Adds session authentication upon NewUserConnections. Adds user key authentication (in safemode only) upon CreateChildAgents. All of this for Hypergrid users too. This addresses assorted spoofing vulnerabilities.

7 files changed, 291 insertions, 114 deletions

diff --git a/OpenSim/Region/Communications/Hypergrid/HGCommunicationsGridMode.cs b/OpenSim/Region/Communications/Hypergrid/HGCommunicationsGridMode.cs
index d1be94f..2ef0fd3 100644
--- a/OpenSim/Region/Communications/Hypergrid/HGCommunicationsGridMode.cs
+++ b/OpenSim/Region/Communications/Hypergrid/HGCommunicationsGridMode.cs
@@ -59,6 +59,7 @@ namespace OpenSim.Region.Communications.Hypergrid
 
             // The HG InventoryService always uses secure handlers
             HGInventoryServiceClient invService = new HGInventoryServiceClient(serversInfo.InventoryURL, this.m_userProfileCacheService, true);
+            invService.UserProfileCache = m_userProfileCacheService; 
             AddSecureInventoryService(invService);
             m_defaultInventoryHost = invService.Host;
             if (SecureInventoryService != null)
diff --git a/OpenSim/Region/Communications/Hypergrid/HGInventoryService.cs b/OpenSim/Region/Communications/Hypergrid/HGInventoryService.cs
index 5e3f229..156137e 100644
--- a/OpenSim/Region/Communications/Hypergrid/HGInventoryService.cs
+++ b/OpenSim/Region/Communications/Hypergrid/HGInventoryService.cs
@@ -62,7 +62,7 @@ namespace OpenSim.Region.Communications.Hypergrid
         {
             _inventoryServerUrl = HGNetworkServersInfo.ServerURI(inventoryServerUrl);
             //m_Uri = new Uri(_inventoryServerUrl);
-            m_userProfileCache = userProfileCacheService;
+            //m_userProfileCache = userProfileCacheService;
             m_gridmode = gridmode;
         }
 
@@ -506,6 +506,9 @@ namespace OpenSim.Region.Communications.Hypergrid
 
         private bool IsLocalStandaloneUser(UUID userID)
         {
+            if (m_userProfileCache == null)
+                return false;
+
             CachedUserInfo uinfo = m_userProfileCache.GetUserDetails(userID);
             if (uinfo == null)
                 return true;
@@ -522,6 +525,7 @@ namespace OpenSim.Region.Communications.Hypergrid
         private string GetUserInventoryURI(UUID userID)
         {
             string invURI = _inventoryServerUrl;
+
             CachedUserInfo uinfo = m_userProfileCache.GetUserDetails(userID);
             if ((uinfo == null) || (uinfo.UserProfile == null))
                 return invURI;
diff --git a/OpenSim/Region/Communications/Hypergrid/HGUserServices.cs b/OpenSim/Region/Communications/Hypergrid/HGUserServices.cs
index ef08421..05ae5a9 100644
--- a/OpenSim/Region/Communications/Hypergrid/HGUserServices.cs
+++ b/OpenSim/Region/Communications/Hypergrid/HGUserServices.cs
@@ -31,7 +31,10 @@ using System.Collections.Generic;
 using OpenMetaverse;
 using OpenSim.Framework;
 using OpenSim.Framework.Communications;
+using OpenSim.Framework.Communications.Cache;
+using OpenSim.Framework.Communications.Clients;
 using OpenSim.Region.Communications.OGS1;
+using OpenSim.Region.Communications.Local;
 
 namespace OpenSim.Region.Communications.Hypergrid
 {
@@ -40,32 +43,30 @@ namespace OpenSim.Region.Communications.Hypergrid
     /// so it always fails for foreign users.
     /// Later it needs to talk with the foreign users' user servers.
     /// </summary>
-    public class HGUserServices : IUserService, IAvatarService, IMessagingService
+    public class HGUserServices : OGS1UserServices
     {
         //private static readonly ILog m_log = LogManager.GetLogger(MethodBase.GetCurrentMethod().DeclaringType);
 
