| package org.apache.archiva.redback.rbac.ldap; |
| |
| /* |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| |
| import org.apache.archiva.redback.common.ldap.MappingException; |
| import org.apache.archiva.redback.common.ldap.connection.LdapConnection; |
| import org.apache.archiva.redback.common.ldap.connection.LdapConnectionFactory; |
| import org.apache.archiva.redback.common.ldap.connection.LdapException; |
| import org.apache.archiva.redback.common.ldap.role.LdapRoleMapper; |
| import org.apache.archiva.redback.common.ldap.role.LdapRoleMapperConfiguration; |
| import org.apache.archiva.redback.components.cache.Cache; |
| import org.apache.archiva.redback.configuration.UserConfiguration; |
| import org.apache.archiva.redback.configuration.UserConfigurationKeys; |
| import org.apache.archiva.redback.rbac.AbstractRBACManager; |
| import org.apache.archiva.redback.rbac.AbstractRole; |
| import org.apache.archiva.redback.rbac.Operation; |
| import org.apache.archiva.redback.rbac.Permission; |
| import org.apache.archiva.redback.rbac.RBACManager; |
| import org.apache.archiva.redback.rbac.RBACManagerListener; |
| import org.apache.archiva.redback.rbac.RBACObjectAssertions; |
| import org.apache.archiva.redback.rbac.RbacManagerException; |
| import org.apache.archiva.redback.rbac.RbacObjectInvalidException; |
| import org.apache.archiva.redback.rbac.RbacObjectNotFoundException; |
| import org.apache.archiva.redback.rbac.RbacPermanentException; |
| import org.apache.archiva.redback.rbac.Resource; |
| import org.apache.archiva.redback.rbac.Role; |
| import org.apache.archiva.redback.rbac.UserAssignment; |
| import org.apache.archiva.redback.users.User; |
| import org.apache.archiva.redback.users.UserManager; |
| import org.apache.archiva.redback.users.UserManagerException; |
| import org.apache.archiva.redback.users.ldap.ctl.LdapController; |
| import org.apache.archiva.redback.users.ldap.ctl.LdapControllerException; |
| import org.apache.commons.lang.StringUtils; |
| import org.slf4j.Logger; |
| import org.slf4j.LoggerFactory; |
| import org.springframework.stereotype.Service; |
| |
| import javax.annotation.PostConstruct; |
| import javax.inject.Inject; |
| import javax.inject.Named; |
| import javax.naming.NamingException; |
| import javax.naming.directory.DirContext; |
| import java.util.ArrayList; |
| import java.util.Collection; |
| import java.util.Collections; |
| import java.util.HashSet; |
| import java.util.List; |
| import java.util.Map; |
| import java.util.Set; |
| |
| /** |
| * LdapRbacManager will read datas from ldap for mapping groups to role. |
| * Write operations will delegate to cached implementation. |
| * |
| * @author Olivier Lamy |
| */ |
| @Service("rbacManager#ldap") |
| public class LdapRbacManager |
| extends AbstractRBACManager |
| implements RBACManager, RBACManagerListener |
| { |
| |
| private Logger log = LoggerFactory.getLogger( getClass() ); |
| |
| @Inject |
| @Named(value = "rbacManager#cached") |
| private RBACManager rbacImpl; |
| |
| @Inject |
| @Named(value = "ldapRoleMapper#default") |
| private LdapRoleMapper ldapRoleMapper; |
| |
| @Inject |
| @Named(value = "userConfiguration#default") |
| private UserConfiguration userConf; |
| |
| @Inject |
| @Named(value = "userManager#ldap") |
| private UserManager userManager; |
| |
| @Inject |
| private LdapConnectionFactory ldapConnectionFactory; |
| |
| @Inject |
| private LdapController ldapController; |
| |
| @Inject |
| @Named(value = "ldapRoleMapperConfiguration#default") |
| private LdapRoleMapperConfiguration ldapRoleMapperConfiguration; |
| |
| @Inject |
| @Named(value = "cache#ldapRoles") |
| private Cache<String, Role> rolesCache; |
| |
| @Inject |
| @Named(value = "cache#userAssignments") |
