1 package org
.argeo
.cms
.internal
.kernel
;
3 import static org
.argeo
.cms
.internal
.kernel
.KernelUtils
.getFrameworkProp
;
4 import static org
.argeo
.cms
.internal
.kernel
.KernelUtils
.getOsgiInstanceDir
;
7 import java
.io
.IOException
;
9 import java
.util
.ArrayList
;
10 import java
.util
.Arrays
;
11 import java
.util
.Dictionary
;
12 import java
.util
.HashMap
;
13 import java
.util
.HashSet
;
14 import java
.util
.Hashtable
;
15 import java
.util
.List
;
19 import javax
.jcr
.Node
;
20 import javax
.jcr
.Repository
;
21 import javax
.jcr
.RepositoryException
;
22 import javax
.jcr
.Session
;
23 import javax
.jcr
.Value
;
24 import javax
.jcr
.security
.Privilege
;
25 import javax
.naming
.InvalidNameException
;
26 import javax
.naming
.ldap
.LdapName
;
27 import javax
.transaction
.TransactionManager
;
29 import org
.apache
.commons
.io
.FileUtils
;
30 import org
.apache
.commons
.logging
.Log
;
31 import org
.apache
.commons
.logging
.LogFactory
;
32 import org
.argeo
.ArgeoException
;
33 import org
.argeo
.cms
.CmsException
;
34 import org
.argeo
.cms
.auth
.AuthConstants
;
35 import org
.argeo
.jcr
.ArgeoJcrConstants
;
36 import org
.argeo
.jcr
.ArgeoNames
;
37 import org
.argeo
.jcr
.ArgeoTypes
;
38 import org
.argeo
.jcr
.JcrUtils
;
39 import org
.argeo
.jcr
.UserJcrUtils
;
40 import org
.argeo
.osgi
.useradmin
.LdapUserAdmin
;
41 import org
.argeo
.osgi
.useradmin
.LdifUserAdmin
;
42 import org
.argeo
.osgi
.useradmin
.UserAdminConf
;
43 import org
.argeo
.osgi
.useradmin
.UserDirectory
;
44 import org
.argeo
.osgi
.useradmin
.UserDirectoryException
;
45 import org
.osgi
.framework
.InvalidSyntaxException
;
46 import org
.osgi
.service
.useradmin
.Authorization
;
47 import org
.osgi
.service
.useradmin
.Role
;
48 import org
.osgi
.service
.useradmin
.User
;
49 import org
.osgi
.service
.useradmin
.UserAdmin
;
52 * Aggregates multiple {@link UserDirectory} and integrates them with this node
55 public class NodeUserAdmin
implements UserAdmin
{
56 private final static Log log
= LogFactory
.getLog(NodeUserAdmin
.class);
57 final static LdapName ROLES_BASE
;
60 ROLES_BASE
= new LdapName(AuthConstants
.ROLES_BASEDN
);
61 } catch (InvalidNameException e
) {
62 throw new UserDirectoryException("Cannot initialize "
63 + NodeUserAdmin
.class, e
);
68 private UserAdmin nodeRoles
= null;
69 private Map
<LdapName
, UserAdmin
> userAdmins
= new HashMap
<LdapName
, UserAdmin
>();
72 /** The home base path. */
73 private String homeBasePath
= "/home";
74 private String peopleBasePath
= ArgeoJcrConstants
.PEOPLE_BASE_PATH
;
75 private Repository repository
;
76 private Session adminSession
;
78 public NodeUserAdmin(TransactionManager transactionManager
,
79 Repository repository
) {
80 this.repository
= repository
;
82 this.adminSession
= this.repository
.login();
83 } catch (RepositoryException e
) {
84 throw new CmsException("Cannot log-in", e
);
88 File nodeBaseDir
= new File(getOsgiInstanceDir(), "node");
90 String userAdminUri
= getFrameworkProp(KernelConstants
.USERADMIN_URIS
);
91 initUserAdmins(userAdminUri
, nodeBaseDir
);
92 String nodeRolesUri
= getFrameworkProp(KernelConstants
.ROLES_URI
);
93 initNodeRoles(nodeRolesUri
, nodeBaseDir
);
95 // Transaction manager
96 ((UserDirectory
) nodeRoles
).setTransactionManager(transactionManager
);
97 for (UserAdmin userAdmin
: userAdmins
.values()) {
98 if (userAdmin
instanceof UserDirectory
)
99 ((UserDirectory
) userAdmin
)
100 .setTransactionManager(transactionManager
);
104 initJcr(adminSession
);
107 Dictionary
<String
, ?
