ldapsecurity.cpp 45 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582
  1. /*##############################################################################
  2. HPCC SYSTEMS software Copyright (C) 2012 HPCC Systems®.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. ############################################################################## */
  13. #define AXA_API DECL_EXPORT
  14. #include "ldapsecurity.ipp"
  15. #include "ldapsecurity.hpp"
  16. #include "authmap.ipp"
  17. #include "digisign.hpp"
  18. using namespace cryptohelper;
  19. /**********************************************************
  20. * CLdapSecUser *
  21. **********************************************************/
  22. // An empty static properties instance is shared by all instances because this
  23. // implementation of the interface does not manage per-instance properties.
  24. Owned<IProperties> CLdapSecUser::sm_emptyParameters(createProperties(false));
  25. CLdapSecUser::CLdapSecUser(const char *name, const char *pw) :
  26. m_pw(pw), m_authenticateStatus(AS_UNKNOWN)
  27. {
  28. setName(name);
  29. setUserID(0);
  30. setPosixenabled(false);
  31. setSudoersEnabled(false);
  32. setInSudoers(false);
  33. setSessionToken(0);
  34. setSignature(nullptr);
  35. }
  36. CLdapSecUser::~CLdapSecUser()
  37. {
  38. }
  39. //non-interfaced functions
  40. void CLdapSecUser::setUserID(unsigned userid)
  41. {
  42. m_userid = userid;
  43. }
  44. void CLdapSecUser::setUserSid(int sidlen, const char* sid)
  45. {
  46. m_usersid.clear();
  47. m_usersid.append(sidlen, sid);
  48. }
  49. MemoryBuffer& CLdapSecUser::getUserSid()
  50. {
  51. return m_usersid;
  52. }
  53. //interface ISecUser
  54. const char * CLdapSecUser::getName()
  55. {
  56. return m_name.get();
  57. }
  58. bool CLdapSecUser::setName(const char * name)
  59. {
  60. if(name != NULL)
  61. {
  62. const char* atsign = strchr(name, '@');
  63. if(atsign != NULL)
  64. {
  65. m_name.set(name, atsign - name);
  66. m_realm.set(atsign + 1);
  67. }
  68. else
  69. {
  70. m_name.set(name);
  71. }
  72. }
  73. return TRUE;
  74. }
  75. const char * CLdapSecUser::getFullName()
  76. {
  77. return m_fullname.get();
  78. }
  79. bool CLdapSecUser::setFullName(const char * name)
  80. {
  81. if(name != NULL)
  82. {
  83. m_fullname.set(name);
  84. }
  85. return true;
  86. }
  87. const char * CLdapSecUser::getFirstName()
  88. {
  89. return m_firstname.get();
  90. }
  91. bool CLdapSecUser::setFirstName(const char * fname)
  92. {
  93. if(fname != NULL)
  94. {
  95. m_firstname.set(fname);
  96. }
  97. return true;
  98. }
  99. const char * CLdapSecUser::getLastName()
  100. {
  101. return m_lastname.get();
  102. }
  103. bool CLdapSecUser::setLastName(const char * lname)
  104. {
  105. if(lname != NULL)
  106. {
  107. m_lastname.set(lname);
  108. }
  109. return true;
  110. }
  111. const char * CLdapSecUser::getEmployeeID()
  112. {
  113. return m_employeeID.get();
  114. }
  115. bool CLdapSecUser::setEmployeeID(const char * emplID)
  116. {
  117. m_employeeID.set(emplID);
  118. return true;
  119. }
  120. const char * CLdapSecUser::getDistinguishedName()
  121. {
  122. return m_distinguishedName.get();
  123. }
  124. bool CLdapSecUser::setDistinguishedName(const char * dn)
  125. {
  126. m_distinguishedName.set(dn);
  127. return true;
  128. }
  129. const char * CLdapSecUser::getRealm()
  130. {
  131. return m_realm.get();
  132. }
  133. bool CLdapSecUser::setRealm(const char * name)
  134. {
  135. m_realm.set(name);
  136. return TRUE;
  137. }
  138. const char * CLdapSecUser::getFqdn()
  139. {
  140. return m_Fqdn.get();
  141. }
  142. bool CLdapSecUser::setFqdn(const char * Fqdn)
  143. {
  144. m_Fqdn.set(Fqdn);
  145. return true;
  146. }
  147. const char *CLdapSecUser::getPeer()
  148. {
  149. return m_Peer.get();
  150. }
  151. bool CLdapSecUser::setPeer(const char *Peer)
  152. {
  153. m_Peer.set(Peer);
  154. return true;
  155. }
  156. ISecCredentials & CLdapSecUser::credentials()
  157. {
  158. return *this;
  159. }
  160. unsigned CLdapSecUser::getUserID()
  161. {
  162. return m_userid;
  163. }
  164. //interface ISecCredentials
  165. bool CLdapSecUser::setPassword(const char * pw)
  166. {
  167. m_pw.set(pw);
  168. return TRUE;
  169. }
  170. const char* CLdapSecUser::getPassword()
  171. {
  172. return m_pw;
  173. }
  174. bool CLdapSecUser::setEncodedPassword(SecPasswordEncoding enc, void * pw, unsigned length, void * salt, unsigned saltlen)
  175. {
  176. return FALSE; //not supported yet
  177. }
  178. void CLdapSecUser::setSessionToken(unsigned token)
  179. {
  180. m_sessionToken = token;
  181. }
  182. unsigned CLdapSecUser::getSessionToken()
  183. {
  184. return m_sessionToken;
  185. }
  186. void CLdapSecUser::setSignature(const char * signature)
  187. {
  188. m_signature.clear().append(signature);
  189. }
  190. const char * CLdapSecUser::getSignature()
  191. {
  192. return m_signature.str();
  193. }
  194. void CLdapSecUser::copyTo(ISecUser& destination)
  195. {
  196. if (this == &destination)
  197. return;
  198. CLdapSecUser* dest = dynamic_cast<CLdapSecUser*>(&destination);
  199. if(!dest)
  200. return;
  201. dest->setAuthenticateStatus(getAuthenticateStatus());
  202. dest->setName(getName());
  203. dest->setFullName(getFullName());
  204. dest->setFirstName(getFirstName());
  205. dest->setLastName(getLastName());
  206. dest->setEmployeeID(getEmployeeID());
  207. dest->setRealm(getRealm());
  208. dest->credentials().setPassword(credentials().getPassword());
  209. dest->setUserSid(m_usersid.length(), m_usersid.toByteArray());
  210. dest->setUserID(m_userid);
  211. dest->setPasswordExpiration(m_passwordExpiration);
  212. dest->setDistinguishedName(m_distinguishedName);
  213. dest->credentials().setSessionToken(m_sessionToken);
  214. dest->credentials().setSignature(m_signature.str());
  215. }
