X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Finternal%2Fauth%2FCmsUserManagerImpl.java;h=a4c482663e73c86d19f236825317b379fee2e05c;hb=54df376a9c2dd458a82eaa09bfbb718fe699dd0d;hp=dfb0a56a27a554691706907b22f014f22a63ff23;hpb=a61a938100ef882c56104e4eb4ea18f7c786c3bc;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.cms/src/org/argeo/cms/internal/auth/CmsUserManagerImpl.java b/org.argeo.cms/src/org/argeo/cms/internal/auth/CmsUserManagerImpl.java index dfb0a56a2..a4c482663 100644 --- a/org.argeo.cms/src/org/argeo/cms/internal/auth/CmsUserManagerImpl.java +++ b/org.argeo.cms/src/org/argeo/cms/internal/auth/CmsUserManagerImpl.java @@ -1,8 +1,8 @@ package org.argeo.cms.internal.auth; -import static org.argeo.util.naming.LdapAttrs.cn; -import static org.argeo.util.naming.LdapAttrs.description; -import static org.argeo.util.naming.LdapAttrs.owner; +import static org.argeo.api.acr.ldap.LdapAttrs.cn; +import static org.argeo.api.acr.ldap.LdapAttrs.description; +import static org.argeo.api.acr.ldap.LdapAttrs.owner; import java.time.ZoneOffset; import java.time.ZonedDateTime; @@ -14,6 +14,7 @@ import java.util.HashSet; import java.util.List; import java.util.Map; import java.util.NavigableMap; +import java.util.Objects; import java.util.Set; import java.util.TreeMap; import java.util.TreeSet; @@ -23,19 +24,23 @@ import javax.naming.InvalidNameException; import javax.naming.ldap.LdapName; import javax.security.auth.Subject; +import org.argeo.api.acr.NamespaceUtils; +import org.argeo.api.acr.ldap.LdapAttrs; +import org.argeo.api.acr.ldap.NamingUtils; import org.argeo.api.cms.CmsConstants; import org.argeo.api.cms.CmsLog; +import org.argeo.api.cms.directory.HierarchyUnit; +import org.argeo.api.cms.transaction.WorkTransaction; import org.argeo.cms.CmsUserManager; import org.argeo.cms.auth.CurrentUser; +import org.argeo.cms.auth.SystemRole; import org.argeo.cms.auth.UserAdminUtils; -import org.argeo.osgi.useradmin.AggregatingUserAdmin; -import org.argeo.osgi.useradmin.TokenUtils; -import org.argeo.osgi.useradmin.UserDirectory; -import org.argeo.util.directory.DirectoryConf; -import org.argeo.util.directory.ldap.SharedSecret; -import org.argeo.util.naming.LdapAttrs; -import org.argeo.util.naming.NamingUtils; -import org.argeo.util.transaction.WorkTransaction; +import org.argeo.cms.directory.ldap.LdapEntry; +import org.argeo.cms.directory.ldap.SharedSecret; +import org.argeo.cms.osgi.useradmin.AggregatingUserAdmin; +import org.argeo.cms.osgi.useradmin.TokenUtils; +import org.argeo.cms.osgi.useradmin.UserDirectory; +import org.argeo.cms.runtime.DirectoryConf; import org.osgi.framework.InvalidSyntaxException; import org.osgi.service.useradmin.Authorization; import org.osgi.service.useradmin.Group; @@ -62,6 +67,9 @@ public class CmsUserManagerImpl implements CmsUserManager { // private Map serviceProperties; private WorkTransaction userTransaction; + private final String[] knownProps = { LdapAttrs.cn.name(), LdapAttrs.sn.name(), LdapAttrs.givenName.name(), + LdapAttrs.uid.name() }; + // private Map> userDirectories = Collections // .synchronizedMap(new LinkedHashMap<>()); @@ -87,7 +95,7 @@ public class CmsUserManagerImpl implements CmsUserManager { // ALL USER: WARNING access to this will be later reduced - /** Retrieve a user given his dn */ + /** Retrieve a user given his dn, or null if it doesn't exist. */ public User getUser(String dn) { return (User) getUserAdmin().getRole(dn); } @@ -124,9 +132,6 @@ public class CmsUserManagerImpl implements CmsUserManager { return false; } - private final String[] knownProps = { LdapAttrs.cn.name(), LdapAttrs.sn.name(), LdapAttrs.givenName.name(), - LdapAttrs.uid.name() }; - public Set listUsersInGroup(String groupDn, String filter) { Group group = (Group) userAdmin.getRole(groupDn); if (group == null) @@ -136,6 +141,22 @@ public class CmsUserManagerImpl implements CmsUserManager { return users; } +// @Override +// public Set listAccounts(HierarchyUnit hierarchyUnit, boolean deep) { +// if(!hierarchyUnit.isFunctional()) +// throw new IllegalArgumentException("Hierarchy unit "+hierarchyUnit.getBase()+" is not functional"); +// UserDirectory directory = (UserDirectory)hierarchyUnit.getDirectory(); +// Set res = new HashSet<>(); +// for(HierarchyUnit