> currentState() {
108 Dictionary
<String
, Object
> res
= new Hashtable
<String
, Object
>();
109 for (LdapName name
: userAdmins
.keySet()) {
110 StringBuilder buf
= new StringBuilder();
111 if (userAdmins
.get(name
) instanceof UserDirectory
) {
112 UserDirectory userDirectory
= (UserDirectory
) userAdmins
114 String uri
= UserAdminConf
.propertiesAsUri(
115 userDirectory
.getProperties()).toString();
118 buf
.append('/').append(name
.toString())
119 .append("?readOnly=true");
125 public void destroy() {
126 for (LdapName name
: userAdmins
.keySet()) {
127 if (userAdmins
.get(name
) instanceof UserDirectory
) {
128 UserDirectory userDirectory
= (UserDirectory
) userAdmins
130 userDirectory
.destroy();
136 public Role
createRole(String name
, int type
) {
137 return findUserAdmin(name
).createRole(name
, type
);
141 public boolean removeRole(String name
) {
142 boolean actuallyDeleted
= findUserAdmin(name
).removeRole(name
);
143 nodeRoles
.removeRole(name
);
144 return actuallyDeleted
;
148 public Role
getRole(String name
) {
149 return findUserAdmin(name
).getRole(name
);
153 public Role
[] getRoles(String filter
) throws InvalidSyntaxException
{
154 List
<Role
> res
= new ArrayList
<Role
>();
155 for (UserAdmin userAdmin
: userAdmins
.values()) {
156 res
.addAll(Arrays
.asList(userAdmin
.getRoles(filter
)));
158 res
.addAll(Arrays
.asList(nodeRoles
.getRoles(filter
)));
159 return res
.toArray(new Role
[res
.size()]);
163 public User
getUser(String key
, String value
) {
164 List
<User
> res
= new ArrayList
<User
>();
165 for (UserAdmin userAdmin
: userAdmins
.values()) {
166 User u
= userAdmin
.getUser(key
, value
);
170 // Note: node roles cannot contain users, so it is not searched
171 return res
.size() == 1 ? res
.get(0) : null;
175 public Authorization
getAuthorization(User user
) {
176 if (user
== null) {// anonymous
177 return nodeRoles
.getAuthorization(null);
179 UserAdmin userAdmin
= findUserAdmin(user
.getName());
180 Authorization rawAuthorization
= userAdmin
.getAuthorization(user
);
181 // gather system roles
182 Set
<String
> systemRoles
= new HashSet
<String
>();
183 for (String role
: rawAuthorization
.getRoles()) {
184 Authorization auth
= nodeRoles
.getAuthorization((User
) userAdmin
186 systemRoles
.addAll(Arrays
.asList(auth
.getRoles()));
188 Authorization authorization
= new NodeAuthorization(
189 rawAuthorization
.getName(), rawAuthorization
.toString(),
190 systemRoles
, rawAuthorization
.getRoles());
191 syncJcr(adminSession
, authorization
);
192 return authorization
;
196 // USER ADMIN AGGREGATOR
198 public synchronized void addUserAdmin(String baseDn
, UserAdmin userAdmin
) {
199 if (userAdmins
.containsKey(baseDn
))
200 throw new UserDirectoryException(
201 "There is already a user admin for " + baseDn
);
203 userAdmins
.put(new LdapName(baseDn
), userAdmin
);
204 } catch (InvalidNameException e
) {
205 throw new UserDirectoryException("Badly formatted base DN "
210 private UserAdmin
findUserAdmin(String name
) {
212 return findUserAdmin(new LdapName(name
));
213 } catch (InvalidNameException e
) {
214 throw new UserDirectoryException("Badly formatted name " + name
, e
);
218 private UserAdmin
findUserAdmin(LdapName name
) {
219 if (name
.startsWith(ROLES_BASE
))
221 List
<UserAdmin
> res
= new ArrayList
<UserAdmin
>(1);
222 for (LdapName baseDn
: userAdmins
.keySet()) {
223 if (name
.startsWith(baseDn
))
224 res
.add(userAdmins
.get(baseDn
));
227 throw new UserDirectoryException("Cannot find user admin for "
230 throw new UserDirectoryException("Multiple user admin found for "
235 public void setTransactionManager(TransactionManager transactionManager
) {
236 if (nodeRoles
instanceof UserDirectory
)
237 ((UserDirectory
) nodeRoles
)
238 .setTransactionManager(transactionManager
);
239 for (UserAdmin userAdmin
: userAdmins
.values()) {
240 if (userAdmin
instanceof UserDirectory
)
241 ((UserDirectory
) userAdmin
)
242 .setTransactionManager(transactionManager
);
246 private void initUserAdmins(String userAdminUri
, File nodeBaseDir
) {
247 if (userAdminUri
== null) {
248 String demoBaseDn
= "dc=example,dc=com";
249 File businessRolesFile
= new File(nodeBaseDir
, demoBaseDn
+ ".ldif");
250 if (!businessRolesFile
.exists())
252 FileUtils
.copyInputStreamToFile(getClass()
253 .getResourceAsStream(demoBaseDn
+ ".ldif"),
255 } catch (IOException e
) {
256 throw new CmsException("Cannot copy demo resource", e
);
258 userAdminUri
= businessRolesFile
.toURI().toString();
260 String
[] uris
= userAdminUri
.split(" ");
261 for (String uri
: uris
) {
265 if (u
.getPath() == null)
266 throw new CmsException("URI " + uri
267 + " must have a path in order to determine base DN");
268 if (u
.getScheme() == null) {
269 if (uri
.startsWith("/") || uri
.startsWith("./")
270 || uri
.startsWith("../"))
271 u
= new File(uri
).getCanonicalFile().toURI();
272 else if (!uri
.contains("/"))
273 u
= new File(nodeBaseDir
, uri
).getCanonicalFile()
276 throw new CmsException("Cannot interpret " + uri
278 } else if (u
.getScheme().equals("file")) {
279 u
= new File(u
).getCanonicalFile().toURI();
281 } catch (Exception e
) {
282 throw new CmsException(
283 "Cannot interpret " + uri
+ " as an uri", e
);
285 Dictionary
<String
, ?
