044    import com.liferay.portlet.PortletURLImpl;
045    
046    import javax.portlet.ActionRequest;
047    import javax.portlet.ActionResponse;
048    import javax.portlet.PortletPreferences;
049    import javax.portlet.PortletRequest;
050    import javax.portlet.PortletURL;
051    import javax.portlet.WindowState;
052    
053    import javax.servlet.http.HttpServletRequest;
054    import javax.servlet.http.HttpServletResponse;
055    import javax.servlet.http.HttpSession;
056    
057    /**
058     * @author Brian Wing Shun Chan
059     * @author Peter Fellwock
060     */
061    @OSGiBeanProperties(
062            property = {
063                    "javax.portlet.name=" + PortletKeys.FAST_LOGIN,
064                    "javax.portlet.name=" + PortletKeys.LOGIN,
065                    "mvc.command.name=/login/login"
066            }
067    )
068    public class LoginMVCActionCommand extends BaseMVCActionCommand {
069    
070            @Override
071            protected void doProcessAction(
072                            ActionRequest actionRequest, ActionResponse actionResponse)
073                    throws Exception {
074    
075                    ThemeDisplay themeDisplay = (ThemeDisplay)actionRequest.getAttribute(
076                            WebKeys.THEME_DISPLAY);
077    
078                    if (PropsValues.AUTH_LOGIN_DISABLED) {
079                            actionResponse.sendRedirect(
080                                    themeDisplay.getPathMain() +
081                                            PropsValues.AUTH_LOGIN_DISABLED_PATH);
082    
083                            return;
084                    }
085    
086                    /*if (actionRequest.getRemoteUser() != null) {
087                            actionResponse.sendRedirect(themeDisplay.getPathMain());
088    
089                            return;
090                    }*/
091    
092                    try {
093                            login(themeDisplay, actionRequest, actionResponse);
094    
095                            boolean doActionAfterLogin = ParamUtil.getBoolean(
096                                    actionRequest, "doActionAfterLogin");
097    
098                            if (doActionAfterLogin) {
099                                    actionResponse.setRenderParameter(
100                                            "mvcPath", "/html/portlet/login/login_redirect.jsp");
101                            }
102                    }
103                    catch (Exception e) {
104                            if (e instanceof AuthException) {
105                                    Throwable cause = e.getCause();
106    
107                                    if (cause instanceof PasswordExpiredException ||
108                                            cause instanceof UserLockoutException) {
109    
110                                            SessionErrors.add(actionRequest, cause.getClass(), cause);
111                                    }
112                                    else {
113                                            if (_log.isInfoEnabled()) {
114                                                    _log.info("Authentication failed");
115                                            }
116    
117                                            SessionErrors.add(actionRequest, e.getClass());
118                                    }
119                            }
120                            else if (e instanceof CompanyMaxUsersException ||
121                                             e instanceof CookieNotSupportedException ||
122                                             e instanceof NoSuchUserException ||
123                                             e instanceof PasswordExpiredException ||
124                                             e instanceof UserEmailAddressException ||
125                                             e instanceof UserIdException ||
126                                             e instanceof UserLockoutException ||
127                                             e instanceof UserPasswordException ||
128                                             e instanceof UserScreenNameException) {
129    
130                                    SessionErrors.add(actionRequest, e.getClass(), e);
131                            }
132                            else {
133                                    _log.error(e, e);
134    
135                                    PortalUtil.sendError(e, actionRequest, actionResponse);
136    
137                                    return;
138                            }
139    
140                            postProcessAuthFailure(actionRequest, actionResponse);
141                    }
142            }
143    
144            protected String getCompleteRedirectURL(
145                    HttpServletRequest request, String redirect) {
146    
147                    HttpSession session = request.getSession();
148    
149                    Boolean httpsInitial = (Boolean)session.getAttribute(
150                            WebKeys.HTTPS_INITIAL);
151    
152                    String portalURL = null;
153    
154                    if (PropsValues.COMPANY_SECURITY_AUTH_REQUIRES_HTTPS &&
155                            !PropsValues.SESSION_ENABLE_PHISHING_PROTECTION &&
156                            (httpsInitial != null) && !httpsInitial.booleanValue()) {
