Announcement

**atomatom** · 3 Jun 2011, 07:53

I had to extend IDACall and return the login marker code myself.

I'm not sure if this is best practice. But I also do other things like set AppEngine namespaces and other stuff in my extended IDACall class.

**zdary** · 3 Jun 2011, 10:06

I'd say that this is a framework bug since
event.getResponse().getStatus() is -1 while event.getResponse().getHttpResponseCode() is 200.

It means HTTP status OK and response status FAILED.
HttpResponseCode needs to be set to 401 - Unauthorized.

**Isomorphic** · 3 Jun 2011, 10:11

No, this is a configuration error. You should not be allowing this operation to be called at all until the user has authenticated.

**zdary** · 16 Jun 2011, 23:48

Atomatom: Can you send me an example of your extended IDAcall, please?

I no longer allow user to call DS before they authenticate. Pro problem persist when a session expires. For example, the same login gets used on a different computer or it just times out.

In those cases I need to show a login screen and since LoginRequiredCallback doesn't register anything I have no chance to controll further actions.

Cheers,
Zdary

**atomatom** · 17 Jun 2011, 04:19

This took me quite a bit of time to develop, so I hope it saves you some. :) Likewise, if you see any issues with it, I would be grateful if you point them out.

The code runs on AppEngine - so in addition to setting user access, it also sets namespaces. There is a check for JXPath which crashes on AppEngine unless you set the property as below.

Somewhere in there you'll see the loginRequired code. Since users need to login, they are allowed to check certain datasources (like check to see if their login details match in the userAccount datasource).

Code:

import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import java.util.Map;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang.time.DurationFormatUtils;
import org.apache.commons.lang.time.StopWatch;

import com.google.appengine.api.NamespaceManager;
import com.isomorphic.datasource.DSRequest;
import com.isomorphic.datasource.DSResponse;
import com.isomorphic.rpc.RPCManager;
import com.isomorphic.rpc.RPCRequest;
import com.isomorphic.rpc.RPCResponse;
import com.isomorphic.servlet.IDACall;
import com.isomorphic.servlet.RequestContext;

public class SecureIDACall extends IDACall {
	@Override
	public void init() throws ServletException {
		super.init();
		checkJXPathKey();
	}

	private void checkJXPathKey() {
		try {
			String key = "org.apache.commons.jxpath.JXPathContextFactory";
			String value = System.getProperty(key);
			if (value == null)
				System.setProperty(key,
						"org.apache.commons.jxpath.ri.JXPathContextFactoryReferenceImpl");
		} catch (Exception e) {
			e.printStackTrace();
		}
	}

	private static final long serialVersionUID = 1410730002634700876L;
	Service service;
	private long totalTime = 0;
	private long timeStarted = System.currentTimeMillis();
	private Boolean loginRequired;

	public void processRequest(HttpServletRequest request,
			HttpServletResponse response) throws ServletException, IOException {
		StopWatch timer = new StopWatch();
		timer.start();
		try {
			HttpSession session = request.getSession();

			UserAccount userAccount = getService().getUserService()
					.getUserAccount(session);

			boolean isAuthenticated = userAccount != null;
			String roles;
			if (!isAuthenticated) {
				roles = "unregistered";
			} else {
				List<String> userRolesList = userAccount.getRoles();
				if (userRolesList == null)
					roles = ".";
				else
					roles = StringUtils.join(userRolesList, ",");
				NamespaceManager.set(userAccount.getNamespace());
			}

			if (roles != null) {
				try {
					RequestContext context = RequestContext.instance(this,
							request, response);
					RPCManager rpc = new RPCManager(request, response);
					rpc.setAuthenticated(isAuthenticated);
					rpc.setUserRoles(roles);

					StringBuffer buff = new StringBuffer();
					buff.append(request.getRemoteAddr() + " ");

					List requests = rpc.getRequests();
					for (Object r : requests) {
						buff.append("Request is a "
								+ r.getClass().getSimpleName() + " for ");
						if (r instanceof RPCRequest) {
							Object data = ((RPCRequest) r).getData();
							buff.append(data);
						} else if (r instanceof DSRequest) {
							DSRequest dsRequest = (DSRequest) r;
							buff.append(dsRequest.getDataSourceName());
						} else {
						}
					}