| private Cache<String, UserAssignment> userAssignmentsCache; |
| |
| private boolean writableLdap = false; |
| |
| @PostConstruct |
| public void initialize() |
| { |
| this.writableLdap = userConf.getBoolean( UserConfigurationKeys.LDAP_WRITABLE, this.writableLdap ); |
| } |
| |
| |
| public void addChildRole( Role role, Role childRole ) |
| throws RbacObjectInvalidException, RbacManagerException |
| { |
| this.rbacImpl.addChildRole( role, childRole ); |
| } |
| |
| public void addListener( RBACManagerListener listener ) |
| { |
| super.addListener( listener ); |
| this.rbacImpl.addListener( listener ); |
| } |
| |
| public Operation createOperation( String name ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.createOperation( name ); |
| } |
| |
| public Permission createPermission( String name ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.createPermission( name ); |
| } |
| |
| public Permission createPermission( String name, String operationName, String resourceIdentifier ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.createPermission( name, operationName, resourceIdentifier ); |
| } |
| |
| public Resource createResource( String identifier ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.createResource( identifier ); |
| } |
| |
| public Role createRole( String name ) |
| { |
| return this.rbacImpl.createRole( name ); |
| } |
| |
| public UserAssignment createUserAssignment( String username ) |
| throws RbacManagerException |
| { |
| // TODO ldap cannot or isWritable ldap ? |
| return this.rbacImpl.createUserAssignment( username ); |
| } |
| |
| public void eraseDatabase() |
| { |
| if ( writableLdap ) |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| ldapRoleMapper.removeAllRoles( context ); |
| } |
| catch ( MappingException e ) |
| { |
| log.warn( "skip error removing all roles {}", e.getMessage() ); |
| } |
| catch ( LdapException e ) |
| { |
| log.warn( "skip error removing all roles {}", e.getMessage() ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| } |
| this.rolesCache.clear(); |
| this.userAssignmentsCache.clear(); |
| this.rbacImpl.eraseDatabase(); |
| } |
| |
| /** |
| * @see org.apache.archiva.redback.rbac.RBACManager#getAllAssignableRoles() |
| */ |
| public List<Role> getAllAssignableRoles() |
| throws RbacManagerException |
| { |
| try |
| { |
| Collection<Collection<String>> roleNames = ldapRoleMapperConfiguration.getLdapGroupMappings().values(); |
| |
| Set<Role> roles = new HashSet<Role>(); |
| |
| for ( Collection<String> names : roleNames ) |
| { |
| for ( String name : names ) |
| { |
| roles.add( new RoleImpl( name ) ); |
| } |
| } |
| |
| return new ArrayList<Role>( roles ); |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| } |
| |
| public List<Operation> getAllOperations() |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getAllOperations(); |
| } |
| |
| public List<Permission> getAllPermissions() |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getAllPermissions(); |
| } |
| |
| public List<Resource> getAllResources() |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getAllResources(); |
| } |
| |
| public List<Role> getAllRoles() |
| throws RbacManagerException |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| |
| List<String> groups = ldapRoleMapper.getAllGroups( context ); |
| return mapToRoles( groups ); |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| //return this.rbacImpl.getAllRoles(); |
| } |
| |
| |
| public List<UserAssignment> getAllUserAssignments() |
| throws RbacManagerException |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| Map<String, Collection<String>> usersWithRoles = ldapController.findUsersWithRoles( context ); |
