001 //$HeadURL: svn+ssh://rbezema@svn.wald.intevation.org/deegree/base/branches/2.2_testing/src/org/deegree/portal/standard/security/control/SecurityHelper.java $
002 /*---------------- FILE HEADER ------------------------------------------
003
004 This file is part of deegree.
005 Copyright (C) 2001-2008 by:
006 EXSE, Department of Geography, University of Bonn
007 http://www.giub.uni-bonn.de/deegree/
008 lat/lon GmbH
009 http://www.lat-lon.de
010
011 This library is free software; you can redistribute it and/or
012 modify it under the terms of the GNU Lesser General Public
013 License as published by the Free Software Foundation; either
014 version 2.1 of the License, or (at your option) any later version.
015
016 This library is distributed in the hope that it will be useful,
017 but WITHOUT ANY WARRANTY; without even the implied warranty of
018 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
019 Lesser General Public License for more details.
020
021 You should have received a copy of the GNU Lesser General Public
022 License along with this library; if not, write to the Free Software
023 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
024
025 Contact:
026
027 Andreas Poth
028 lat/lon GmbH
029 Aennchenstr. 19
030 53177 Bonn
031 Germany
032 E-Mail: poth@lat-lon.de
033
034 Prof. Dr. Klaus Greve
035 Department of Geography
036 University of Bonn
037 Meckenheimer Allee 166
038 53115 Bonn
039 Germany
040 E-Mail: greve@giub.uni-bonn.de
041
042 ---------------------------------------------------------------------------*/
043 package org.deegree.portal.standard.security.control;
044
045 import java.util.HashSet;
046 import java.util.Iterator;
047 import java.util.Set;
048
049 import javax.servlet.http.HttpServletRequest;
050 import javax.servlet.http.HttpSession;
051
052 import org.deegree.enterprise.control.AbstractListener;
053 import org.deegree.i18n.Messages;
054 import org.deegree.security.GeneralSecurityException;
055 import org.deegree.security.UnauthorizedException;
056 import org.deegree.security.drm.SecurityAccess;
057 import org.deegree.security.drm.SecurityAccessManager;
058 import org.deegree.security.drm.SecurityTransaction;
059 import org.deegree.security.drm.model.RightType;
060 import org.deegree.security.drm.model.Role;
061 import org.deegree.security.drm.model.User;
062
063 /**
064 * Helper class that performs common security access tasks and checks used in the
065 * <code>Listener</code> classes.
066 *
067 * @author <a href="mschneider@lat-lon.de">Markus Schneider </a>
068 * @author last edited by: $Author: apoth $
069 *
070 * @version $Revision: 9346 $, $Date: 2007-12-27 17:39:07 +0100 (Do, 27 Dez 2007) $
071 */
072 public class SecurityHelper {
073
074 /**
075 * Tries to acquire a <code>SecurityAccess</code> for the credentials (username, password)
076 * stored in the associated <code>HttpSesssion</code> of the given
077 * <code>AbstractListener</code>.
078 *
079 * @param listener
080 * @return SecurityAccess
081 * @throws GeneralSecurityException
082 */
083 public static SecurityAccess acquireAccess( AbstractListener listener )
084 throws GeneralSecurityException {
085 // get USERNAME and PASSWORD from HttpSession
086 HttpSession session = ( (HttpServletRequest) listener.getRequest() ).getSession( false );
087 if ( session == null ) {
088 throw new UnauthorizedException( Messages.getMessage( "IGEO_STD_SEC_ERROR_UNAUTHORIZED_ACCESS" ) );
089
090 }
091 String userName = (String) session.getAttribute( ClientHelper.KEY_USERNAME );
092 String password = (String) session.getAttribute( ClientHelper.KEY_PASSWORD );
093
094 // perform access check
095 SecurityAccessManager manager = SecurityAccessManager.getInstance();
096 User user = manager.getUserByName( userName );
097 user.authenticate( password );
098 return manager.acquireAccess( user );
099 }
100
101 /**
102 * Tries to acquire a <code>SecurityTransaction</code> for the credentials (username,
103 * password) stored in the associated <code>HttpSesssion</code>.
104 *
105 * @param listener
106 * @return SecurityTransaction
107 * @throws GeneralSecurityException
108 */
109 public static SecurityTransaction acquireTransaction( AbstractListener listener )
110 throws GeneralSecurityException {
111 // get USERNAME and PASSWORD from HttpSession
112 HttpSession session = ( (HttpServletRequest) listener.getRequest() ).getSession( false );
113 String userName = (String) session.getAttribute( ClientHelper.KEY_USERNAME );
114 String password = (String) session.getAttribute( ClientHelper.KEY_PASSWORD );
115
116 // perform access check
117 SecurityAccessManager manager = SecurityAccessManager.getInstance();
118 User user = manager.getUserByName( userName );
119 user.authenticate( password );
120 return manager.acquireTransaction( user );
121 }
122
123 /**
124 * Returns the administrator (the 'Administrator'- or a 'SUBADMIN:'-role) for the given role.