technicalHu:hierarchyUnit.getDirectHierarchyUnits(false)) { +// if(technicalHu.isFunctional()) +// continue; +// for(Role role:directory.getHierarchyUnitRoles(technicalHu, null, false)) { +// if(role) +// } +// } +// return res; +// } + /** Recursively add users to list */ private void addUsers(Set users, Group group, String filter) { Role[] roles = group.getMembers(); @@ -162,7 +183,8 @@ public class CmsUserManagerImpl implements CmsUserManager { List users = new ArrayList(); for (Role role : roles) { if ((includeUsers && role.getType() == Role.USER || role.getType() == Role.GROUP) && !users.contains(role) - && (includeSystemRoles || !role.getName().toLowerCase().endsWith(CmsConstants.ROLES_BASEDN))) { + && (includeSystemRoles + || !role.getName().toLowerCase().endsWith(CmsConstants.SYSTEM_ROLES_BASEDN))) { if (match(role, filter)) users.add((User) role); } @@ -205,6 +227,188 @@ public class CmsUserManagerImpl implements CmsUserManager { return buildDistinguishedName(localId, getDefaultDomainName(), type); } + /* + * EDITION + */ + @Override + public User createUser(String username, Map properties, Map credentials) { + try { + userTransaction.begin(); + User user = (User) userAdmin.createRole(username, Role.USER); + if (properties != null) { + for (String key : properties.keySet()) + user.getProperties().put(key, properties.get(key)); + } + if (credentials != null) { + for (String key : credentials.keySet()) + user.getCredentials().put(key, credentials.get(key)); + } + userTransaction.commit(); + return user; + } catch (Exception e) { + try { + userTransaction.rollback(); + } catch (Exception e1) { + log.error("Could not roll back", e1); + } + if (e instanceof RuntimeException) + throw (RuntimeException) e; + else + throw new RuntimeException("Cannot create user " + username, e); + } + } + + @Override + public Group getOrCreateGroup(HierarchyUnit groups, String commonName) { + try { + String dn = LdapAttrs.cn.name() + "=" + commonName + "," + groups.getBase(); + Group group = (Group) getUserAdmin().getRole(dn); + if (group != null) + return group; + userTransaction.begin(); + group = (Group) userAdmin.createRole(dn, Role.GROUP); + userTransaction.commit(); + return group; + } catch (Exception e) { + try { + userTransaction.rollback(); + } catch (Exception e1) { + log.error("Could not roll back", e1); + } + if (e instanceof RuntimeException) + throw (RuntimeException) e; + else + throw new RuntimeException("Cannot create group " + commonName + " in " + groups, e); + } + } + + @Override + public Group getOrCreateSystemRole(HierarchyUnit roles, SystemRole systemRole) { + try { + String dn = LdapAttrs.cn.name() + "=" + NamespaceUtils.toPrefixedName(systemRole.getName()) + "," + + roles.getBase(); + Group group = (Group) getUserAdmin().getRole(dn); + if (group != null) + return group; + userTransaction.begin(); + group = (Group) userAdmin.createRole(dn, Role.GROUP); + userTransaction.commit(); + return group; + } catch (Exception e) { + try { + userTransaction.rollback(); + } catch (Exception e1) { + log.error("Could not roll back", e1); + } + if (e instanceof RuntimeException) + throw (RuntimeException) e; + else + throw new RuntimeException("Cannot create system role " + systemRole + " in " + roles, e); + } + } + + @Override + public HierarchyUnit getOrCreateHierarchyUnit(UserDirectory directory, String path) { + HierarchyUnit hi = directory.getHierarchyUnit(path); + if (hi != null) + return hi; + try { + userTransaction.begin(); + HierarchyUnit hierarchyUnit = directory.createHierarchyUnit(path); + userTransaction.commit(); + return hierarchyUnit; + } catch (Exception e1) { + try { + if (!userTransaction.isNoTransactionStatus()) + userTransaction.rollback(); + } catch (Exception e2) { + if (log.isTraceEnabled()) + log.trace("Cannot rollback transaction", e2); + } + throw new RuntimeException("Cannot create hierarchy unit " + path + " in directory " + directory, e1); + } + } + + @Override + public void addObjectClasses(Role role, Set objectClasses, Map additionalProperties) { + try { + userTransaction.begin(); + LdapEntry.addObjectClasses(role.getProperties(), objectClasses); + for (String key : additionalProperties.keySet()) { + role.getProperties().put(key, additionalProperties.get(key)); + } + userTransaction.commit(); + } catch (Exception e1) { + try { + if (!userTransaction.isNoTransactionStatus()) + userTransaction.rollback(); + } catch (Exception e2) { + if (log.isTraceEnabled()) + log.trace("Cannot rollback transaction", e2); + } + throw new RuntimeException("Cannot add object classes " + objectClasses + " to " + role, e1); + } + } + + @Override + public void addObjectClasses(HierarchyUnit hierarchyUnit, Set objectClasses, + Map additionalProperties) { + try { + userTransaction.begin(); + LdapEntry.addObjectClasses(hierarchyUnit.getProperties(), objectClasses); + for (String key : additionalProperties.keySet()) { + hierarchyUnit.getProperties().put(key, additionalProperties.get(key)); + } + userTransaction.commit(); + } catch (Exception e1) { + try { + if (!userTransaction.isNoTransactionStatus()) + userTransaction.rollback(); + } catch (Exception e2) { + if (log.isTraceEnabled()) + log.trace("Cannot rollback transaction", e2); + } + throw new RuntimeException("Cannot add object classes " + objectClasses + " to " + hierarchyUnit, e1); + } + } + + @Override + public void edit(Runnable action) { + Objects.requireNonNull(action); + try { + userTransaction.begin(); + action.run(); + userTransaction.commit(); + } catch (Exception e1) { + try { + if (!userTransaction.isNoTransactionStatus()) + userTransaction.rollback(); + } catch (Exception e2) { + if (log.isTraceEnabled()) + log.trace("Cannot rollback transaction", e2); + } + throw new RuntimeException("Cannot edit", e1); + } + } + + @Override + public void addMember(Group group, Role role) { + try { + userTransaction.begin(); + group.addMember(role); + userTransaction.commit(); + } catch (Exception e1) { + try { + if (!userTransaction.isNoTransactionStatus()) + userTransaction.rollback(); + } catch (Exception e2) { + if (log.isTraceEnabled()) + log.trace("Cannot rollback transaction", e2); + } + throw new RuntimeException("Cannot add object classes " + role + " to group " + group, e1); + } + } + @Override public String getDefaultDomainName() { Map dns = getKnownBaseDns(true); @@ -215,36 +419,15 @@ public class CmsUserManagerImpl implements CmsUserManager { + dns.keySet().toString() + ". Unable to chose a default one."); } -// public Map getKnownBaseDns(boolean onlyWritable) { -// Map dns = new HashMap(); -// String[] propertyKeys = serviceProperties.keySet().toArray(new String[serviceProperties.size()]); -// for (String uri : propertyKeys) { -// if (!uri.startsWith("/")) -// continue; -// Dictionary props = UserAdminConf.uriAsProperties(uri); -// String readOnly = UserAdminConf.readOnly.getValue(props); -// String baseDn = UserAdminConf.baseDn.getValue(props); -// -// if (onlyWritable && "true".equals(readOnly)) -// continue; -// if (baseDn.equalsIgnoreCase(NodeConstants.ROLES_BASEDN)) -// continue; -// if (baseDn.equalsIgnoreCase(NodeConstants.TOKENS_BASEDN)) -// continue; -// dns.put(baseDn, uri); -// } -// return dns; -// } - public Map getKnownBaseDns(boolean onlyWritable) { Map dns = new HashMap(); for (UserDirectory userDirectory : userDirectories) { Boolean readOnly = userDirectory.isReadOnly(); - String baseDn = userDirectory.getContext(); + String baseDn = userDirectory.getBase(); if (onlyWritable && readOnly) continue; - if (baseDn.equalsIgnoreCase(CmsConstants.ROLES_BASEDN)) + if (baseDn.equalsIgnoreCase(CmsConstants.SYSTEM_ROLES_BASEDN)) continue; if (baseDn.equalsIgnoreCase(CmsConstants.TOKENS_BASEDN)) continue; @@ -255,7 +438,7 @@ public class CmsUserManagerImpl implements CmsUserManager { } public Set getUserDirectories() { - TreeSet res = new TreeSet<>((o1, o2) -> o1.getContext().compareTo(o2.getContext())); + TreeSet res = new TreeSet<>((o1, o2) -> o1.getBase().compareTo(o2.getBase())); res.addAll(userDirectories); return res; } @@ -453,8 +636,8 @@ public class CmsUserManagerImpl implements CmsUserManager { String name = user.getName(); NavigableMap possible = new TreeMap<>(); for (UserDirectory userDirectory : userDirectories) { - if (name.endsWith(userDirectory.getContext())) { - possible.put(userDirectory.getContext(), userDirectory); + if (name.endsWith(userDirectory.getBase())) { + possible.put(userDirectory.getBase(), userDirectory); } } if (possible.size() == 0)