/*
   jGuard is a security framework based on top of jaas (java authentication and authorization security).
   it is written for web applications, to resolve simply, access control problems.
   version $Name$
   http://sourceforge.net/projects/jguard/
   
   Copyright (C) 2004  Charles GAY
   
   This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Lesser General Public
  License as published by the Free Software Foundation; either
  version 2.1 of the License, or (at your option) any later version.
  
  This library is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  Lesser General Public License for more details.
  
  You should have received a copy of the GNU Lesser General Public
  License along with this library; if not, write to the Free Software
  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  
  
  jGuard project home page:
  http://sourceforge.net/projects/jguard/
  
  */
  package net.sf.jguard.ext.authentication.manager;
  
  import java.io.FileWriter;
  import java.io.IOException;
  import java.io.OutputStream;
  import java.security.Principal;
  import java.util.Collection;
  import java.util.HashMap;
  import java.util.HashSet;
  import java.util.Iterator;
  import java.util.List;
  import java.util.Map;
  import java.util.Set;
  
  import java.util.logging.Level;
  import javax.security.auth.Subject;
  
  import net.sf.jguard.core.CoreConstants;
  import net.sf.jguard.core.PolicyEnforcementPointOptions;
  import net.sf.jguard.core.authentication.AuthenticationException;
  import net.sf.jguard.core.authentication.credentials.JGuardCredential;
  import net.sf.jguard.core.authentication.manager.AuthenticationManager;
  import net.sf.jguard.core.organization.Organization;
  import net.sf.jguard.core.organization.OrganizationUtils;
  import net.sf.jguard.core.principals.RolePrincipal;
  import net.sf.jguard.core.provisioning.OrganizationTemplate;
  import net.sf.jguard.core.provisioning.SubjectTemplate;
  import net.sf.jguard.ext.util.SubjectUtils;
  import net.sf.jguard.core.util.XMLUtils;
  
  import org.dom4j.Document;
  import org.dom4j.DocumentHelper;
  import org.dom4j.Element;
  
  import org.dom4j.InvalidXPathException;
  import org.dom4j.XPath;
  import org.dom4j.io.HTMLWriter;
  import org.dom4j.io.OutputFormat;
  import org.dom4j.io.XMLWriter;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  /**
   * AuthenticationManager implementation which persists in an XML repository file.
   * @author <a href="mailto:diabolo512@users.sourceforge.net">Charles Gay</a>
   * @author <a href="mailto:tandilero@users.sourceforge.net">Maximiliano Batelli</a>
   *
   */
  public class XmlAuthenticationManager extends AbstractAuthenticationManager implements AuthenticationManager{
  
          public static final String AUTHENTICATION = "authentication";
  	private static final String PUBLIC_OPTIONAL_CREDENTIALS = "publicOptionalCredentials";
  	private static final String PRIVATE_OPTIONAL_CREDENTIALS = "privateOptionalCredentials";
  	private static final String PUBLIC_REQUIRED_CREDENTIALS = "publicRequiredCredentials";
  	private static final String CRED_TEMPLATE_ID = "credTemplateId";
  	private static final String PRIVATE_REQUIRED_CREDENTIALS = "privateRequiredCredentials";
  	private static final String USER_TEMPLATE = "userTemplate";
  	private static final String VALUE = "value";
  	private static final String ID = "id";
  	private static final String CREDENTIAL = "credential";
          private static final String CREDENTIALS = "credentials";
  	private static final String PRINCIPAL_REF = "principalRef";
  	private static final String PRINCIPALS_REF = "principalsRef";
  	private static final String PUBLIC_CREDENTIALS = "publicCredentials";
  	private static final String PRIVATE_CREDENTIALS = "privateCredentials";
  	private static final String USER = "user";
  	private static final String USERS = "users";
  	private static final String APPLICATION_NAME = "applicationName";
  	private static final String CLASS = "class";
  	private static final String NAME = "name";
  	private static final String ACTIVE = "active";
  	private static final String DEFINITION = "definition";
 	private static final String PRINCIPAL = "principal";
 	private static final String PRINCIPALS = "principals";
         private static final String ORGANIZATIONS = "organizations";
         private static final String ORGANIZATION = "organization";
         private static final String ORGANIZATION_TEMPLATE = "organizationTemplate";
         private static final String ORGANIZATION_REF = "organizationRef";
         
 
 	/** Logger for this class */
 	private static final Logger logger = LoggerFactory.getLogger(XmlAuthenticationManager.class.getName());
         private Document document = null;
         private Element root = null;
         private String fileLocation = null;
 
         //link principals applicationName#name(as keys) and principals objects from multiple applications
         private  Map principals;
         //principals from multiple applications
         private  Set principalsSet;
         private Set users;
 
     
 
      /**
      * initialise the DAO by reading the XML file, and converting it in objects.
      * @see net.sf.jguard.core.authentication.manager.AuthenticationManager#init(java.util.Map)
      */
     public  XmlAuthenticationManager(Map options) {
         super(options);
       
             users = new HashSet();
             principalsSet = new HashSet();
             principals = new HashMap();
             applicationName = (String) options.get(PolicyEnforcementPointOptions.APPLICATION_NAME.getLabel());
 
             debug = Boolean.valueOf((String) options.get("debug")).booleanValue();
             fileLocation = (String) options.get(CoreConstants.AUTHENTICATION_XML_FILE_LOCATION);
 
             if (fileLocation == null) {
                 logger.error(" parameter '" + CoreConstants.AUTHENTICATION_XML_FILE_LOCATION + "' which is null must be specified in the authentication configuration ");
             }
             if (debug && logger.isDebugEnabled()) {
                     logger.debug("initAuthenticationDAO() - fileLocation=" + fileLocation);
             }
 
             document = XMLUtils.read(fileLocation);
             root = document.getRootElement();
 
