# OsSsoAuthenticator.java

    /*
     ** Module   : OsSsoAuthenticator.java
     ** Abstract : SSO authenticator implementation which accepts OS credentials and maps them to a single FWD user.
     **
     ** Copyright (c) 2025, Golden Code Development Corporation.
     **
     ** -#- -I- --Date-- ---------------------------------Description---------------------------------
     ** 001 CA  20250221 Created initial version
     */
    /*
     ** This program is free software: you can redistribute it and/or modify
     ** it under the terms of the GNU Affero General Public License as
     ** published by the Free Software Foundation, either version 3 of the
     ** License, or (at your option) any later version.
     **
     ** This program is distributed in the hope that it will be useful,
     ** but WITHOUT ANY WARRANTY; without even the implied warranty of
     ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     ** GNU Affero General Public License for more details.
     **
     ** You may find a copy of the GNU Affero GPL version 3 at the following
     ** location: https://www.gnu.org/licenses/agpl-3.0.en.html
     **
     ** Additional terms under GNU Affero GPL version 3 section 7:
     **
     **   Under Section 7 of the GNU Affero GPL version 3, the following additional
     **   terms apply to the works covered under the License.  These additional terms
     **   are non-permissive additional terms allowed under Section 7 of the GNU
     **   Affero GPL version 3 and may not be removed by you.
     **
     **   0. Attribution Requirement.
     **
     **     You must preserve all legal notices or author attributions in the covered
     **     work or Appropriate Legal Notices displayed by works containing the covered
     **     work.  You may not remove from the covered work any author or developer
     **     credit already included within the covered work.
     **
     **   1. No License To Use Trademarks.
     **
     **     This license does not grant any license or rights to use the trademarks
     **     Golden Code, FWD, any Golden Code or FWD logo, or any other trademarks
     **     of Golden Code Development Corporation. You are not authorized to use the
     **     name Golden Code, FWD, or the names of any author or contributor, for
     **     publicity purposes without written authorization.
     **
     **   2. No Misrepresentation of Affiliation.
     **
     **     You may not represent yourself as Golden Code Development Corporation or FWD.
     **
     **     You may not represent yourself for publicity purposes as associated with
     **     Golden Code Development Corporation, FWD, or any author or contributor to
     **     the covered work, without written authorization.
     **
     **   3. No Misrepresentation of Source or Origin.
     **
     **     You may not represent the covered work as solely your work.  All modified
     **     versions of the covered work must be marked in a reasonable way to make it
     **     clear that the modified work is not originating from Golden Code Development
     **     Corporation or FWD.  All modified versions must contain the notices of
     **     attribution required in this license.
     */

    package com.goldencode.p2j.security;

    import com.goldencode.p2j.main.*;
    import com.goldencode.p2j.main.WebDriverHandler.SupportedHttpCode;
    import com.goldencode.p2j.util.*;

    import javax.servlet.http.*;

    import java.io.*;
    import java.util.*;

    /**
     * SSO authenticator hook, which accepts OS credentials, validates them, and returns both the FWD user and
     * OS user which will be used to spawn the FWD client.
     * <p>
     * This implementation uses the {@link #defaultFwdUser} configured {@link #setOption at the SSO plugin}, for
     * the FWD client's username.  More complex implementations can expand the plugin to resolve the FWD user
     * account which is associated with the OS user, or even create the FWD user account automatically (note that
     * this may also include ACLs).
     * <p>
     * Cookies are not used for this authenticator.
     */
    public class OsSsoAuthenticator
    implements SsoAuthenticator
    {
       /** The FWD user returned by default for all in-app users. */
       private String defaultFwdUser = null;

       /**
        * The FWD server creates a singleton of this plugin - read the config when is created, under the server
        * context.
        * <p>
        * Do not use driver type, as the Java class for the driver can't be initialized when the SSO plugin is
        * instantiated.
        */
       private final String spawner = ConfigItem.SPAWNER.read(null);

       /** The spawner folder. */
       private final File spawnerDir = new File(spawner).getAbsoluteFile().getParentFile();

       /**
        * Validates the POST request data against an authentication provider (DB, 3rd party directory, custom
        * auth server, etc) and returns a container with all details needed by the FWD framework to respond to
        * the auth request and eventually spawn a new client with the specified authorization. If the FWD SDK
        * script is used on the login page, the parameters map contains {@link #FWD_SDK_LOGIN_PARAM_USER} and
        * {@link #FWD_SDK_LOGIN_PARAM_PASS}.
        * <p>
        * This implementation authenticates the given credentials as OS credentials.  If it passes, return in the
        * result both the configured FWD user and the entered OS user/password.
        *
        * @param    paramMap
        *           A map of all query / form params.
        * @param    cookies
        *           All cookies coming with the HTTP request.
        * @param    licensingData
        *           Data that can be used for enforcing licensing policy.
        *
        * @return   A container with all details needed by the FWD framework to spawn a new client.
        */
       @Override
       public Result authenticate(Map<String, String[]> paramMap, Cookie[] cookies, LicensingData licensingData)
       {
          if (defaultFwdUser == null)
          {
             return new Result(false, SupportedHttpCode.UNEXPECTED_ERROR, null);
          }