  216. ISecUser * CLdapSecUser::clone()
  217. {
  218. CLdapSecUser* newuser = new CLdapSecUser(m_name.get(), m_pw.get());
  219. if(newuser)
  220. copyTo(*newuser);
  221. return newuser;
  222. }
  223. /**********************************************************
  224. * CLdapSecResource *
  225. **********************************************************/
  226. CLdapSecResource::CLdapSecResource(const char *name) : m_name(name), m_access(SecAccess_None), m_required_access(SecAccess_None), m_parameters(createProperties(false))
  227. {
  228. m_resourcetype = RT_DEFAULT;
  229. }
  230. void CLdapSecResource::addAccess(SecAccessFlags flags)
  231. {
  232. m_access = (SecAccessFlags)((int)m_access | (int)flags);
  233. }
  234. void CLdapSecResource::setAccessFlags(SecAccessFlags flags)
  235. {
  236. m_access = flags;
  237. }
  238. void CLdapSecResource::setRequiredAccessFlags(SecAccessFlags flags)
  239. {
  240. m_required_access = flags;
  241. }
  242. SecAccessFlags CLdapSecResource::getRequiredAccessFlags()
  243. {
  244. return m_required_access;
  245. }
  246. //interface ISecResource : extends IInterface
  247. const char * CLdapSecResource::getName()
  248. {
  249. return m_name.get();
  250. }
  251. SecAccessFlags CLdapSecResource::getAccessFlags()
  252. {
  253. return m_access;
  254. }
  255. int CLdapSecResource::addParameter(const char* name, const char* value)
  256. {
  257. m_parameters->setProp(name, value);
  258. return 0;
  259. }
  260. const char * CLdapSecResource::getParameter(const char * name)
  261. {
  262. return m_parameters->queryProp(name);
  263. }
  264. IPropertyIterator * CLdapSecResource::getParameterIterator() const
  265. {
  266. return m_parameters->getIterator();
  267. }
  268. void CLdapSecResource::setDescription(const char* description)
  269. {
  270. m_description.clear().append(description);
  271. }
  272. const char* CLdapSecResource::getDescription()
  273. {
  274. return m_description.str();
  275. }
  276. void CLdapSecResource::setValue(const char* value)
  277. {
  278. m_value.clear();
  279. m_value.append(value);
  280. }
  281. const char* CLdapSecResource::getValue()
  282. {
  283. return m_value.str();
  284. }
  285. ISecResource * CLdapSecResource::clone()
  286. {
  287. CLdapSecResource* _res = new CLdapSecResource(m_name.get());
  288. if(!_res)
  289. return NULL;
  290. _res->setResourceType(m_resourcetype);
  291. _res->setValue(m_value.str());
  292. _res->m_access = m_access;
  293. _res->m_required_access = m_required_access;
  294. _res->setDescription(m_description.str());
  295. Owned<IPropertyIterator> Itr = m_parameters->getIterator();
  296. ForEach(*Itr)
  297. {
  298. _res->addParameter(Itr->getPropKey(),m_parameters->queryProp(Itr->getPropKey()));
  299. }
  300. return _res;
  301. }
  302. void CLdapSecResource::copy(ISecResource* from)
  303. {
  304. if(!from)
  305. return;
  306. CLdapSecResource* ldapfrom = dynamic_cast<CLdapSecResource*>(from);
  307. if(!ldapfrom)
  308. return;
  309. m_access = ldapfrom->m_access;
  310. setDescription(ldapfrom->m_description.str());
  311. // The destination properties are reset to an empty default state so the
  312. // result of the copy is a copy and not a merge. The IProperties interface
  313. // does not provide ways to manage existing content with lower overhead.
  314. m_parameters.setown(createProperties());
  315. Owned<IPropertyIterator> Itr = ldapfrom->m_parameters->getIterator();
  316. ForEach(*Itr)
  317. {
  318. addParameter(Itr->getPropKey(), ldapfrom->m_parameters->queryProp(Itr->getPropKey()));
  319. }
  320. return;
  321. }
  322. SecResourceType CLdapSecResource::getResourceType()
  323. {
  324. return m_resourcetype;
  325. }
  326. void CLdapSecResource::setResourceType(SecResourceType resourcetype)
  327. {
  328. m_resourcetype = resourcetype;
  329. }
  330. /**********************************************************
  331. * CLdapSecResourceList *
  332. **********************************************************/
  333. CLdapSecResourceList::CLdapSecResourceList(const char *name) : m_complete(0)
  334. {
  335. m_name.set(name);
  336. }
  337. void CLdapSecResourceList::setAuthorizationComplete(bool value)
  338. {
  339. m_complete=value;
  340. }
  341. IArrayOf<ISecResource>& CLdapSecResourceList::getResourceList()
  342. {
  343. return m_rlist;
  344. }
  345. //interface ISecResourceList : extends IInterface
  346. bool CLdapSecResourceList::isAuthorizationComplete()
  347. {
  348. return m_complete;
  349. }
  350. ISecResourceList * CLdapSecResourceList::clone()
  351. {
  352. CLdapSecResourceList* _newList = new CLdapSecResourceList(m_name.get());
  353. if(!_newList)
  354. return NULL;
  355. copyTo(*_newList);
  356. return _newList;
  357. }
  358. bool CLdapSecResourceList::copyTo(ISecResourceList& destination)
  359. {
  360. ForEachItemIn(x, m_rlist)
  361. {
  362. CLdapSecResource* res = (CLdapSecResource*)(&(m_rlist.item(x)));
  363. if(res)
  364. destination.addResource(res->clone());
  365. }
  366. return false;
  367. }
  368. ISecResource* CLdapSecResourceList::addResource(const char * name)
  369. {
  370. if(!name || !*name)
  371. {
  372. DBGLOG("CLdapSecResourceList::addResource resource name must be provided");
  373. return NULL;
  374. }
  375. ISecResource* resource = m_rmap[name];
  376. if(resource == NULL)
  377. {
  378. resource = new CLdapSecResource(name);
  379. m_rlist.append(*resource);
  380. m_rmap[name] = resource;
  381. }
  382. return resource;
  383. }
  384. void CLdapSecResourceList::addResource(ISecResource * resource)
  385. {
  386. if(resource == NULL)
  387. {
  388. DBGLOG("CLdapSecResourceList::addResource2 ISecResource cannot be NULL");
  389. return;
  390. }
  391. const char* name = resource->getName();
  392. if(!name || !*name)
  393. {
  394. DBGLOG("CLdapSecResourceList::addResource2 resource name must be provided");