             //initialize principals
             Map principalsAndOrganizationRefs = initPrincipals(root);
             super.organizationTemplate = getOrganizationTemplate(root);
 
             initOrganizations(root);
 
             resolvePrincipalsOrganizationRefs(principalsAndOrganizationRefs, organizations);
             users = initUsers(root);
 
     }
 	/**
      * persist principal in the XML repository.
      * @param principal to persist
      * @see net.sf.jguard.core.authentication.manager.AuthenticationManager#createPrincipal(net.sf.jguard.core.principals.RolePrincipal)
      */
     protected void persistPrincipal(Principal principal) throws AuthenticationException {
                 Element prpals = root.element(XmlAuthenticationManager.PRINCIPALS);
 		Element newPrincipal = prpals.addElement(XmlAuthenticationManager.PRINCIPAL);
 		Element principalName = newPrincipal.addElement(XmlAuthenticationManager.NAME);
 		principalName.setText(principal.getName());
 
 		Element principalClass = newPrincipal.addElement(XmlAuthenticationManager.CLASS);
 		principalClass.setText(principal.getClass().getName());
 
 		Element appName = newPrincipal.addElement(XmlAuthenticationManager.APPLICATION_NAME);
 		if(principal instanceof RolePrincipal){
 		  appName.setText(((RolePrincipal)principal).getApplicationName());
 		}
 		 try {
 			XMLUtils.write(fileLocation,document);
 		} catch (IOException e) {
 			logger.error(e.getMessage());
 			throw new AuthenticationException(e.getMessage(),e);
                 }
     }
 
 
    
 
     /**
      * update user's informations in the XML repository file.
      * @see net.sf.jguard.core.authentication.manager.AuthenticationManager#updateUser(JGuardCredential, javax.security.auth.Subject)
      */
     protected void updateUserImpl(JGuardCredential identityCred, Subject user) throws AuthenticationException {
     	logger.debug("update user - identityCred ="+identityCred);
         Element userElement = findUser(identityCred);
         if(userElement!=null){
         	deleteUserFromMemory(identityCred);
         	root.element(XmlAuthenticationManager.USERS).elements(XmlAuthenticationManager.USER).remove(userElement);
         	try {
 	       		   XMLUtils.write(fileLocation,document);
 	        } catch (IOException e) {
 	        	   logger.error( "removeUser(Subject)", e);
 	        	   throw new AuthenticationException(e.getMessage());
 	        }
         	persistUser(user);
         }
     }
 
    
 
     /**
      * remove user from users repository stored in memory.
      * @param user to remove
      * @throws AuthenticationException
      */
     private void deleteUserFromMemory(Subject user) throws AuthenticationException{
     	deleteUserFromMemory(extractIdentityCredentialFromUser(user));
     }
 
     /**
      * remove user from users repository stored in memory.
      * @param identityCred 'identity' credential from the user to remove.
      * @throws AuthenticationException
      */
     private void deleteUserFromMemory(JGuardCredential identityCred) throws AuthenticationException{
     	Iterator itUsers= users.iterator();
     	while(itUsers.hasNext()){
     		Subject user = (Subject)itUsers.next();
     	    JGuardCredential credFromUser = extractIdentityCredentialFromUser(user);
     	    if(identityCred.equals(credFromUser)){
     	    	itUsers.remove();
     	    	logger.debug("user with identityCred:"+identityCred.getName()+" ="+identityCred.getValue().toString()+" removed ");
     	    	break;
     	    }
     	}
     }
     
     /**
      * remove the user from the XML repository.
      * @param user to remove
 	 * @throws AuthenticationException
      * @see net.sf.jguard.core.authentication.manager.AuthenticationManager#deleteUser(javax.security.auth.Subject)
      */
     public void deleteUser(Subject user) throws AuthenticationException {
         if(user!= null){
         	deleteUserFromMemory(user);
 
         	Element userElement = findUser(user);
         	if(userElement!= null){
                root.element(XmlAuthenticationManager.USERS).elements(XmlAuthenticationManager.USER).remove(userElement);
 	       	   try {
 	       		   XMLUtils.write(fileLocation,document);
 	           } catch (IOException e) {
 	        	   logger.error( "removeUser(Subject)", e);
 	        	   throw new AuthenticationException(e.getMessage());
 	           }
 
     		}
         }
     }
 
     private Element getOrganization(String organizationId) throws InvalidXPathException {
 
         String xpath = getXpathSearchStringForOrganization(organizationId);
         XPath xp2 = DocumentHelper.createXPath(xpath);
         Map uris = new HashMap();
         uris.put("j", "http://jguard.sourceforge.net/xsd/jGuardUsersPrincipals_1.1.0");
         xp2.setNamespaceURIs(uris);
 
         Element organizationFound = (Element) xp2.selectSingleNode(root);
 
         return organizationFound;
     }
 
     /**
      * find the DOM4J Element corresponding to this Subject, null otherwise.
      * @param user subject we are looking for in the XML repository file.
      * @return Element corresponding to the found user, null if not found.
      * @throws AuthenticationException
      */
     private Element findUser(Subject user)throws AuthenticationException{
 
