001
014
015 package com.liferay.portal.security.auth;
016
017 import com.liferay.portal.kernel.log.Log;
018 import com.liferay.portal.kernel.log.LogFactoryUtil;
019 import com.liferay.portal.kernel.servlet.HttpHeaders;
020 import com.liferay.portal.kernel.util.PropsKeys;
021 import com.liferay.portal.kernel.util.StringPool;
022 import com.liferay.portal.kernel.util.Validator;
023 import com.liferay.portal.model.User;
024 import com.liferay.portal.security.exportimport.UserImporterUtil;
025 import com.liferay.portal.security.sso.SSOUtil;
026 import com.liferay.portal.service.UserLocalServiceUtil;
027 import com.liferay.portal.util.PortalUtil;
028 import com.liferay.portal.util.PrefsPropsUtil;
029 import com.liferay.portal.util.PropsUtil;
030 import com.liferay.portal.util.PropsValues;
031
032 import java.util.HashSet;
033 import java.util.Set;
034
035 import javax.servlet.http.HttpServletRequest;
036 import javax.servlet.http.HttpServletResponse;
037
038
042 public class RequestHeaderAutoLogin extends BaseAutoLogin {
043
044 public RequestHeaderAutoLogin() {
045 String[] hostsAllowedArray = PropsUtil.getArray(
046 "request.header.auth.hosts.allowed");
047
048 for (int i = 0; i < hostsAllowedArray.length; i++) {
049 _hostsAllowed.add(hostsAllowedArray[i]);
050 }
051 }
052
053 @Override
054 protected String[] doLogin(
055 HttpServletRequest request, HttpServletResponse response)
056 throws Exception {
057
058 String remoteAddr = request.getRemoteAddr();
059
060 if (SSOUtil.isAccessAllowed(request, _hostsAllowed)) {
061 if (_log.isDebugEnabled()) {
062 _log.debug("Access allowed for " + remoteAddr);
063 }
064 }
065 else {
066 if (_log.isWarnEnabled()) {
067 _log.warn("Access denied for " + remoteAddr);
068 }
069
070 return null;
071 }
072
073 long companyId = PortalUtil.getCompanyId(request);
074
075 String screenName = request.getHeader(HttpHeaders.LIFERAY_SCREEN_NAME);
076
077 if (Validator.isNull(screenName)) {
078 return null;
079 }
080
081 User user = null;
082
083 if (PrefsPropsUtil.getBoolean(
084 companyId, PropsKeys.REQUEST_HEADER_AUTH_IMPORT_FROM_LDAP,
085 PropsValues.REQUEST_HEADER_AUTH_IMPORT_FROM_LDAP)) {
086
087 try {
088 user = UserImporterUtil.importUser(
089 companyId, StringPool.BLANK, screenName);
090 }
091 catch (Exception e) {
092 }
093 }
094
095 if (user == null) {
096 user = UserLocalServiceUtil.getUserByScreenName(
097 companyId, screenName);
098 }
099
100 String[] credentials = new String[3];
101
102 credentials[0] = String.valueOf(user.getUserId());
103 credentials[1] = user.getPassword();
104 credentials[2] = Boolean.TRUE.toString();
105
106 return credentials;
107 }
108
109 private static final Log _log = LogFactoryUtil.getLog(
110 RequestHeaderAutoLogin.class);
111
112 private final Set<String> _hostsAllowed = new HashSet<String>();
113
114 }