/*
    * Licensed to the Apache Software Foundation (ASF) under one
    * or more contributor license agreements.  See the NOTICE file
    * distributed with this work for additional information
    * regarding copyright ownership.  The ASF licenses this file
    * to you under the Apache License, Version 2.0 (the
    * "License"); you may not use this file except in compliance
    * with the License.  You may obtain a copy of the License at
    *
   *   http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   * KIND, either express or implied.  See the License for the
   * specific language governing permissions and limitations
   * under the License.
   */
  package org.apache.syncope.common.lib.auth;
  
  import java.io.Serializable;
  import java.util.Map;
  import org.apache.syncope.common.lib.AbstractLDAPConf;
  import org.apache.syncope.common.lib.to.AuthModuleTO;
  
  /**
   * SPNEGO is an authentication technology that is primarily used to provide transparent CAS authentication to browsers
   * running on Windows running under Active Directory domain credentials. There are three actors involved: the client,
   * the CAS server, and the Active Directory Domain Controller/KDC.
   */
  public class SpnegoAuthModuleConf implements LDAPDependantAuthModuleConf {
  
      private static final long serialVersionUID = -7775771400312303131L;
  
      public static class LDAP extends AbstractLDAPConf implements Serializable {
  
          private static final long serialVersionUID = -7274446267090678730L;
  
      }
  
      /**
       * The Login conf.Absolute path to the jaas login configuration file.
       * This should define the spnego authentication details.
       * Make sure you have at least specified the JCIFS Service Principal defined.
       */
      private String loginConf;
  
      /**
       * The Kerberos conf.
       * As with all Kerberos installations, a Kerberos Key Distribution Center (KDC) is required.
       * It needs to contain the user name and password you will use to be authenticated to Kerberos.
       * As with most Kerberos installations, a Kerberos configuration file krb5.conf is
       * consulted to determine such things as the default realm and KDC.
       * Typically, the default realm and the KDC for that realm are indicated in
       * the Kerberos krb5.conf configuration file.
       * The path to the configuration file must typically be defined
       * as an absolute path.
       */
      private String kerberosConf;
  
      /**
       * The Kerberos kdc.
       */
      private String kerberosKdc = "172.10.1.10";
  
      /**
       * The Jcifs service principal.
       */
      private String jcifsServicePrincipal;
  
      /**
       * The Kerberos realm.
       */
      private String kerberosRealm = "EXAMPLE.COM";
  
      /**
       * The Kerberos debug.
       */
      private boolean kerberosDebug;
  
      /**
       * The Use subject creds only.
       */
      private boolean useSubjectCredsOnly;
  
      /**
       * If specified, will create the principal by ths name on successful authentication.
       */
      private boolean principalWithDomainName;
  
      /**
       * Allows authentication if spnego credential is marked as NTLM.
       */
      private boolean ntlmAllowed = true;
  
      /**
       * If the authenticated principal cannot be determined from the spegno credential,
       * will set the http status code to 401.
       */
     private boolean send401OnAuthenticationFailure = true;
 
     /**
      * The bean id of a webflow action whose job is to evaluate the client host
      * to see if the request is authorized for spnego.
      * Supported strategies include {@code hostnameSpnegoClientAction} where
      * CAS checks to see if the request’s remote hostname matches a predefine pattern.
      * and {@code ldapSpnegoClientAction} where
      * CAS checks an LDAP instance for the remote hostname, to locate a pre-defined attribute whose
      * mere existence would allow the webflow to resume to SPNEGO.
      */
     private String hostNameClientActionStrategy = "hostnameSpnegoClientAction";
 
     /**
      * LDAP settings for spnego to validate clients, etc.
      */
     private LDAP ldap;
 
     /**
      * When validating clients, specifies the DNS timeout used to look up an address.
      */
     private String dnsTimeout = "PT2S";
 
     /**
      * A regex pattern that indicates whether the client host name is allowed for spnego.
      */
     private String hostNamePatternString = ".+";
 
     /**
      * A regex pattern that indicates whether the client IP is allowed for spnego.
      */
     private String ipsToCheckPattern = "127.+";
 
     /**
      * Alternative header name to use in order to find the host address.
      */
     private String alternativeRemoteHostAttribute = "alternateRemoteHeader";
 
     /**
      * In case LDAP is used to validate clients, this is the attribute that indicates the host.
      */
     private String spnegoAttributeName = "distinguishedName";
 
     /**
      * Determines the header to set and the message prefix when negotiating spnego.
      */
     private boolean ntlm;
 
     /**
      * If true, does not terminate authentication and allows CAS to resume
      * and fallback to normal authentication means such as uid/psw via the login page.
      * If disallowed, considers spnego authentication to be final in the event of failures.
      */
     private boolean mixedModeAuthentication;
 
     /**
      * Begins negotiating spnego if the user-agent is one of the supported browsers.
      */
     private String supportedBrowsers = "MSIE,Trident,Firefox,AppleWebKit";
 
     /**
      * The size of the pool used to validate SPNEGO tokens.
      * A pool is used to provider better performance than what was previously offered by the simple Lombok
      * {@code Synchronized} annotation.
      */
     private int poolSize = 10;
 
     /**
      * The timeout of the pool used to validate SPNEGO tokens.
      */
     private String poolTimeout = "PT2S";
 
     /**
      * Activated attribute repository identifiers that should be used for fetching attributes if attribute resolution is
      * enabled.
      * The list here may include identifiers separated by comma.
      */
     private String attributeRepoId;
 
