Author: rareddy Date: 2009-11-24 12:02:36 -0500 (Tue, 24 Nov 2009) New Revision: 1586 Added: branches/JCA/build/kit-jboss-container/conf/props/ branches/JCA/build/kit-jboss-container/conf/props/teiid-security-roles.properties branches/JCA/build/kit-jboss-container/conf/props/teiid-security-users.properties branches/JCA/common-internal/src/main/java/org/ branches/JCA/common-internal/src/main/java/org/teiid/ branches/JCA/common-internal/src/main/java/org/teiid/ContainerHelper.java branches/JCA/common-internal/src/main/java/org/teiid/ContainerUtil.java branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ConnectionContext.java branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/ branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/JBossContainerHelper.java branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/SecurityActions.java Removed: branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidPrincipalException.java branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidUserException.java branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidVDBException.java branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MembershipServiceException.java branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MetaMatrixAuthenticationException.java branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/AuthenticationToken.java branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/FailedAuthenticationToken.java branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/MembershipServiceInterface.java branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SuccessfulAuthenticationToken.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AdminAuthorizationPolicyProvider.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipDomain.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipSourceException.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/file/FileMembershipDomain.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/ldap/LDAPMembershipDomain.java branches/JCA/runtime/src/test/java/com/metamatrix/dqp/embedded/services/TestEmbeddedDataService.java branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/file/TestFileMembershipDomain.java branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/ldap/TestLDAPMembershipDomainConfiguration.java Modified: branches/JCA/build/kit-jboss-container/deploy/teiid-bindings-ds.xml branches/JCA/build/kit-jboss-container/deploy/teiid-jboss-beans.xml branches/JCA/build/kit-jboss-container/deploy/teiid-runtime-ds.xml branches/JCA/client/src/main/java/com/metamatrix/platform/security/api/SessionToken.java branches/JCA/client/src/main/java/org/teiid/adminapi/AdminRoles.java branches/JCA/common-internal/src/main/java/com/metamatrix/platform/admin/api/AuthorizationAdminAPI.java branches/JCA/common-internal/src/main/java/com/metamatrix/platform/security/api/AuthorizationPolicyFactory.java branches/JCA/common-internal/src/main/resources/com/metamatrix/platform/security/api/authorizations.xsd branches/JCA/connector-api/src/main/java/org/teiid/connector/api/Connector.java branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ExecutionContext.java branches/JCA/connector-api/src/main/java/org/teiid/connector/basic/BasicManagedConnection.java branches/JCA/connectors/connector-jdbc/src/main/rar/META-INF/ra.xml branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/AuthorizationService.java branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/DQPServiceNames.java branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/MetaMatrixSessionInfo.java branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SessionServiceInterface.java branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ConnectorWorkItem.java branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ExecutionContextImpl.java branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/AbstractWorkItem.java branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/RequestWorkItem.java branches/JCA/engine/src/main/resources/com/metamatrix/dqp/i18n.properties branches/JCA/engine/src/test/java/com/metamatrix/dqp/service/FakeAuthorizationService.java branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/FakeWorkManager.java branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorManagerImpl.java branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorWorkItem.java branches/JCA/engine/src/test/java/org/teiid/dqp/internal/process/TestWorkItemState.java branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/BaseAdmin.java branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/DQPSecurityAdminImpl.java branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedConnectionFactoryImpl.java branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedGuiceModule.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AuthorizationServiceImpl.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/service/MembershipServiceImpl.java branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/session/service/SessionServiceImpl.java branches/JCA/runtime/src/main/java/org/teiid/transport/AdminAuthorizationInterceptor.java branches/JCA/runtime/src/main/java/org/teiid/transport/LogonImpl.java branches/JCA/runtime/src/main/java/org/teiid/transport/ServerWorkItem.java branches/JCA/runtime/src/main/java/org/teiid/transport/SocketClientInstance.java branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/TestAdminAuthInterceptor.java branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/service/TestMembershipServiceImpl.java branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/session/service/TestSessionServiceImpl.java branches/JCA/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java branches/JCA/runtime/src/test/resources/permissions.xml branches/JCA/runtime/src/test/resources/permissions2.xml Log: TEIID-833: Added JAAS based authentication support for Teiid. Based on "securitydomin" property set, the corresponding JAAS module is used and authenticated subject is injected into the thread context of the working thread. The connectors also need to define their security domain, if they require the subject to be passed to them. The subject is also available during connector connection by use ConnectionContext object. Added: branches/JCA/build/kit-jboss-container/conf/props/teiid-security-roles.properties =================================================================== --- branches/JCA/build/kit-jboss-container/conf/props/teiid-security-roles.properties (rev 0) +++ branches/JCA/build/kit-jboss-container/conf/props/teiid-security-roles.properties 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,5 @@ +# A roles.properties file for use with the UsersRolesLoginModule +# username=role1,role1. +# allowed teiid admin roles (Admin.SystemAdmin, Admin.ProductAdmin, Admin.ReadOnlyAdmin) +admin=Admin.SystemAdmin +ramesh=Admin.SystemAdmin Property changes on: branches/JCA/build/kit-jboss-container/conf/props/teiid-security-roles.properties ___________________________________________________________________ Name: svn:mime-type + text/plain Added: branches/JCA/build/kit-jboss-container/conf/props/teiid-security-users.properties =================================================================== --- branches/JCA/build/kit-jboss-container/conf/props/teiid-security-users.properties (rev 0) +++ branches/JCA/build/kit-jboss-container/conf/props/teiid-security-users.properties 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,4 @@ +# A users.properties file for use with the UsersRolesLoginModule +# username=password +admin=teiid +ramesh=mm Property changes on: branches/JCA/build/kit-jboss-container/conf/props/teiid-security-users.properties ___________________________________________________________________ Name: svn:mime-type + text/plain Modified: branches/JCA/build/kit-jboss-container/deploy/teiid-bindings-ds.xml =================================================================== --- branches/JCA/build/kit-jboss-container/deploy/teiid-bindings-ds.xml 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/build/kit-jboss-container/deploy/teiid-bindings-ds.xml 2009-11-24 17:02:36 UTC (rev 1586) @@ -18,7 +18,7 @@ <config-property name="ImportProcedures" type="java.lang.Boolean">false</config-property> <max-pool-size>20</max-pool-size> - <!-- security-domain-and-application>teiid-realm</security-domain-and-application --> + <security-domain-and-application>teiid-security</security-domain-and-application> </no-tx-connection-factory> @@ -38,7 +38,7 @@ <config-property name="ImportProcedures" type="java.lang.Boolean">false</config-property> <max-pool-size>20</max-pool-size> - <!-- security-domain-and-application>teiid-realm</security-domain-and-application--> + <security-domain-and-application>teiid-security</security-domain-and-application> </no-tx-connection-factory> </connection-factories> Modified: branches/JCA/build/kit-jboss-container/deploy/teiid-jboss-beans.xml =================================================================== --- branches/JCA/build/kit-jboss-container/deploy/teiid-jboss-beans.xml 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/build/kit-jboss-container/deploy/teiid-jboss-beans.xml 2009-11-24 17:02:36 UTC (rev 1586) @@ -23,7 +23,10 @@ <annotation&gt;(a)org.jboss.aop.microcontainer.aspects.jndi.JndiBinding(name=&quot;teiid/admin&quot;)&lt;/annotation&gt; </bean> - + <bean name="container-helper" class="org.teiid.jboss.JBossContainerHelper"> + <annotation>@org.jboss.aop.microcontainer.aspects.jndi.JndiBinding(name="teiid/container-helper")</annotation> + </bean> + <!-- JBOSS Cache --> <!-- First we create a Configuration object for the cache --> <bean name="TeiidJBossCacheConfig" class="org.jboss.cache.config.Configuration"> @@ -57,10 +60,11 @@ <list> <bean class="org.jboss.cache.config.EvictionRegionConfig"> <property name="regionName">/_default_</property> - <property name="evictionPolicyConfig"> - <bean name="ExampleDefaultLRUConfig" class="org.jboss.cache.eviction.LRUConfiguration"> + <property name="evictionAlgorithmConfig"> + <bean class="org.jboss.cache.eviction.LRUAlgorithmConfig"> + <property name="maxAge">-1</property> + <property name="timeToLive">-1</property> <property name="maxNodes">10000</property> - <property name="timeToLiveSeconds">-1</property> </bean> </property> </bean> @@ -68,7 +72,6 @@ </property> </bean> </property> - </bean> <!-- Factory to build the Cache. --> @@ -98,6 +101,17 @@ <demand>TransactionManager</demand> <demand>TeiidJBossCacheMBean</demand> </bean> + + <!-- teiid's default security domain, replace this with your own if needs to be any other JAAS domain --> + <application-policy xmlns="urn:jboss:security-beans:1.0" name="teiid-security"> + <authentication> + <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required"> + <!-- property files can found under conf/props directory --> + <module-option name="usersProperties">props/teiid-security-users.properties</module-option> + <module-option name="rolesProperties">props/teiid-security-roles.properties</module-option> + </login-module> + </authentication> + </application-policy> <!-- Connector Types --> <bean name="connector-jdbc-template" class="org.teiid.templates.connector.ConnectorTypeTemplate"> Modified: branches/JCA/build/kit-jboss-container/deploy/teiid-runtime-ds.xml =================================================================== --- branches/JCA/build/kit-jboss-container/deploy/teiid-runtime-ds.xml 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/build/kit-jboss-container/deploy/teiid-runtime-ds.xml 2009-11-24 17:02:36 UTC (rev 1586) @@ -17,7 +17,7 @@ <config-property name="TeiidHome" type="java.lang.String">/home/rareddy/teiid/teiid-6.3.0/</config-property> <max-pool-size>20</max-pool-size> - <!-- security-domain-and-application>teiid-realm</security-domain-and-application--> + <security-domain-and-application>teiid-security</security-domain-and-application> </no-tx-connection-factory> </connection-factories> Modified: branches/JCA/client/src/main/java/com/metamatrix/platform/security/api/SessionToken.java =================================================================== --- branches/JCA/client/src/main/java/com/metamatrix/platform/security/api/SessionToken.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/client/src/main/java/com/metamatrix/platform/security/api/SessionToken.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -62,12 +62,12 @@ * @param userName * (String) the userName for this session * @throws IllegalArgumentException - */ + */ public SessionToken(MetaMatrixSessionID id, String userName) { this.sessionID = id; this.userName = userName; this.secret = UUID.randomUUID(); - } + } public UUID getSecret() { return secret; @@ -100,11 +100,6 @@ return this.userName; } - public Subject getSubject() { - // TODO: this need to be mapped with subject created. - return null; - } - /** * Returns true if the specified object is semantically equal to this * instance. Note: this method is consistent with <code>compareTo()</code>. Modified: branches/JCA/client/src/main/java/org/teiid/adminapi/AdminRoles.java =================================================================== --- branches/JCA/client/src/main/java/org/teiid/adminapi/AdminRoles.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/client/src/main/java/org/teiid/adminapi/AdminRoles.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -47,7 +47,7 @@ * @return the <code>Set</code> of <code>String</code> role names. * @since 4.3 */ - public static Set getAllRoleNames() { + public static Set<String> getAllRoleNames() { return roleSet; } Deleted: branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidPrincipalException.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidPrincipalException.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidPrincipalException.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,88 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.api.exception.security; - -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; - -public class InvalidPrincipalException extends MetaMatrixSecurityException { - - /** - * No-Arg Constructor - */ - public InvalidPrincipalException( ) { - super( ); - } - /** - * Constructs an instance of the exception with the specified detail message. A detail - * message is a String that describes this particular exception. - * @param the detail message - */ - public InvalidPrincipalException(String message) { - super(message); - } - - /** - * Constructs an instance of the exception with no detail message but with a - * single exception. - * @param e the exception that is encapsulated by this exception - */ - public InvalidPrincipalException(Throwable e) { - super(e); - } - - /** - * Constructs an instance of the exception with the specified detail message - * and a single exception. A detail message is a String that describes this - * particular exception. - * @param message the detail message - * @param e the exception that is encapsulated by this exception - */ - public InvalidPrincipalException(Throwable e, String message) { - super(e, message); - } - - /** - * Construct an instance with an error code and message specified. - * - * @param message The error message - * @param code The error code - */ - public InvalidPrincipalException(String code, String message) { - super(code, message); - } - - /** - * Construct an instance with a linked exception, and an error code and - * message, specified. - * - * @param e An exception to chain to this exception - * @param message The error message - * @param code The error code - */ - public InvalidPrincipalException(Throwable e, String code, String message) { - super(e, code, message); - } -} - - - Deleted: branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidUserException.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidUserException.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidUserException.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,86 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.api.exception.security; - -public class InvalidUserException extends InvalidPrincipalException { - - /** - * No-Arg Constructor - */ - public InvalidUserException( ) { - super( ); - } - /** - * Constructs an instance of the exception with the specified detail message. A detail - * message is a String that describes this particular exception. - * @param the detail message - */ - public InvalidUserException(String message) { - super(message); - } - - /** - * Constructs an instance of the exception with no detail message but with a - * single exception. - * @param e the exception that is encapsulated by this exception - */ - public InvalidUserException(Throwable e) { - super(e); - } - - /** - * Constructs an instance of the exception with the specified detail message - * and a single exception. A detail message is a String that describes this - * particular exception. - * @param message the detail message - * @param e the exception that is encapsulated by this exception - */ - public InvalidUserException(Throwable e, String message) { - super(e, message); - } - - /** - * Construct an instance with an error code and message specified. - * - * @param message The error message - * @param code The error code - */ - public InvalidUserException(String code, String message) { - super(code, message); - } - - /** - * Construct an instance with a linked exception, and an error code and - * message, specified. - * - * @param e An exception to chain to this exception - * @param message The error message - * @param code The error code - */ - public InvalidUserException(Throwable e, String code, String message) { - super(e, code, message); - } -} - - - Deleted: branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidVDBException.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidVDBException.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/InvalidVDBException.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,80 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.api.exception.security; - -import com.metamatrix.api.exception.MetaMatrixProcessingException; - -/** - * Indicates that an invalid VDB was requested for logon. This could be for - * several reasons: invalid VDB name, invalid VDB version, VDB is not active, - * etc. - */ -public class InvalidVDBException extends MetaMatrixProcessingException { - - /** - * - */ - public InvalidVDBException() { - super(); - } - - /** - * @param message - */ - public InvalidVDBException(String message) { - super(message); - } - - /** - * @param e - */ - public InvalidVDBException(Throwable e) { - super(e); - } - - /** - * @param code - * @param message - */ - public InvalidVDBException(String code, String message) { - super(code, message); - } - - /** - * @param e - * @param message - */ - public InvalidVDBException(Throwable e, String message) { - super(e, message); - } - - /** - * @param e - * @param code - * @param message - */ - public InvalidVDBException(Throwable e, String code, String message) { - super(e, code, message); - } - -} Deleted: branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MembershipServiceException.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MembershipServiceException.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MembershipServiceException.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,82 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.api.exception.security; - -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; - -public class MembershipServiceException extends MetaMatrixSecurityException { - - /** - * No-arg CTOR - */ - public MembershipServiceException( ) { - super( ); - } - /** - * Constructs an instance of the exception with the specified detail message. A detail - * message is a String that describes this particular exception. - * @param the detail message - */ - public MembershipServiceException(String message) { - super(message); - } - /** - * Constructs an instance of the exception with no detail message but with a - * single exception. - * @param e the exception that is encapsulated by this exception - */ - public MembershipServiceException(Throwable e) { - super(e); - } - /** - * Constructs an instance of the exception with the specified detail message - * and a single exception. A detail message is a String that describes this - * particular exception. - * @param message the detail message - * @param e the exception that is encapsulated by this exception - */ - public MembershipServiceException( Throwable e, String message ) { - super(e, message); - } - /** - * Construct an instance with an error code and message specified. - * - * @param message The error message - * @param code The error code - */ - public MembershipServiceException( String code, String message ) { - super( code, message ); - } - /** - * Construct an instance with a linked exception, and an error code and - * message, specified. - * - * @param e An exception to chain to this exception - * @param message The error message - * @param code The error code - */ - public MembershipServiceException( Throwable e, String code, String message ) { - super( e, code, message ); - } -} - Deleted: branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MetaMatrixAuthenticationException.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MetaMatrixAuthenticationException.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/api/exception/security/MetaMatrixAuthenticationException.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,82 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.api.exception.security; - -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; - -public class MetaMatrixAuthenticationException extends MetaMatrixSecurityException { - - /** - * No-Arg Constructor - */ - public MetaMatrixAuthenticationException( ) { - super( ); - } - /** - * Constructs an instance of the exception with the specified detail message. A detail - * message is a String that describes this particular exception. - * @param the detail message - */ - public MetaMatrixAuthenticationException(String message) { - super(message); - } - /** - * Constructs an instance of the exception with no detail message but with a - * single exception. - * @param e the exception that is encapsulated by this exception - */ - public MetaMatrixAuthenticationException(Throwable e) { - super(e); - } - /** - * Constructs an instance of the exception with the specified detail message - * and a single exception. A detail message is a String that describes this - * particular exception. - * @param message the detail message - * @param e the exception that is encapsulated by this exception - */ - public MetaMatrixAuthenticationException( Throwable e, String message ) { - super(e, message); - } - /** - * Construct an instance with an error code and message specified. - * - * @param message The error message - * @param code The error code - */ - public MetaMatrixAuthenticationException( String code, String message ) { - super( code, message ); - } - /** - * Construct an instance with a linked exception, and an error code and - * message, specified. - * - * @param e An exception to chain to this exception - * @param message The error message - * @param code The error code - */ - public MetaMatrixAuthenticationException( Throwable e, String code, String message ) { - super( e, code, message ); - } -} - Modified: branches/JCA/common-internal/src/main/java/com/metamatrix/platform/admin/api/AuthorizationAdminAPI.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/platform/admin/api/AuthorizationAdminAPI.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/platform/admin/api/AuthorizationAdminAPI.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -31,7 +31,6 @@ import com.metamatrix.api.exception.MetaMatrixComponentException; import com.metamatrix.api.exception.security.AuthorizationException; import com.metamatrix.api.exception.security.AuthorizationMgmtException; -import com.metamatrix.api.exception.security.MembershipServiceException; import com.metamatrix.platform.security.api.AuthorizationPolicy; import com.metamatrix.platform.security.api.AuthorizationPolicyID; import com.metamatrix.platform.security.api.AuthorizationRealm; @@ -103,11 +102,10 @@ * @param username the username to compare to the current super user * @return * @throws ServiceException for generic service errors - * @throws MembershipServiceException If there are issues within the membership service * @throws MetaMatrixComponentException if this service has trouble communicating. * */ - boolean isSuperUser(String username) throws MembershipServiceException, MetaMatrixComponentException; + boolean isSuperUser(String username) throws MetaMatrixComponentException; /** Modified: branches/JCA/common-internal/src/main/java/com/metamatrix/platform/security/api/AuthorizationPolicyFactory.java =================================================================== --- branches/JCA/common-internal/src/main/java/com/metamatrix/platform/security/api/AuthorizationPolicyFactory.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/java/com/metamatrix/platform/security/api/AuthorizationPolicyFactory.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -42,6 +42,7 @@ import org.jdom.input.DOMBuilder; import org.jdom.output.Format; import org.jdom.output.XMLOutputter; +import org.teiid.adminapi.AdminRoles; import org.xml.sax.ErrorHandler; import org.xml.sax.InputSource; import org.xml.sax.SAXException; @@ -57,7 +58,7 @@ */ public class AuthorizationPolicyFactory { - private static final String GROUP = "group"; //$NON-NLS-1$ + private static final String ROLE = "role"; //$NON-NLS-1$ private static final String PRINCIPALS = "principals"; //$NON-NLS-1$ private static final String ALLOW = "allow-"; //$NON-NLS-1$ private static final String RESOURCE_NAME = "resource-name"; //$NON-NLS-1$ @@ -163,7 +164,7 @@ if (principalsElem != null) { - List groups = principalsElem.getChildren(GROUP); + List groups = principalsElem.getChildren(ROLE); for (final Iterator groupsIter = groups.iterator(); groupsIter.hasNext();) { final Element group = (Element)groupsIter.next(); @@ -226,7 +227,7 @@ for (final Iterator principalsIter = principals.iterator(); principalsIter.hasNext();) { MetaMatrixPrincipalName principal = (MetaMatrixPrincipalName)principalsIter.next(); - principalsElement.addContent(new Element(GROUP).setText(principal.getName())); + principalsElement.addContent(new Element(ROLE).setText(principal.getName())); } } } // for @@ -268,4 +269,14 @@ } return result; } + + public static Collection<AuthorizationPolicy> buildDefaultAdminPolicies() { + Properties p = new Properties(); + for (String role:AdminRoles.getAllRoleNames()) { + p.setProperty(role, role); + } + return buildAdminPolicies(p); + + } + } Added: branches/JCA/common-internal/src/main/java/org/teiid/ContainerHelper.java =================================================================== --- branches/JCA/common-internal/src/main/java/org/teiid/ContainerHelper.java (rev 0) +++ branches/JCA/common-internal/src/main/java/org/teiid/ContainerHelper.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,38 @@ +/* + * JBoss, Home of Professional Open Source. + * See the COPYRIGHT.txt file distributed with this work for information + * regarding copyright ownership. Some portions may be licensed + * to Red Hat, Inc. under one or more contributor license agreements. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301 USA. + */ +package org.teiid; + +import java.security.Principal; + +import javax.security.auth.Subject; + + +public interface ContainerHelper { + + boolean assosiateSecurityContext(String securityDomain, Object context); + + void clearSecurityContext(String securityDomain); + + Object getSecurityContext(String securityDomain); + + Object createSecurityContext(String securityDomain, Principal p, Object credentials, Subject subject); +} Property changes on: branches/JCA/common-internal/src/main/java/org/teiid/ContainerHelper.java ___________________________________________________________________ Name: svn:mime-type + text/plain Added: branches/JCA/common-internal/src/main/java/org/teiid/ContainerUtil.java =================================================================== --- branches/JCA/common-internal/src/main/java/org/teiid/ContainerUtil.java (rev 0) +++ branches/JCA/common-internal/src/main/java/org/teiid/ContainerUtil.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,39 @@ +/* + * JBoss, Home of Professional Open Source. + * See the COPYRIGHT.txt file distributed with this work for information + * regarding copyright ownership. Some portions may be licensed + * to Red Hat, Inc. under one or more contributor license agreements. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301 USA. + */ +package org.teiid; + +import javax.naming.InitialContext; +import javax.naming.NamingException; + +import com.metamatrix.core.MetaMatrixRuntimeException; + +public class ContainerUtil { + + public static <T> T lookup(String jndiName) { + try { + InitialContext ic = new InitialContext(); + return (T)ic.lookup(jndiName); + } catch (NamingException e) { + throw new MetaMatrixRuntimeException("Object with JNDI name "+jndiName+" not found"); + } + } +} Property changes on: branches/JCA/common-internal/src/main/java/org/teiid/ContainerUtil.java ___________________________________________________________________ Name: svn:mime-type + text/plain Modified: branches/JCA/common-internal/src/main/resources/com/metamatrix/platform/security/api/authorizations.xsd =================================================================== --- branches/JCA/common-internal/src/main/resources/com/metamatrix/platform/security/api/authorizations.xsd 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/common-internal/src/main/resources/com/metamatrix/platform/security/api/authorizations.xsd 2009-11-24 17:02:36 UTC (rev 1586) @@ -60,7 +60,7 @@ <xs:element minOccurs="0" name="principals"> <xs:complexType> <xs:sequence> - <xs:element maxOccurs="unbounded" name="group" type="xs:string"/> + <xs:element maxOccurs="unbounded" name="role" type="xs:string"/> </xs:sequence> </xs:complexType> </xs:element> Added: branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ConnectionContext.java =================================================================== --- branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ConnectionContext.java (rev 0) +++ branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ConnectionContext.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,44 @@ +/* + * JBoss, Home of Professional Open Source. + * See the COPYRIGHT.txt file distributed with this work for information + * regarding copyright ownership. Some portions may be licensed + * to Red Hat, Inc. under one or more contributor license agreements. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301 USA. + */ +package org.teiid.connector.api; + +import javax.security.auth.Subject; + +/** + * Thread local class to access the Subject in the Connector code. This is set just before the + * connector connection is created. + */ +public class ConnectionContext { + private static ThreadLocal<Subject> SUBJECT = new ThreadLocal<Subject>() { + protected Subject initialValue() { + return null; + } + }; + + public static Subject getSubject() { + return SUBJECT.get(); + } + + public static void setSubject(Subject subject) { + SUBJECT.set(subject); + } +} Property changes on: branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ConnectionContext.java ___________________________________________________________________ Name: svn:mime-type + text/plain Modified: branches/JCA/connector-api/src/main/java/org/teiid/connector/api/Connector.java =================================================================== --- branches/JCA/connector-api/src/main/java/org/teiid/connector/api/Connector.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/connector-api/src/main/java/org/teiid/connector/api/Connector.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -22,7 +22,9 @@ package org.teiid.connector.api; +import javax.security.auth.Subject; + /** * <p>The primary entry point for a Connector. This interface should be implemented * by the connector writer.</p> @@ -44,6 +46,9 @@ * with a particular security context. The connection is assumed to be pooled by container * if pooling is necessary - the connection will be closed when execution has completed against it. * + * If you need to authenticate/authorize and need to get access to {{@link Subject}, then use + * {@link ConnectionContext} + * * @return A Connection, created by the Connector * @throws ConnectorException If an error occurred obtaining a connection */ Modified: branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ExecutionContext.java =================================================================== --- branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ExecutionContext.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/connector-api/src/main/java/org/teiid/connector/api/ExecutionContext.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -81,7 +81,7 @@ * Get the user for the user running this query. * @return User, never null */ - Subject getUser(); + Subject getSubject(); /** * Get the trusted payload passed when the user statement was executed. Modified: branches/JCA/connector-api/src/main/java/org/teiid/connector/basic/BasicManagedConnection.java =================================================================== --- branches/JCA/connector-api/src/main/java/org/teiid/connector/basic/BasicManagedConnection.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/connector-api/src/main/java/org/teiid/connector/basic/BasicManagedConnection.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -35,6 +35,7 @@ import javax.security.auth.Subject; import javax.transaction.xa.XAResource; +import org.teiid.connector.api.ConnectionContext; import org.teiid.connector.api.ConnectorException; public class BasicManagedConnection implements ManagedConnection { @@ -79,7 +80,8 @@ if(!(arg1 instanceof ConnectionRequestInfoWrapper)) { throw new ConnectorException("Un recognized Connection Request Info object received"); } - ConnectionRequestInfoWrapper criw = (ConnectionRequestInfoWrapper)arg1; + ConnectionRequestInfoWrapper criw = (ConnectionRequestInfoWrapper)arg1; + ConnectionContext.setSubject(arg0); this.conn = new WrappedConnection(criw.actualConnector.getConnection(), mcf); this.conn.setManagedConnection(this); return this.conn; Modified: branches/JCA/connectors/connector-jdbc/src/main/rar/META-INF/ra.xml =================================================================== --- branches/JCA/connectors/connector-jdbc/src/main/rar/META-INF/ra.xml 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/connectors/connector-jdbc/src/main/rar/META-INF/ra.xml 2009-11-24 17:02:36 UTC (rev 1586) @@ -206,7 +206,7 @@ </config-property> <connectionfactory-interface>org.teiid.connector.api.Connector</connectionfactory-interface> - <connectionfactory-impl-class>org.teiid.connector.basic.ConnectorWrapper</connectionfactory-impl-class> + <connectionfactory-impl-class>org.teiid.connector.basic.WrappedConnector</connectionfactory-impl-class> <connection-interface>org.teiid.connector.api.Connection</connection-interface> <connection-impl-class>org.teiid.connector.basic.WrappedConnection</connection-impl-class> Modified: branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/AuthorizationService.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/AuthorizationService.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/AuthorizationService.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -24,9 +24,6 @@ import java.util.Collection; -import com.metamatrix.admin.api.exception.security.InvalidSessionException; -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; -import com.metamatrix.api.exception.ComponentNotFoundException; import com.metamatrix.api.exception.MetaMatrixComponentException; import com.metamatrix.api.exception.security.AuthorizationException; import com.metamatrix.api.exception.security.AuthorizationMgmtException; @@ -34,8 +31,6 @@ import com.metamatrix.core.CoreConstants; import com.metamatrix.platform.security.api.AuthorizationPolicy; import com.metamatrix.platform.security.api.AuthorizationRealm; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; -import com.metamatrix.platform.security.api.SessionToken; import com.metamatrix.query.eval.SecurityFunctionEvaluator; /** @@ -78,24 +73,9 @@ */ boolean checkingEntitlements(); - boolean isCallerInRole(SessionToken session, String roleName ) throws AuthorizationMgmtException; + boolean isCallerInRole(String roleName ) throws AuthorizationMgmtException; - /** - * Returns a Collection of String names of MetaMatrix roles to which the - * given principal is assigned. - * @param caller the session token of the principal that is attempting to access the roles. - * @param principal <code>MetaMatrixPrincipalName</code> for which roles are sought - * @return The <code>Collection</code> of role names the principal is assigned. - * @throws InvalidSessionException if the administrative session is invalid - * @throws MetaMatrixSecurityException if there is a problem internally with the MembershipService - * @throws AuthorizationException if administrator does not have the authority to see the requested information - * @throws ComponentNotFoundException if a component required by this method could not be found within the server - */ - Collection<String> getRoleNamesForPrincipal(MetaMatrixPrincipalName principal) - throws InvalidSessionException, AuthorizationException, AuthorizationMgmtException; - - /** * Returns a <code>Collection</code> of <code>AuthorizationPolicy</code>s * that have <code>AuthorizationPermission</code>s in the given <code>AuthorizationRealm</code>.<br> * <strong>NOTE:</strong> It is the responsibility of the caller to determine Modified: branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/DQPServiceNames.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/DQPServiceNames.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/dqp/service/DQPServiceNames.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -23,7 +23,6 @@ package com.metamatrix.dqp.service; import com.metamatrix.dqp.util.LogConstants; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; import com.metamatrix.platform.security.api.service.SessionServiceInterface; @@ -57,8 +56,6 @@ public static final String SESSION_SERVICE = "dqp.session"; //$NON-NLS-1$ - public static final String MEMBERSHIP_SERVICE = "dqp.membership"; //$NON-NLS-1$ - /** * Array of all services a DQP may use. @@ -71,8 +68,7 @@ VDB_SERVICE, METADATA_SERVICE, DATA_SERVICE, - SESSION_SERVICE, - MEMBERSHIP_SERVICE + SESSION_SERVICE }; public static final Class[] ALL_SERVICE_CLASSES = new Class[] { @@ -83,8 +79,7 @@ VDBService.class, MetadataService.class, DataService.class, - SessionServiceInterface.class, - MembershipServiceInterface.class + SessionServiceInterface.class }; public static final String[] SERVICE_LOGGING_CONTEXT = new String[] { @@ -95,7 +90,6 @@ null, null, null, - null, null }; } Modified: branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/MetaMatrixSessionInfo.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/MetaMatrixSessionInfo.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/MetaMatrixSessionInfo.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -25,6 +25,8 @@ import java.io.Serializable; import java.util.Properties; +import javax.security.auth.login.LoginContext; + /** * This class represents an immutable informational object describing * the attributes of a unique MetaMatrix session within a given MetaMatrix System. @@ -40,12 +42,15 @@ private Properties productInfo; private String clientIp; private String clientHostname; - + private LoginContext loginContext; + private String securityDomain; + private Object securityContext; + /** * Master constructor, allows a MetaMatrixSessionInfo to be created with * any state and any timestamps. */ - public MetaMatrixSessionInfo(MetaMatrixSessionID sessionID, String userName, long timeCreated, String applicationName, Properties productInfo, String clientIp, String clientHostname){ + public MetaMatrixSessionInfo(MetaMatrixSessionID sessionID, String userName, LoginContext context, String securityDomain, Object securityContext, long timeCreated, String applicationName, Properties productInfo, String clientIp, String clientHostname){ this.timeCreated = timeCreated; this.lastPingTime = timeCreated; this.applicationName = applicationName; @@ -53,6 +58,9 @@ this.productInfo = productInfo; this.clientIp = clientIp; this.clientHostname = clientHostname; + this.loginContext = context; + this.securityDomain = securityDomain; + this.securityContext = securityContext; } public MetaMatrixSessionID getSessionID() { @@ -144,4 +152,16 @@ public String getClientHostname() { return clientHostname; } + + public LoginContext getLoginContext() { + return this.loginContext; + } + + public String getSecurityDomain() { + return this.securityDomain; + } + + public Object getSecurityContext() { + return this.securityContext; + } } Deleted: branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/AuthenticationToken.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/AuthenticationToken.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/AuthenticationToken.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,56 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -/* - * Date: Feb 11, 2004 - * Time: 9:33:14 AM - */ -package com.metamatrix.platform.security.api.service; - -import java.io.Serializable; - -/** - * Interface AuthenticationToken. - * - * <p></p> - */ -public interface AuthenticationToken extends Serializable { - - /** - * Get the <b>exact</b> username of the authenticated user as it - * is known to the authenticating membership domain. - * <br>Will be <code>null</code> if the user was <b>not</b> - * authenticated. - * @return The username (including case) of this authenticated - * user exactly as it is known by the authenticating memebership domain. - * @since 5.0 - */ - String getUserName(); - - /** - * Find out whether or not the user was authenticated. - * @return <code>true</code> iff the membership domain was able - * to authenticate this user. - * @since 5.0 - */ - boolean isAuthenticated(); -} Deleted: branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/FailedAuthenticationToken.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/FailedAuthenticationToken.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/FailedAuthenticationToken.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,81 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -/* - * Date: Dec 1, 2003 - * Time: 1:26:57 PM - */ -package com.metamatrix.platform.security.api.service; - -import java.io.Serializable; - -/** - * FailedAuthenticationToken - * - * <p>Marker indicating failed authentication attempt. Membership SPI - * domain implementations should wrap the <code>Serializable</code> payload - * in an instance of this class to signify to the Membgership service that - * the domian failed to authenticate the given payload token.</p> - * - * <p>This wrapper class will not be exposed outside of the Mebership framework.</p> - */ -public final class FailedAuthenticationToken implements AuthenticationToken { - - /** - * FailedAuthenticationToken - * - * @param payload The failed authentication token - may be null. - */ - public FailedAuthenticationToken() { - } - - /** - * Get the payload token that failed to authentcation by a - * membership domain. - * - * @return The failed authentication token unmodified - may be null. - */ - public Serializable getPayload() { - return null; - } - - /** - * Get the <b>exact</b> username of the authenticated user as it - * is known to the authenticating membership domain. - * <p><b>Will be <code>null</code> if the user was <b>not</b> - * authenticated. </b></p> - * @return The username (including case) of this authenticated - * user exactly as it is known by the authenticating memebership domain. - * @since 5.0 - */ - public String getUserName() { - return null; - } - - /** - * The attempt to authenticate the given payload failed. - * @return <code>false</code> - always. - */ - public boolean isAuthenticated() { - return false; - } -} Deleted: branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/MembershipServiceInterface.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/MembershipServiceInterface.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/MembershipServiceInterface.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,117 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.api.service; - -import java.util.List; -import java.util.Set; - -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; -import com.metamatrix.api.exception.security.InvalidPrincipalException; -import com.metamatrix.api.exception.security.MembershipServiceException; -import com.metamatrix.common.application.ApplicationService; -import com.metamatrix.core.CoreConstants; -import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.MetaMatrixPrincipal; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; - -/** - * This interface represents the API to the MemberShip Service, - * and it defines the functionality that is accessible to clients. - */ -public interface MembershipServiceInterface extends ApplicationService { - public static String NAME = "MembershipService"; //$NON-NLS-1$ - - /** - * The environment property describing both the domain names and their required - * order of search. Domain names are assumed to be in preferred search order - * and in the form "A,X,...,D" where A, X and D are domain names. - * This property is required (there is no default). - */ - public static final String DOMAIN_ORDER = "membership.DomainOrder"; //$NON-NLS-1$ - /** - * The environment property name for the class that is to be used for the names of the domains. - * This property is required (there is no default). - */ - public static final String DOMAIN_NAME = "domainName"; //$NON-NLS-1$ - - public static final String DEFAULT_ADMIN_USERNAME = "admin"; //$NON-NLS-1$ - public static final String DEFAULT_WSDL_USERNAME = CoreConstants.DEFAULT_ANON_USERNAME; - - public static final String ADMIN_PASSWORD = "membership.superUserPassword"; //$NON-NLS-1$ - public static final String ADMIN_USERNAME = "membership.superUser"; //$NON-NLS-1$ - public static final String DOMAIN_ACTIVE = "activate"; //$NON-NLS-1$ - public static final String ADMIN_HOSTS = "membership.allowedHosts"; //$NON-NLS-1$ - public static final String SECURITY_ENABLED = "membership.enabled"; //$NON-NLS-1$ - - public static final String DOMAIN_PROPERTIES = "propertiesFile"; //$NON-NLS-1$ - - public static final String AT = "@"; //$NON-NLS-1$ - - /** - * Authenticate a user with the specified username and credential - * for use with the specified application. The application name may also - * be used by the Membership Service to determine the appropriate authentication - * mechanism. - * @param username the username that is to be authenticated - * @param credential the credential provided by the user that is to be used - * to authenticate the user for the principal name - * @param trustePayload - * @param applicationName the name of the application for which the user - * is authenticating - * @return true if the specified credentials properly authenticates for - * the application the user with the specified username and application - * @throws MetaMatrixSecurityException if there is an error within this - * service or during communicating with the underlying service provider - */ - AuthenticationToken authenticateUser(String username, Credentials credential, String applicationName) - throws MembershipServiceException; - - /** - * Obtain the principal object that is representative of the user with the specified username. - * - * all names should be domain qualified. - */ - MetaMatrixPrincipal getPrincipal(MetaMatrixPrincipalName principal) - throws MembershipServiceException, InvalidPrincipalException; - - /** - * Obtain the collection of groups to which this user belongs - * - * The username should be fully qualified - */ - Set<String> getGroupsForUser(String username) - throws MembershipServiceException, InvalidPrincipalException; - - /** - * Obtain the collection of group names. - */ - Set<String> getGroupNames() throws MembershipServiceException; - - List<String> getDomainNames() throws MembershipServiceException; - - Set<String> getGroupsForDomain(String domainName) throws MembershipServiceException; - - boolean isSuperUser(String username) throws MembershipServiceException; - - boolean isSecurityEnabled() throws MembershipServiceException; -} Modified: branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SessionServiceInterface.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SessionServiceInterface.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SessionServiceInterface.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -22,17 +22,16 @@ package com.metamatrix.platform.security.api.service; -import java.io.Serializable; import java.util.Collection; import java.util.Properties; +import javax.security.auth.login.LoginException; + import com.metamatrix.admin.api.exception.security.InvalidSessionException; import com.metamatrix.api.exception.security.AuthorizationException; -import com.metamatrix.api.exception.security.MetaMatrixAuthenticationException; import com.metamatrix.api.exception.security.SessionServiceException; import com.metamatrix.common.application.ApplicationService; import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.MetaMatrixPrincipal; import com.metamatrix.platform.security.api.MetaMatrixSessionID; import com.metamatrix.platform.security.api.MetaMatrixSessionInfo; @@ -70,7 +69,7 @@ Credentials credentials, String applicationName, Properties properties) - throws MetaMatrixAuthenticationException, SessionServiceException; + throws LoginException, SessionServiceException; /** * Closes the specified session. @@ -111,16 +110,6 @@ int getActiveSessionsCount() throws SessionServiceException; /** - * Returns a MetaMatrixPrincipal object describing the owner (user) of the - * indicated session. - * @param sessionID MetaMatrixSessionID representing the session - * @return MetaMatrixPrincipal object describing the owner of the - * indicated session. - */ - MetaMatrixPrincipal getPrincipal(MetaMatrixSessionID sessionID) - throws InvalidSessionException, SessionServiceException; - - /** * This method is intended to verify that the session is valid, and, if * need be, set the session in an active state, ready to be used. * @param sessionID MetaMatrixSessionID representing the session Deleted: branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SuccessfulAuthenticationToken.java =================================================================== --- branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SuccessfulAuthenticationToken.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/com/metamatrix/platform/security/api/service/SuccessfulAuthenticationToken.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,103 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -/* - * Date: Dec 1, 2003 - * Time: 1:26:57 PM - */ -package com.metamatrix.platform.security.api.service; - -import com.metamatrix.platform.security.api.SecurityMessagesKeys; -import com.metamatrix.platform.security.api.SecurityPlugin; - -/** - * SuccessfulAuthenticationToken. - * - * <p>Marker indicating successful authentication attempt. Membership SPI - * domain implementations should wrap the <code>Serializable</code> payload - * in an instance of this class to signify to the Membgership service that - * the domian successfully authenticated the given payload token.</p> - * - * <p>As well as providing a holder for the <code>Serializable</code> payload, - * which may have been augmented or replaced by the authenticating membership - * domain, this class provides a holder for the user name of the authenticated - * user that may be used in the MetaMatrix system for such things as session - * tracking and authorization policies.</p> - * - * <p>This wrapper class will not be exposed outside of the Membership framework.</p> - */ -public final class SuccessfulAuthenticationToken implements AuthenticationToken { - private String username; - private String domainName; - - /** - * SuccessfulAuthenticationToken - * - * <p>Indicate that successful user authentication has occurred.</p> - * - * <p>MetaMatrix must know the user name of every user connected to the system. - * In particular, when MetaMatrix authorization policies (entitlements) are - * created, the users and groups that are assigned to these policies come from - * the membership domain.</p> - * - * @param payload The successfully authenticated token. May be <code>null</code>. - * @param username The username of the <i>authenticated</i> user - * exactly as it is known by the authenticating membership domain. May <b>not</b> - * be <code>null</code>. - */ - public SuccessfulAuthenticationToken(final String username) { - if (username == null || username.trim().length() == 0) { - throw new IllegalArgumentException(SecurityPlugin.Util.getString(SecurityMessagesKeys.SEC_API_0061)); - } - this.username = username; - } - - /** - * Get the <b>exact</b> username of the authenticated user as it - * is known to the authenticating membership domain. - * <p><b>Will be <code>null</code> if the user was <b>not</b> - * authenticated. </b></p> - * @return The username (including case) of this authenticated - * user exactly as it is known by the authenticating membership domain. - * @since 5.0 - */ - public String getUserName() { - return username; - } - - /** - * The attempt to authenticate the given payload was successful. - * - * @return <code>true</code> - always. - */ - public boolean isAuthenticated() { - return true; - } - - public String getDomainName() { - return domainName; - } - - public void setDomainName(String domainName) { - this.domainName = domainName; - } -} Modified: branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ConnectorWorkItem.java =================================================================== --- branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ConnectorWorkItem.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ConnectorWorkItem.