157    
158                            portalURL = PortalUtil.getPortalURL(request, false);
159                    }
160                    else {
161                            portalURL = PortalUtil.getPortalURL(request);
162                    }
163    
164                    return portalURL.concat(redirect);
165            }
166    
167            protected void login(
168                            ThemeDisplay themeDisplay, ActionRequest actionRequest,
169                            ActionResponse actionResponse)
170                    throws Exception {
171    
172                    HttpServletRequest request = PortalUtil.getHttpServletRequest(
173                            actionRequest);
174                    HttpServletResponse response = PortalUtil.getHttpServletResponse(
175                            actionResponse);
176    
177                    String login = ParamUtil.getString(actionRequest, "login");
178                    String password = actionRequest.getParameter("password");
179                    boolean rememberMe = ParamUtil.getBoolean(actionRequest, "rememberMe");
180    
181                    if (!themeDisplay.isSignedIn()) {
182                            String portletId = PortalUtil.getPortletId(actionRequest);
183    
184                            PortletPreferences portletPreferences =
185                                    PortletPreferencesFactoryUtil.getStrictPortletSetup(
186                                            themeDisplay.getLayout(), portletId);
187    
188                            String authType = portletPreferences.getValue("authType", null);
189    
190                            AuthenticatedSessionManagerUtil.login(
191                                    request, response, login, password, rememberMe, authType);
192                    }
193    
194                    String redirect = ParamUtil.getString(actionRequest, "redirect");
195    
196                    if (Validator.isNotNull(redirect)) {
197                            redirect = PortalUtil.escapeRedirect(redirect);
198    
199                            if (Validator.isNotNull(redirect) &&
200                                    !redirect.startsWith(Http.HTTP)) {
201    
202                                    redirect = getCompleteRedirectURL(request, redirect);
203                            }
204                    }
205    
206                    String mainPath = themeDisplay.getPathMain();
207    
208                    if (PropsValues.PORTAL_JAAS_ENABLE) {
209                            if (Validator.isNotNull(redirect)) {
210                                    redirect = mainPath.concat(
211                                            "/portal/protected?redirect=").concat(
212                                                    HttpUtil.encodeURL(redirect));
213                            }
214                            else {
215                                    redirect = mainPath.concat("/portal/protected");
216                            }
217    
218                            actionResponse.sendRedirect(redirect);
219                    }
220                    else {
221                            if (Validator.isNotNull(redirect)) {
222                                    actionResponse.sendRedirect(redirect);
223                            }
224                            else {
225                                    boolean doActionAfterLogin = ParamUtil.getBoolean(
226                                            actionRequest, "doActionAfterLogin");
227    
228                                    if (doActionAfterLogin) {
229                                            return;
230                                    }
231                                    else {
232                                            actionResponse.sendRedirect(mainPath);
233                                    }
234                            }
235                    }
236            }
237    
238            protected void postProcessAuthFailure(
239                            ActionRequest actionRequest, ActionResponse actionResponse)
240                    throws Exception {
241    
242                    Layout layout = (Layout)actionRequest.getAttribute(WebKeys.LAYOUT);
243    
244                    PortletURL portletURL = new PortletURLImpl(
245                            actionRequest, PortletKeys.LOGIN, layout.getPlid(),
246                            PortletRequest.RENDER_PHASE);
247    
248                    portletURL.setParameter("saveLastPath", Boolean.FALSE.toString());
249    
250                    String redirect = ParamUtil.getString(actionRequest, "redirect");
251    
252                    if (Validator.isNotNull(redirect)) {
253                            portletURL.setParameter("redirect", redirect);
254                    }
255    
256                    String login = ParamUtil.getString(actionRequest, "login");
257    
258                    if (Validator.isNotNull(login)) {
259                            portletURL.setParameter("login", login);
260                    }
261    
262                    portletURL.setWindowState(WindowState.MAXIMIZED);
263    
264                    actionResponse.sendRedirect(portletURL.toString());
265            }
266    
267            private static final Log _log = LogFactoryUtil.getLog(
268                    LoginMVCActionCommand.class);
269    
270    }