Add security
authorMathieu Baudier <mbaudier@argeo.org>
Fri, 3 Jul 2009 12:32:14 +0000 (12:32 +0000)
committerMathieu Baudier <mbaudier@argeo.org>
Fri, 3 Jul 2009 12:32:14 +0000 (12:32 +0000)
git-svn-id: https://svn.argeo.org/slc/trunk@2685 4cfe0d0a-d680-48aa-b62c-e0a02a3f76cc

15 files changed:
demo/site/org.argeo.slc.demo.log4j/log4j.properties
modules/server/org.argeo.slc.server.activemq/META-INF/MANIFEST.MF
modules/server/org.argeo.slc.server.activemq/META-INF/spring/activemq.xml
modules/server/org.argeo.slc.webapp.war/META-INF/MANIFEST.MF
modules/server/org.argeo.slc.webapp.war/WEB-INF/applicationContext.xml
modules/server/org.argeo.slc.webapp.war/WEB-INF/security.xml [new file with mode: 0644]
modules/server/org.argeo.slc.webapp.war/WEB-INF/web.xml
runtime/org.argeo.slc.core/src/main/java/org/argeo/slc/core/execution/DefaultExecutionFlowDescriptorConverter.java
runtime/org.argeo.slc.core/src/main/java/org/argeo/slc/core/execution/DefaultExecutionSpec.java
runtime/org.argeo.slc.core/src/main/java/org/argeo/slc/core/execution/RefSpecAttribute.java
runtime/org.argeo.slc.core/src/main/java/org/argeo/slc/core/execution/RefValue.java
runtime/org.argeo.slc.server/src/main/java/org/argeo/slc/web/mvc/result/ListResultsController.java
runtime/org.argeo.slc.support.castor/src/main/java/org/argeo/slc/castor/structure/tree/TreeSPathFieldHandler.java
runtime/org.argeo.slc.support.castor/src/main/resources/org/argeo/slc/castor/execution.xml
runtime/org.argeo.slc.support.hibernate/src/main/resources/org/argeo/slc/hibernate/process/RealizedFlow.hbm.xml [new file with mode: 0644]

index 5a1e3b79306effa7a523b519f5120bb4e3207e86..64433ee53dfc19e0af99bd268efeb23e5df72356 100644 (file)
@@ -13,6 +13,7 @@ log4j.logger.org.hibernate=WARN
 
 log4j.logger.org.springframework=WARN
 log4j.logger.org.springframework.jms=WARN
+log4j.logger.org.springframework.security=INFO
 
 log4j.logger.org.apache.activemq=WARN
 log4j.logger.org.apache.activemq.transport=WARN
index 89f823e2e88acdfce687d19f7aaf223ccf16bf7f..f76ae41adf6592749d2c6f1962733b26924f5b3a 100644 (file)
@@ -6,4 +6,5 @@ Import-Package: javax.jms,
  org.springframework.jms.connection,\r
  org.springframework.oxm,\r
  org.argeo.slc.jms,\r
- org.springframework.jms.support.converter\r
+ org.springframework.jms.support.converter,\r
+ org.springframework.beans.factory.config\r
index 59c02446e6444b4953d66c0c97cf467aac689e40..b17159039c95aabf48b5896696378c43137345b4 100644 (file)
@@ -3,13 +3,23 @@
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">
 
