/*
    * This file is part of ***  M y C o R e  ***
    * See http://www.mycore.de/ for details.
    *
    * MyCoRe is free software: you can redistribute it and/or modify
    * it under the terms of the GNU General Public License as published by
    * the Free Software Foundation, either version 3 of the License, or
    * (at your option) any later version.
    *
   * MyCoRe is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   * GNU General Public License for more details.
   *
   * You should have received a copy of the GNU General Public License
   * along with MyCoRe.  If not, see <http://www.gnu.org/licenses/>.
   */
  
  package org.mycore.user2.login;
  
  import org.apache.logging.log4j.LogManager;
  import org.apache.logging.log4j.Logger;
  import org.jasig.cas.client.authentication.AttributePrincipal;
  import org.jasig.cas.client.validation.Assertion;
  import org.jasig.cas.client.validation.Cas20ProxyTicketValidator;
  import org.mycore.common.MCRSessionMgr;
  import org.mycore.common.config.MCRConfiguration2;
  import org.mycore.frontend.servlets.MCRServlet;
  import org.mycore.frontend.servlets.MCRServletJob;
  import org.mycore.user2.MCRUser;
  import org.mycore.user2.MCRUser2Constants;
  import org.mycore.user2.MCRUserManager;
  
  import jakarta.servlet.ServletException;
  import jakarta.servlet.http.HttpServletRequest;
  import jakarta.servlet.http.HttpServletResponse;
  
  /**
   * Login user with JA-SIG Central Authentication Service (CAS).
   * The servlet validates the ticket returned from CAS and
   * builds a User object to login to the current session.
   * 
   * For /servlets/MCRCASServlet, a authentication filter must be defined
   * in web.xml. The following properties must be configured in 
   * mycore.properties:
   * 
   *  The URL of the CAS Client Servlet:
   * MCR.user2.CAS.ClientURL=http://localhost:8291/servlets/MCRCASServlet
   *
   * The Base URL of the CAS Server
   * MCR.user2.CAS.ServerURL=https://cas.uni-duisburg-essen.de/cas
   *
   * The realm the CAS Server authenticates for, as in realms.xml
   * MCR.user2.CAS.RealmID=ude
   *
   * Configure store of trusted SSL (https) server certificates
   * MCR.user2.CAS.SSL.TrustStore=/path/to/java/lib/security/cacerts
   * MCR.user2.CAS.SSL.TrustStore.Password=changeit
   * 
   * After successful login, MCRCASServlet queries an LDAP server for
   * the user's properties.
   *
   * @author Frank L\u00fctzenkirchen
   */
  public class MCRCASServlet extends MCRServlet {
      private static final long serialVersionUID = 1L;
  
      /** The logger */
      private static Logger LOGGER = LogManager.getLogger();
  
      /** The URL of THIS servlet */
      private String clientURL;
  
      /** The base URL of the CAS Server */
      private String serverURL;
  
      /** The realm the CAS Server authenticates for, as in realms.xml */
      private String realmID;
  
      @Override
      public void init() throws ServletException {
          super.init();
  
          clientURL = MCRConfiguration2.getStringOrThrow(MCRUser2Constants.CONFIG_PREFIX + "CAS.ClientURL");
          serverURL = MCRConfiguration2.getStringOrThrow(MCRUser2Constants.CONFIG_PREFIX + "CAS.ServerURL");
          realmID = MCRConfiguration2.getStringOrThrow(MCRUser2Constants.CONFIG_PREFIX + "CAS.RealmID");
  
          // Set properties to enable SSL connection to CAS and accept certificates  
          String trustStore = MCRConfiguration2.getStringOrThrow(MCRUser2Constants.CONFIG_PREFIX + "CAS.SSL.TrustStore");
          String trustStorePassword = MCRConfiguration2
              .getStringOrThrow(MCRUser2Constants.CONFIG_PREFIX + "CAS.SSL.TrustStore.Password");
  
          System.setProperty("javax.net.ssl.trustStore", trustStore);
          System.setProperty("javax.net.ssl.trustStorePassword", trustStorePassword);
      }
  
      public void doGetPost(MCRServletJob job) throws Exception {
          HttpServletRequest req = job.getRequest();
          HttpServletResponse res = job.getResponse();
 
         String ticket = req.getParameter("ticket");
         if ((ticket == null) || (ticket.trim().length() == 0)) {
             res.sendError(HttpServletResponse.SC_BAD_REQUEST);
             return;
         }
 
         // Validate ticket at CAS server
         Cas20ProxyTicketValidator sv = new Cas20ProxyTicketValidator(serverURL);
         sv.setAcceptAnyProxy(true);
         Assertion a = sv.validate(ticket, clientURL);
         AttributePrincipal principal = a.getPrincipal();
 
         // Get user name logged in
         String userName = principal.getName();
         LOGGER.info("Login {}", userName);
 
         MCRUser user;
         boolean userExists = MCRUserManager.exists(userName, realmID);
         if (userExists) {
             user = MCRUserManager.getUser(userName, realmID);
         } else {
             user = new MCRUser(userName, realmID);
         }
 
         // Get user properties from LDAP server
         boolean userChanged = MCRLDAPClient.instance().updateUserProperties(user);
         if (userChanged && userExists) {
             MCRUserManager.updateUser(user);
         }
 
         // Store login user in session and redirect browser to target url
         MCRSessionMgr.getCurrentSession().setUserInformation(user);
         // MCR-1154
         req.changeSessionId();
         MCRLoginServlet.redirect(res);
     }
 }