package com.dtolabs.rundeck.server.filters;

import com.dtolabs.rundeck.core.utils.GrailsServiceInjectorJobListener;
import org.apache.log4j.Logger;
import org.codehaus.groovy.grails.commons.GrailsApplication;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.support.WebApplicationContextUtils;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.IOException;
import java.security.Principal;
import java.util.Enumeration;
import java.util.Map;

/**
 * Filter interrogates headers and modifies the request object to be passed down the filter chain
 *
 * @author John Stoltenborg
 */

public class AuthFilter implements Filter {

    private static final transient Logger LOG = Logger.getLogger(AuthFilter.class);

    String preauthentication;
    String rolesAttribute;
    String userNameHeader;
    String rolesHeader;

    public void init(FilterConfig filterConfig) throws ServletException {

        WebApplicationContext springContext = WebApplicationContextUtils.getWebApplicationContext(filterConfig.getServletContext());
        GrailsApplication grailsApplication = springContext.getBean(GrailsApplication.class);

        if (grailsApplication.equals(null)) {
            throw new IllegalStateException("grailsApplication not found in context");
        }

        Map map = grailsApplication.getFlatConfig();
        preauthentication = (String) map.get("rundeck.security.authorization.preauthenticated.enabled");
        rolesAttribute = (String) map.get("rundeck.security.authorization.preauthenticated.attributeName");
        rolesHeader = (String) map.get("rundeck.security.authorization.preauthenticated.userRolesHeader");
        userNameHeader = (String) map.get("rundeck.security.authorization.preauthenticated.userNameHeader");

    }

    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain filterChain)
            throws IOException, ServletException {

        if(preauthentication.equals("true")) {
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            Enumeration<String> headerNames = httpRequest.getHeaderNames();

            final String forwardedUser = httpRequest.getHeader(userNameHeader);
            ServletRequest requestModified =
                    new HttpServletRequestWrapper((HttpServletRequest) request) {
                        @Override
                        public String getRemoteUser() {
                            return forwardedUser;
                        }

                        @Override
                        public Principal getUserPrincipal() {
                            Principal principle = new Principal() {
                                @Override
                                public String getName() {
                                    return forwardedUser;
                                }
                            };
                            return principle;
                        }
                    };

            //
            // Get the roles sent by the proxy and add them onto the request as an attribute for
            // PreauthenticatedAttributeRoleSource
            final String forwardedRoles = httpRequest.getHeader(rolesHeader);
            requestModified.setAttribute(rolesAttribute, forwardedRoles);
            filterChain.doFilter(requestModified, response);

            LOG.info("Roles header " + rolesHeader);
            LOG.info("Roles received " + forwardedRoles);
            LOG.info("User header " + userNameHeader);
            LOG.info("User / UUID recieved " + forwardedUser);

        } else {
            filterChain.doFilter(request, response);
        }
    }

    public void destroy() {
    }
}
@@ -42,80 +42,8 @@
 s;%0A%0A
-import com.dtolabs.rundeck.core.utils.GrailsServiceInjectorJobListener;%0A
 impo
@@ -268,16 +268,17 @@
 tUtils;%0A
+%0A
 import j
@@ -456,38 +456,8 @@
 al;%0A
-import java.util.Enumeration;%0A
 impo
@@ -751,32 +751,23 @@
     
-String preauthentication
+boolean enabled
 ;%0A  
@@ -1028,16 +1028,123 @@
 erConfig
+%0A                                                                                                          
 .getServ
@@ -1462,36 +1462,18 @@
     
-preauthentication = (String)
+Object o =
  map
@@ -1533,24 +1533,78 @@
 .enabled%22);%0A
+        enabled = Boolean.parseBoolean(o.toString());%0A
         role
@@ -1912,24 +1912,25 @@
 eHeader%22);%0A%0A
+%0A
     %7D%0A%0A    p
@@ -1949,16 +1949,29 @@
 oFilter(
+%0A            
 ServletR
@@ -2024,29 +2024,16 @@
         
-        
-     
 FilterCh
@@ -2047,16 +2047,21 @@
 terChain
+%0A    
 )%0A      
@@ -2094,32 +2094,36 @@
 ServletException
+%0A   
  %7B%0A%0A        if(p
@@ -2124,49 +2124,105 @@
   if
-(preauthentication.equals(%22true%22)) %7B%0A    
+ (!enabled) %7B%0A            filterChain.doFilter(request, response);%0A            return;%0A        %7D%0A
     
@@ -2300,76 +2300,77 @@
     
-    Enumeration%3CString%3E headerNames = httpRequest.getHeaderNames();%0A
+ServletRequest requestModified;%0A        if (userNameHeader != null) %7B
 %0A   
@@ -2438,32 +2438,33 @@
 serNameHeader);%0A
+%0A
             Serv
@@ -2455,38 +2455,141 @@
             
-ServletRequest
+LOG.info(%22User header %22 + userNameHeader);%0A            LOG.info(%22User / UUID recieved %22 + forwardedUser);%0A           
  requestModi
@@ -3326,31 +3326,214 @@
      %7D;%0A
-%0A            //
+        %7D else %7B%0A            requestModified =%0A                    new HttpServletRequestWrapper((HttpServletRequest) request);%0A        %7D%0A        if (rolesAttribute != null && rolesHeader != null) %7B
 %0A       
@@ -3829,70 +3829,8 @@
 s);%0A
-            filterChain.doFilter(requestModified, response);%0A%0A
     
@@ -3948,140 +3948,10 @@
     
-    LOG.info(%22User header %22 + userNameHeader);%0A            LOG.info(%22User / UUID recieved %22 + forwardedUser);%0A%0A        %7D else %7B%0A    
+%7D%0A
     
@@ -3974,32 +3974,40 @@
 doFilter(request
+Modified
 , response);%0A   
@@ -4003,26 +4003,16 @@
 ponse);%0A
-        %7D%0A
     %7D%0A%0A 

allow boolean enabled flag, allow username/roles to be used separately