+       <bean
+               class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
+               <property name="systemPropertiesModeName" value="SYSTEM_PROPERTIES_MODE_OVERRIDE" />
+               <property name="ignoreUnresolvablePlaceholders" value="true" />
+               <property name="locations">
+                       <value>osgibundle:activemq.properties
+                       </value>
+               </property>
+       </bean>
+
        <!-- Connection Factory -->
        <bean id="jmsConnectionFactory"
                class="org.springframework.jms.connection.CachingConnectionFactory">
                <property name="targetConnectionFactory">
                        <bean class="org.apache.activemq.ActiveMQConnectionFactory">
                                <property name="brokerURL">
-                                       <value>vm://localhost</value>
+                                       <value>${slc.server.jms.url}</value>
                                </property>
                        </bean>
                </property>
index f2e2e3dc6d882befef4185cff21f3e698b871abf..bd110b5a9473d8d4bddda292a82b92e988967ed6 100644 (file)
@@ -4,42 +4,47 @@ Bundle-Version: 0.11.4.SNAPSHOT
 Bundle-Name: SLC Webapp\r
 Web-ContextPath: org.argeo.slc.webapp\r
 Bundle-SymbolicName: org.argeo.slc.webapp\r
-Import-Package: org.springframework.web.context,\r
- org.springframework.osgi.web.context.support,\r
- org.springframework.web.context.support,\r
- org.springframework.orm.hibernate3.support,\r
- org.argeo.slc.dao.runtime,\r
+Import-Package: net.sf.cglib.core,\r
+ net.sf.cglib.proxy,\r
+ net.sf.cglib.reflect,\r
+ org.aopalliance.aop,\r
+ org.argeo.slc.build,\r
+ org.argeo.slc.core.attachment,\r
+ org.argeo.slc.core.test.tree,\r
  org.argeo.slc.dao.process,\r
+ org.argeo.slc.dao.runtime,\r
  org.argeo.slc.dao.test,\r
  org.argeo.slc.dao.test.tree,\r
- org.springframework.web.servlet.mvc,\r
- org.hibernate,\r
- org.argeo.slc.services,\r
- org.springframework.transaction,\r
- org.argeo.slc.runtime,\r
- org.argeo.slc.core.test.tree,\r
- org.argeo.slc.msg.event,\r
- org.argeo.slc.core.attachment,\r
  org.argeo.slc.deploy,\r
- org.argeo.slc.build,\r
- org.springframework.web.servlet,\r
- org.springframework.oxm,\r
- org.springframework.aop,\r
- org.springframework.aop.framework,\r
- org.springframework.aop.scope,\r
+ org.argeo.slc.msg.event,\r
+ org.argeo.slc.runtime,\r
+ org.argeo.slc.services,\r
+ org.argeo.slc.web.mvc,\r
+ org.argeo.slc.web.mvc.attachment,\r
+ org.argeo.slc.web.mvc.event,\r
+ org.argeo.slc.web.mvc.execution,\r
  org.argeo.slc.web.mvc.management,\r
+ org.argeo.slc.web.mvc.process,\r
  org.argeo.slc.web.mvc.provisioning,\r
  org.argeo.slc.web.mvc.result,\r
- org.argeo.slc.web.mvc.process,\r
  org.argeo.slc.web.mvc.runtime,\r
- org.argeo.slc.web.mvc.event,\r
- org.argeo.slc.web.mvc.attachment,\r
- org.argeo.slc.web.mvc.execution,\r
- org.argeo.slc.web.mvc,\r
- org.springframework.web.servlet.handler,\r
- org.aopalliance.aop,\r
- net.sf.cglib.core,\r
- net.sf.cglib.proxy,\r
- net.sf.cglib.reflect,\r
+ org.hibernate,\r
+ org.hibernate.hql.ast,\r
  org.hibernate.jdbc,\r
- org.hibernate.hql.ast\r
+ org.springframework.aop,\r
+ org.springframework.aop.framework,\r
+ org.springframework.aop.scope,\r
+ org.springframework.beans.factory.support,\r
+ org.springframework.orm.hibernate3.support,\r
+ org.springframework.osgi.web.context.support,\r
+ org.springframework.oxm,\r
+ org.springframework.security.ui.webapp,\r
+ org.springframework.security.userdetails.memory,\r
+ org.springframework.transaction,\r
+ org.springframework.web.context,\r
+ org.springframework.web.context.request,\r
+ org.springframework.web.context.support,\r
+ org.springframework.web.filter,\r
+ org.springframework.web.servlet,\r
+ org.springframework.web.servlet.handler,\r
+ org.springframework.web.servlet.mvc\r
index 703e681a76d30c8b7dbd47307cef1c74e745b5e7..fcea0a17eb3f684fd205a4a2510c996ddf637856 100644 (file)
@@ -10,6 +10,7 @@
        <!--
                <import resource="classpath:/org/argeo/slc/server/spring/jmx.xml" />
        -->
+       <import resource="security.xml" />
 
        <import resource="osgi.xml" />
 
diff --git a/modules/server/org.argeo.slc.webapp.war/WEB-INF/security.xml b/modules/server/org.argeo.slc.webapp.war/WEB-INF/security.xml
new file mode 100644 (file)
index 0000000..fbf7439
--- /dev/null
@@ -0,0 +1,19 @@
+<beans:beans xmlns="http://www.springframework.org/schema/security"
+       xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
+
+       <http>
+               <intercept-url pattern="/**" access="ROLE_USER" />
+               <http-basic />
+               <anonymous />
+       </http>
+
+       <authentication-provider>
+               <user-service>
+                       <user name="mbaudier" password="mbaudier" authorities="ROLE_USER,ROLE_ADMIN" />
+                       <user name="cdujeu" password="cdujeu" authorities="ROLE_USER" />
+               </user-service>
+       </authentication-provider>
+
+</beans:beans>
index 3e9d60b93f79db8e849b7c568306a5f34e1e33f3..34a837fbf2e64a4e187a7d438fe2f9dcb220bdd4 100644 (file)
                <param-value>org.springframework.osgi.web.context.support.OsgiBundleXmlWebApplicationContext</param-value>
        </context-param>
 
