X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=org.argeo.util%2Fsrc%2Forg%2Fargeo%2Fosgi%2Fuseradmin%2FAggregatingUserAdmin.java;h=c9479d51cd40ad7703bd0b9db09a42fc73951fe1;hb=3c1cdc594d954520b14646102b366290bdad58c7;hp=ac641de97cf6a128b5c2781f9c053cba8e98a7d7;hpb=cceead8a279e8630f63cc9e8213bdcdca39955a5;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.util/src/org/argeo/osgi/useradmin/AggregatingUserAdmin.java b/org.argeo.util/src/org/argeo/osgi/useradmin/AggregatingUserAdmin.java index ac641de97..c9479d51c 100644 --- a/org.argeo.util/src/org/argeo/osgi/useradmin/AggregatingUserAdmin.java +++ b/org.argeo.util/src/org/argeo/osgi/useradmin/AggregatingUserAdmin.java @@ -1,19 +1,22 @@ package org.argeo.osgi.useradmin; -import static org.argeo.osgi.useradmin.AbstractUserDirectory.toLdapName; +import static org.argeo.osgi.useradmin.DirectoryUserAdmin.toLdapName; import java.util.ArrayList; import java.util.Arrays; import java.util.HashMap; import java.util.HashSet; +import java.util.Hashtable; import java.util.List; import java.util.Map; +import java.util.Objects; import java.util.Set; import java.util.TreeSet; import javax.naming.InvalidNameException; import javax.naming.ldap.LdapName; +import org.argeo.util.directory.DirectoryConf; import org.osgi.framework.InvalidSyntaxException; import org.osgi.service.useradmin.Authorization; import org.osgi.service.useradmin.Group; @@ -30,9 +33,9 @@ public class AggregatingUserAdmin implements UserAdmin { private final LdapName tokensBaseDn; // DAOs - private AbstractUserDirectory systemRoles = null; - private AbstractUserDirectory tokens = null; - private Map businessRoles = new HashMap(); + private DirectoryUserAdmin systemRoles = null; + private DirectoryUserAdmin tokens = null; + private Map businessRoles = new HashMap(); // TODO rather use an empty constructor and an init method public AggregatingUserAdmin(String systemRolesBaseDn, String tokensBaseDn) { @@ -86,13 +89,15 @@ public class AggregatingUserAdmin implements UserAdmin { return res.size() == 1 ? res.get(0) : null; } + /** Builds an authorisation by scanning all referentials. */ @Override public Authorization getAuthorization(User user) { if (user == null) {// anonymous return systemRoles.getAuthorization(null); } - AbstractUserDirectory userReferentialOfThisUser = findUserAdmin(user.getName()); + DirectoryUserAdmin userReferentialOfThisUser = findUserAdmin(user.getName()); Authorization rawAuthorization = userReferentialOfThisUser.getAuthorization(user); + User retrievedUser = (User) userReferentialOfThisUser.getRole(user.getName()); String usernameToUse; String displayNameToUse; if (user instanceof Group) { @@ -113,15 +118,26 @@ public class AggregatingUserAdmin implements UserAdmin { } // gather roles from other referentials - final AbstractUserDirectory userAdminToUse;// possibly scoped when authenticating - if (user instanceof DirectoryUser) { - userAdminToUse = userReferentialOfThisUser; - } else if (user instanceof AuthenticatingUser) { - userAdminToUse = userReferentialOfThisUser.scope(user); - } else { - throw new IllegalArgumentException("Unsupported user type " + user.getClass()); + List rawRoles = Arrays.asList(rawAuthorization.getRoles()); + List allRoles = new ArrayList<>(rawRoles); + for (LdapName otherBaseDn : businessRoles.keySet()) { + if (otherBaseDn.equals(userReferentialOfThisUser.getBaseDn())) + continue; + DirectoryUserAdmin otherUserAdmin = userAdminToUse(user, businessRoles.get(otherBaseDn)); + if (otherUserAdmin == null) + continue; + for (String roleStr : rawRoles) { + User role = (User) findUserAdmin(roleStr).getRole(roleStr); + Authorization auth = otherUserAdmin.getAuthorization(role); + allRoles.addAll(Arrays.asList(auth.getRoles())); + } + } + // integrate system roles + final DirectoryUserAdmin userAdminToUse = userAdminToUse(retrievedUser, userReferentialOfThisUser); + Objects.requireNonNull(userAdminToUse); + try { Set sysRoles = new HashSet(); for (String role : rawAuthorization.getRoles()) { @@ -136,7 +152,7 @@ public class AggregatingUserAdmin implements UserAdmin { } addAbstractSystemRoles(rawAuthorization, sysRoles); Authorization authorization = new AggregatingAuthorization(usernameToUse, displayNameToUse, sysRoles, - rawAuthorization.getRoles()); + allRoles.toArray(new String[allRoles.size()])); return authorization; } finally { if (userAdminToUse != null && userAdminToUse.isScoped()) { @@ -145,6 +161,20 @@ public class