/**
    * Originally contributed by eMation (www.emation.pt)
    */
   package org.itracker.services.authentication.adsson;
   
   import java.rmi.RemoteException;
   import java.util.Date;
   
   import javax.servlet.http.HttpServletRequest;
  
  import org.apache.log4j.Logger;
  import org.itracker.model.User;
  import org.itracker.model.UserPreferences;
  import org.itracker.services.UserService;
  import org.itracker.services.authentication.DefaultAuthenticator;
  import org.itracker.services.exceptions.AuthenticatorException;
  import org.itracker.services.exceptions.UserException;
  import org.itracker.services.util.UserUtilities;
  
  
  /**
   * Single Sign On class with Windows
   * 
   * Gets an authentication from jcifs web filter, gets user information from
   * active directory, creates or updates the user with that information if needed
   * 
   * @author Ricardo Trindade (ricardo.trindade@emation.pt)
   */
  public abstract class WindowsSSONAuthenticator extends DefaultAuthenticator {
  
  	private static final Logger logger = Logger.getLogger(WindowsSSONAuthenticator.class);
  	
      private static String TEMPLATE_USER = "TemplateUser";
  
      /**
       * @see org.itracker.ejb.authentication.AbstractPluggableAuthenticator#checkLogin(java.lang.String,
       *      java.lang.Object, int, int)
       */
      public User checkLogin(String login, Object authentication, int authType, int reqSource)
              throws AuthenticatorException {
          User userModel;
          try {
              // this authenticator only handles authType=AUTH_TYPE_REQUEST
              // (HttpServletRequest)
              if (authType != AUTH_TYPE_REQUEST || !(authentication instanceof HttpServletRequest)) {
                  logger.error("Only http request authentication supported by this single sign on class. Received "
                          + authType);
                  throw new AuthenticatorException(
                          "Only http request authentication supported by this single sign on class",
                          AuthenticatorException.INVALID_AUTHENTICATION_TYPE);
              }
              UserService userService = getUserService();
              // validate we're really using jcifs, and we
              // have a valid authentication object
              // TODO: get user from jcifs
              String theLogin = ((HttpServletRequest) authentication).getRemoteUser();
  
              if (theLogin == null) {
                  throw new AuthenticatorException("User obtained from jcifs is null. Check that jcifs is active",
                          AuthenticatorException.CUSTOM_ERROR);
              }
  
              // sometimes jcifs sends the username in the form of DOMAIN\USER
              if (theLogin.indexOf("\\") > 0) {
              	theLogin = theLogin.substring(theLogin.indexOf("\\") + 1);
              }
              if (!theLogin.equals(login)) {
              	// should an exception be thrown here?
              	AuthenticatorException ex = new AuthenticatorException("User obtained from authenticator does not match, got " + theLogin + ", expected " + login + ".",
                          AuthenticatorException.CUSTOM_ERROR); 
              	logger.warn("checkLogin: checking login for " + login + " but got " + theLogin + " in authentication " + authentication, ex);
                  throw ex;
              }
  
              userModel = updateOrCreateUser(theLogin, userService);
              return userModel;
          } catch (RemoteException ex) {
              logger.error("pt_PT", ex);
              throw new AuthenticatorException(ex.getMessage(), AuthenticatorException.SYSTEM_ERROR, ex);
          } catch (UserException ex) {
              logger.error("pt_PT", ex);
              throw new AuthenticatorException(ex.getMessage(), AuthenticatorException.SYSTEM_ERROR, ex);
          } catch (AuthenticatorException ex) {
              logger.error("pt_PT", ex);
              throw new AuthenticatorException(ex.getMessage(), AuthenticatorException.SYSTEM_ERROR, ex);
          }
      }
  
      /**
       * Checks if the user needs creating or updating, and if so, do it
       * 
       * @param login
       * @param userService
       * @return
       * @throws RemoteException
       * @throws UserException
       */
      private User updateOrCreateUser(String login, UserService userService) throws RemoteException, UserException,
              AuthenticatorException {
         User userModel;
         // check if the user already exists in ITracker
         // if he already exists, and needs updating, update him
         // if not, create him
         userModel = userService.getUserByLogin(login);
         if (null == userModel) {
             userModel = createUser(login, userService);
         } else {
             // user exists, update if needed
             // get user info from authentication source
             if (needsUpdate(userModel, getExternalUserInfo(login))) {
                 // update user here...
                 // userService.updateUser();
                 // get updated version
                 userModel = userService.getUserByLogin(login);
                 userModel = updateUser(userModel, getExternalUserInfo(login));
                 userService.updateUser(userModel);
             }
         }
         return userModel;
     }
 
