gerrit.onap Code Review - portal/sdk.git/blob

   1 /*
   2  * ============LICENSE_START==========================================
   3  * ONAP Portal SDK
   4  * ===================================================================
   5  * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
   6  * ===================================================================
   7  *
   8  * Unless otherwise specified, all software contained herein is licensed
   9  * under the Apache License, Version 2.0 (the "License");
  10  * you may not use this software except in compliance with the License.
  11  * You may obtain a copy of the License at
  12  *
  13  *             http://www.apache.org/licenses/LICENSE-2.0
  14  *
  15  * Unless required by applicable law or agreed to in writing, software
  16  * distributed under the License is distributed on an "AS IS" BASIS,
  17  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18  * See the License for the specific language governing permissions and
  19  * limitations under the License.
  20  *
  21  * Unless otherwise specified, all documentation contained herein is licensed
  22  * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
  23  * you may not use this documentation except in compliance with the License.
  24  * You may obtain a copy of the License at
  25  *
  26  *             https://creativecommons.org/licenses/by/4.0/
  27  *
  28  * Unless required by applicable law or agreed to in writing, documentation
  29  * distributed under the License is distributed on an "AS IS" BASIS,
  30  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  31  * See the License for the specific language governing permissions and
  32  * limitations under the License.
  33  *
  34  * ============LICENSE_END============================================
  35  *
  36  * ECOMP is a trademark and service mark of AT&T Intellectual Property.
  37  */
  38 package org.onap.portalapp.controller.core;
  39
  40 import java.net.URLDecoder;
  41 import java.net.URLEncoder;
  42 import java.util.HashMap;
  43 import java.util.List;
  44 import java.util.Map;
  45
  46 import javax.servlet.http.Cookie;
  47 import javax.servlet.http.HttpServletRequest;
  48 import javax.servlet.http.HttpSession;
  49
  50 import org.onap.portalsdk.core.auth.LoginStrategy;
  51 import org.onap.portalsdk.core.command.LoginBean;
  52 import org.onap.portalsdk.core.controller.UnRestrictedBaseController;
  53 import org.onap.portalsdk.core.domain.RoleFunction;
  54 import org.onap.portalsdk.core.domain.User;
  55 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
  56 import org.onap.portalsdk.core.menu.MenuProperties;
  57 import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler;
  58 import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
  59 import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
  60 import org.onap.portalsdk.core.service.LoginService;
  61 import org.onap.portalsdk.core.service.RoleService;
  62 import org.onap.portalsdk.core.util.SystemProperties;
  63 import org.onap.portalsdk.core.web.support.AppUtils;
  64 import org.onap.portalsdk.core.web.support.UserUtils;
  65 import org.springframework.beans.factory.annotation.Autowired;
  66 import org.springframework.stereotype.Controller;
  67 import org.springframework.web.bind.annotation.RequestMapping;
  68 import org.springframework.web.bind.annotation.RequestMethod;
  69 import org.springframework.web.servlet.ModelAndView;
  70 import org.springframework.web.util.WebUtils;
  71
  72 @Controller
  73 @RequestMapping("/")
  74 public class SingleSignOnController extends UnRestrictedBaseController {
  75
  76         private static final EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(SingleSignOnController.class);
  77
  78         @Autowired
  79         private LoginService loginService;
  80
  81         @Autowired
  82         private LoginStrategy loginStrategy;
  83
  84         @Autowired
  85         private RoleService roleService;
  86
  87         private String viewName;
  88         private String welcomeView;
  89
  90         public String getWelcomeView() {
  91                 return welcomeView;
  92         }
  93
  94         public void setWelcomeView(String welcomeView) {
  95                 this.welcomeView = welcomeView;
  96         }
  97
  98         /**
  99          * Handles requests directed to the single sign-on page by the session timeout
 100          * interceptor.
