001    /**
002     *  Licensed to the Apache Software Foundation (ASF) under one or more
003     *  contributor license agreements.  See the NOTICE file distributed with
004     *  this work for additional information regarding copyright ownership.
005     *  The ASF licenses this file to You under the Apache License, Version 2.0
006     *  (the "License"); you may not use this file except in compliance with
007     *  the License.  You may obtain a copy of the License at
008     *
009     *     http://www.apache.org/licenses/LICENSE-2.0
010     *
011     *  Unless required by applicable law or agreed to in writing, software
012     *  distributed under the License is distributed on an "AS IS" BASIS,
013     *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014     *  See the License for the specific language governing permissions and
015     *  limitations under the License.
016     */
017    
018    package org.apache.geronimo.connector.outbound;
019    
020    import javax.resource.ResourceException;
021    import javax.resource.spi.ApplicationServerInternalException;
022    import javax.security.auth.Subject;
023    
024    /**
025     * SubjectInterceptor.java This is installed only when the plan includes a container-managed-security element.
026     *
027     *
028     * Created: Mon Oct  6 14:31:56 2003
029     *
030     * @version $Rev: 559235 $ $Date: 2007-07-25 00:01:59 +0200 (Wed, 25 Jul 2007) $
031     */
032    public class SubjectInterceptor implements ConnectionInterceptor {
033    
034        private final ConnectionInterceptor next;
035        private final SubjectSource subjectSource;
036    
037        public SubjectInterceptor(final ConnectionInterceptor next, final SubjectSource subjectSource) {
038            this.next = next;
039            this.subjectSource = subjectSource;
040        }
041    
042        public void getConnection(ConnectionInfo connectionInfo) throws ResourceException {
043            Subject currentSubject = null;
044            if (!connectionInfo.isApplicationManagedSecurity()) {
045                try {
046                    currentSubject = subjectSource.getSubject();
047                } catch (SecurityException e) {
048                    throw new ResourceException("Can not obtain Subject for login", e);
049                }
050                if (currentSubject == null) {
051                    throw new ResourceException("No subject for container managed security");
052                }
053            }
054            ManagedConnectionInfo originalManagedConnectionInfo = connectionInfo.getManagedConnectionInfo();
055            //No existing managed connection, get an appropriate one and return.
056            if (originalManagedConnectionInfo.getManagedConnection() == null) {
057                originalManagedConnectionInfo.setSubject(currentSubject);
058                next.getConnection(connectionInfo);
059            } else {
060                Subject oldSubject = originalManagedConnectionInfo.getSubject();
061                if (currentSubject == null ? oldSubject != null : !currentSubject.equals(oldSubject)) {
062                    if (connectionInfo.isUnshareable()) {
063                        throw new ApplicationServerInternalException("Unshareable resource is attempting to change security context: expected request under: " + oldSubject + ", received request under: " + currentSubject);
064                    } else {
065                        //existing managed connection, wrong subject: must re-associate.
066                        //make a ConnectionInfo to process removing the handle from the old mc
067                        ConnectionInfo returningConnectionInfo = new ConnectionInfo();
068                        returningConnectionInfo.setManagedConnectionInfo(originalManagedConnectionInfo);
069                        //This should decrement handle count, but not close the handle, when returnConnection is called
070                        //I'm not sure how to test/assure this.
071                        returningConnectionInfo.setConnectionHandle(connectionInfo.getConnectionHandle());
072    
073                        //make a new ManagedConnectionInfo for the mc we will ask for
074                        ManagedConnectionInfo newManagedConnectionInfo =
075                                new ManagedConnectionInfo(
076                                        originalManagedConnectionInfo.getManagedConnectionFactory(),
077                                        originalManagedConnectionInfo.getConnectionRequestInfo());
078                        newManagedConnectionInfo.setSubject(currentSubject);
079                        connectionInfo.setManagedConnectionInfo(newManagedConnectionInfo);
080                        next.getConnection(connectionInfo);
081                        //process the removal of the handle from the previous mc
082                        returnConnection(returningConnectionInfo, ConnectionReturnAction.RETURN_HANDLE);
083                    }
084                } else {
085                    //otherwise, the current ManagedConnection matches the security info, we keep it.
086                    //set up the tx context
087                    next.getConnection(connectionInfo);
088                }
089            }
090        }
091    
092        public void returnConnection(
093                ConnectionInfo connectionInfo,
094                ConnectionReturnAction connectionReturnAction) {
095            next.returnConnection(connectionInfo, connectionReturnAction);
096        }
097    
098        public void destroy() {
099            next.destroy();
100        }
101    
102    }