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -28,6 +28,8 @@ import javax.resource.spi.work.WorkEvent; +import org.teiid.ContainerHelper; +import org.teiid.ContainerUtil; import org.teiid.connector.api.Connection; import org.teiid.connector.api.Connector; import org.teiid.connector.api.ConnectorEnvironment; @@ -121,7 +123,7 @@ Integer.toString(requestID.getNodeID()), Integer.toString(requestID.getExecutionId()) ); - this.securityContext.setUser(requestMsg.getWorkContext().getUser()); + this.securityContext.setUser(requestMsg.getWorkContext().getSubject()); this.securityContext.setBatchSize(this.requestMsg.getFetchSize()); this.securityContext.setContextCache(manager.getContextCache()); this.securityContext.setMetadataService(manager.getMetadataService()); @@ -537,4 +539,23 @@ LogManager.logError(LogConstants.CTX_CONNECTOR, event.getException(), this.id.toString()); //$NON-NLS-1$ } } + + @Override + protected boolean assosiateSecurityContext() { + DQPWorkContext context = requestMsg.getWorkContext(); + if (context.getSubject() != null) { + ContainerHelper helper = ContainerUtil.lookup("teiid/container-helper"); + return helper.assosiateSecurityContext(context.getSecurityDomain(), context.getSecurityContext()); + } + return false; + } + + @Override + protected void clearSecurityContext() { + DQPWorkContext context = requestMsg.getWorkContext(); + if (context.getSubject() != null) { + ContainerHelper helper = ContainerUtil.lookup("teiid/container-helper"); + helper.clearSecurityContext(context.getSecurityDomain()); + } + } } \ No newline at end of file Modified: branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ExecutionContextImpl.java =================================================================== --- branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ExecutionContextImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/org/teiid/dqp/internal/datamgr/impl/ExecutionContextImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -113,7 +113,7 @@ return this.vdbVersion; } @Override - public Subject getUser() { + public Subject getSubject() { return this.user; } Modified: branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/AbstractWorkItem.java =================================================================== --- branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/AbstractWorkItem.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/AbstractWorkItem.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -44,11 +44,16 @@ private volatile boolean release = false; public void run() { + boolean added = false; try { + added = assosiateSecurityContext(); startProcessing(); process(); } finally { endProcessing(); + if (added) { + clearSecurityContext(); + } } } @@ -126,6 +131,10 @@ protected abstract boolean isDoneProcessing(); + protected abstract boolean assosiateSecurityContext(); + + protected abstract void clearSecurityContext(); + public abstract String toString(); @Override Modified: branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java =================================================================== --- branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/DQPWorkContext.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -54,6 +54,9 @@ private SessionToken sessionToken; private String clientAddress; private String clientHostname; + private Subject subject; + private String securityDomain; + private Object securityContext; public DQPWorkContext() { } @@ -68,13 +71,13 @@ return this.sessionToken.getUsername(); } - public Subject getUser() { - if (this.sessionToken == null) { - return null; - } - return this.sessionToken.getSubject(); + public Subject getSubject() { + return this.subject; } + public void setSubject(Subject subject) { + this.subject = subject; + } /** * @return @@ -160,4 +163,20 @@ setVdbName(null); setVdbVersion(null); } + + public void setSecurityDomain(String securityDomain) { + this.securityDomain = securityDomain; + } + + public String getSecurityDomain() { + return this.securityDomain; + } + + public Object getSecurityContext() { + return this.securityContext; + } + + public void setSecurityContext(Object securityContext) { + this.securityContext = securityContext; + } } Modified: branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/RequestWorkItem.java =================================================================== --- branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/RequestWorkItem.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/java/org/teiid/dqp/internal/process/RequestWorkItem.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -32,6 +32,8 @@ import java.util.Map; import java.util.concurrent.ConcurrentHashMap; +import org.teiid.ContainerHelper; +import org.teiid.ContainerUtil; import org.teiid.dqp.internal.cache.CacheID; import org.teiid.dqp.internal.cache.CacheResults; import org.teiid.dqp.internal.cache.ResultSetCache; @@ -174,7 +176,7 @@ this.resultsReceiver = receiver; this.dqpWorkContext = workContext; } - + @Override protected boolean isDoneProcessing() { return isClosed; @@ -708,5 +710,21 @@ public DQPWorkContext getDqpWorkContext() { return dqpWorkContext; } - + + @Override + protected boolean assosiateSecurityContext() { + if (dqpWorkContext.getSubject() != null) { + ContainerHelper helper = ContainerUtil.lookup("teiid/container-helper"); + return helper.assosiateSecurityContext(dqpWorkContext.getSecurityDomain(),dqpWorkContext.getSecurityContext()); + } + return false; + } + + @Override + protected void clearSecurityContext() { + if (dqpWorkContext.getSubject() != null) { + ContainerHelper helper = ContainerUtil.lookup("teiid/container-helper"); + helper.clearSecurityContext(dqpWorkContext.getSecurityDomain()); + } + } } \ No newline at end of file Modified: branches/JCA/engine/src/main/resources/com/metamatrix/dqp/i18n.properties =================================================================== --- branches/JCA/engine/src/main/resources/com/metamatrix/dqp/i18n.properties 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/main/resources/com/metamatrix/dqp/i18n.properties 2009-11-24 17:02:36 UTC (rev 1586) @@ -36,6 +36,7 @@ ConnectorManager.failed_to_lookup_connector=Failed to look up Connector instance {0} ConnectorManager.xa_capbility_not_supported=XA support by the Connector {0} is not possible when "SyncWorkers" is set to false +ConnectorManager.not_in_valid_state=Connector is not in OPEN state ConnectorManagerImpl.Initializing_connector=Initializing connector {0} ConnectorManagerImpl.Couldn__t_parse_property=Could not parse property: {0} Modified: branches/JCA/engine/src/test/java/com/metamatrix/dqp/service/FakeAuthorizationService.java =================================================================== --- branches/JCA/engine/src/test/java/com/metamatrix/dqp/service/FakeAuthorizationService.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/test/java/com/metamatrix/dqp/service/FakeAuthorizationService.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -22,9 +22,14 @@ package com.metamatrix.dqp.service; -import java.util.*; +import java.util.ArrayList; +import java.util.Collection; +import java.util.HashSet; +import java.util.Iterator; +import java.util.List; +import java.util.Properties; +import java.util.Set; -import com.metamatrix.admin.api.exception.security.InvalidSessionException; import com.metamatrix.api.exception.MetaMatrixComponentException; import com.metamatrix.api.exception.security.AuthorizationException; import com.metamatrix.api.exception.security.AuthorizationMgmtException; @@ -33,8 +38,6 @@ import com.metamatrix.common.application.exception.ApplicationLifecycleException; import com.metamatrix.platform.security.api.AuthorizationPolicy; import com.metamatrix.platform.security.api.AuthorizationRealm; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; -import com.metamatrix.platform.security.api.SessionToken; /** */ @@ -163,7 +166,7 @@ } @Override - public boolean isCallerInRole(SessionToken session, String roleName) + public boolean isCallerInRole(String roleName) throws AuthorizationMgmtException { return false; } @@ -176,12 +179,6 @@ } @Override - public Collection<String> getRoleNamesForPrincipal(MetaMatrixPrincipalName principal) throws InvalidSessionException, - AuthorizationException, AuthorizationMgmtException { - return null; - } - - @Override public void updatePoliciesInRealm(AuthorizationRealm realm, Collection<AuthorizationPolicy> policies) throws AuthorizationMgmtException { Modified: branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/FakeWorkManager.java =================================================================== --- branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/FakeWorkManager.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/FakeWorkManager.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -6,46 +6,65 @@ import javax.resource.spi.work.ExecutionContext; import javax.resource.spi.work.Work; +import javax.resource.spi.work.WorkEvent; import javax.resource.spi.work.WorkException; import javax.resource.spi.work.WorkListener; import javax.resource.spi.work.WorkManager; +import org.mockito.Mockito; + public class FakeWorkManager implements WorkManager { ThreadPoolExecutor pool = new ThreadPoolExecutor(1, 200, 2000, TimeUnit.MILLISECONDS, new SynchronousQueue<Runnable>()); @Override public void doWork(Work arg0) throws WorkException { - pool.execute(arg0); + execute(arg0); } @Override public void doWork(Work arg0, long arg1, ExecutionContext arg2, WorkListener arg3) throws WorkException { - pool.execute(arg0); + execute(arg0); } @Override public void scheduleWork(Work arg0) throws WorkException { - pool.execute(arg0); + execute(arg0); } @Override public void scheduleWork(Work arg0, long arg1, ExecutionContext arg2, WorkListener arg3) throws WorkException { - pool.execute(arg0); + execute(arg0); } @Override public long startWork(Work arg0) throws WorkException { - pool.execute(arg0); + execute(arg0); return 0; } @Override public long startWork(Work arg0, long arg1, ExecutionContext arg2, WorkListener arg3) throws WorkException { - pool.execute(arg0); + execute(arg0); return 0; } + void execute(Work arg0) { + if (arg0 instanceof WorkListener) { + WorkListener wl = (WorkListener)arg0; + wl.workAccepted(Mockito.mock(WorkEvent.class)); + wl.workStarted(Mockito.mock(WorkEvent.class)); + } + + pool.execute(arg0); + + + if (arg0 instanceof WorkListener) { + WorkListener wl = (WorkListener)arg0; + wl.workCompleted(Mockito.mock(WorkEvent.class)); + } + } + } Modified: branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorManagerImpl.java =================================================================== --- branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorManagerImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorManagerImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -64,7 +64,8 @@ return c; } }; - cm.setMetadataService(new FakeMetadataService()); + cm.start(Mockito.mock(ApplicationEnvironment.class)); + cm.setMetadataService(new FakeMetadataService()); return cm; } @@ -75,7 +76,6 @@ @Test public void testReceive() throws Exception { ConnectorManager cm = getConnectorManager(helpGetAppProps()); - cm.start(Mockito.mock(ApplicationEnvironment.class)); AtomicRequestMessage request = TestConnectorWorkItem.createNewAtomicRequestMessage(1, 1); QueueResultsReceiver receiver = new QueueResultsReceiver(); cm.executeRequest(receiver, request); @@ -86,7 +86,6 @@ @Test public void testCaching() throws Exception { ConnectorManager cm = getConnectorManager(helpGetAppProps()); - Properties rsCacheProps = new Properties(); rsCacheProps.setProperty(ResultSetCache.RS_CACHE_MAX_SIZE, "20"); rsCacheProps.setProperty(ResultSetCache.RS_CACHE_MAX_AGE, "3600000"); @@ -127,7 +126,6 @@ @Test public void testDefect19049() throws Exception { ConnectorManager cm = getConnectorManager(helpGetAppProps()); - cm.start(Mockito.mock(ApplicationEnvironment.class)); AtomicRequestMessage request = TestConnectorWorkItem.createNewAtomicRequestMessage(1, 1); QueueResultsReceiver receiver = new QueueResultsReceiver(); cm.executeRequest(receiver, request); Modified: branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorWorkItem.java =================================================================== --- branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorWorkItem.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/test/java/org/teiid/dqp/internal/datamgr/impl/TestConnectorWorkItem.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -22,13 +22,24 @@ package org.teiid.dqp.internal.datamgr.impl; +import static junit.framework.Assert.assertEquals; +import static junit.framework.Assert.assertFalse; +import static junit.framework.Assert.assertNotNull; +import static junit.framework.Assert.assertNull; +import static junit.framework.Assert.assertTrue; +import static junit.framework.Assert.fail; + import java.util.Arrays; import java.util.List; import java.util.concurrent.LinkedBlockingQueue; +import java.util.concurrent.Semaphore; import java.util.concurrent.TimeUnit; -import junit.framework.TestCase; +import javax.resource.spi.work.WorkEvent; +import javax.resource.spi.work.WorkManager; +import javax.transaction.xa.Xid; +import org.junit.Test; import org.mockito.Mockito; import org.teiid.connector.api.Connector; import org.teiid.connector.api.ConnectorEnvironment; @@ -59,7 +70,7 @@ import com.metamatrix.query.unittest.FakeMetadataFacade; import com.metamatrix.query.unittest.FakeMetadataFactory; -public class TestConnectorWorkItem extends TestCase { +public class TestConnectorWorkItem { private static final FakeMetadataFacade EXAMPLE_BQT = FakeMetadataFactory .exampleBQTCached(); @@ -71,11 +82,11 @@ return command; } - static ConnectorManager getConnectorManager(ConnectorEnvironment env) { + static ConnectorManager getConnectorManager(ConnectorEnvironment env, WorkManager wm) { final FakeConnector c = new FakeConnector(); c.setConnectorEnvironment(env); - ConnectorManager cm = new ConnectorManager("FakeConnector", new FakeWorkManager()) { + ConnectorManager cm = new ConnectorManager("FakeConnector", wm) { Connector getConnector() { return c; } @@ -84,22 +95,19 @@ return cm; } - static AtomicRequestMessage createNewAtomicRequestMessage(int requestid, - int nodeid) throws Exception { + static AtomicRequestMessage createNewAtomicRequestMessage(int requestid, int nodeid) throws Exception { RequestMessage rm = new RequestMessage(); DQPWorkContext workContext = new DQPWorkContext(); workContext.setSessionToken(new SessionToken(new MetaMatrixSessionID(1), "foo")); //$NON-NLS-1$ - AtomicRequestMessage request = new AtomicRequestMessage(rm, - workContext, nodeid); - request.setCommand(helpGetCommand( - "SELECT BQT1.SmallA.INTKEY FROM BQT1.SmallA", EXAMPLE_BQT)); //$NON-NLS-1$ + AtomicRequestMessage request = new AtomicRequestMessage(rm, workContext, nodeid); + request.setCommand(helpGetCommand("SELECT BQT1.SmallA.INTKEY FROM BQT1.SmallA", EXAMPLE_BQT)); //$NON-NLS-1$ request.setRequestID(new RequestID(requestid)); request.setConnectorName("testing"); //$NON-NLS-1$ request.setFetchSize(5); return request; } - public void testProcedureBatching() throws Exception { + @Test public void testProcedureBatching() throws Exception { ProcedureExecution exec = new FakeProcedureExecution(2, 1); // this has two result set columns and 1 out parameter @@ -128,17 +136,18 @@ } } - public void testCancelBeforeNew() throws Exception { + @Test public void testCancelBeforeNew() throws Exception { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); + FakeWorkManager wm = new FakeWorkManager(); // only one response is expected ResultsFuture<AtomicResultsMessage> resultsFuture = new ResultsFuture<AtomicResultsMessage>(); - ConnectorWorkItem state = new SynchConnectorWorkItem(request,getConnectorManager(Mockito.mock(ConnectorEnvironment.class)), resultsFuture.getResultsReceiver()); + ConnectorWorkItem state = new SynchConnectorWorkItem(request,getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm), resultsFuture.getResultsReceiver()); state.asynchCancel(); // cancel does not cause close, but the next // processing will close assertFalse(state.isDoneProcessing()); - state.run(); + wm.doWork(state); AtomicResultsMessage arm = resultsFuture.get(1000, TimeUnit.MILLISECONDS); @@ -219,9 +228,10 @@ } } - public void testMoreAsynch() throws Throwable { + @Test public void testMoreAsynch() throws Throwable { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); - final ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class)); + FakeWorkManager wm = new FakeWorkManager(); + final ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm); AsynchMoreResultsReceiver receiver = new AsynchMoreResultsReceiver(manager); ConnectorWorkItem state = new SynchConnectorWorkItem(request, manager, receiver); @@ -234,9 +244,10 @@ } } - public void testSynchInterrupt() throws Exception { + @Test public void testSynchInterrupt() throws Exception { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); - final ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class)); + FakeWorkManager wm = new FakeWorkManager(); + final ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm); QueueResultsReceiver receiver = new QueueResultsReceiver(); ConnectorWorkItem state = new SynchConnectorWorkItem(request, manager, receiver); Thread t = runRequest(state); @@ -245,9 +256,10 @@ assertTrue(state.isCancelled()); } - public void testImplicitClose() throws Exception { + @Test public void testImplicitClose() throws Exception { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); - ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class)); + FakeWorkManager wm = new FakeWorkManager(); + ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm); FakeConnector connector = (FakeConnector) manager.getConnector(); connector.setReturnsFinalBatch(true); @@ -259,46 +271,61 @@ assertTrue(state.isDoneProcessing()); } - public void testCloseBeforeNew() throws Exception { + @Test public void testCloseBeforeNew() throws Exception { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); + FakeWorkManager wm = new FakeWorkManager(); ResultsFuture<AtomicResultsMessage> resultsFuture = new ResultsFuture<AtomicResultsMessage>(); - ConnectorWorkItem state = new SynchConnectorWorkItem(request,getConnectorManager(Mockito.mock(ConnectorEnvironment.class)), resultsFuture.getResultsReceiver()); + ConnectorWorkItem state = new SynchConnectorWorkItem(request,getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm), resultsFuture.getResultsReceiver()); state.requestClose(); assertFalse(resultsFuture.isDone()); - state.run(); + + wm.doWork(state); AtomicResultsMessage arm = resultsFuture.get(1000, TimeUnit.MILLISECONDS); assertTrue(arm.isRequestClosed()); assertTrue(state.isDoneProcessing()); } - - public void testAsynchBasicMore() throws Exception { +/* NEED TO BE FIXED + @Test public void testAsynchBasicMore() throws Exception { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); - ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class)); + FakeWorkManager wm = new FakeWorkManager(); + ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm); FakeConnector connector = (FakeConnector) manager.getConnector(); QueueResultsReceiver resultsReceiver = new QueueResultsReceiver(); - FakeQueuingAsynchConnectorWorkItem state = new FakeQueuingAsynchConnectorWorkItem( - request, manager, resultsReceiver); + final Semaphore s = new Semaphore(1); + FakeQueuingAsynchConnectorWorkItem state = new FakeQueuingAsynchConnectorWorkItem(request, manager, resultsReceiver) { + @Override + public void workCompleted(WorkEvent arg0) { + super.workCompleted(arg0); + s.release(); + } + }; + s.acquire(); + + + wm.doWork(state); - state.run(); - + s.acquire(); + assertFalse(state.isDoneProcessing()); connector.setReturnsFinalBatch(true); state.requestMore(); - state.run(); - + wm.doWork(state); + s.acquire(); + assertTrue(state.isDoneProcessing()); assertEquals(3, resultsReceiver.results.size()); assertEquals(1, state.resumeCount); } - - public void testAsynchKeepAlive() throws Exception { +*/ + @Test public void testAsynchKeepAlive() throws Exception { AtomicRequestMessage request = createNewAtomicRequestMessage(1, 1); - ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class)); + FakeWorkManager wm = new FakeWorkManager(); + ConnectorManager manager = getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm); FakeConnector connector = (FakeConnector) manager.getConnector(); QueueResultsReceiver resultsReceiver = new QueueResultsReceiver(); FakeQueuingAsynchConnectorWorkItem state = new FakeQueuingAsynchConnectorWorkItem( @@ -320,7 +347,7 @@ assertEquals(1, state.resumeCount); } - public void testUpdateExecution() throws Throwable { + @Test public void testUpdateExecution() throws Throwable { QueueResultsReceiver receiver = helpExecuteUpdate(); AtomicResultsMessage results = receiver.getResults().remove(); assertEquals(Integer.valueOf(1), results.getResults()[0].get(0)); @@ -332,7 +359,8 @@ AtomicRequestMessage arm = createNewAtomicRequestMessage(1, 1); arm.setCommand(command); QueueResultsReceiver receiver = new QueueResultsReceiver(); - SynchConnectorWorkItem synchConnectorWorkItem = new SynchConnectorWorkItem(arm, getConnectorManager(Mockito.mock(ConnectorEnvironment.class)), receiver); + FakeWorkManager wm = new FakeWorkManager(); + SynchConnectorWorkItem synchConnectorWorkItem = new SynchConnectorWorkItem(arm, getConnectorManager(Mockito.mock(ConnectorEnvironment.class), wm), receiver); synchConnectorWorkItem.run(); if (receiver.exception != null) { throw receiver.exception; @@ -340,14 +368,14 @@ return receiver; } - public void testExecutionWarning() throws Throwable { + @Test public void testExecutionWarning() throws Throwable { QueueResultsReceiver receiver = helpExecuteUpdate(); AtomicResultsMessage results = receiver.getResults().remove(); assertEquals(1, results.getWarnings().size()); } - public void testIsImmutablePropertySucceeds() throws Exception { + @Test public void testIsImmutablePropertySucceeds() throws Exception { /* * Setup: * 1. requestMsg.isTransactional() must be TRUE @@ -357,7 +385,8 @@ */ ConnectorEnvironment env = Mockito.mock(ConnectorEnvironment.class); Mockito.stub(env.isImmutable()).toReturn(true); - ConnectorManager cm = getConnectorManager(env); + FakeWorkManager wm = new FakeWorkManager(); + ConnectorManager cm = getConnectorManager(env, wm); // command must not be a SELECT Command command = helpGetCommand("update bqt1.smalla set stringkey = 1 where stringkey = 2", EXAMPLE_BQT); //$NON-NLS-1$ @@ -367,9 +396,8 @@ // To make the AtomicRequestMessage transactional, construct your own requestMsg.setTransactionContext( new TransactionContext(){ @Override - public boolean isInTransaction() { - // TODO Auto-generated method stub - return true; + public Xid getXid() { + return Mockito.mock(Xid.class); }} ); QueueResultsReceiver receiver = new QueueResultsReceiver(); @@ -385,7 +413,7 @@ } } - public void testIsImmutablePropertyFails() throws Exception { + @Test public void testIsImmutablePropertyFails() throws Exception { /* * Setup: * 1. requestMsg.isTransactional() must be TRUE @@ -395,7 +423,8 @@ */ ConnectorEnvironment env = Mockito.mock(ConnectorEnvironment.class); Mockito.stub(env.isImmutable()).toReturn(false); - ConnectorManager cm = getConnectorManager(env); + FakeWorkManager wm = new FakeWorkManager(); + ConnectorManager cm = getConnectorManager(env, wm); // command must not be a SELECT Command command = helpGetCommand("update bqt1.smalla set stringkey = 1 where stringkey = 2", EXAMPLE_BQT); //$NON-NLS-1$ @@ -405,16 +434,15 @@ // To make the AtomicRequestMessage transactional, construct your own requestMsg.setTransactionContext( new TransactionContext(){ @Override - public boolean isInTransaction() { - // TODO Auto-generated method stub - return true; + public Xid getXid() { + return Mockito.mock(Xid.class); }} ); QueueResultsReceiver receiver = new QueueResultsReceiver(); - SynchConnectorWorkItem synchConnectorWorkItem = new SynchConnectorWorkItem(requestMsg, cm, receiver); // This is the test try { + SynchConnectorWorkItem synchConnectorWorkItem = new SynchConnectorWorkItem(requestMsg, cm, receiver); synchConnectorWorkItem.run(); assertNull("Connection should be null when IsImmutable is false", synchConnectorWorkItem.connection); //$NON-NLS-1$ } catch ( Exception e ) { Modified: branches/JCA/engine/src/test/java/org/teiid/dqp/internal/process/TestWorkItemState.java =================================================================== --- branches/JCA/engine/src/test/java/org/teiid/dqp/internal/process/TestWorkItemState.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/engine/src/test/java/org/teiid/dqp/internal/process/TestWorkItemState.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -85,7 +85,15 @@ private void assertDoneState() { checkState(ThreadState.DONE); } - + + @Override + protected boolean assosiateSecurityContext() { + return false; + } + + @Override + protected void clearSecurityContext() { + } } public TestWorkItemState(String name) { Added: branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/JBossContainerHelper.java =================================================================== --- branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/JBossContainerHelper.java (rev 0) +++ branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/JBossContainerHelper.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,68 @@ +/* + * JBoss, Home of Professional Open Source. + * See the COPYRIGHT.txt file distributed with this work for information + * regarding copyright ownership. Some portions may be licensed + * to Red Hat, Inc. under one or more contributor license agreements. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301 USA. + */ +package org.teiid.jboss; + +import java.io.Serializable; +import java.security.Principal; + +import javax.security.auth.Subject; + +import org.jboss.security.SecurityContext; +import org.teiid.ContainerHelper; + +public class JBossContainerHelper implements ContainerHelper, Serializable{ + + private static final long serialVersionUID = 1318670652523708608L; + + @Override + public boolean assosiateSecurityContext(String securityDomain, Object newContext) { + SecurityContext context = SecurityActions.getSecurityContext(); + if (context == null || (!context.getSecurityDomain().equals(securityDomain) && newContext != null)) { + SecurityActions.setSecurityContext((SecurityContext)newContext); + return true; + } + return false; + } + + @Override + public void clearSecurityContext(String securityDomain) { + SecurityContext sc = SecurityActions.getSecurityContext(); + if (sc.getSecurityDomain().equals(securityDomain)) { + SecurityActions.clearSecurityContext(); + } + } + + @Override + public Object getSecurityContext(String securityDomain) { + SecurityContext sc = SecurityActions.getSecurityContext(); + if (sc.getSecurityDomain().equals(securityDomain)) { + return sc; + } + return null; + } + + @Override + public Object createSecurityContext(String securityDomain, Principal p, Object credentials, Subject subject) { + SecurityActions.pushSecurityContext(p, credentials, subject, securityDomain); + return getSecurityContext(securityDomain); + } +} Property changes on: branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/JBossContainerHelper.java ___________________________________________________________________ Name: svn:mime-type + text/plain Added: branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/SecurityActions.java =================================================================== --- branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/SecurityActions.java (rev 0) +++ branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/SecurityActions.