source: cats/ISOcat/trunk/mod-ISOcat-control-access/control/credentials.js @ 2675

importPackage(Packages.com.Ostermiller.util);

importClass(Packages.org.ten60.netkernel.layer1.representation.MonoRepresentationImpl);
importClass(Packages.com.ten60.netkernel.urii.aspect.StringAspect);
importClass(Packages.org.ten60.netkernel.xml.representation.DOMXDAAspect);

//java.lang.System.out.println("DBG:credentials.js:welcome");

// get the current request
req = context.getThisRequest();

// create a subrequest out of the current request
subreq = context.createSubRequest();
subreq.setURI(req.getArgument("uri"));

cred = null;
shib = null;

// first try HTTP Basic authentication
if (req.argumentExists("Authorization")) {
    auth = req.getArgument("Authorization");
    auth = auth.replace("data:text/plain,","");
    auth = java.net.URLDecoder.decode(auth,"UTF-8");
    auth = auth.trim();
    if (auth.startsWith("Basic ")) {
        // the shibboleth token password can never come by BASIC authentication
        if (!auth.endsWith(":shib")) {
            auth = auth.replace("Basic ","");
            auth = Base64.decode(auth,"UTF-8");
            //java.lang.System.out.println("DBG:credentials.js:auth["+auth+"] with prefix");
            auth = ""+auth; // turn the Java string into a JS string
            auth = auth.replace(/^[^\:\-]+-/,'');
            //java.lang.System.out.println("DBG:credentials.js:auth["+auth+"] without prefix");
            cred = auth;
            subreq.addArgument("credentials","data:text/plain,"+java.net.URLEncoder.encode(cred,"UTF-8"));
        }
    }
}

// try Shibboleth EPPN authentication
if ((req.argumentExists("eduPersonPrincipalName"))) {
    var auth = req.getArgument("eduPersonPrincipalName");
    auth = auth.replace("data:text/plain,","");
    //java.lang.System.out.println("DBG:credentials.js:principal["+auth+"]");
    if (auth != "") {
        shib = auth;
    }
}

// if no principal yet, try Shibboleth EPTID authentication
if (shib == null) {
    if ((req.argumentExists("eduPersonTargetedID"))) {
        var auth = req.getArgument("eduPersonTargetedID");
        auth = auth.replace("data:text/plain,","");
        //java.lang.System.out.println("DBG:credentials.js:principal["+auth+"]");
        if (auth != "") {
            shib = auth;
        }
    }
}

// if no credentials and no principal yet, try Shibboleth security token authentication
if ((cred == null) && (shib == null)) {
    if (req.argumentExists("Authorization")) {
        auth = req.getArgument("Authorization");
        auth = auth.replace("data:text/plain,","");
        auth = java.net.URLDecoder.decode(auth,"UTF-8");
        auth = auth.trim();
        if (auth.startsWith("Bearer ")) {
            tok = auth.replace("Bearer ","");
            tok = ""+tok; // turn the Java string into a JS string
            tok = tok.replace(/^[^\:\-]+-/,'');
            //java.lang.System.out.println("DBG:credentials.js:token["+tok+"]");
            var tokreq = context.createSubRequest();
            tokreq.setURI("active:ISOcat.control.access.shib.check_token");
            tokreq.addArgument("token","data:text/plain,"+tok);
            tokreq.setAspectClass(DOMXDAAspect);
            tokres = context.issueSubRequest(tokreq);
            if (tokres != null) {
                //java.lang.System.out.println("DBG:credentials.js:tokres["+tokres.getAspects()+"]");
                if (tokres.hasAspect(DOMXDAAspect)) {
                    tokres = tokres.getAspect(DOMXDAAspect);
                    //java.lang.System.out.println("DBG:credentials.js:XDA["+tokres+"]");
                    if (tokres != null) {
                        tokres = tokres.getXDA();
                        if (tokres.isTrue("/string")) {
                            tokres =  tokres.getText("/string",true);
                            //java.lang.System.out.println("DBG:credentials.js:tokres["+tokres+"]");
                            if (tokres != "") {
                                shib = tokres;
                            }
                        }
                    }
                }
            }
        }
    }
}

