boolean isLdapAuthenticationEnabled = isLdapAuthenticationEnabled();
if (isLdapAuthenticationEnabled) {//we can proceed with LDAP checking
//check that session is valid. RHQ auth has already occurred. Security check required to initiate following
//spinder BZ:682755: 3/10/11: can't use isValidSessionId() as it also compares subject.id which is changing during case insensitive
// and new registration. This worked before because HTTP get took longer to invalidate sessions.
Subject sessionSubject;
try {
sessionSubject = sessionManager.getSubject(subject.getSessionId());
} catch (SessionNotFoundException e) {
throw new LoginException("User session not valid. Login to proceed.");
} catch (SessionTimeoutException e) {
throw new LoginException("User session not valid. Login to proceed.");
}
if (!subject.getName().equals(sessionSubject.getName())) {
throw new LoginException("User session not valid. Login to proceed.");
}
//Subject.id == 0 then is registration or case insensitive check and subject update.
if (subject.getId() == 0) {
//i)case insensitive check or ii)ldap new user registration.
//BZ-586435: insert case insensitivity for usernames with ldap auth
// locate first matching subject and attach.
SubjectCriteria subjectCriteria = new SubjectCriteria();
subjectCriteria.setCaseSensitive(false);
subjectCriteria.setStrict(true);
subjectCriteria.fetchRoles(false);
subjectCriteria.fetchConfiguration(false);
subjectCriteria.addFilterName(subject.getName());
//BZ-798465: spinder 3/1/12 we now need to pass in overlord because of BZ-786159
// We've verified that this user has valid session, and is using ldap. Safe to elevate search here.
PageList<Subject> subjectsLocated = findSubjectsByCriteria(getOverlord(), subjectCriteria);
//if subject variants located then take the first one with a principal otherwise do nothing
//To defend against the case where they create an account with the same name but not
//case as an rhq sysadmin or higher perms, then make them relogin with same creds entered.
if ((!subjectsLocated.isEmpty())
&& (!subjectsLocated.get(0).getName().equals(subject.getName()))) {//then case insensitive username matches found. Try to use instead.
Subject ldapSubject = subjectsLocated.get(0);
String msg = "Located existing ldap account with different case for ["
+ ldapSubject.getName() + "]. "
+ "Attempting to authenticate with that account instead.";
if (log.isInfoEnabled()) {
log.info(msg);
}
logout(subject.getSessionId().intValue());
subject = _login(ldapSubject.getName(), subjectPassword, false, false);
Integer sessionId = subject.getSessionId();
if (log.isDebugEnabled()) {
log.debug("Logged in as [" + ldapSubject.getName() + "] with session id [" + sessionId
+ "]");
}
} else {//then this is a registration request. insert overlord registration and login
//we've verified that this user has valid session, requires registration and that ldap is configured.
Subject superuser = getOverlord();
// create the subject, but don't add a principal since LDAP will handle authentication
if (log.isDebugEnabled()) {
log.debug("registering new LDAP-authenticated subject [" + subject.getName() + "]");
}