modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsAction.java | 8
modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsFormPrepareAction.java | 36
modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/RemoveLdapGroupsAction.java | 6
modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/ViewAction.java | 13
modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/user/RegisterAction.java | 44 -
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerBean.java | 103 --
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerLocal.java | 11
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/LdapLoginModule.java | 10
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManager.java | 304 -------
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerBean.java | 426 ++++++++++
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerLocal.java | 53 +
modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/util/LookupUtil.java | 6
modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/RoleManagerBeanTest.java | 5
13 files changed, 581 insertions(+), 444 deletions(-)
New commits:
commit 20fe0ece0175e24f2a8905c3a666011802decea5
Author: Simeon Pinder <spinder(a)redhat.com>
Date: Tue Apr 27 18:44:32 2010 -0400
BZ 584355: i)refactored ldap auth classes to be more consitently defined.ii)modified exception handling.
diff --git a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsAction.java b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsAction.java
index fe91d46..036f8c1 100644
--- a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsAction.java
+++ b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsAction.java
@@ -35,13 +35,16 @@ import org.rhq.enterprise.gui.legacy.action.BaseAction;
import org.rhq.enterprise.gui.legacy.action.BaseValidatorForm;
import org.rhq.enterprise.gui.legacy.util.RequestUtils;
import org.rhq.enterprise.gui.legacy.util.SessionUtils;
-import org.rhq.enterprise.server.authz.RoleManagerLocal;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.util.LookupUtil;
/**
* An Action that adds resource groups for a role.
*/
public class AddLdapGroupsAction extends BaseAction {
+
+ LdapGroupManagerLocal ldapManager = LookupUtil.getLdapGroupManager();
+
public ActionForward execute(ActionMapping mapping, ActionForm form, HttpServletRequest request,
HttpServletResponse response) throws Exception {
Log log = LogFactory.getLog(AddLdapGroupsAction.class.getName());
@@ -75,8 +78,7 @@ public class AddLdapGroupsAction extends BaseAction {
log.debug("adding group [" + id + "] for role [" + roleId + "]");
}
- RoleManagerLocal roleManager = LookupUtil.getRoleManager();
- roleManager.addLdapGroupsToRole(RequestUtils.getSubject(request), roleId, pendingGroupIds);
+ ldapManager.addLdapGroupsToRole(RequestUtils.getSubject(request), roleId, pendingGroupIds);
log.debug("removing pending group list");
SessionUtils.removeList(session, Constants.PENDING_RESGRPS_SES_ATTR);
diff --git a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsFormPrepareAction.java b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsFormPrepareAction.java
index 39fe62e..6cbbfce 100644
--- a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsFormPrepareAction.java
+++ b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/AddLdapGroupsFormPrepareAction.java
@@ -28,6 +28,7 @@ import java.util.Properties;
import java.util.Set;
import java.util.TreeMap;
+import javax.ejb.EJBException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@@ -55,7 +56,7 @@ import org.rhq.enterprise.server.RHQConstants;
import org.rhq.enterprise.server.authz.RoleManagerLocal;
import org.rhq.enterprise.server.exception.LdapCommunicationException;
import org.rhq.enterprise.server.exception.LdapFilterException;
-import org.rhq.enterprise.server.resource.group.LdapGroupManager;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.system.SystemManagerLocal;
import org.rhq.enterprise.server.util.LookupUtil;
@@ -65,6 +66,9 @@ import org.rhq.enterprise.server.util.LookupUtil;
public class AddLdapGroupsFormPrepareAction extends TilesAction {
final String LDAP_GROUP_CACHE = "ldapGroupCache";
+ RoleManagerLocal roleManager = LookupUtil.getRoleManager();
+ LdapGroupManagerLocal ldapManager = LookupUtil.getLdapGroupManager();
+
public ActionForward execute(ComponentContext context, ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response) throws Exception {
Log log = LogFactory.getLog(AddLdapGroupsFormPrepareAction.class.getName());
@@ -111,16 +115,16 @@ public class AddLdapGroupsFormPrepareAction extends TilesAction {
try { //defend against ldap communication runtime difficulties.