					NotifyService.notifyAdminAccess(userAccount,
							buff.toString());
					processRPCTransaction(rpc, context);
				} catch (Throwable e) {
					e.printStackTrace();
					handleError(response, e);
				}
			} else {
				super.processRequest(request, response);
			}

			if (loginRequired != null && loginRequired) {
				response.getWriter().append(Constants.loginRequiredResponse);
				loginRequired = null;
			}
		} catch (Exception e) {
			e.printStackTrace();
			handleError(response, e);
		}

		totalTime += timer.getTime();
		System.out.println("Last  Time : " + timer.toString());
		System.out.println("Total Time : "
				+ DurationFormatUtils.formatDurationHMS(totalTime));
		System.out.println("Alive Time : "
				+ DurationFormatUtils.formatDurationHMS(System
						.currentTimeMillis() - timeStarted));
	}

	public Service getService() {
		if (service == null)
			service = new Service();
		return service;
	}

	@Override
	public RPCResponse handleRPCRequest(RPCRequest rpcRequest, RPCManager rpc,
			RequestContext context) throws Exception {
		
		return super.handleRPCRequest(rpcRequest, rpc, context);
	}

	@Override
	public DSResponse handleDSRequest(DSRequest dsRequest, RPCManager rpc,
			RequestContext context) throws Exception {
		Map<String, Object> dsconfig = dsRequest.getDataSource().getConfig();
		Object globalProperty = dsconfig.get("globalNameSpace");
		boolean isGlobal = globalProperty != null
				&& ((String) globalProperty).toLowerCase().equals("true");
		if (!isGlobal) {
			UserAccount userAccount = getService().getUserService()
					.getUserAccount(
							dsRequest.getHttpServletRequest().getSession());

			if (userAccount == null) {
				System.out
						.println("Tried to access datasource but not logged in");
				loginRequired = true;
				return createReloginResponse(dsRequest);
			} else
				NamespaceManager.set(userAccount.getNamespace());
		} else {
			System.out
					.println("global NS for " + dsRequest.getDataSourceName());
			NamespaceManager.set(Constants.globalNamespace);
		}

		System.out.println("\n\n\nExecuting request: dataSource="
				+ dsRequest.getDataSourceName() + " operation="
				+ dsRequest.getOperation() + " operationId="
				+ dsRequest.getOperationId() + " with namespace "
				+ NamespaceManager.get());

		try {
			DSResponse handleDSRequest = super.handleDSRequest(dsRequest, rpc,
					context);
			return handleDSRequest;

		} catch (NotSignedInException e) {
			System.out.println("Tried to access datasource but not logged in");
			loginRequired = true;
			return createReloginResponse(dsRequest);
		}
	}

	private DSResponse createReloginResponse(DSRequest dsRequest)
			throws Exception {
		DSResponse dSResponse = new DSResponse(dsRequest.getDataSource());
		dSResponse.setStatus(DSResponse.STATUS_LOGIN_REQUIRED);
		return dSResponse;
	}

}

**zdary** · 20 Jun 2011, 01:18

Hi,

Atomatom: thank you very much.

Isomorphic:

Originally posted by Isomorphic

No, this is a configuration error. You should not be allowing this operation to be called at all until the user has authenticated.

What about a situation when the session expires? I'll receive the same error and the LoginRequiredCallback will not trigger...

cheers,
Zdary

**atomatom** · 20 Jun 2011, 07:21

Zdary: for what it's worth, I handle session stuff in

Code:

UserAccount userAccount = getService().getUserService()
					.getUserAccount(session);

If the session is expired or not logged in, I just return null. (which makes the SecureIDA class return the not logged in marker, which prompts the user to login again)

**zdary** · 20 Jun 2011, 09:56

Hi,
yes I know. I took the logic out of your class and make it as follow:

Code:

package cz.bcom.smartrise.server.authentication;

import org.springframework.security.core.context.SecurityContextHolder;

import com.isomorphic.datasource.DSRequest;
import com.isomorphic.datasource.DSResponse;
import com.isomorphic.rpc.RPCManager;
import com.isomorphic.servlet.IDACall;
import com.isomorphic.servlet.RequestContext;

public class IDACall4Spring extends IDACall {
	private static final long serialVersionUID = 516231357196292820L;

	public IDACall4Spring() {
		super();
	}

	@Override
	public DSResponse handleDSRequest(DSRequest dsRequest, RPCManager rpcManager, RequestContext requestContext) throws Exception {
		if (SecurityContextHolder.getContext() == null || SecurityContextHolder.getContext().getAuthentication() == null) {
			DSResponse dSResponse = new DSResponse(dsRequest.getDataSource());
			dSResponse.setStatus(DSResponse.STATUS_LOGIN_REQUIRED);
			return dSResponse;
		}
		return super.handleDSRequest(dsRequest, rpcManager, requestContext);
	}
}

I just think that Isomorphic should either fix javadoc for RPCManager and explain when the LoginRequiredCallback works since it is not in all cases or fix this situation.

Atomatom thank you for you work. It saved me time.

Cheers,
Zdary

Announcement

RPCManager.setLoginRequiredCallback

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment