ldapsecurity.cpp 44 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580
  1. /*##############################################################################
  2. HPCC SYSTEMS software Copyright (C) 2012 HPCC Systems®.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. ############################################################################## */
  13. #define AXA_API DECL_EXPORT
  14. #include "ldapsecurity.ipp"
  15. #include "ldapsecurity.hpp"
  16. #include "authmap.ipp"
  17. #include "digisign.hpp"
  18. /**********************************************************
  19. * CLdapSecUser *
  20. **********************************************************/
  21. CLdapSecUser::CLdapSecUser(const char *name, const char *pw) :
  22. m_pw(pw), m_authenticateStatus(AS_UNKNOWN)
  23. {
  24. setName(name);
  25. setUserID(0);
  26. setPosixenabled(false);
  27. setSudoersEnabled(false);
  28. setInSudoers(false);
  29. setSessionToken(0);
  30. setSignature(nullptr);
  31. }
  32. CLdapSecUser::~CLdapSecUser()
  33. {
  34. }
  35. //non-interfaced functions
  36. void CLdapSecUser::setUserID(unsigned userid)
  37. {
  38. m_userid = userid;
  39. }
  40. void CLdapSecUser::setUserSid(int sidlen, const char* sid)
  41. {
  42. m_usersid.clear();
  43. m_usersid.append(sidlen, sid);
  44. }
  45. MemoryBuffer& CLdapSecUser::getUserSid()
  46. {
  47. return m_usersid;
  48. }
  49. //interface ISecUser
  50. const char * CLdapSecUser::getName()
  51. {
  52. return m_name.get();
  53. }
  54. bool CLdapSecUser::setName(const char * name)
  55. {
  56. if(name != NULL)
  57. {
  58. const char* atsign = strchr(name, '@');
  59. if(atsign != NULL)
  60. {
  61. m_name.set(name, atsign - name);
  62. m_realm.set(atsign + 1);
  63. }
  64. else
  65. {
  66. m_name.set(name);
  67. }
  68. }
  69. return TRUE;
  70. }
  71. const char * CLdapSecUser::getFullName()
  72. {
  73. return m_fullname.get();
  74. }
  75. bool CLdapSecUser::setFullName(const char * name)
  76. {
  77. if(name != NULL)
  78. {
  79. m_fullname.set(name);
  80. }
  81. return true;
  82. }
  83. const char * CLdapSecUser::getFirstName()
  84. {
  85. return m_firstname.get();
  86. }
  87. bool CLdapSecUser::setFirstName(const char * fname)
  88. {
  89. if(fname != NULL)
  90. {
  91. m_firstname.set(fname);
  92. }
  93. return true;
  94. }
  95. const char * CLdapSecUser::getLastName()
  96. {
  97. return m_lastname.get();
  98. }
  99. bool CLdapSecUser::setLastName(const char * lname)
  100. {
  101. if(lname != NULL)
  102. {
  103. m_lastname.set(lname);
  104. }
  105. return true;
  106. }
  107. const char * CLdapSecUser::getEmployeeID()
  108. {
  109. return m_employeeID.get();
  110. }
  111. bool CLdapSecUser::setEmployeeID(const char * emplID)
  112. {
  113. m_employeeID.set(emplID);
  114. return true;
  115. }
  116. const char * CLdapSecUser::getDistinguishedName()
  117. {
  118. return m_distinguishedName.get();
  119. }
  120. bool CLdapSecUser::setDistinguishedName(const char * dn)
  121. {
  122. m_distinguishedName.set(dn);
  123. return true;
  124. }
  125. const char * CLdapSecUser::getRealm()
  126. {
  127. return m_realm.get();
  128. }
  129. bool CLdapSecUser::setRealm(const char * name)
  130. {
  131. m_realm.set(name);
  132. return TRUE;
  133. }
  134. const char * CLdapSecUser::getFqdn()
  135. {
  136. return m_Fqdn.get();
  137. }
  138. bool CLdapSecUser::setFqdn(const char * Fqdn)
  139. {
  140. m_Fqdn.set(Fqdn);
  141. return true;
  142. }
  143. const char *CLdapSecUser::getPeer()
  144. {
  145. return m_Peer.get();
  146. }
  147. bool CLdapSecUser::setPeer(const char *Peer)
  148. {
  149. m_Peer.set(Peer);
  150. return true;
  151. }
  152. ISecCredentials & CLdapSecUser::credentials()
  153. {
  154. return *this;
  155. }
  156. unsigned CLdapSecUser::getUserID()
  157. {
  158. return m_userid;
  159. }
  160. //interface ISecCredentials
  161. bool CLdapSecUser::setPassword(const char * pw)
  162. {
  163. m_pw.set(pw);
  164. return TRUE;
  165. }
  166. const char* CLdapSecUser::getPassword()
  167. {
  168. return m_pw;
  169. }
  170. bool CLdapSecUser::setEncodedPassword(SecPasswordEncoding enc, void * pw, unsigned length, void * salt, unsigned saltlen)
  171. {
  172. return FALSE; //not supported yet
  173. }
  174. void CLdapSecUser::setSessionToken(unsigned token)
  175. {
  176. m_sessionToken = token;
  177. }
  178. unsigned CLdapSecUser::getSessionToken()
  179. {
  180. return m_sessionToken;
  181. }
  182. void CLdapSecUser::setSignature(const char * signature)
  183. {
  184. m_signature.clear().append(signature);
  185. }
  186. const char * CLdapSecUser::getSignature()
  187. {
  188. return m_signature.str();
  189. }
  190. void CLdapSecUser::copyTo(ISecUser& destination)
  191. {
  192. if (this == &destination)
  193. return;
  194. CLdapSecUser* dest = dynamic_cast<CLdapSecUser*>(&destination);
  195. if(!dest)
  196. return;
  197. dest->setAuthenticateStatus(getAuthenticateStatus());
  198. dest->setName(getName());
  199. dest->setFullName(getFullName());
  200. dest->setFirstName(getFirstName());
  201. dest->setLastName(getLastName());
  202. dest->setEmployeeID(getEmployeeID());
  203. dest->setRealm(getRealm());
  204. dest->credentials().setPassword(credentials().getPassword());
  205. dest->setUserSid(m_usersid.length(), m_usersid.toByteArray());
  206. dest->setUserID(m_userid);
  207. dest->setPasswordExpiration(m_passwordExpiration);
  208. dest->setDistinguishedName(m_distinguishedName);
  209. dest->credentials().setSessionToken(m_sessionToken);
  210. dest->credentials().setSignature(m_signature.str());
  211. }
  212. ISecUser * CLdapSecUser::clone()
  213. {
  214. CLdapSecUser* newuser = new CLdapSecUser(m_name.get(), m_pw.get());
  215. if(newuser)