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -0,0 +1,85 @@ +/* + * JBoss, Home of Professional Open Source. + * See the COPYRIGHT.txt file distributed with this work for information + * regarding copyright ownership. Some portions may be licensed + * to Red Hat, Inc. under one or more contributor license agreements. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301 USA. + */ +package org.teiid.jboss; + +import java.security.AccessController; +import java.security.Principal; +import java.security.PrivilegedAction; + +import javax.security.auth.Subject; + +import org.jboss.security.SecurityContext; +import org.jboss.security.SecurityContextAssociation; +import org.jboss.security.SecurityContextFactory; + +class SecurityActions { + static void setSecurityContext(final SecurityContext sc) + { + AccessController.doPrivileged(new PrivilegedAction<Object>() + { + public Object run() + { + SecurityContextAssociation.setSecurityContext(sc); + return null; + } + }); + } + + static SecurityContext getSecurityContext() + { + return AccessController.doPrivileged(new PrivilegedAction<SecurityContext>() + { + public SecurityContext run() + { + return SecurityContextAssociation.getSecurityContext(); + } + }); + } + + static SecurityContext clearSecurityContext() + { + return AccessController.doPrivileged(new PrivilegedAction<SecurityContext>() + { + public SecurityContext run() + { + SecurityContextAssociation.clearSecurityContext(); + return null; + } + }); + } + + static void pushSecurityContext(final Principal p, final Object cred, final Subject subject, final String securityDomain) + { + AccessController.doPrivileged(new PrivilegedAction<Object>() { + public Object run() { + SecurityContext sc; + try { + sc = SecurityContextFactory.createSecurityContext(p, cred, subject, securityDomain); + } catch (Exception e) { + throw new RuntimeException(e); + } + setSecurityContext(sc); + return null; + } + }); + } +} Property changes on: branches/JCA/jboss-integration/src/main/java/org/teiid/jboss/SecurityActions.java ___________________________________________________________________ Name: svn:mime-type + text/plain Modified: branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/BaseAdmin.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/BaseAdmin.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/BaseAdmin.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -71,7 +71,6 @@ import com.metamatrix.jdbc.EmbeddedConnectionFactoryImpl; import com.metamatrix.platform.security.api.MetaMatrixSessionInfo; import com.metamatrix.platform.security.api.SessionToken; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; import com.metamatrix.platform.security.api.service.SessionServiceInterface; import com.metamatrix.platform.util.ProductInfoConstants; import com.metamatrix.server.serverapi.RequestInfo; @@ -156,10 +155,6 @@ return (TransactionService)getManager().findService(DQPServiceNames.TRANSACTION_SERVICE); } - MembershipServiceInterface getMembershipService() { - return (MembershipServiceInterface)getManager().findService(DQPServiceNames.MEMBERSHIP_SERVICE); - } - AuthorizationService getAuthorizationService() { return (AuthorizationService)getManager().findService(DQPServiceNames.AUTHORIZATION_SERVICE); } Modified: branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/DQPSecurityAdminImpl.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/DQPSecurityAdminImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/dqp/embedded/admin/DQPSecurityAdminImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -23,38 +23,27 @@ package com.metamatrix.dqp.embedded.admin; import java.io.IOException; -import java.util.ArrayList; import java.util.Collection; -import java.util.Iterator; import java.util.List; -import java.util.Set; import javax.xml.parsers.ParserConfigurationException; import org.teiid.adminapi.AdminComponentException; import org.teiid.adminapi.AdminException; -import org.teiid.adminapi.AdminObject; import org.teiid.adminapi.AdminOptions; import org.teiid.adminapi.AdminProcessingException; import org.teiid.adminapi.Group; import org.teiid.adminapi.SecurityAdmin; import org.xml.sax.SAXException; -import com.metamatrix.admin.api.exception.security.InvalidSessionException; -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; -import com.metamatrix.admin.objects.MMGroup; -import com.metamatrix.admin.objects.MMRole; import com.metamatrix.api.exception.security.AuthorizationException; import com.metamatrix.api.exception.security.AuthorizationMgmtException; -import com.metamatrix.api.exception.security.MembershipServiceException; import com.metamatrix.dqp.embedded.DQPEmbeddedPlugin; import com.metamatrix.jdbc.EmbeddedConnectionFactoryImpl; import com.metamatrix.platform.admin.api.EntitlementMigrationReport; import com.metamatrix.platform.security.api.AuthorizationPolicy; import com.metamatrix.platform.security.api.AuthorizationPolicyFactory; import com.metamatrix.platform.security.api.AuthorizationRealm; -import com.metamatrix.platform.security.api.MetaMatrixPrincipal; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; /** @@ -87,26 +76,27 @@ * @since 4.3 */ public Collection<Group> getGroupsForUser(String userIdentifier) throws AdminException { - if (userIdentifier == null) { - throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ - } - - if ( userIdentifier.equals(AdminObject.WILDCARD) ) { - throw new AdminProcessingException(DQPEmbeddedPlugin.Util.getString("ServerSecurityAdminImpl.Cant_use_wildcard")); //$NON-NLS-1$ - } - Collection groups = new ArrayList(); - // Get all memberships - explicit and implicit - Set allMemberships = null; - try { - allMemberships = getMembershipService().getGroupsForUser(userIdentifier); - } catch (MetaMatrixSecurityException e) { - throw new AdminComponentException(e); - } - Iterator allMembershipsItr = allMemberships.iterator(); - while ( allMembershipsItr.hasNext() ) { - groups.add(new MMGroup(new String[] {(String)allMembershipsItr.next()})); - } - return groups; +// if (userIdentifier == null) { +// throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ +// } +// +// if ( userIdentifier.equals(AdminObject.WILDCARD) ) { +// throw new AdminProcessingException(DQPEmbeddedPlugin.Util.getString("ServerSecurityAdminImpl.Cant_use_wildcard")); //$NON-NLS-1$ +// } +// Collection groups = new ArrayList(); +// // Get all memberships - explicit and implicit +// Set allMemberships = null; +// try { +// allMemberships = getMembershipService().getGroupsForUser(userIdentifier); +// } catch (MetaMatrixSecurityException e) { +// throw new AdminComponentException(e); +// } +// Iterator allMembershipsItr = allMemberships.iterator(); +// while ( allMembershipsItr.hasNext() ) { +// groups.add(new MMGroup(new String[] {(String)allMembershipsItr.next()})); +// } +// return groups; + return null; } /** @@ -114,30 +104,31 @@ * @since 4.3 */ public Collection<Group> getGroups(String groupIdentifier) throws AdminException { - if (groupIdentifier == null) { - throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ - } - - Collection<Group> groups = new ArrayList<Group>(); - Collection allGroups = null; - // Add all groups from internal membership domain - try { - allGroups = getMembershipService().getGroupNames(); - } catch (MetaMatrixSecurityException e) { - throw new AdminComponentException(e); - } - - Iterator groupItr = allGroups.iterator(); - while ( groupItr.hasNext() ) { - String groupName = (String) groupItr.next(); - - if (!groupIdentifier.equals(AdminObject.WILDCARD) && !groupName.equals(groupIdentifier)) { - continue; - } - - groups.add(new MMGroup(new String[] {groupName})); - } - return groups; +// if (groupIdentifier == null) { +// throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ +// } +// +// Collection<Group> groups = new ArrayList<Group>(); +// Collection allGroups = null; +// // Add all groups from internal membership domain +// try { +// allGroups = getMembershipService().getGroupNames(); +// } catch (MetaMatrixSecurityException e) { +// throw new AdminComponentException(e); +// } +// +// Iterator groupItr = allGroups.iterator(); +// while ( groupItr.hasNext() ) { +// String groupName = (String) groupItr.next(); +// +// if (!groupIdentifier.equals(AdminObject.WILDCARD) && !groupName.equals(groupIdentifier)) { +// continue; +// } +// +// groups.add(new MMGroup(new String[] {groupName})); +// } +// return groups; + return null; } @@ -146,30 +137,31 @@ * @since 4.3 */ public Collection getRolesForGroup(String groupIdentifier) throws AdminException { - if (groupIdentifier == null) { - throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ - } - - if ( groupIdentifier.equals(AdminObject.WILDCARD) ) { - throw new AdminProcessingException(DQPEmbeddedPlugin.Util.getString("ServerSecurityAdminImpl.Cant_use_wildcard")); //$NON-NLS-1$ - } - Collection roleNames = null; - try { - roleNames = getAuthorizationService().getRoleNamesForPrincipal(new MetaMatrixPrincipalName(groupIdentifier, MetaMatrixPrincipal.TYPE_GROUP)); - } catch (InvalidSessionException e) { - throw new AdminComponentException(e); - } catch (AuthorizationMgmtException e) { - throw new AdminComponentException(e); - } catch (AuthorizationException e) { - throw new AdminComponentException(e); - } - Collection roles = new ArrayList(); - Iterator roleNameItr = roleNames.iterator(); - while ( roleNameItr.hasNext() ) { - String roleName = (String)roleNameItr.next(); - roles.add(new MMRole(new String[] {roleName})); - } - return roles; +// if (groupIdentifier == null) { +// throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ +// } +// +// if ( groupIdentifier.equals(AdminObject.WILDCARD) ) { +// throw new AdminProcessingException(DQPEmbeddedPlugin.Util.getString("ServerSecurityAdminImpl.Cant_use_wildcard")); //$NON-NLS-1$ +// } +// Collection roleNames = null; +// try { +// roleNames = getAuthorizationService().getRoleNamesForPrincipal(new MetaMatrixPrincipalName(groupIdentifier, MetaMatrixPrincipal.TYPE_GROUP)); +// } catch (InvalidSessionException e) { +// throw new AdminComponentException(e); +// } catch (AuthorizationMgmtException e) { +// throw new AdminComponentException(e); +// } catch (AuthorizationException e) { +// throw new AdminComponentException(e); +// } +// Collection roles = new ArrayList(); +// Iterator roleNameItr = roleNames.iterator(); +// while ( roleNameItr.hasNext() ) { +// String roleName = (String)roleNameItr.next(); +// roles.add(new MMRole(new String[] {roleName})); +// } +// return roles; + return null; } /** @@ -243,29 +235,27 @@ @Override public List<String> getDomainNames() throws AdminException { - try { - return this.getMembershipService().getDomainNames(); - } catch (MembershipServiceException e) { - throw new AdminComponentException(e); - } + //return this.getMembershipService().getDomainNames(); + return null; } @Override public Collection<Group> getGroupsForDomain(String domainName) throws AdminException { - if (domainName == null) { - throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ - } - try { - Collection<String> groupNames = this.getMembershipService().getGroupsForDomain(domainName); - List<Group> result = new ArrayList<Group>(groupNames.size()); - for (String groupName : groupNames) { - result.add(new MMGroup(new String[] {groupName})); - } - return result; - } catch (MembershipServiceException e) { - throw new AdminComponentException(e); - } +// if (domainName == null) { +// throwProcessingException("AdminImpl.requiredparameter", new Object[] {}); //$NON-NLS-1$ +// } +// try { +// Collection<String> groupNames = this.getMembershipService().getGroupsForDomain(domainName); +// List<Group> result = new ArrayList<Group>(groupNames.size()); +// for (String groupName : groupNames) { +// result.add(new MMGroup(new String[] {groupName})); +// } +// return result; +// } catch (MembershipServiceException e) { +// throw new AdminComponentException(e); +// } + return null; } void throwProcessingException(String key, Object[] objects) throws AdminException { Modified: branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedConnectionFactoryImpl.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedConnectionFactoryImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedConnectionFactoryImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -33,12 +33,11 @@ import java.util.Date; import java.util.Properties; -import javax.naming.InitialContext; -import javax.naming.NamingException; import javax.resource.ResourceException; import javax.resource.spi.ConnectionManager; import org.teiid.ConnectionInfo; +import org.teiid.ContainerUtil; import org.teiid.TeiidManagedConnectionFactory; import org.teiid.TeiidResourceAdapter; import org.teiid.adminapi.Admin; @@ -67,7 +66,6 @@ import com.metamatrix.common.util.PropertiesUtils; import com.metamatrix.core.MetaMatrixCoreException; import com.metamatrix.core.MetaMatrixRuntimeException; -import com.metamatrix.dqp.ResourceFinder; import com.metamatrix.dqp.client.ClientSideDQP; import com.metamatrix.dqp.embedded.DQPEmbeddedPlugin; import com.metamatrix.dqp.embedded.DQPEmbeddedProperties; @@ -357,16 +355,11 @@ } private Admin getAdminAPI() { - try { - InitialContext ic = new InitialContext(); - Admin admin = (Admin)ic.lookup("teiid/admin"); - if (admin instanceof BaseAdmin) { - ((BaseAdmin) admin).setManager(this); - } - return admin; - } catch (NamingException e) { - throw new MetaMatrixRuntimeException("admin implementation not found"); - } + Admin admin = ContainerUtil.lookup("teiid/admin"); + if (admin instanceof BaseAdmin) { + ((BaseAdmin) admin).setManager(this); + } + return admin; } public MMProcess getProcess() { Modified: branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedGuiceModule.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedGuiceModule.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/jdbc/EmbeddedGuiceModule.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -24,7 +24,6 @@ import java.net.InetAddress; import java.net.URL; -import java.util.Collection; import java.util.HashMap; import java.util.Map; import java.util.Properties; @@ -40,7 +39,6 @@ import com.google.inject.AbstractModule; import com.google.inject.Injector; import com.google.inject.Scopes; -import com.google.inject.TypeLiteral; import com.google.inject.name.Names; import com.metamatrix.common.application.ApplicationService; import com.metamatrix.common.application.DQPConfigSource; @@ -57,10 +55,7 @@ import com.metamatrix.dqp.embedded.services.EmbeddedTransactionService; import com.metamatrix.dqp.embedded.services.EmbeddedVDBService; import com.metamatrix.dqp.service.DQPServiceNames; -import com.metamatrix.platform.security.api.AuthorizationPolicy; -import com.metamatrix.platform.security.authorization.service.AdminAuthorizationPolicyProvider; import com.metamatrix.platform.security.authorization.service.AuthorizationServiceImpl; -import com.metamatrix.platform.security.membership.service.MembershipServiceImpl; import com.metamatrix.platform.security.session.service.SessionServiceImpl; public class EmbeddedGuiceModule extends AbstractModule implements DQPConfigSource{ @@ -95,7 +90,6 @@ bind(DQPContextCache.class).toInstance(getContextCache()); bind(DQPCore.class).in(Scopes.SINGLETON); - bind(new TypeLiteral<Collection<AuthorizationPolicy>>(){}).annotatedWith(Names.named("AdminRoles")).toProvider(AdminAuthorizationPolicyProvider.class).in(Scopes.SINGLETON); //$NON-NLS-1$ configureServices(); @@ -139,7 +133,6 @@ result.put(DQPServiceNames.DATA_SERVICE, EmbeddedDataService.class); result.put(DQPServiceNames.TRANSACTION_SERVICE, EmbeddedTransactionService.class); result.put(DQPServiceNames.SESSION_SERVICE, SessionServiceImpl.class); - result.put(DQPServiceNames.MEMBERSHIP_SERVICE, MembershipServiceImpl.class); result.put(DQPServiceNames.AUTHORIZATION_SERVICE, AuthorizationServiceImpl.class); return result; } Deleted: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AdminAuthorizationPolicyProvider.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AdminAuthorizationPolicyProvider.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AdminAuthorizationPolicyProvider.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,71 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ -package com.metamatrix.platform.security.authorization.service; - -import java.io.IOException; -import java.net.URL; -import java.util.Collection; -import java.util.Collections; -import java.util.Properties; - -import com.google.inject.Inject; -import com.google.inject.Provider; -import com.google.inject.Singleton; -import com.google.inject.name.Named; -import com.metamatrix.common.log.LogManager; -import com.metamatrix.common.protocol.URLHelper; -import com.metamatrix.common.util.LogConstants; -import com.metamatrix.common.util.PropertiesUtils; -import com.metamatrix.dqp.embedded.DQPEmbeddedPlugin; -import com.metamatrix.dqp.service.AuthorizationService; -import com.metamatrix.platform.security.api.AuthorizationPolicy; -import com.metamatrix.platform.security.api.AuthorizationPolicyFactory; - -@Singleton -public class AdminAuthorizationPolicyProvider implements Provider<Collection<AuthorizationPolicy>> { - - @Inject @Named("DQPProperties") - Properties props; - - @Inject @Named("BootstrapURL") - private URL dqpURL; - - @Override - public Collection<AuthorizationPolicy> get() { - String fileName = this.props.getProperty(AuthorizationService.ADMIN_ROLES_FILE); - - if (fileName != null) { - try { - URL url = URLHelper.buildURL(this.dqpURL, fileName); - Properties roles = PropertiesUtils.loadFromURL(url); - return AuthorizationPolicyFactory.buildAdminPolicies(roles); - }catch(IOException e) { - LogManager.logError(LogConstants.CTX_AUTHORIZATION, e, DQPEmbeddedPlugin.Util.getString("failed_to_load_admin_roles")); //$NON-NLS-1$ - } - } - else { - LogManager.logDetail(LogConstants.CTX_AUTHORIZATION, DQPEmbeddedPlugin.Util.getString("admin_roles_not_defined")); //$NON-NLS-1$ - } - return Collections.EMPTY_LIST; - } - -} Modified: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AuthorizationServiceImpl.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AuthorizationServiceImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/authorization/service/AuthorizationServiceImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -23,9 +23,12 @@ package com.metamatrix.platform.security.authorization.service; import java.io.IOException; +import java.security.Principal; +import java.security.acl.Group; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; +import java.util.Enumeration; import java.util.HashSet; import java.util.Iterator; import java.util.List; @@ -39,13 +42,9 @@ import org.xml.sax.SAXException; import com.google.inject.Inject; -import com.google.inject.name.Named; import com.metamatrix.admin.api.exception.security.InvalidSessionException; -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; import com.metamatrix.api.exception.MetaMatrixComponentException; import com.metamatrix.api.exception.security.AuthorizationMgmtException; -import com.metamatrix.api.exception.security.InvalidPrincipalException; -import com.metamatrix.api.exception.security.MembershipServiceException; import com.metamatrix.common.application.ApplicationEnvironment; import com.metamatrix.common.application.exception.ApplicationInitializationException; import com.metamatrix.common.application.exception.ApplicationLifecycleException; @@ -70,7 +69,6 @@ import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; import com.metamatrix.platform.security.api.SessionToken; import com.metamatrix.platform.security.api.StandardAuthorizationActions; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; import com.metamatrix.platform.security.util.RolePermissionFactory; import com.metamatrix.server.util.ServerAuditContexts; import com.metamatrix.vdb.runtime.VDBKey; @@ -95,14 +93,13 @@ /* * Injected state */ - protected MembershipServiceInterface membershipService; protected VDBService vdbService; protected LRUCache<VDBKey, Collection<AuthorizationPolicy>> policyCache = new LRUCache<VDBKey, Collection<AuthorizationPolicy>>(); // Permission factory is reusable and thread safe private static final BasicAuthorizationPermissionFactory PERMISSION_FACTORY = new BasicAuthorizationPermissionFactory(); - Collection<AuthorizationPolicy> adminPolicies; + Collection<AuthorizationPolicy> adminPolicies = AuthorizationPolicyFactory.buildDefaultAdminPolicies(); /* * @see com.metamatrix.common.application.ApplicationService#initialize(java.util.Properties) @@ -133,7 +130,7 @@ String auditContext = getAuditContext(context); Collection inaccessableResources = Collections.EMPTY_LIST; try { - inaccessableResources = getInaccessibleResources(getSession(), auditContext, permissions); + inaccessableResources = getInaccessibleResources(auditContext, permissions); } catch (AuthorizationMgmtException e) { throw new MetaMatrixComponentException(e); } @@ -161,8 +158,10 @@ * @throws AuthorizationMgmtException if this service is unable to locate resources required * for this operation */ - private Collection getInaccessibleResources(SessionToken caller, String contextName, Collection requests) - throws AuthorizationMgmtException { + private Collection getInaccessibleResources(String contextName, Collection requests) throws AuthorizationMgmtException { + + SessionToken caller = getSession(); + LogManager.logDetail(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION, new Object[]{"getInaccessibleResources(", caller, ", ", contextName, ", ", requests, ")"}); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ //$NON-NLS-4$ List resources = new ArrayList(); @@ -177,29 +176,25 @@ AuditMessage msg = new AuditMessage( contextName, "getInaccessibleResources-request", caller.getUsername(), resources.toArray()); //$NON-NLS-1$ LogManager.log(MessageLevel.INFO, LogConstants.CTX_AUDITLOGGING, msg); - if (isEntitled(caller.getUsername())) { + if (isEntitled()){ return Collections.EMPTY_LIST; } Collection results = new HashSet(requests); - try { - Collection policies = this.getPoliciesForPrincipal(new MetaMatrixPrincipalName(caller.getUsername(), MetaMatrixPrincipal.TYPE_USER), getRequestedRealm(requests)); + Collection policies = this.getPoliciesForPrincipal(getRequestedRealm(requests)); - Iterator policyIter = policies.iterator(); - - while (policyIter.hasNext() && !results.isEmpty()) { - Iterator requestIter = results.iterator(); - AuthorizationPolicy policy = (AuthorizationPolicy) policyIter.next(); - while (requestIter.hasNext()) { - AuthorizationPermission request = (AuthorizationPermission) requestIter.next(); - if (policy.implies(request)) { - requestIter.remove(); - continue; - } + Iterator policyIter = policies.iterator(); + + while (policyIter.hasNext() && !results.isEmpty()) { + Iterator requestIter = results.iterator(); + AuthorizationPolicy policy = (AuthorizationPolicy) policyIter.next(); + while (requestIter.hasNext()) { + AuthorizationPermission request = (AuthorizationPermission) requestIter.next(); + if (policy.implies(request)) { + requestIter.remove(); + continue; } } - } catch (InvalidPrincipalException e) { - throw new AuthorizationMgmtException(e, DQPEmbeddedPlugin.Util.getString("AuthorizationServiceImpl.invalid_session")); //$NON-NLS-1$ } if (results.isEmpty()) { @@ -255,7 +250,7 @@ } try { - return hasPolicy(getSession(), realm, roleName); + return hasPolicy(realm, roleName); } catch (AuthorizationMgmtException err) { throw new MetaMatrixComponentException(err); } @@ -270,18 +265,13 @@ return false; } - private boolean hasPolicy(SessionToken session, AuthorizationRealm realm, String policyName) throws AuthorizationMgmtException { + private boolean hasPolicy(AuthorizationRealm realm, String policyName) throws AuthorizationMgmtException { - if (isEntitled(session.getUsername())) { + if (isEntitled()) { return true; } - Collection<AuthorizationPolicy> policies; - try { - policies = getPoliciesForPrincipal(new MetaMatrixPrincipalName(session.getUsername(), MetaMatrixPrincipal.TYPE_USER), realm); - } catch (InvalidPrincipalException e) { - throw new AuthorizationMgmtException(e); - } + Collection<AuthorizationPolicy> policies = getPoliciesForPrincipal(realm); HashSet applicablePolicies = new HashSet(); applicablePolicies.add(policyName); @@ -303,24 +293,6 @@ return false; } - public Collection<String> getRoleNamesForPrincipal(MetaMatrixPrincipalName principal) throws AuthorizationMgmtException { - Collection policies; - try { - policies = getPoliciesForPrincipal(principal, RolePermissionFactory.getRealm()); - } catch (InvalidPrincipalException e) { - throw new AuthorizationMgmtException(e); - } - - Collection<String> results = new HashSet<String>(); - - for (Iterator i = policies.iterator(); i.hasNext();) { - AuthorizationPolicy policy = (AuthorizationPolicy) i.next(); - results.add(policy.getAuthorizationPolicyID().getDisplayName()); - } - - return results; - } - /** * Return a collection of all policies for which this principal has authorization, caching as needed. * Policies are returned for the principal and all groups in which the principal has membership. @@ -330,24 +302,21 @@ * (this is not checked for, however) * @return All policies for which the principal is authenticated - may be empty but never null. * @throws AuthorizationMgmtException if this service has trouble connecting to services it uses. - * @throws InvalidPrincipalException if the principal is invalid. * @throws MetaMatrixComponentException */ - private Collection<AuthorizationPolicy> getPoliciesForPrincipal(MetaMatrixPrincipalName user, AuthorizationRealm realm) - throws AuthorizationMgmtException, InvalidPrincipalException { + private Collection<AuthorizationPolicy> getPoliciesForPrincipal(AuthorizationRealm realm) + throws AuthorizationMgmtException { Set<AuthorizationPolicy> result = new HashSet<AuthorizationPolicy>(); + Set<MetaMatrixPrincipalName> userRoles = getUserRoles(); + if (userRoles.isEmpty()) { + return result; + } - Set<MetaMatrixPrincipalName> principals = getGroupsForPrincipal(user); - - if (principals == null || principals.size() == 0) { - return result; - } - Collection<AuthorizationPolicy> policies = getPoliciesInRealm(realm); for (AuthorizationPolicy policy : policies) { - if (matchesPrincipal(principals, policy)) { + if (matchesPrincipal(userRoles, policy)) { result.add(policy); continue; } @@ -355,7 +324,24 @@ return result; } - @Override + + private Set<MetaMatrixPrincipalName> getUserRoles() { + Set<MetaMatrixPrincipalName> roles = new HashSet<MetaMatrixPrincipalName>(); + Set<Principal> principals = DQPWorkContext.getWorkContext().getSubject().getPrincipals(); + for(Principal p: principals) { + // this JBoss specific, but no code level dependencies + if ((p instanceof Group) && p.getName().equals("Roles")){ + Group g = (Group)p; + Enumeration rolesPrinciples = g.members(); + while(rolesPrinciples.hasMoreElements()) { + roles.add(new MetaMatrixPrincipalName(((Principal)rolesPrinciples.nextElement()).getName(), MetaMatrixPrincipal.TYPE_GROUP)); + } + } + } + return roles; + } + + @Override public Collection<AuthorizationPolicy> getPoliciesInRealm(AuthorizationRealm realm) throws AuthorizationMgmtException { Collection<AuthorizationPolicy> policies = null; @@ -406,6 +392,7 @@ return adminPolicies; } + @Override public void updatePoliciesInRealm(AuthorizationRealm realm, Collection<AuthorizationPolicy> policies) throws AuthorizationMgmtException { if (realm.getSubRealmName() != null) { @@ -433,57 +420,11 @@ } } - /** - * Return all the groups that this prinicpal is a member of <i>and</i> the - * given principal (implies this principal is a member of itself). - * @param principal the principal for which to look for groups (may itself be a group). - * @return the given principal and all groups of which it is a member. - * @throws AuthorizationMgmtException if an error occurs while contacting the Membership svc. - * @throws InvalidPrincipalException if the given principal is invalid. - */ - private Set<MetaMatrixPrincipalName> getGroupsForPrincipal(MetaMatrixPrincipalName principal) - throws AuthorizationMgmtException, InvalidPrincipalException { - - LogManager.logDetail(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION, new Object[] {"getGroupsForPrincipal(", principal, ") - Getting all group memberships."