//java.lang.System.out.println("DBG:credentials.js:principal["+shib+"]");
if (shib != null) {
    subreq.addArgument("principal","data:text/plain,"+java.net.URLEncoder.encode(shib,"UTF-8"));
}

// if no credentials but the principal is known, try to resolve principal to credentials 
if ((cred == null) && (shib != null)) {
    // request the credentials for the principal
    var credreq = context.createSubRequest();
    credreq.setURI("active:ISOcat.manage.access.shibboleth");
    credreq.addArgument("principal","data:text/plain,"+java.net.URLEncoder.encode(shib,"UTF-8"));
    credreq.setAspectClass(DOMXDAAspect);
    auth = context.issueSubRequest(credreq);
    if (auth != null) {
        //java.lang.System.out.println("DBG:credentials.js:cred["+auth.getAspects()+"]");
        if (auth.hasAspect(DOMXDAAspect)) {
            auth = auth.getAspect(DOMXDAAspect);
            //java.lang.System.out.println("DBG:credentials.js:XDA["+auth+"]");
            if (auth != null) {
                auth = auth.getXDA();
                if (auth.isTrue("/string")) {
                    auth =  auth.getText("/string",true);
                    //java.lang.System.out.println("DBG:credentials.js:auth["+auth+"]");
                    cred = auth;
                    subreq.addArgument("credentials","data:text/plain,"+java.net.URLEncoder.encode(cred,"UTF-8"));
                } //else
                    //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has no <string/> envelop");
            } //else
                //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has NULL DOMXDAAspect");
        } //else
            //java.lang.System.out.println("ERR:credentials.js:cred["+cred+"] has no DOMXDAAspect");
    } //else
        //java.lang.System.out.println("ERR:credentials.js:auth is NULL");
}

//java.lang.System.out.println("DBG:credentials.js:authorization credentials["+cred+"]");
//java.lang.System.out.println("DBG:credentials.js:shiboleth principal["+shib+"]");

for(iter = req.getArguments(); iter.hasNext(); ) {
    arg = iter.next();
    if (arg.equals("Authorization")) {
        continue;
    } else if (arg.equals("eduPersonPrincipalName")) {
        continue;
    } else if (arg.equals("eduPersonTargetedID")) {
        continue;
    } else if (arg.equals("principal")) {
        continue;
    } else if (arg.equals("uri")) {
        continue;
    } else if (arg.equals("operator")) {
        continue;
    } else {
        //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]");
        argURI = req.getArgument(arg);
        if (argURI != null) {
            //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"]");
            argValue = req.getArgumentValue(argURI);
            //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"]["+argValue+"]");
            if (argValue != null) {
                //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argValue+"] value");
                subreq.addArgument(arg,argValue);
            //} else if (argURI.startsWith("data:text/plain,")) {
            //    var val = java.net.URLEncoder.encode(argURI.replaceFirst("data:text/plain,",""),"UTF-8");
            //    val = val.replace("\+","%20");// we don't want + to escape spaces but %20, as + has a special meaning in an active URI
            //    java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"][data:text/plain,"+val+"] encoded URI");
            //    subreq.addArgument(arg,"data:text/plain,"+val);
            } else {
                //java.lang.System.out.println("DBG:credentials.js:arg["+arg+"]["+argURI+"] URI");
                subreq.addArgument(arg,argURI);
            }
        }// else
        //    java.lang.System.out.println("DBG:credentials.js:arg["+arg+"] null");
    }
}

reply = context.issueSubRequest(subreq);

//Create response, set metadata and exit
response = context.createResponseFrom(reply);

//java.lang.System.out.println("DBG:credentials.js:done");