  216. copyTo(*newuser);
  217. return newuser;
  218. }
  219. /**********************************************************
  220. * CLdapSecResource *
  221. **********************************************************/
  222. CLdapSecResource::CLdapSecResource(const char *name) : m_name(name), m_access(SecAccess_None), m_required_access(SecAccess_None)
  223. {
  224. m_resourcetype = RT_DEFAULT;
  225. }
  226. void CLdapSecResource::addAccess(SecAccessFlags flags)
  227. {
  228. m_access = (SecAccessFlags)((int)m_access | (int)flags);
  229. }
  230. void CLdapSecResource::setAccessFlags(SecAccessFlags flags)
  231. {
  232. m_access = flags;
  233. }
  234. void CLdapSecResource::setRequiredAccessFlags(SecAccessFlags flags)
  235. {
  236. m_required_access = flags;
  237. }
  238. SecAccessFlags CLdapSecResource::getRequiredAccessFlags()
  239. {
  240. return m_required_access;
  241. }
  242. //interface ISecResource : extends IInterface
  243. const char * CLdapSecResource::getName()
  244. {
  245. return m_name.get();
  246. }
  247. SecAccessFlags CLdapSecResource::getAccessFlags()
  248. {
  249. return m_access;
  250. }
  251. int CLdapSecResource::addParameter(const char* name, const char* value)
  252. {
  253. if (!m_parameters)
  254. m_parameters.setown(createProperties(false));
  255. m_parameters->setProp(name, value);
  256. return 0;
  257. }
  258. const char * CLdapSecResource::getParameter(const char * name)
  259. {
  260. if (m_parameters)
  261. {
  262. const char *value = m_parameters->queryProp(name);
  263. return value;
  264. }
  265. return NULL;
  266. }
  267. void CLdapSecResource::setDescription(const char* description)
  268. {
  269. m_description.clear().append(description);
  270. }
  271. const char* CLdapSecResource::getDescription()
  272. {
  273. return m_description.str();
  274. }
  275. void CLdapSecResource::setValue(const char* value)
  276. {
  277. m_value.clear();
  278. m_value.append(value);
  279. }
  280. const char* CLdapSecResource::getValue()
  281. {
  282. return m_value.str();
  283. }
  284. ISecResource * CLdapSecResource::clone()
  285. {
  286. CLdapSecResource* _res = new CLdapSecResource(m_name.get());
  287. if(!_res)
  288. return NULL;
  289. _res->setResourceType(m_resourcetype);
  290. _res->setValue(m_value.str());
  291. _res->m_access = m_access;
  292. _res->m_required_access = m_required_access;
  293. _res->setDescription(m_description.str());
  294. if(!m_parameters)
  295. return _res;
  296. Owned<IPropertyIterator> Itr = m_parameters->getIterator();
  297. Itr->first();
  298. while(Itr->isValid())
  299. {
  300. _res->addParameter(Itr->getPropKey(),m_parameters->queryProp(Itr->getPropKey()));
  301. Itr->next();
  302. }
  303. return _res;
  304. }
  305. void CLdapSecResource::copy(ISecResource* from)
  306. {
  307. if(!from)
  308. return;
  309. CLdapSecResource* ldapfrom = dynamic_cast<CLdapSecResource*>(from);
  310. if(!ldapfrom)
  311. return;
  312. m_access = ldapfrom->m_access;
  313. setDescription(ldapfrom->m_description.str());
  314. if(m_parameters.get())
  315. {
  316. m_parameters.clear();
  317. }
  318. if(!ldapfrom->m_parameters.get())
  319. return;
  320. Owned<IPropertyIterator> Itr = ldapfrom->m_parameters->getIterator();
  321. Itr->first();
  322. while(Itr->isValid())
  323. {
  324. addParameter(Itr->getPropKey(), ldapfrom->m_parameters->queryProp(Itr->getPropKey()));
  325. Itr->next();
  326. }
  327. return;
  328. }
  329. SecResourceType CLdapSecResource::getResourceType()
  330. {
  331. return m_resourcetype;
  332. }
  333. void CLdapSecResource::setResourceType(SecResourceType resourcetype)
  334. {
  335. m_resourcetype = resourcetype;
  336. }
  337. /**********************************************************
  338. * CLdapSecResourceList *
  339. **********************************************************/
  340. CLdapSecResourceList::CLdapSecResourceList(const char *name) : m_complete(0)
  341. {
  342. m_name.set(name);
  343. }
  344. void CLdapSecResourceList::setAuthorizationComplete(bool value)
  345. {
  346. m_complete=value;
  347. }
  348. IArrayOf<ISecResource>& CLdapSecResourceList::getResourceList()
  349. {
  350. return m_rlist;
  351. }
  352. //interface ISecResourceList : extends IInterface
  353. bool CLdapSecResourceList::isAuthorizationComplete()
  354. {
  355. return m_complete;
  356. }
  357. ISecResourceList * CLdapSecResourceList::clone()
  358. {
  359. CLdapSecResourceList* _newList = new CLdapSecResourceList(m_name.get());
  360. if(!_newList)
  361. return NULL;
  362. copyTo(*_newList);
  363. return _newList;
  364. }
  365. bool CLdapSecResourceList::copyTo(ISecResourceList& destination)
  366. {
  367. ForEachItemIn(x, m_rlist)
  368. {
  369. CLdapSecResource* res = (CLdapSecResource*)(&(m_rlist.item(x)));
  370. if(res)
  371. destination.addResource(res->clone());
  372. }
  373. return false;
  374. }
  375. ISecResource* CLdapSecResourceList::addResource(const char * name)
  376. {
  377. if(!name || !*name)
  378. {
  379. DBGLOG("CLdapSecResourceList::addResource resource name must be provided");
  380. return NULL;
  381. }
  382. ISecResource* resource = m_rmap[name];
  383. if(resource == NULL)
  384. {
  385. resource = new CLdapSecResource(name);
  386. m_rlist.append(*resource);
  387. m_rmap[name] = resource;
  388. }
  389. return resource;
  390. }
  391. void CLdapSecResourceList::addResource(ISecResource * resource)
  392. {
  393. if(resource == NULL)
  394. {
  395. DBGLOG("CLdapSecResourceList::addResource2 ISecResource cannot be NULL");
  396. return;
  397. }
  398. const char* name = resource->getName();
  399. if(!name || !*name)
  400. {
  401. DBGLOG("CLdapSecResourceList::addResource2 resource name must be provided");
  402. return;