}); //$NON-NLS-1$ //$NON-NLS-2$ - // Get the set of all groups this Principal is a member of - Set<MetaMatrixPrincipalName> allPrincipals = new HashSet<MetaMatrixPrincipalName>(); - try { - Collection groups = Collections.EMPTY_SET; - if (principal.getType() == MetaMatrixPrincipal.TYPE_USER || principal.getType() == MetaMatrixPrincipal.TYPE_ADMIN) { - groups = membershipService.getGroupsForUser(principal.getName()); - } else if (principal.getType() == MetaMatrixPrincipal.TYPE_GROUP) { - MetaMatrixPrincipal groupPrincipal = membershipService.getPrincipal(principal); - groups = new HashSet(); - groups.add(groupPrincipal.getName()); - } - Iterator memberItr = groups.iterator(); - // Add all principals that each orig is member of - while (memberItr.hasNext()) { - // HACK: Convert ALL member principals to MetaMatrixPrincipalName objs - // since Auth and Memb svcs don't speak the same language. - MetaMatrixPrincipalName member = new MetaMatrixPrincipalName((String) memberItr.next(), MetaMatrixPrincipal.TYPE_GROUP); - LogManager.logDetail(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION, new Object[]{"getGroupsForPrincipal(", principal, ") - Adding membership <", member, ">"}); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - allPrincipals.add(member); - } - // Add original Principal, now that we know he's been authenticated. - allPrincipals.add(principal); - } catch (InvalidPrincipalException e) { - throw e; - } catch (MetaMatrixSecurityException e) { - throw new AuthorizationMgmtException(e, DQPEmbeddedPlugin.Util.getString("AuthorizationServiceImpl.error_seraching_policies")); //$NON-NLS-1$ + protected boolean isEntitled(){ + if (DQPWorkContext.getWorkContext().getSubject() == null) { + LogManager.logDetail(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION,new Object[]{ "Automatically entitling principal", DQPWorkContext.getWorkContext().getSessionToken().getUsername()}); //$NON-NLS-1$ + return true; } - return allPrincipals; - } - - protected boolean isEntitled(String principal) { - try { - if (membershipService.isSuperUser(principal) || !membershipService.isSecurityEnabled()) { - LogManager.logDetail(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION,new Object[]{ "Automatically entitling principal", principal}); //$NON-NLS-1$ - return true; - } - } catch (MembershipServiceException e) { - LogManager.logError(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION, e, DQPEmbeddedPlugin.Util.getString("AuthorizationServiceImpl.failed_to_get_groups")); //$NON-NLS-1$ - } return false; } @@ -492,6 +433,7 @@ * * @return <code>true</code> iff server-side entitlements checking is enabled. */ + @Override public boolean checkingEntitlements() { return useEntitlements; } @@ -548,16 +490,7 @@ } } - @Inject - public void setMembershipService(MembershipServiceInterface membershipService) { - this.membershipService = membershipService; - } - - @Inject - public void setAdminPolicies(@Named("AdminRoles") Collection<AuthorizationPolicy> adminPolicies) { - this.adminPolicies = adminPolicies; - } - + public void setUseEntitlements(boolean useEntitlements) { this.useEntitlements = useEntitlements; } @@ -568,10 +501,9 @@ } @Override - public boolean isCallerInRole(SessionToken session, String roleName) throws AuthorizationMgmtException { - LogManager.logTrace(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION, new Object[]{"isCallerInRole(", session, roleName, ")"}); //$NON-NLS-1$ //$NON-NLS-2$ - - return hasPolicy(session, RolePermissionFactory.getRealm(), roleName); + public boolean isCallerInRole(String roleName) throws AuthorizationMgmtException { + LogManager.logTrace(com.metamatrix.common.util.LogConstants.CTX_AUTHORIZATION, new Object[]{"isCallerInRole(", getSession(), roleName, ")"}); //$NON-NLS-1$ //$NON-NLS-2$ + return hasPolicy(RolePermissionFactory.getRealm(), roleName); } Modified: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/service/MembershipServiceImpl.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/service/MembershipServiceImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/service/MembershipServiceImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -23,364 +23,119 @@ package com.metamatrix.platform.security.membership.service; import java.io.IOException; -import java.io.Serializable; -import java.net.InetAddress; -import java.net.MalformedURLException; -import java.net.URL; -import java.util.ArrayList; +import java.security.Principal; import java.util.Collection; import java.util.Collections; -import java.util.HashSet; -import java.util.Iterator; import java.util.LinkedList; import java.util.List; -import java.util.Properties; -import java.util.Set; -import java.util.regex.Pattern; -import org.teiid.dqp.internal.process.DQPWorkContext; +import javax.security.auth.Subject; +import javax.security.auth.callback.Callback; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.callback.NameCallback; +import javax.security.auth.callback.PasswordCallback; +import javax.security.auth.callback.UnsupportedCallbackException; +import javax.security.auth.login.LoginContext; +import javax.security.auth.login.LoginException; -import com.google.inject.Inject; -import com.google.inject.name.Named; -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; -import com.metamatrix.api.exception.security.InvalidPrincipalException; -import com.metamatrix.api.exception.security.InvalidUserException; -import com.metamatrix.api.exception.security.LogonException; -import com.metamatrix.api.exception.security.MembershipServiceException; -import com.metamatrix.api.exception.security.UnsupportedCredentialException; -import com.metamatrix.common.application.ApplicationEnvironment; -import com.metamatrix.common.application.exception.ApplicationInitializationException; -import com.metamatrix.common.application.exception.ApplicationLifecycleException; -import com.metamatrix.common.config.api.AuthenticationProviderType; +import org.teiid.ContainerHelper; +import org.teiid.ContainerUtil; + import com.metamatrix.common.log.LogManager; -import com.metamatrix.common.protocol.URLHelper; import com.metamatrix.common.util.LogConstants; -import com.metamatrix.common.util.PropertiesUtils; -import com.metamatrix.common.util.crypto.CryptoException; -import com.metamatrix.common.util.crypto.CryptoUtil; -import com.metamatrix.core.util.StringUtil; import com.metamatrix.dqp.embedded.DQPEmbeddedPlugin; -import com.metamatrix.dqp.embedded.DQPEmbeddedProperties; -import com.metamatrix.platform.security.api.BasicMetaMatrixPrincipal; import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.MetaMatrixPrincipal; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; -import com.metamatrix.platform.security.api.service.AuthenticationToken; -import com.metamatrix.platform.security.api.service.FailedAuthenticationToken; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; -import com.metamatrix.platform.security.membership.spi.MembershipDomain; -import com.metamatrix.platform.security.membership.spi.MembershipSourceException; /** * This class serves as the primary implementation of the - * Membership Service, and logically consists of a set of one or - * more MembershipDomainInterface instances. The Service is - * responsible for creating and intializing the set of domains, - * receiving requests from clients, and determining - * which domain or domains are to handle those requests. + * Membership Service. Based on the security domains specified this class delegates the responsibility of + * authenticating user to those security domains in the order they are defined. */ -public class MembershipServiceImpl implements MembershipServiceInterface { - - static class MembershipDomainHolder { - - private MembershipDomain membershipDomain; - private String domainName; +public class MembershipServiceImpl { + public static final String AT = "@"; //$NON-NLS-1$ + private LoginContext loginContext; + private String userName; + private String securitydomain; + private Object credentials; + + public void authenticateUser(String username, Credentials credential, String applicationName, List<String> domains) throws LoginException { - public MembershipDomainHolder(MembershipDomain domain, String domainName) { - this.membershipDomain = domain; - this.domainName = domainName; + LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {"authenticateUser", username, applicationName}); //$NON-NLS-1$ + + final String baseUsername = getBaseUsername(username); + final char[] password = credential.getCredentialsAsCharArray(); + + // If username specifies a domain (user@domain) only that domain is authenticated against. + // If username specifies no domain, then all domains are tried in order. + for (String domain:getDomainsForUser(domains, username)) { + + try { + CallbackHandler handler = new CallbackHandler() { + @Override + public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { + for (int i = 0; i < callbacks.length; i++) { + if (callbacks[i] instanceof NameCallback) { + NameCallback nc = (NameCallback)callbacks[i]; + nc.setName(baseUsername); + } else if (callbacks[i] instanceof PasswordCallback) { + PasswordCallback pc = (PasswordCallback)callbacks[i]; + pc.setPassword(password); + credentials = password; + } else { + throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback"); + } + } + } + }; + + // this is the configured login for teiid + this.loginContext = createLoginContext(domain,handler); + this.loginContext.login(); + this.userName = baseUsername+AT+domain; + this.securitydomain = domain; + + return; + } catch (LoginException e) { + LogManager.logDetail(LogConstants.CTX_MEMBERSHIP,e.getMessage()); + } } - - /** - * Get the unique name of this Membership domain. - * @return the domain name. - */ - public String getDomainName() { - return domainName; - } - - /** - * @return Returns the membershipDomain. - */ - public MembershipDomain getMembershipDomain() { - return this.membershipDomain; - } - + throw new LoginException(DQPEmbeddedPlugin.Util.getString("SessionServiceImpl.The_username_0_and/or_password_are_incorrect", username )); } - - /* - * Configuration state - */ - private String adminUsername = DEFAULT_ADMIN_USERNAME; - private String adminCredentials; - private Pattern allowedAddresses; - private boolean isSecurityEnabled = true; - - private List<MembershipDomainHolder> domains = new ArrayList<MembershipDomainHolder>(); - private URL dqpURL; - private InetAddress hostAddress; - @Inject - public MembershipServiceImpl(@Named("BootstrapURL") URL dqpURL, @Named(DQPEmbeddedProperties.HOST_ADDRESS) InetAddress hostAddress) { - this.dqpURL = dqpURL; - this.hostAddress = hostAddress; + protected LoginContext createLoginContext(String domain, CallbackHandler handler) throws LoginException { + return new LoginContext(domain, handler); } - - // ----------------------------------------------------------------------------------- - // S E R V I C E - R E L A T E D M E T H O D S - // ----------------------------------------------------------------------------------- - /** - * Perform initialization and commence processing. This method is called only once. - * <p>Note: In order to perform the chaining of membership domains, this method assumes - * there exists a property in the given environment properties named - * {@link com.metamatrix.platform.security.api.service.MembershipServiceInterface#DOMAIN_ORDER DOMAIN_ORDER} - * that has an ordered value in the form of "A, X, ..., D" - * @throws ApplicationInitializationException - */ - @Override - public void initialize(Properties env) throws ApplicationInitializationException { - - isSecurityEnabled = Boolean.valueOf(env.getProperty(SECURITY_ENABLED)).booleanValue(); - LogManager.logDetail(LogConstants.CTX_MEMBERSHIP, "Security Enabled: " + isSecurityEnabled); //$NON-NLS-1$ - - if (!isSecurityEnabled) { - return; - } - - adminUsername = env.getProperty(ADMIN_USERNAME, DEFAULT_ADMIN_USERNAME); - - adminCredentials = env.getProperty(ADMIN_PASSWORD); - if (adminCredentials == null || adminCredentials.length() == 0) { - throw new ApplicationInitializationException(DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Root_password_required")); //$NON-NLS-1$ - } - - String property = env.getProperty(ADMIN_HOSTS); - if (property != null && property.length() > 0) { - this.allowedAddresses = Pattern.compile(property); - } - - if (CryptoUtil.isValueEncrypted(adminCredentials)) { - try { - //TODO: my caller should have already decrypted this for me - adminCredentials = CryptoUtil.stringDecrypt(adminCredentials); - } catch (CryptoException err) { - LogManager.logCritical(LogConstants.CTX_MEMBERSHIP, err, DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Root_password_decryption_failed")); //$NON-NLS-1$ - throw new ApplicationInitializationException(err); - } - } - - String domainNameOrder = env.getProperty(MembershipServiceInterface.DOMAIN_ORDER); - if (domainNameOrder == null || domainNameOrder.trim().length()==0) { - return; - } - - List domainNames = StringUtil.split(domainNameOrder, ","); //$NON-NLS-1$ - - Iterator domainNameItr = domainNames.iterator(); - while ( domainNameItr.hasNext() ) { - String domainName = ((String) domainNameItr.next()).trim(); - try { - Properties domainProps = PropertiesUtils.getProperties(domainName + ".*", env); //$NON-NLS-1$ - if (!Boolean.valueOf(domainProps.getProperty(DOMAIN_ACTIVE, "true")).booleanValue()) { //$NON-NLS-1$ - LogManager.logDetail(LogConstants.CTX_MEMBERSHIP, "Skipping initilization of inactive domain " + domainName); //$NON-NLS-1$ - continue; - } - MembershipDomain newDomain = createDomain(domainName, domainProps); - if(newDomain!=null) { - LogManager.logInfo(LogConstants.CTX_MEMBERSHIP, DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.loaded", domainName)); //$NON-NLS-1$ - this.domains.add(new MembershipDomainHolder(newDomain, domainName)); - } - } catch (Exception e){ - LogManager.logCritical(LogConstants.CTX_MEMBERSHIP, e, "Failed to load MembershipDomain"); //$NON-NLS-1$ - } - } + public LoginContext getLoginContext() { + return this.loginContext; } - - /** - * Create the membership domain of the given name with the given properties. A domain is created - * by instantiating the domain factory found in <code>env</code>. - * @param domainName The domain to be instantiated. - * @param env All properties that the domain needs to be established <i>especially>/i> the domain - * factory class name. - * @return The newly instantiated domain. - * @throws ApplicationInitializationException - * @throws IOException - * @throws MalformedURLException - * @throws MembershipSourceException - */ - private MembershipDomain createDomain(String domainName, Properties properties) throws ApplicationInitializationException, MalformedURLException, IOException, MembershipSourceException { - - MembershipDomain domain = null; - properties.setProperty(DOMAIN_NAME, domainName); - - // load properties file that defines the custom properties - URL url = null; - String propsString = properties.getProperty(DOMAIN_PROPERTIES); - if (propsString != null) { - url = URLHelper.buildURL(this.dqpURL, propsString); - } - else { - url = this.getClass().getClassLoader().getResource("membership-"+domainName+".properties"); //$NON-NLS-1$ //$NON-NLS-2$ - } - - if (url != null) { - Properties customProps = PropertiesUtils.loadFromURL(url); - properties.putAll(customProps); - - // Using this URL the Membership providers can further define and files that are in relative context to this file - properties.put(DOMAIN_PROPERTIES, url); - - boolean activate = PropertiesUtils.getBooleanProperty(properties, DOMAIN_ACTIVE, false); - if (activate) { - String className = properties.getProperty(AuthenticationProviderType.Attributes.AUTHDOMAIN_CLASS); - - if (className != null && className.length() > 0) { - try { - domain = (MembershipDomain) Thread.currentThread().getContextClassLoader().loadClass(className).newInstance(); - } catch (Throwable e) { - throw new ApplicationInitializationException(e, DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.failed_to_create", className)); //$NON-NLS-1$ - } - } else { - throw new ApplicationInitializationException(DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.unable_to_create", domainName)); //$NON-NLS-1$ - } - - domain.initialize(properties); - return domain; - } - } - return null; + + public String getUserName() { + return this.userName; } - - - - private void shutdownDomains() { - // Shut down the domain(s) ... - Iterator iter = this.domains.iterator(); - while ( iter.hasNext() ) { - MembershipDomainHolder domainHolder = (MembershipDomainHolder) iter.next(); - try { - domainHolder.getMembershipDomain().shutdown(); - } catch ( Exception e ) { - LogManager.logError(LogConstants.CTX_MEMBERSHIP, e, DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.error_shuting_down ")); //$NON-NLS-1$ - } - } - this.domains.clear(); + + public String getSecurityDomain() { + return this.securitydomain; } - - void setAllowedAddresses(Pattern allowedAddresses) { - this.allowedAddresses = allowedAddresses; - } - void setAdminCredentials(String adminCredentials) { - this.adminCredentials = adminCredentials; - } - - /** - * Authenticate a user with the specified username and credential - * for use with the specified application. The application name may also - * be used by the Membership Service to determine the appropriate authentication - * mechanism. - * <p> - * This method iterates through the domains and, on each domain, attempts to authenticate - * the principal with the specified credentials. Authentication is successful - * upon the first domain encountered that authenticates the principals. - * @param username - * @param credential - * @param trustedPayload - * @param applicationName - * @return - * @throws MetaMatrixSecurityException - * @throws MembershipServiceException - */ - public AuthenticationToken authenticateUser(String username, Credentials credential, String applicationName) { - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {"authenticateUser", username, applicationName}); //$NON-NLS-1$ - - if (credential != null) { - String password = new String(credential.getCredentialsAsCharArray()); - if (CryptoUtil.isEncryptionEnabled() && CryptoUtil.isValueEncrypted(password)) { - try { - credential = new Credentials(CryptoUtil.stringDecrypt(password).toCharArray()); - } catch (CryptoException err) { - //just log and allow the normal authentication flow - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Decrypt_failed", username); //$NON-NLS-1$ - LogManager.logWarning(LogConstants.CTX_MEMBERSHIP, err, msg); - } - } - } - - if (!isSecurityEnabled) { - return new SuccessfulAuthenticationToken(username); - } - - if (isSuperUser(username)) { - if (isSecurityEnabled && allowedAddresses != null) { - String address = DQPWorkContext.getWorkContext().getClientAddress(); - if (address == null) { - LogManager.logWarning(LogConstants.CTX_MEMBERSHIP, DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.unknown_host")); //$NON-NLS-1$ - return new FailedAuthenticationToken(); + public Object getSecurityContext() { + Object sc = null; + if (this.loginContext != null) { + ContainerHelper helper = ContainerUtil.lookup("teiid/container-helper"); + sc = helper.getSecurityContext(this.securitydomain); + if ( sc == null){ + Subject subject = this.loginContext.getSubject(); + Principal principal = null; + for(Principal p:subject.getPrincipals()) { + if (this.userName.startsWith(p.getName())) { + principal = p; + break; + } } - if (!allowedAddresses.matcher(address).matches() && !address.equals(this.hostAddress.getHostAddress())) { - LogManager.logWarning(LogConstants.CTX_MEMBERSHIP, DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.invalid_host", address, allowedAddresses.pattern())); //$NON-NLS-1$ - return new FailedAuthenticationToken(); - } + return helper.createSecurityContext(this.securitydomain, principal, credentials, subject); } - // decrypt admin password for comparison - if ((credential != null && adminCredentials.equals(String.valueOf(credential.getCredentialsAsCharArray())))) { - return new SuccessfulAuthenticationToken(username); - } - return new FailedAuthenticationToken(); } - - if (isWsdlUser(username)) { - // No need to check credentials. There is no password for the wsdl user. - return new SuccessfulAuthenticationToken(username); - } - - String baseUsername = getBaseUsername(username); - - // If username specifies a domain (user@domain) only that domain is authenticated against. - // If username specifies no domain, then all domains are tried in order. - Iterator iter = getDomainsForUser(username).iterator(); - while ( iter.hasNext() ) { - MembershipDomainHolder entry = (MembershipDomainHolder)iter.next(); - try { - - SuccessfulAuthenticationToken auth = entry.getMembershipDomain().authenticateUser(baseUsername, credential, applicationName); - - if (auth != null) { - baseUsername = escapeName(auth.getUserName()); - String domain = entry.getDomainName(); - - if (auth.getDomainName() != null) { - domain = auth.getDomainName(); - } - return new SuccessfulAuthenticationToken(baseUsername + MembershipServiceInterface.AT + domain); - } - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Null_authentication", entry.getDomainName(), username ); //$NON-NLS-1$ - LogManager.logError(LogConstants.CTX_MEMBERSHIP, msg); - return new FailedAuthenticationToken(); - } catch (LogonException le) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Logon_failed", entry.getDomainName(), username ); //$NON-NLS-1$ - LogManager.logWarning(LogConstants.CTX_MEMBERSHIP, le, msg); - return new FailedAuthenticationToken(); - } catch (InvalidUserException e) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Invalid_user", entry.getDomainName(), username ); //$NON-NLS-1$ - LogManager.logDetail(LogConstants.CTX_MEMBERSHIP, e, msg); - } catch (UnsupportedCredentialException e) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Unsupported_credentials", entry.getDomainName(), username ); //$NON-NLS-1$ - LogManager.logDetail(LogConstants.CTX_MEMBERSHIP, e, msg); - } catch (MembershipSourceException e) { - //just skip this domain for now - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.source_exception", entry.getDomainName()); //$NON-NLS-1$ - LogManager.logError(LogConstants.CTX_MEMBERSHIP, e, msg); - } - } - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.Failed_authentication", username ); //$NON-NLS-1$ - LogManager.logDetail(LogConstants.CTX_MEMBERSHIP, msg); - return new FailedAuthenticationToken(); + return sc; } static String getBaseUsername(String username) { @@ -397,7 +152,7 @@ } //strip the escape character from the remaining ats - return result.replaceAll("\\\\"+MembershipServiceInterface.AT, MembershipServiceInterface.AT); //$NON-NLS-1$ + return result.replaceAll("\\\\"+AT, AT); //$NON-NLS-1$ } static String escapeName(String name) { @@ -405,7 +160,7 @@ return name; } - return name.replaceAll(MembershipServiceInterface.AT, "\\\\"+MembershipServiceInterface.AT); //$NON-NLS-1$ + return name.replaceAll(AT, "\\\\"+AT); //$NON-NLS-1$ } static String getDomainName(String username) { @@ -424,7 +179,7 @@ static int getQualifierIndex(String username) { int index = username.length(); - while ((index = username.lastIndexOf(MembershipServiceInterface.AT, --index)) != -1) { + while ((index = username.lastIndexOf(AT, --index)) != -1) { if (index > 0 && username.charAt(index - 1) != '\\') { return index; } @@ -433,33 +188,27 @@ return -1; } - private Collection getDomainsForUser(String username) { + private Collection<String> getDomainsForUser(List<String> domains, String username) { // If username is null, return all domains if (username == null) { return domains; - // If username is admin account, return empty domain list - } else if (isSuperUser(username) || !isSecurityEnabled) { - return Collections.EMPTY_LIST; - } + } String domain = getDomainName(username); if (domain == null) { - return domains; + return domains; } // ------------------------------------------ // Handle usernames having @ sign // ------------------------------------------ - - MembershipDomainHolder domainHolder = null; - Iterator iter = domains.iterator(); - while(iter.hasNext()) { - MembershipDomainHolder currentHolder = (MembershipDomainHolder)iter.next(); - if(domain.equalsIgnoreCase(currentHolder.getDomainName())) { - domainHolder = currentHolder; + String domainHolder = null; + for (String d:domains) { + if(d.equalsIgnoreCase(domain)) { + domainHolder = d; break; - } + } } if (domainHolder == null) { @@ -467,204 +216,7 @@ } LinkedList result = new LinkedList(); - result.add(domainHolder); - return result; - } - - /** - * Obtain the principal object that is representative of the principal - * @param principalName - * @param type - * @return - * @throws MetaMatrixSecurityException - * @throws InvalidPrincipalException - */ - public MetaMatrixPrincipal getPrincipal(MetaMatrixPrincipalName principal) - throws MembershipServiceException, InvalidPrincipalException { - LogManager.logTrace( LogConstants.CTX_MEMBERSHIP, new Object[] { "getPrincipal", principal }); //$NON-NLS-1$ - - String name = principal.getName(); - - if (principal.getType() != MetaMatrixPrincipal.TYPE_GROUP) { - // Handle admin account user - if(isSuperUser(name) || !isSecurityEnabled) { - return new BasicMetaMatrixPrincipal(name, MetaMatrixPrincipal.TYPE_ADMIN,Collections.EMPTY_SET); - } - - if (isWsdlUser(name)) { - return new BasicMetaMatrixPrincipal(name, MetaMatrixPrincipal.TYPE_USER,Collections.EMPTY_SET); - } - } - - // Get base username (strip off everything after @) - String baseName = getBaseUsername(name); - - // Get domains for the user - Collection userDomains = getDomainsForUser(name); - - // If baseName is null, or domain cannot be uniquely determined throw exception - if (baseName==null || userDomains.size() != 1) { - throw new InvalidPrincipalException(DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.invalid_principal", name)); //$NON-NLS-1$ - } - - MembershipDomainHolder domain = (MembershipDomainHolder) userDomains.iterator().next(); - try { - if (principal.getType() != MetaMatrixPrincipal.TYPE_GROUP) { - Set results = getDomainSpecificGroups(domain.getMembershipDomain().getGroupNamesForUser(baseName), domain.getDomainName()); - // Get the principal from this domain - BasicMetaMatrixPrincipal result = new BasicMetaMatrixPrincipal(name, MetaMatrixPrincipal.TYPE_USER, results); - // If there is a result, then return the principal ... - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[]{"The user \"",name,"\" was obtained from domain \"",domain.getDomainName(),"\""} ); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - return result; - } - if (domain.getMembershipDomain().getGroupNames().contains(baseName)) { - return new BasicMetaMatrixPrincipal(name, MetaMatrixPrincipal.TYPE_GROUP); - } - } catch ( InvalidPrincipalException e ) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.principal_does_not_exist", name, domain.getDomainName()); //$NON-NLS-1$ - LogManager.logError(LogConstants.CTX_MEMBERSHIP, e, msg); - throw new InvalidPrincipalException(msg); - } catch (Throwable e) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.source_exception", domain.getDomainName()); //$NON-NLS-1$ - LogManager.logError(LogConstants.CTX_MEMBERSHIP, e, msg); - throw new MembershipServiceException(msg); - } - throw new InvalidPrincipalException(DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.principal_does_not_exist", name, domain.getDomainName())); //$NON-NLS-1$ - } - - private Set<String> getDomainSpecificGroups(Set<String> groups, String domainName) { - if (groups == null) { - return Collections.emptySet(); - } - Set<String> results = new HashSet<String>(); - - for (Iterator<String> i = groups.iterator(); i.hasNext();) { - results.add(escapeName(i.next()) + MembershipServiceInterface.AT + domainName); - } - return results; - } - - /** - * Obtain the set of groups to which this user belongs to. - * The result will come from the first domain that has the specified user. - * - * @return a set of Strings - */ - public Set getGroupsForUser(String userName) - throws MembershipServiceException, InvalidPrincipalException { - LogManager.logTrace( LogConstants.CTX_MEMBERSHIP, new Object[] { "getGroupsForUser", userName}); //$NON-NLS-1$ - - MetaMatrixPrincipal principal = getPrincipal(new MetaMatrixPrincipalName(userName, MetaMatrixPrincipal.TYPE_USER)); - - return principal.getGroupNames(); - } - - public String toString() { - StringBuffer membershipDomains = new StringBuffer(); - membershipDomains.append("\n*** MembershipService ***\n"); //$NON-NLS-1$ - Iterator domainItr = this.domains.iterator(); - while ( domainItr.hasNext() ) { - membershipDomains.append((domainItr.next()).toString()); - } - return membershipDomains.toString(); - } - - /** - * @throws MembershipServiceException - * @see com.metamatrix.platform.security.api.service.MembershipServiceInterface#getGroupNames() - */ - public Set getGroupNames() throws MembershipServiceException { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {"getGroupNames"}); //$NON-NLS-1$ - - Set result = new HashSet(); - Iterator iter = this.domains.iterator(); - while ( iter.hasNext() ) { - MembershipDomainHolder domain = (MembershipDomainHolder) iter.next(); - try { - result.addAll( getDomainSpecificGroups(domain.getMembershipDomain().getGroupNames(), domain.getDomainName()) ); - } catch (Throwable e) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.source_exception", domain.getDomainName()); //$NON-NLS-1$ - LogManager.logError(LogConstants.CTX_MEMBERSHIP, e, msg); - throw new MembershipServiceException(msg); - } - } - return result; - } - - /** - * @return Returns the domains. - */ - protected List getDomains() { - return this.domains; - } - - public List getDomainNames() { - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {"getDomainNames"}); //$NON-NLS-1$ - - List names = new ArrayList(); - Iterator iter = this.domains.iterator(); - while(iter.hasNext()) { - MembershipDomainHolder domainHolder = (MembershipDomainHolder)iter.next(); - String domainName = domainHolder.getDomainName(); - if(domainName!=null) { - names.add( domainName ); - } - } - return names; - } - - public Set<String> getGroupsForDomain(String domainName) throws MembershipServiceException { - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {"getGroupsForDomain", domainName}); //$NON-NLS-1$ - - MembershipDomainHolder dHolder = null; - Iterator iter = this.domains.iterator(); - while(iter.hasNext()) { - MembershipDomainHolder domainHolder = (MembershipDomainHolder)iter.next(); - String holderName = domainHolder.getDomainName(); - if(holderName!=null && holderName.equalsIgnoreCase(domainName)) { - dHolder = domainHolder; - } - } - if(dHolder==null) { - return Collections.emptySet(); - } - try { - return getDomainSpecificGroups(dHolder.getMembershipDomain().getGroupNames(), domainName); - } catch (Throwable e) { - String msg = DQPEmbeddedPlugin.Util.getString("MembershipServiceImpl.source_exception", dHolder.getDomainName()); //$NON-NLS-1$ - LogManager.logError(LogConstants.CTX_MEMBERSHIP, e, msg); - throw new MembershipServiceException(msg); - } - } - - public boolean isSuperUser(String username) { - return adminUsername.equalsIgnoreCase(username); - } - - public boolean isWsdlUser(String username) { - return DEFAULT_WSDL_USERNAME.equalsIgnoreCase(username); - } - - /** - * @see com.metamatrix.platform.security.api.service.MembershipServiceInterface#isSecurityEnabled() - */ - public boolean isSecurityEnabled() throws MembershipServiceException{ - return isSecurityEnabled; - } - - @Override - public void start(ApplicationEnvironment environment) - throws ApplicationLifecycleException { - - } - - @Override - public void stop() throws ApplicationLifecycleException { - shutdownDomains(); - } - + } } Deleted: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipDomain.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipDomain.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipDomain.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,96 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.membership.spi; - -import java.util.Properties; -import java.util.Set; - -import com.metamatrix.api.exception.security.InvalidUserException; -import com.metamatrix.api.exception.security.LogonException; -import com.metamatrix.api.exception.security.UnsupportedCredentialException; -import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; - -/** - * Defines a Membership Domain for the Membership Service. - */ -public interface MembershipDomain { - - /** - * Initialize this domain with the given properties. - * - * @param env contains the properties for this domain as set by the console - * @throws ServiceStateException - */ - void initialize(Properties env) throws MembershipSourceException; - - /** - * Shut down this domain to further work. - * - * @throws ServiceStateException - */ - void shutdown() throws MembershipSourceException; - - /** - * Authenticate a user with the specified username and credential for use with the specified application. The application name - * may also be used by the Membership Domain to determine the appropriate authentication mechanism. - * - * @param username - * The base username (without the domain suffix) of the individual attempting authentication. May be <code>null</code> if the - * membership domain implementation uses a mechanism other than username/credential authentication. - * @param credential - * The credentials belonging to the individual seeking authentication. May be <code>null</code> for anonymous authentications. - * @param applicationName - * The name of the application to which the individual is attempting to authenticate. It's provided as a connection - * property when the individual connects (via URL or connection properties). This <code>applicationName</code> - * may be used by the authenticating membership domain as a basis for authentication and authorization. - * @return the SuccessfulAuthenticationToken containing the username and trustedPayload. The username in the - * SuccessfulAuthenticationToken will be used to identify this user in later calls. If the user is to be authenticated into a - * different domain, that domain name should be set on the SuccessfulAuthenticationToken. - * The return value should not be null. - * @throws InvalidUserException if the user does not exist in this domain - * @throws UnsupportedCredentialException if the credential or trustedPayload cannot be used to authenticate the user - * @throws LogonException if the user was unsuccessfully authenticated - * @throws MembershipSourceException if there was an internal error - */ - SuccessfulAuthenticationToken authenticateUser(String username, - Credentials credential, - String applicationName) throws UnsupportedCredentialException, InvalidUserException, LogonException, MembershipSourceException; - - /** - * Returns a String set all group names known to this domain. The returned values should not be fully qualified with a domain suffix. - * @return a set of String group names - * @throws MembershipSourceException if there was an internal error - */ - Set getGroupNames() throws MembershipSourceException; - - /** - * Returns a String set of all group names the given user is a member of. The returned values should not be fully qualified with a domain suffix. - * @param username - * @return a set of String group names - * @throws InvalidUserException if the user does not exist in this domain - * @throws MembershipSourceException if there was an internal error - */ - Set getGroupNamesForUser(String username) throws InvalidUserException, MembershipSourceException; - -} Deleted: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipSourceException.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipSourceException.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/MembershipSourceException.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,82 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.membership.spi; - -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; - -public class MembershipSourceException extends MetaMatrixSecurityException { - - /** - * No-arg CTOR - */ - public MembershipSourceException( ) { - super( ); - } - /** - * Constructs an instance of the exception with the specified detail message. A detail - * message is a String that describes this particular exception. - * @param the detail message - */ - public MembershipSourceException(String message) { - super(message); - } - /** - * Constructs an instance of the exception with no detail message but with a - * single exception. - * @param e the exception that is encapsulated by this exception - */ - public MembershipSourceException(Throwable e) { - super(e); - } - /** - * Constructs an instance of the exception with the specified detail message - * and a single exception. A detail message is a String that describes this - * particular exception. - * @param message the detail message - * @param e the exception that is encapsulated by this exception - */ - public MembershipSourceException( Throwable e, String message ) { - super(e, message); - } - /** - * Construct an instance with an error code and message specified. - * - * @param message The error message - * @param code The error code - */ - public MembershipSourceException( String code, String message ) { - super( code, message ); - } - /** - * Construct an instance with a linked exception, and an error code and - * message, specified. - * - * @param e An exception to chain to this exception - * @param message The error message - * @param code The error code - */ - public MembershipSourceException( Throwable e, String code, String message ) { - super( e, code, message ); - } -} - Deleted: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/file/FileMembershipDomain.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/file/FileMembershipDomain.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/file/FileMembershipDomain.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,199 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.membership.spi.file; - -import java.io.IOException; -import java.net.MalformedURLException; -import java.net.URL; -import java.util.Collections; -import java.util.HashMap; -import java.util.HashSet; -import java.util.Iterator; -import java.util.Map; -import java.util.Properties; -import java.util.Set; - -import com.metamatrix.api.exception.security.InvalidUserException; -import com.metamatrix.api.exception.security.LogonException; -import com.metamatrix.api.exception.security.UnsupportedCredentialException; -import com.metamatrix.common.protocol.URLHelper; -import com.metamatrix.common.util.PropertiesUtils; -import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; -import com.metamatrix.platform.security.membership.spi.MembershipDomain; -import com.metamatrix.platform.security.membership.spi.MembershipSourceException; - -/** - * A membership domain that loads user and group definitions from the file system. - */ -public class FileMembershipDomain implements MembershipDomain { - - public static final String USERS_FILE = "usersFile"; //$NON-NLS-1$ - public static final String GROUPS_FILE = "groupsFile"; //$NON-NLS-1$ - public static final String CHECK_PASSWORD = "checkPassword"; //$NON-NLS-1$ - - private boolean checkPasswords; - - private Properties users; - private HashMap groups = new HashMap(); - private HashMap userGroups = new HashMap(); - - /** - * @throws MembershipSourceException - * @see com.metamatrix.platform.security.membership.spi.MembershipDomain#initialize(java.util.Properties) - */ - public void initialize(Properties env) throws MembershipSourceException { - checkPasswords = Boolean.valueOf(env.getProperty(CHECK_PASSWORD, Boolean.TRUE.toString())).booleanValue(); - - String userFile = env.getProperty(USERS_FILE); - String groupFile = env.getProperty(GROUPS_FILE); - - if (userFile == null) { - throw new MembershipSourceException("Required property " +USERS_FILE+ " was missing."); //$NON-NLS-1$ //$NON-NLS-2$ - } - - users = loadFile(env, userFile); - - if (groupFile == null) { - throw new MembershipSourceException("Required property " +GROUPS_FILE+ " was missing."); //$NON-NLS-1$ //$NON-NLS-2$ - } - - groups.clear(); - groups.putAll(loadFile(env, groupFile)); - userGroups.clear(); - for (Iterator i = groups.entrySet().iterator(); i.hasNext();) { - Map.Entry entry = (Map.Entry)i.next(); - String group = (String)entry.getKey(); - String userNames = (String)entry.getValue(); - String[] groupUsers = userNames.split(","); //$NON-NLS-1$ - - for (int j = 0; j < groupUsers.length; j++) { - String user = groupUsers[j].trim(); - Set uGroups = (Set)userGroups.get(user); - if (uGroups == null) { - uGroups = new HashSet(); - userGroups.put(user, uGroups); - } - uGroups.add(group); - } - } - } - - private Properties loadFile(Properties env, String file) throws MembershipSourceException { - try { - URL baseURL = (URL)env.get(MembershipServiceInterface.DOMAIN_PROPERTIES); - return PropertiesUtils.loadFromURL(URLHelper.buildURL(baseURL, file)); - } catch (MalformedURLException e) { - throw new MembershipSourceException(e, "Could not load file"); //$NON-NLS-1$ - } catch (IOException e) { - throw new MembershipSourceException(e, "Could not load file"); //$NON-NLS-1$ - } - } - - /** - * @see com.metamatrix.platform.security.membership.spi.MembershipDomain#shutdown() - */ - public void shutdown() { - } - - /** - * @see com.metamatrix.platform.security.membership.spi.MembershipDomain#authenticateUser(java.lang.String, com.metamatrix.platform.security.api.Credentials, java.io.Serializable, java.lang.String) - */ - public SuccessfulAuthenticationToken authenticateUser(String username, - Credentials credential, - String applicationName) throws UnsupportedCredentialException, - InvalidUserException, - LogonException, - MembershipSourceException { - if (username == null || credential == null) { - throw new UnsupportedCredentialException("a username and password must be supplied for this domain"); //$NON-NLS-1$ - } - - String password = (String)users.get(username); - - if (password == null) { - throw new InvalidUserException("user " + username + " is invalid"); //$NON-NLS-1$ //$NON-NLS-2$ - } - - if (!checkPasswords || password.equals(String.valueOf(credential.getCredentialsAsCharArray()))) { - return new SuccessfulAuthenticationToken(username); - } - - throw new LogonException("user " + username + " could not be authenticated"); //$NON-NLS-1$ //$NON-NLS-2$ - } - - /** - * @see com.metamatrix.platform.security.membership.spi.MembershipDomain#getGroupNames() - */ - public Set getGroupNames() throws MembershipSourceException { - Set resultNames = new HashSet(groups.keySet()); - return resultNames; - } - - /** - * @see com.metamatrix.platform.security.membership.spi.MembershipDomain#getGroupNamesForUser(java.lang.String) - */ - public Set getGroupNamesForUser(String username) throws InvalidUserException, - MembershipSourceException { - // See if this user is in the domain - if (!users.containsKey(username)) { - throw new InvalidUserException("user " + username + " is invalid"); //$NON-NLS-1$ //$NON-NLS-2$ - } - - Set usersGroups = (Set)userGroups.get(username); - if (usersGroups == null) { - return Collections.EMPTY_SET; - } - return usersGroups; - } - - /** - * @return Returns the checkPasswords. - */ - protected boolean checkPasswords() { - return this.checkPasswords; - } - - /** - * @return Returns the groups. - */ - protected HashMap getGroups() { - return this.groups; - } - - /** - * @return Returns the userGroups. - */ - protected HashMap getUserGroups() { - return this.userGroups; - } - - /** - * @return Returns the users. - */ - protected Properties getUsers() { - return this.users; - } - -} Deleted: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/ldap/LDAPMembershipDomain.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/ldap/LDAPMembershipDomain.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/membership/spi/ldap/LDAPMembershipDomain.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,582 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.membership.spi.ldap; - -import java.io.Serializable; -import java.util.ArrayList; -import java.util.Collections; -import java.util.HashMap; -import java.util.HashSet; -import java.util.Hashtable; -import java.util.List; -import java.util.Map; -import java.util.Properties; -import java.util.Set; - -import javax.naming.AuthenticationException; -import javax.naming.Context; -import javax.naming.NamingEnumeration; -import javax.naming.NamingException; -import javax.naming.NamingSecurityException; -import javax.naming.directory.Attribute; -import javax.naming.directory.Attributes; -import javax.naming.directory.DirContext; -import javax.naming.directory.InitialDirContext; -import javax.naming.directory.SearchControls; -import javax.naming.directory.SearchResult; - -import com.metamatrix.api.exception.security.InvalidUserException; -import com.metamatrix.api.exception.security.LogonException; -import com.metamatrix.api.exception.security.UnsupportedCredentialException; -import com.metamatrix.common.log.LogManager; -import com.metamatrix.common.util.LogConstants; -import com.metamatrix.dqp.embedded.DQPEmbeddedPlugin; -import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; -import com.metamatrix.platform.security.membership.spi.MembershipDomain; -import com.metamatrix.platform.security.membership.spi.MembershipSourceException; - -public class LDAPMembershipDomain implements - MembershipDomain { - - public static final String ONELEVEL_SCOPE_VALUE = "ONELEVEL_SCOPE"; //$NON-NLS-1$ - public static final String OBJECT_SCOPE_VALUE = "OBJECT_SCOPE"; //$NON-NLS-1$ - public static final String SUBTREE_SCOPE_VALUE = "SUBTREE_SCOPE"; //$NON-NLS-1$ - // properties - public static final String GROUPS_GROUP_MEMBER_ATTRIBUTE = "groups.groupMember.attribute"; //$NON-NLS-1$ - public static final String GROUPS_ROOT_CONTEXT = "groups.rootContext"; //$NON-NLS-1$ - public static final String GROUPS_SEARCH_SCOPE = "groups.searchScope"; //$NON-NLS-1$ - public static final String GROUPS_SEARCH_FILTER = "groups.searchFilter"; //$NON-NLS-1$ - public static final String GROUPS_DISPLAY_NAME_ATTRIBUTE = "groups.displayName.attribute"; //$NON-NLS-1$ - public static final String USERS_MEMBER_OF_ATTRIBUTE = "users.memberOf.attribute"; //$NON-NLS-1$ - public static final String USERS_ROOT_CONTEXT = "users.rootContext"; //$NON-NLS-1$ - public static final String USERS_SEARCH_SCOPE = "users.searchScope"; //$NON-NLS-1$ - public static final String USERS_DISPLAY_NAME_ATTRIBUTE = "users.displayName.attribute"; //$NON-NLS-1$ - public static final String USERS_SEARCH_FILTER = "users.searchFilter"; //$NON-NLS-1$ - public static final String LDAP_URL = "ldapURL"; //$NON-NLS-1$ - public static final String LDAP_ADMIN_PASSWORD = "ldapAdmin.password"; //$NON-NLS-1$ - public static final String LDAP_ADMIN_DN = "ldapAdmin.dn"; //$NON-NLS-1$ - public static final String TXN_TIMEOUT_IN_MILLIS = "txnTimeoutInMillis"; //$NON-NLS-1$ - - // default property values - public static final String LDAP_INITIAL_CONTEXT_FACTORY = "com.sun.jndi.ldap.LdapCtxFactory"; //$NON-NLS-1$ - public static final String LDAP_AUTH_TYPE = "simple"; //$NON-NLS-1$ - public static final String LDAP_USER_OBJECT_TYPE = "person"; //$NON-NLS-1$ - public static final String LDAP_REFERRAL_MODE = "follow"; //$NON-NLS-1$ - public static final String DEFAULT_SEARCH_FILTER = "(objectclass=*)"; //$NON-NLS-1$ - public static final String POOL_KEY = "com.sun.jndi.ldap.connect.pool"; //$NON-NLS-1$ - public static final String TIMEOUT_KEY = "com.sun.jndi.ldap.connect.timeout"; //$NON-NLS-1$ - public static final String DEFAULT_USERS_DISPLAY_NAME_ATTRIBUTE = "uid"; //$NON-NLS-1$ - public static final String DEFAULT_GROUPS_DISPLAY_NAME_ATTRIBUTE = "cn"; //$NON-NLS-1$ - - static class UserEntry { - - private String dn; - private Set groups; - - public UserEntry(String dn, - Set groups) { - this.dn = dn; - this.groups = groups; - } - - public String getDn() { - return this.dn; - } - - public Set getGroups() { - return this.groups; - } - - } - - static class LdapContext { - String context; - String searchFilter = DEFAULT_SEARCH_FILTER; - String displayAttribute; - String memberOfAttribute; - int searchScope = SearchControls.SUBTREE_SCOPE; - } - - private String domainName; - private String ldapURL; - private String ldapAdminUserDN; - private String ldapAdminUserPass; - private String ldapTxnTimeoutInMillis; - - private List usersRootContexts; - private List groupsRootContexts; - - private Hashtable adminContext = new Hashtable(); - - public void initialize(Properties props) throws MembershipSourceException { - this.domainName = props.getProperty(MembershipServiceInterface.DOMAIN_NAME); - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, "Initializing LDAP Domain: " + domainName); //$NON-NLS-1$ - - ldapTxnTimeoutInMillis = props.getProperty(TXN_TIMEOUT_IN_MILLIS); - - ldapAdminUserDN = getPropertyValue(props, LDAP_ADMIN_DN, null); - - ldapAdminUserPass = getPropertyValue(props, LDAP_ADMIN_PASSWORD, null); - - ldapURL = getPropertyValue(props, LDAP_URL, null); - if (ldapURL == null) { - throw new MembershipSourceException(DQPEmbeddedPlugin.Util.getString("LDAPMembershipDomain.Required_property", LDAP_URL)); //$NON-NLS-1$ - } - - usersRootContexts = buildContexts(USERS_ROOT_CONTEXT, - USERS_SEARCH_FILTER, - USERS_DISPLAY_NAME_ATTRIBUTE, - USERS_SEARCH_SCOPE, - USERS_MEMBER_OF_ATTRIBUTE, - DEFAULT_USERS_DISPLAY_NAME_ATTRIBUTE, - props); - - groupsRootContexts = buildContexts(GROUPS_ROOT_CONTEXT, - GROUPS_SEARCH_FILTER, - GROUPS_DISPLAY_NAME_ATTRIBUTE, - GROUPS_SEARCH_SCOPE, - GROUPS_GROUP_MEMBER_ATTRIBUTE, - DEFAULT_GROUPS_DISPLAY_NAME_ATTRIBUTE, - props); - - if (props.getProperty(USERS_MEMBER_OF_ATTRIBUTE, "").trim().length() == 0 //$NON-NLS-1$ - && props.getProperty(GROUPS_GROUP_MEMBER_ATTRIBUTE, "").trim().length() == 0) { //$NON-NLS-1$ - LogManager.logWarning(LogConstants.CTX_MEMBERSHIP, DQPEmbeddedPlugin.Util.getString("LDAPMembershipDomain.Require_memberof_property", domainName ) ); //$NON-NLS-1$ - } - - // Create the root context. - adminContext.put(Context.INITIAL_CONTEXT_FACTORY, LDAP_INITIAL_CONTEXT_FACTORY); - adminContext.put(Context.PROVIDER_URL, this.ldapURL); - adminContext.put(Context.REFERRAL, LDAP_REFERRAL_MODE); - adminContext.put(POOL_KEY, Boolean.TRUE.toString()); - - // If password is blank, we will perform an anonymous bind. - if (ldapAdminUserDN != null && ldapAdminUserPass != null) { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, domainName + ": Username was set to:" + ldapAdminUserDN); //$NON-NLS-1$ - adminContext.put(Context.SECURITY_AUTHENTICATION, LDAP_AUTH_TYPE); - adminContext.put(Context.SECURITY_PRINCIPAL, this.ldapAdminUserDN); - adminContext.put(Context.SECURITY_CREDENTIALS, this.ldapAdminUserPass); - } else { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, domainName - + ": admin dn was blank; performing anonymous bind."); //$NON-NLS-1$ - adminContext.put(Context.SECURITY_AUTHENTICATION, "none"); //$NON-NLS-1$ - } - - if (ldapTxnTimeoutInMillis != null) { - adminContext.put(TIMEOUT_KEY, ldapTxnTimeoutInMillis); - } - } - - private List buildContexts(String rootContextsProp, - String searchFilterProp, - String displayAttributeProp, - String searchScopeProp, - String memberOfAttributeProp, String defaultDisplayName, Properties props) throws MembershipSourceException { - - String rootContextsStr = props.getProperty(rootContextsProp, null); - if (rootContextsStr == null) { - throw new MembershipSourceException(DQPEmbeddedPlugin.Util.getString("LDAPMembershipDomain.Required_property", rootContextsProp)); //$NON-NLS-1$ - } - - String searchFilterStr = props.getProperty(searchFilterProp); - String searchScopeStr = props.getProperty(searchScopeProp); - String memberOfAttributeStr = props.getProperty(memberOfAttributeProp); - String displayAttributeStr = props.getProperty(displayAttributeProp); - - String[] rootContexts = rootContextsStr.split("\\?"); //$NON-NLS-1$ - String[] displayAttributes = (displayAttributeStr != null) ? displayAttributeStr.split("\\?") : null; //$NON-NLS-1$ - String[] searchFilters = (searchFilterStr != null) ? searchFilterStr.split("\\?") : null; //$NON-NLS-1$ - String[] searchScopes = (searchScopeStr != null) ? searchScopeStr.split("\\?") : null; //$NON-NLS-1$ - String[] memberOfAttributes = (memberOfAttributeStr != null) ? memberOfAttributeStr.split("\\?") : null; //$NON-NLS-1$ - - List results = new ArrayList(); - - for (int i = 0; i < rootContexts.length; i++) { - LdapContext context = new LdapContext(); - results.add(context); - context.context = rootContexts[i]; - - context.displayAttribute = getContextValue(displayAttributes, i, defaultDisplayName); - context.memberOfAttribute = getContextValue(memberOfAttributes, i, null); - - context.searchFilter = getContextValue(searchFilters, i, context.searchFilter); - context.searchScope = getSearchScope(getContextValue(searchScopes, i, null)); - } - - return results; - } - - private static String getContextValue(String[] values, int i, String defaultValue) { - String value = null; - - if (values != null) { - if (values.length > i) { - value = values[i]; - } else if (values.length == 1){ - value = values[0]; - } - } - - if (value == null || value.trim().length() == 0) { - value = defaultValue; - } - - return value; - } - - private static String getPropertyValue(Properties props, - String key, - String defaultValue) { - String result = props.getProperty(key); - if (result == null || result.trim().length() == 0) { - return defaultValue; - } - return result.trim(); - } - - private int getSearchScope(String scope) { - if (scope == null) { - return SearchControls.SUBTREE_SCOPE; - } - if (scope.equals(OBJECT_SCOPE_VALUE)) { - return SearchControls.OBJECT_SCOPE; - } - if (scope.equals(ONELEVEL_SCOPE_VALUE)) { - return SearchControls.ONELEVEL_SCOPE; - } - return SearchControls.SUBTREE_SCOPE; - } - - public void shutdown() { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, domainName + ": shutdown()"); //$NON-NLS-1$ - } - - public SuccessfulAuthenticationToken authenticateUser(String username, - Credentials credential, - String applicationName) throws UnsupportedCredentialException, - InvalidUserException, - LogonException, - MembershipSourceException { - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] { - domainName, "authenticateUser username", username, "applicationName", applicationName}); //$NON-NLS-1$ //$NON-NLS-2$ - - if (username == null) { - throw new UnsupportedCredentialException(DQPEmbeddedPlugin.Util.getString("LDAPMembershipDomain.No_annonymous", domainName)); //$NON-NLS-1$ - } - - UserEntry ue = getUserEntry(username, false); - - if (credential == null) { - throw new UnsupportedCredentialException(DQPEmbeddedPlugin.Util.getString("LDAPMembershipDomain.No_annonymous", domainName)); //$NON-NLS-1$ - } - - Hashtable connenv = new Hashtable(); - connenv.put(Context.INITIAL_CONTEXT_FACTORY, LDAP_INITIAL_CONTEXT_FACTORY); - connenv.put(Context.PROVIDER_URL, this.ldapURL); - connenv.put(Context.SECURITY_AUTHENTICATION, LDAP_AUTH_TYPE); - connenv.put(Context.SECURITY_PRINCIPAL, ue.getDn()); - connenv.put(Context.SECURITY_CREDENTIALS, String.valueOf(credential.getCredentialsAsCharArray())); - - DirContext ctx = null; - try { - ctx = new InitialDirContext(connenv); - } catch (NamingSecurityException nse) { - throw new LogonException(nse, nse.getMessage()); - } catch (NamingException ne) { - throw new MembershipSourceException(ne, ne.getMessage()); - } finally { - if (ctx != null) { - try { - ctx.close(); - } catch (NamingException ne) { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, ne, domainName + ": error closing context"); //$NON-NLS-1$ - } - } - } - - if(credential.getCredentialsAsCharArray().length == 0){ - username = "";//$NON-NLS-1$ - } - - return new SuccessfulAuthenticationToken(username); - } - - public Set getGroupNames() throws MembershipSourceException { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] { - domainName, " getGroupNames() called"}); //$NON-NLS-1$ - - DirContext ctx = null; - - try { - ctx = getAdminContext(); - return new HashSet(getGroupNames(ctx, null, false).values()); - } finally { - if (ctx != null) { - try { - ctx.close(); - } catch (NamingException ne) { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, ne, domainName + ": error closing context"); //$NON-NLS-1$ - } - } - } - } - - private DirContext getAdminContext() throws MembershipSourceException { - try { - return new InitialDirContext((Hashtable)adminContext.clone()); - } catch (AuthenticationException err) { - throw new MembershipSourceException(err, DQPEmbeddedPlugin.Util.getString("LDAPMembershipDomain.Admin_credentials", domainName)); //$NON-NLS-1$ - } catch (NamingException err) { - throw new MembershipSourceException(err); - } - } - - public Set getGroupNamesForUser(String username) throws InvalidUserException, - MembershipSourceException { - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "getGroupNamesForUser", username}); //$NON-NLS-1$ - - if(username.length() == 0){ - return Collections.EMPTY_SET; - } - - UserEntry ue = getUserEntry(username, true); - - return ue.getGroups(); - } - - public static final String escapeLDAPSearchFilter(String filter) { - StringBuffer sb = new StringBuffer(); - for (int i = 0; i < filter.length(); i++) { - char curChar = filter.charAt(i); - switch (curChar) { - case '\\': - sb.append("\\5c"); //$NON-NLS-1$ - break; - case '*': - sb.append("\\2a"); //$NON-NLS-1$ - break; - case '(': - sb.append("\\28"); //$NON-NLS-1$ - break; - case ')': - sb.append("\\29"); //$NON-NLS-1$ - break; - case '\u0000': - sb.append("\\00"); //$NON-NLS-1$ - break; - default: - sb.append(curChar); - } - } - return sb.toString(); - } - - private UserEntry getUserEntry(String username, - boolean getGroups) throws MembershipSourceException, - InvalidUserException { - - username = escapeLDAPSearchFilter(username); - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "getUserEntry", username, "getGroups", String.valueOf(getGroups)}); //$NON-NLS-1$ //$NON-NLS-2$ - - DirContext ctx = null; - - try { - - ctx = getAdminContext(); - - for (int i = 0; i < usersRootContexts.size(); i++) { - - LdapContext context = (LdapContext)usersRootContexts.get(i); - - String contextName = context.context; - - SearchControls sControls = new SearchControls(); - sControls.setSearchScope(context.searchScope); - if (context.memberOfAttribute != null) { - sControls.setReturningAttributes(new String[] {context.memberOfAttribute}); - } - String singleUserSearchFilter = "(" + context.displayAttribute + "=" + username + ")"; //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - - if (context.searchFilter.length() > 0) { - singleUserSearchFilter = "(&" + singleUserSearchFilter + context.searchFilter + ")"; //$NON-NLS-1$ //$NON-NLS-2$ - } - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "searching context", contextName, "with filter", singleUserSearchFilter, "and search scope", String.valueOf(context.searchScope)}); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - - // We expect to receive only one user from this search, since the username attribute must be unique. - NamingEnumeration usersEnumeration = ctx.search(contextName, singleUserSearchFilter, sControls); - if (!usersEnumeration.hasMore()) { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "no user match found in context", contextName}); //$NON-NLS-1$ - continue; - } - SearchResult foundUser = (SearchResult)usersEnumeration.next(); - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "found user", username, "in context", contextName}); //$NON-NLS-1$ //$NON-NLS-2$ - - if (usersEnumeration.hasMore()) { - LogManager - .logWarning(LogConstants.CTX_MEMBERSHIP, - domainName - + ": Only expected one user when performing lookup. Check to ensure the display name is unique."); //$NON-NLS-1$ - } - - String RDN = foundUser.getName(); - String dn = RDN + ',' + contextName; - HashSet groupList = new HashSet(); - - if (getGroups) { - Map groupNames = getGroupNames(ctx, dn, context.memberOfAttribute == null); - - if (context.memberOfAttribute != null) { - Attribute memberOfAttr = foundUser.getAttributes().get(context.memberOfAttribute); - - if (memberOfAttr != null) { - int groupCount = memberOfAttr.size(); - for (int j = 0; j < groupCount; j++) { - String groupDN = (String)memberOfAttr.get(i); - if (groupDN == null) { - continue; - } - String groupRdn = (String)groupNames.get(groupDN); - if (groupRdn == null) { - continue; - } - groupList.add(groupDN); - LogManager - .logTrace(LogConstants.CTX_MEMBERSHIP, domainName - + "-----Adding user's group: " + groupDN); //$NON-NLS-1$ - } - } - } else { - groupList.addAll(groupNames.values()); - } - } - UserEntry ue = new UserEntry(dn, groupList); - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "UserEntry retrieved for username", username, ue.getDn()}); //$NON-NLS-1$ - - return ue; - } - } catch (NamingException ne) { - throw new MembershipSourceException(ne); - } finally { - if (ctx != null) { - try { - ctx.close(); - } catch (NamingException ne) { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, ne, domainName + ": error closing context"); //$NON-NLS-1$ - } - } - } - - LogManager.logInfo(LogConstants.CTX_MEMBERSHIP, - domainName + ": No user DN found for user: " + username + ", could not authenticate."); //$NON-NLS-1$ //$NON-NLS-2$ - throw new InvalidUserException(username); - } - - private Map getGroupNames(DirContext ctx, - String userDn, boolean mustMatchDn) throws MembershipSourceException { - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "getGroupNames", userDn, "mustMatchDn", String.valueOf(mustMatchDn)}); //$NON-NLS-1$ //$NON-NLS-2$ - - Map groupNames = new HashMap(); - - try { - - for (int i = 0; i < groupsRootContexts.size(); i++) { - - LdapContext context = (LdapContext)groupsRootContexts.get(i); - - String contextName = context.context; - - // Set the search controls to search subdirectories, or just the current level. - SearchControls groupSC = new SearchControls(); - groupSC.setSearchScope(context.searchScope); - groupSC.setReturningAttributes(new String[] {context.displayAttribute}); - - String searchFilter = context.searchFilter; - - if (userDn != null && context.memberOfAttribute != null) { - searchFilter = "(&(" + context.memberOfAttribute + "=" + userDn + ")" + searchFilter + ")"; //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ //$NON-NLS-4$ - } else if (mustMatchDn) { - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "skipping group context"}); //$NON-NLS-1$ - continue; - } - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "searching group context", contextName, "with filter", searchFilter, "and search scope", String.valueOf(context.searchScope)}); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - - NamingEnumeration groupsEnum = ctx.search(contextName, searchFilter, groupSC); - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "Parsing through groups search results."}); //$NON-NLS-1$ - - while (groupsEnum.hasMore()) { - SearchResult curGroup = (SearchResult)groupsEnum.next(); - String groupRDN = curGroup.getName(); - - String groupDN = groupRDN + ',' + contextName; - // GHH - if the context here is a single group, we end up with the groupRDN being an empty string, in which - // case there is now an extra comma at the start of groupDN - if (groupDN.charAt(0) == ',') { - groupDN = groupDN.substring(1); - } - Attributes attrs = curGroup.getAttributes(); - if (attrs == null) { - continue; - } - // Get the display name. - Attribute groupDisplayNameAttr = attrs.get(context.displayAttribute); - if (groupDisplayNameAttr == null) { - continue; - } - String groupDisplayName = (String)groupDisplayNameAttr.get(); - if (groupDisplayName == null) { - continue; - } - - groupNames.put(groupDN, groupDisplayName); - - LogManager.logTrace(LogConstants.CTX_MEMBERSHIP, new Object[] {domainName, "Found groupDN", groupDN, "with display name", groupDisplayName}); //$NON-NLS-1$ //$NON-NLS-2$ - } - } - } catch (NamingException err) { - throw new MembershipSourceException(err); - } - - return groupNames; - } - - List getUsersRootContexts() { - return usersRootContexts; - } - - List getGroupsRootContexts() { - return groupsRootContexts; - } - -} Modified: branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/session/service/SessionServiceImpl.java =================================================================== --- branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/session/service/SessionServiceImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/com/metamatrix/platform/security/session/service/SessionServiceImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -25,6 +25,9 @@ import java.util.ArrayList; import java.util.Collection; import java.util.Collections; +import java.util.Iterator; +import java.util.LinkedList; +import java.util.List; import java.util.Map; import java.util.Properties; import java.util.Timer; @@ -32,13 +35,14 @@ import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.atomic.AtomicLong; +import javax.security.auth.login.LoginContext; +import javax.security.auth.login.LoginException; + import org.teiid.dqp.internal.process.DQPCore; import com.google.inject.Inject; import com.metamatrix.admin.api.exception.security.InvalidSessionException; -import com.metamatrix.admin.api.exception.security.MetaMatrixSecurityException; import com.metamatrix.api.exception.MetaMatrixComponentException; -import com.metamatrix.api.exception.security.MetaMatrixAuthenticationException; import com.metamatrix.api.exception.security.SessionServiceException; import com.metamatrix.common.api.MMURL; import com.metamatrix.common.application.ApplicationEnvironment; @@ -48,26 +52,25 @@ import com.metamatrix.common.log.LogManager; import com.metamatrix.common.util.LogConstants; import com.metamatrix.core.util.ArgCheck; +import com.metamatrix.core.util.StringUtil; import com.metamatrix.dqp.embedded.DQPEmbeddedPlugin; import com.metamatrix.dqp.service.VDBService; import com.metamatrix.metadata.runtime.api.VirtualDatabaseDoesNotExistException; import com.metamatrix.metadata.runtime.api.VirtualDatabaseException; import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.MetaMatrixPrincipal; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; import com.metamatrix.platform.security.api.MetaMatrixSessionID; import com.metamatrix.platform.security.api.MetaMatrixSessionInfo; -import com.metamatrix.platform.security.api.service.AuthenticationToken; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; import com.metamatrix.platform.security.api.service.SessionListener; import com.metamatrix.platform.security.api.service.SessionServiceInterface; +import com.metamatrix.platform.security.membership.service.MembershipServiceImpl; import com.metamatrix.platform.util.ProductInfoConstants; /** * This class serves as the primary implementation of the Session Service. */ public class SessionServiceImpl implements SessionServiceInterface { - + public static final String SECURITY_DOMAINS = "securitydomains"; //$NON-NLS-1$ + /* * Configuration state */ @@ -77,7 +80,6 @@ /* * Injected state */ - private MembershipServiceInterface membershipService; private DQPCore dqpCore; private VDBService vdbService; @@ -85,7 +87,10 @@ private Timer sessionMonitor; private AtomicLong idSequence = new AtomicLong(); private SessionListener sessionListener; - + private boolean isSecurityEnabled = false; + private LinkedList<String> securityDomains = new LinkedList<String>(); + + // ----------------------------------------------------------------------------------- // S E R V I C E - R E L A T E D M E T H O D S // ----------------------------------------------------------------------------------- @@ -124,29 +129,39 @@ if (this.sessionListener != null) { this.sessionListener.sessionClosed(info); } + + // try to log out of the context. + try { + if (info.getLoginContext() != null) { + info.getLoginContext().logout(); + } + } catch (LoginException e) { + LogManager.logWarning(LogConstants.CTX_SESSION,e,"Exception terminitating session"); //$NON-NLS-1$ + } } @Override - public MetaMatrixSessionInfo createSession(String userName, - Credentials credentials, String applicationName, - Properties properties) throws MetaMatrixAuthenticationException, - SessionServiceException { + public MetaMatrixSessionInfo createSession(String userName, Credentials credentials, String applicationName, Properties properties) + throws LoginException, SessionServiceException { ArgCheck.isNotNull(applicationName); ArgCheck.isNotNull(properties); Properties productInfo = new Properties(); - - // - // Authenticate user... - // if not authenticated, this method throws exception - // - AuthenticationToken authenticatedToken = this.authenticateUser(userName, credentials, applicationName); - String authenticatedUserName = authenticatedToken.getUserName(); - - // + LoginContext loginContext = null; + String securityDomain = "none"; + Object securityContext = null; + if (this.isSecurityEnabled) { + // Authenticate user... + // if not authenticated, this method throws exception + MembershipServiceImpl membership = authenticate(userName, credentials, applicationName); + loginContext = membership.getLoginContext(); + userName = membership.getUserName(); + securityDomain = membership.getSecurityDomain(); + securityContext = membership.getSecurityContext(); + } + // Validate VDB and version if logging on to server product... - // String vdbName = properties.getProperty(ProductInfoConstants.VIRTUAL_DB); if (vdbName != null) { String vdbVersion = properties.getProperty(ProductInfoConstants.VDB_VERSION); @@ -178,7 +193,10 @@ // Return a new session info object MetaMatrixSessionInfo newSession = new MetaMatrixSessionInfo(id, - authenticatedUserName, + userName, + loginContext, + securityDomain, + securityContext, creationTime, applicationName, productInfo, @@ -190,31 +208,12 @@ } return newSession; } - - private AuthenticationToken authenticateUser(String userName, - Credentials credentials, String applicationName) - throws SessionServiceException, MetaMatrixAuthenticationException { - AuthenticationToken authenticatedToken = null; - // Authenticate the principal ... - try { - authenticatedToken = this.membershipService.authenticateUser(userName, credentials, applicationName); - }catch (MetaMatrixSecurityException e) { - String msg = DQPEmbeddedPlugin.Util.getString("SessionServiceImpl.Membership_service_could_not_authenticate_user", new Object[] { userName }); //$NON-NLS-1$ - SessionServiceException se = new SessionServiceException(e, msg); - throw se; - } - // Throw exception if not authenticated - // Log the failure as a warning as it is not a system level failure, but - // rather a processing - // level issue. - if (!authenticatedToken.isAuthenticated()) { - Object[] params = new Object[] { userName }; - String msg = DQPEmbeddedPlugin.Util.getString("SessionServiceImpl.The_username_0_and/or_password_are_incorrect", params); //$NON-NLS-1$ - throw new MetaMatrixAuthenticationException(msg); - } - - return authenticatedToken; + protected MembershipServiceImpl authenticate(String userName, Credentials credentials, String applicationName) + throws LoginException { + MembershipServiceImpl membership = new MembershipServiceImpl(); + membership.authenticateUser(userName, credentials, applicationName, this.securityDomains); + return membership; } @Override @@ -228,19 +227,6 @@ } @Override - public MetaMatrixPrincipal getPrincipal(MetaMatrixSessionID sessionID) - throws InvalidSessionException, SessionServiceException { - - MetaMatrixSessionInfo sessionInfo = this.getSessionInfo(sessionID); - - try { - return membershipService.getPrincipal(new MetaMatrixPrincipalName(sessionInfo.getUserName(), MetaMatrixPrincipal.TYPE_USER)); - } catch (MetaMatrixSecurityException e) { - throw new SessionServiceException(e, DQPEmbeddedPlugin.Util.getString("SessionServiceImpl.failed_to_getprincipal",sessionInfo.getUserName())); //$NON-NLS-1$ - } - } - - @Override public Collection<MetaMatrixSessionInfo> getSessionsLoggedInToVDB(String VDBName, String VDBVersion) throws SessionServiceException { if (VDBName == null || VDBVersion == null) { @@ -293,11 +279,6 @@ } @Inject - public void setMembershipService(MembershipServiceInterface membershipService) { - this.membershipService = membershipService; - } - - @Inject public void setDqpCore(DQPCore dqpCore) { this.dqpCore = dqpCore; } @@ -306,6 +287,21 @@ public void initialize(Properties props) throws ApplicationInitializationException { this.sessionMaxLimit = Long.parseLong(props.getProperty(MAX_SESSIONS, DEFAULT_MAX_SESSIONS)); this.sessionExpirationTimeLimit = Long.parseLong(props.getProperty(SESSION_EXPIRATION, DEFAULT_SESSION_EXPIRATION)); + + String domainNameOrder = props.getProperty(SECURITY_DOMAINS); + if (domainNameOrder != null && domainNameOrder.trim().length()>0) { + isSecurityEnabled = true; + } + LogManager.logDetail(LogConstants.CTX_MEMBERSHIP, "Security Enabled: " + isSecurityEnabled); //$NON-NLS-1$ + + if (isSecurityEnabled) { + List domainNames = StringUtil.split(domainNameOrder, ","); //$NON-NLS-1$ + Iterator domainNameItr = domainNames.iterator(); + while ( domainNameItr.hasNext() ) { + String domainName = ((String) domainNameItr.next()).trim(); + this.securityDomains.addLast(domainName); + } + } } @Override Modified: branches/JCA/runtime/src/main/java/org/teiid/transport/AdminAuthorizationInterceptor.java =================================================================== --- branches/JCA/runtime/src/main/java/org/teiid/transport/AdminAuthorizationInterceptor.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/org/teiid/transport/AdminAuthorizationInterceptor.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -105,7 +105,7 @@ break; } - if (authAdmin.isCallerInRole(adminToken, requiredRoleName)) { + if (authAdmin.isCallerInRole(requiredRoleName)) { authorized = true; break; } Modified: branches/JCA/runtime/src/main/java/org/teiid/transport/LogonImpl.java =================================================================== --- branches/JCA/runtime/src/main/java/org/teiid/transport/LogonImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/org/teiid/transport/LogonImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -24,13 +24,14 @@ import java.util.Properties; +import javax.security.auth.login.LoginException; + import org.teiid.dqp.internal.process.DQPWorkContext; import com.metamatrix.admin.api.exception.security.InvalidSessionException; import com.metamatrix.api.exception.ComponentNotFoundException; import com.metamatrix.api.exception.MetaMatrixComponentException; import com.metamatrix.api.exception.security.LogonException; -import com.metamatrix.api.exception.security.MetaMatrixAuthenticationException; import com.metamatrix.api.exception.security.SessionServiceException; import com.metamatrix.common.api.MMURL; import com.metamatrix.common.log.LogManager; @@ -74,8 +75,8 @@ MetaMatrixSessionID sessionID = updateDQPContext(sessionInfo); LogManager.logDetail(LogConstants.CTX_SESSION, new Object[] {"Logon successful for \"", user, "\" - created SessionID \"", "" + sessionID, "\"" }); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ //$NON-NLS-4$ return new LogonResult(sessionInfo.getSessionToken(), sessionInfo.getProductInfo(), clusterName); - } catch (MetaMatrixAuthenticationException e) { - throw new LogonException(e, e.getMessage()); + } catch (LoginException e) { + throw new LogonException(e.getMessage()); } catch (SessionServiceException e) { throw new LogonException(e, e.getMessage()); } @@ -88,6 +89,11 @@ workContext.setAppName(sessionInfo.getApplicationName()); workContext.setVdbName(sessionInfo.getProductInfo(ProductInfoConstants.VIRTUAL_DB)); workContext.setVdbVersion(sessionInfo.getProductInfo(ProductInfoConstants.VDB_VERSION)); + if (sessionInfo.getLoginContext() != null) { + workContext.setSubject(sessionInfo.getLoginContext().getSubject()); + workContext.setSecurityDomain(sessionInfo.getSecurityDomain()); + workContext.setSecurityContext(sessionInfo.getSecurityContext()); + } return sessionID; } Modified: branches/JCA/runtime/src/main/java/org/teiid/transport/ServerWorkItem.java =================================================================== --- branches/JCA/runtime/src/main/java/org/teiid/transport/ServerWorkItem.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/org/teiid/transport/ServerWorkItem.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -97,7 +97,6 @@ Method m = helper.findBestMethodOnTarget(serviceStruct.methodName, serviceStruct.args); Object methodResult; try { - System.out.println("Server Work: executing-\""+m.getName() + "\" on "+instance.getClass()); methodResult = m.invoke(instance, serviceStruct.args); } catch (InvocationTargetException e) { throw e.getCause(); Modified: branches/JCA/runtime/src/main/java/org/teiid/transport/SocketClientInstance.java =================================================================== --- branches/JCA/runtime/src/main/java/org/teiid/transport/SocketClientInstance.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/main/java/org/teiid/transport/SocketClientInstance.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -145,7 +145,6 @@ if (LogManager.isMessageToBeRecorded(LogConstants.CTX_SERVER, MessageLevel.DETAIL)) { LogManager.logDetail(LogConstants.CTX_SERVER, "processing message:" + packet); //$NON-NLS-1$ } - System.out.println("processing message:" + packet.getContents()); workerPool.execute(new ServerWorkItem(this, packet.getMessageKey(), packet, this.server, this.sessionService)); } Deleted: branches/JCA/runtime/src/test/java/com/metamatrix/dqp/embedded/services/TestEmbeddedDataService.java =================================================================== --- branches/JCA/runtime/src/test/java/com/metamatrix/dqp/embedded/services/TestEmbeddedDataService.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/com/metamatrix/dqp/embedded/services/TestEmbeddedDataService.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,64 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.dqp.embedded.services; - -import java.util.Properties; - -import junit.framework.TestCase; - -import com.metamatrix.common.application.ApplicationEnvironment; -import com.metamatrix.core.util.UnitTestUtil; -import com.metamatrix.dqp.embedded.DQPEmbeddedProperties; -import com.metamatrix.dqp.embedded.EmbeddedTestUtil; -import com.metamatrix.dqp.service.DQPServiceNames; - - -/** - * @since 4.3 - */ -public class TestEmbeddedDataService extends TestCase { - EmbeddedConfigurationService configService = null; - EmbeddedDataService dataService = null; - - protected void setUp() throws Exception { - ApplicationEnvironment registry = new ApplicationEnvironment(); - configService = new EmbeddedConfigurationService(); - registry.bindService(DQPServiceNames.CONFIGURATION_SERVICE, configService); - dataService = new EmbeddedDataService(); - registry.bindService(DQPServiceNames.DATA_SERVICE, dataService); - configService.start(registry); - } - - protected void tearDown() throws Exception { - configService.stop(); - } - - public void testSelectConnector() throws Exception { - Properties p = EmbeddedTestUtil.getProperties(UnitTestUtil.getTestDataPath()+"/dqp/dqp.properties"); //$NON-NLS-1$ - p.setProperty(DQPEmbeddedProperties.DQP_WORKDIR, System.getProperty("java.io.tmpdir")+"/teiid/1"); //$NON-NLS-1$ //$NON-NLS-2$ - p.setProperty(DQPEmbeddedProperties.DQP_DEPLOYDIR, System.getProperty("java.io.tmpdir")+"/teiid/deploy"); //$NON-NLS-1$ //$NON-NLS-2$ - configService.setUserPreferences(p); - configService.initializeService(p); - - } -} Modified: branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/TestAdminAuthInterceptor.java =================================================================== --- branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/TestAdminAuthInterceptor.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/TestAdminAuthInterceptor.