125 *
126 * @param access
127 * @param role
128 * @throws GeneralSecurityException
129 * @return Role
130 */
131 public static Role findAdminForRole( SecurityAccess access, Role role )
132 throws GeneralSecurityException {
133 Role[] allRoles = access.getAllRoles();
134 Role admin = access.getRoleById( Role.ID_SEC_ADMIN );
135 for ( int i = 0; i < allRoles.length; i++ ) {
136 if ( allRoles[i].getName().startsWith( "SUBADMIN:" ) ) {
137 // if a subadmin-role has the update right, it is
138 // considered to be administrative for the role
139 if ( allRoles[i].hasRight( access, RightType.UPDATE, role ) ) {
140 admin = allRoles[i];
141 }
142 }
143 }
144 return admin;
145 }
146
147 /**
148 * Returns the associated 'Administrator'- or 'SUBADMIN:'-role of the token holder.
149 *
150 * @param access
151 * @return Role
152 * @throws GeneralSecurityException
153 */
154 public static Role checkForAdminOrSubadminRole( SecurityAccess access )
155 throws GeneralSecurityException {
156 Role adminOrSubadminRole = null;
157 Role[] roles = access.getUser().getRoles( access );
158 for ( int i = 0; i < roles.length; i++ ) {
159 if ( roles[i].getID() == Role.ID_SEC_ADMIN ||
160 roles[i].getName().startsWith( "SUBADMIN:" ) ) {
161 if ( adminOrSubadminRole == null ) {
162 adminOrSubadminRole = roles[i];
163 } else {
164 throw new GeneralSecurityException( Messages.getMessage( "IGEO_STD_SEC_WRONG_ROLE" ) );
165 }
166 }
167 }
168 if ( adminOrSubadminRole == null ) {
169 throw new UnauthorizedException( Messages.getMessage( "IGEO_STD_SEC_MISSING_SUBADMIN_ROLE" ) );
170
171 }
172 return adminOrSubadminRole;
173 }
174
175 /**
176 * Tests if the given token is associated with the 'Administrator'-role.
177 *
178 * @param access
179 * @throws GeneralSecurityException,
180 * this is an UnauthorizedException if the user does not have the
181 * 'Administrator'-role
182 */
183 public static void checkForAdminRole( SecurityAccess access )
184 throws GeneralSecurityException {
185 Role[] roles = access.getUser().getRoles( access );
186 for ( int i = 0; i < roles.length; i++ ) {
187 if ( roles[i].getID() == Role.ID_SEC_ADMIN ) {
188 return;
189 }
190 }
191 throw new UnauthorizedException( Messages.getMessage( "IGEO_STD_SEC_MISSING_ADMIN_ROLE" ) );
192 }
193
194 /**
195 * Tests if the 'SUBADMIN:' and 'Administrator'-roles are all disjoint (so that there are no
196 * users that have more than 1 role).
197 *
198 * @param access
199 * @throws GeneralSecurityException
200 * if there is a user with more than one role
201 */
202 public static void checkSubadminRoleValidity( SecurityAccess access )
203 throws GeneralSecurityException {
204
205 Role[] subadminRoles = access.getRolesByNS( "SUBADMIN" );
206 Set<User>[] rolesAndUsers = new Set[subadminRoles.length + 1];
207 String[] roleNames = new String[subadminRoles.length + 1];
208
209 // admin role
210 User[] users = access.getRoleById( Role.ID_SEC_ADMIN ).getAllUsers( access );
211 rolesAndUsers[0] = new HashSet<User>();
212 roleNames[0] = "Administrator";
213 for ( int i = 0; i < users.length; i++ ) {
214 rolesAndUsers[0].add( users[i] );
215 }
216
217 // subadmin roles
218 for ( int i = 1; i < rolesAndUsers.length; i++ ) {
219 users = subadminRoles[i - 1].getAllUsers( access );
220 rolesAndUsers[i] = new HashSet<User>();
221 roleNames[i] = subadminRoles[i - 1].getTitle();
222 for ( int j = 0; j < users.length; j++ ) {
223 rolesAndUsers[i].add( users[j] );
224 }
225 }
226
227 // now check if all usersets are disjoint
228 for ( int i = 0; i < rolesAndUsers.length - 1; i++ ) {
229 Set userSet1 = rolesAndUsers[i];
230 for ( int j = i + 1; j < rolesAndUsers.length; j++ ) {
231 Set userSet2 = rolesAndUsers[j];
232 Iterator it = userSet2.iterator();
233 while ( it.hasNext() ) {
234 User user = (User) it.next();
235 if ( userSet1.contains( user ) ) {
236 throw new GeneralSecurityException( Messages.getMessage( "IGEO_STD_SEC_INVALID_SUBADMIN_ROLE" ) );
237 }
238 }
239 }
240 }
241 }
242 }