  403. }
  404. ISecResource* r = m_rmap[name];
  405. if(r == NULL)
  406. {
  407. m_rlist.append(*resource);
  408. m_rmap[name] = resource;
  409. }
  410. }
  411. bool CLdapSecResourceList::addCustomResource(const char * name, const char * config)
  412. {
  413. return false;
  414. }
  415. ISecResource * CLdapSecResourceList::getResource(const char * Resource)
  416. {
  417. if(!Resource || !*Resource)
  418. {
  419. DBGLOG("CLdapSecResourceList::getResource resource name must be provided");
  420. return NULL;
  421. }
  422. ISecResource* r = m_rmap[Resource];
  423. if(r)
  424. return LINK(r);
  425. else
  426. return NULL;
  427. }
  428. void CLdapSecResourceList::clear()
  429. {
  430. m_rlist.kill();
  431. }
  432. int CLdapSecResourceList::count()
  433. {
  434. return m_rlist.length();
  435. }
  436. const char* CLdapSecResourceList::getName()
  437. {
  438. return m_name.get();
  439. }
  440. ISecResource * CLdapSecResourceList::queryResource(unsigned seq)
  441. {
  442. if(seq < m_rlist.length())
  443. return &(m_rlist.item(seq));
  444. else
  445. return NULL;
  446. }
  447. ISecPropertyIterator * CLdapSecResourceList::getPropertyItr()
  448. {
  449. return new ArrayIIteratorOf<IArrayOf<struct ISecResource>, ISecProperty, ISecPropertyIterator>(m_rlist);
  450. }
  451. ISecProperty* CLdapSecResourceList::findProperty(const char* name)
  452. {
  453. if(!name || !*name)
  454. {
  455. DBGLOG("CLdapSecResourceList::findProperty property name must be provided");
  456. return NULL;
  457. }
  458. return m_rmap[name];
  459. }
  460. /**********************************************************
  461. * CLdapSecManager *
  462. **********************************************************/
  463. CLdapSecManager::CLdapSecManager(const char *serviceName, const char *config)
  464. {
  465. IPropertyTree* cfg = createPTreeFromXMLString(config, ipt_caseInsensitive);
  466. if(cfg == NULL)
  467. {
  468. throw MakeStringException(-1, "createPTreeFromXMLString() failed for %s", config);
  469. }
  470. init(serviceName, cfg);
  471. }
  472. void CLdapSecManager::init(const char *serviceName, IPropertyTree* cfg)
  473. {
  474. for(int i = 0; i < RT_SCOPE_MAX; i++)
  475. m_cache_off[i] = false;
  476. m_cache_off[RT_VIEW_SCOPE] = true;
  477. m_usercache_off = false;
  478. m_cfg.setown(cfg);
  479. cfg->getProp(".//@ldapAddress", m_server);
  480. cfg->getProp(".//@description", m_description);
  481. ILdapClient* ldap_client = createLdapClient(cfg);
  482. IPermissionProcessor* pp;
  483. if(ldap_client->getServerType() == ACTIVE_DIRECTORY)
  484. pp = new PermissionProcessor(cfg);
  485. else if(ldap_client->getServerType() == IPLANET)
  486. pp = new CIPlanetAciProcessor(cfg);
  487. else if(ldap_client->getServerType() == OPEN_LDAP)
  488. {
  489. if (0 == stricmp(ldap_client->getLdapConfig()->getCfgServerType(), "389DirectoryServer"))//uses iPlanet style ACI
  490. pp = new CIPlanetAciProcessor(cfg);
  491. else
  492. pp = new COpenLdapAciProcessor(cfg);
  493. }
  494. else
  495. throwUnexpected();
  496. pp->setLdapClient(ldap_client);
  497. ldap_client->init(pp);
  498. m_ldap_client.setown(ldap_client);
  499. m_pp.setown(pp);
  500. int cachetimeout = cfg->getPropInt("@cacheTimeout", 5);
  501. if (cfg->getPropBool("@sharedCache", true))
  502. m_permissionsCache.setown(CPermissionsCache::getInstance(cfg->queryProp("@name")));
  503. else
  504. m_permissionsCache.setown(new CPermissionsCache());
  505. m_permissionsCache->setCacheTimeout( 60 * cachetimeout);
  506. m_permissionsCache->setTransactionalEnabled(true);
  507. m_permissionsCache->setSecManager(this);
  508. m_passwordExpirationWarningDays = cfg->getPropInt(".//@passwordExpirationWarningDays", 10); //Default to 10 days
  509. m_checkViewPermissions = cfg->getPropBool(".//@checkViewPermissions", false);
  510. };
  511. CLdapSecManager::CLdapSecManager(const char *serviceName, IPropertyTree &config)
  512. {
  513. init(serviceName, &config);
  514. }
  515. CLdapSecManager::~CLdapSecManager()
  516. {
  517. }
  518. //interface ISecManager : extends IInterface
  519. ISecUser * CLdapSecManager::createUser(const char * user_name)
  520. {
  521. return (new CLdapSecUser(user_name, NULL));
  522. }
  523. ISecResourceList * CLdapSecManager::createResourceList(const char * rlname)
  524. {
  525. return (new CLdapSecResourceList(rlname));
  526. }
  527. bool CLdapSecManager::subscribe(ISecAuthenticEvents & events)
  528. {
  529. m_subscriber.set(&events);
  530. return true;
  531. }
  532. bool CLdapSecManager::unsubscribe(ISecAuthenticEvents & events)
  533. {
  534. if (&events == m_subscriber.get())
  535. {
  536. m_subscriber.set(NULL);
  537. }
  538. return true;
  539. }
  540. bool CLdapSecManager::authenticate(ISecUser* user)
  541. {
  542. if(!user)
  543. {
  544. DBGLOG("CLdapSecManager::authenticate user cannot be NULL");
  545. return false;
  546. }
  547. user->setAuthenticateStatus(AS_UNKNOWN);
  548. bool isCaching = m_permissionsCache->isCacheEnabled() && !m_usercache_off;//caching enabled?
  549. bool isUserCached = false;
  550. Owned<ISecUser> cachedUser = new CLdapSecUser(user->getName(), "");
  551. if(isCaching)
  552. {
  553. user->copyTo(*(cachedUser.get()));//copy user to cachedUser
  554. isUserCached = m_permissionsCache->lookup(*cachedUser);//populate cachedUser with cached values
  555. }
  556. //Verify provided signature if present
  557. IDigitalSignatureManager * pDSM = createDigitalSignatureManagerInstanceFromEnv();
  558. if (pDSM && pDSM->isDigiVerifierConfigured() && !isEmptyString(user->credentials().getSignature()))
  559. {
  560. StringBuffer b64Signature(user->credentials().getSignature());
  561. if (!pDSM->digiVerify(user->getName(), b64Signature))//digital signature valid?
