public Session getSession(final HttpServletRequest req, final Repository repository, final String workspace)
throws LoginException, RepositoryException, ServletException {
final ResourceResolver resolver = (ResourceResolver) req.getAttribute(AuthenticationSupport.REQUEST_ATTRIBUTE_RESOLVER);
if (resolver != null) {
final Session session = resolver.adaptTo(Session.class);
if (session != null) {
final Session newSession = getLongLivedSession(session);
log.debug("getSession: Creating new Session ({}) for {}", newSession, newSession.getUserID());
return newSession;
}
}
throw new ServletException("ResourceResolver missing or not providing on JCR Session");
}
public void releaseSession(final Session session) {
log.debug("releaseSession: Logging out long lived Session ({})", session);
session.logout();
}
/**
* Creates a new session for the user of the slingSession in the
* same workspace as the slingSession.
* <p>
* Assumption: The admin session has permission to impersonate
* as any user without restriction. If this is not the case
* the Session.impersonate method throws a LoginException
* which is folded into a RepositoryException.
*
* @param slingSession The session provided by the Sling
* authentication mechanis,
* @return a new session which may (and will) outlast the request
* @throws RepositoryException If an error occurrs creating the
* session.
*/
private Session getLongLivedSession(final Session slingSession) throws RepositoryException {
Session adminSession = null;
final String user = slingSession.getUserID();
try {
final SimpleCredentials credentials = new SimpleCredentials(user, EMPTY_PW);
final String wsp = slingSession.getWorkspace().getName();
adminSession = SlingDavExServlet.this.repository.loginAdministrative(wsp);
return adminSession.impersonate(credentials);
} catch (RepositoryException re) {
// LoginException from impersonate (missing permission)
// and RepositoryException from loginAdministrative and
// impersonate folded into RepositoryException to
// cause a 403/FORBIDDEN response
throw new RepositoryException("Cannot get session for " + user, re);
} finally {
if (adminSession != null) {
adminSession.logout();
}
}
}
};
}