-       <!-- Log4j configContext loader config
-       <listener>
+       <!--  Security -->
+       <filter>
+               <filter-name>springSecurityFilterChain</filter-name>
+               <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
+       </filter>
+
+       <filter-mapping>
+               <filter-name>springSecurityFilterChain</filter-name>
+               <url-pattern>/*</url-pattern>
+       </filter-mapping>
+
+       <!--
+               Log4j configContext loader config <listener>
                <display-name>Log4j</display-name>
                <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
-       </listener>
-       <context-param>
+               </listener> <context-param>
                <param-name>log4jConfigLocation</param-name>
                <param-value>/WEB-INF/classes/log4j.properties</param-value>
-       </context-param>
-       <context-param>
+               </context-param> <context-param>
                <param-name>log4jRefreshInterval</param-name>
-               <param-value>5000</param-value>
-       </context-param>
- -->
-
-       <!--
-               Active MQ <context-param>
-               <param-name>org.apache.activemq.brokerURL</param-name>
-               <param-value>vm://localhost</param-value> </context-param>
-
-               <context-param>
-               <param-name>org.apache.activemq.embeddedBroker</param-name>
-               <param-value>false</param-value> </context-param> <servlet>
-               <servlet-name>MessageListenerServlet</servlet-name>
-               <servlet-class>org.apache.activemq.web.MessageListenerServlet</servlet-class>
-               <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping>
-               <servlet-name>MessageListenerServlet</servlet-name>
-               <url-pattern>/amq/*</url-pattern> </servlet-mapping> <filter>
-               <filter-name>session</filter-name>
-               <filter-class>org.apache.activemq.web.SessionFilter</filter-class>
-               </filter> <filter-mapping> <filter-name>session</filter-name>
-               <url-pattern>/amq/*</url-pattern> </filter-mapping>
+               <param-value>5000</param-value> </context-param>
        -->
 </web-app>
index 2b540f3c8171a3351f9f27ca3cf42080cdf04537..baa9b86a1d9a1daec12d0a44fa9884206ff87800 100644 (file)
@@ -1,14 +1,13 @@
 package org.argeo.slc.core.execution;
 
-import java.util.ArrayList;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.TreeMap;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.argeo.slc.SlcException;
+import org.argeo.slc.UnsupportedException;
 import org.argeo.slc.execution.ExecutionFlow;
 import org.argeo.slc.execution.ExecutionFlowDescriptor;
 import org.argeo.slc.execution.ExecutionFlowDescriptorConverter;
@@ -26,6 +25,8 @@ import org.springframework.util.Assert;
 
 public class DefaultExecutionFlowDescriptorConverter implements
                ExecutionFlowDescriptorConverter, ApplicationContextAware {
+       public final static String REF_VALUE_TYPE_BEAN_NAME = "beanName";
+
        private final static Log log = LogFactory
                        .getLog(DefaultExecutionFlowDescriptorConverter.class);
 
@@ -33,9 +34,7 @@ public class DefaultExecutionFlowDescriptorConverter implements
 
        public Map<String, Object> convertValues(
                        ExecutionFlowDescriptor executionFlowDescriptor) {
-               // convert the values of flow.getFlowDescriptor()
                Map<String, Object> values = executionFlowDescriptor.getValues();
-
                Map<String, Object> convertedValues = new HashMap<String, Object>();
 