> properties
= UserAdminConf
.uriAsProperties(u
287 UserDirectory businessRoles
;
288 if (u
.getScheme().startsWith("ldap")) {
289 businessRoles
= new LdapUserAdmin(properties
);
291 businessRoles
= new LdifUserAdmin(properties
);
293 businessRoles
.init();
294 String baseDn
= businessRoles
.getBaseDn();
295 if (userAdmins
.containsKey(baseDn
))
296 throw new UserDirectoryException(
297 "There is already a user admin for " + baseDn
);
299 userAdmins
.put(new LdapName(baseDn
), (UserAdmin
) businessRoles
);
300 } catch (InvalidNameException e
) {
301 throw new UserDirectoryException("Badly formatted base DN "
304 addUserAdmin(businessRoles
.getBaseDn(), (UserAdmin
) businessRoles
);
305 if (log
.isDebugEnabled())
306 log
.debug("User directory " + businessRoles
.getBaseDn() + " ["
307 + u
.getScheme() + "] enabled.");
312 private void initNodeRoles(String nodeRolesUri
, File nodeBaseDir
) {
313 String baseNodeRoleDn
= AuthConstants
.ROLES_BASEDN
;
314 if (nodeRolesUri
== null) {
315 File nodeRolesFile
= new File(nodeBaseDir
, baseNodeRoleDn
+ ".ldif");
316 if (!nodeRolesFile
.exists())
318 FileUtils
.copyInputStreamToFile(getClass()
319 .getResourceAsStream("demo.ldif"), nodeRolesFile
);
320 } catch (IOException e
) {
321 throw new CmsException("Cannot copy demo resource", e
);
323 nodeRolesUri
= nodeRolesFile
.toURI().toString();
326 Dictionary
<String
, ?
> nodeRolesProperties
= UserAdminConf
327 .uriAsProperties(nodeRolesUri
);
328 if (!nodeRolesProperties
.get(UserAdminConf
.baseDn
.property()).equals(
330 throw new CmsException("Invalid base dn for node roles");
331 // TODO deal with "mounted" roles with a different baseDN
333 if (nodeRolesUri
.startsWith("ldap")) {
334 nodeRoles
= new LdapUserAdmin(nodeRolesProperties
);
336 nodeRoles
= new LdifUserAdmin(nodeRolesProperties
);
338 ((UserDirectory
) nodeRoles
).setExternalRoles(this);
339 ((UserDirectory
) nodeRoles
).init();
340 addUserAdmin(baseNodeRoleDn
, (UserAdmin
) nodeRoles
);
341 if (log
.isTraceEnabled())
342 log
.trace("Node roles enabled.");
349 private void initJcr(Session adminSession
) {
351 JcrUtils
.mkdirs(adminSession
, homeBasePath
);
352 JcrUtils
.mkdirs(adminSession
, peopleBasePath
);
355 JcrUtils
.addPrivilege(adminSession
, homeBasePath
,
356 AuthConstants
.ROLE_USER_ADMIN
, Privilege
.JCR_READ
);
357 JcrUtils
.addPrivilege(adminSession
, peopleBasePath
,
358 AuthConstants
.ROLE_USER_ADMIN
, Privilege
.JCR_ALL
);
360 } catch (RepositoryException e
) {
361 throw new CmsException("Cannot initialize node user admin", e
);
365 private Node
syncJcr(Session session
, Authorization authorization
) {
366 // TODO check user name validity (e.g. should not start by ROLE_)
367 String username
= authorization
.getName();
368 String
[] roles
= authorization
.getRoles();
370 Node userHome
= UserJcrUtils
.getUserHome(session
, username
);
371 if (userHome
== null) {
372 String homePath
= generateUserPath(homeBasePath
, username
);
373 if (session
.itemExists(homePath
))// duplicate user id
374 userHome
= session
.getNode(homePath
).getParent()
375 .addNode(JcrUtils
.lastPathElement(homePath
));
377 userHome
= JcrUtils
.mkdirs(session
, homePath
);
378 // userHome = JcrUtils.mkfolders(session, homePath);
379 userHome
.addMixin(ArgeoTypes