  395. return;
  396. }
  397. ISecResource* r = m_rmap[name];
  398. if(r == NULL)
  399. {
  400. m_rlist.append(*resource);
  401. m_rmap[name] = resource;
  402. }
  403. }
  404. bool CLdapSecResourceList::addCustomResource(const char * name, const char * config)
  405. {
  406. return false;
  407. }
  408. ISecResource * CLdapSecResourceList::getResource(const char * Resource)
  409. {
  410. if(!Resource || !*Resource)
  411. {
  412. DBGLOG("CLdapSecResourceList::getResource resource name must be provided");
  413. return NULL;
  414. }
  415. ISecResource* r = m_rmap[Resource];
  416. if(r)
  417. return LINK(r);
  418. else
  419. return NULL;
  420. }
  421. void CLdapSecResourceList::clear()
  422. {
  423. m_rlist.kill();
  424. }
  425. int CLdapSecResourceList::count()
  426. {
  427. return m_rlist.length();
  428. }
  429. const char* CLdapSecResourceList::getName()
  430. {
  431. return m_name.get();
  432. }
  433. ISecResource * CLdapSecResourceList::queryResource(unsigned seq)
  434. {
  435. if(seq < m_rlist.length())
  436. return &(m_rlist.item(seq));
  437. else
  438. return NULL;
  439. }
  440. ISecPropertyIterator * CLdapSecResourceList::getPropertyItr()
  441. {
  442. return new ArrayIIteratorOf<IArrayOf<struct ISecResource>, ISecProperty, ISecPropertyIterator>(m_rlist);
  443. }
  444. ISecProperty* CLdapSecResourceList::findProperty(const char* name)
  445. {
  446. if(!name || !*name)
  447. {
  448. DBGLOG("CLdapSecResourceList::findProperty property name must be provided");
  449. return NULL;
  450. }
  451. return m_rmap[name];
  452. }
  453. /**********************************************************
  454. * CLdapSecManager *
  455. **********************************************************/
  456. CLdapSecManager::CLdapSecManager(const char *serviceName, const char *config)
  457. {
  458. IPropertyTree* cfg = createPTreeFromXMLString(config, ipt_caseInsensitive);
  459. if(cfg == NULL)
  460. {
  461. throw MakeStringException(-1, "createPTreeFromXMLString() failed for %s", config);
  462. }
  463. init(serviceName, cfg);
  464. }
  465. void CLdapSecManager::init(const char *serviceName, IPropertyTree* cfg)
  466. {
  467. for(int i = 0; i < RT_SCOPE_MAX; i++)
  468. m_cache_off[i] = false;
  469. m_cache_off[RT_VIEW_SCOPE] = true;
  470. m_usercache_off = false;
  471. m_cfg.setown(cfg);
  472. cfg->getProp(".//@ldapAddress", m_server);
  473. cfg->getProp(".//@description", m_description);
  474. ILdapClient* ldap_client = createLdapClient(cfg);
  475. IPermissionProcessor* pp;
  476. if(ldap_client->getServerType() == ACTIVE_DIRECTORY)
  477. pp = new PermissionProcessor(cfg);
  478. else if(ldap_client->getServerType() == IPLANET)
  479. pp = new CIPlanetAciProcessor(cfg);
  480. else if(ldap_client->getServerType() == OPEN_LDAP)
  481. {
  482. if (0 == stricmp(ldap_client->getLdapConfig()->getCfgServerType(), "389DirectoryServer"))//uses iPlanet style ACI
  483. pp = new CIPlanetAciProcessor(cfg);
  484. else
  485. pp = new COpenLdapAciProcessor(cfg);
  486. }
  487. else
  488. throwUnexpected();
  489. pp->setLdapClient(ldap_client);
  490. ldap_client->init(pp);
  491. m_ldap_client.setown(ldap_client);
  492. m_pp.setown(pp);
  493. int cachetimeout = cfg->getPropInt("@cacheTimeout", 5);
  494. if (cfg->getPropBool("@sharedCache", true))
  495. m_permissionsCache.setown(CPermissionsCache::getInstance(cfg->queryProp("@name")));
  496. else
  497. m_permissionsCache.setown(new CPermissionsCache());
  498. m_permissionsCache->setCacheTimeout( 60 * cachetimeout);
  499. m_permissionsCache->setTransactionalEnabled(true);
  500. m_permissionsCache->setSecManager(this);
  501. m_passwordExpirationWarningDays = cfg->getPropInt(".//@passwordExpirationWarningDays", 10); //Default to 10 days
  502. m_checkViewPermissions = cfg->getPropBool(".//@checkViewPermissions", false);
  503. };
  504. CLdapSecManager::CLdapSecManager(const char *serviceName, IPropertyTree &config)
  505. {
  506. init(serviceName, &config);
  507. }
  508. CLdapSecManager::~CLdapSecManager()
  509. {
  510. }
  511. //interface ISecManager : extends IInterface
  512. ISecUser * CLdapSecManager::createUser(const char * user_name)
  513. {
  514. return (new CLdapSecUser(user_name, NULL));
  515. }
  516. ISecResourceList * CLdapSecManager::createResourceList(const char * rlname)
  517. {
  518. return (new CLdapSecResourceList(rlname));
  519. }
  520. bool CLdapSecManager::subscribe(ISecAuthenticEvents & events)
  521. {
  522. m_subscriber.set(&events);
  523. return true;
  524. }
  525. bool CLdapSecManager::unsubscribe(ISecAuthenticEvents & events)
  526. {
  527. if (&events == m_subscriber.get())
  528. {
  529. m_subscriber.set(NULL);
  530. }
  531. return true;
  532. }
  533. bool CLdapSecManager::authenticate(ISecUser* user)
  534. {
  535. if(!user)
  536. {
  537. DBGLOG("CLdapSecManager::authenticate user cannot be NULL");
  538. return false;
  539. }
  540. bool isCaching = m_permissionsCache->isCacheEnabled() && !m_usercache_off;//caching enabled?
  541. bool isUserCached = false;
  542. Owned<ISecUser> cachedUser = new CLdapSecUser(user->getName(), "");
  543. if(isCaching)
  544. {
  545. user->copyTo(*(cachedUser.get()));//copy user to cachedUser
  546. isUserCached = m_permissionsCache->lookup(*cachedUser);//populate cachedUser with cached values
  547. }
  548. if (AS_AUTHENTICATED == user->getAuthenticateStatus())
  549. {
  550. if(isCaching && !isUserCached)
  551. m_permissionsCache->add(*user);
  552. return true;
  553. }
  554. //Verify provided signature if present
  555. IDigitalSignatureManager * pDSM = queryDigitalSignatureManagerInstanceFromEnv();
  556. if (pDSM && pDSM->isDigiVerifierConfigured() && !isEmptyString(user->credentials().getSignature()))
  557. {
  558. StringBuffer b64Signature(user->credentials().getSignature());
  559. if (!pDSM->digiVerify(b64Signature, user->getName()))//digital signature valid?
