httpSession.setAttribute(SpagoBIConstants.BACK_URL, backUrl);
}
errorHandler = getErrorHandler();
UserProfile previousProfile = (UserProfile) permSess.getAttribute(IEngUserProfile.ENG_USER_PROFILE);
String userId=null;
if (!activeSoo) {
userId = (String)request.getAttribute("userID");
logger.debug("userID="+userId);
if (userId == null) {
if (previousProfile != null) {
profile = previousProfile;
// user is authenticated, nothing to do
logger.debug("User is authenticated");
// fill response
MenuUtilities.getMenuItems(request, response, profile);
// set publisher name
response.setAttribute(SpagoBIConstants.PUBLISHER_NAME, "userhome");
return;
} else {
// user must authenticate
logger.debug("User must authenticate");
String url = servletRequest.getProtocol().substring(0,servletRequest.getProtocol().indexOf("/")) +
"://"+servletRequest.getServerName()+":"+servletRequest.getLocalPort()+servletRequest.getContextPath();
response.setAttribute("start_url", url);
response.setAttribute(SpagoBIConstants.PUBLISHER_NAME, "login");
logger.debug("OUT");
return;
}
//logger.error("User identifier not found. Cannot build user profile object");
//throw new SecurityException("User identifier not found.");
}
} else {
SsoServiceInterface userProxy = SsoServiceFactory.createProxyService();
userId = userProxy.readUserIdentifier(servletRequest);
logger.debug("OUT,userId:"+userId);
// if we are in SSO and user has a previous profile keep it!
if (previousProfile != null && previousProfile.getUserId().equals(userId)) {
if (previousProfile != null) {
profile = previousProfile;
// user is authenticated, nothing to do
logger.debug("User is authenticated");
// fill response
MenuUtilities.getMenuItems(request, response, profile);
// set publisher name
response.setAttribute(SpagoBIConstants.PUBLISHER_NAME, "userhome");
return;
}
}
}
ISecurityServiceSupplier supplier=SecurityServiceSupplierFactory.createISecurityServiceSupplier();
// If SSO is not active, check username and password, i.e. performs the authentication;
// instead, if SSO is active, the authentication mechanism is provided by the SSO itself, so SpagoBI does not make
// any authentication, just creates the user profile object and puts it into Spago permanent container
if (!activeSoo) {
String pwd=(String)request.getAttribute("password");
try {
Object ris=supplier.checkAuthentication(userId, pwd);
if (ris==null){
logger.error("pwd uncorrect");
EMFUserError emfu = new EMFUserError(EMFErrorSeverity.ERROR, 501);
errorHandler.addError(emfu);
return;
}
} catch (Exception e) {
logger.error("Reading user information... ERROR");
throw new SecurityException("Reading user information... ERROR",e);
}
//getting security type: if it's internal (SpagoBI) active pwd management and checks
boolean isInternalSecurity = ("true".equalsIgnoreCase((String)request.getAttribute("isInternalSecurity")))?true:false;
logger.debug("isInternalSecurity: " + isInternalSecurity);
if (isInternalSecurity) {
//gets the user bo
ISbiUserDAO userDao = DAOFactory.getSbiUserDAO();
SbiUser user = userDao.loadSbiUserByUserId(userId);
//check user's role: if he's admin it doesn't apply checks on password
String strAdminPatter = SingletonConfig.getInstance().getConfigValue("SPAGOBI.SECURITY.ROLE-TYPE-PATTERNS.ADMIN-PATTERN");
int sbiUserId=-1;
if (user!=null)sbiUserId=user.getId();
List lstRoles = userDao.loadSbiUserRolesById(sbiUserId);
boolean isAdminUser = false;
for (int i=0; i<lstRoles.size(); i++){
SbiExtRoles tmpRole = (SbiExtRoles)lstRoles.get(i);
Role role = DAOFactory.getRoleDAO().loadByID(tmpRole.getExtRoleId());
if (role.getName().equals(strAdminPatter)){
isAdminUser = true;
logger.debug("User is administrator. Checks on the password are not applied !");
break;
}
}
if (!isAdminUser){
//check validation of the password
logger.debug("Validation password starting...");
boolean goToChangePwd = checkPwd(user);
if (goToChangePwd){
response.setAttribute("user_id", user.getUserId());
String url = servletRequest.getProtocol().substring(0,servletRequest.getProtocol().indexOf("/")) +
"://"+servletRequest.getServerName()+":"+servletRequest.getLocalPort()+servletRequest.getContextPath();
response.setAttribute("start_url", url);
response.setAttribute(SpagoBIConstants.PUBLISHER_NAME, "ChangePwdPublisher");
return;
}
logger.info("The pwd is active!");
//update lastAccessDate on db with current date
try{
if (user!=null){
user.setDtLastAccess(new Date());
userDao.updateSbiUser(user, user.getId());
}
}catch(Exception e){
logger.error("Error while update user's dtLastAccess: " + e);
}
}
}
}
try {
profile=UserUtilities.getUserProfile(userId);
if (profile == null){
logger.error("user not created");
EMFUserError emfu = new EMFUserError(EMFErrorSeverity.ERROR, 501);
errorHandler.addError(emfu);
return;
}
Boolean userHasChanged = Boolean.TRUE;
// try to find if the user has changed: if so, the session parameters must be reset, see also homebis.jsp
// check previous userId with current one: if they are equals, user has not changed
if (previousProfile != null && previousProfile.getUserId().equals(((UserProfile)profile).getUserId())) {
userHasChanged = Boolean.FALSE;
}
response.setAttribute("USER_HAS_CHANGED", userHasChanged);
// put user profile into session
permSess.setAttribute(IEngUserProfile.ENG_USER_PROFILE, profile);