         JGuardCredential identityCred = extractIdentityCredentialFromUser(user);
 
         return findUser(identityCred);
     }
 
 
     /**
      * return the DOM4J element which match with the identityCredential provided.
      * @param identityCred
      * @return null if no user is found, an Element if user found
      */
 	private Element findUser(JGuardCredential identityCred) {
 		logger.debug("try to find user with identityCredential="+identityCred);
 		Element usersElement = root.element(XmlAuthenticationManager.USERS);
     	List usersElementlist = usersElement.elements(XmlAuthenticationManager.USER);
     	Iterator itUsersList = usersElementlist.iterator();
     	while(itUsersList.hasNext()){
 
     		Element userElement = (Element)itUsersList.next();
     		Element privateCredentialsElement = userElement.element(XmlAuthenticationManager.PRIVATE_CREDENTIALS);
     		Element elt = (Element)privateCredentialsElement.selectSingleNode("./credential[id='"+identityCred.getName()+"' and value='"+identityCred.getValue().toString()+"']");
     		if(elt!=null){
     			logger.debug("user "+userElement+"has been found");
     			return userElement;
     		}
 
 
     		Element publicCredentialsElement = userElement.element(XmlAuthenticationManager.PUBLIC_CREDENTIALS);
     		Element elt2 = (Element)publicCredentialsElement.selectSingleNode("./credential[id='"+identityCred.getName()+"' and value='"+identityCred.getValue().toString()+"']");
     		if(elt2!=null){
     			logger.debug("user "+userElement+"has been found");
     			return userElement;
     		}
     	}
     	//no user has been found
     	logger.debug("no user has been found");
     	return null;
 	}
 
     private Set getCredentialsSet(Element credentialsElement) {
         List credentialsElements = credentialsElement.elements(XmlAuthenticationManager.CREDENTIAL);
         Iterator itCred = credentialsElements.iterator();
         Set credentials = new HashSet();
         while (itCred.hasNext()) {
             Element credentialElement = (Element) itCred.next();
             JGuardCredential credential = new JGuardCredential();
             String id = credentialElement.element(XmlAuthenticationManager.ID).getStringValue();
             String value = credentialElement.element(XmlAuthenticationManager.VALUE).getStringValue();
             credential.setName(id);
             credential.setValue(value);
             credentials.add(credential);
         }
         return credentials;
     }
 
     private Organization getOrganization(Element organizationElement) {
         if(organizationElement==null){
             throw new IllegalArgumentException("organizationElement in argument is null");
         }
         Organization organization = new Organization();
         
         Set ppals = getPrincipalsReference(organizationElement);
         organization.setPrincipals(ppals);
         Element userTemplateElement = organizationElement.element(XmlAuthenticationManager.USER_TEMPLATE);
         SubjectTemplate subjTemplate = buildSubjectTemplateFromElement(userTemplateElement);
         organization.setSubjectTemplate(subjTemplate);
 
         Element credentialsElement = organizationElement.element(XmlAuthenticationManager.CREDENTIALS);
         Set credentials = getCredentialsSet(credentialsElement);
         organization.setCredentials(credentials);
 
         
         return organization;
     }
 
     private Organization getOrganizationPrincipal(Element userElement) {
         String organizationName=  userElement.element(XmlAuthenticationManager.ORGANIZATION_REF).getStringValue();
         Iterator itOrganizations = organizations.iterator();
         while(itOrganizations.hasNext()){
             Organization orga = (Organization)itOrganizations.next();
             if(organizationName.equals(orga.getName())){
                 return orga;
             }
         }
         logger.error(" organization with name"+organizationName+" have not been found");
         return null;
     }
 
     /**
      * @param DOM4J root Element
      * @return OrganizationTemplate parsed by this method 
      */
     private OrganizationTemplate getOrganizationTemplate(Element root) {
         Element organizationsElement = root.element(XmlAuthenticationManager.ORGANIZATIONS);
         Element organizationTemplateElement = organizationsElement.element(XmlAuthenticationManager.ORGANIZATION_TEMPLATE);
         OrganizationTemplate template = new OrganizationTemplate();
         
         Element requiredCredentialsElement = organizationTemplateElement.element(XmlAuthenticationManager.CREDENTIALS);
         List reqCredsElement = requiredCredentialsElement.elements(XmlAuthenticationManager.CRED_TEMPLATE_ID);
         Set reqCreds = getJGuardCredentialList(reqCredsElement);
         template.setCredentials(reqCreds);
         
         Set orgaTemplatePrincipals = getPrincipalsReference(organizationTemplateElement);
         template.setPrincipals(orgaTemplatePrincipals);
         SubjectTemplate subjTemplate = getSubjectTemplate(organizationTemplateElement);
         
         template.setSubjectTemplate(subjTemplate);
         return template;
     }
 
     /**
      * parse the DOM4J element and build the set of <i>RolePrincipal</i> referenced in
      * the element.
      * @param Element containing the <i>principalsRef</i> DOM4J Element.
      * @return Set of RolePrincipal
      */ 
     private Set getPrincipalsReference(Element parentElement) {
         
         Set userPrincipals = new HashSet();
 
         Element principalsRefElement = parentElement.element(XmlAuthenticationManager.PRINCIPALS_REF);
         List userPrincipalsRefElement = principalsRefElement.elements(XmlAuthenticationManager.PRINCIPAL_REF);
         Iterator itUserPrincipals = userPrincipalsRefElement.iterator();
         while (itUserPrincipals.hasNext()) {
             Element principalElement = (Element) itUserPrincipals.next();
             String principalName = principalElement.attributeValue(XmlAuthenticationManager.NAME);
             String principalApplicationName = principalElement.attributeValue(XmlAuthenticationManager.APPLICATION_NAME);
             //if the applicationName is not set, the current applicationName is implied
             if (principalApplicationName == null) {
                 principalApplicationName = super.applicationName;
             }
             String definition = principalElement.attributeValue(XmlAuthenticationManager.DEFINITION);
             String active = principalElement.attributeValue(XmlAuthenticationManager.ACTIVE);
 
