/* * The contents of this file are subject to the Mozilla Public License * Version 1.1 (the "License"); you may not use this file except in * compliance with the License. You may obtain a copy of the License at * http://www.mozilla.org/MPL/ * * Software distributed under the License is distributed on an "AS IS" * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the * License for the specific language governing rights and limitations * under the License. * * The Original Code is available at http://www.abiquo.com/..... * * The Initial Developer of the Original Code is Soluciones Grid, S.L. (www.abiquo.com), * Consell de Cent 296, Principal 2�, 08007 Barcelona, Spain. * * No portions of the Code have been created by third parties. * All Rights Reserved. * * Contributor(s): ______________________________________. * * Graphical User Interface of this software may be used under the terms * of the Common Public Attribution License Version 1.0 (the "CPAL License", * available at http://cpal.abiquo.com/), in which case the * provisions of CPAL License are applicable instead of those above. In relation * of this portions of the Code, a Legal Notice according to Exhibits A and B of * CPAL Licence should be provided in any distribution of the corresponding Code * to Graphical User Interface. */ package com.abiquo.abiserver.business.authentication; import java.util.ArrayList; import java.util.Calendar; import java.util.Date; import org.hibernate.Session; import org.hibernate.Transaction; import org.hibernate.criterion.Order; import org.hibernate.criterion.Restrictions; import com.abiquo.abiserver.AbiConfiguration; import com.abiquo.abiserver.abicloudws.AbiCloudConstants; import com.abiquo.util.ErrorManager; import com.abiquo.util.resources.ResourceManager; import com.abiquo.abiserver.business.hibernate.pojohb.user.UserHB; import com.abiquo.abiserver.business.hibernate.util.HibernateUtil; import com.abiquo.abiserver.pojo.authentication.Login; import com.abiquo.abiserver.pojo.authentication.LoginResult; import com.abiquo.abiserver.pojo.authentication.UserSession; import com.abiquo.abiserver.pojo.result.BasicResult; import com.abiquo.abiserver.pojo.result.DataResult; import com.abiquo.abiserver.pojo.user.User; /** * This Authentication Manager provides authentication services, with a Data Base backend * * @author Oliver */ public class AuthenticationManagerDB implements IAuthenticationManager { private final AbiConfiguration abiConfig = AbiConfiguration.getAbiConfiguration(); private static final ResourceManager resourceManger = new ResourceManager(AuthenticationManagerDB.class); private final ErrorManager errorManager = ErrorManager.getInstance(AbiCloudConstants.ERROR_PREFIX); @SuppressWarnings("unchecked") public DataResult<LoginResult> doLogin(Login login) { DataResult<LoginResult> dataResult = new DataResult<LoginResult>(); Session session = null; Transaction transaction = null; try { session = HibernateUtil.getSession(); transaction = session.beginTransaction(); // Checking if a user exists for the given credentials (remeber to check that the user // is not deleted!) String customQuery = "SELECT * FROM user WHERE user='" + login.getUser() + "' AND MD5(password)='" + login.getPassword() + "' AND deleted = 0"; UserHB userHB = (UserHB) session.createSQLQuery(customQuery).addEntity(UserHB.class).uniqueResult(); if (userHB != null) { // User exists. Check if it is active if (userHB.getActive() == 1) { // User exists in database and is active. // Looking for all existing active sessions of this user, ordered by when were // created ArrayList<UserSession> oldUserSessions = (ArrayList<UserSession>) session.createCriteria(UserSession.class).add( Restrictions.eq("user", login.getUser())).addOrder(Order.desc("key")) .list(); Date currentTime = new Date(); // Get the maximum number of sessions - a value of 0 indicates no limit int maxNumSessions = this.abiConfig.getMaxNumSessions(); // We erase old expired sessions, or those that exceed the maximum number of // simultaneous active sessions // trying to keep the newer ones int currentActiveSessions = 0; for (UserSession existingSession : oldUserSessions) { if (currentTime.after(existingSession.getExpireDate())) session.delete(existingSession); else { currentActiveSessions++; if (maxNumSessions > 0 && currentActiveSessions >= maxNumSessions) session.delete(existingSession); } } // Creating the user session UserSession userSession = new UserSession(); userSession.setUser(userHB.getUser()); userSession.setKey(String.valueOf(Calendar.getInstance().getTimeInMillis())); userSession.setLocale(login.getLocale()); int