| List<UserAssignment> userAssignments = new ArrayList<UserAssignment>( usersWithRoles.size() ); |
| |
| for ( Map.Entry<String, Collection<String>> entry : usersWithRoles.entrySet() ) |
| { |
| UserAssignment userAssignment = new UserAssignmentImpl( entry.getKey(), entry.getValue() ); |
| userAssignments.add( userAssignment ); |
| userAssignmentsCache.put( userAssignment.getPrincipal(), userAssignment ); |
| } |
| |
| return userAssignments; |
| } |
| catch ( LdapControllerException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| } |
| |
| protected void closeLdapConnection( LdapConnection ldapConnection ) |
| { |
| if ( ldapConnection != null ) |
| { |
| ldapConnection.close(); |
| } |
| } |
| |
| protected void closeContext( DirContext context ) |
| { |
| if ( context != null ) |
| { |
| try |
| { |
| context.close(); |
| } |
| catch ( NamingException e ) |
| { |
| log.warn( "skip issue closing context: {}", e.getMessage() ); |
| } |
| } |
| } |
| |
| /** |
| * public Map<String, List<Permission>> getAssignedPermissionMap( String username ) |
| * throws RbacManagerException |
| * { |
| * return this.rbacImpl.getAssignedPermissionMap( username ); |
| * }* |
| */ |
| |
| /*public Set<Permission> getAssignedPermissions( String username ) |
| throws RbacObjectNotFoundException, RbacManagerException |
| { |
| // TODO here !! |
| return this.rbacImpl.getAssignedPermissions( username ); |
| }*/ |
| private List<Role> mapToRoles( List<String> groups ) |
| throws MappingException, RbacManagerException |
| { |
| if ( groups == null || groups.isEmpty() ) |
| { |
| return Collections.emptyList(); |
| } |
| |
| List<Role> roles = new ArrayList<Role>( groups.size() ); |
| Map<String, Collection<String>> mappedGroups = ldapRoleMapperConfiguration.getLdapGroupMappings(); |
| for ( String group : groups ) |
| { |
| Collection<String> roleNames = mappedGroups.get( group ); |
| if ( roleNames != null ) |
| { |
| for ( String roleName : roleNames ) |
| { |
| Role role = buildRole( roleName ); |
| roles.add( role ); |
| } |
| } |
| else if ( this.ldapRoleMapper.isUseDefaultRoleName() ) |
| { |
| Role role = buildRole( group ); |
| roles.add( role ); |
| |
| |
| } |
| } |
| return roles; |
| |
| } |
| |
| private Role buildRole( String group ) |
| throws RbacManagerException |
| { |
| Role role = null; |
| try |
| { |
| role = this.rbacImpl.getRole( group ); |
| } |
| catch ( RbacObjectNotFoundException e ) |
| { |
| // if it's mapped role to a group it doesn't exist in jdo |
| } |
| role = ( role == null ) ? new RoleImpl( group ) : role; |
| if ( role != null ) |
| { |
| rolesCache.put( role.getName(), role ); |
| |
| } |
| return role; |
| } |
| |
| protected List<String> getRealRoles() |
| throws RbacManagerException |
| { |
| List<Role> roles = this.rbacImpl.getAllRoles(); |
| List<String> roleNames = new ArrayList<String>( roles.size() ); |
| for ( Role role : roles ) |
| { |
| roleNames.add( role.getName() ); |
| } |
| return roleNames; |
| } |
| |
| public Collection<Role> getAssignedRoles( String username ) |
| throws RbacManagerException |
| { |
| |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| |
| try |
| { |
| |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| List<String> roleNames = ldapRoleMapper.getRoles( username, context, getRealRoles() ); |
| |
| if ( roleNames.isEmpty() ) |
| { |
| return Collections.emptyList(); |
| } |
| |
| List<Role> roles = new ArrayList<Role>( roleNames.size() ); |
| |
| for ( String name : roleNames ) |
| { |
| roles.add( this.rbacImpl.getRole( name ) );// new RoleImpl( name ) ); |
| } |
| |
| return roles; |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| } |
| |
| public Collection<Role> getAssignedRoles( UserAssignment userAssignment ) |
| throws RbacManagerException |