  562. {
  563. user->setAuthenticateStatus(AS_INVALID_CREDENTIALS);
  564. WARNLOG("Invalid digital signature for user %s", user->getName());
  565. return false;
  566. }
  567. else
  568. {
  569. user->setAuthenticateStatus(AS_AUTHENTICATED);
  570. if(isCaching && !isUserCached)
  571. m_permissionsCache->add(*user);
  572. return true;
  573. }
  574. }
  575. if (isUserCached && cachedUser->getAuthenticateStatus() == AS_AUTHENTICATED)//only authenticated users will be cached
  576. {
  577. return true;
  578. }
  579. //User not in cache. Look for session token, or call LDAP to authenticate
  580. if (0 != user->credentials().getSessionToken())//check for token existence
  581. {
  582. user->setAuthenticateStatus(AS_AUTHENTICATED);
  583. }
  584. else if (m_ldap_client->authenticate(*user)) //call LDAP to authenticate
  585. user->setAuthenticateStatus(AS_AUTHENTICATED);
  586. if (AS_AUTHENTICATED == user->getAuthenticateStatus())
  587. {
  588. if (pDSM && pDSM->isDigiSignerConfigured() && isEmptyString(user->credentials().getSignature()))
  589. {
  590. //Set user digital signature
  591. StringBuffer b64Signature;
  592. pDSM->digiSign(user->getName(), b64Signature);
  593. user->credentials().setSignature(b64Signature);
  594. }
  595. if (isCaching)
  596. m_permissionsCache->add(*user);
  597. }
  598. return AS_AUTHENTICATED == user->getAuthenticateStatus();
  599. }
  600. bool CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * Resources, IEspSecureContext* secureContext)
  601. {
  602. if(!authenticate(&sec_user))
  603. {
  604. return false;
  605. }
  606. CLdapSecResourceList * reslist = (CLdapSecResourceList*)Resources;
  607. if(!reslist)
  608. return true;
  609. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  610. int nResources = rlist.length();
  611. int ri;
  612. for(ri = 0; ri < nResources; ri++)
  613. {
  614. ISecResource* res = &rlist.item(ri);
  615. if(res != NULL)
  616. res->setResourceType(rtype);
  617. }
  618. if (nResources <= 0)
  619. return true;
  620. bool rc;
  621. time_t tctime = getThreadCreateTime();
  622. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  623. {
  624. bool* cached_found = (bool*)alloca(nResources*sizeof(bool));
  625. int nFound = m_permissionsCache->lookup(sec_user, rlist, cached_found);
  626. if (nFound < nResources)
  627. {
  628. IArrayOf<ISecResource> rlist2;
  629. int i;
  630. for (i=0; i < nResources; i++)
  631. {
  632. if (*(cached_found+i) == false)
  633. {
  634. ISecResource& secRes = rlist.item(i);
  635. secRes.Link();
  636. rlist2.append(secRes);
  637. //DBGLOG("CACHE: Fetching permissions for %s:%s", sec_user.getName(), secRes.getName());
  638. }
  639. }
  640. rc = m_ldap_client->authorize(rtype, sec_user, rlist2);
  641. if (rc)
  642. m_permissionsCache->add(sec_user, rlist2);
  643. }
  644. else
  645. rc = true;
  646. }
  647. else
  648. {
  649. rc = m_ldap_client->authorize(rtype, sec_user, rlist, reslist->getName());
  650. }
  651. return rc;
  652. }
  653. SecAccessFlags CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser & user, const char * resourcename, IEspSecureContext* secureContext)
  654. {
  655. if(!resourcename || !*resourcename)
  656. return SecAccess_Full;
  657. Owned<ISecResourceList> rlist;
  658. rlist.setown(createResourceList("resources"));
  659. rlist->addResource(resourcename);
  660. bool ok = authorizeEx(rtype, user, rlist.get(), secureContext);
  661. if(ok)
  662. return rlist->queryResource(0)->getAccessFlags();
  663. else
  664. return SecAccess_Unavailable;
  665. }
  666. bool CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * Resources, bool doAuthentication)
  667. {
  668. if(doAuthentication && !authenticate(&sec_user))
  669. {
  670. return false;
  671. }
  672. CLdapSecResourceList * reslist = (CLdapSecResourceList*)Resources;
  673. if(!reslist)
  674. return true;
  675. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  676. int nResources = rlist.length();
  677. int ri;
  678. for(ri = 0; ri < nResources; ri++)
  679. {
  680. ISecResource* res = &rlist.item(ri);
  681. if(res != NULL)
  682. res->setResourceType(rtype);
  683. }
  684. if (nResources <= 0)
  685. return true;
  686. bool rc;
  687. time_t tctime = getThreadCreateTime();
  688. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  689. {
  690. bool* cached_found = (bool*)alloca(nResources*sizeof(bool));
  691. int nFound = m_permissionsCache->lookup(sec_user, rlist, cached_found);
  692. if (nFound < nResources)
  693. {
  694. IArrayOf<ISecResource> rlist2;
  695. int i;
  696. for (i=0; i < nResources; i++)
  697. {
  698. if (*(cached_found+i) == false)
  699. {
  700. ISecResource& secRes = rlist.item(i);
  701. secRes.Link();
  702. rlist2.append(secRes);
  703. //DBGLOG("CACHE: Fetching permissions for %s:%s", sec_user.getName(), secRes.getName());
  704. }
  705. }
  706. rc = m_ldap_client->authorize(rtype, sec_user, rlist2);
  707. if (rc)
  708. m_permissionsCache->add(sec_user, rlist2);
  709. }
  710. else
  711. rc = true;
  712. }
  713. else
  714. {
  715. rc = m_ldap_client->authorize(rtype, sec_user, rlist);
  716. }
  717. return rc;
  718. }
  719. SecAccessFlags CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser & user, const char * resourcename, bool doAuthentication)
  720. {
  721. if(!resourcename || !*resourcename)
  722. return SecAccess_Full;
  723. Owned<ISecResourceList> rlist;
  724. rlist.setown(createResourceList("resources"));
  725. rlist->addResource(resourcename);
  726. bool ok = authorizeEx(rtype, user, rlist.get(), doAuthentication);
  727. if(ok)
  728. return rlist->queryResource(0)->getAccessFlags();
  729. else
  730. return SecAccess_Unavailable;
  731. }
  732. SecAccessFlags CLdapSecManager::getAccessFlagsEx(SecResourceType rtype, ISecUser & user, const char * resourcename)
  733. {
  734. if(!resourcename || !*resourcename)
  735. return SecAccess_Unavailable;
  736. Owned<ISecResourceList> rlist0;
  737. rlist0.setown(createResourceList("resources"));
  738. rlist0->addResource(resourcename);
  739. CLdapSecResourceList * reslist = (CLdapSecResourceList*)rlist0.get();
  740. if(!reslist)
  741. return SecAccess_Unavailable;
  742. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  743. int nResources = rlist.length();
  744. int ri;
  745. for(ri = 0; ri < nResources; ri++)
  746. {
  747. ISecResource* res = &rlist.item(ri);
  748. if(res != NULL)
  749. res->setResourceType(rtype);
  750. }
  751. if (nResources <= 0)
  752. return SecAccess_Unavailable;
  753. bool ok = false;
  754. time_t tctime = getThreadCreateTime();
  755. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  756. {
  757. bool* cached_found = (bool*)alloca(nResources*sizeof(bool));
