* (c) 2001 - 2014 OpenPlans

* This code is licensed under the GPL 2.0 license, available at the root

* application directory.

*/

* Top level singleton/facade/dao for the security authentication/authorization subsystem. 

*

*

* @author Justin Deoliveira, OpenGeo

*

*/

    ApplicationListener, ResourceStore {

    static Logger LOGGER = Logging.getLogger("org.geoserver.security");

    /** default config file name */

    public static final String CONFIG_FILENAME = "config.xml";

    /** master password config file name */

    public static final String MASTER_PASSWD_CONFIG_FILENAME = "masterpw.xml";

   

    /** master password info file name */

    public static final String MASTER_PASSWD_INFO_FILENAME = "masterpw.info";

    /** master password digest file name */

    public static final String MASTER_PASSWD_DIGEST_FILENAME = "masterpw.digest";

   

    /** default master password */

    public static final char[] MASTER_PASSWD_DEFAULT= "geoserver".toCharArray();

    /** data directory file system access */

    GeoServerDataDirectory dataDir;

    /** app context for loading plugins */

    ApplicationContext appContext;

    /** the active role service */

    GeoServerRoleService activeRoleService;

    /** configured authentication providers */

    List<GeoServerAuthenticationProvider> authProviders;

    /** current security config */

    SecurityManagerConfig securityConfig = new SecurityManagerConfig();

    /** current master password config */

    MasterPasswordConfig masterPasswordConfig = new MasterPasswordConfig();

    /** digested master password */

    volatile String masterPasswdDigest;

    /** cached user groups */

    ConcurrentHashMap<String, GeoServerUserGroupService> userGroupServices =

        new ConcurrentHashMap<String, GeoServerUserGroupService>();

    /** cached role services */

    ConcurrentHashMap<String, GeoServerRoleService> roleServices =

        new ConcurrentHashMap<String, GeoServerRoleService>();

   

    /** cached password validators services */

    ConcurrentHashMap<String, PasswordValidator> passwordValidators =

        new ConcurrentHashMap<String, PasswordValidator>();

    /** some helper instances for storing/loading service config */

    RoleServiceHelper roleServiceHelper = new RoleServiceHelper();

    UserGroupServiceHelper userGroupServiceHelper = new UserGroupServiceHelper();

    AuthProviderHelper authProviderHelper = new AuthProviderHelper();

    FilterHelper filterHelper = new FilterHelper();

    PasswordValidatorHelper  passwordValidatorHelper = new PasswordValidatorHelper();

    MasterPasswordProviderHelper masterPasswordProviderHelper = new MasterPasswordProviderHelper();

    /** helper for encrypting store configuration parameters */

    ConfigurationPasswordEncryptionHelper configPasswordEncryptionHelper;

    /**

     * listeners

     */

    List<SecurityManagerListener> listeners = new ArrayList<SecurityManagerListener>();

   

    /** cached flag determining is strong cryptography is available */

    Boolean strongEncryptionAvaialble;

   

    /** flag set once the security manager has been fully initialized */

    boolean initialized = false;

    /** keystore provider, loaded lazily */

    volatile KeyStoreProvider keyStoreProvider;

    /** generator of random passwords */

    RandomPasswordProvider randomPasswdProvider = new RandomPasswordProvider();

    /** authentication cache */

    volatile AuthenticationCache authCache;

    /** rememmber me service */

    volatile RememberMeServices rememberMeService;

    public static final String REALM="GeoServer Realm";

   

    public GeoServerSecurityManager(GeoServerDataDirectory dataDir) throws Exception {

        this.dataDir = dataDir;

        setEraseCredentialsAfterAuthentication(true);

        /*

         * JD we have to ensure that the master password is initialized first thing, before the

         * catalog since we need to decrypt configuration the passwords, the rest of the security

         * initializes occurs at the end of startup 

         */

        Resource masterpw = security().get( MASTER_PASSWD_CONFIG_FILENAME);       

        if (masterpw.getType() == Type.RESOURCE) {

            init(loadMasterPasswordConfig());

        }

        else {

            //if it doesn't exist this must be a migration startup... and this case should be

            // handled during migration where all the datastore passwords are processed

            // explicitly

        }

       

        configPasswordEncryptionHelper = new ConfigurationPasswordEncryptionHelper(this);

    }

    public Catalog getCatalog() {

        //have to look this up dynamically on demand on avoid circular dependency on application

        // context startup

        return (Catalog) GeoServerExtensions.bean("catalog");

    }

    public ConfigurationPasswordEncryptionHelper getConfigPasswordEncryptionHelper() {

        return configPasswordEncryptionHelper;

    }

    @Override