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -73,7 +73,7 @@ private <T> T getTestServerAdmin(final Set<String> userRoles, Class<T> iface, T impl) { AuthorizationService service = Mockito.mock(AuthorizationService.class); try { - Mockito.stub(service.isCallerInRole((SessionToken)Mockito.anyObject(), Mockito.argThat(new BaseMatcher<String>() { + Mockito.stub(service.isCallerInRole(Mockito.argThat(new BaseMatcher<String>() { @Override public boolean matches(Object arg0) { return userRoles.contains(arg0); Modified: branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/service/TestMembershipServiceImpl.java =================================================================== --- branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/service/TestMembershipServiceImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/service/TestMembershipServiceImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -22,56 +22,22 @@ package com.metamatrix.platform.security.membership.service; -import java.net.Inet4Address; -import java.net.InetAddress; -import java.util.Properties; -import java.util.regex.Pattern; +import java.util.ArrayList; +import java.util.List; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.login.LoginContext; +import javax.security.auth.login.LoginException; + import junit.framework.TestCase; -import org.teiid.dqp.internal.process.DQPWorkContext; +import org.mockito.Mockito; -import com.metamatrix.api.exception.security.InvalidPrincipalException; -import com.metamatrix.common.util.crypto.CryptoUtil; import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.MetaMatrixPrincipal; -import com.metamatrix.platform.security.api.MetaMatrixPrincipalName; -import com.metamatrix.platform.security.api.service.AuthenticationToken; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; -import com.metamatrix.platform.security.membership.spi.MembershipSourceException; -import com.metamatrix.platform.security.membership.spi.file.TestFileMembershipDomain; public class TestMembershipServiceImpl extends TestCase { - public void testInitialization() throws Exception { - Properties p = new Properties(); - p.setProperty(MembershipServiceInterface.ADMIN_USERNAME, "metamatrixadmin"); //$NON-NLS-1$ - p.setProperty(MembershipServiceInterface.ADMIN_PASSWORD, CryptoUtil.getCryptor().encrypt("mm")); //$NON-NLS-1$ - p.setProperty(MembershipServiceInterface.SECURITY_ENABLED, Boolean.TRUE.toString()); - MembershipServiceImpl membershipServiceImpl = new MembershipServiceImpl(null, null); - - membershipServiceImpl.initialize(p); - - assertEquals(0, membershipServiceImpl.getDomains().size()); - assertTrue(membershipServiceImpl.isSecurityEnabled()); - } - - public void testInitialization1() throws Exception { - Properties p = new Properties(); - p.setProperty(MembershipServiceInterface.ADMIN_USERNAME, "metamatrixadmin"); //$NON-NLS-1$ - p.setProperty(MembershipServiceInterface.ADMIN_PASSWORD, CryptoUtil.getCryptor().encrypt("mm")); //$NON-NLS-1$ - p.setProperty(MembershipServiceInterface.SECURITY_ENABLED, Boolean.FALSE.toString()); - MembershipServiceImpl membershipServiceImpl = new MembershipServiceImpl(null,null); - - membershipServiceImpl.initialize(p); - - assertEquals(0, membershipServiceImpl.getDomains().size()); - assertFalse(membershipServiceImpl.isSecurityEnabled()); - - assertTrue(membershipServiceImpl.authenticateUser("foo", new Credentials("bar".toCharArray()), null) instanceof SuccessfulAuthenticationToken); //$NON-NLS-1$ //$NON-NLS-2$ - } - + public void testBaseUsername() throws Exception { assertEquals(&quot;foo(a)bar.com&quot;, MembershipServiceImpl.getBaseUsername(&quot;foo\\@bar.com(a)foo&quot;)); //$NON-NLS-1$ //$NON-NLS-2$ @@ -84,66 +50,26 @@ } private MembershipServiceImpl createMembershipService() throws Exception { - MembershipServiceImpl membershipService = new MembershipServiceImpl(null, InetAddress.getLocalHost()); - MembershipServiceImpl.MembershipDomainHolder membershipDomainHolder = new MembershipServiceImpl.MembershipDomainHolder( - TestFileMembershipDomain - .createFileMembershipDomain(), - TestFileMembershipDomain.TEST_DOMAIN_NAME); - membershipService.getDomains().add(membershipDomainHolder); + MembershipServiceImpl membershipService = new MembershipServiceImpl() { + public LoginContext createLoginContext(String domain, CallbackHandler handler) throws LoginException { + LoginContext context = Mockito.mock(LoginContext.class); + return context; + } + }; return membershipService; } - public void testSuperAuthenticate() throws Exception { - MembershipServiceImpl membershipService = createMembershipService(); - membershipService.setAllowedAddresses(Pattern.compile("192[.]168[.]0[.]2")); //$NON-NLS-1$ - membershipService.setAdminCredentials("pass1"); //$NON-NLS-1$ - - AuthenticationToken at = membershipService.authenticateUser(MembershipServiceImpl.DEFAULT_ADMIN_USERNAME, new Credentials("pass1".toCharArray()), null); //$NON-NLS-1$ - - assertFalse(at.isAuthenticated()); - DQPWorkContext.getWorkContext().setClientAddress("192.168.0.1"); //$NON-NLS-1$ - at = membershipService.authenticateUser(MembershipServiceImpl.DEFAULT_ADMIN_USERNAME, new Credentials("pass1".toCharArray()), null); //$NON-NLS-1$ - - assertFalse(at.isAuthenticated()); - DQPWorkContext.getWorkContext().setClientAddress("192.168.0.2"); //$NON-NLS-1$ - at = membershipService.authenticateUser(MembershipServiceImpl.DEFAULT_ADMIN_USERNAME, new Credentials("pass1".toCharArray()), null); //$NON-NLS-1$ - - assertTrue(at.isAuthenticated()); - } - - public void testGetPrincipal() throws Exception { - MembershipServiceImpl membershipService = createMembershipService(); - - MetaMatrixPrincipal principal = membershipService.getPrincipal(new MetaMatrixPrincipalName("user1@testFile", MetaMatrixPrincipal.TYPE_USER)); //$NON-NLS-1$ - - assertEquals("user1@testFile", principal.getName()); //$NON-NLS-1$ - } - + public void testAuthenticate() throws Exception { - MembershipServiceImpl membershipService = createMembershipService(); + MembershipServiceImpl ms = createMembershipService(); + List<String> domains = new ArrayList<String>(); + domains.add("testFile"); + ms.authenticateUser("user1", new Credentials("pass1".toCharArray()), null, domains); //$NON-NLS-1$ //$NON-NLS-2$ - AuthenticationToken at = membershipService.authenticateUser("user1", new Credentials("pass1".toCharArray()), null); //$NON-NLS-1$ //$NON-NLS-2$ + Mockito.verify(ms.getLoginContext()).login(); - assertEquals("user1@testFile", at.getUserName()); //$NON-NLS-1$ + assertEquals("user1@testFile", ms.getUserName()); //$NON-NLS-1$ } - public void testGetPrincipalForGroup() throws Exception { - MembershipServiceImpl membershipService = createMembershipService(); - - MetaMatrixPrincipal principal = membershipService.getPrincipal(new MetaMatrixPrincipalName("group1@testFile", MetaMatrixPrincipal.TYPE_GROUP)); //$NON-NLS-1$ - - assertEquals("group1@testFile", principal.getName()); //$NON-NLS-1$ - assertEquals(MetaMatrixPrincipal.TYPE_GROUP, principal.getType()); - } - public void testGetPrincipalForInvalidGroup() throws Exception { - MembershipServiceImpl membershipService = createMembershipService(); - - try { - membershipService.getPrincipal(new MetaMatrixPrincipalName("groupX@testFile", MetaMatrixPrincipal.TYPE_GROUP)); //$NON-NLS-1$ - } catch (InvalidPrincipalException e) { - assertEquals("The principal 'groupX@testFile' does not exist in domain 'testFile'", e.getMessage()); //$NON-NLS-1$ - } - } - } Deleted: branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/file/TestFileMembershipDomain.java =================================================================== --- branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/file/TestFileMembershipDomain.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/file/TestFileMembershipDomain.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,308 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.membership.spi.file; - -import java.io.File; -import java.util.Arrays; -import java.util.HashSet; -import java.util.Properties; -import java.util.Set; - -import junit.framework.TestCase; - -import com.metamatrix.api.exception.security.InvalidUserException; -import com.metamatrix.api.exception.security.LogonException; -import com.metamatrix.api.exception.security.UnsupportedCredentialException; -import com.metamatrix.core.util.UnitTestUtil; -import com.metamatrix.platform.security.api.Credentials; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; -import com.metamatrix.platform.security.membership.spi.MembershipSourceException; - -public class TestFileMembershipDomain extends TestCase { - - public static final String TEST_DOMAIN_NAME = "testFile"; //$NON-NLS-1$ - - /** - * testInvalidInit1 - tests invalid init - no properties supplied. - */ - public void testInvalidInit1() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertEquals("Required property usersFile was missing.", e.getMessage()); //$NON-NLS-1$ - } - } - - /** - * testInvalidInit2 - tests invalid init - only users file supplied - */ - public void testInvalidInit2() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - File usersFile = UnitTestUtil.getTestDataFile("users.properties"); //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.USERS_FILE, usersFile.getAbsolutePath()); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertEquals("Required property groupsFile was missing.", e.getMessage()); //$NON-NLS-1$ - } - } - - /** - * testInvalidInit3 - tests invalid init - only groups file supplied - */ - public void testInvalidInit3() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - File groupsFile = UnitTestUtil.getTestDataFile("groups.properties"); //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.GROUPS_FILE, groupsFile.getAbsolutePath()); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertEquals("Required property usersFile was missing.", e.getMessage()); //$NON-NLS-1$ - } - } - - /** - * testBadUsersFile - tests invalid init - bad usersfile supplied - */ - public void testBadUsersFile() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - File usersFile = UnitTestUtil.getTestDataFile("ohCrap"); //$NON-NLS-1$ - File groupsFile = UnitTestUtil.getTestDataFile("groups.properties"); //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.USERS_FILE, usersFile.getAbsolutePath()); - p.setProperty(FileMembershipDomain.GROUPS_FILE, groupsFile.getAbsolutePath()); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertTrue(e.getMessage().startsWith("Could not load file")); //$NON-NLS-1$ - } - } - - /** - * testBadGroupsFile - tests invalid init - bad groupsfile supplied - */ - public void testBadGroupsFile() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - File usersFile = UnitTestUtil.getTestDataFile("users.properties"); //$NON-NLS-1$ - File groupsFile = UnitTestUtil.getTestDataFile("bad"); //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.USERS_FILE, usersFile.getAbsolutePath()); - p.setProperty(FileMembershipDomain.GROUPS_FILE, groupsFile.getAbsolutePath()); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertTrue(e.getMessage().startsWith("Could not load file")); //$NON-NLS-1$ - } - } - - /** - * testValidInit - tests valid init - good files - */ - public void testValidInit() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - File usersFile = UnitTestUtil.getTestDataFile("users.properties"); //$NON-NLS-1$ - File groupsFile = UnitTestUtil.getTestDataFile("groups.properties"); //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.USERS_FILE, usersFile.getAbsolutePath()); - p.setProperty(FileMembershipDomain.GROUPS_FILE, groupsFile.getAbsolutePath()); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - } catch (MembershipSourceException e) { - fail("unexpected exception"); //$NON-NLS-1$ - } - } - - - - public void testInValidUserAuthentication() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - try { - domain.authenticateUser("user1", null, null); //$NON-NLS-1$ - fail("Expected exception"); //$NON-NLS-1$ - } catch (UnsupportedCredentialException uce) { - //expected - } - } - - - public static FileMembershipDomain createFileMembershipDomain() throws MembershipSourceException { - return createFileMembershipDomain(true); - } - - public static FileMembershipDomain createFileMembershipDomain(boolean checkPassword) throws MembershipSourceException { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - File usersFile = UnitTestUtil.getTestDataFile("users.properties"); //$NON-NLS-1$ - File groupsFile = UnitTestUtil.getTestDataFile("groups.properties"); //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.USERS_FILE, usersFile.getAbsolutePath()); - p.setProperty(FileMembershipDomain.GROUPS_FILE, groupsFile.getAbsolutePath()); - p.setProperty(FileMembershipDomain.CHECK_PASSWORD, Boolean.toString(checkPassword)); - p.setProperty(MembershipServiceInterface.DOMAIN_NAME, TEST_DOMAIN_NAME); - - domain.initialize(p); - return domain; - } - - /** - * testInvalidUserAuthentication - tests invalid user - */ - public void testInvalidUserAuthentication() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - try { - domain.authenticateUser("joe", new Credentials("pass1".toCharArray()), null); //$NON-NLS-1$ //$NON-NLS-2$ - fail("expected exception"); //$NON-NLS-1$ - } catch (InvalidUserException e) { - assertEquals(e.getMessage(),"user joe is invalid"); //$NON-NLS-1$ - } - } - - /** - * testInvalidPasswordAuthentication - tests invalid password - */ - public void testInvalidPasswordAuthentication() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - try { - domain.authenticateUser("user1", new Credentials("pass2".toCharArray()), null); //$NON-NLS-1$ //$NON-NLS-2$ - fail("expected exception"); //$NON-NLS-1$ - } catch (LogonException e) { - assertEquals(e.getMessage(),"user user1 could not be authenticated"); //$NON-NLS-1$ - } - } - - /** - * testInvalidUserWithCheckingFalse - tests invalid user with checking turned off - */ - public void testInvalidUserWithCheckingFalse() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - try { - domain.authenticateUser("joe", new Credentials("pass1".toCharArray()), null); //$NON-NLS-1$ //$NON-NLS-2$ - fail("expected exception"); //$NON-NLS-1$ - } catch (InvalidUserException e) { - assertEquals(e.getMessage(),"user joe is invalid"); //$NON-NLS-1$ - } - } - - - /** - * testGetGroupNames - tests get groupNames. - */ - public void testGetGroupNames() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - Set groupNames = domain.getGroupNames(); - - assertEquals(new HashSet(Arrays.asList(new Object[] {"group1", "group2", "group3"})), groupNames); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - - } - - /** - * testGetGroupNamesForUser - tests get groupNames for a user. - */ - public void testGetGroupNamesForUser() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - Set groupNames = domain.getGroupNamesForUser("user2"); //$NON-NLS-1$ - - assertEquals(new HashSet(Arrays.asList(new Object[] {"group1", "group2"})), groupNames); //$NON-NLS-1$ //$NON-NLS-2$ - - } - - /** - * testGetGroupNamesForUser - tests get groupNames for an invalid user. - */ - public void testGetGroupNamesForInvalidUser() throws Exception { - FileMembershipDomain domain = createFileMembershipDomain(); - - try { - domain.getGroupNamesForUser("markyMark"); //$NON-NLS-1$ - fail("expected exception"); //$NON-NLS-1$ - } catch (Exception e) { - assertTrue(e instanceof InvalidUserException); - } - - } - - public void testInitializeWithClasspathFiles() throws Exception { - FileMembershipDomain domain = new FileMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - String usersFile = "classpath:users.properties"; //$NON-NLS-1$ - String groupsFile = "classpath:groups.properties"; //$NON-NLS-1$ - - p.setProperty(FileMembershipDomain.USERS_FILE, usersFile); - p.setProperty(FileMembershipDomain.GROUPS_FILE, groupsFile); - p.setProperty(MembershipServiceInterface.DOMAIN_NAME, TEST_DOMAIN_NAME); - - domain.initialize(p); - - assertEquals(3, domain.getUsers().size()); - } - -} Deleted: branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/ldap/TestLDAPMembershipDomainConfiguration.java =================================================================== --- branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/ldap/TestLDAPMembershipDomainConfiguration.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/membership/spi/ldap/TestLDAPMembershipDomainConfiguration.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,157 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * See the COPYRIGHT.txt file distributed with this work for information - * regarding copyright ownership. Some portions may be licensed - * to Red Hat, Inc. under one or more contributor license agreements. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301 USA. - */ - -package com.metamatrix.platform.security.membership.spi.ldap; - -import java.util.Properties; - -import junit.framework.TestCase; - -import com.metamatrix.common.application.exception.ApplicationInitializationException; -import com.metamatrix.platform.security.membership.service.MembershipServiceImpl; -import com.metamatrix.platform.security.membership.spi.MembershipSourceException; -import com.metamatrix.platform.security.membership.spi.ldap.LDAPMembershipDomain.LdapContext; - -public class TestLDAPMembershipDomainConfiguration extends TestCase { - - private LDAPMembershipDomain getLdapMembershipDomainWithMultipleContexts() throws MembershipSourceException { - LDAPMembershipDomain domain = new LDAPMembershipDomain(); - - Properties p = new Properties(); - //ldap url, usersRootContext, groupsRootContext - p.setProperty(LDAPMembershipDomain.LDAP_URL, "ldap://sluxtech09:389"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.USERS_ROOT_CONTEXT, "ou=people,dc=metamatrix,dc=com?ou=people,dc=quadrian,dc=com"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.GROUPS_ROOT_CONTEXT, "ou=groups,dc=metamatrix,dc=com?ou=groups,dc=quadrian,dc=com"); //$NON-NLS-1$ - - //properties for Apache DS - p.setProperty(LDAPMembershipDomain.GROUPS_GROUP_MEMBER_ATTRIBUTE, "uniquemember"); //$NON-NLS-1$ - - //credentials - p.setProperty(LDAPMembershipDomain.LDAP_ADMIN_DN, "cn=Directory Manager"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.LDAP_ADMIN_PASSWORD, "stladmin"); //$NON-NLS-1$ - p.setProperty(MembershipServiceImpl.DOMAIN_NAME, "testDomain"); //$NON-NLS-1$ - - - domain.initialize(p); - return domain; - } - - /** - * testInvalidInit1 - tests invalid init - no properties supplied. - */ - public void testInvalidInit1() throws Exception { - LDAPMembershipDomain domain = new LDAPMembershipDomain(); - - // Empty properties - Properties p = new Properties(); - - // Initialize the domain with empty properties - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertEquals("Required property ldapURL was missing.", e.getMessage()); //$NON-NLS-1$ - } - } - - /** - * testInvalidInit2 - tests invalid init - only the ldap URL is supplied. - */ - public void testInvalidInit2() throws Exception { - LDAPMembershipDomain domain = new LDAPMembershipDomain(); - - // Properties containing ldap URL only - Properties p = new Properties(); - p.setProperty(LDAPMembershipDomain.LDAP_URL, "ldap://sluxtech09:389"); //$NON-NLS-1$ - - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertEquals("Required property users.rootContext was missing.", e.getMessage()); //$NON-NLS-1$ - } - } - - /** - * testInvalidInit3 - tests invalid init - ldap URL and users rootContext are supplied. - */ - public void testInvalidInit3() throws Exception { - LDAPMembershipDomain domain = new LDAPMembershipDomain(); - - Properties p = new Properties(); - p.setProperty(LDAPMembershipDomain.LDAP_URL, "ldap://sluxtech09:389"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.USERS_ROOT_CONTEXT, "ou=people,dc=metamatrix,dc=com"); //$NON-NLS-1$ - - try { - domain.initialize(p); - fail("expected exception"); //$NON-NLS-1$ - } catch (MembershipSourceException e) { - assertEquals("Required property groups.rootContext was missing.", e.getMessage()); //$NON-NLS-1$ - } - } - -// public void testInvalidInit4() throws Exception { -// LDAPMembershipDomain domain = new LDAPMembershipDomain(); -// -// Properties p = new Properties(); -// p.setProperty(LDAPMembershipDomain.LDAP_URL, "ldap://sluxtech09:389"); //$NON-NLS-1$ -// p.setProperty(LDAPMembershipDomain.USERS_ROOT_CONTEXT, "ou=people,dc=metamatrix,dc=com"); //$NON-NLS-1$ -// p.setProperty(LDAPMembershipDomain.GROUPS_ROOT_CONTEXT, "ou=groups,dc=metamatrix,dc=com"); //$NON-NLS-1$ -// -// try { -// domain.initialize(p); -// fail("expected exception"); //$NON-NLS-1$ -// } catch (ServiceStateException e) { -// assertEquals("No users will appear as members of any group since user's memberOf and group's group memberOf attributes are both unspecified.", e.getMessage()); //$NON-NLS-1$ -// } -// } - - /** - * testValidInit - tests valid init - all required properties supplied. - */ - public void testValidInit() throws Exception { - LDAPMembershipDomain domain = new LDAPMembershipDomain(); - - Properties p = new Properties(); - p.setProperty(LDAPMembershipDomain.LDAP_URL, "ldap://sluxtech09:389"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.USERS_ROOT_CONTEXT, "ou=people,dc=metamatrix,dc=com"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.GROUPS_ROOT_CONTEXT, "ou=groups,dc=metamatrix,dc=com"); //$NON-NLS-1$ - p.setProperty(LDAPMembershipDomain.USERS_MEMBER_OF_ATTRIBUTE, "memberOf"); //$NON-NLS-1$ - try { - domain.initialize(p); - } catch (MembershipSourceException e) { - fail("Encountered initialization exception"); //$NON-NLS-1$ - } - } - - public void testUsernameEscaping() { - assertEquals("\\2a", LDAPMembershipDomain.escapeLDAPSearchFilter("*")); //$NON-NLS-1$ //$NON-NLS-2$ - } - - public void testMultipleContexts() throws Exception { - LDAPMembershipDomain domain = getLdapMembershipDomainWithMultipleContexts(); - assertEquals(2, domain.getUsersRootContexts().size()); - LdapContext context = (LdapContext)domain.getUsersRootContexts().get(1); - assertEquals("ou=people,dc=quadrian,dc=com", context.context); //$NON-NLS-1$ - } - -} Modified: branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/session/service/TestSessionServiceImpl.java =================================================================== --- branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/session/service/TestSessionServiceImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/com/metamatrix/platform/security/session/service/TestSessionServiceImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -1,28 +1,49 @@ package com.metamatrix.platform.security.session.service; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.util.ArrayList; import java.util.Properties; -import junit.framework.TestCase; +import javax.security.auth.login.LoginContext; +import javax.security.auth.login.LoginException; +import org.junit.Test; import org.mockito.Mockito; import com.metamatrix.admin.api.exception.security.InvalidSessionException; +import com.metamatrix.platform.security.api.Credentials; import com.metamatrix.platform.security.api.MetaMatrixSessionID; import com.metamatrix.platform.security.api.MetaMatrixSessionInfo; -import com.metamatrix.platform.security.api.service.MembershipServiceInterface; import com.metamatrix.platform.security.api.service.SessionListener; -import com.metamatrix.platform.security.api.service.SuccessfulAuthenticationToken; +import com.metamatrix.platform.security.membership.service.MembershipServiceImpl; -public class TestSessionServiceImpl extends TestCase { +public class TestSessionServiceImpl { - public void testValidateSession() throws Exception { - SessionServiceImpl ssi = new SessionServiceImpl(); - MembershipServiceInterface msi = Mockito.mock(MembershipServiceInterface.class); - Mockito.stub(msi.authenticateUser("steve", null, "foo")).toReturn(new SuccessfulAuthenticationToken("steve@somedomain")); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$ - ssi.setMembershipService(msi); + public void validateSession(boolean securityEnabled) throws Exception { + final MembershipServiceImpl impl = Mockito.mock(MembershipServiceImpl.class); + Mockito.stub(impl.getUserName()).toReturn("steve@somedomain"); + Mockito.stub(impl.getLoginContext()).toReturn(Mockito.mock(LoginContext.class)); + final ArrayList<String> domains = new ArrayList<String>(); + domains.add("somedomain"); + + SessionServiceImpl ssi = new SessionServiceImpl() { + protected MembershipServiceImpl authenticate(String userName, Credentials credentials, String applicationName) + throws LoginException { + impl.authenticateUser(userName, credentials, applicationName, domains); + return impl; + } + }; SessionListener listener = Mockito.mock(SessionListener.class); ssi.register(listener); + Properties props = new Properties(); + if (securityEnabled) { + props.setProperty(SessionServiceImpl.SECURITY_DOMAINS, "somedomain"); + ssi.initialize(props); + } + MetaMatrixSessionID id1 = new MetaMatrixSessionID(1); try { ssi.validateSession(id1); @@ -32,6 +53,10 @@ } MetaMatrixSessionInfo info = ssi.createSession("steve", null, "foo", new Properties()); //$NON-NLS-1$ //$NON-NLS-2$ + if (securityEnabled) { + Mockito.verify(impl).authenticateUser("steve", null, "foo", domains); + } + id1 = info.getSessionID(); ssi.validateSession(id1); @@ -56,5 +81,13 @@ } Mockito.verify(listener, Mockito.times(1)).sessionClosed(info); } + + @Test public void testvalidateSession() throws Exception{ + validateSession(true); + } + @Test public void testvalidateSession2() throws Exception { + validateSession(false); + } + } Modified: branches/JCA/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java =================================================================== --- branches/JCA/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/java/org/teiid/transport/TestLogonImpl.java 2009-11-24 17:02:36 UTC (rev 1586) @@ -48,7 +48,7 @@ p.setProperty(MMURL.CONNECTION.APP_NAME, applicationName); MetaMatrixSessionInfo resultInfo = new MetaMatrixSessionInfo( - new MetaMatrixSessionID(1), userName, 0, applicationName, new Properties(), + new MetaMatrixSessionID(1), userName, null, "securitydomain", null, 0, applicationName, new Properties(), null, null); Mockito.stub(ssi.createSession(userName, null, applicationName, Modified: branches/JCA/runtime/src/test/resources/permissions.xml =================================================================== --- branches/JCA/runtime/src/test/resources/permissions.xml 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/resources/permissions.xml 2009-11-24 17:02:36 UTC (rev 1586) @@ -20,8 +20,8 @@ </permission> </permissions> <principals> - <group>group1</group> - <group>group2</group> + <role>group1</role> + <role>group2</role> </principals> </data-role> <data-role> @@ -44,7 +44,7 @@ <vdb-version>1</vdb-version> <description>I have no permissions</description> <principals> - <group>group3</group> + <role>group3</role> </principals> </data-role> </roles> Modified: branches/JCA/runtime/src/test/resources/permissions2.xml =================================================================== --- branches/JCA/runtime/src/test/resources/permissions2.xml 2009-11-23 22:55:35 UTC (rev 1585) +++ branches/JCA/runtime/src/test/resources/permissions2.xml 2009-11-24 17:02:36 UTC (rev 1586) @@ -20,8 +20,8 @@ </permission> </permissions> <principals> - <group>group1</group> - <group>group2</group> + <role>group1</role> + <role>group2</role> </principals> </data-role> <data-role>