sessionTimeout = this.abiConfig.getSessionTimeout(); long expireMilis = (new Date()).getTime() + sessionTimeout * 60 * 1000; Date expireDate = new Date(expireMilis); userSession.setExpireDate(expireDate); // Saving in Data Base the created User Session session.save(userSession); // Generating the login result, with the user who has logged in and his session LoginResult loginResult = new LoginResult(); loginResult.setSession(userSession); loginResult.setUser((User) userHB.toPojo()); // Generating the DataResult dataResult.setSuccess(true); dataResult.setMessage(AuthenticationManagerDB.resourceManger .getMessage("doLogin.success")); dataResult.setData(loginResult); /* * if(currentActiveSessions < maxNumSessions || maxNumSessions == 0) { } else { * //The maximum number of simultaneous sessions has been reached * this.errorManager.reportError(resourceManger, * dataResult,"doLogin.sessionExpired"); * dataResult.setResultCode(BasicResult.SESSION_MAX_NUM_REACHED); } */ } else { // User is not active. Generating the DataResult this.errorManager.reportError(resourceManger, dataResult, "doLogin.userInActive"); } } else { // User not exists in database or bad credentials. Generating the DataResult this.errorManager.reportError(resourceManger, dataResult, "doLogin.passwordUserIncorrect"); dataResult.setResultCode(BasicResult.USER_INVALID); } transaction.commit(); } catch (Exception e) { if (transaction != null && transaction.isActive()) transaction.rollback(); this.errorManager.reportError(resourceManger, dataResult, "doLogin.exception", e); } return dataResult; } public BasicResult doLogout(UserSession userSession) { BasicResult basicResult = new BasicResult(); Session session = null; Transaction transaction = null; try { session = HibernateUtil.getSession(); transaction = session.beginTransaction(); // Deleting the user session UserSession previousSession = (UserSession) session.createCriteria(UserSession.class).add( Restrictions.eq("user", userSession.getUser())).add( Restrictions.eq("key", userSession.getKey())).uniqueResult(); if (previousSession != null) session.delete(previousSession); basicResult.setSuccess(true); basicResult.setMessage(AuthenticationManagerDB.resourceManger .getMessage("doLogout.success")); transaction.commit(); } catch (Exception e) { if (transaction != null && transaction.isActive()) transaction.rollback(); this.errorManager.reportError(resourceManger, basicResult, "doLogout", e); } return basicResult; } public BasicResult checkSession(UserSession userSession) { BasicResult checkSessionResult = new BasicResult(); Session session = null; Transaction transaction = null; UserSession sessionToCheck = null; try { session = HibernateUtil.getSession(); transaction = session.beginTransaction(); sessionToCheck = (UserSession) HibernateUtil.getSession().createCriteria(UserSession.class).add( Restrictions.eq("user", userSession.getUser())).add( Restrictions.eq("key", userSession.getKey())).uniqueResult(); if (sessionToCheck == null) { // The session does not exist, so is not valid checkSessionResult.setResultCode(BasicResult.SESSION_INVALID); this.errorManager.reportError(resourceManger, checkSessionResult, "checkSession.invalid"); } else { // Checking if the session has expired Date currentDate = new Date(); if (currentDate.before(sessionToCheck.getExpireDate())) { // The session is valid updating the expire Date int sessionTimeout = this.abiConfig.getSessionTimeout(); long expireMilis = (new Date()).getTime() + sessionTimeout * 60 * 1000; Date expireDate = new Date(expireMilis); sessionToCheck.setExpireDate(expireDate); session.update(sessionToCheck); checkSessionResult.setSuccess(true); checkSessionResult.setMessage(AuthenticationManagerDB.resourceManger .getMessage("checkSession.success")); } else { // The session has time out. Deleting the session from Data Base session.delete(sessionToCheck); checkSessionResult.setResultCode(BasicResult.SESSION_TIMEOUT); this.errorManager.reportError(resourceManger, checkSessionResult, "checkSession.expired"); } } transaction.commit(); } catch (Exception e) { if (transaction != null && transaction.isActive()) transaction.rollback(); this.errorManager.reportError(resourceManger, checkSessionResult, "checkSession.exception", e); } return checkSessionResult; } public static void main(String[] args) { String username = "admin"; String password = com.abiquo.util.ToString.MD5("xabiquo"); Login login = new Login(); login.setUser(username); login.setPassword(password); AuthenticationManagerDB m = new AuthenticationManagerDB(); m.doLogin(login); } }