module/session/SessionMechanism.java

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

package org.opensolaris.os.vp.server.module.session;

import com.sun.cacao.agent.auth.*;
import java.security.*;
import java.util.*;
import java.util.logging.*;
import javax.management.ObjectName;
import javax.security.auth.Subject;
import org.opensolaris.os.vp.common.panel.SessionMXBean;
import org.opensolaris.os.vp.util.misc.Base64Util;

/**
 * 'Session' mechanism, accepts session-key in the private credential
 * to look up an existing connection's Subject and re-use it.
 * @author Nick Stephen
 */
public class SessionMechanism implements Mechanism, SessionMXBean {

    /* Tracing utility. */
    private static final Logger logger = Logger.getLogger(
        SessionMechanism.class.getPackage().getName());

    public Logger getLogger() {
        return logger;
    }

    private static final SecureRandom sr = new SecureRandom();

    private static final Map<String, Subject> sessionIdSubjectMap =
        new WeakHashMap<String, Subject>();

    private static final Map<String, Properties> sessionIdPropertiesMap =
        new WeakHashMap<String, Properties>();

    private static SessionMechanism myInstance;

    /**
     * Return the name of this mechanism, must correspond to first field
     * of the SASL/PLAIN authentication-id
     * @return a <code>String</code> value
     */
    public String getName() {
	return (SESSION_MECHANISM_NAME);
    }

    public ObjectName getObjectName() {
	return (SessionMXBean.OBJECT_NAME);
    }
    /**
     * Obtain a reference to the session mechanism instance
     * @return a reference to the singleton SessionMechanism instance
     */
    public synchronized static SessionMechanism getInstance() {
	if (myInstance == null) {
	    myInstance = new SessionMechanism();
	}
	return myInstance;
    }

    /**
     * Instance reference must be obtained through getInstance().
     */
    protected SessionMechanism() {
        // empty
    }

    /**
     * Indicate if this mechanism asserts identity
     * @return a <code>boolean</code> value
     */
    public boolean isIdentityAsserted() {
	return false;
    }

    /**
     * Parse and validate the given credentials, returning a CallbackInfo
     * @return a <code>CallbackInfo</code> value
     *
     * @param authenticationID a <code>String</code> value
     * @param password a <code>String</code> value
     * @param authPieces a <code>String[]</code> value containing fields
     * @param passwdPieces a <code>String[]</code> value containing fields
     *
     * @exception SecurityException if an error occurs
     */
    public CallbackInfo parse(String authenticationID,
	String password, String[] authPieces, String[] passwdPieces)
	throws SecurityException {

	if (logger.isLoggable(Level.FINER)) {
	    logger.finer("Authentication_Module: SASL/PLAIN: "+
			 "authenticate-id: " +
			 authenticationID + ", mechanism: " + authPieces[0] +
			 ", public credential: " + authPieces[1]);
	}

	// Try and find a suitable 'Subject' object with these credentials

        // private credentials contains our session id
	Subject subject = sessionIdSubjectMap.get(passwdPieces[0]);

        if (subject == null) {
            throw (new SecurityException(
		"Authentication failed - invalid session ID"));
        }
	CallbackInfo callbackInfo = new CallbackInfo(subject, false);

	logger.finer("Authentication_Module: authenticated session");

	return callbackInfo;
    }

    // Implementation of MBean interface

    public String getSessionSaslAuthenticationId() {

	return (SESSION_MECHANISM_NAME + CacaoCallbackHandler.SEPARATOR +
	    "existing session");
    }

    public String getSessionSaslPassword() {
	return getSessionId();
    }

    public synchronized String getSessionId() {

        // get the Subject from the current thread context
        java.security.AccessControlContext acc =
            java.security.AccessController.getContext();
        javax.security.auth.Subject subject =
            javax.security.auth.Subject.getSubject(acc);

        if (subject == null) {
            throw new SecurityException("No subject");
        }
        Set sessionCredSet =
	    subject.getPrivateCredentials(SessionCredential.class);
        String sessionId = null;
        switch (sessionCredSet.size()) {
            case 0 : {
                // need to create new session id

                byte[] bytes = new byte[1024 / 8];
                sr.nextBytes(bytes);
                sessionId = Base64Util.encode(bytes);
                SessionCredential sessionCred =
		    new SessionCredential(sessionId);

                subject.getPrivateCredentials().add(sessionCred);

                sessionIdSubjectMap.put(sessionId, subject);
                sessionIdPropertiesMap.put(sessionId, new Properties());
                break;
            }
            case 1: {
                // session Id already exists
                SessionCredential sessionCred =
		    (SessionCredential)sessionCredSet.iterator().next();
                sessionId = sessionCred.getSessionId();
                break;
            }
            default : {
                throw (new RuntimeException(
		    "Too many SessionId objects in Subject"));
            }
        }
        return sessionId;
    }

    public synchronized boolean invalidateSession() {
        // get the Subject from the current thread context
        java.security.AccessControlContext acc =
            java.security.AccessController.getContext();
        javax.security.auth.Subject subject =
            javax.security.auth.Subject.getSubject(acc);

        if (subject == null) {
            return false;
        }
        Set sessionCredSet =
	    subject.getPrivateCredentials(SessionCredential.class);
        switch (sessionCredSet.size()) {
            case 0 : {
                // nothing to do
                return false;
            }
            case 1: {
                // session Id exists, get it
                SessionCredential sessionCred =
		    (SessionCredential)sessionCredSet.iterator().next();
                String sessionId = sessionCred.getSessionId();
                // delete our session id from the subject credentials
                subject.getPrivateCredentials().removeAll(sessionCredSet);
                // delete our session id from our internal Maps
                sessionIdSubjectMap.remove(sessionId);
                sessionIdPropertiesMap.remove(sessionId);

                return true;
            }
            default : {
		/*
		 * delete session ids from the subject credentials
		 * before throwing exception
		 */
                subject.getPrivateCredentials().removeAll(sessionCredSet);
                throw (new RuntimeException(
		    "Too many SessionId objects in Subject"));
            }
        }
    }

    public synchronized String getProperty(String key) {

        String sessionId = getSessionId();
        Properties props = sessionIdPropertiesMap.get(sessionId);
        if (props == null) {
            throw new RuntimeException("No properties object available");
        }
        return props.getProperty(key);
    }

    public synchronized String setProperty(String key, String value) {

        String sessionId = getSessionId();
        Properties props = sessionIdPropertiesMap.get(sessionId);
        if (props == null) {
            throw new RuntimeException("No properties object available");
        }
        return (String)props.setProperty(key, value);
    }

    public synchronized String[] getPropertyNames() {
        String sessionId = getSessionId();
        Properties props = sessionIdPropertiesMap.get(sessionId);
        if (props == null) {
            throw new RuntimeException("No properties object available");
        }
        return (new ArrayList<Object>(props.keySet()).toArray(new String[] {}));
    }

    public synchronized Map<String, String> getPropertyMap() {
        String sessionId = getSessionId();
        Properties props = sessionIdPropertiesMap.get(sessionId);

	/* Sigh; work around broken Properties definition */
	Map<String, String> result = new HashMap<String, String>(props.size());
	for (Map.Entry<Object, Object> entry : props.entrySet())
	    result.put(entry.getKey().toString(),
		entry.getValue().toString());

	return (result);
    }

    private static class SessionCredential {
        private String sessionId = null;

        private SessionCredential(String id) {
            this.sessionId = id;
        }

        private String getSessionId() {
            return sessionId;
        }
    }
}