if (cachedAvailableLdapGroups == null) {
- allGroups = LdapGroupManager.getInstance().findAvailableGroups();
+ // allGroups = LdapGroupManagerBean.getInstance().findAvailableGroups();
+ allGroups = ldapManager.findAvailableGroups();
} else {//reuse cached.
allGroups = cachedAvailableLdapGroups;
}
//store unmodified list in session.
cachedAvailableLdapGroups = allGroups;
- RoleManagerLocal roleManager = LookupUtil.getRoleManager();
//retrieve currently assigned groups
- assignedList = roleManager.findLdapGroupsByRole(role.getId(), PageControl.getUnlimitedInstance());
+ assignedList = ldapManager.findLdapGroupsByRole(role.getId(), PageControl.getUnlimitedInstance());
//trim already defined from all groups returned.
allGroups = filterExisting(assignedList, allGroups);
@@ -217,6 +221,30 @@ public class AddLdapGroupsFormPrepareAction extends TilesAction {
availableGroups.setTotalSize(groupLookup.size());
availableGroups.setPageControl(pca);
+ } catch (EJBException ejx) {
+ //this is the exception type thrown now that we use SLSB.Local methods
+ // mine out other exceptions
+ Exception cause = ejx.getCausedByException();
+ if (cause == null) {
+ ActionMessages actionMessages = new ActionMessages();
+ actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage("errors.cam.general"));
+ saveErrors(request, actionMessages);
+ } else {
+ if (cause instanceof LdapFilterException) {
+ ActionMessages actionMessages = new ActionMessages();
+ actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(
+ "admin.role.LdapGroupFilterMessage"));
+ saveErrors(request, actionMessages);
+ } else if (cause instanceof LdapCommunicationException) {
+ ActionMessages actionMessages = new ActionMessages();
+ SystemManagerLocal manager = LookupUtil.getSystemManager();
+ Properties options = manager.getSystemConfiguration();
+ String providerUrl = options.getProperty(RHQConstants.LDAPUrl, "(unavailable)");
+ actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(
+ "admin.role.LdapCommunicationMessage", providerUrl));
+ saveErrors(request, actionMessages);
+ }
+ }
} catch (LdapFilterException lce) {
ActionMessages actionMessages = new ActionMessages();
actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage("admin.role.LdapGroupFilterMessage"));
diff --git a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/RemoveLdapGroupsAction.java b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/RemoveLdapGroupsAction.java
index fb359c6..48ab1c5 100644
--- a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/RemoveLdapGroupsAction.java
+++ b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/RemoveLdapGroupsAction.java
@@ -31,12 +31,16 @@ import org.rhq.core.util.collection.ArrayUtils;
import org.rhq.enterprise.gui.legacy.Constants;
import org.rhq.enterprise.gui.legacy.action.BaseAction;
import org.rhq.enterprise.gui.legacy.util.RequestUtils;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.util.LookupUtil;
/**
* An Action that retrieves data to facilitate display of the form for removing groups to a role.