             RolePrincipal principal = new RolePrincipal();
             principal.setLocalName(principalName);
             principal.setApplicationName(principalApplicationName);
             principal.setDefinition(definition);
             if((XmlAuthenticationManager.PRINCIPALS).equals(parentElement.getName())){
                 Element organizationRefElement = principalElement.element(XmlAuthenticationManager.ORGANIZATION_REF);
                 String organizationRefId = organizationRefElement.getStringValue();
                 Organization organization = OrganizationUtils.findOrganization(organizations, organizationRefId);
                 principal.setOrganization(organization);
             }
             if ("true".equalsIgnoreCase(active)) {
                 principal.setActive(true);
             } else {
                 principal.setActive(false);
             }
             userPrincipals.add(principal);
         }
         return userPrincipals;
     }
 
     private String getXpathSearchStringForOrganization(String organizationId) {
         String xpath ="/j:authentication/j:organizations/j:organization/j:credentials/j:credential[j:id='id' and j:value='"+organizationId+"']/../..";
         return xpath;
     }
 
     private void initOrganizations(Element root) {
         Element organizationsElement = root.element(XmlAuthenticationManager.ORGANIZATIONS);
         List organizationsList = organizationsElement.elements(XmlAuthenticationManager.ORGANIZATION);
         Iterator itOrganizationsList = organizationsList.iterator();
         while (itOrganizationsList.hasNext()) {
             Element organizationElement = (Element) itOrganizationsList.next();
             Organization organization = getOrganization(organizationElement);
             organizations.add(organization);
         }
 
     }
 
     /**
      * initialize principals.
      * @param root dom4j element
      */
     private Map initPrincipals(Element root){
         Element principalsElement = root.element(XmlAuthenticationManager.PRINCIPALS);
         List principalsList = principalsElement.elements(XmlAuthenticationManager.PRINCIPAL);
         Iterator itPrincipalsList = principalsList.iterator();
         Map principalsAndOrganizationRefs = new HashMap();
         while(itPrincipalsList.hasNext()){
             Element principalElement = (Element)itPrincipalsList.next();
             String principalClass = principalElement.element(XmlAuthenticationManager.CLASS).getStringValue();
             if(!RolePrincipal.class.getName().equals(principalClass)){
                 throw new IllegalArgumentException("class=+"+principalClass +"is unsupported ; only class="+RolePrincipal.class.getName()+" is supported");
             }
             RolePrincipal principal = new RolePrincipal();
             principal.setLocalName(principalElement.element(XmlAuthenticationManager.NAME).getStringValue());
             Element applicationNameElement = principalElement.element(XmlAuthenticationManager.APPLICATION_NAME);
             principal.setApplicationName(applicationNameElement.getStringValue());
             Element organizationRefElement = principalElement.element(XmlAuthenticationManager.ORGANIZATION_REF);
             String organizationRefId = organizationRefElement.getStringValue();
             principalsAndOrganizationRefs.put(principal, organizationRefId);
             principals.put(principal.getName(),principal);
             principalsSet.add(principal);
             if(principal.getApplicationName().equals(applicationName)){
                 localPrincipalsSet.add(principal);
                 localPrincipals.put(principal.getName(),principal);
             }
         }
         
         return principalsAndOrganizationRefs;
 
     }
 
     /**
      * initialize users.
      * @param root dom4j element
      * @return users Set
      */
     private Set initUsers(Element root) {
         Element usersElement = root.element(XmlAuthenticationManager.USERS);
         List usersList = usersElement.elements(XmlAuthenticationManager.USER);
         Iterator itUsersList = usersList.iterator();
 
         while(itUsersList.hasNext()){
             Element userElement = (Element)itUsersList.next();
 
             Set privateCredentials;
             
             Element privateCredentialsElement = userElement.element(XmlAuthenticationManager.PRIVATE_CREDENTIALS);
             privateCredentials = getCredentialsSet(privateCredentialsElement);
 
             Set publicCredentials;
             Element publicCredentialsElement = userElement.element(XmlAuthenticationManager.PUBLIC_CREDENTIALS);
             publicCredentials = getCredentialsSet(publicCredentialsElement);
             Set userPrincipals = getPrincipalsReference(userElement);
             Organization organization = getOrganizationPrincipal(userElement);
             //set of RolePrincipal granted to the organization 
             Set organizationPrincipals = organization.getPrincipals();
             //we check that RolePrincipals granted to the user are a subset of 
             //RolePrincipals granted to the organization: we remove Roleprincipals
             //not granted to the organization
             userPrincipals.retainAll(new HashSet(organizationPrincipals));
             
             //we add the organization Principal to the user to be reach in contextual permissions
             userPrincipals.add(organization);
                         
             //subject is not in read-only mode
             Subject  user = new Subject(false,userPrincipals,publicCredentials,privateCredentials);
             if(userPrincipals.size()<=1){
                 JGuardCredential cred = SubjectUtils.getIdentityCredential(user, this);
                 logger.warn(" user "+cred.getName()+"="+cred.getValue()+" hasn't got any RolePrincipals granted (no roles owned by his organization is granted to him) ");
             }
             users.add(user);
         }
 
         return users;
     }
 
     /**
      * construct from configuration file the subjectTemplate.
      * @return Subject template built
      * @throws AuthenticationException
      */
     public SubjectTemplate getSubjectTemplate(Element organizationNode){
     
         Element subjectTemplateElement = organizationNode.element(XmlAuthenticationManager.USER_TEMPLATE);
         SubjectTemplate st = buildSubjectTemplateFromElement(subjectTemplateElement);
     	return st;
     }
 
 
 	private SubjectTemplate buildSubjectTemplateFromElement(Element userTemplate) {
 	Element privateRequiredCredentials = userTemplate.element(XmlAuthenticationManager.PRIVATE_REQUIRED_CREDENTIALS);
         List privReqCreds = privateRequiredCredentials.elements(XmlAuthenticationManager.CRED_TEMPLATE_ID);
         Set privReqCreds2 = getJGuardCredentialList(privReqCreds);
         Element publicRequiredCredentials = userTemplate.element(XmlAuthenticationManager.PUBLIC_REQUIRED_CREDENTIALS);
         List pubReqCreds = publicRequiredCredentials.elements(XmlAuthenticationManager.CRED_TEMPLATE_ID);
         Set pubReqCreds2 = getJGuardCredentialList(pubReqCreds);
         Element privateOptionalCredentials = userTemplate.element(XmlAuthenticationManager.PRIVATE_OPTIONAL_CREDENTIALS);
         List privOptCreds = privateOptionalCredentials.elements(XmlAuthenticationManager.CRED_TEMPLATE_ID);
         Set privOptCreds2 = getJGuardCredentialList(privOptCreds);
         Element publicOptionalCredentials = userTemplate.element(XmlAuthenticationManager.PUBLIC_OPTIONAL_CREDENTIALS);
         List pubOptCreds = publicOptionalCredentials.elements(XmlAuthenticationManager.CRED_TEMPLATE_ID);
         Set pubOptCreds2 = getJGuardCredentialList(pubOptCreds);
         SubjectTemplate st = new SubjectTemplate();
         st.setPrivateRequiredCredentials(privReqCreds2);
         st.setPublicRequiredCredentials(pubReqCreds2);
         st.setPrivateOptionalCredentials(privOptCreds2);
         st.setPublicOptionalCredentials(pubOptCreds2);
 
         List principalElements = userTemplate.element(XmlAuthenticationManager.PRINCIPALS_REF).elements(XmlAuthenticationManager.PRINCIPAL_REF);
         Set genPpals = getPrincipals(principalElements);
         st.setPrincipals(genPpals);
         
 		return st;
 	}
 
 
     /**
      * return a Set of Principals referenced in a <i>principalsRef<i/> 
      * element.
      * @param genericPrincipalElements
      * @return
      */
     private Set getPrincipals(List principalElements){
         Set ppals = new HashSet();
         Iterator principalsIterator = principalElements.iterator();
         while(principalsIterator.hasNext()){
         	Element ppalElement = (Element)principalsIterator.next();
             Principal ppal = (Principal)principals.get(ppalElement.attribute(APPLICATION_NAME).getData()+"#"+ppalElement.attribute(NAME).getData());
             if(ppal!=null){
             	ppals.add(ppal);
             }
         }
 
     	return ppals;
     }
     /**
      * transform a list of DOM4J elements into a Set of JGuardCredentials.
      * @param credTemplateIdElements list of DOM4J elements
      * @return Set of jGuardCredentials
      */
     private Set getJGuardCredentialList(List credTemplateIdElements){
     	Iterator it = credTemplateIdElements.iterator();
     	Set jguardCredlist = new HashSet();
     	while(it.hasNext()){
     		Element credElement = (Element)it.next();
     		JGuardCredential jcred = new JGuardCredential();
     		String id = credElement.getText();
                 if(id.equals("id")){
                     jcred.setValue("template");
                 }
     		jcred.setName(id);
     		jguardCredlist.add(jcred);
     	}
     	return jguardCredlist;
     }
 
     /**
      * persist user into the XML repository file.
      * @param user
      * @throws AuthenticationException
      */
 	protected void persistUser(Subject user) throws AuthenticationException {
 		Element xmlUsers = root.element(XmlAuthenticationManager.USERS);
 		Element newUser = xmlUsers.addElement(XmlAuthenticationManager.USER);
 		Element privateCredentials = newUser.addElement(XmlAuthenticationManager.PRIVATE_CREDENTIALS);
 		Set privCredentialsSet  = user.getPrivateCredentials(JGuardCredential.class);
 		persistCredentialsSet(privCredentialsSet,privateCredentials);
 
 		Element publicCredentials = newUser.addElement(XmlAuthenticationManager.PUBLIC_CREDENTIALS);
 		Set pubCredentials  = user.getPublicCredentials(JGuardCredential.class);
 		persistCredentialsSet(pubCredentials,publicCredentials);
 
 		Element ppals = newUser.addElement(XmlAuthenticationManager.PRINCIPALS_REF);
 		Set prpals = user.getPrincipals();
 		persistPrincipalRefs(prpals,ppals);
                 
                 Set organizations = user.getPrincipals(Organization.class);
                 if(organizations.size()!=1){
                     throw new IllegalArgumentException("user"+user+"hasn't got one Organization but "+organizations.size()+" organizations ");
                 }
                 Organization orga = (Organization)organizations.iterator().next();
                 Element organizationRef = newUser.addElement(XmlAuthenticationManager.ORGANIZATION_REF);
                 organizationRef.setText(orga.getName());
                 
 	    try {
         	XMLUtils.write(fileLocation,document);
             //add the user to the in-memory users repository
             this.users.add(user);
         } catch (IOException e) {
 			logger.error( "persistUser(Subject)", e);
 			throw new AuthenticationException(e.getMessage());
         }
 	}
 
     private void persistCredentialTemplates(Set credentials, Element subjectTemplateElement, String credentialConstant) {
         Element credentialsElement = subjectTemplateElement.addElement(credentialConstant);
         if(credentialsElement==null){
             logger.debug("credentialTemplateID element in XML "+credentialConstant+" is null");
             return;
         }
         if(credentials==null || credentials.size()==0){
             logger.debug("credentials"+credentialConstant+" in Object is null or empty");
             return;
         }
         Iterator credentialIterator = credentials.iterator();
         while (credentialIterator.hasNext()) {
             JGuardCredential cred = (JGuardCredential) credentialIterator.next();
             Element cred1 = credentialsElement.addElement(XmlAuthenticationManager.CRED_TEMPLATE_ID);
             cred1.setText(cred.getName());
         }
     }
 
     private void persistOrganization(Organization organization, Element organizationElement) throws AuthenticationException{
         SubjectTemplate template = organization.getSubjectTemplate();
         if(template==null){
             throw new IllegalArgumentException("SubejctTemplate is null into Organization "+organization);
         }
         persistSubjectTemplate(organizationElement,template);
 
         Element newCredentialsElement = organizationElement.addElement(XmlAuthenticationManager.CREDENTIALS);
 
         Set credentials = organization.getCredentials();
         Iterator itCreds = credentials.iterator();
         while (itCreds.hasNext()) {
             JGuardCredential cred = (JGuardCredential) itCreds.next();
             Element credElement = newCredentialsElement.addElement(XmlAuthenticationManager.CREDENTIAL);
             Element idElement = credElement.addElement(XmlAuthenticationManager.ID);
             idElement.setText(cred.getName());
             Element valueElement = credElement.addElement(XmlAuthenticationManager.VALUE);
             valueElement.setText(cred.getValue().toString());
         }
 
         Element principalsRefElement = organizationElement.addElement(XmlAuthenticationManager.PRINCIPALS_REF);
         Set orgaPrincipals = organization.getPrincipals();
         Iterator itOrgaPrincipals = orgaPrincipals.iterator();
         while (itOrgaPrincipals.hasNext()) {
             RolePrincipal ppal = (RolePrincipal) itOrgaPrincipals.next();
             Element principalRefElement = principalsRefElement.addElement(XmlAuthenticationManager.PRINCIPAL_REF);
             principalRefElement.addAttribute(XmlAuthenticationManager.NAME, ppal.getLocalName());
             principalRefElement.addAttribute(XmlAuthenticationManager.APPLICATION_NAME, ppal.getApplicationName());
             principalRefElement.addAttribute(XmlAuthenticationManager.DEFINITION, ppal.getDefinition());
             principalRefElement.addAttribute(XmlAuthenticationManager.ACTIVE, ppal.isActive() == true ? "true" : "false");
         }
          try {
             XMLUtils.write(fileLocation,document);
 	 } catch (IOException e) {
             logger.error(e.getMessage());
             throw new AuthenticationException(e.getMessage());
          }
     }
 
 	/**
          * persist principals into the XML repository file.
 	 * @param principals
 	 * @param <i>principalsRef</i> Element
 	 */
 	private void persistPrincipalRefs(Set principals, Element ppals) {
 		
 		Iterator itPrincipals = principals.iterator();
 		while(itPrincipals.hasNext()){
 			Principal ppal = (Principal)itPrincipals.next();
 			if(ppal instanceof RolePrincipal) {
 				RolePrincipal jppal = (RolePrincipal)ppal;
 				Element principal = ppals.addElement(XmlAuthenticationManager.PRINCIPAL_REF);
 				principal.addAttribute(XmlAuthenticationManager.NAME, jppal.getLocalName());
 				principal.addAttribute(XmlAuthenticationManager.APPLICATION_NAME, jppal.getApplicationName());
 				principal.addAttribute(XmlAuthenticationManager.DEFINITION, jppal.getDefinition());
 				principal.addAttribute(XmlAuthenticationManager.ACTIVE, jppal.isActive()==true?"true":"false");
 			}
 		}
 
 	}
 
         
         
 	/**
 	 * persist a jGuardCredential set into the XML subset corresponding to the
 	 * credentialsSetElement.
 	 * @param credentials
 	 * @param credentialsSetElement
 	 */
 	private void persistCredentialsSet(Set credentials,Element credentialsSetElement){
 		Iterator itPubCredentials = credentials.iterator();
 		while(itPubCredentials.hasNext()){
 			JGuardCredential jcred2 = (JGuardCredential)itPubCredentials.next();
 			Element credential = credentialsSetElement.addElement(XmlAuthenticationManager.CREDENTIAL);
 		    Element id = credential.addElement(XmlAuthenticationManager.ID);
 		    id.setText(jcred2.getName());
 		    Element value = credential.addElement(XmlAuthenticationManager.VALUE);
 		    value.setText(jcred2.getValue().toString());
 		}
 
 	}
 
 
 	/**
 	 * define and persist the SubjectTemplate for registration.
 	 * @param template
 	 */
 	public void persistSubjectTemplate(Element organizationElement, SubjectTemplate template) {
              Element subjectTemplateElement = organizationElement.addElement(XmlAuthenticationManager.USER_TEMPLATE);
              if(subjectTemplateElement == null){
                  throw new IllegalArgumentException(" subjectTemplate is not present into organizationElement "+organizationElement.getName());
              }
              
              if(template == null){
                  throw new IllegalArgumentException(" SubjectTemplate is null");
              }
              persistCredentialTemplates(template.getPrivateRequiredCredentials(), subjectTemplateElement, XmlAuthenticationManager.PRIVATE_REQUIRED_CREDENTIALS);
              persistCredentialTemplates(template.getPublicRequiredCredentials(), subjectTemplateElement, XmlAuthenticationManager.PUBLIC_REQUIRED_CREDENTIALS);
              persistCredentialTemplates(template.getPrivateOptionalCredentials(), subjectTemplateElement, XmlAuthenticationManager.PRIVATE_OPTIONAL_CREDENTIALS);
              persistCredentialTemplates(template.getPublicOptionalCredentials(), subjectTemplateElement, XmlAuthenticationManager.PUBLIC_OPTIONAL_CREDENTIALS);
              Element principalsRefElement = subjectTemplateElement.addElement(XmlAuthenticationManager.PRINCIPALS_REF);
              persistPrincipalRefs(template.getPrincipals(),principalsRefElement);
 	}
 
 	/**
 	 * @return <i>true</i> if there is no principals and no permissions.
 	 * <i>false</i> otherwise.
 	 */
 	public boolean isEmpty() {
             Element principalsElement = root.element(XmlAuthenticationManager.PRINCIPALS);
             List principalsList = principalsElement.elements(XmlAuthenticationManager.PRINCIPAL);
             
             
             Element usersElement = root.element(XmlAuthenticationManager.USERS);
             List usersList = usersElement.elements(XmlAuthenticationManager.USER);
             
             if(!principalsList.isEmpty()&&!usersList.isEmpty()){
                 return false;
             }
 		return true;
 
 	}
 
 
 
 
     public Set getAllPrincipalsSet(){
     	return principalsSet;
     }
 
 
 
 
     /**
      *  search the users which matches credentials criterions.
      * @param credentials crierions used to grab the users
      * @return users found
      */
     public Set findUsers(Collection privateCredentials,Collection publicCredentials){
     	Set usersFound = new HashSet();
         Iterator it = users.iterator();
         while(it.hasNext()){
         	Subject user = (Subject)it.next();
             Iterator privItCred = privateCredentials.iterator();
             boolean userFound = true;
             while(privItCred.hasNext()){
             	JGuardCredential jcred = (JGuardCredential)privItCred.next();
                 if(user.getPrivateCredentials().contains(jcred)){
                   continue;
                 }else{
                      userFound = false;
                 }
             }
             if(userFound==false){
                 //Subject in evaluation does not match private credentials constraints
                 //we skip it and evaluate the next subject
                 continue;
             }
             Iterator pubItCred = publicCredentials.iterator();
             
             while(pubItCred.hasNext()){
             	JGuardCredential jcred = (JGuardCredential)pubItCred.next();
                 if(user.getPublicCredentials().contains(jcred)){
                   continue;
                 }else{
                      userFound = false;
                 }
             }
 
             if(userFound==true){
                 //Subject in evaluation matches private and public credentials constraints
             	usersFound.add(user);
             }
         }
     	return usersFound;
     }
 
 	public Set getUsers() {
 		return users;
 	}
 
 
 	public void updatePrincipal(String oldPrincipalName, Principal principal) {
             Principal oldPal = (Principal)principals.remove(oldPrincipalName);
             if(oldPal==null){
                     logger.warn(" principal "+oldPrincipalName+" cannot be updated because it does not exists ");
                     return;
             }
             principalsSet.remove(oldPal);
             principals.put(principal.getName(),principal);
             principalsSet.add(principal);
             
             if(isRoleAndLocal(oldPal) && localPrincipalsSet.contains(oldPal)){
                 localPrincipalsSet.remove(oldPal);
                 localPrincipals.put(principal.getName(),principal);
                 localPrincipalsSet.add(principal);
             }
             try {
                     XMLUtils.write(fileLocation,document);
             } catch (IOException e) {
                             logger.error( "updateRole(String, RolePrincipal)", e);
             }
 
 	}
 
 
 	public boolean deletePrincipal(Principal principal) throws AuthenticationException {
             Principal ppalReference = (Principal)principals.remove(principal.getName());
             if(ppalReference==null){
                     return false;
             }
             principalsSet.remove(ppalReference);
             
             if(isRoleAndLocal(principal)&& localPrincipalsSet.contains(principal)){
                  localPrincipalsSet.remove(principal);
                  localPrincipals.remove(principal);
             }
             Element principalsElement = root.element("principals");
             Element principalElement = (Element)principalsElement.selectSingleNode("//principal[name='"+principal.getName()+"']");
             principalsElement.remove(principalElement);
             if(ppalReference.getClass().equals(RolePrincipal.class)){
               //delete all the references of this principal
               XMLUtils.deletePrincipalRefs(root,(RolePrincipal)ppalReference);
             }
             try {
                     XMLUtils.write(fileLocation,document);
             } catch (IOException e) {
                             logger.error( "deletePrincipal(String)", e);
                             throw new AuthenticationException(e.getMessage());
             }
             return true;
 
 	}
 
 	
 	public String exportAsXMLString(){
 		return document.asXML();
 	}
 	
 	public void writeAsXML(OutputStream outputStream, String encodingScheme) throws IOException  {
 	   OutputFormat outformat = OutputFormat.createPrettyPrint();
 	   outformat.setEncoding(encodingScheme);
 	   XMLWriter writer = new XMLWriter(outputStream, outformat);
 	   writer.write(this.document);
 	   writer.flush();
 	}
 
