DrupAuthServlet.java

Go to the documentation of this file.

/*
 * Project: Server for annotations sharing
 * Author: Ing. Jaroslav Dytrych idytrych@fit.vutbr.cz
 * File: DrupAuthServlet.java
 * Description: Servlet which allows Drupal CMS to send informations about it's 
 *              users, so users can be authenticated automatically with these 
 *              informations. If user haven't account yet, it will be created.
 */

/**
 * @file DrupAuthServlet.java
 *
 * Servlet which allows Drupal CMS to send informations about it's 
 * users, so users can be authenticated automatically with these 
 * informations. If user haven't account yet, it will be created.
 * 
 * @brief Servlet which allows Drupal CMS to send informations about it's users
 */

package cz.vutbr.fit.knot.annotations.comet;

import cz.vutbr.fit.knot.annotations.app.AppBean;
import cz.vutbr.fit.knot.annotations.app.Constants;
import cz.vutbr.fit.knot.annotations.entity.DefaultSettings;
import cz.vutbr.fit.knot.annotations.entity.DrupAuthServer;
import cz.vutbr.fit.knot.annotations.entity.Settings;
import cz.vutbr.fit.knot.annotations.entity.User;
import cz.vutbr.fit.knot.annotations.entity.UserGroup;
import cz.vutbr.fit.knot.annotations.web.EditUser;
import cz.vutbr.fit.knot.annotations.web.MessageProvider;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringReader;
import java.io.StringWriter;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.ListIterator;
import java.util.Map;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.persistence.EntityManager;
import javax.persistence.EntityTransaction;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;

/**
 * Servlet which allows Drupal CMS to send informations about it's users, 
 * so users can be authenticated automatically with these informations. 
 * If user haven't account yet, it will be created.
 * 
 * @brief Servlet which allows Drupal CMS to send informations about it's users
 * @author idytrych
 */
public class DrupAuthServlet extends HttpServlet {
  
  /** 
   * Handles the HTTP <code>GET</code> method.
   * 
   * @param request servlet request
   * @param response servlet response
   * @throws ServletException if a servlet-specific error occurs
   * @throws IOException if an I/O error occurs
   */
  @Override
  protected void doGet(HttpServletRequest request, HttpServletResponse response)
          throws ServletException, IOException {
    response.setContentType("text/html;charset=UTF-8");
    PrintWriter out = response.getWriter();
    try {
      out.println(getError());
      if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_ALL) {
        Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.ALL, "GET request on DrupAuthServlet");
      }
    } finally {   
      out.close();
    }
  }  // doGet()

  /** 
   * Handles the HTTP <code>POST</code> method.
   * 
   * @param request servlet request
   * @param response servlet response
   * @throws ServletException if a servlet-specific error occurs
   * @throws IOException if an I/O error occurs
   */
  @Override
  protected void doPost(HttpServletRequest request, HttpServletResponse response)
          throws ServletException, IOException {
    BufferedReader bufReader = request.getReader();

    String responseString = "OK";  // default reply for the client
    try  {
    
      // read XML from Drupal
      StringWriter writer = new StringWriter();
      int nextChar;
      while ((nextChar = bufReader.read()) != -1) {
        writer.write(nextChar);
      }
      String requestStr = writer.toString();

      // parse XML
      Document doc = parseXml(requestStr);
      if (doc == null) {
        if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_ALL) {
          String msg = "Bad XML received from Drupal: " + requestStr;
          Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.ALL, msg);
        }
        throw new RuntimeException("Bad data sent!");
      }
      Element docEl = doc.getDocumentElement();

      ArrayList<User> users = new ArrayList<User>();
      Map<String,String> authData = new HashMap<String, String>();
      
      String drupalAddress = "";
      
      NodeList drupalNL = docEl.getElementsByTagName("drupal");
      Element drupalEl = (Element) drupalNL.item(0);
      if (drupalEl != null) {
        drupalAddress = drupalEl.getAttribute("address");
        if (drupalAddress == null) {
          drupalAddress = "";
        }
      }
      
      if (drupalAddress.isEmpty()) {
        if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_ALL_ERRORS) {
          Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.SEVERE, "Missing Drupal address.");
        }
        throw new RuntimeException("No drupal address included!");
      }

      String remoteAddr = request.getRemoteAddr();
      String remoteHost = request.getRemoteHost();      
      if (Constants.AUTH_DRUPAL == Constants.AUTH_DRUPAL_BY_IP 
          && !isAuthorizedByIp(remoteAddr)) {
        if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_ALL) {
          String msg = "Bad IP of Drupal: " + remoteAddr;
          Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.ALL, msg);
        }
        throw new RuntimeException("Bad IP");
      }
      if (Constants.AUTH_DRUPAL == Constants.AUTH_DRUPAL_BY_HOST 
          && !isAuthorizedByName(remoteHost)) {
        if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_ALL) {
          String msg = "Bad host of Drupal: " + remoteHost;
          Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.ALL, msg);
        }
        throw new RuntimeException("Bad Host Name");
      }
            