| { |
| return getAssignedRoles( userAssignment.getPrincipal() ); |
| } |
| |
| public Map<String, Role> getChildRoles( Role role ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getChildRoles( role ); |
| } |
| |
| public Map<String, Role> getParentRoles( Role role ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getParentRoles( role ); |
| } |
| |
| // |
| // public Collection<Role> getEffectivelyAssignedRoles( String username ) |
| // throws RbacManagerException |
| // { |
| // TODO here !! |
| // return this.rbacImpl.getEffectivelyAssignedRoles( username ); |
| // } |
| |
| //public Collection<Role> getEffectivelyUnassignedRoles( String username ) |
| //throws RbacManagerException |
| //{ |
| // TODO here !! |
| // return this.rbacImpl.getEffectivelyUnassignedRoles( username ); |
| // } |
| |
| |
| public Set<Role> getEffectiveRoles( Role role ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getEffectiveRoles( role ); |
| } |
| |
| public Resource getGlobalResource() |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getGlobalResource(); |
| } |
| |
| public Operation getOperation( String operationName ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getOperation( operationName ); |
| } |
| |
| public Permission getPermission( String permissionName ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getPermission( permissionName ); |
| } |
| |
| public Resource getResource( String resourceIdentifier ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getResource( resourceIdentifier ); |
| } |
| |
| public Role getRole( String roleName ) |
| throws RbacManagerException |
| { |
| |
| Role role = rolesCache.get( roleName ); |
| if ( role != null ) |
| { |
| return role; |
| } |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| //verify it's a ldap group |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| if ( !ldapRoleMapper.hasRole( context, roleName ) ) |
| { |
| return null; |
| } |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| role = this.rbacImpl.getRole( roleName ); |
| role = ( role == null ) ? new RoleImpl( roleName ) : role; |
| |
| rolesCache.put( roleName, role ); |
| |
| return role; |
| } |
| |
| public Map<String, Role> getRoles( Collection<String> roleNames ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.getRoles( roleNames ); |
| } |
| |
| public Collection<Role> getUnassignedRoles( String username ) |
| throws RbacManagerException |
| { |
| LdapConnection ldapConnection = null; |
| |
| DirContext context = null; |
| |
| try |
| { |
| |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| |
| context = ldapConnection.getDirContext(); |
| |
| List<String> allRoles = ldapRoleMapper.getAllRoles( context ); |
| final List<String> userRoles = ldapRoleMapper.getRoles( username, context, getRealRoles() ); |
| |
| List<Role> unassignedRoles = new ArrayList<Role>(); |
| |
| for ( String roleName : allRoles ) |
| { |
| if ( !userRoles.contains( roleName ) ) |
| { |
| unassignedRoles.add( rbacImpl.getRole( roleName ) ); |
| } |
| } |
| return unassignedRoles; |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| } |
| |
| public UserAssignment getUserAssignment( String username ) |
| throws RbacManagerException |
| { |
| UserAssignment ua = userAssignmentsCache.get( username ); |
| if ( ua != null ) |
| { |
| return ua; |
| } |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| List<String> roles = ldapRoleMapper.getRoles( username, context, getRealRoles() ); |
| |
| ua = new UserAssignmentImpl( username, roles ); |
| |
| userAssignmentsCache.put( username, ua ); |
| |
| return ua; |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| |
| //return this.rbacImpl.getUserAssignment( username ); |
| } |
| |
