/*
    * Copyright 2010 Fraunhofer Gesellschaft, Munich, Germany,
    * for its Fraunhofer Institute for Computer Architecture and Software
    * Technology (FIRST), Berlin, Germany. All rights reserved.
    * http://www.first.fraunhofer.de/
    */
   
   package net.kwfgrid.gwes;
   
  import net.kwfgrid.gwes.util.StringUtils;
  import net.kwfgrid.gwes.exception.LoggingException;
  import net.kwfgrid.gwes.exception.WorkflowSecurityException;
  import org.apache.log4j.Logger;
  import org.globus.common.CoGProperties;
  import org.gridforum.jgss.ExtendedGSSCredential;
  import org.gridforum.jgss.ExtendedGSSManager;
  import org.ietf.jgss.GSSCredential;
  import org.ietf.jgss.GSSException;
  
  import java.io.File;
  import java.io.FileInputStream;
  import java.io.IOException;
  
  /**
   * Credential manager for secured activities.
   *
   * @author Andreas Hoheisel
   *         (<a href="http://www.andreas-hoheisel.de">www.andreas-hoheisel.de</a>)
   * @version $Id: CredentialManager.java 1532 2011-06-23 15:57:53Z hoheisel $
   */
  public class CredentialManager {
  
      static final Logger logger = Logger.getLogger(CredentialManager.class);
  
      /**
       * minimum remaining credential lifetime in seconds.
       */
      final private static int MIN_REMAINING_LIFETIME = 60*60;
  
      private GSSCredential credential;
  
      private File proxyFile;
  
      /**
       * The mode specifies the retrieval method for credentials.
       */
      private int mode;
  
      /**
       * Use the default Globus credential.
       */
      public final static int MODE_DEFAULT_PROXY_FILE = 1;
  
      /**
       * Use a secific proxy file.
       */
      public final static int MODE_PROXY_FILE = 2;
  
      /**
       * Use a specific credential.
       */
      public final static int MODE_USER_CREDENTIAL = 4;
  
      /**
       * Create credential manager which uses default Globus Toolkit credential as defined in cog.properties
       * (property X509_USER_PROXY).
       */
      public CredentialManager() throws GSSException, IOException, LoggingException {
          String dn = null;
          Throwable error = null;
          try {
              this.mode = MODE_DEFAULT_PROXY_FILE;
              this.credential = getDefaultCredential();
              dn = getDN();
          } catch (GSSException e) {
              error = e; throw e;
          } catch (IOException e) {
              error = e; throw e;
          } catch (Throwable e) {
              error = e; throw new IOException(e.toString(),e);
          } finally {
              if (error == null) { // SUCCESS
                  GWESLogger.getInstance().logEventSP(GWESLogger.Event.LOAD_CREDENTIAL,dn,this,"defaultGlobusProxyFile",null,proxyFile.getAbsolutePath());
              } else {             // ERROR
                  GWESLogger.getInstance().logEventSP(GWESLogger.Event.LOAD_CREDENTIAL,GWESLogger.EventOutcome.ERROR,dn,this,"defaultGlobusProxyFile",null,proxyFile.getAbsolutePath(),error);
              }
          }
      }
  
      /**
       * Create credential manager which uses specific proxy File.
       * @param proxyFile
       */
      public CredentialManager(File proxyFile) throws GSSException, IOException, LoggingException {
          String dn = null;
          Throwable error = null;
          try {
              this.mode = MODE_PROXY_FILE;
              this.proxyFile = proxyFile;
             this.credential = getCredentialFromProxyFile();
             dn = getDN();
         } catch (GSSException e) {
             error = e; throw e;
         } catch (IOException e) {
             error = e; throw e;
         } catch (Throwable e) {
             error = e; throw new IOException(e.toString(),e);
         } finally {
             if (error == null) { // SUCCESS
                 GWESLogger.getInstance().logEventSP(GWESLogger.Event.LOAD_CREDENTIAL,dn,this,"proxyFile",null,proxyFile.getAbsolutePath());
             } else {             // ERROR
                 GWESLogger.getInstance().logEventSP(GWESLogger.Event.LOAD_CREDENTIAL,GWESLogger.EventOutcome.ERROR,dn,this,"proxyFile",null,proxyFile.getAbsolutePath(),error);
             }
         }
     }
 
