forked from SuperAmerica/agilefant
-
Notifications
You must be signed in to change notification settings - Fork 0
/
SecurityUtil.java
151 lines (124 loc) · 4.85 KB
/
SecurityUtil.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
package fi.hut.soberit.agilefant.security;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import org.hibernate.Session;
import org.hibernate.SessionFactory;
import org.springframework.security.Authentication;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
import fi.hut.soberit.agilefant.db.hibernate.UserDAOHibernate;
import fi.hut.soberit.agilefant.model.User;
import fi.hut.soberit.agilefant.web.RefreshUserInterceptor;
/**
* Some security-related utilities.
*
* @author Turkka Äijälä
*/
public class SecurityUtil {
/** A thread local variable to save the user object in during the request. */
private static ThreadLocal<User> threadLocalUser = new ThreadLocal<User>() {
protected synchronized User initialValue() {
return null;
}
};
private SecurityUtil() {
}
/**
* Get id for the currently logged user. It's always valid to call this, as
* opposed to setLoggedUser, which is valid only during a web request.
*
* @return logged user id
* @throws IllegalStateException
* when there's no user logged
*/
public static int getLoggedUserId() throws IllegalStateException {
if (SecurityContextHolder.getContext().getAuthentication() == null)
throw new IllegalStateException("no logged user");
try{
AgilefantUserDetails ud = (AgilefantUserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
if (ud == null)
throw new IllegalStateException("no logged user");
return ud.getUserId();
} catch(ClassCastException cce){
//log in read only user
SessionFactory sessionFactory = null;
UserDAOHibernate userDao = new UserDAOHibernate();
try {
sessionFactory = (SessionFactory) new InitialContext().lookup("hibernateSessionFactory");
userDao.setSessionFactory(sessionFactory);
} catch (NamingException e) {
e.printStackTrace();
}
Session session = sessionFactory.openSession();
User user = userDao.getByLoginName("readonly");
session.disconnect();
session.close();
return user.getId();
}
}
/**
* Set the currently logged-in user (for the current thread/request).
* <p>
* The purpose is to store the user-object during a single WWW-request. This
* is achieved by saving the object in a thread local variable. (is this
* ok/valid?)
* <p>
* You shouldn't normally call this function.
*
* @see RefreshUserInterceptor
* @see getLoggedUser
* @param user
* currently logged user
*/
public static void setLoggedUser(User user) {
threadLocalUser.set(user);
}
/**
* Get currently logged-in user (for the current thread/request) as set by
* setLoggedUser.
* <p>
* <b>Currently only valid for struts-stuff.</b> ... since
* RefreshUserInterceptor ensures proper user is set.
*
* @see RefreshUserInterceptor
* @see setLoggedUser
* @return User object for the user who's logged in, or null if no user.
*/
public static User getLoggedUser() {
return threadLocalUser.get();
}
/**
* Calculate MD5 hash from a string.
*
* @param text
* string to calculate hash from
* @return MD5 hash
*/
public static String MD5(String text) {
byte[] bytes = text.getBytes();
try {
MessageDigest algorithm = MessageDigest.getInstance("MD5");
algorithm.reset();
algorithm.update(bytes);
byte messageDigest[] = algorithm.digest();
StringBuffer hex = new StringBuffer();
for (int i = 0; i < messageDigest.length; i++) {
if ((messageDigest[i] & 0xff) < 16)
hex.append('0');
hex.append(Integer.toHexString(messageDigest[i] & 0xff));
}
return hex.toString();
} catch (NoSuchAlgorithmException nsae) {
return null;
}
}
public static void logoutCurrentUser() {
SecurityContext context = SecurityContextHolder.getContext();
if (context == null) return;
Authentication authentication = context.getAuthentication();
if (authentication == null) return;
authentication.setAuthenticated(false);
}
}