| public List<UserAssignment> getUserAssignmentsForRoles( Collection<String> roleNames ) |
| throws RbacManagerException |
| { |
| // TODO from ldap |
| return this.rbacImpl.getUserAssignmentsForRoles( roleNames ); |
| } |
| |
| public boolean operationExists( Operation operation ) |
| { |
| return this.rbacImpl.operationExists( operation ); |
| } |
| |
| public boolean operationExists( String name ) |
| { |
| return this.rbacImpl.operationExists( name ); |
| } |
| |
| public boolean permissionExists( Permission permission ) |
| { |
| return this.rbacImpl.permissionExists( permission ); |
| } |
| |
| public boolean permissionExists( String name ) |
| { |
| return this.rbacImpl.permissionExists( name ); |
| } |
| |
| public void rbacInit( boolean freshdb ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacInit( freshdb ); |
| } |
| } |
| |
| public void rbacPermissionRemoved( Permission permission ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacPermissionRemoved( permission ); |
| } |
| |
| } |
| |
| public void rbacPermissionSaved( Permission permission ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacPermissionSaved( permission ); |
| } |
| |
| } |
| |
| public void rbacRoleRemoved( Role role ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacRoleRemoved( role ); |
| } |
| |
| } |
| |
| public void rbacRoleSaved( Role role ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacRoleSaved( role ); |
| } |
| |
| } |
| |
| public void rbacUserAssignmentRemoved( UserAssignment userAssignment ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacUserAssignmentRemoved( userAssignment ); |
| } |
| |
| } |
| |
| public void rbacUserAssignmentSaved( UserAssignment userAssignment ) |
| { |
| if ( rbacImpl instanceof RBACManagerListener ) |
| { |
| ( (RBACManagerListener) this.rbacImpl ).rbacUserAssignmentSaved( userAssignment ); |
| } |
| |
| } |
| |
| public void removeListener( RBACManagerListener listener ) |
| { |
| this.rbacImpl.removeListener( listener ); |
| } |
| |
| public void removeOperation( Operation operation ) |
| throws RbacManagerException |
| { |
| this.rbacImpl.removeOperation( operation ); |
| } |
| |
| public void removeOperation( String operationName ) |
| throws RbacManagerException |
| { |
| this.rbacImpl.removeOperation( operationName ); |
| } |
| |
| public void removePermission( Permission permission ) |
| throws RbacManagerException |
| { |
| this.rbacImpl.removePermission( permission ); |
| } |
| |
| public void removePermission( String permissionName ) |
| throws RbacManagerException |
| { |
| this.rbacImpl.removePermission( permissionName ); |
| } |
| |
| public void removeResource( Resource resource ) |
| throws RbacManagerException |
| { |
| this.rbacImpl.removeResource( resource ); |
| } |
| |
| public void removeResource( String resourceIdentifier ) |
| throws RbacManagerException |
| { |
| this.rbacImpl.removeResource( resourceIdentifier ); |
| } |
| |
| public void removeRole( Role role ) |
| throws RbacManagerException |
| { |
| RBACObjectAssertions.assertValid( role ); |
| |
| if ( role.isPermanent() ) |
| { |
| throw new RbacPermanentException( "Unable to delete permanent role [" + role.getName() + "]" ); |
| } |
| rolesCache.remove( role.getName() ); |
| if ( writableLdap ) |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| ldapRoleMapper.removeRole( role.getName(), context ); |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| fireRbacRoleRemoved( role ); |
| } |
| } |
| |
| public void removeRole( String roleName ) |
| throws RbacManagerException |
| { |
| if ( roleName == null ) |
| { |
| return; |
| } |
| removeRole( new RoleImpl( roleName ) ); |
| } |
| |
| public void removeUserAssignment( String username ) |
| throws RbacManagerException |