                if (values != null) {
@@ -43,17 +42,22 @@ public class DefaultExecutionFlowDescriptorConverter implements
                                Object value = values.get(key);
                                if (value instanceof PrimitiveValue) {
                                        PrimitiveValue primitiveValue = (PrimitiveValue) value;
-
-                                       // TODO: check that the class of the the
-                                       // primitiveValue.value
-                                       // matches
-                                       // the primitiveValue.type
+                                       // TODO: check class <=> type
                                        convertedValues.put(key, primitiveValue.getValue());
                                } else if (value instanceof RefValue) {
-                                       // not yet implemented
-
-                                       // RefValue refValue = (RefValue) value;
-                                       // convertedValues.put(key, refValue.getLabel());
+                                       RefValue refValue = (RefValue) value;
+
+                                       if (REF_VALUE_TYPE_BEAN_NAME.equals(refValue.getType()))
+                                               if (refValue.getRef() != null) {
+                                                       Object obj = applicationContext.getBean(refValue
+                                                                       .getRef());
+                                                       convertedValues.put(key, obj);
+                                               } else {
+                                                       log.warn("Cannot interpret " + refValue);
+                                               }
+                                       else
+                                               throw new UnsupportedException("Ref value type",
+                                                               refValue.getType());
                                }
                        }
                }
@@ -105,6 +109,10 @@ public class DefaultExecutionFlowDescriptorConverter implements
                        if (executionFlow.getPath() != null)
                                efd.setPath(executionFlow.getPath());
 
+                       // Takes description from spring
+                       BeanDefinition bd = getBeanFactory().getBeanDefinition(name);
+                       efd.setDescription(bd.getDescription());
+
                        // Add execution spec if necessary
                        if (!md.getExecutionSpecs().contains(executionSpec))
                                md.getExecutionSpecs().add(executionSpec);
@@ -118,6 +126,7 @@ public class DefaultExecutionFlowDescriptorConverter implements
        protected RefValue buildRefValue(RefSpecAttribute rsa,
                        ExecutionFlow executionFlow, String key) {
                RefValue refValue = new RefValue();
+               refValue.setType(REF_VALUE_TYPE_BEAN_NAME);
 
                if (executionFlow.isSetAsParameter(key)) {
                        String ref = null;
@@ -151,7 +160,10 @@ public class DefaultExecutionFlowDescriptorConverter implements
                        }
                        if (ref == null)
                                log.warn("Cannot define reference for ref spec attribute "
-                                               + key);
+                                               + key + " in " + executionFlow + " (" + rsa + ")");
+                       else if (log.isDebugEnabled())
+                               log.debug(ref + " is the reference for ref spec attribute "
+                                               + key + " in " + executionFlow + " (" + rsa + ")");
                        refValue.setRef(ref);
                }
                return refValue;
index af0afc416739211df779743d4e08b3434401e346..d9038197df2e2564d1135e1d93b1b114a359373b 100644 (file)
@@ -78,7 +78,12 @@ public class DefaultExecutionSpec implements ExecutionSpec, BeanNameAware,
                        if (attr instanceof RefSpecAttribute) {
                                RefSpecAttribute rsa = (RefSpecAttribute) attr;
                                if (rsa.getChoices() == null) {
-                                       rsa.setChoices(buildRefValueChoices(rsa));
+                                       List<RefValueChoice> choices = buildRefValueChoices(rsa);
+                                       if (log.isDebugEnabled())
+                                               log.debug("Found " + choices.size() + " choices for "
+                                                               + rsa + " in spec " + name);
+
+                                       rsa.setChoices(choices);
                                }
                        }
                }
@@ -98,6 +103,11 @@ public class DefaultExecutionSpec implements ExecutionSpec, BeanNameAware,
                        RefValueChoice choice = new RefValueChoice();
                        choice.setName(beanName);
                        choice.setDescription(bd.getDescription());
+                       if (log.isTraceEnabled())
+                               log.debug("Found choice " + beanName + " for " + rsa);
+
+                       choices.add(choice);
+
                }
                return choices;
        }
index eebb660400a12c31be9755227def1f6217663e0f..e1c196016a1848de9b26a2dd0f62d3341e18a79a 100644 (file)
@@ -49,4 +49,9 @@ public class RefSpecAttribute extends AbstractSpecAttribute implements
                return rsa;
        }
 
+       @Override
+       public String toString() {
+               return "Ref spec attribute [" + targetClass + "]";
+       }
+
 }
index 61abcb84940b9b374ad80e7053e7ea03a50e74ef..e44b0d7ad2b6617b83210dbfe95cb05036f5226c 100644 (file)
@@ -1,8 +1,8 @@
 package org.argeo.slc.core.execution;
 
-
 public class RefValue extends AbstractExecutionValue {
        private String ref;
+       private String type;
 
        public RefValue() {
        }
@@ -20,4 +20,17 @@ public class RefValue extends AbstractExecutionValue {
                this.ref = ref;
        }
 
