// The contents of this file are subject to the Mozilla Public License Version 1.1
// (the "License"); you may not use this file except in compliance with the License.
// You may obtain a copy of the License at <http://www.mozilla.org/MPL/>.
// 
// Software distributed under the License is distributed on an "AS IS" basis, WITHOUT
// WARRANTY OF ANY KIND, either express or implied. See the License for the specific
// language governing rights and limitations under the License.
// 
// The Original Code is the Venice Web Communities System.
// 
// The Initial Developer of the Original Code is Eric J. Bowersox <erbo@silcom.com>,
// for Silverwrist Design Studios.  Portions created by Eric J. Bowersox are
// Copyright (C) 2003 Eric J. Bowersox/Silverwrist Design Studios.  All Rights Reserved.
// 
// Contributor(s): 

importPackage(Packages.org.sourceid.sso.xml.lib)
importPackage(Packages.com.silverwrist.dynamo.iface);
importPackage(Packages.com.silverwrist.dynamo.util);

req = bsf.lookupBean("request");           // get request
rhelp = bsf.lookupBean("request_help");    // get request helper
session = rhelp.getSession();              // get the session
user = vlib.getUser(session);

if (user.isAnonymous())
{ // we did not authenticate - bail out
  ar = sourceid.castAuthnRequestType(rhelp.getExternalSessionAttribute("org.sourceid.sso.authnRequest"));
  if (ar==null)
    dynamo.scriptReturn(new Redirect("SERVLET","top.js.vs"));
  else
    dynamo.scriptReturn(new ForwardToServlet("SourceID-SSO-Authenticator"));

} // end if

// Perform the Identity Provider Introduction Protocol, if it's configured.  This involves forwarding to another
// servlet, which will bounce to a common domain, set a cookie, and bounce back here.
if (rhelp.getExternalAppAttribute("org.sourceid.sso.commonDomain")!=null)
{ // only do this once...
  if (rhelp.getExternalSessionAttribute("org.sourceid.sso.IDPIntroductionDone")==null)
  { // We need to construct the return path as an ABSOLUTE URL...
    rewriter = cast.queryURLRewriter(req);
    tmp = rewriter.rewriteURL("SERVLET","sourceid/idp_return_login.js.vs");
    url = "http://" + req.getServerName();
    if ((req.getServerPort()>0) && (req.getServerPort()!=80))
      url += (":" + req.getServerPort() + tmp);
    else
      url += tmp;
    rc = new ForwardToPath("/sso/idpiWriter");
    rc.setParameter("ReturnURL",url);
    dynamo.scriptReturn(rc);

  } // end if

  rhelp.removeExternalSessionAttribute("org.sourceid.sso.IDPIntroductionDone");

} // end if

// If this wasn't the result of an external authentication request, leave.
ar = sourceid.castAuthnRequestType(rhelp.getExternalSessionAttribute("org.sourceid.sso.authnRequest"));
if (ar==null)
  dynamo.scriptReturn(new Redirect("SERVLET","top.js.vs"));

// Tell SourceID that we authenticated with this provider.  Venice uses default password authentication, so
// tell it that as well.
rc = new ForwardToServlet("SourceID-SSO-Authenticator");
rc.setParameter("UserID",user);
rc.setParameter("AuthnMethod","urn:oasis:names:tc:SAML:1.0:am:password");
dynamo.scriptOutput(rc);