| { |
| // TODO ldap cannot or isWritable ldap ? |
| userAssignmentsCache.remove( username ); |
| this.rbacImpl.removeUserAssignment( username ); |
| } |
| |
| public void removeUserAssignment( UserAssignment userAssignment ) |
| throws RbacManagerException |
| { |
| if ( userAssignment != null ) |
| { |
| userAssignmentsCache.remove( userAssignment.getPrincipal() ); |
| } |
| // TODO ldap cannot or isWritable ldap ? |
| this.rbacImpl.removeUserAssignment( userAssignment ); |
| } |
| |
| public boolean resourceExists( Resource resource ) |
| { |
| return this.rbacImpl.resourceExists( resource ); |
| } |
| |
| public boolean resourceExists( String identifier ) |
| { |
| return this.rbacImpl.resourceExists( identifier ); |
| } |
| |
| @Override |
| public boolean roleExists( Role role ) |
| throws RbacManagerException |
| { |
| if ( role == null ) |
| { |
| return false; |
| } |
| return roleExists( role.getName() ); |
| } |
| |
| @Override |
| public boolean roleExists( String name ) |
| throws RbacManagerException |
| { |
| if ( StringUtils.isEmpty( name ) ) |
| { |
| return false; |
| } |
| if ( rolesCache.get( name ) != null ) |
| { |
| return true; |
| } |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| if ( rolesCache.hasKey( name ) ) |
| { |
| return true; |
| } |
| return ldapRoleMapper.hasRole( context, name ); |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| } |
| |
| public Operation saveOperation( Operation operation ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.saveOperation( operation ); |
| } |
| |
| public Permission savePermission( Permission permission ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.savePermission( permission ); |
| } |
| |
| public Resource saveResource( Resource resource ) |
| throws RbacManagerException |
| { |
| return this.rbacImpl.saveResource( resource ); |
| } |
| |
| public synchronized Role saveRole( Role role ) |
| throws RbacManagerException |
| { |
| if ( writableLdap ) |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| ldapRoleMapper.saveRole( role.getName(), context ); |
| |
| if ( !role.getChildRoleNames().isEmpty() ) |
| { |
| for ( String roleName : role.getChildRoleNames() ) |
| { |
| ldapRoleMapper.saveRole( roleName, context ); |
| } |
| } |
| fireRbacRoleSaved( role ); |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| } |
| role = this.rbacImpl.saveRole( role ); |
| rolesCache.put( role.getName(), role ); |
| |
| return role; |
| //return new RoleImpl( role.getName(), role.getPermissions() ); |
| } |
| |
| public synchronized void saveRoles( Collection<Role> roles ) |
| throws RbacManagerException |
| { |
| if ( writableLdap ) |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| for ( Role role : roles ) |
| { |
| ldapRoleMapper.saveRole( role.getName(), context ); |
| fireRbacRoleSaved( role ); |
| } |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| } |
| this.rbacImpl.saveRoles( roles ); |
| |
| } |
| |
| public UserAssignment saveUserAssignment( UserAssignment userAssignment ) |
| throws RbacManagerException |
| { |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| if ( !userManager.userExists( userAssignment.getPrincipal() ) ) |
| { |
| User user = userManager.createUser( userAssignment.getPrincipal(), null, null ); |
| userManager.addUser( user ); |
| } |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| List<String> allRoles = ldapRoleMapper.getAllRoles( context ); |
| |
| List<String> currentUserRoles = |
| ldapRoleMapper.getRoles( userAssignment.getPrincipal(), context, getRealRoles() ); |
| |
| for ( String role : userAssignment.getRoleNames() ) |
| { |
| if ( !currentUserRoles.contains( role ) && writableLdap ) |
| { |
| // role exists in ldap ? |