      NodeList userNodes = docEl.getElementsByTagName("user");
      int uCount = userNodes.getLength();
      for (int i = 0; i < uCount; i++) {
        Element userEl = (Element) userNodes.item(i);
        User u = processUser(userEl,authData,drupalAddress);
        if (u != null) {
          users.add(u);
        } else {
          if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_ALL_ERRORS) {
            String msg = "Bad entry in authentication data from Drupal " + drupalAddress 
                         + " " + userEl.toString();
            Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.SEVERE, msg);
          }
          throw new RuntimeException("Bad entry found!");
        }
      }
      
      saveUsers(users,authData);
    
    } catch (Exception e) {  // if any exception occurred
      if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_SERVER_INTERNAL_ERRORS) {
        String msg = "Unknown exception:";
        Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.SEVERE, msg, e);
      }
      responseString = getError();
    }
    
    // return reply to client
    PrintWriter resWriter = response.getWriter();
    resWriter.write(responseString);
    resWriter.flush();
    
  }  // doPost()

  /**
   * Saves data about users to the database and authentication data to AppBean
   * 
   * @param users List of users to save
   * @param aData Map with authentication data
   */
  private void saveUsers(List users, Map<String, String> aData) {
    EntityManager em = AppBean.getPersistenceManager().getEM();
    EntityTransaction transaction = em.getTransaction();
    boolean errorOccurred = false;
    try {
      transaction.begin();
      
      // existing users will be updated, new users will be saved
      for (Iterator uIt = users.iterator(); uIt.hasNext();) {  // for all users
        User user = (User) uIt.next();
        ArrayList<UserGroup> groups = user.getGroupsAL();
        user.setGroups(null);

        user = em.merge(user);

        for (Iterator<UserGroup> gIt = groups.iterator(); gIt.hasNext();) {
          UserGroup ug = gIt.next();
          ug = em.merge(ug);
          if (!ug.getUsers().contains(user)) {
            ug.addUser(user);
          }
          user.addGroup(ug);
        }
      }  // for all users
    
      em.flush();
      transaction.commit();
      
    } catch (Exception e) {
      if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_SERVER_INTERNAL_ERRORS) {
        String msg = "Saving of users failed.";
        Logger.getLogger(DrupAuthServlet.class.getName()).log(Level.SEVERE, msg, e);
      }
      transaction.rollback();
      errorOccurred = true;
    } finally {
      em.close();
    }
    if (errorOccurred) {
      throw new RuntimeException("Database failure!");
    }

    for (Iterator uIt = users.iterator(); uIt.hasNext();) {
      User user = (User) uIt.next();

      if(user.getId() == null){
        //new user
        //find new user
        Object[] params = {"login",user.getLogin(),"comeFrom",user.getComeFrom()};
        @SuppressWarnings("unchecked")
        List<User> userList = AppBean.getPersistenceManager().queryDB("User.findByLoginAndSystem",params);

        if(userList != null){
          String resultError = loadDefaultSettings(userList.get(0));
          if(resultError != null){
            throw(new RuntimeException("Error occured during default user settings save procedure."));
          }
        }else throw(new RuntimeException("Error: Can't find user."));
      }
      
      AppBean.setExtAuthData(user.getComeFrom(), user.getLogin(), aData.get(user.getLogin()));
    }
  }  // saveUSers()
  
  /**
   * Processes XML element with data about user and returns User object. 
   * If user is already in database, saved object will be returned. 
   * If user is not in database, new object will be created.
   * It also stores authentication data into the given map.
   * 
   * @param userEl XML element with data about user
   * @param authData Map to which authentication data will be stored.
   * @param drupalAddress Address from which user comes
   * @return Returns User object of the given user.
   */
  private User processUser(Element userEl, Map<String,String> authData, String drupalAddress) {
    User user = null;
    
    // get attributes of user from XML
    String loginAtt = userEl.getAttribute("login");
    String tokenAtt = userEl.getAttribute("token");
    String idAtt = userEl.getAttribute("id");
    String nameAtt = userEl.getAttribute("name");
    String passwordAtt = userEl.getAttribute("password");
    String emailAtt = userEl.getAttribute("email");
    if (loginAtt == null) {  // null is a same as not set
      loginAtt = "";
    }
    if (tokenAtt == null) {
      tokenAtt = "";
    }
    if (idAtt == null) {
      idAtt = "";
    }
    if (nameAtt == null) {
      nameAtt = "";
    }
    if (passwordAtt == null) {
      passwordAtt = "";
    }
    if (emailAtt == null) {
      emailAtt = "";
    }
    
    if (loginAtt.isEmpty()) {
      return null;
    }
    
    // query database for the user (find by login)
    Object[] params = new Object[4];
    params[0] = "login";
    params[1] = loginAtt;
    params[2] = "comeFrom";
    params[3] = drupalAddress;
    List uList = AppBean.getPersistenceManager().queryDB("User.findByLoginAndSystem", params);
    if (uList != null && !uList.isEmpty()) {  // if user was found
      user = (User) uList.get(0);
    }

    if (user == null) {
      user = new User(loginAtt, nameAtt, emailAtt, passwordAtt);
      user.setGroups(new ArrayList<UserGroup>());
    }
    