-        //private HGCommunicationsGridMode m_parent;
-        private OGS1UserServices m_remoteUserServices;
+        //private CommunicationsManager m_parent;
+        //private OGS1UserServices m_remoteUserServices;
+        private LocalUserServices m_localUserServices;
 
-        public HGUserServices(HGCommunicationsGridMode parent)
+        // Constructor called when running in grid mode
+        public HGUserServices(CommunicationsManager parent)
+            : base(parent)
         {
-            //m_parent = parent;
-            m_remoteUserServices = new OGS1UserServices(parent);
         }
 
-        public UserProfileData ConvertXMLRPCDataToUserProfile(Hashtable data)
+        // Constructor called when running in standalone
+        public HGUserServices(LocalUserServices local)
         {
-            return m_remoteUserServices.ConvertXMLRPCDataToUserProfile(data);
+            m_localUserServices = local;
         }
 
-        public UserProfileData GetUserProfile(Uri uri)
+        // Called for standalone mode only, to set up the communications manager
+        public void SetCommunicationsManager(CommunicationsManager parent)
         {
-            throw new System.NotImplementedException();
-        }
-
-        public Uri GetUserUri(UserProfileData userProfile)
-        {
-            throw new NotImplementedException();
+            m_commsManager = parent;
         }
 
         /// <summary>
@@ -73,25 +74,15 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="avatarID"></param>
         /// <returns>null if the request fails</returns>
-        public UserAgentData GetAgentByUUID(UUID userId)
+        public override UserAgentData GetAgentByUUID(UUID userId)
         {
-            return m_remoteUserServices.GetAgentByUUID(userId);
-        }
-
-        public AvatarAppearance ConvertXMLRPCDataToAvatarAppearance(Hashtable data)
-        {
-            return m_remoteUserServices.ConvertXMLRPCDataToAvatarAppearance(data);
-        }
+            string url = string.Empty;
+            if ((m_localUserServices != null) && !IsForeignUser(userId, out url))
+                return m_localUserServices.GetAgentByUUID(userId);
 
-        public List<AvatarPickerAvatar> ConvertXMLRPCDataToAvatarPickerList(UUID queryID, Hashtable data)
-        {
-            return m_remoteUserServices.ConvertXMLRPCDataToAvatarPickerList(queryID, data);
+            return base.GetAgentByUUID(userId);
         }
 
-        public List<FriendListItem> ConvertXMLRPCDataToFriendListItemList(Hashtable data)
-        {
-            return m_remoteUserServices.ConvertXMLRPCDataToFriendListItemList(data);
-        }
 
         /// <summary>
         /// Logs off a user on the user server
@@ -101,9 +92,13 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// <param name="regionhandle">regionhandle</param>
         /// <param name="position">final position</param>
         /// <param name="lookat">final lookat</param>
-        public void LogOffUser(UUID userid, UUID regionid, ulong regionhandle, Vector3 position, Vector3 lookat)
+        public override void LogOffUser(UUID userid, UUID regionid, ulong regionhandle, Vector3 position, Vector3 lookat)
         {
-            m_remoteUserServices.LogOffUser(userid, regionid, regionhandle, position, lookat);
+            string url = string.Empty;
+            if ((m_localUserServices != null) && !IsForeignUser(userid, out url))
+                m_localUserServices.LogOffUser(userid, regionid, regionhandle, position, lookat);
+            else
+                base.LogOffUser(userid, regionid, regionhandle, position, lookat);
         }
 
         /// <summary>
@@ -115,19 +110,29 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// <param name="posx">final position x</param>
         /// <param name="posy">final position y</param>
         /// <param name="posz">final position z</param>
-        public void LogOffUser(UUID userid, UUID regionid, ulong regionhandle, float posx, float posy, float posz)
+        public override void LogOffUser(UUID userid, UUID regionid, ulong regionhandle, float posx, float posy, float posz)
         {
-            m_remoteUserServices.LogOffUser(userid, regionid, regionhandle, posx, posy, posz);
+            string url = string.Empty;
+            if ((m_localUserServices != null) && !IsForeignUser(userid, out url))
+                m_localUserServices.LogOffUser(userid, regionid, regionhandle, posx, posy, posz);
+            else
+                base.LogOffUser(userid, regionid, regionhandle, posx, posy, posz);
         }
 
-        public UserProfileData GetUserProfile(string firstName, string lastName)
+        public override UserProfileData GetUserProfile(string firstName, string lastName)
         {
+            if (m_localUserServices != null)
+                return m_localUserServices.GetUserProfile(firstName, lastName);
+
             return GetUserProfile(firstName + " " + lastName);
         }
 
-        public List<AvatarPickerAvatar> GenerateAgentPickerRequestResponse(UUID queryID, string query)
+        public override List<AvatarPickerAvatar> GenerateAgentPickerRequestResponse(UUID queryID, string query)
         {
-            return m_remoteUserServices.GenerateAgentPickerRequestResponse(queryID, query);
+            if (m_localUserServices != null)
+                return m_localUserServices.GenerateAgentPickerRequestResponse(queryID, query);
+
+            return base.GenerateAgentPickerRequestResponse(queryID, query);
         }
 
         /// <summary>
@@ -135,9 +140,11 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="avatarID"></param>
         /// <returns>null if the request fails</returns>
-        public UserProfileData GetUserProfile(string name)
+        public override UserProfileData GetUserProfile(string name)
         {
-            return m_remoteUserServices.GetUserProfile(name);
+            // This doesn't exist in LocalUserServices
+
+            return base.GetUserProfile(name);
         }
 
         /// <summary>
@@ -145,14 +152,24 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="avatarID"></param>
         /// <returns>null if the request fails</returns>
-        public UserProfileData GetUserProfile(UUID avatarID)
+        public override UserProfileData GetUserProfile(UUID avatarID)
         {
-            return m_remoteUserServices.GetUserProfile(avatarID);
+            string url = string.Empty;
+            // Unfortunately we can't query for foreigners here,
+            // because we'll end up in an infinite loop...
+            //if ((m_localUserServices != null) && (!IsForeignUser(avatarID, out url)))
+            if (m_localUserServices != null)
+                return m_localUserServices.GetUserProfile(avatarID);
+
+            return base.GetUserProfile(avatarID);
         }
 
-        public void ClearUserAgent(UUID avatarID)
+        public override void ClearUserAgent(UUID avatarID)
         {
-            m_remoteUserServices.ClearUserAgent(avatarID);
+            if (m_localUserServices != null)
+                m_localUserServices.ClearUserAgent(avatarID);
+            else
+                base.ClearUserAgent(avatarID);
         }
 
         /// <summary>
@@ -160,9 +177,12 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="uuid"></param>
         /// <returns></returns>
-        public UserProfileData SetupMasterUser(string firstName, string lastName)
+        public override UserProfileData SetupMasterUser(string firstName, string lastName)
         {
-            return m_remoteUserServices.SetupMasterUser(firstName, lastName);
+            if (m_localUserServices != null)
+                return m_localUserServices.SetupMasterUser(firstName, lastName);
+
+            return base.SetupMasterUser(firstName, lastName);
         }
 
         /// <summary>
@@ -170,9 +190,12 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="uuid"></param>
         /// <returns></returns>
-        public UserProfileData SetupMasterUser(string firstName, string lastName, string password)
+        public override UserProfileData SetupMasterUser(string firstName, string lastName, string password)
         {
-            return m_remoteUserServices.SetupMasterUser(firstName, lastName, password);
+            if (m_localUserServices != null)
+                return m_localUserServices.SetupMasterUser(firstName, lastName, password);
+
+            return base.SetupMasterUser(firstName, lastName, password);
         }
 
         /// <summary>
@@ -180,36 +203,47 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="uuid"></param>
         /// <returns></returns>
-        public UserProfileData SetupMasterUser(UUID uuid)
+        public override UserProfileData SetupMasterUser(UUID uuid)
         {
-            return m_remoteUserServices.SetupMasterUser(uuid);
+            if (m_localUserServices != null)
+                return m_localUserServices.SetupMasterUser(uuid);
+
+            return base.SetupMasterUser(uuid);
         }
 
-        public UUID AddUserProfile(string firstName, string lastName, string pass, uint regX, uint regY)
+        public override bool ResetUserPassword(string firstName, string lastName, string newPassword)
         {
-            return m_remoteUserServices.AddUserProfile(firstName, lastName, pass, regX, regY);
+            if (m_localUserServices != null)
+                return m_localUserServices.ResetUserPassword(firstName, lastName, newPassword);
+            else
+                return base.ResetUserPassword(firstName, lastName, newPassword);
         }
-        
-        public bool ResetUserPassword(string firstName, string lastName, string newPassword)
-        {
-            return m_remoteUserServices.ResetUserPassword(firstName, lastName, newPassword);
-        }        
 
-        public bool UpdateUserProfile(UserProfileData userProfile)
+        public override bool UpdateUserProfile(UserProfileData userProfile)
         {
-            return m_remoteUserServices.UpdateUserProfile(userProfile);
+            string url = string.Empty;
+            if ((m_localUserServices != null) && (!IsForeignUser(userProfile.ID, out url)))
+                return m_localUserServices.UpdateUserProfile(userProfile);
+
+            return base.UpdateUserProfile(userProfile);
         }
 
         #region IUserServices Friend Methods
+
+        // NOTE: We're still not dealing with foreign user friends
+
         /// <summary>
         /// Adds a new friend to the database for XUser
         /// </summary>
         /// <param name="friendlistowner">The agent that who's friends list is being added to</param>
         /// <param name="friend">The agent that being added to the friends list of the friends list owner</param>
         /// <param name="perms">A uint bit vector for set perms that the friend being added has; 0 = none, 1=This friend can see when they sign on, 2 = map, 4 edit objects </param>
-        public void AddNewUserFriend(UUID friendlistowner, UUID friend, uint perms)
+        public override void AddNewUserFriend(UUID friendlistowner, UUID friend, uint perms)
         {
-            m_remoteUserServices.AddNewUserFriend(friendlistowner, friend, perms);
+            if (m_localUserServices != null)
+                m_localUserServices.AddNewUserFriend(friendlistowner, friend, perms);
+            else
+                base.AddNewUserFriend(friendlistowner, friend, perms);
         }
 
         /// <summary>
@@ -217,9 +251,12 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// </summary>
         /// <param name="friendlistowner">The agent that who's friends list is being updated</param>
         /// <param name="friend">The Ex-friend agent</param>
-        public void RemoveUserFriend(UUID friendlistowner, UUID friend)
+        public override void RemoveUserFriend(UUID friendlistowner, UUID friend)
         {
-            m_remoteUserServices.RemoveUserFriend(friend, friend);
+            if (m_localUserServices != null)
+                m_localUserServices.RemoveUserFriend(friendlistowner, friend);
+            else
+                base.RemoveUserFriend(friend, friend);
         }
 
         /// <summary>
@@ -228,39 +265,79 @@ namespace OpenSim.Region.Communications.Hypergrid
         /// <param name="friendlistowner">The agent that who's friends list is being updated</param>
         /// <param name="friend">The agent that is getting or loosing permissions</param>
         /// <param name="perms">A uint bit vector for set perms that the friend being added has; 0 = none, 1=This friend can see when they sign on, 2 = map, 4 edit objects </param>
-        public void UpdateUserFriendPerms(UUID friendlistowner, UUID friend, uint perms)
+        public override void UpdateUserFriendPerms(UUID friendlistowner, UUID friend, uint perms)
         {
-            m_remoteUserServices.UpdateUserFriendPerms(friendlistowner, friend, perms);
+            if (m_localUserServices != null)
+                m_localUserServices.UpdateUserFriendPerms(friendlistowner, friend, perms);
+            else
+                base.UpdateUserFriendPerms(friendlistowner, friend, perms);
         }
         /// <summary>
         /// Returns a list of FriendsListItems that describe the friends and permissions in the friend relationship for UUID friendslistowner
         /// </summary>
         /// <param name="friendlistowner">The agent that we're retreiving the friends Data.</param>
-        public List<FriendListItem> GetUserFriendList(UUID friendlistowner)
+        public override List<FriendListItem> GetUserFriendList(UUID friendlistowner)
         {
-            return m_remoteUserServices.GetUserFriendList(friendlistowner);
+            if (m_localUserServices != null)
+                return m_localUserServices.GetUserFriendList(friendlistowner);
+
+            return base.GetUserFriendList(friendlistowner);
         }
 
         #endregion
 
         /// Appearance
-        public AvatarAppearance GetUserAppearance(UUID user)
+        public override AvatarAppearance GetUserAppearance(UUID user)
         {
-            return m_remoteUserServices.GetUserAppearance(user);
+            string url = string.Empty;
+            if ((m_localUserServices != null) && (!IsForeignUser(user, out url)))
+                return m_localUserServices.GetUserAppearance(user);
+            else
+                return base.GetUserAppearance(user);
         }
 
-        public void UpdateUserAppearance(UUID user, AvatarAppearance appearance)
+        public override void UpdateUserAppearance(UUID user, AvatarAppearance appearance)
         {
-            m_remoteUserServices.UpdateUserAppearance(user, appearance);
+            string url = string.Empty;
+            if ((m_localUserServices != null) && (!IsForeignUser(user, out url)))
+                m_localUserServices.UpdateUserAppearance(user, appearance);
+            else
+                base.UpdateUserAppearance(user, appearance);
         }
 
         #region IMessagingService
 
-        public Dictionary<UUID, FriendRegionInfo> GetFriendRegionInfos(List<UUID> uuids)
+        public override Dictionary<UUID, FriendRegionInfo> GetFriendRegionInfos(List<UUID> uuids)
         {
-            return m_remoteUserServices.GetFriendRegionInfos(uuids);
+            if (m_localUserServices != null)
+                return m_localUserServices.GetFriendRegionInfos(uuids);
+
+            return base.GetFriendRegionInfos(uuids);
         }
         #endregion
 
+        protected override string GetUserServerURL(UUID userID)
+        {
+            string serverURL = string.Empty;
+            if (IsForeignUser(userID, out serverURL))
+                return serverURL;
+
+            return m_commsManager.NetworkServersInfo.UserURL;
+        }
+
+        private bool IsForeignUser(UUID userID, out string userServerURL)
+        {
+            userServerURL = string.Empty;
+            CachedUserInfo uinfo = m_commsManager.UserProfileCacheService.GetUserDetails(userID);
+            if (uinfo != null)
+            {
+                if (!HGNetworkServersInfo.Singleton.IsLocalUser(uinfo.UserProfile))
+                {
+                    userServerURL = ((ForeignUserProfileData)(uinfo.UserProfile)).UserServerURI;
+                    return true;
+                }
+            }
+            return false;
+        }
     }
 }
diff --git a/OpenSim/Region/CoreModules/Communications/REST/RESTInterregionComms.cs b/OpenSim/Region/CoreModules/Communications/REST/RESTInterregionComms.cs
index 87272a1..97ffeae 100644
--- a/OpenSim/Region/CoreModules/Communications/REST/RESTInterregionComms.cs
+++ b/OpenSim/Region/CoreModules/Communications/REST/RESTInterregionComms.cs
@@ -59,6 +59,9 @@ namespace OpenSim.Region.CoreModules.Communications.REST
 
         protected RegionToRegionClient m_regionClient;
 
+        protected bool m_safemode;
+        protected IPAddress m_thisIP;
+
         #region IRegionModule
 
         public virtual void Initialise(Scene scene, IConfigSource config)
@@ -74,6 +77,9 @@ namespace OpenSim.Region.CoreModules.Communications.REST
                 {
                     m_log.Info("[REST COMMS]: Enabling InterregionComms RESTComms module");
                     m_enabled = true;
+                    if (config.Configs["Hypergrid"] != null)
+                        m_safemode = config.Configs["Hypergrid"].GetBoolean("safemode", false);
+
                     InitOnce(scene);
                 }
             }
@@ -117,6 +123,7 @@ namespace OpenSim.Region.CoreModules.Communications.REST
             m_commsManager = scene.CommsManager;
             m_aScene = scene;
             m_regionClient = new RegionToRegionClient(m_aScene);
+            m_thisIP = Util.GetHostFromDNS(scene.RegionInfo.ExternalHostName);
         }
 
         protected virtual void AddHTTPHandlers()
@@ -148,7 +155,7 @@ namespace OpenSim.Region.CoreModules.Communications.REST
                 {
                     m_regionClient.SendUserInformation(regInfo, aCircuit);
 
-                    return m_regionClient.DoCreateChildAgentCall(regInfo, aCircuit);
+                    return m_regionClient.DoCreateChildAgentCall(regInfo, aCircuit, "None");
                 }
                 //else
                 //    m_log.Warn("[REST COMMS]: Region not found " + regionHandle);
@@ -331,6 +338,7 @@ namespace OpenSim.Region.CoreModules.Communications.REST
             responsedata["content_type"] = "text/html";
             responsedata["keepalive"] = false;
 
+
             UUID agentID;
             string action;
             ulong regionHandle;
@@ -378,6 +386,28 @@ namespace OpenSim.Region.CoreModules.Communications.REST
 
         protected virtual void DoAgentPost(Hashtable request, Hashtable responsedata, UUID id)
         {
+            if (m_safemode)
+            {
+                // Authentication
+                string authority = string.Empty;
+                string authToken = string.Empty;
+                if (!GetAuthentication(request, out authority, out authToken))
+                {
+                    m_log.InfoFormat("[REST COMMS]: Authentication failed for agent message {0}", request["uri"]);
+                    responsedata["int_response_code"] = 403;
+                    responsedata["str_response_string"] = "Forbidden";
+                    return ;
+                }
+                if (!VerifyKey(id, authority, authToken))
+                {
+                    m_log.InfoFormat("[REST COMMS]: Authentication failed for agent message {0}", request["uri"]);
+                    responsedata["int_response_code"] = 403;
+                    responsedata["str_response_string"] = "Forbidden";
+                    return ;
+                }
+                m_log.DebugFormat("[REST COMMS]: Authentication succeeded for {0}", id);
+            }
+
             OSDMap args = RegionClient.GetOSDMap((string)request["body"]);
             if (args == null)
             {
@@ -793,6 +823,53 @@ namespace OpenSim.Region.CoreModules.Communications.REST
             }
         }
 
+        public static bool GetAuthentication(Hashtable request, out string authority, out string authKey)
+        {
+            authority = string.Empty;
+            authKey = string.Empty;
+
+            Uri authUri;
+            Hashtable headers = (Hashtable)request["headers"];
+
+            // Authorization keys look like this:
+            // http://orgrid.org:8002/<uuid>
+            if (headers.ContainsKey("authorization") && (string)headers["authorization"] != "None")
+            {
+                if (Uri.TryCreate((string)headers["authorization"], UriKind.Absolute, out authUri))
+                {
+                    authority = authUri.Authority;
+                    authKey = authUri.PathAndQuery.Trim('/');
+                    m_log.DebugFormat("[REST COMMS]: Got authority {0} and key {1}", authority, authKey);
+                    return true;
+                }
+                else
+                    m_log.Debug("[REST COMMS]: Wrong format for Authorization header: " + (string)headers["authorization"]);
+            }
+            else
+                m_log.Debug("[REST COMMS]: Authorization header not found");
+
+            return false;
+        }
+
+        bool VerifyKey(UUID userID, string authority, string key)
+        {
+            string[] parts = authority.Split(':');
+            IPAddress ipaddr = IPAddress.None;
+            uint port = 0;
+            if (parts.Length <= 2)
+                ipaddr = Util.GetHostFromDNS(parts[0]);
+            if (parts.Length == 2)
+                UInt32.TryParse(parts[1], out port);
+
+            // local authority (standalone), local call
+            if (m_thisIP.Equals(ipaddr) && (m_aScene.RegionInfo.HttpPort == port))
+                return ((IAuthentication)m_aScene.CommsManager.UserAdminService).VerifyKey(userID, key);
+            // remote call
+            else
+                return AuthClient.VerifyKey("http://" + authority, userID, key);
+        }
+
+
         #endregion Misc 
 
         protected class RegionToRegionClient : RegionClient
diff --git a/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneInventoryModule.cs b/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneInventoryModule.cs
index 3675583..f0d70a7 100644
--- a/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneInventoryModule.cs
+++ b/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneInventoryModule.cs
@@ -93,7 +93,7 @@ namespace OpenSim.Region.CoreModules.Hypergrid
 
                 m_inventoryService = new HGInventoryService(m_inventoryBase,
                     ((AssetServerBase)m_scene.CommsManager.AssetCache.AssetServer).AssetProviderPlugin,
-                    (UserManagerBase)m_scene.CommsManager.UserService, m_scene.CommsManager.HttpServer, 
+                    (UserManagerBase)m_scene.CommsManager.UserAdminService, m_scene.CommsManager.HttpServer, 
                     m_scene.CommsManager.NetworkServersInfo.InventoryURL);
 
                 AddHttpHandlers(m_scene.CommsManager.HttpServer);
diff --git a/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneLoginModule.cs b/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneLoginModule.cs
index f0e957b..c458b89 100644
--- a/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneLoginModule.cs
+++ b/OpenSim/Region/CoreModules/Hypergrid/HGStandaloneLoginModule.cs
@@ -104,11 +104,12 @@ namespace OpenSim.Region.CoreModules.Hypergrid
                     IHttpServer httpServer = m_firstScene.CommsManager.HttpServer;
 
                     //TODO: fix the casting of the user service, maybe by registering the userManagerBase with scenes, or refactoring so we just need a IUserService reference
-                    m_loginService = new HGLoginAuthService((UserManagerBase)m_firstScene.CommsManager.UserService, welcomeMessage, m_firstScene.CommsManager.InterServiceInventoryService, m_firstScene.CommsManager.NetworkServersInfo, authenticate, rootFolder, this);
+                    m_loginService = new HGLoginAuthService((UserManagerBase)m_firstScene.CommsManager.UserAdminService, welcomeMessage, m_firstScene.CommsManager.InterServiceInventoryService, m_firstScene.CommsManager.NetworkServersInfo, authenticate, rootFolder, this);
 
                     httpServer.AddXmlRPCHandler("hg_login", m_loginService.XmlRpcLoginMethod);
                     httpServer.AddXmlRPCHandler("hg_new_auth_key", m_loginService.XmlRpcGenerateKeyMethod);
                     httpServer.AddXmlRPCHandler("hg_verify_auth_key", m_loginService.XmlRpcVerifyKeyMethod);
+                    httpServer.AddXmlRPCHandler("check_auth_session", m_loginService.XmlRPCCheckAuthSession);
 
                 }
             }
diff --git a/OpenSim/Region/Framework/Scenes/Scene.cs b/OpenSim/Region/Framework/Scenes/Scene.cs
index c26adc0..5ffa64c 100644
--- a/OpenSim/Region/Framework/Scenes/Scene.cs
+++ b/OpenSim/Region/Framework/Scenes/Scene.cs
@@ -40,6 +40,7 @@ using OpenMetaverse.Imaging;
 using OpenSim.Framework;
 using OpenSim.Framework.Communications;
 using OpenSim.Framework.Communications.Cache;
+using OpenSim.Framework.Communications.Clients;
 using OpenSim.Framework.Console;
 using OpenSim.Region.Framework.Interfaces;
 using OpenSim.Region.Framework.Scenes.Scripting;
@@ -2372,64 +2373,80 @@ namespace OpenSim.Region.Framework.Scenes
         /// <param name="agent"></param>
         public bool NewUserConnection(AgentCircuitData agent)
         {
-            CapsModule.NewUserConnection(agent);
+            bool goodUserConnection = AuthenticateUser(agent);
 
-            ScenePresence sp = m_sceneGraph.GetScenePresence(agent.AgentID);
-            if (sp != null)
+            if (goodUserConnection)
             {
-                m_log.DebugFormat(
-                    "[SCENE]: Adjusting known seeds for existing agent {0} in {1}",
-                    agent.AgentID, RegionInfo.RegionName);
+                CapsModule.NewUserConnection(agent);
 
-                sp.AdjustKnownSeeds();
+                ScenePresence sp = m_sceneGraph.GetScenePresence(agent.AgentID);
+                if (sp != null)
+                {
+                    m_log.DebugFormat(
+                        "[SCENE]: Adjusting known seeds for existing agent {0} in {1}",
+                        agent.AgentID, RegionInfo.RegionName);
 