+       public String getType() {
+               return type;
+       }
+
+       public void setType(String type) {
+               this.type = type;
+       }
+
+       @Override
+       public String toString() {
+               return "Ref Value [" + type + "=" + ref + "]";
+       }
+
 }
index 5cd9da043f7dd9051a7f3c4c08ff97347bcb149c..1759449f5d80aea535cb625f2d1b86fc328986a1 100644 (file)
@@ -7,6 +7,8 @@ import java.util.Map;
 import javax.servlet.http.HttpServletRequest;\r
 import javax.servlet.http.HttpServletResponse;\r
 \r
+import org.apache.commons.logging.Log;\r
+import org.apache.commons.logging.LogFactory;\r
 import org.argeo.slc.core.test.tree.TreeTestResult;\r
 import org.argeo.slc.dao.test.tree.TreeTestResultCollectionDao;\r
 import org.argeo.slc.msg.ObjectList;\r
@@ -15,6 +17,8 @@ import org.springframework.web.servlet.ModelAndView;
 \r
 /** Lists results possibly filtering them. */\r
 public class ListResultsController extends AbstractServiceController {\r
+       private final static Log log = LogFactory\r
+                       .getLog(ListResultsController.class);\r
        private final TreeTestResultCollectionDao testResultCollectionDao;\r
 \r
        public ListResultsController(\r
@@ -23,10 +27,18 @@ public class ListResultsController extends AbstractServiceController {
        }\r
 \r
        @Override\r
-       @SuppressWarnings(value={"unchecked"})\r
+       @SuppressWarnings(value = { "unchecked" })\r
        protected void handleServiceRequest(HttpServletRequest request,\r
                        HttpServletResponse response, ModelAndView modelAndView)\r
                        throws Exception {\r
+\r
+               log.debug("userPrincipal=" + request.getUserPrincipal());\r
+               log.debug("authType= " + request.getAuthType());\r
+               log.debug("remoteUser=" + request.getRemoteUser());\r
+               log.debug("cookies=" + request.getCookies());\r
+               log.debug("requestedSessionId=" + request.getRequestedSessionId());\r
+               log.debug("session.id=" + request.getSession().getId());\r
+\r
                String collectionId = request.getParameter("collectionId");\r
 \r
                Map<String, String[]> parameterMap = request.getParameterMap();\r
@@ -42,7 +54,6 @@ public class ListResultsController extends AbstractServiceController {
                List<TreeTestResult> resultAttributes = testResultCollectionDao\r
                                .listResults(collectionId, attributes);\r
 \r
-               modelAndView.addObject("resultList", new ObjectList(\r
-                               resultAttributes));\r
+               modelAndView.addObject("resultList", new ObjectList(resultAttributes));\r
        }\r
 }\r
index ad117ff14149d5f81a8aad7b2c1360cd921f18f4..98186656c67f739f50a75cf7cf8b572ec13c75ea 100644 (file)
@@ -35,7 +35,7 @@ public class TreeSPathFieldHandler extends AbstractFieldHandler {
        public void setValue(Object object, Object value)
                        throws IllegalStateException, IllegalArgumentException {
                MapItem part = (MapItem) object;
-               part.setKey(TreeSPath.parseToCreatePath(value.toString()));
+               part.setKey(new TreeSPath(value.toString()));
        }
 
 }
index 2fdfb7e4a43ca7cdaa30715686219288b58bac84..c3f9a1a44e91a09e26077fa31e02e9b2bfc95326 100644 (file)
                <field name="ref">\r
                        <bind-xml name="ref" node="attribute" />\r
                </field>\r
+               <field name="type">\r
+                       <bind-xml name="type" node="attribute" />\r
+               </field>\r
        </class>\r
 \r
        <class name="org.argeo.slc.core.execution.RefValueChoice">\r
diff --git a/runtime/org.argeo.slc.support.hibernate/src/main/resources/org/argeo/slc/hibernate/process/RealizedFlow.hbm.xml b/runtime/org.argeo.slc.support.hibernate/src/main/resources/org/argeo/slc/hibernate/process/RealizedFlow.hbm.xml
new file mode 100644 (file)
index 0000000..258c1d4
--- /dev/null
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<!DOCTYPE hibernate-mapping PUBLIC\r
+       "-//Hibernate/Hibernate Mapping DTD 3.0//EN"\r
+       "http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">\r
+<hibernate-mapping package="org.argeo.slc.process">\r
+       <class name="RealizedFlow" table="REALIZED_FLOW">\r
+               <cache usage="read-write" />\r
+\r
+               <id column="ID" />\r
+               <property name="moduleName" column="MODULE_NAME" />\r
+               <property name="moduleVersion" column="MODULE_VERSION" />\r
+\r
+       </class>
+</hibernate-mapping>
\ No newline at end of file