    // set Drupal to which is user logged in
    user.setComeFrom(drupalAddress);
    // set authentication data
    authData.put(loginAtt, tokenAtt);

    NodeList groupsNL = userEl.getElementsByTagName("group");
    int groupsCnt = groupsNL.getLength();
    for (int i = 0; i < groupsCnt; i++) {  // for all groups
      Element gropEl = (Element) groupsNL.item(i);
      String groupName = gropEl.getAttribute("name");
      if (groupName == null) {
        groupName = "";
      }
      if (groupName.isEmpty()) {
        continue;
      }
      
      // query database for group
      params[0] = "name";
      params[1] = groupName;
      List gList = AppBean.getPersistenceManager().queryDB("UserGroup.findByName", params);
      if (gList != null && !gList.isEmpty()) {  // if group was found
        UserGroup group = (UserGroup) gList.get(0);
        if (!user.getGroupsAL().contains(group)) {
          user.addGroup(group);  // add user to group
        }
      }
      
    }  // for all groups
    
    return user;
  }  // processUser()
  
  /**
   * Gets error page (there is not much informations because it can be used 
   * by attacker)
   * 
   * @return Returns content of the error page
   */
  private static String getError() {
    String retString = "<html>"
      + "<head>"
      + "<title>Error</title>"
      + "</head>"
      + "<body>"
      + "<h1>Access to this page is not allowed!</h1>"
      + "</body>"
      + "</html>";
    return retString;
  }
  
  /**
   * Parses XML with data
   *
   * @param XMLString String with XML with data from Drupal
   * @return Parsed XML in w3c.dom.Document
   */
  private static Document parseXml(String XMLString) throws SAXException, ParserConfigurationException, IOException {
    Document dom;
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);

    DocumentBuilder db = dbf.newDocumentBuilder();
    InputSource is = new InputSource();
    is.setCharacterStream(new StringReader(XMLString));
    dom = db.parse(is);

    return dom;
  }  // parseXml()
  
  /** 
   * Returns a short description of the servlet.
   * 
   * @return a String containing servlet description
   */
  @Override
  public String getServletInfo() {
    return "Servlet which allows Drupal CMS to send informations about it's users";
  }
  
  private String loadDefaultSettings(User user){
      @SuppressWarnings("unchecked")
    List<DefaultSettings> settingsList = AppBean.getPersistenceManager().queryDB("DefaultSettings.findAll");
    if(settingsList != null){
      String errorMessageOut;
      ListIterator<DefaultSettings> resultIt = settingsList.listIterator();
      while(resultIt.hasNext()){
        DefaultSettings actualDefaultSetting = resultIt.next();
        Settings newUserSetting = new Settings(user,actualDefaultSetting.getName(),actualDefaultSetting.getValue());
        
        if (AppBean.getPersistenceManager().persistEntity(newUserSetting)) {
          errorMessageOut = MessageProvider.getMessage("newUserSettingDBFailure");
          if (Constants.LOG_LEVEL >= Constants.LOG_LEVEL_SERVER_ERRORS) {
            String msg = "Persisting of new user settings failed.";
            Logger.getLogger(EditUser.class.getName()).log(Level.SEVERE, msg);
          }
          return errorMessageOut;
        }
      }
    }
    
    return null;
  }
  
  /** 
   * Method checks if request come from authorized server.
   * 
   * @param ipAdderess ip addres of server
   * @return true value indicate thet server is authorized, false indicates unauthorized request
   */
  private boolean isAuthorizedByIp(String ipAdderess){
    @SuppressWarnings("unchecked")
    List<DrupAuthServer> results = AppBean.getPersistenceManager().getEntitiesByName("DrupAuthServer");
    if(results == null || results.isEmpty()){
      return true;
    }

    Iterator<DrupAuthServer> resultsIt = results.iterator();
    if(resultsIt.hasNext()){
      if(resultsIt.next().getIpAddress().equals(ipAdderess)){
        return true;
      }
    }

    return false;
  }
  
  /** 
   * Method checks if request come from authorized server.
   * 
   * @param hostName host name of server
   * @return true value indicate thet server is authorized, false indicates unauthorized request
   */
  private boolean isAuthorizedByName(String hostName){
    @SuppressWarnings("unchecked")
    List<DrupAuthServer> results = AppBean.getPersistenceManager().getEntitiesByName("DrupAuthServer");
    if(results == null || results.isEmpty()){
      return true;
    }

    Iterator<DrupAuthServer> resultsIt = results.iterator();
    if(resultsIt.hasNext()){
      if(resultsIt.next().getHostName().equals(hostName)){
        return true;
      }
    }

    return false;
  }
}  // class DrupAuthServlet