     /**
      * Create credential manager which uses specific GSSCredential.
      * @param credential
      */
     public CredentialManager(GSSCredential credential) throws LoggingException, GSSException {
         String dn = null;
         Throwable error = null;
         try {
             this.mode = MODE_USER_CREDENTIAL;
             this.credential = credential;
             dn = getDN();
         } catch (GSSException e) {
             error = e; throw e;
         } finally {
             if (error == null) { // SUCCESS
                 GWESLogger.getInstance().logEvent(GWESLogger.Event.LOAD_CREDENTIAL,dn,this);
             } else {             // ERROR
                 GWESLogger.getInstance().logEvent(GWESLogger.Event.LOAD_CREDENTIAL,GWESLogger.EventOutcome.ERROR,dn,this,error);
             }
         }
     }
 
     /**
      * Create credential manager which uses specific userID|credential string.
      * @param userIdCredential
      */
     public CredentialManager(String userIdCredential) throws GSSException, LoggingException {
         String dn = null;
         Throwable error = null;
         try {
             this.mode = MODE_USER_CREDENTIAL;
             this.credential = getGSSCredential(extractCredential(userIdCredential));
             dn = getDN();
         } catch (GSSException e) {
             error = e; throw e;
         } finally {
             if (error == null) { // SUCCESS
                 GWESLogger.getInstance().logEvent(GWESLogger.Event.LOAD_CREDENTIAL,dn,this);
             } else {             // ERROR
                 GWESLogger.getInstance().logEvent(GWESLogger.Event.LOAD_CREDENTIAL,GWESLogger.EventOutcome.ERROR,dn,this,error);
             }
         }
     }
 
     public GSSCredential getCredential() throws GSSException, IOException {
         switch(mode) {
             case MODE_DEFAULT_PROXY_FILE:
             case MODE_PROXY_FILE:
                 //try to reload credential from proxy if lifetime is less than MIN_REMAINING_LIFETIME
                 if (credential.getRemainingLifetime() < MIN_REMAINING_LIFETIME) {
                     logger.warn("remaining credential lifetime for credential \""+getDN()+"\" not sufficient - reloading credential...");
                     credential = getCredentialFromProxyFile();
                 }
             case MODE_USER_CREDENTIAL:
                 //nothing to do
         }
         return credential;
     }
 
     public void setCredential(String credentialString) throws GSSException, LoggingException {
             setCredential(getGSSCredential(credentialString));
     }
 
     public void setCredential(GSSCredential credential) throws GSSException, LoggingException {
         String dn = null;
         Throwable error = null;
         String oldDN = null;
         try {
             if (mode != MODE_USER_CREDENTIAL) throw new GSSException(GSSException.UNAUTHORIZED);
             oldDN = getDN();
             this.credential = credential;
             dn = getDN();
         } catch (GSSException e) {
             error = e; throw e;
         } finally {
             if (error == null) { // SUCCESS
                 GWESLogger.getInstance().logEventSP(GWESLogger.Event.SET_CREDENTIAL,dn,this,"DN",oldDN,dn);
             } else {             // ERROR
                 GWESLogger.getInstance().logEventSP(GWESLogger.Event.SET_CREDENTIAL,GWESLogger.EventOutcome.ERROR,dn,this,"DN",oldDN,dn,error);
             }
         }
     }
 
     public String getDN() throws GSSException {
         if (credential == null) throw new GSSException(GSSException.NO_CRED);
         return credential.getName().toString();
     }
     
     public String getFilteredCN() throws GSSException {
         return StringUtils.extractFilteredCNFromDN(getDN());
     }
 
     /**
      * Create a GSSCredential from a proxy file generated with grid-proxy-init.
      *
      * @throws IOException
      * @throws GSSException
      */
     private GSSCredential getCredentialFromProxyFile() throws IOException, GSSException {
         if (proxyFile == null) throw new IOException("proxy file not defined");
         if (logger.isDebugEnabled()) {
             logger.debug("loading credential from file " + proxyFile.getAbsolutePath() + " ...");
         }
         byte[] proxyData = new byte[(int) proxyFile.length()];
         FileInputStream inputStream = new FileInputStream(proxyFile);
         inputStream.read(proxyData);
         inputStream.close();
 
