| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| */ |
| |
| /* $Id$ */ |
| |
| package org.apache.lenya.cms.cocoon.components.modules.input; |
| |
| import java.util.Arrays; |
| import java.util.Iterator; |
| import java.util.Map; |
| |
| import org.apache.avalon.framework.configuration.Configuration; |
| import org.apache.avalon.framework.configuration.ConfigurationException; |
| import org.apache.avalon.framework.service.ServiceException; |
| import org.apache.avalon.framework.service.ServiceManager; |
| import org.apache.avalon.framework.service.ServiceSelector; |
| import org.apache.avalon.framework.service.Serviceable; |
| import org.apache.cocoon.components.modules.input.AbstractInputModule; |
| import org.apache.cocoon.environment.ObjectModelHelper; |
| import org.apache.cocoon.environment.Request; |
| import org.apache.cocoon.environment.Session; |
| import org.apache.lenya.ac.AccessControlException; |
| import org.apache.lenya.ac.AccessController; |
| import org.apache.lenya.ac.AccessControllerResolver; |
| import org.apache.lenya.ac.AccreditableManager; |
| import org.apache.lenya.ac.Identity; |
| import org.apache.lenya.ac.ItemManager; |
| import org.apache.lenya.ac.Machine; |
| import org.apache.lenya.ac.Policy; |
| import org.apache.lenya.ac.PolicyManager; |
| import org.apache.lenya.ac.Role; |
| import org.apache.lenya.ac.User; |
| import org.apache.lenya.ac.UserManager; |
| import org.apache.lenya.cms.ac.PolicyUtil; |
| import org.apache.lenya.util.ServletHelper; |
| |
| /** |
| * <p> |
| * Input module for access control attributes. |
| * </p> |
| * <p> |
| * Attributes: |
| * </p> |
| * <ul> |
| * <li><strong><code>user-id</code></strong> - the ID of the currently logged-in user</li> |
| * <li><strong><code>user-name</code></strong> - the full name of the currently logged-in user</li> |
| * <li><strong><code>user-name:{user-id}</code></strong> - the full name of a specific user</li> |
| * <li><strong><code>user-email</code></strong> - the e-mail address of the currently logged-in user</li> |
| * <li><strong><code>user-email:{user-id}</code></strong> - the e-mail address of a specific user</li> |
| * <li><strong><code>ip-address</code></strong> - the IP address of the client machine</li> |
| * <li><strong><code>role-ids</code></strong> - the role IDs which are granted to the current identity</li> |
| * <li><strong><code>user-manager</code></strong> - the user manager object</li> |
| * <li><strong><code>group-manager</code></strong> - the group manager object</li> |
| * <li><strong><code>iprange-manager</code></strong> - the IP range manager object</li> |
| * <li><strong><code>role-manager</code></strong> - the role manager object</li> |
| * </ul> |
| * |
| */ |
| public class AccessControlModule extends AbstractInputModule implements Serviceable { |
| |
| /** |
| * <code>USER_ID</code> The user id |
| */ |
| public static final String USER_ID = "user-id"; |
| /** |
| * <code>USER_NAME</code> The user name, optional: provide the user ID after a colon |
| */ |
| public static final String USER_NAME = "user-name"; |
| /** |
| * <code>USER_EMAIL</code> The user email, optional: provide the user ID after a colon |
| */ |
| public static final String USER_EMAIL = "user-email"; |
| /** |
| * <code>IP_ADDRESS</code> The IP address |
| */ |
| public static final String IP_ADDRESS = "ip-address"; |
| /** |
| * <code>ROLE_IDS</code> The role ids |
| */ |
| public static final String ROLE_IDS = "role-ids"; |
| /** |
| * <code>USER_MANAGER</code> The user manager |
| */ |
| public static final String USER_MANAGER = "user-manager"; |
| /** |
| * <code>GROUP_MANAGER</code> The group manager |
| */ |
| public static final String GROUP_MANAGER = "group-manager"; |
| /** |
| * <code>ROLE_MANAGER</code> The role manager |
| */ |
| public static final String ROLE_MANAGER = "role-manager"; |
