/**
    * Originally contributed by eMation (www.emation.pt)
    */
   package org.itracker.services.authentication.adsson;
   
   import java.io.IOException;
   import java.io.InputStream;
   import java.security.AccessControlException;
   import java.util.Properties;
  
  import javax.security.auth.Subject;
  import javax.security.auth.login.LoginContext;
  import javax.security.auth.login.LoginException;
  
  import org.apache.log4j.Logger;
  
  /**
   * Performs a kerberos authenticated search in AD
   *
   * @author ricardo
   */
  public class ADIntegration {
      
      private static final String AD_AUTH_PROPERTIES_FILE = "adauth.properties";
      private static final String PASSWORD = "password";
      private static final String USERNAME = "username";
      private static final String BASE_BRANCH = "basebranch";
      private static final String PROVIDER_URL = "url";
      
      private final Logger logger;
      private LoginContext lc = null;
      private Properties adAuth;
      
      public ADIntegration() throws IOException {
          this.logger = Logger.getLogger(getClass());
          adAuth = new Properties();
          InputStream is = getClass().getResourceAsStream( "/" + AD_AUTH_PROPERTIES_FILE);
          if( is == null) {
              String message = "Can't find " + AD_AUTH_PROPERTIES_FILE + " to get A.D. auth properties. This file should be in the root of your classpath or EAR file";
              logger.error( message );
              throw new IOException( message );
          }
          adAuth.load( is );
      }
      
      public void login() throws LoginException {
          try {
              // 1. Log in (to Kerberos)
              // The login context should be configured in login-config.xml
              lc = new LoginContext("Helpdesk", new SimpleCallbackHandler( getUsername(), getPassword() ) );
              // Attempt authentication
              // You might want to do this in a "for" loop to give
              // user more than one chance to enter correct username/password
              lc.login();
          } catch (IOException e) {
              throw new LoginException( e.getMessage() );
          }
      }
      
      public Object getUserInfo(String login) throws AccessControlException {
          // 2. Perform JNDI work as logged in subject
          Object userInfo = Subject.doAs(lc.getSubject(), new GetUserModelFromADPrivilegedAction( login, getBaseBranch(), getProviderUrl() ));
          
          if( userInfo == null ) {
              logger.error("Can't get info on " + login + " from A.D.");
              throw new AccessControlException("Can't get info on " + login + " from A.D.");
          }
          
          return( userInfo );
      }
      
      /**
       * @return
       */
      private String getProviderUrl() {
          return( adAuth.getProperty( PROVIDER_URL ) );
      }
      
      /**
       * @return
       */
      private String getPassword() throws IOException {
          return( adAuth.getProperty( PASSWORD ) );
      }
      
      /**
       * @return
       */
      private String getUsername() throws IOException {
          return( adAuth.getProperty( USERNAME ) );
      }
      
      /**
       * @return
       */
      private String getBaseBranch() {
          return( adAuth.getProperty( BASE_BRANCH ) );
      }
  }