  758. int nFound = m_permissionsCache->lookup(user, rlist, cached_found);
  759. if (nFound < nResources)
  760. {
  761. IArrayOf<ISecResource> rlist2;
  762. int i;
  763. for (i=0; i < nResources; i++)
  764. {
  765. if (*(cached_found+i) == false)
  766. {
  767. ISecResource& secRes = rlist.item(i);
  768. secRes.Link();
  769. rlist2.append(secRes);
  770. //DBGLOG("CACHE: Fetching permissions for %s:%s", sec_user.getName(), secRes.getName());
  771. }
  772. }
  773. ok = m_ldap_client->authorize(rtype, user, rlist2);
  774. if (ok)
  775. m_permissionsCache->add(user, rlist2);
  776. }
  777. else
  778. ok = true;
  779. }
  780. else
  781. {
  782. ok = m_ldap_client->authorize(rtype, user, rlist);
  783. }
  784. //bool ok = authorizeEx(rtype, user, rlist.get());
  785. if(ok)
  786. return rlist0->queryResource(0)->getAccessFlags();
  787. else
  788. return SecAccess_Unavailable;
  789. }
  790. bool CLdapSecManager::authorize(ISecUser& sec_user, ISecResourceList * Resources, IEspSecureContext* secureContext)
  791. {
  792. return authorizeEx(RT_DEFAULT, sec_user, Resources, secureContext);
  793. }
  794. SecAccessFlags CLdapSecManager::authorizeFileScope(ISecUser & user, const char * filescope)
  795. {
  796. if(filescope == 0 || filescope[0] == '\0')
  797. return SecAccess_Full;
  798. StringBuffer managedFilescope;
  799. if(m_permissionsCache->isCacheEnabled() && !m_usercache_off)
  800. {
  801. SecAccessFlags accessFlags;
  802. //See if file scope in question is managed by LDAP permissions.
  803. // If not, return default file permission (dont call out to LDAP)
  804. // If is, look in cache for permission of longest matching managed scope strings. If found return that permission (no call to LDAP),
  805. // otherwise a call to LDAP "authorizeFileScope" is necessary, specifying the longest matching managed scope string
  806. bool gotPerms = m_permissionsCache->queryPermsManagedFileScope(user, filescope, managedFilescope, &accessFlags);
  807. if (gotPerms)
  808. return accessFlags;
  809. }
  810. Owned<ISecResourceList> rlist;
  811. rlist.setown(createResourceList("FileScope"));
  812. rlist->addResource(managedFilescope.length() ? managedFilescope.str() : filescope );
  813. bool ok = authorizeFileScope(user, rlist.get());
  814. if(ok)
  815. return rlist->queryResource(0)->getAccessFlags();
  816. else
  817. return SecAccess_Unavailable;
  818. }
  819. bool CLdapSecManager::authorizeFileScope(ISecUser & user, ISecResourceList * resources)
  820. {
  821. return authorizeEx(RT_FILE_SCOPE, user, resources);
  822. }
  823. bool CLdapSecManager::authorizeViewScope(ISecUser & user, StringArray & filenames, StringArray & columnnames)
  824. {
  825. if (filenames.length() != columnnames.length())
  826. {
  827. PROGLOG("Error authorizing view scope: number of filenames (%d) do not match number of columnnames (%d).", filenames.length(), columnnames.length());
  828. return false;
  829. }
  830. const char* username = user.getName();
  831. StringArray viewnames, viewdescriptions, viewManagedBy;
  832. queryAllViews(viewnames, viewdescriptions, viewManagedBy);
  833. // All views where user belongs must pass
  834. ForEachItemIn(i, viewnames)
  835. {
  836. const char* viewname = viewnames.item(i);
  837. if (userInView(username, viewname))
  838. {
  839. Owned<ISecResourceList> resList;
  840. resList.setown(new CLdapSecResourceList(viewname));
  841. // Inefficient loop because we are adding same used columns all over again for each views.
  842. // we can improve the performance later if there is a way to rename and reuse same ISecResourceList for each view.
  843. ForEachItemIn(j, filenames)
  844. {
  845. StringBuffer resourceName;
  846. resourceName.append("QueryAccessedColumns");
  847. resourceName.append(j);
  848. ISecResource* res = resList->addResource(resourceName);
  849. res->addParameter("file", filenames.item(j));
  850. res->addParameter("column", columnnames.item(j));
  851. }
  852. if (!authorizeEx(RT_VIEW_SCOPE, user, resList.get()))
  853. {
  854. PROGLOG("View scope authorization denied by a view %s for a user %s", viewname, username);
  855. return false;
  856. }
  857. }
  858. }
  859. return true;
  860. }
  861. SecAccessFlags CLdapSecManager::authorizeWorkunitScope(ISecUser & user, const char * wuscope)
  862. {
  863. if(wuscope == 0 || wuscope[0] == '\0')
  864. return SecAccess_Full;
  865. Owned<ISecResourceList> rlist;
  866. rlist.setown(createResourceList("WorkunitScope"));
  867. rlist->addResource(wuscope);
  868. bool ok = authorizeWorkunitScope(user, rlist.get());
  869. if(ok)
  870. return rlist->queryResource(0)->getAccessFlags();
  871. else
  872. return SecAccess_Unavailable;
  873. }
  874. bool CLdapSecManager::authorizeWorkunitScope(ISecUser & user, ISecResourceList * resources)
  875. {
  876. return authorizeEx(RT_WORKUNIT_SCOPE, user, resources);
  877. }
  878. bool CLdapSecManager::addResourcesEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * resources, SecPermissionType ptype, const char* basedn)
  879. {
  880. CLdapSecResourceList * reslist = (CLdapSecResourceList*)resources;
  881. if(!reslist)
  882. return true;
  883. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  884. if(rlist.length() <= 0)
  885. return true;
  886. return m_ldap_client->addResources(rtype, sec_user, rlist, ptype, basedn);
  887. }
  888. bool CLdapSecManager::addResourceEx(SecResourceType rtype, ISecUser& user, const char* resourcename, SecPermissionType ptype, const char* basedn)
  889. {
  890. Owned<ISecResourceList> rlist;
  891. rlist.setown(createResourceList("resources"));
  892. rlist->addResource(resourcename);
  893. return addResourcesEx(rtype, user, rlist.get(), ptype, basedn);
  894. }
  895. bool CLdapSecManager::addResources(ISecUser& sec_user, ISecResourceList * resources)
  896. {
  897. return addResourcesEx(RT_DEFAULT, sec_user, resources);
  898. }
  899. bool CLdapSecManager::addUser(ISecUser & user)
  900. {
  901. bool ok = m_ldap_client->addUser(user);
  902. if(!ok)
  903. return false;
  904. return m_pp->retrieveUserInfo(user);
  905. }
  906. ISecUser * CLdapSecManager::lookupUser(unsigned uid)
  907. {
  908. return m_ldap_client->lookupUser(uid);
  909. }
  910. ISecUser * CLdapSecManager::findUser(const char * username)
  911. {
  912. if(username == NULL || strlen(username) == 0)
  913. {
  914. DBGLOG("findUser - username is empty");
  915. return NULL;
  916. }
  917. Owned<ISecUser> user;
  918. user.setown(createUser(username));
  919. try
  920. {
  921. bool ok = m_pp->retrieveUserInfo(*user);
  922. if(ok)
  923. {
  924. return LINK(user.get());
  925. }
  926. else
  927. {
  928. return NULL;
  929. }
  930. }
  931. catch(IException*)
  932. {
  933. return NULL;
  934. }
  935. catch(...)