-                return true;
-            }
+                    sp.AdjustKnownSeeds();
 
-            // Don't disable this log message - it's too helpful
-            m_log.InfoFormat(
-                "[CONNECTION BEGIN]: Region {0} told of incoming client {1} {2} {3} (circuit code {4})",
-                RegionInfo.RegionName, agent.firstname, agent.lastname, agent.AgentID, agent.circuitcode);
+                    return true;
+                }
 
-            if (m_regInfo.EstateSettings.IsBanned(agent.AgentID))
-            {
-                m_log.WarnFormat(
-               "[CONNECTION BEGIN]: Incoming user {0} at {1} is on the region banlist",
-               agent.AgentID, RegionInfo.RegionName);
-                //return false;
-            }
+                // Don't disable this log message - it's too helpful
+                m_log.InfoFormat(
+                    "[CONNECTION BEGIN]: Region {0} told of incoming client {1} {2} {3} (circuit code {4})",
+                    RegionInfo.RegionName, agent.firstname, agent.lastname, agent.AgentID, agent.circuitcode);
+
+                if (m_regInfo.EstateSettings.IsBanned(agent.AgentID))
+                {
+                    m_log.WarnFormat(
+                   "[CONNECTION BEGIN]: Incoming user {0} at {1} is on the region banlist",
+                   agent.AgentID, RegionInfo.RegionName);
+                    //return false;
+                }
 
-            CapsModule.AddCapsHandler(agent.AgentID);
+                CapsModule.AddCapsHandler(agent.AgentID);
 
-            if (!agent.child)
-            {
-                // Honor parcel landing type and position.
-                ILandObject land = LandChannel.GetLandObject(agent.startpos.X, agent.startpos.Y);
-                if (land != null)
+                if (!agent.child)
                 {
-                    if (land.landData.LandingType == (byte)1 && land.landData.UserLocation != Vector3.Zero)
+                    // Honor parcel landing type and position.
+                    ILandObject land = LandChannel.GetLandObject(agent.startpos.X, agent.startpos.Y);
+                    if (land != null)
                     {
-                        agent.startpos = land.landData.UserLocation;
+                        if (land.landData.LandingType == (byte)1 && land.landData.UserLocation != Vector3.Zero)
+                        {
+                            agent.startpos = land.landData.UserLocation;
+                        }
                     }
                 }
-            }
 
-            m_authenticateHandler.AddNewCircuit(agent.circuitcode, agent);
+                m_authenticateHandler.AddNewCircuit(agent.circuitcode, agent);
 
-            // rewrite session_id
-            CachedUserInfo userinfo = CommsManager.UserProfileCacheService.GetUserDetails(agent.AgentID);
+                // rewrite session_id
+                CachedUserInfo userinfo = CommsManager.UserProfileCacheService.GetUserDetails(agent.AgentID);
+                if (userinfo != null)
+                {
+                    userinfo.SessionID = agent.SessionID;
+                }
+                else
+                {
+                    m_log.WarnFormat(
+                        "[CONNECTION BEGIN]: We couldn't find a User Info record for {0}.  This is usually an indication that the UUID we're looking up is invalid", agent.AgentID);
+                }
 
-            if (userinfo != null)
-            {
-                userinfo.SessionID = agent.SessionID;
+                return true;
             }
             else
             {
-                m_log.WarnFormat(
-                    "[CONNECTION BEGIN]: We couldn't find a User Info record for {0}.  This is usually an indication that the UUID we're looking up is invalid", agent.AgentID);
+                m_log.WarnFormat("[CONNECTION BEGIN]: failed to authenticate user {0} {1}. Denying connection.", agent.firstname, agent.lastname);
+                return false;
             }
+        }
 
-            return true;
+        public virtual bool AuthenticateUser(AgentCircuitData agent)
+        {
+            bool result = CommsManager.UserService.VerifySession(agent.AgentID, agent.SessionID);
+            m_log.Debug("[CONNECTION BEGIN]: User authentication returned " + result);
+            return result;
         }
 
         public void UpdateCircuitData(AgentCircuitData data)