  560. {
  561. user->setAuthenticateStatus(AS_INVALID_CREDENTIALS);
  562. WARNLOG("Invalid digital signature for user %s", user->getName());
  563. return false;
  564. }
  565. else
  566. {
  567. user->setAuthenticateStatus(AS_AUTHENTICATED);
  568. if(isCaching && !isUserCached)
  569. m_permissionsCache->add(*user);
  570. return true;
  571. }
  572. }
  573. if (isUserCached && cachedUser->getAuthenticateStatus() == AS_AUTHENTICATED)//only authenticated users will be cached
  574. {
  575. return true;
  576. }
  577. //User not in cache. Look for session token, or call LDAP to authenticate
  578. if (0 != user->credentials().getSessionToken())//check for token existence
  579. {
  580. user->setAuthenticateStatus(AS_AUTHENTICATED);
  581. }
  582. else if (m_ldap_client->authenticate(*user)) //call LDAP to authenticate
  583. user->setAuthenticateStatus(AS_AUTHENTICATED);
  584. if (AS_AUTHENTICATED == user->getAuthenticateStatus())
  585. {
  586. if (isCaching)
  587. m_permissionsCache->add(*user);
  588. else if (isEmptyString(user->credentials().getPassword()) && (0 == user->credentials().getSessionToken()) && isEmptyString(user->credentials().getSignature()))
  589. {
  590. //No need to sign if password or authenticated session based user
  591. if (pDSM && pDSM->isDigiSignerConfigured())
  592. {
  593. //Set user digital signature
  594. StringBuffer b64Signature;
  595. pDSM->digiSign(b64Signature, user->getName());
  596. user->credentials().setSignature(b64Signature);
  597. }
  598. }
  599. }
  600. return AS_AUTHENTICATED == user->getAuthenticateStatus();
  601. }
  602. bool CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * Resources, IEspSecureContext* secureContext)
  603. {
  604. if(!authenticate(&sec_user))
  605. {
  606. return false;
  607. }
  608. CLdapSecResourceList * reslist = (CLdapSecResourceList*)Resources;
  609. if(!reslist)
  610. return true;
  611. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  612. int nResources = rlist.length();
  613. int ri;
  614. for(ri = 0; ri < nResources; ri++)
  615. {
  616. ISecResource* res = &rlist.item(ri);
  617. if(res != NULL)
  618. res->setResourceType(rtype);
  619. }
  620. if (nResources <= 0)
  621. return true;
  622. bool rc;
  623. time_t tctime = getThreadCreateTime();
  624. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  625. {
  626. bool* cached_found = (bool*)alloca(nResources*sizeof(bool));
  627. int nFound = m_permissionsCache->lookup(sec_user, rlist, cached_found);
  628. if (nFound < nResources)
  629. {
  630. IArrayOf<ISecResource> rlist2;
  631. int i;
  632. for (i=0; i < nResources; i++)
  633. {
  634. if (*(cached_found+i) == false)
  635. {
  636. ISecResource& secRes = rlist.item(i);
  637. secRes.Link();
  638. rlist2.append(secRes);
  639. //DBGLOG("CACHE: Fetching permissions for %s:%s", sec_user.getName(), secRes.getName());
  640. }
  641. }
  642. rc = m_ldap_client->authorize(rtype, sec_user, rlist2);
  643. if (rc)
  644. m_permissionsCache->add(sec_user, rlist2);
  645. }
  646. else
  647. rc = true;
  648. }
  649. else
  650. {
  651. rc = m_ldap_client->authorize(rtype, sec_user, rlist, reslist->getName());
  652. }
  653. return rc;
  654. }
  655. SecAccessFlags CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser & user, const char * resourcename, IEspSecureContext* secureContext)
  656. {
  657. if(!resourcename || !*resourcename)
  658. return SecAccess_Full;
  659. Owned<ISecResourceList> rlist;
  660. rlist.setown(createResourceList("resources"));
  661. rlist->addResource(resourcename);
  662. bool ok = authorizeEx(rtype, user, rlist.get(), secureContext);
  663. if(ok)
  664. return rlist->queryResource(0)->getAccessFlags();
  665. else
  666. return SecAccess_Unavailable;
  667. }
  668. bool CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * Resources, bool doAuthentication)
  669. {
  670. if(doAuthentication && !authenticate(&sec_user))
  671. {
  672. return false;
  673. }
  674. CLdapSecResourceList * reslist = (CLdapSecResourceList*)Resources;
  675. if(!reslist)
  676. return true;
  677. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  678. int nResources = rlist.length();
  679. int ri;
  680. for(ri = 0; ri < nResources; ri++)
  681. {
  682. ISecResource* res = &rlist.item(ri);
  683. if(res != NULL)
  684. res->setResourceType(rtype);
  685. }
  686. if (nResources <= 0)
  687. return true;
  688. bool rc;
  689. time_t tctime = getThreadCreateTime();
  690. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  691. {
  692. bool* cached_found = (bool*)alloca(nResources*sizeof(bool));
  693. int nFound = m_permissionsCache->lookup(sec_user, rlist, cached_found);
  694. if (nFound < nResources)
  695. {
  696. IArrayOf<ISecResource> rlist2;
  697. int i;
  698. for (i=0; i < nResources; i++)
  699. {
  700. if (*(cached_found+i) == false)
  701. {
  702. ISecResource& secRes = rlist.item(i);
  703. secRes.Link();
  704. rlist2.append(secRes);
  705. //DBGLOG("CACHE: Fetching permissions for %s:%s", sec_user.getName(), secRes.getName());
  706. }
  707. }
  708. rc = m_ldap_client->authorize(rtype, sec_user, rlist2);
  709. if (rc)
  710. m_permissionsCache->add(sec_user, rlist2);
  711. }
  712. else
  713. rc = true;
  714. }
  715. else
  716. {
  717. rc = m_ldap_client->authorize(rtype, sec_user, rlist);
  718. }
  719. return rc;
  720. }
  721. SecAccessFlags CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser & user, const char * resourcename, bool doAuthentication)
  722. {
  723. if(!resourcename || !*resourcename)
  724. return SecAccess_Full;
  725. Owned<ISecResourceList> rlist;
  726. rlist.setown(createResourceList("resources"));
  727. rlist->addResource(resourcename);
  728. bool ok = authorizeEx(rtype, user, rlist.get(), doAuthentication);
  729. if(ok)
  730. return rlist->queryResource(0)->getAccessFlags();
  731. else
  732. return SecAccess_Unavailable;
  733. }
  734. SecAccessFlags CLdapSecManager::getAccessFlagsEx(SecResourceType rtype, ISecUser & user, const char * resourcename)
  735. {
  736. if(!resourcename || !*resourcename)
  737. return SecAccess_Unavailable;
  738. Owned<ISecResourceList> rlist0;
  739. rlist0.setown(createResourceList("resources"));
  740. rlist0->addResource(resourcename);
  741. CLdapSecResourceList * reslist = (CLdapSecResourceList*)rlist0.get();
  742. if(!reslist)
  743. return SecAccess_Unavailable;
  744. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  745. int nResources = rlist.length();
  746. int ri;
  747. for(ri = 0; ri < nResources; ri++)
  748. {
  749. ISecResource* res = &rlist.item(ri);
  750. if(res != NULL)
  751. res->setResourceType(rtype);
  752. }
  753. if (nResources <= 0)
  754. return SecAccess_Unavailable;
  755. bool ok = false;
  756. time_t tctime = getThreadCreateTime();
  757. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  758. {