  936. {
  937. return NULL;
  938. }
  939. }
  940. ISecUserIterator * CLdapSecManager::getAllUsers()
  941. {
  942. synchronized block(m_monitor);
  943. m_user_array.popAll(true);
  944. m_ldap_client->retrieveUsers(m_user_array);
  945. return new ArrayIIteratorOf<IUserArray, ISecUser, ISecUserIterator>(m_user_array);
  946. }
  947. void CLdapSecManager::searchUsers(const char* searchstr, IUserArray& users)
  948. {
  949. m_ldap_client->retrieveUsers(searchstr, users);
  950. }
  951. ISecItemIterator* CLdapSecManager::getUsersSorted(const char* userName, UserField* sortOrder, const unsigned pageStartFrom,
  952. const unsigned pageSize, unsigned* total, __int64* cacheHint)
  953. {
  954. return m_ldap_client->getUsersSorted(userName, sortOrder, pageStartFrom, pageSize, total, cacheHint);
  955. }
  956. void CLdapSecManager::getAllUsers(IUserArray& users)
  957. {
  958. m_ldap_client->retrieveUsers(users);
  959. }
  960. bool CLdapSecManager::getResources(SecResourceType rtype, const char * basedn, IArrayOf<ISecResource> & resources)
  961. {
  962. return m_ldap_client->getResources(rtype, basedn, "", resources);
  963. }
  964. bool CLdapSecManager::getResourcesEx(SecResourceType rtype, const char * basedn, const char* searchstr, IArrayOf<ISecResource> & resources)
  965. {
  966. return m_ldap_client->getResourcesEx(rtype, basedn, "", searchstr, resources);
  967. }
  968. ISecItemIterator* CLdapSecManager::getResourcesSorted(SecResourceType rtype, const char * basedn, const char * resourceName, unsigned extraNameFilter,
  969. ResourceField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned *total, __int64 *cachehint)
  970. {
  971. return m_ldap_client->getResourcesSorted(rtype, basedn, resourceName, extraNameFilter, sortOrder, pageStartFrom, pageSize, total, cachehint);
  972. }
  973. ISecItemIterator* CLdapSecManager::getResourcePermissionsSorted(const char* name, enum ACCOUNT_TYPE_REQ accountType, const char* baseDN, const char* rtype, const char* prefix,
  974. ResourcePermissionField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned *total, __int64 *cachehint)
  975. {
  976. return m_ldap_client->getResourcePermissionsSorted(name, accountType, baseDN, rtype, prefix, sortOrder, pageStartFrom, pageSize, total, cachehint);
  977. }
  978. void CLdapSecManager::setExtraParam(const char * name, const char * value)
  979. {
  980. if(name == NULL || name[0] == '\0')
  981. {
  982. DBGLOG("CLdapSecManager::setExtraParam name must be provided");
  983. return;
  984. }
  985. if (!m_extraparams)
  986. m_extraparams.setown(createProperties(false));
  987. m_extraparams->setProp(name, value);
  988. if(value != NULL && value[0] != '\0')
  989. {
  990. if(stricmp(name, "resourcesBasedn") == 0)
  991. m_ldap_client->setResourceBasedn(value, RT_DEFAULT);
  992. else if(stricmp(name, "workunitsBasedn") == 0)
  993. m_ldap_client->setResourceBasedn(value, RT_WORKUNIT_SCOPE);
  994. }
  995. }
  996. IAuthMap * CLdapSecManager::createAuthMap(IPropertyTree * authconfig)
  997. {
  998. CAuthMap* authmap = new CAuthMap(this);
  999. IPropertyTreeIterator *loc_iter = NULL;
  1000. loc_iter = authconfig->getElements(".//Location");
  1001. if (loc_iter != NULL)
  1002. {
  1003. IPropertyTree *location = NULL;
  1004. loc_iter->first();
  1005. while(loc_iter->isValid())
  1006. {
  1007. location = &loc_iter->query();
  1008. if (location)
  1009. {
  1010. StringBuffer pathstr, rstr, required, description;
  1011. location->getProp("@path", pathstr);
  1012. location->getProp("@resource", rstr);
  1013. location->getProp("@required", required);
  1014. location->getProp("@description", description);
  1015. if(pathstr.length() == 0)
  1016. throw MakeStringException(-1, "path empty in Authenticate/Location");
  1017. if(rstr.length() == 0)
  1018. throw MakeStringException(-1, "resource empty in Authenticate/Location");
  1019. ISecResourceList* rlist = authmap->queryResourceList(pathstr.str());
  1020. if(rlist == NULL)
  1021. {
  1022. rlist = createResourceList("ldapsecurity");
  1023. authmap->add(pathstr.str(), rlist);
  1024. }
  1025. ISecResource* rs = rlist->addResource(rstr.str());
  1026. SecAccessFlags requiredaccess = str2perm(required.str());
  1027. rs->setRequiredAccessFlags(requiredaccess);
  1028. rs->setDescription(description.str());
  1029. }
  1030. loc_iter->next();
  1031. }
  1032. loc_iter->Release();
  1033. loc_iter = NULL;
  1034. }
  1035. authmap->addToBackend();
  1036. return authmap;
  1037. }
  1038. IAuthMap * CLdapSecManager::createFeatureMap(IPropertyTree * authconfig)
  1039. {
  1040. CAuthMap* feature_authmap = new CAuthMap(this);
  1041. IPropertyTreeIterator *feature_iter = NULL;
  1042. feature_iter = authconfig->getElements(".//Feature");
  1043. if (feature_iter != NULL)
  1044. {
  1045. IPropertyTree *feature = NULL;
  1046. feature_iter->first();
  1047. while(feature_iter->isValid())
  1048. {
  1049. feature = &feature_iter->query();
  1050. if (feature)
  1051. {
  1052. StringBuffer pathstr, rstr, required, description;
  1053. feature->getProp("@path", pathstr);
  1054. feature->getProp("@resource", rstr);
  1055. feature->getProp("@required", required);
  1056. feature->getProp("@description", description);
  1057. ISecResourceList* rlist = feature_authmap->queryResourceList(pathstr.str());
  1058. if(rlist == NULL)
  1059. {