          // cookies are not used

          String osUser = paramMap.get(FWD_SDK_LOGIN_PARAM_USER)[0];
          String osPass = paramMap.get(FWD_SDK_LOGIN_PARAM_PASS)[0];

          SupportedHttpCode error = checkUser(osUser, osPass);
          if (error != null)
          {
             return new Result(false, error, null);
          }

          Result result = new Result(true, defaultFwdUser, "storage-" + osUser, null, null);
          result.setOsUser(osUser);
          result.setOsPassword(osPass);
          result.setSessionDescription("Session for end user " + osUser);
          return result;
       }

       /**
        * Invalidates the web session associated with the authentication cookie by communicating with the auth
        * server or updating the DB and returns a cookie with the same name, but invalid value.
        * <p>
        * This implementation does not use cookies, so this is a no-op.
        *
        * @param    cookies
        *           The cookie to be returned to the browser and used in the next auth requests.
        *
        * @return   <code>null</code> if the web session / cookie invalidation failed, otherwise an
        *           authentication Cookie with invalid value.
        */
       @Override
       public Cookie logout(Cookie[] cookies)
       {
          // nothing to do, cookies are not used
          return null;
       }

       /**
        * Auto-login interface. Searches for a recognizable cookie to validate the session against an
        * authentication provider (DB, 3rd party directory, custom auth server, etc) and returns a container
        * with all details needed by the FWD framework to respond to the auth request and eventually spawn a
        * new client with the specified authorization. On failure,
        * {@link #authenticate(Map, Cookie[], LicensingData)} will be later called by the login page on form
        * submission.
        * <p>
        * This implementation does not use cookies, so this is a no-op.
        *
        * @param    cookies
        *           All cookies coming with the HTTP request for authentication.
        * @param    licensingData
        *           Data that can be used for enforcing licensing policy.
        *
        * @return   A container with all details needed by the FWD framework to spawn a new client.
        */
       @Override
       public Result authenticate(Cookie[] cookies, LicensingData licensingData)
       {
          // this needs to check the cookie value against some storage to validate it, but they are not used
          return null;
       }

       /**
        * Returns the name of the cookie used for auto-login. Enables the framework to do validation of the
        * cookies present in the request and determine if auto-login is possible. If <code>null</code> is
        * returned, that indicates the auto-login function is disabled.
        *
        * @return   The name of the cookie used for auto-login.
        *           This implementation does not use cookies, so <code>null</code> is returned.
        */
       @Override
       public String getAuthCookieName()
       {
          return null;
       }

       /**
        * Provides options configured in directory under config/auth-mode/ssopluginoption. Plain text that can
        * contain any number of configs to be parsed by the custom implementation of the authenticator. The
        * method is called right after the current object is instantiated, before any authentication takes place.
        *
        * @param    option
        *           The {@link #defaultFwdUser FWD user name} which will be used by the FWD client.
        */
       @Override
       public void setOption(String option)
       {
          this.defaultFwdUser = option;
       }

       /**
        * Receives as an argument the html template loaded from the standard location in the custom package or
        * null if no resource present.
        *
        * @param    loadedTemplate
        *           The html template loaded from the standard location in the custom root package or null.
        *
        * @return   The inflated template ready to be served as login page.
        *           This implementation returns <code>null</code>, to use the default template.
        */
       @Override
       public String getLoginPage(String loadedTemplate)
       {
          return null;
       }

       /**
        * Check the specified credentials if are valid as OS user/password.
        *
        * @param    user
        *           The OS username.
        * @param    pw
        *           The OS password.
        *
        * @return   <code>null</code> in case of success, an error code otherwise.
        */
       private SupportedHttpCode checkUser(String user, String pw)
       {
          ProcessBuilder pb = new ProcessBuilder();
          pb.directory(spawnerDir);
          pb.command(new ArrayList<String>(Arrays.asList(spawner, ClientSpawner.MODE_CREDENTIALS_CHECK, user)));
          try
          {
             Process shell = pb.start();
             // write password
             OutputStreamWriter os = new OutputStreamWriter(shell.getOutputStream());
             os.write(pw);
             os.close();
             shell.waitFor();
             int exitCode = shell.exitValue();
             return exitCode == 0 ? null : SupportedHttpCode.UNAUTHORIZED;
          }
          catch (Throwable t)
          {
             return SupportedHttpCode.UNEXPECTED_ERROR;
          }
       }
    }