  759. bool* cached_found = (bool*)alloca(nResources*sizeof(bool));
  760. int nFound = m_permissionsCache->lookup(user, rlist, cached_found);
  761. if (nFound < nResources)
  762. {
  763. IArrayOf<ISecResource> rlist2;
  764. int i;
  765. for (i=0; i < nResources; i++)
  766. {
  767. if (*(cached_found+i) == false)
  768. {
  769. ISecResource& secRes = rlist.item(i);
  770. secRes.Link();
  771. rlist2.append(secRes);
  772. //DBGLOG("CACHE: Fetching permissions for %s:%s", sec_user.getName(), secRes.getName());
  773. }
  774. }
  775. ok = m_ldap_client->authorize(rtype, user, rlist2);
  776. if (ok)
  777. m_permissionsCache->add(user, rlist2);
  778. }
  779. else
  780. ok = true;
  781. }
  782. else
  783. {
  784. ok = m_ldap_client->authorize(rtype, user, rlist);
  785. }
  786. //bool ok = authorizeEx(rtype, user, rlist.get());
  787. if(ok)
  788. return rlist0->queryResource(0)->getAccessFlags();
  789. else
  790. return SecAccess_Unavailable;
  791. }
  792. bool CLdapSecManager::authorize(ISecUser& sec_user, ISecResourceList * Resources, IEspSecureContext* secureContext)
  793. {
  794. return authorizeEx(RT_DEFAULT, sec_user, Resources, secureContext);
  795. }
  796. SecAccessFlags CLdapSecManager::authorizeFileScope(ISecUser & user, const char * filescope)
  797. {
  798. if(filescope == 0 || filescope[0] == '\0')
  799. return SecAccess_Full;
  800. StringBuffer managedFilescope;
  801. if(m_permissionsCache->isCacheEnabled() && !m_usercache_off)
  802. {
  803. SecAccessFlags accessFlags;
  804. //See if file scope in question is managed by LDAP permissions.
  805. // If not, return default file permission (dont call out to LDAP)
  806. // If is, look in cache for permission of longest matching managed scope strings. If found return that permission (no call to LDAP),
  807. // otherwise a call to LDAP "authorizeFileScope" is necessary, specifying the longest matching managed scope string
  808. bool gotPerms = m_permissionsCache->queryPermsManagedFileScope(user, filescope, managedFilescope, &accessFlags);
  809. if (gotPerms)
  810. return accessFlags;
  811. }
  812. Owned<ISecResourceList> rlist;
  813. rlist.setown(createResourceList("FileScope"));
  814. rlist->addResource(managedFilescope.length() ? managedFilescope.str() : filescope );
  815. bool ok = authorizeFileScope(user, rlist.get());
  816. if(ok)
  817. return rlist->queryResource(0)->getAccessFlags();
  818. else
  819. return SecAccess_Unavailable;
  820. }
  821. bool CLdapSecManager::authorizeFileScope(ISecUser & user, ISecResourceList * resources)
  822. {
  823. return authorizeEx(RT_FILE_SCOPE, user, resources);
  824. }
  825. bool CLdapSecManager::authorizeViewScope(ISecUser & user, StringArray & filenames, StringArray & columnnames)
  826. {
  827. if (filenames.length() != columnnames.length())
  828. {
  829. PROGLOG("Error authorizing view scope: number of filenames (%d) do not match number of columnnames (%d).", filenames.length(), columnnames.length());
  830. return false;
  831. }
  832. const char* username = user.getName();
  833. StringArray viewnames, viewdescriptions, viewManagedBy;
  834. queryAllViews(viewnames, viewdescriptions, viewManagedBy);
  835. // All views where user belongs must pass
  836. ForEachItemIn(i, viewnames)
  837. {
  838. const char* viewname = viewnames.item(i);
  839. if (userInView(username, viewname))
  840. {
  841. Owned<ISecResourceList> resList;
  842. resList.setown(new CLdapSecResourceList(viewname));
  843. // Inefficient loop because we are adding same used columns all over again for each views.
  844. // we can improve the performance later if there is a way to rename and reuse same ISecResourceList for each view.
  845. ForEachItemIn(j, filenames)
  846. {
  847. StringBuffer resourceName;
  848. resourceName.append("QueryAccessedColumns");
  849. resourceName.append(j);
  850. ISecResource* res = resList->addResource(resourceName);
  851. res->addParameter("file", filenames.item(j));
  852. res->addParameter("column", columnnames.item(j));
  853. }
  854. if (!authorizeEx(RT_VIEW_SCOPE, user, resList.get()))
  855. {
  856. PROGLOG("View scope authorization denied by a view %s for a user %s", viewname, username);
  857. return false;
  858. }
  859. }
  860. }
  861. return true;
  862. }
  863. SecAccessFlags CLdapSecManager::authorizeWorkunitScope(ISecUser & user, const char * wuscope)
  864. {
  865. if(wuscope == 0 || wuscope[0] == '\0')
  866. return SecAccess_Full;
  867. Owned<ISecResourceList> rlist;
  868. rlist.setown(createResourceList("WorkunitScope"));
  869. rlist->addResource(wuscope);
  870. bool ok = authorizeWorkunitScope(user, rlist.get());
  871. if(ok)
  872. return rlist->queryResource(0)->getAccessFlags();
  873. else
  874. return SecAccess_Unavailable;
  875. }
  876. bool CLdapSecManager::authorizeWorkunitScope(ISecUser & user, ISecResourceList * resources)
  877. {
  878. return authorizeEx(RT_WORKUNIT_SCOPE, user, resources);
  879. }
  880. bool CLdapSecManager::addResourcesEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * resources, SecPermissionType ptype, const char* basedn)
  881. {
  882. CLdapSecResourceList * reslist = (CLdapSecResourceList*)resources;
  883. if(!reslist)
  884. return true;
  885. IArrayOf<ISecResource>& rlist = reslist->getResourceList();
  886. if(rlist.length() <= 0)
  887. return true;
  888. return m_ldap_client->addResources(rtype, sec_user, rlist, ptype, basedn);
  889. }
  890. bool CLdapSecManager::addResourceEx(SecResourceType rtype, ISecUser& user, const char* resourcename, SecPermissionType ptype, const char* basedn)
  891. {
  892. Owned<ISecResourceList> rlist;
  893. rlist.setown(createResourceList("resources"));
  894. rlist->addResource(resourcename);
  895. return addResourcesEx(rtype, user, rlist.get(), ptype, basedn);
  896. }
  897. bool CLdapSecManager::addResources(ISecUser& sec_user, ISecResourceList * resources)
  898. {
  899. return addResourcesEx(RT_DEFAULT, sec_user, resources);
  900. }
  901. bool CLdapSecManager::addUser(ISecUser & user)
  902. {
  903. bool ok = m_ldap_client->addUser(user);
  904. if(!ok)
  905. return false;
  906. return m_pp->retrieveUserInfo(user);
  907. }
  908. ISecUser * CLdapSecManager::lookupUser(unsigned uid)
  909. {
  910. return m_ldap_client->lookupUser(uid);
  911. }
  912. ISecUser * CLdapSecManager::findUser(const char * username)
  913. {
  914. if(username == NULL || strlen(username) == 0)
  915. {
  916. DBGLOG("findUser - username is empty");
  917. return NULL;
  918. }
  919. Owned<ISecUser> user;
  920. user.setown(createUser(username));
  921. try
  922. {
  923. bool ok = m_pp->retrieveUserInfo(*user);
  924. if(ok)
  925. {
  926. return LINK(user.get());
  927. }
  928. else
  929. {
  930. return NULL;
  931. }
  932. }
  933. catch(IException*)
  934. {
  935. return NULL;
  936. }
  937. catch(...)
