package com.adfaspace.jay.app.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer;
import org.springframework.security.core.session.SessionRegistry;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.session.HttpSessionEventPublisher;

import com.adfaspace.jay.app.Application;
import com.adfaspace.jay.backend.data.LocalAuthority;
import com.adfaspace.jay.backend.service.UserService;
import com.atlassian.crowd.integration.http.CrowdHttpAuthenticatorImpl;
import com.atlassian.crowd.integration.http.util.CrowdHttpTokenHelper;
import com.atlassian.crowd.integration.http.util.CrowdHttpTokenHelperImpl;
import com.atlassian.crowd.integration.http.util.CrowdHttpValidationFactorExtractor;
import com.atlassian.crowd.integration.http.util.CrowdHttpValidationFactorExtractorImpl;
import com.atlassian.crowd.integration.rest.service.factory.RestCrowdClientFactory;
import com.atlassian.crowd.integration.springsecurity.RemoteCrowdAuthenticationProvider;
import com.atlassian.crowd.integration.springsecurity.user.CrowdUserDetailsServiceImpl;
import com.atlassian.crowd.service.client.ClientPropertiesImpl;
import com.atlassian.crowd.service.client.ClientResourceLocator;
import com.atlassian.crowd.service.client.CrowdClient;

@EnableWebSecurity
@Configuration
public class SecurityConfigCrowd extends WebSecurityConfigurerAdapter {
	
	private final RedirectAuthenticationSuccessHandler successHandler;
	
	@Autowired
	private UserService userService;
	
	/**
	 * Default constructor
	 */
	@Autowired
	public SecurityConfigCrowd(RedirectAuthenticationSuccessHandler successHandler) {
		this.successHandler = successHandler;
	}
	
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		auth.authenticationProvider(crowdAuthenticationProvider());
	}
	
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// Not using Spring CSRF here to be able to use plain HTML
		http.csrf().disable();
		
		ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry reg = http
				.authorizeRequests();

		// Allow access to static resources
		reg = reg.antMatchers("/static/**").permitAll();
		// Require authentication for all URLS ("/**")
		reg = reg.antMatchers("/**").authenticated();
		HttpSecurity sec = reg.and();

		// Allow access to login page without login
		FormLoginConfigurer<HttpSecurity> login = sec.formLogin().permitAll();
		login = login.loginPage(Application.LOGIN_URL).loginProcessingUrl(Application.LOGIN_PROCESSING_URL)
				.failureUrl(Application.LOGIN_FAILURE_URL).successHandler(successHandler);
		login.and().logout().logoutSuccessUrl(Application.LOGOUT_URL);
		
		// session management
		http.sessionManagement().maximumSessions(3).sessionRegistry(sessionRegistry());
	}
	
	@Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }

    @Bean
    public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
        return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
    }
    
    @Bean
    public ClientResourceLocator resourceLocator() {
        return new ClientResourceLocator("crowd.properties");
    }
    
    @Bean
    public ClientPropertiesImpl clientProperties() {
    	return ClientPropertiesImpl.newInstanceFromResourceLocator(resourceLocator());
    }
    
    @Bean
    public RestCrowdClientFactory crowdClientFactory() {
    	return new RestCrowdClientFactory();
    }
    
    @Bean
    public CrowdClient crowdClient() {
    	return crowdClientFactory().newInstance(clientProperties());
    }
    
    @Bean
    public CrowdHttpValidationFactorExtractor validationFactorExtractor() {
    	return CrowdHttpValidationFactorExtractorImpl.getInstance();
    }
    
    @Bean
    public CrowdHttpTokenHelper tokenHelper() {
    	return CrowdHttpTokenHelperImpl.getInstance(validationFactorExtractor());
    }
    
    @Bean
    public CrowdHttpAuthenticatorImpl crowdHttpAuthenticator() {
    	return new CrowdHttpAuthenticatorImpl(crowdClient(), clientProperties(), tokenHelper());
    }
    
    @Bean
    public CrowdUserDetailsServiceImpl crowdUserDetailsService() {
    	
    	 CrowdUserDetailsServiceImpl cuds = new CrowdUserDetailsServiceImpl();
    	 cuds.setCrowdClient(crowdClient());
    	 return cuds;
    }
    
	@Bean
	public RemoteCrowdAuthenticationProvider crowdAuthenticationProvider() {
		
		return new CrowdAuthenticationProviderExt(crowdClient(), crowdHttpAuthenticator(), crowdUserDetailsService(),
				userService);
	}
}

package com.adfaspace.jay.app.security;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;

import com.adfaspace.jay.backend.service.UserService;
import com.atlassian.crowd.embedded.api.User;
import com.atlassian.crowd.exception.ApplicationPermissionException;
import com.atlassian.crowd.exception.ExpiredCredentialException;
import com.atlassian.crowd.exception.InactiveAccountException;
import com.atlassian.crowd.exception.InvalidAuthenticationException;
import com.atlassian.crowd.exception.OperationFailedException;
import com.atlassian.crowd.exception.UserNotFoundException;
import com.atlassian.crowd.integration.http.CrowdHttpAuthenticator;
import com.atlassian.crowd.integration.springsecurity.RemoteCrowdAuthenticationProvider;
import com.atlassian.crowd.integration.springsecurity.user.CrowdUserDetailsService;
import com.atlassian.crowd.service.client.CrowdClient;

public class CrowdAuthenticationProviderExt extends RemoteCrowdAuthenticationProvider{
	
	private final UserService userService;
	
	public CrowdAuthenticationProviderExt(CrowdClient authenticationManager, CrowdHttpAuthenticator httpAuthenticator,
			CrowdUserDetailsService userDetailsService, UserService userService) {
		
		super(authenticationManager, httpAuthenticator, userDetailsService);
		
		this.userService = userService;
	}
	
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		
		String userName = authentication.getName();
		
		User crowdUser = null;
		
		try {
			crowdUser = authenticationManager.authenticateUser(userName, (String) authentication.getCredentials());
			
		} catch (Exception e) {
			
			System.out.println(e.getMessage());
			return null;
		}
		
		// init
		com.adfaspace.jay.backend.data.entity.User user = null;
		
		// check if have a persistent local user copy
		if (!userService.userWithNameExists(userName)) {
			// create local user for this crowd user
			user = userService.createUserFromCrowdUser(userName, false);
		} else {
			user = userService.findByName(userName, null);
		}
		
		// update transient-like properties and save user to user repo
		user = setTransientPropertiesAndSaveUser(crowdUser, user);
		
		// create token for spring
		UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(user,
				authentication.getCredentials(), userService.getAuthorities(user.getName()));
		
		return token;
	}
	
	/**
	 * Sets properties on local users that should be updated everytime a crowdUser logs in.
	 * @param crowdUser
	 * @param user
	 */
	private com.adfaspace.jay.backend.data.entity.User setTransientPropertiesAndSaveUser(User crowdUser, com.adfaspace.jay.backend.data.entity.User user) {
		
		user.setActive(crowdUser.isActive());
		user.setDirectoryId(crowdUser.getDirectoryId());
		
		// save changes
		return userService.save(user);
	}
}