.ARGEO_USER_HOME
);
380 userHome
.setProperty(ArgeoNames
.ARGEO_USER_ID
, username
);
383 JcrUtils
.clearAccessControList(session
, homePath
, username
);
384 JcrUtils
.addPrivilege(session
, homePath
, username
,
388 Node userProfile
= UserJcrUtils
.getUserProfile(session
, username
);
390 if (userProfile
== null) {
391 String personPath
= generateUserPath(peopleBasePath
, username
);
393 if (session
.itemExists(personPath
))// duplicate user id
394 personBase
= session
.getNode(personPath
).getParent()
395 .addNode(JcrUtils
.lastPathElement(personPath
));
397 personBase
= JcrUtils
.mkdirs(session
, personPath
);
398 userProfile
= personBase
.addNode(ArgeoNames
.ARGEO_PROFILE
);
399 userProfile
.addMixin(ArgeoTypes
.ARGEO_USER_PROFILE
);
400 userProfile
.setProperty(ArgeoNames
.ARGEO_USER_ID
, username
);
401 userProfile
.setProperty(ArgeoNames
.ARGEO_ENABLED
, true);
402 userProfile
.setProperty(ArgeoNames
.ARGEO_ACCOUNT_NON_EXPIRED
,
404 userProfile
.setProperty(ArgeoNames
.ARGEO_ACCOUNT_NON_LOCKED
,
406 userProfile
.setProperty(
407 ArgeoNames
.ARGEO_CREDENTIALS_NON_EXPIRED
, true);
410 JcrUtils
.clearAccessControList(session
, userProfile
.getPath(),
412 JcrUtils
.addPrivilege(session
, userProfile
.getPath(), username
,
418 writeRemoteRoles(userProfile
, roles
);
422 } catch (RepositoryException e
) {
423 JcrUtils
.discardQuietly(session
);
424 throw new ArgeoException("Cannot sync node security model for "
429 /** Generate path for a new user home */
430 private String
generateUserPath(String base
, String username
) {
433 dn
= new LdapName(username
);
434 } catch (InvalidNameException e
) {
435 throw new ArgeoException("Invalid name " + username
, e
);
437 String userId
= dn
.getRdn(dn
.size() - 1).getValue().toString();
438 int atIndex
= userId
.indexOf('@');
440 String domain
= userId
.substring(0, atIndex
);
441 String name
= userId
.substring(atIndex
+ 1);
442 return base
+ '/' + JcrUtils
.firstCharsToPath(domain
, 2) + '/'
443 + domain
+ '/' + JcrUtils
.firstCharsToPath(name
, 2) + '/'
445 } else if (atIndex
== 0 || atIndex
== (userId
.length() - 1)) {
446 throw new ArgeoException("Unsupported username " + userId
);
448 return base
+ '/' + JcrUtils
.firstCharsToPath(userId
, 2) + '/'
453 /** Write remote roles used by remote access in the home directory */
454 private void writeRemoteRoles(Node userHome
, String
[] roles
)
455 throws RepositoryException
{
456 boolean writeRoles
= false;
457 if (userHome
.hasProperty(ArgeoNames
.ARGEO_REMOTE_ROLES
)) {
458 Value
[] remoteRoles
= userHome
.getProperty(
459 ArgeoNames
.ARGEO_REMOTE_ROLES
).getValues();
460 if (remoteRoles
.length
!= roles
.length
)
463 for (int i
= 0; i
< remoteRoles
.length
; i
++)
464 if (!remoteRoles
[i
].getString().equals(roles
[i
]))
470 userHome
.getSession().getWorkspace().getVersionManager()
471 .checkout(userHome
.getPath());
472 userHome
.setProperty(ArgeoNames
.ARGEO_REMOTE_ROLES
, roles
);
473 JcrUtils
.updateLastModified(userHome
);
474 userHome
.getSession().save();
475 userHome
.getSession().getWorkspace().getVersionManager()
476 .checkin(userHome
.getPath());
477 if (log
.isDebugEnabled())
478 log
.debug("Wrote remote roles " + roles
+ " for "
479 + userHome
.getProperty(ArgeoNames
.ARGEO_USER_ID
));