  938. {
  939. return NULL;
  940. }
  941. }
  942. ISecUserIterator * CLdapSecManager::getAllUsers()
  943. {
  944. synchronized block(m_monitor);
  945. m_user_array.popAll(true);
  946. m_ldap_client->retrieveUsers(m_user_array);
  947. return new ArrayIIteratorOf<IUserArray, ISecUser, ISecUserIterator>(m_user_array);
  948. }
  949. void CLdapSecManager::searchUsers(const char* searchstr, IUserArray& users)
  950. {
  951. m_ldap_client->retrieveUsers(searchstr, users);
  952. }
  953. ISecItemIterator* CLdapSecManager::getUsersSorted(const char* userName, UserField* sortOrder, const unsigned pageStartFrom,
  954. const unsigned pageSize, unsigned* total, __int64* cacheHint)
  955. {
  956. return m_ldap_client->getUsersSorted(userName, sortOrder, pageStartFrom, pageSize, total, cacheHint);
  957. }
  958. void CLdapSecManager::getAllUsers(IUserArray& users)
  959. {
  960. m_ldap_client->retrieveUsers(users);
  961. }
  962. bool CLdapSecManager::getResources(SecResourceType rtype, const char * basedn, IArrayOf<ISecResource> & resources)
  963. {
  964. return m_ldap_client->getResources(rtype, basedn, "", resources);
  965. }
  966. bool CLdapSecManager::getResourcesEx(SecResourceType rtype, const char * basedn, const char* searchstr, IArrayOf<ISecResource> & resources)
  967. {
  968. return m_ldap_client->getResourcesEx(rtype, basedn, "", searchstr, resources);
  969. }
  970. ISecItemIterator* CLdapSecManager::getResourcesSorted(SecResourceType rtype, const char * basedn, const char * resourceName, unsigned extraNameFilter,
  971. ResourceField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned *total, __int64 *cachehint)
  972. {
  973. return m_ldap_client->getResourcesSorted(rtype, basedn, resourceName, extraNameFilter, sortOrder, pageStartFrom, pageSize, total, cachehint);
  974. }
  975. ISecItemIterator* CLdapSecManager::getResourcePermissionsSorted(const char* name, enum ACCOUNT_TYPE_REQ accountType, const char* baseDN, const char* rtype, const char* prefix,
  976. ResourcePermissionField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned *total, __int64 *cachehint)
  977. {
  978. return m_ldap_client->getResourcePermissionsSorted(name, accountType, baseDN, rtype, prefix, sortOrder, pageStartFrom, pageSize, total, cachehint);
  979. }
  980. void CLdapSecManager::setExtraParam(const char * name, const char * value)
  981. {
  982. if(name == NULL || name[0] == '\0')
  983. {
  984. DBGLOG("CLdapSecManager::setExtraParam name must be provided");
  985. return;
  986. }
  987. if (!m_extraparams)
  988. m_extraparams.setown(createProperties(false));
  989. m_extraparams->setProp(name, value);
  990. if(value != NULL && value[0] != '\0')
  991. {
  992. if(stricmp(name, "resourcesBasedn") == 0)
  993. m_ldap_client->setResourceBasedn(value, RT_DEFAULT);
  994. else if(stricmp(name, "workunitsBasedn") == 0)
  995. m_ldap_client->setResourceBasedn(value, RT_WORKUNIT_SCOPE);
  996. }
  997. }
  998. IAuthMap * CLdapSecManager::createAuthMap(IPropertyTree * authconfig)
  999. {
  1000. CAuthMap* authmap = new CAuthMap(this);
  1001. IPropertyTreeIterator *loc_iter = NULL;
  1002. loc_iter = authconfig->getElements(".//Location");
  1003. if (loc_iter != NULL)
  1004. {
  1005. IPropertyTree *location = NULL;
  1006. loc_iter->first();
  1007. while(loc_iter->isValid())
  1008. {
  1009. location = &loc_iter->query();
  1010. if (location)
  1011. {
  1012. StringBuffer pathstr, rstr, required, description;
  1013. location->getProp("@path", pathstr);
  1014. location->getProp("@resource", rstr);
  1015. location->getProp("@required", required);
  1016. location->getProp("@description", description);
  1017. if(pathstr.length() == 0)
  1018. throw MakeStringException(-1, "path empty in Authenticate/Location");
  1019. if(rstr.length() == 0)
  1020. throw MakeStringException(-1, "resource empty in Authenticate/Location");
  1021. ISecResourceList* rlist = authmap->queryResourceList(pathstr.str());
  1022. if(rlist == NULL)
  1023. {
  1024. rlist = createResourceList("ldapsecurity");
  1025. authmap->add(pathstr.str(), rlist);
  1026. }
  1027. ISecResource* rs = rlist->addResource(rstr.str());
  1028. SecAccessFlags requiredaccess = str2perm(required.str());
  1029. rs->setRequiredAccessFlags(requiredaccess);
  1030. rs->setDescription(description.str());
  1031. }
  1032. loc_iter->next();
  1033. }
  1034. loc_iter->Release();
  1035. loc_iter = NULL;
  1036. }
  1037. authmap->addToBackend();
  1038. return authmap;
  1039. }
  1040. IAuthMap * CLdapSecManager::createFeatureMap(IPropertyTree * authconfig)
  1041. {
  1042. CAuthMap* feature_authmap = new CAuthMap(this);
  1043. IPropertyTreeIterator *feature_iter = NULL;
  1044. feature_iter = authconfig->getElements(".//Feature");
  1045. if (feature_iter != NULL)
  1046. {
  1047. IPropertyTree *feature = NULL;
  1048. feature_iter->first();
  1049. while(feature_iter->isValid())
  1050. {
  1051. feature = &feature_iter->query();
  1052. if (feature)
  1053. {
  1054. StringBuffer pathstr, rstr, required, description;
  1055. feature->getProp("@path", pathstr);
  1056. feature->getProp("@resource", rstr);
  1057. feature->getProp("@required", required);
  1058. feature->getProp("@description", description);
  1059. ISecResourceList* rlist = feature_authmap->queryResourceList(pathstr.str());
  1060. if(rlist == NULL)
  1061. {
  1062. rlist = createResourceList(pathstr.str());