 
 	
 	public void writeAsHTML(OutputStream outputStream) throws IOException{
 		 HTMLWriter writer = new HTMLWriter(outputStream,OutputFormat.createPrettyPrint());
 		 writer.write(this.document);
 		 writer.flush();
 	}
 
 
 	public void exportAsXMLFile(String fileName) throws IOException {
 		XMLWriter xmlWriter = new XMLWriter(new FileWriter(fileName), OutputFormat.createPrettyPrint());
 		xmlWriter.write(document);
 		xmlWriter.close();
 	}
 
     public void persistUserLoginAttempt(String login, String hostAddress, String hostName, boolean succeeded, long timeStamp) throws AuthenticationException {
         System.out.println(" persistUserLoginAttempt not yet implemented  in XmlAuthenticationManager ");
     }
 
      public void persistUserLogoutAttempt(String login, String hostAddress, String hostName, long timeStamp) throws AuthenticationException {
         System.out.println(" persistUserLogoutAttempt not yet implemented  in XmlAuthenticationManager ");
     }
    
 
     public void deleteOrganization(Organization organisation) {
         String credId = organisation.getName();
         Element organizationElement = getOrganization(credId);
         root.remove(organizationElement);
     }
 
     public void updateOrganization(String organizationId, Organization organization) throws AuthenticationException {
         Element organizationElement = getOrganization(organizationId);
         if(organizationElement==null){
             throw new IllegalArgumentException("organization cannot be updated : it doesn't exist ");
         }
         
         //remove userTemplate
         Element userTemplate = organizationElement.element(XmlAuthenticationManager.USER_TEMPLATE);
         if(userTemplate!=null){
             organizationElement.remove(userTemplate);
         }
         
         //remove credentilasElement
         Element credentialsElement = organizationElement.element(XmlAuthenticationManager.CREDENTIALS);
         organizationElement.remove(credentialsElement);
         
         Element oldPrincipalsRefElement = organizationElement.element(XmlAuthenticationManager.PRINCIPALS_REF);
         organizationElement.remove(oldPrincipalsRefElement);
         persistOrganization(organization, organizationElement);
     }
     
     
     public Organization findOrganization(String organizationId) {
         
         Element organizationFound  = getOrganization(organizationId);
         
         if(organizationFound==null){
             return null;
         }
         Organization orgaFound = getOrganization(organizationFound);
         return orgaFound;
         
     }
     
     protected void persistOrganization(Organization organization) throws AuthenticationException {
         String id = organization.getName();
         String xpath = getXpathSearchStringForOrganization(id);
         logger.debug("id for organization ="+id);
         logger.debug("xpath for organization ="+xpath);
         Element organizationElement  = root.element(xpath);
         if(organizationElement==null){
             Element organizationsElement = root.element(ORGANIZATIONS);
             organizationElement = organizationsElement.addElement(ORGANIZATION);
         }
         persistOrganization(organization, organizationElement);
     }
 
     public Set getOrganizations() throws AuthenticationException{
         return organizations;
     }
 
     private void resolvePrincipalsOrganizationRefs(Map principalsAndOwners, Set organizations) {
         Iterator it = principalsAndOwners.entrySet().iterator();
         while(it.hasNext()){
             Map.Entry entry = (Map.Entry)it.next();
             RolePrincipal principal = (RolePrincipal)entry.getKey();
             String organizationId = (String)entry.getValue();
             Organization orgaFound = OrganizationUtils.findOrganization(organizations, organizationId);
             principal.setOrganization(orgaFound);
         }
     }
 
     public Collection findOrganizations(Collection credentials)throws AuthenticationException {
      	Set organizationsFound = new HashSet();
         Iterator it = organizations.iterator();
         while(it.hasNext()){
         	Organization organization = (Organization)it.next();
             Iterator itCred = credentials.iterator();
             boolean organizationFound = true;
             while(itCred.hasNext()){
             	JGuardCredential jcred = (JGuardCredential)itCred.next();
                 if(organization.getCredentials().contains(jcred)){
                   continue;
                 }else{
                      organizationFound = false;
                 }
             }
 
             if(organizationFound==true){
             	organizationsFound.add(organization);
             }
         }
     	return organizationsFound;
     }
 
     public void setOrganizationTemplate(OrganizationTemplate organizationTemplate) throws AuthenticationException {
         Element organizationsElement = root.element(XmlAuthenticationManager.ORGANIZATIONS);
         Element organizationTemplateElement = organizationsElement.element(XmlAuthenticationManager.ORGANIZATION_TEMPLATE);
                 
         Element requiredCredentialsElement = organizationTemplateElement.element(XmlAuthenticationManager.CREDENTIALS);
         
         List reqCredsElement = requiredCredentialsElement.elements(XmlAuthenticationManager.CRED_TEMPLATE_ID);
         Iterator it = reqCredsElement.iterator();
         while(it.hasNext()){
             Element elt = (Element)it.next();
             requiredCredentialsElement.remove(elt);
         }
         
         Set creds = organizationTemplate.getCredentials();
         Iterator itCreds = creds.iterator();
         while(itCreds.hasNext()){
             JGuardCredential cred = (JGuardCredential)itCreds.next();
             String name = cred.getName();
             Element credTemplateId = requiredCredentialsElement.addElement(XmlAuthenticationManager.CRED_TEMPLATE_ID);
             credTemplateId.setText(name);
         }
         
         persistPrincipalRefs(organizationTemplate.getPrincipals(), organizationTemplateElement);
         persistSubjectTemplate(organizationTemplateElement, organizationTemplate.getSubjectTemplate());
         
         
     }
 
    
 }