     /**
      * Updates parts of profile that are obtained from external source
      * 
      * @param model
      * @return
      */
     private User updateUser(User oldUserModel, User newUserModel) {
         oldUserModel.setEmail(newUserModel.getEmail());
         oldUserModel.setFirstName(newUserModel.getFirstName());
         oldUserModel.setLastName(newUserModel.getLastName());
         oldUserModel.setLastModifiedDate(new Date());
         oldUserModel.setSuperUser(newUserModel.isSuperUser());
         return (oldUserModel);
     }
 
     /**
      * Create a user in the ITracker database
      * 
      * @param login
      * @param userModel
      * @param userService
      * @return
      * @throws UserException
      * @throws RemoteException
      */
     private User createUser(String login, UserService userService) throws RemoteException, UserException,
             AuthenticatorException {
 
         // doesn't exist, create
         User userModel = getExternalUserInfo(login);
         userModel.setRegistrationType(UserUtilities.REGISTRATION_TYPE_ADMIN);
         userModel.setStatus(UserUtilities.STATUS_ACTIVE);
         userModel = userService.createUser(userModel);
         // if this user is a super user, there is no need to set default
         // permissions
         // if not, set default permissions
         if (!userModel.isSuperUser()) {
             setDefaultPermissions(userModel, userService);
         }
 
         return userModel;
     }
 
     /**
      * Set the default user permissions
      * 
      * Default user permissions are the same as those of a user called
      * "TemplateUser"
      * 
      * @param userModel
      * @param userService
      * @throws RemoteException
      */
     private void setDefaultPermissions(User userModel, UserService userService) throws RemoteException,
             AuthenticatorException, UserException {
 
         User templateUser = userService.getUserByLogin(TEMPLATE_USER);
         if (templateUser == null) {
             String errorMessage = "TemplateUser not found. Create a user called template user, new permissions are copied from him to new users";
             logger.error(errorMessage);
             throw new AuthenticatorException(errorMessage, AuthenticatorException.CUSTOM_ERROR);
         }
         // set permissions
         userService.setUserPermissions(userModel.getId(), userService.getPermissionsByUserId(templateUser.getId()));
         // set preferences
         UserPreferences preferences = templateUser.getPreferences();
         preferences.setUser(userModel);
         userService.updateUserPreferences(preferences);
     }
 
     /**
      * Checks if a given internal user needs updating, by comparing him with the
      * external user data source
      * 
      * @param localUser
      *            The local User
      * @param remoteUser
      *            The remote User
      * @return true if the user needs updating, false otherwise
      */
     private boolean needsUpdate(User localUser, User remoteUser) {
         if (!(localUser.getEmail().equals(remoteUser.getEmail())))
             return true;
         if (!(localUser.getFirstName().equals(remoteUser.getFirstName())))
             return true;
         if (!(localUser.getLastName().equals(remoteUser.getLastName())))
             return true;
         if (localUser.isSuperUser() != remoteUser.isSuperUser())
             return true;
         return (false);
     }
 
     protected abstract User getExternalUserInfo(String login) throws AuthenticatorException;
 
     /*
      * (non-Javadoc)
      * 
      * @see org.itracker.ejb.authentication.AbstractPluggableAuthenticator#allowProfileUpdates(org.itracker.model.deprecatedmodels.User,
      *      java.lang.Object, int, int)
      */
     public boolean allowProfileUpdates(User user, Object authentication, int authType, int reqSource)
             throws AuthenticatorException {
         return true;
     }
 
     /*
      * (non-Javadoc)
      * 
      * @see org.itracker.ejb.authentication.AbstractPluggableAuthenticator#allowPasswordUpdates(org.itracker.model.deprecatedmodels.User,
      *      java.lang.Object, int, int)
      */
     public boolean allowPasswordUpdates(User user, Object authentication, int authType, int reqSource)
             throws AuthenticatorException {
         return false;
     }
 
 }