         ExtendedGSSManager manager =
                 (ExtendedGSSManager) ExtendedGSSManager.getInstance();
 
         GSSCredential ret = manager.createCredential(proxyData, ExtendedGSSCredential.IMPEXP_OPAQUE, GSSCredential.DEFAULT_LIFETIME,
                 null, GSSCredential.INITIATE_AND_ACCEPT);
         if (ret == null) throw new GSSException(GSSException.NO_CRED);
         return ret;
     }
 
     /**
      * Load default globus credential.
      * <p/>
      * It first checks the X509_USER_PROXY system property. If the property
      * is not set, it checks next the 'proxy' property in the current
      * configuration. If that property is not set, then it defaults to a
      * value based on the following rules: <BR>
      * If a UID system property is set, and running on a Unix machine it
      * returns /tmp/x509up_u${UID}. If any other machine then Unix, it returns
      * ${tempdir}/x509up_u${UID}, where tempdir is a platform-specific
      * temporary directory as indicated by the java.io.tmpdir system property.
      * If a UID system property is not set, the username will be used instead
      * of the UID. That is, it returns ${tempdir}/x509up_u_${username}
      * <BR>
      * This is done this way because Java is not able to obtain the current
      * uid.
      *
      * @throws GSSException
      * @throws IOException
      */
     private GSSCredential getDefaultCredential() throws GSSException, IOException {
         logger.debug("loading default credential ...");
         proxyFile = new File(CoGProperties.getDefault().getProxyFile());
         return getCredentialFromProxyFile();
     }
 
     /**
      * Extract a credential from a userIdCredential. The format is "userID|credentialString".
      * @param userIdCredential The format is "userID|credentialString".
      * @return the credentialString.
      */
     public static String extractCredential(String userIdCredential) {
         if (userIdCredential == null) return null;
         String ret = null;
         // Extract credential from userID string
         int idelim = userIdCredential.indexOf('|');
         if (idelim > 0 && userIdCredential.length() > idelim + 1) {
             ret = userIdCredential.substring(idelim + 1);
         }
         return ret;
     }
 
     /**
      * Get userID from userIdCredential String.
      * @param userIdCredential The format is "userID|credentialString".
      * @return If userIdCredential contains a credential, then this method returns the DN of the credential. If not,
      * this method just returns the userID (part before "|").
      */
     public static String extractUserId(String userIdCredential) throws LoggingException, WorkflowSecurityException {
         if (userIdCredential == null) return null;
         if (extractCredential(userIdCredential)==null) {
             // there is no credential -> just return userID
             int idelim = userIdCredential.indexOf('|');
             if (idelim > -1) {
                 return userIdCredential.substring(0,idelim);
             } else {
                 return userIdCredential;
             }
         }
         // check for credential and return DN.
         String dn = null;
         try {
             CredentialManager c = new CredentialManager(userIdCredential);
             dn = c.getDN();
         } catch (GSSException e) {
             throw new WorkflowSecurityException("Exception when extracting userID from credential:" + e.toString(),e);
         }
         return dn;
     }
 
     /**
      * Convert a credential String to a GSSCredential.
      * @param credentialString
      * @return
      * @throws GSSException
      */
     public static GSSCredential getGSSCredential(String credentialString) throws GSSException {
         GSSCredential ret = null;
         if ((credentialString != null && credentialString.length() != 0)) {
             ret = ((ExtendedGSSManager) ExtendedGSSManager.getInstance())
                     .createCredential(credentialString.replaceAll("NEWLINE", "\n").getBytes(),
                             ExtendedGSSCredential.IMPEXP_OPAQUE,
                             GSSCredential.DEFAULT_LIFETIME, null,
                             GSSCredential.INITIATE_AND_ACCEPT);
         }
         if (ret == null) throw new GSSException(GSSException.NO_CRED);
         return ret;
     }
 
 }