AggregatingUserAdmin implements UserAdmin { } } + /** Decide whether to scope or not */ + private DirectoryUserAdmin userAdminToUse(User user, DirectoryUserAdmin userAdmin) { + if (userAdmin.isAuthenticated()) + return userAdmin; + if (user instanceof DirectoryUser) { + return userAdmin; + } else if (user instanceof AuthenticatingUser) { + return userAdmin.scope(user).orElse(null); + } else { + throw new IllegalArgumentException("Unsupported user type " + user.getClass()); + } + + } + /** * Enrich with application-specific roles which are strictly programmatic, such * as anonymous/user semantics. @@ -157,10 +187,10 @@ public class AggregatingUserAdmin implements UserAdmin { // USER ADMIN AGGREGATOR // protected void addUserDirectory(UserDirectory ud) { - if (!(ud instanceof AbstractUserDirectory)) - throw new IllegalArgumentException("Only " + AbstractUserDirectory.class.getName() + " is supported"); - AbstractUserDirectory userDirectory = (AbstractUserDirectory) ud; - String basePath = userDirectory.getContext(); + if (!(ud instanceof DirectoryUserAdmin)) + throw new IllegalArgumentException("Only " + DirectoryUserAdmin.class.getName() + " is supported"); + DirectoryUserAdmin userDirectory = (DirectoryUserAdmin) ud; + String basePath = userDirectory.getBase(); if (isSystemRolesBaseDn(basePath)) { this.systemRoles = userDirectory; systemRoles.setExternalRoles(this); @@ -181,7 +211,7 @@ public class AggregatingUserAdmin implements UserAdmin { protected void postAdd(UserDirectory userDirectory) { } - private AbstractUserDirectory findUserAdmin(String name) { + private DirectoryUserAdmin findUserAdmin(String name) { try { return findUserAdmin(new LdapName(name)); } catch (InvalidNameException e) { @@ -189,14 +219,14 @@ public class AggregatingUserAdmin implements UserAdmin { } } - private AbstractUserDirectory findUserAdmin(LdapName name) { + private DirectoryUserAdmin findUserAdmin(LdapName name) { if (name.startsWith(systemRolesBaseDn)) return systemRoles; if (tokensBaseDn != null && name.startsWith(tokensBaseDn)) return tokens; - List res = new ArrayList<>(1); + List res = new ArrayList<>(1); userDirectories: for (LdapName baseDn : businessRoles.keySet()) { - AbstractUserDirectory userDirectory = businessRoles.get(baseDn); + DirectoryUserAdmin userDirectory = businessRoles.get(baseDn); if (name.startsWith(baseDn)) { if (userDirectory.isDisabled()) continue userDirectories; @@ -238,9 +268,18 @@ public class AggregatingUserAdmin implements UserAdmin { // return res; // } - public void destroy() { + public void start() { + if (systemRoles == null) { + // TODO do we really need separate system roles? + Hashtable properties = new Hashtable<>(); + properties.put(DirectoryConf.baseDn.name(), "ou=roles,ou=system"); + systemRoles = new DirectoryUserAdmin(properties); + } + } + + public void stop() { for (LdapName name : businessRoles.keySet()) { - AbstractUserDirectory userDirectory = businessRoles.get(name); + DirectoryUserAdmin userDirectory = businessRoles.get(name); destroy(userDirectory); } businessRoles.clear(); @@ -249,18 +288,26 @@ public class AggregatingUserAdmin implements UserAdmin { systemRoles = null; } - private void destroy(AbstractUserDirectory userDirectory) { + private void destroy(DirectoryUserAdmin userDirectory) { preDestroy(userDirectory); userDirectory.destroy(); } +// protected void removeUserDirectory(UserDirectory userDirectory) { +// LdapName baseDn = toLdapName(userDirectory.getContext()); +// businessRoles.remove(baseDn); +// if (userDirectory instanceof DirectoryUserAdmin) +// destroy((DirectoryUserAdmin) userDirectory); +// } + + @Deprecated protected void removeUserDirectory(String basePath) { if (isSystemRolesBaseDn(basePath)) throw new IllegalArgumentException("System roles cannot be removed "); LdapName baseDn = toLdapName(basePath); if (!businessRoles.containsKey(baseDn)) throw new IllegalStateException("No user directory registered for " + baseDn); - AbstractUserDirectory userDirectory = businessRoles.remove(baseDn); + DirectoryUserAdmin userDirectory = businessRoles.remove(baseDn); destroy(userDirectory); } @@ -272,8 +319,10 @@ public class AggregatingUserAdmin implements UserAdmin { } public Set getUserDirectories() { - TreeSet res = new TreeSet<>((o1, o2) -> o1.getContext().compareTo(o2.getContext())); + TreeSet res = new TreeSet<>((o1, o2) -> o1.getBase().compareTo(o2.getBase())); res.addAll(businessRoles.values()); + res.add(systemRoles); return res; } + }