  1060. rlist = createResourceList(pathstr.str());
  1061. feature_authmap->add(pathstr.str(), rlist);
  1062. }
  1063. ISecResource* rs = rlist->addResource(rstr.str());
  1064. SecAccessFlags requiredaccess = str2perm(required.str());
  1065. rs->setRequiredAccessFlags(requiredaccess);
  1066. rs->setDescription(description.str());
  1067. }
  1068. feature_iter->next();
  1069. }
  1070. feature_iter->Release();
  1071. feature_iter = NULL;
  1072. }
  1073. feature_authmap->addToBackend();
  1074. return feature_authmap;
  1075. }
  1076. bool CLdapSecManager::updateUserPassword(ISecUser& user, const char* newPassword, const char* currPassword)
  1077. {
  1078. // Authenticate User first
  1079. if(!authenticate(&user) && user.getAuthenticateStatus() != AS_PASSWORD_VALID_BUT_EXPIRED)
  1080. {
  1081. return false;
  1082. }
  1083. //Update password if authenticated
  1084. bool ok = m_ldap_client->updateUserPassword(user, newPassword, currPassword);
  1085. if(ok && m_permissionsCache->isCacheEnabled() && !m_usercache_off)
  1086. {
  1087. m_permissionsCache->removeFromUserCache(user);
  1088. }
  1089. return ok;
  1090. }
  1091. bool CLdapSecManager::updateUser(const char* type, ISecUser& user)
  1092. {
  1093. bool ok = m_ldap_client->updateUser(type, user);
  1094. if(ok && m_permissionsCache->isCacheEnabled() && !m_usercache_off)
  1095. m_permissionsCache->removeFromUserCache(user);
  1096. return ok;
  1097. }
  1098. bool CLdapSecManager::updateUserPassword(const char* username, const char* newPassword)
  1099. {
  1100. return m_ldap_client->updateUserPassword(username, newPassword);
  1101. }
  1102. void CLdapSecManager::getAllGroups(StringArray & groups, StringArray & managedBy, StringArray & descriptions)
  1103. {
  1104. m_ldap_client->getAllGroups(groups, managedBy, descriptions);
  1105. }
  1106. ISecItemIterator* CLdapSecManager::getGroupsSorted(GroupField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize,
  1107. unsigned *total, __int64 *cachehint)
  1108. {
  1109. return m_ldap_client->getGroupsSorted(sortOrder, pageStartFrom, pageSize, total, cachehint);
  1110. }
  1111. ISecItemIterator* CLdapSecManager::getGroupMembersSorted(const char* groupName, UserField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize,
  1112. unsigned *total, __int64 *cachehint)
  1113. {
  1114. return m_ldap_client->getGroupMembersSorted(groupName, sortOrder, pageStartFrom, pageSize, total, cachehint);
  1115. }
  1116. bool CLdapSecManager::getPermissionsArray(const char* basedn, SecResourceType rtype, const char* name, IArrayOf<CPermission>& permissions)
  1117. {
  1118. return m_ldap_client->getPermissionsArray(basedn, rtype, name, permissions);
  1119. }
  1120. void CLdapSecManager::addGroup(const char* groupname, const char * groupOwner, const char * groupDesc)
  1121. {
  1122. m_ldap_client->addGroup(groupname, groupOwner, groupDesc);
  1123. }
  1124. void CLdapSecManager::deleteGroup(const char* groupname)
  1125. {
  1126. m_ldap_client->deleteGroup(groupname);
  1127. }
  1128. bool CLdapSecManager::changePermission(CPermissionAction& action)
  1129. {
  1130. return m_ldap_client->changePermission(action);
  1131. }
  1132. void CLdapSecManager::getGroups(const char* username, StringArray & groups)
  1133. {
  1134. m_ldap_client->getGroups(username, groups);
  1135. }
  1136. void CLdapSecManager::changeUserGroup(const char* action, const char* username, const char* groupname)
  1137. {
  1138. m_ldap_client->changeUserGroup(action, username, groupname);
  1139. }
  1140. bool CLdapSecManager::deleteUser(ISecUser* user)
  1141. {
  1142. return m_ldap_client->deleteUser(user);
  1143. }
  1144. void CLdapSecManager::getGroupMembers(const char* groupname, StringArray & users)
  1145. {
  1146. m_ldap_client->getGroupMembers(groupname, users);
  1147. }
  1148. void CLdapSecManager::deleteResource(SecResourceType rtype, const char * name, const char * basedn)
  1149. {
  1150. m_ldap_client->deleteResource(rtype, name, basedn);
  1151. time_t tctime = getThreadCreateTime();
  1152. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  1153. m_permissionsCache->remove(rtype, name);
  1154. }
  1155. void CLdapSecManager::renameResource(SecResourceType rtype, const char * oldname, const char * newname, const char * basedn)
  1156. {
  1157. m_ldap_client->renameResource(rtype, oldname, newname, basedn);
  1158. time_t tctime = getThreadCreateTime();
  1159. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  1160. m_permissionsCache->remove(rtype, oldname);
  1161. }
  1162. void CLdapSecManager::copyResource(SecResourceType rtype, const char * oldname, const char * newname, const char * basedn)
  1163. {
  1164. m_ldap_client->copyResource(rtype, oldname, newname, basedn);
  1165. }
  1166. void CLdapSecManager::normalizeDn(const char* dn, StringBuffer& ndn)
  1167. {
  1168. m_ldap_client->normalizeDn(dn, ndn);
  1169. }
  1170. bool CLdapSecManager::isSuperUser(ISecUser* user)
  1171. {
  1172. return m_ldap_client->isSuperUser(user);
  1173. }
  1174. ILdapConfig* CLdapSecManager::queryConfig()
  1175. {
  1176. return m_ldap_client->queryConfig();
  1177. }
  1178. void CLdapSecManager::cacheSwitch(SecResourceType rtype, bool on)
  1179. {
  1180. m_cache_off[rtype] = !on;
  1181. // To make things simple, turning off any resource type's permission cache turns off the userCache.