     @Override
     public AbstractLDAPConf ldapInstance() {
         return new SpnegoAuthModuleConf.LDAP();
     }
 
     public String getJcifsServicePrincipal() {
         return jcifsServicePrincipal;
     }
 
     public void setJcifsServicePrincipal(final String jcifsServicePrincipal) {
         this.jcifsServicePrincipal = jcifsServicePrincipal;
     }
 
     public String getAttributeRepoId() {
         return attributeRepoId;
     }
 
     public void setAttributeRepoId(final String attributeRepoId) {
         this.attributeRepoId = attributeRepoId;
     }
 
     public String getLoginConf() {
         return loginConf;
     }
 
     public void setLoginConf(final String loginConf) {
         this.loginConf = loginConf;
     }
 
     public String getKerberosConf() {
         return kerberosConf;
     }
 
     public void setKerberosConf(final String kerberosConf) {
         this.kerberosConf = kerberosConf;
     }
 
     public String getKerberosKdc() {
         return kerberosKdc;
     }
 
     public void setKerberosKdc(final String kerberosKdc) {
         this.kerberosKdc = kerberosKdc;
     }
 
     public String getKerberosRealm() {
         return kerberosRealm;
     }
 
     public void setKerberosRealm(final String kerberosRealm) {
         this.kerberosRealm = kerberosRealm;
     }
 
     public boolean isKerberosDebug() {
         return kerberosDebug;
     }
 
     public void setKerberosDebug(final boolean kerberosDebug) {
         this.kerberosDebug = kerberosDebug;
     }
 
     public boolean isUseSubjectCredsOnly() {
         return useSubjectCredsOnly;
     }
 
     public void setUseSubjectCredsOnly(final boolean useSubjectCredsOnly) {
         this.useSubjectCredsOnly = useSubjectCredsOnly;
     }
 
     public boolean isPrincipalWithDomainName() {
         return principalWithDomainName;
     }
 
     public void setPrincipalWithDomainName(final boolean principalWithDomainName) {
         this.principalWithDomainName = principalWithDomainName;
     }
 
     public boolean isNtlmAllowed() {
         return ntlmAllowed;
     }
 
     public void setNtlmAllowed(final boolean ntlmAllowed) {
         this.ntlmAllowed = ntlmAllowed;
     }
 
     public boolean isSend401OnAuthenticationFailure() {
         return send401OnAuthenticationFailure;
     }
 
     public void setSend401OnAuthenticationFailure(final boolean send401OnAuthenticationFailure) {
         this.send401OnAuthenticationFailure = send401OnAuthenticationFailure;
     }
 
     public String getHostNameClientActionStrategy() {
         return hostNameClientActionStrategy;
     }
 
     public void setHostNameClientActionStrategy(final String hostNameClientActionStrategy) {
         this.hostNameClientActionStrategy = hostNameClientActionStrategy;
     }
 
     public LDAP getLdap() {
         return ldap;
     }
 
     public void setLdap(final LDAP ldap) {
         this.ldap = ldap;
     }
 
     public String getDnsTimeout() {
         return dnsTimeout;
     }
 
     public void setDnsTimeout(final String dnsTimeout) {
         this.dnsTimeout = dnsTimeout;
     }
 
     public String getHostNamePatternString() {
         return hostNamePatternString;
     }
 
     public void setHostNamePatternString(final String hostNamePatternString) {
         this.hostNamePatternString = hostNamePatternString;
     }
 
     public String getIpsToCheckPattern() {
         return ipsToCheckPattern;
     }
 
     public void setIpsToCheckPattern(final String ipsToCheckPattern) {
         this.ipsToCheckPattern = ipsToCheckPattern;
     }
 
     public String getAlternativeRemoteHostAttribute() {
         return alternativeRemoteHostAttribute;
     }
 
     public void setAlternativeRemoteHostAttribute(final String alternativeRemoteHostAttribute) {
         this.alternativeRemoteHostAttribute = alternativeRemoteHostAttribute;
     }
 
     public String getSpnegoAttributeName() {
         return spnegoAttributeName;
     }
 
     public void setSpnegoAttributeName(final String spnegoAttributeName) {
         this.spnegoAttributeName = spnegoAttributeName;
     }
 
     public boolean isNtlm() {
         return ntlm;
     }
 
     public void setNtlm(final boolean ntlm) {
         this.ntlm = ntlm;
     }
 
     public boolean isMixedModeAuthentication() {
         return mixedModeAuthentication;
     }
 
     public void setMixedModeAuthentication(final boolean mixedModeAuthentication) {
         this.mixedModeAuthentication = mixedModeAuthentication;
     }
 
     public String getSupportedBrowsers() {
         return supportedBrowsers;
     }
 
     public void setSupportedBrowsers(final String supportedBrowsers) {
         this.supportedBrowsers = supportedBrowsers;
     }
 
     public int getPoolSize() {
         return poolSize;
     }
 
     public void setPoolSize(final int poolSize) {
         this.poolSize = poolSize;
     }
 
     public String getPoolTimeout() {
         return poolTimeout;
     }
 
     public void setPoolTimeout(final String poolTimeout) {
         this.poolTimeout = poolTimeout;
     }
 
     @Override
     public Map<String, Object> map(final AuthModuleTO authModule, final Mapper mapper) {
         return mapper.map(authModule, this);
     }
 }