  1063. feature_authmap->add(pathstr.str(), rlist);
  1064. }
  1065. ISecResource* rs = rlist->addResource(rstr.str());
  1066. SecAccessFlags requiredaccess = str2perm(required.str());
  1067. rs->setRequiredAccessFlags(requiredaccess);
  1068. rs->setDescription(description.str());
  1069. }
  1070. feature_iter->next();
  1071. }
  1072. feature_iter->Release();
  1073. feature_iter = NULL;
  1074. }
  1075. feature_authmap->addToBackend();
  1076. return feature_authmap;
  1077. }
  1078. bool CLdapSecManager::updateUserPassword(ISecUser& user, const char* newPassword, const char* currPassword)
  1079. {
  1080. // Authenticate User first
  1081. if(!authenticate(&user) && user.getAuthenticateStatus() != AS_PASSWORD_VALID_BUT_EXPIRED)
  1082. {
  1083. return false;
  1084. }
  1085. //Update password if authenticated
  1086. bool ok = m_ldap_client->updateUserPassword(user, newPassword, currPassword);
  1087. if(ok && m_permissionsCache->isCacheEnabled() && !m_usercache_off)
  1088. {
  1089. m_permissionsCache->removeFromUserCache(user);
  1090. }
  1091. return ok;
  1092. }
  1093. bool CLdapSecManager::updateUser(const char* type, ISecUser& user)
  1094. {
  1095. bool ok = m_ldap_client->updateUser(type, user);
  1096. if(ok && m_permissionsCache->isCacheEnabled() && !m_usercache_off)
  1097. m_permissionsCache->removeFromUserCache(user);
  1098. return ok;
  1099. }
  1100. bool CLdapSecManager::updateUserPassword(const char* username, const char* newPassword)
  1101. {
  1102. return m_ldap_client->updateUserPassword(username, newPassword);
  1103. }
  1104. void CLdapSecManager::getAllGroups(StringArray & groups, StringArray & managedBy, StringArray & descriptions)
  1105. {
  1106. m_ldap_client->getAllGroups(groups, managedBy, descriptions);
  1107. }
  1108. ISecItemIterator* CLdapSecManager::getGroupsSorted(GroupField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize,
  1109. unsigned *total, __int64 *cachehint)
  1110. {
  1111. return m_ldap_client->getGroupsSorted(sortOrder, pageStartFrom, pageSize, total, cachehint);
  1112. }
  1113. ISecItemIterator* CLdapSecManager::getGroupMembersSorted(const char* groupName, UserField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize,
  1114. unsigned *total, __int64 *cachehint)
  1115. {
  1116. return m_ldap_client->getGroupMembersSorted(groupName, sortOrder, pageStartFrom, pageSize, total, cachehint);
  1117. }
  1118. bool CLdapSecManager::getPermissionsArray(const char* basedn, SecResourceType rtype, const char* name, IArrayOf<CPermission>& permissions)
  1119. {
  1120. return m_ldap_client->getPermissionsArray(basedn, rtype, name, permissions);
  1121. }
  1122. void CLdapSecManager::addGroup(const char* groupname, const char * groupOwner, const char * groupDesc)
  1123. {
  1124. m_ldap_client->addGroup(groupname, groupOwner, groupDesc);
  1125. }
  1126. void CLdapSecManager::deleteGroup(const char* groupname)
  1127. {
  1128. m_ldap_client->deleteGroup(groupname);
  1129. }
  1130. bool CLdapSecManager::changePermission(CPermissionAction& action)
  1131. {
  1132. return m_ldap_client->changePermission(action);
  1133. }
  1134. void CLdapSecManager::getGroups(const char* username, StringArray & groups)
  1135. {
  1136. m_ldap_client->getGroups(username, groups);
  1137. }
  1138. void CLdapSecManager::changeUserGroup(const char* action, const char* username, const char* groupname)
  1139. {
  1140. m_ldap_client->changeUserGroup(action, username, groupname);
  1141. }
  1142. bool CLdapSecManager::deleteUser(ISecUser* user)
  1143. {
  1144. return m_ldap_client->deleteUser(user);
  1145. }
  1146. void CLdapSecManager::getGroupMembers(const char* groupname, StringArray & users)
  1147. {
  1148. m_ldap_client->getGroupMembers(groupname, users);
  1149. }
  1150. void CLdapSecManager::deleteResource(SecResourceType rtype, const char * name, const char * basedn)
  1151. {
  1152. m_ldap_client->deleteResource(rtype, name, basedn);
  1153. time_t tctime = getThreadCreateTime();
  1154. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  1155. m_permissionsCache->remove(rtype, name);
  1156. }
  1157. void CLdapSecManager::renameResource(SecResourceType rtype, const char * oldname, const char * newname, const char * basedn)
  1158. {
  1159. m_ldap_client->renameResource(rtype, oldname, newname, basedn);
  1160. time_t tctime = getThreadCreateTime();
  1161. if ((m_permissionsCache->isCacheEnabled() || (m_permissionsCache->isTransactionalEnabled() && tctime > 0)) && (!m_cache_off[rtype]))
  1162. m_permissionsCache->remove(rtype, oldname);
  1163. }
  1164. void CLdapSecManager::copyResource(SecResourceType rtype, const char * oldname, const char * newname, const char * basedn)
  1165. {
  1166. m_ldap_client->copyResource(rtype, oldname, newname, basedn);
  1167. }
  1168. void CLdapSecManager::normalizeDn(const char* dn, StringBuffer& ndn)
  1169. {
  1170. m_ldap_client->normalizeDn(dn, ndn);
  1171. }
  1172. bool CLdapSecManager::isSuperUser(ISecUser* user)
  1173. {
  1174. return m_ldap_client->isSuperUser(user);
  1175. }
  1176. ILdapConfig* CLdapSecManager::queryConfig()
  1177. {
  1178. return m_ldap_client->queryConfig();
  1179. }
  1180. void CLdapSecManager::cacheSwitch(SecResourceType rtype, bool on)
  1181. {
  1182. m_cache_off[rtype] = !on;
  1183. // To make things simple, turning off any resource type's permission cache turns off the userCache.