| if ( !allRoles.contains( role ) ) |
| { |
| ldapRoleMapper.saveRole( role, context ); |
| allRoles.add( role ); |
| } |
| ldapRoleMapper.saveUserRole( role, userAssignment.getPrincipal(), context ); |
| currentUserRoles.add( role ); |
| } |
| } |
| |
| for ( String role : currentUserRoles ) |
| { |
| if ( !userAssignment.getRoleNames().contains( role ) && writableLdap ) |
| { |
| ldapRoleMapper.removeUserRole( role, userAssignment.getPrincipal(), context ); |
| } |
| } |
| |
| userAssignmentsCache.put( userAssignment.getPrincipal(), userAssignment ); |
| return userAssignment; |
| } |
| catch ( UserManagerException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( MappingException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| catch ( LdapException e ) |
| { |
| throw new RbacManagerException( e.getMessage(), e ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| } |
| |
| public boolean userAssignmentExists( String principal ) |
| { |
| if ( userAssignmentsCache.hasKey( principal ) ) |
| { |
| return true; |
| } |
| LdapConnection ldapConnection = null; |
| DirContext context = null; |
| try |
| { |
| ldapConnection = ldapConnectionFactory.getConnection(); |
| context = ldapConnection.getDirContext(); |
| List<String> roles = ldapRoleMapper.getRoles( principal, context, getRealRoles() ); |
| if ( roles == null || roles.isEmpty() ) |
| { |
| return false; |
| } |
| return true; |
| } |
| catch ( RbacManagerException e ) |
| { |
| log.warn( "fail to call userAssignmentExists: {}", e.getMessage() ); |
| } |
| catch ( LdapException e ) |
| { |
| log.warn( "fail to call userAssignmentExists: {}", e.getMessage() ); |
| } |
| catch ( MappingException e ) |
| { |
| log.warn( "fail to call userAssignmentExists: {}", e.getMessage() ); |
| } |
| finally |
| { |
| closeContext( context ); |
| closeLdapConnection( ldapConnection ); |
| } |
| return false; |
| } |
| |
| public boolean userAssignmentExists( UserAssignment assignment ) |
| { |
| if ( assignment == null ) |
| { |
| return false; |
| } |
| return this.userAssignmentExists( assignment.getPrincipal() ); |
| } |
| |
| public RBACManager getRbacImpl() |
| { |
| return rbacImpl; |
| } |
| |
| public void setRbacImpl( RBACManager rbacImpl ) |
| { |
| this.rbacImpl = rbacImpl; |
| } |
| |
| public boolean isWritableLdap() |
| { |
| return writableLdap; |
| } |
| |
| public void setWritableLdap( boolean writableLdap ) |
| { |
| this.writableLdap = writableLdap; |
| } |
| |
| public LdapRoleMapper getLdapRoleMapper() |
| { |
| return ldapRoleMapper; |
| } |
| |
| public void setLdapRoleMapper( LdapRoleMapper ldapRoleMapper ) |
| { |
| this.ldapRoleMapper = ldapRoleMapper; |
| } |
| |
| private static class RoleImpl |
| extends AbstractRole |
| { |
| private String name; |
| |
| private String description; |
| |
| private List<Permission> permissions = new ArrayList<Permission>(); |
| |
| private List<String> childRoleNames = new ArrayList<String>(); |
| |
| private RoleImpl( String name ) |
| { |
| this.name = name; |
| } |
| |
| private RoleImpl( String name, List<Permission> permissions ) |
| { |
| this.name = name; |
| this.permissions = permissions; |
| } |
| |
| public void addPermission( Permission permission ) |
| { |
| this.permissions.add( permission ); |
| } |
| |
| public void addChildRoleName( String name ) |
| { |
| this.childRoleNames.add( name ); |
| } |
| |
| public List<String> getChildRoleNames() |
| { |
| return this.childRoleNames; |
| } |
| |
| public String getDescription() |
| { |
| return this.description; |
| } |
| |
| public String getName() |
| { |
| return this.name; |
| } |
| |
| public List<Permission> getPermissions() |
| { |
| return this.permissions; |
| } |
| |
| public boolean isAssignable() |