| /** |
| * <code>IP_RANGE_MANAGER</code> The IP range manager |
| */ |
| public static final String IP_RANGE_MANAGER = "iprange-manager"; |
| /** |
| * Returns if the current page is SSL protected (true|false). |
| */ |
| public static final String SSL = "ssl"; |
| |
| /** |
| * The names of the AccessControlModule parameters. |
| */ |
| static final String[] PARAMETER_NAMES = { IP_ADDRESS, USER_ID, USER_NAME, USER_EMAIL, ROLE_IDS, |
| USER_MANAGER, GROUP_MANAGER, ROLE_MANAGER, IP_RANGE_MANAGER, SSL }; |
| |
| /** |
| * |
| * @see org.apache.cocoon.components.modules.input.InputModule#getAttribute(java.lang.String, |
| * org.apache.avalon.framework.configuration.Configuration, java.util.Map) |
| */ |
| public Object getAttribute(String attribute, Configuration modeConf, Map objectModel) |
| throws ConfigurationException { |
| |
| Request request = ObjectModelHelper.getRequest(objectModel); |
| Session session = request.getSession(); |
| Object value = null; |
| |
| String[] parameters = attribute.split(":", 2); |
| String name = parameters[0]; |
| |
| if (!Arrays.asList(PARAMETER_NAMES).contains(name)) { |
| throw new ConfigurationException("The attribute [" + name + "] is not supported!"); |
| } |
| |
| Identity identity = null; |
| |
| if (session != null) { |
| identity = (Identity) session.getAttribute(Identity.class.getName()); |
| } |
| User user = getUser(request, parameters, identity); |
| |
| if (user != null) { |
| if (name.equals(USER_NAME)) { |
| value = user.getName(); |
| } else if (name.equals(USER_EMAIL)) { |
| value = user.getEmail(); |
| } |
| } |
| |
| if (identity != null) { |
| if (name.equals(USER_ID)) { |
| User currentUser = identity.getUser(); |
| if (currentUser != null) { |
| value = currentUser.getId(); |
| } |
| } else if (name.equals(IP_ADDRESS)) { |
| Machine machine = identity.getMachine(); |
| if (machine != null) { |
| value = machine.getIp(); |
| } |
| } else if (name.equals(ROLE_IDS)) { |
| try { |
| Role[] roles = PolicyUtil.getRoles(request); |
| StringBuffer buf = new StringBuffer(); |
| for (int i = 0; i < roles.length; i++) { |
| if (i > 0) { |
| buf.append(","); |
| } |
| buf.append(roles[i].getId()); |
| } |
| value = buf.toString(); |
| } catch (AccessControlException e) { |
| throw new ConfigurationException("Obtaining value for attribute [" + name |
| + "] failed: ", e); |
| } |
| } |
| } |
| |
| if (name.equals(USER_MANAGER) || name.equals(GROUP_MANAGER) || name.equals(ROLE_MANAGER) |
| || name.equals(IP_RANGE_MANAGER)) { |
| value = getItemManager(request, name); |
| } |
| |
| if (name.equals(SSL)) { |
| ServiceSelector selector = null; |
| AccessControllerResolver acResolver = null; |
| AccessController accessController = null; |
| try { |
| selector = (ServiceSelector) this.manager.lookup(AccessControllerResolver.ROLE |
| + "Selector"); |
| acResolver |
| = (AccessControllerResolver) selector.select(AccessControllerResolver.DEFAULT_RESOLVER); |
| |
| String url = ServletHelper.getWebappURI(request); |
| accessController = acResolver.resolveAccessController(url); |
| AccreditableManager accreditableManager = accessController.getAccreditableManager(); |
| PolicyManager policyManager = accessController.getPolicyManager(); |
| |
| Policy policy = policyManager.getPolicy(accreditableManager, url); |
| value = Boolean.toString(policy.isSSLProtected()); |
| } |
| catch (Exception e) { |
| throw new ConfigurationException("Resolving attribute [" + name + "] failed: ", e); |
| } |
| finally { |
| if (selector != null) { |
| if (acResolver != null) { |
| if (accessController != null) { |
| acResolver.release(accessController); |
| } |
| selector.release(acResolver); |
| } |
| this.manager.release(selector); |
| } |
| } |
| } |
| |
| return value; |
| } |
| |
| /** |
| * Returns the user specified with parameter[1], falling back to the currently logged in user. |