 101          *
 102          * @param request
 103          * @return Redirect to an appropriate address
 104          * @throws Exception
 105          */
 106         @RequestMapping(value = { "/single_signon.htm" }, method = RequestMethod.GET)
 107         public ModelAndView singleSignOnLogin(HttpServletRequest request) throws Exception {
 108
 109                 Map<String, String> model = new HashMap<>();
 110                 HashMap<String, String> additionalParamsMap = new HashMap<>();
 111                 LoginBean commandBean = new LoginBean();
 112
 113                 // SessionTimeoutInterceptor sets these parameters
 114                 String forwardURL = URLDecoder.decode(request.getParameter("forwardURL"), "UTF-8");
 115                 String redirectToPortal = request.getParameter("redirectToPortal");
 116
 117                 if (isLoginCookieExist(request) && redirectToPortal == null) {
 118                         HttpSession session = AppUtils.getSession(request);
 119                         User user = UserUtils.getUserSession(request);
 120                         if (session == null || user == null) {
 121
 122                                 final String authMech = SystemProperties.getProperty(SystemProperties.AUTHENTICATION_MECHANISM);
 123                                 String userId = loginStrategy.getUserId(request);
 124                                 commandBean.setUserid(userId);
 125                                 commandBean = getLoginService().findUser(commandBean,
 126                                                 (String) request.getAttribute(MenuProperties.MENU_PROPERTIES_FILENAME_KEY),
 127                                                 additionalParamsMap);
 128                                 List<RoleFunction> roleFunctionList = roleService.getRoleFunctions(userId);
 129                                 if (commandBean.getUser() == null) {
 130                                         String loginErrorMessage = (commandBean.getLoginErrorMessage() != null)
 131                                                         ? commandBean.getLoginErrorMessage()
 132                                                         : SystemProperties.MESSAGE_KEY_LOGIN_ERROR_USER_NOT_FOUND;
 133                                         model.put(LoginStrategy.ERROR_MESSAGE_KEY, SystemProperties.getProperty(loginErrorMessage));
 134                                         final String redirectUrl = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REDIRECT_URL)
 135                                                         + "?noUserError=Yes";
 136                                         logger.debug(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: user is null, redirect URL is {}",
 137                                                         redirectUrl);
 138                                         return new ModelAndView("redirect:" + redirectUrl);
 139                                 } else {
 140                                         // store the user's information in the session
 141                                         String loginMethod;
 142                                         if (null == authMech || "".equals(authMech) || "BOTH".equals(authMech)) {
 143                                                 loginMethod = SystemProperties.getProperty(SystemProperties.LOGIN_METHOD_CSP);
 144                                         } else if ("CSP".equals(authMech)) {
 145                                                 loginMethod = SystemProperties.getProperty(SystemProperties.LOGIN_METHOD_CSP);
 146                                         } else {
 147                                                 loginMethod = SystemProperties.getProperty(SystemProperties.LOGIN_METHOD_WEB_JUNCTION);
 148                                         }
 149                                         UserUtils.setUserSession(request, commandBean.getUser(), commandBean.getMenu(),
 150                                                         commandBean.getBusinessDirectMenu(), loginMethod, roleFunctionList);
 151                                         initateSessionMgtHandler(request);
 152                                         logger.debug(EELFLoggerDelegate.debugLogger,
 153                                                         "singleSignOnLogin: create new user session for expired user {}; user {} exists in the system",
 154                                                         userId, commandBean.getUser().getOrgUserId());
 155                                         return new ModelAndView("redirect:" + forwardURL);
 156                                 }
 157                         } // user is null or session is null
 158                         else {
 159                                 // both user and session are non-null.
 160                                 logger.info(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: redirecting to the forwardURL {}",
 161                                                 forwardURL);
 162                                 return new ModelAndView("redirect:" + forwardURL);
 163                         }
 164
 165                 } else {
 166                         /*
 167                          * Login cookie not found, or redirect-to-portal parameter was found.