| { |
| return true; |
| } |
| |
| public void removePermission( Permission permission ) |
| { |
| this.permissions.remove( permission ); |
| } |
| |
| public void setAssignable( boolean assignable ) |
| { |
| // no op |
| } |
| |
| public void setChildRoleNames( List<String> names ) |
| { |
| this.childRoleNames = names; |
| } |
| |
| public void setDescription( String description ) |
| { |
| this.description = description; |
| } |
| |
| public void setName( String name ) |
| { |
| this.name = name; |
| } |
| |
| public void setPermissions( List<Permission> permissions ) |
| { |
| this.permissions = permissions; |
| } |
| |
| public boolean isPermanent() |
| { |
| return true; |
| } |
| |
| public void setPermanent( boolean permanent ) |
| { |
| // no op |
| } |
| |
| @Override |
| public String toString() |
| { |
| final StringBuilder sb = new StringBuilder(); |
| sb.append( "RoleImpl" ); |
| sb.append( "{name='" ).append( name ).append( '\'' ); |
| sb.append( '}' ); |
| return sb.toString(); |
| } |
| |
| @Override |
| public boolean equals( Object o ) |
| { |
| if ( this == o ) |
| { |
| return true; |
| } |
| if ( o == null || getClass() != o.getClass() ) |
| { |
| return false; |
| } |
| |
| RoleImpl role = (RoleImpl) o; |
| |
| if ( name != null ? !name.equals( role.name ) : role.name != null ) |
| { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| @Override |
| public int hashCode() |
| { |
| return name != null ? name.hashCode() : 0; |
| } |
| } |
| |
| private static class UserAssignmentImpl |
| implements UserAssignment |
| { |
| private String username; |
| |
| private List<String> roleNames; |
| |
| private boolean permanent; |
| |
| private UserAssignmentImpl( String username, Collection<String> roleNames ) |
| { |
| this.username = username; |
| |
| if ( roleNames == null ) |
| { |
| this.roleNames = new ArrayList<String>(); |
| } |
| else |
| { |
| this.roleNames = new ArrayList<String>( roleNames ); |
| } |
| } |
| |
| public String getPrincipal() |
| { |
| return this.username; |
| } |
| |
| public List<String> getRoleNames() |
| { |
| return this.roleNames; |
| } |
| |
| public void addRoleName( Role role ) |
| { |
| if ( role == null ) |
| { |
| return; |
| } |
| this.roleNames.add( role.getName() ); |
| } |
| |
| public void addRoleName( String roleName ) |
| { |
| if ( roleName == null ) |
| { |
| return; |
| } |
| this.roleNames.add( roleName ); |
| } |
| |
| public void removeRoleName( Role role ) |
| { |
| if ( role == null ) |
| { |
| return; |
| } |
| this.roleNames.remove( role.getName() ); |
| } |
| |
| public void removeRoleName( String roleName ) |
| { |
| if ( roleName == null ) |
| { |
| return; |
| } |
| this.roleNames.remove( roleName ); |
| } |
| |
| public void setPrincipal( String principal ) |
| { |
| this.username = principal; |
| } |
| |
| public void setRoleNames( List<String> roles ) |
| { |
| this.roleNames = roles; |
| } |
| |
| public boolean isPermanent() |
| { |
| return this.permanent; |
| } |
| |
| public void setPermanent( boolean permanent ) |
| { |
| this.permanent = permanent; |
| } |
| |
| @Override |
| public String toString() |
| { |
| final StringBuilder sb = new StringBuilder(); |
| sb.append( "UserAssignmentImpl" ); |
| sb.append( "{username='" ).append( username ).append( '\'' ); |
| sb.append( ", roleNames=" ).append( roleNames ); |
| sb.append( ", permanent=" ).append( permanent ); |
| sb.append( '}' ); |
| return sb.toString(); |
| } |
| } |
| |
| |
| @Override |
| public boolean isFinalImplementation() |
| { |
| return true; |
| } |
| |
| public String getDescriptionKey() |
| { |
| return "archiva.redback.rbacmanager.ldap"; |
| } |
| |
| public boolean isReadOnly() |
| { |
| return !writableLdap; |
| } |
| } |
