/*
    * SPDX-License-Identifier: MIT
    * See LICENSE file for details.
    *
    * Copyright 2010-2026 The Waffle Project Contributors: https://github.com/Waffle/waffle/graphs/contributors
    */
   package waffle.shiro.negotiate;
   
   import java.security.Principal;
  
  import javax.security.auth.Subject;
  
  import org.apache.shiro.authc.AuthenticationException;
  import org.apache.shiro.authc.AuthenticationInfo;
  import org.apache.shiro.authc.AuthenticationToken;
  import org.apache.shiro.realm.AuthenticatingRealm;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import waffle.servlet.WindowsPrincipal;
  import waffle.windows.auth.IWindowsAuthProvider;
  import waffle.windows.auth.IWindowsIdentity;
  import waffle.windows.auth.IWindowsSecurityContext;
  import waffle.windows.auth.impl.WindowsAuthProviderImpl;
  
  /**
   * The Class NegotiateAuthenticationRealm. Derived from
   * net.skorgenes.security.jsecurity.negotiate.NegotiateAuthenticationFilter.
   */
  public class NegotiateAuthenticationRealm extends AuthenticatingRealm {
  
      /**
       * This class's private logger.
       */
      private static final Logger LOGGER = LoggerFactory.getLogger(NegotiateAuthenticationRealm.class);
  
      /** The windows auth provider. */
      private final IWindowsAuthProvider windowsAuthProvider;
  
      /**
       * Instantiates a new negotiate authentication realm.
       */
      public NegotiateAuthenticationRealm() {
          this.windowsAuthProvider = new WindowsAuthProviderImpl();
      }
  
      @Override
      public boolean supports(final AuthenticationToken token) {
          return token instanceof NegotiateToken;
      }
  
      @Override
      protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken t) {
  
          final NegotiateToken token = (NegotiateToken) t;
          final byte[] inToken = token.getIn();
  
          if (token.isNtlmPost()) {
              // type 2 NTLM authentication message received
              this.windowsAuthProvider.resetSecurityToken(token.getConnectionId());
          }
  
          final IWindowsSecurityContext securityContext;
          try {
              securityContext = this.windowsAuthProvider.acceptSecurityToken(token.getConnectionId(), inToken,
                      token.getSecurityPackage());
          } catch (final Exception e) {
              NegotiateAuthenticationRealm.LOGGER.warn("error logging in user");
              throw new AuthenticationException(e);
          }
  
          final byte[] continueTokenBytes = securityContext.getToken();
          token.setOut(continueTokenBytes);
          if (continueTokenBytes != null) {
              NegotiateAuthenticationRealm.LOGGER.debug("continue token bytes: {}",
                      Integer.valueOf(continueTokenBytes.length));
          } else {
              NegotiateAuthenticationRealm.LOGGER.debug("no continue token bytes");
          }
  
          if (securityContext.isContinue() || token.isNtlmPost()) {
              throw new AuthenticationInProgressException();
          }
  
          final IWindowsIdentity windowsIdentity = securityContext.getIdentity();
          securityContext.dispose();
  
          NegotiateAuthenticationRealm.LOGGER.debug("logged in user: {} ({})", windowsIdentity.getFqn(),
                  windowsIdentity.getSidString());
  
          final Principal principal = new WindowsPrincipal(windowsIdentity);
          token.setPrincipal(principal);
  
          final Subject subject = new Subject();
          subject.getPrincipals().add(principal);
          token.setSubject(subject);
  
          return token.createInfo();
      }
 
 }