  1184. if(!on)
  1185. m_usercache_off = true;
  1186. }
  1187. int CLdapSecManager::countUsers(const char* searchstr, int limit)
  1188. {
  1189. return m_ldap_client->countUsers(searchstr, limit);
  1190. }
  1191. int CLdapSecManager::countResources(const char* basedn, const char* searchstr, int limit)
  1192. {
  1193. return m_ldap_client->countResources(basedn, searchstr, limit);
  1194. }
  1195. bool CLdapSecManager::getUserInfo(ISecUser& user, const char* infotype)
  1196. {
  1197. return m_ldap_client->getUserInfo(user, infotype);
  1198. }
  1199. bool CLdapSecManager::createUserScopes()
  1200. {
  1201. Owned<ISecUserIterator> it = getAllUsers();
  1202. it->first();
  1203. bool rc = true;
  1204. while(it->isValid())
  1205. {
  1206. ISecUser &user = it->get();
  1207. if (!m_ldap_client->createUserScope(user))
  1208. {
  1209. PROGLOG("CLdapSecManager::createUserScopes Error creating user scope for user '%s'", user.getName());
  1210. rc = false;
  1211. }
  1212. it->next();
  1213. }
  1214. return rc;
  1215. }
  1216. aindex_t CLdapSecManager::getManagedFileScopes(IArrayOf<ISecResource>& scopes)
  1217. {
  1218. return m_ldap_client->getManagedFileScopes(scopes);
  1219. }
  1220. SecAccessFlags CLdapSecManager::queryDefaultPermission(ISecUser& user)
  1221. {
  1222. return m_ldap_client->queryDefaultPermission(user);
  1223. }
  1224. bool CLdapSecManager::clearPermissionsCache(ISecUser& user)
  1225. {
  1226. if(m_permissionsCache->isCacheEnabled())
  1227. {
  1228. if (!authenticate(&user))
  1229. {
  1230. PROGLOG("User %s not authorized to clear permissions cache", user.getName());
  1231. return false;
  1232. }
  1233. if (!isSuperUser(&user))
  1234. {
  1235. PROGLOG("User %s denied, only a superuser can clear permissions cache", user.getName());
  1236. return false;
  1237. }
  1238. m_permissionsCache->flush();
  1239. }
  1240. return true;
  1241. }
  1242. bool CLdapSecManager::authenticateUser(ISecUser & user, bool *superUser)
  1243. {
  1244. if (!authenticate(&user))
  1245. return false;
  1246. if (superUser)
  1247. *superUser = isSuperUser(&user);
  1248. return true;
  1249. }
  1250. bool CLdapSecManager::logoutUser(ISecUser & user)
  1251. {
  1252. //remove user from permissions cache
  1253. m_permissionsCache->removeFromUserCache(user);
  1254. user.setAuthenticateStatus(AS_UNKNOWN);
  1255. user.credentials().setSessionToken(0);
  1256. return true;
  1257. }
  1258. //Data View related interfaces
  1259. void CLdapSecManager::createView(const char* viewName, const char * viewDescription)
  1260. {
  1261. m_ldap_client->createView(viewName, viewDescription);
  1262. }
  1263. void CLdapSecManager::deleteView(const char* viewName)
  1264. {
  1265. m_ldap_client->deleteView(viewName);
  1266. }
  1267. void CLdapSecManager::queryAllViews(StringArray & viewNames, StringArray & viewDescriptions, StringArray & viewManagedBy)
  1268. {
  1269. m_ldap_client->queryAllViews(viewNames, viewDescriptions, viewManagedBy);
  1270. }
  1271. void CLdapSecManager::addViewColumns(const char* viewName, StringArray & files, StringArray & columns)
  1272. {
  1273. m_ldap_client->addViewColumns(viewName, files, columns);
  1274. }
  1275. void CLdapSecManager::removeViewColumns(const char* viewName, StringArray & files, StringArray & columns)
  1276. {
  1277. m_ldap_client->removeViewColumns(viewName, files, columns);
  1278. }
  1279. void CLdapSecManager::queryViewColumns(const char* viewName, StringArray & files, StringArray & columns)
  1280. {
  1281. m_ldap_client->queryViewColumns(viewName, files, columns);
  1282. }
  1283. void CLdapSecManager::addViewMembers(const char* viewName, StringArray & viewUsers, StringArray & viewGroups)
  1284. {
  1285. m_ldap_client->addViewMembers(viewName, viewUsers, viewGroups);
  1286. }
  1287. void CLdapSecManager::removeViewMembers(const char* viewName, StringArray & viewUsers, StringArray & viewGroups)
  1288. {
  1289. m_ldap_client->removeViewMembers(viewName, viewUsers, viewGroups);
  1290. }
  1291. void CLdapSecManager::queryViewMembers(const char* viewName, StringArray & viewUsers, StringArray & viewGroups)
  1292. {
  1293. m_ldap_client->queryViewMembers(viewName, viewUsers, viewGroups);
  1294. }
  1295. bool CLdapSecManager::userInView(const char * user, const char* viewName)
  1296. {
  1297. return m_ldap_client->userInView(user, viewName);
  1298. }
  1299. extern "C"
  1300. {
  1301. LDAPSECURITY_API ISecManager * newLdapSecManager(const char *serviceName, IPropertyTree &config)
  1302. {
  1303. return new CLdapSecManager(serviceName, config);
  1304. }
  1305. LDAPSECURITY_API IAuthMap *newDefaultAuthMap(IPropertyTree* config)
  1306. {
  1307. CAuthMap* authmap = new CAuthMap(NULL);
  1308. IPropertyTreeIterator *loc_iter = NULL;
  1309. loc_iter = config->getElements(".//Location");
  1310. if (loc_iter != NULL)
  1311. {
  1312. IPropertyTree *location = NULL;
  1313. loc_iter->first();
  1314. while(loc_iter->isValid())
  1315. {
  1316. location = &loc_iter->query();
  1317. if (location)
  1318. {
  1319. StringBuffer pathstr, rstr;
  1320. location->getProp("@path", pathstr);
  1321. authmap->add(pathstr.str(), NULL);
  1322. }
  1323. loc_iter->next();
  1324. }
  1325. loc_iter->Release();
  1326. loc_iter = NULL;
  1327. }
  1328. return authmap;
  1329. }
  1330. }