  1182. if(!on)
  1183. m_usercache_off = true;
  1184. }
  1185. int CLdapSecManager::countUsers(const char* searchstr, int limit)
  1186. {
  1187. return m_ldap_client->countUsers(searchstr, limit);
  1188. }
  1189. int CLdapSecManager::countResources(const char* basedn, const char* searchstr, int limit)
  1190. {
  1191. return m_ldap_client->countResources(basedn, searchstr, limit);
  1192. }
  1193. bool CLdapSecManager::getUserInfo(ISecUser& user, const char* infotype)
  1194. {
  1195. return m_ldap_client->getUserInfo(user, infotype);
  1196. }
  1197. bool CLdapSecManager::createUserScopes()
  1198. {
  1199. Owned<ISecUserIterator> it = getAllUsers();
  1200. it->first();
  1201. bool rc = true;
  1202. while(it->isValid())
  1203. {
  1204. ISecUser &user = it->get();
  1205. if (!m_ldap_client->createUserScope(user))
  1206. {
  1207. PROGLOG("CLdapSecManager::createUserScopes Error creating user scope for user '%s'", user.getName());
  1208. rc = false;
  1209. }
  1210. it->next();
  1211. }
  1212. return rc;
  1213. }
  1214. aindex_t CLdapSecManager::getManagedFileScopes(IArrayOf<ISecResource>& scopes)
  1215. {
  1216. return m_ldap_client->getManagedFileScopes(scopes);
  1217. }
  1218. SecAccessFlags CLdapSecManager::queryDefaultPermission(ISecUser& user)
  1219. {
  1220. return m_ldap_client->queryDefaultPermission(user);
  1221. }
  1222. bool CLdapSecManager::clearPermissionsCache(ISecUser& user)
  1223. {
  1224. if(m_permissionsCache->isCacheEnabled())
  1225. {
  1226. if (!authenticate(&user))
  1227. {
  1228. PROGLOG("User %s not authorized to clear permissions cache", user.getName());
  1229. return false;
  1230. }
  1231. if (!isSuperUser(&user))
  1232. {
  1233. PROGLOG("User %s denied, only a superuser can clear permissions cache", user.getName());
  1234. return false;
  1235. }
  1236. m_permissionsCache->flush();
  1237. }
  1238. return true;
  1239. }
  1240. bool CLdapSecManager::authenticateUser(ISecUser & user, bool *superUser)
  1241. {
  1242. if (!authenticate(&user))
  1243. return false;
  1244. if (superUser)
  1245. *superUser = isSuperUser(&user);
  1246. return true;
  1247. }
  1248. bool CLdapSecManager::logoutUser(ISecUser & user)
  1249. {
  1250. //remove user from permissions cache
  1251. m_permissionsCache->removeFromUserCache(user);
  1252. user.setAuthenticateStatus(AS_UNKNOWN);
  1253. user.credentials().setSessionToken(0);
  1254. return true;
  1255. }
  1256. //Data View related interfaces
  1257. void CLdapSecManager::createView(const char* viewName, const char * viewDescription)
  1258. {
  1259. m_ldap_client->createView(viewName, viewDescription);
  1260. }
  1261. void CLdapSecManager::deleteView(const char* viewName)
  1262. {
  1263. m_ldap_client->deleteView(viewName);
  1264. }
  1265. void CLdapSecManager::queryAllViews(StringArray & viewNames, StringArray & viewDescriptions, StringArray & viewManagedBy)
  1266. {
  1267. m_ldap_client->queryAllViews(viewNames, viewDescriptions, viewManagedBy);
  1268. }
  1269. void CLdapSecManager::addViewColumns(const char* viewName, StringArray & files, StringArray & columns)
  1270. {
  1271. m_ldap_client->addViewColumns(viewName, files, columns);
  1272. }
  1273. void CLdapSecManager::removeViewColumns(const char* viewName, StringArray & files, StringArray & columns)
  1274. {
  1275. m_ldap_client->removeViewColumns(viewName, files, columns);
  1276. }
  1277. void CLdapSecManager::queryViewColumns(const char* viewName, StringArray & files, StringArray & columns)
  1278. {
  1279. m_ldap_client->queryViewColumns(viewName, files, columns);
  1280. }
  1281. void CLdapSecManager::addViewMembers(const char* viewName, StringArray & viewUsers, StringArray & viewGroups)
  1282. {
  1283. m_ldap_client->addViewMembers(viewName, viewUsers, viewGroups);
  1284. }
  1285. void CLdapSecManager::removeViewMembers(const char* viewName, StringArray & viewUsers, StringArray & viewGroups)
  1286. {
  1287. m_ldap_client->removeViewMembers(viewName, viewUsers, viewGroups);
  1288. }
  1289. void CLdapSecManager::queryViewMembers(const char* viewName, StringArray & viewUsers, StringArray & viewGroups)
  1290. {
  1291. m_ldap_client->queryViewMembers(viewName, viewUsers, viewGroups);
  1292. }
  1293. bool CLdapSecManager::userInView(const char * user, const char* viewName)
  1294. {
  1295. return m_ldap_client->userInView(user, viewName);
  1296. }
  1297. extern "C"
  1298. {
  1299. LDAPSECURITY_API ISecManager * newLdapSecManager(const char *serviceName, IPropertyTree &config)
  1300. {
  1301. return new CLdapSecManager(serviceName, config);
  1302. }
  1303. LDAPSECURITY_API IAuthMap *newDefaultAuthMap(IPropertyTree* config)
  1304. {
  1305. CAuthMap* authmap = new CAuthMap(NULL);
  1306. IPropertyTreeIterator *loc_iter = NULL;
  1307. loc_iter = config->getElements(".//Location");
  1308. if (loc_iter != NULL)
  1309. {
  1310. IPropertyTree *location = NULL;
  1311. loc_iter->first();
  1312. while(loc_iter->isValid())
  1313. {
  1314. location = &loc_iter->query();
  1315. if (location)
  1316. {
  1317. StringBuffer pathstr, rstr;
  1318. location->getProp("@path", pathstr);
  1319. authmap->add(pathstr.str(), NULL);
  1320. }
  1321. loc_iter->next();
  1322. }
  1323. loc_iter->Release();
  1324. loc_iter = NULL;
  1325. }
  1326. return authmap;
  1327. }
  1328. }