| * @param request The request. |
| * @param parameters The parameters. |
| * @param identity The logged in identity. |
| * @return A user or <code>null</code> if no user is specified or logged in. |
| * @throws ConfigurationException if an error occurs. |
| */ |
| protected User getUser(Request request, String[] parameters, Identity identity) |
| throws ConfigurationException { |
| User user = null; |
| if (parameters.length == 1) { |
| if (identity != null) { |
| user = identity.getUser(); |
| } |
| } else { |
| String userId = parameters[1]; |
| if (!userId.equals("")) { |
| UserManager userManager = (UserManager) getItemManager(request, USER_MANAGER); |
| user = userManager.getUser(userId); |
| } |
| } |
| return user; |
| } |
| |
| /** |
| * @see org.apache.cocoon.components.modules.input.InputModule#getAttributeNames(org.apache.avalon.framework.configuration.Configuration, |
| * java.util.Map) |
| */ |
| public Iterator getAttributeNames(Configuration modeConf, Map objectModel) |
| throws ConfigurationException { |
| return Arrays.asList(PARAMETER_NAMES).iterator(); |
| } |
| |
| /** |
| * @see org.apache.cocoon.components.modules.input.InputModule#getAttributeValues(java.lang.String, |
| * org.apache.avalon.framework.configuration.Configuration, java.util.Map) |
| */ |
| public Object[] getAttributeValues(String name, Configuration modeConf, Map objectModel) |
| throws ConfigurationException { |
| Object[] objects = { getAttribute(name, modeConf, objectModel) }; |
| |
| return objects; |
| } |
| |
| /** |
| * Returns the item manager for a certain name. |
| * @param request The request. |
| * @param name The name of the manager ({@link #USER_MANAGER}, {@link #ROLE_MANAGER}, |
| * {@link #GROUP_MANAGER}, or {@link #IP_RANGE_MANAGER} |
| * @return An item manager. |
| * @throws ConfigurationException when something went wrong. |
| */ |
| protected ItemManager getItemManager(Request request, String name) |
| throws ConfigurationException { |
| AccessController accessController = null; |
| ServiceSelector selector = null; |
| AccessControllerResolver resolver = null; |
| ItemManager itemManager = null; |
| |
| try { |
| selector = (ServiceSelector) this.manager.lookup(AccessControllerResolver.ROLE |
| + "Selector"); |
| resolver = (AccessControllerResolver) selector |
| .select(AccessControllerResolver.DEFAULT_RESOLVER); |
| |
| String requestURI = request.getRequestURI(); |
| String context = request.getContextPath(); |
| if (context == null) { |
| context = ""; |
| } |
| String url = requestURI.substring(context.length()); |
| accessController = resolver.resolveAccessController(url); |
| |
| AccreditableManager accreditableManager = accessController.getAccreditableManager(); |
| |
| if (name.equals(USER_MANAGER)) { |
| itemManager = accreditableManager.getUserManager(); |
| } else if (name.equals(GROUP_MANAGER)) { |
| itemManager = accreditableManager.getGroupManager(); |
| } else if (name.equals(ROLE_MANAGER)) { |
| itemManager = accreditableManager.getRoleManager(); |
| } else if (name.equals(IP_RANGE_MANAGER)) { |
| itemManager = accreditableManager.getIPRangeManager(); |
| } |
| |
| } catch (Exception e) { |
| throw new ConfigurationException("Obtaining item manager failed: ", e); |
| } finally { |
| if (selector != null) { |
| if (resolver != null) { |
| if (accessController != null) { |
| resolver.release(accessController); |
| } |
| selector.release(resolver); |
| } |
| this.manager.release(selector); |
| } |
| } |
| |
| return itemManager; |
| } |
| |
| private ServiceManager manager; |
| |
| /** |
| * @see org.apache.avalon.framework.service.Serviceable#service(org.apache.avalon.framework.service.ServiceManager) |
| */ |
| public void service(ServiceManager _manager) throws ServiceException { |
| this.manager = _manager; |
| } |
| |
| } |