 168                          *
 169                          * Redirect the user to the portal with a suitable return URL. The forwardURL
 170                          * parameter that arrives as a parameter is a partial (not absolute) request
 171                          * path for a page in the application. The challenge here is to compute the
 172                          * correct absolute path for the original request so the portal can redirect the
 173                          * user back to the right place. If the application sits behind WebJunction, or
 174                          * if separate FE-BE hosts are used, then the URL yielded by the request has a
 175                          * host name that is not reachable by the user.
 176                          */
 177                         String returnToAppUrl;
 178                         if (SystemProperties.containsProperty(SystemProperties.APP_BASE_URL)) {
 179                                 // New feature as of 1610, release 3.3.3:
 180                                 // application can publish a base URL in system.properties
 181                                 String appUrl = SystemProperties.getProperty(SystemProperties.APP_BASE_URL);
 182                                 returnToAppUrl = appUrl + (appUrl.endsWith("/") ? "" : "/") + forwardURL;
 183                                 logger.debug(EELFLoggerDelegate.debugLogger,
 184                                                 "singleSignOnLogin: using app base URL {} and redirectURL {}", appUrl, returnToAppUrl);
 185                         } else {
 186                                 // Be backward compatible with applications that don't need this
 187                                 // feature.
 188                                 // This is the controller for the single_signon.htm page, so the
 189                                 // replace
 190                                 // should always find the specified token.
 191                                 returnToAppUrl = request.getRequestURL().toString().replace("single_signon.htm",
 192                                                 forwardURL);
 193                                 logger.debug(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: computed redirectURL {}",
 194                                                 returnToAppUrl);
 195                         }
 196                         final String encodedReturnToAppUrl = URLEncoder.encode(returnToAppUrl, "UTF-8");
 197                         // Also send the application's UEB key so Portal can block URL
 198                         // reflection attacks.
 199                         final String uebAppKey = PortalApiProperties.getProperty(PortalApiConstants.UEB_APP_KEY);
 200                         final String url = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REDIRECT_URL);
 201                         final String portalUrl = url.substring(0, url.lastIndexOf('/')) + "/process_csp";
 202                         final String redirectUrl = portalUrl + "?uebAppKey=" + uebAppKey + "&redirectUrl=" + encodedReturnToAppUrl;
 203                         logger.debug(EELFLoggerDelegate.debugLogger, "singleSignOnLogin: portal-bound redirect URL is {}",
 204                                         redirectUrl);
 205
 206                         // this line may not be necessary but jsessionid coockie is not getting created in all cases;
 207                         // so force the cookie creation
 208                         request.getSession(true);
 209
 210                         return new ModelAndView("redirect:" + redirectUrl);
 211                 }
 212         }
 213
 214         protected void initateSessionMgtHandler(HttpServletRequest request) {
 215                 String portalJSessionId = getPortalJSessionId(request);
 216                 String jSessionId = getJessionId(request);
 217                 PortalTimeoutHandler.sessionCreated(portalJSessionId, jSessionId, AppUtils.getSession(request));
 218         }
 219
 220         public boolean isLoginCookieExist(HttpServletRequest request) {
 221                 Cookie ep = WebUtils.getCookie(request, LoginStrategy.EP_SERVICE);
 222                 return ep != null;
 223         }
 224
 225         public String getPortalJSessionId(HttpServletRequest request) {
 226                 Cookie ep = WebUtils.getCookie(request, LoginStrategy.EP_SERVICE);
 227                 return ep.getValue();
 228         }
 229
 230         public String getJessionId(HttpServletRequest request) {
 231                 return request.getSession().getId();
 232         }
 233
 234         @Override
 235         public String getViewName() {
 236                 return viewName;
 237         }
 238
 239         @Override
 240         public void setViewName(String viewName) {
 241                 this.viewName = viewName;
 242         }
 243
 244         public LoginService getLoginService() {
 245                 return loginService;
 246         }
 247
 248         public void setLoginService(LoginService loginService) {
 249                 this.loginService = loginService;
 250         }
 251
 252 }