*/
public class RemoveLdapGroupsAction extends BaseAction {
+
+ LdapGroupManagerLocal ldapManager = LookupUtil.getLdapGroupManager();
+
public ActionForward execute(ActionMapping mapping, ActionForm form, HttpServletRequest request,
HttpServletResponse response) throws Exception {
Log log = LogFactory.getLog(RemoveLdapGroupsAction.class.getName());
@@ -46,7 +50,7 @@ public class RemoveLdapGroupsAction extends BaseAction {
int[] groupIds = ArrayUtils.unwrapArray(rmForm.getLdapGroups());
log.debug("removing groups " + groupIds + "] for role [" + roleId + "]");
- LookupUtil.getRoleManager().removeLdapGroupsFromRole(RequestUtils.getSubject(request), roleId, groupIds);
+ ldapManager.removeLdapGroupsFromRole(RequestUtils.getSubject(request), roleId, groupIds);
RequestUtils.setConfirmation(request, "admin.role.confirm.RemoveLdapGroups");
return returnSuccess(request, mapping, Constants.ROLE_PARAM, roleId);
diff --git a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/ViewAction.java b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/ViewAction.java
index 3414dab..b2e884e 100644
--- a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/ViewAction.java
+++ b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/role/ViewAction.java
@@ -45,6 +45,7 @@ import org.rhq.enterprise.gui.legacy.action.WorkflowPrepareAction;
import org.rhq.enterprise.gui.legacy.util.RequestUtils;
import org.rhq.enterprise.gui.util.WebUtility;
import org.rhq.enterprise.server.authz.RoleManagerLocal;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.resource.group.ResourceGroupManagerLocal;
import org.rhq.enterprise.server.util.LookupUtil;
@@ -52,6 +53,11 @@ import org.rhq.enterprise.server.util.LookupUtil;
* An Action that retrieves a specific role. This is executed when you view a specific role.
*/
public class ViewAction extends WorkflowPrepareAction {
+
+ LdapGroupManagerLocal ldapManager = LookupUtil.getLdapGroupManager();
+ RoleManagerLocal roleManager = LookupUtil.getRoleManager();
+ ResourceGroupManagerLocal groupManager = LookupUtil.getResourceGroupManager();
+
/**
*/
public ActionForward workflow(ComponentContext context, ActionMapping mapping, ActionForm form,
@@ -75,8 +81,8 @@ public class ViewAction extends WorkflowPrepareAction {
log.trace("group page control: " + pcg);
log.trace("ldap group page control: " + pcldap);
- RoleManagerLocal roleManager = LookupUtil.getRoleManager();
- ResourceGroupManagerLocal groupManager = LookupUtil.getResourceGroupManager();
+ // RoleManagerLocal roleManager = LookupUtil.getRoleManager();
+ // ResourceGroupManagerLocal groupManager = LookupUtil.getResourceGroupManager();
// get all the role permissions
Set<Permission> permissions = roleManager.getPermissions(roleId);
@@ -91,6 +97,7 @@ public class ViewAction extends WorkflowPrepareAction {
// get the subjects attached to the role
log.trace("getting users for role [" + roleId + "]");
+ // PageList<Subject> users = roleManager.findSubjectsByRole(roleId, pcu);
PageList<Subject> users = roleManager.findSubjectsByRole(roleId, pcu);
request.setAttribute(Constants.ROLE_USERS_ATTR, users);
@@ -104,7 +111,7 @@ public class ViewAction extends WorkflowPrepareAction {
request.setAttribute(Constants.NUM_RESGRPS_ATTR, new Integer(groups.getTotalSize()));
}
- PageList<LdapGroup> ldapGroups = roleManager.findLdapGroupsByRole(roleId, pcldap);
+ PageList<LdapGroup> ldapGroups = ldapManager.findLdapGroupsByRole(roleId, pcldap);
request.setAttribute(Constants.ROLE_LDAPGRPS_ATTR, ldapGroups);
if (ldapGroups == null) {
request.setAttribute(Constants.NUM_LDAPGRPS_ATTR, new Integer(0));
diff --git a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/user/RegisterAction.java b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/user/RegisterAction.java
index 9d4ec7a..91980ad 100644
--- a/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/user/RegisterAction.java
+++ b/modules/enterprise/gui/portal-war/src/main/java/org/rhq/enterprise/gui/admin/user/RegisterAction.java
@@ -23,6 +23,7 @@ import java.util.HashMap;
import java.util.List;
import java.util.Properties;
+import javax.ejb.EJBException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
@@ -44,10 +45,9 @@ import org.rhq.enterprise.gui.legacy.util.RequestUtils;
import org.rhq.enterprise.gui.legacy.util.SessionUtils;
import org.rhq.enterprise.server.RHQConstants;
import org.rhq.enterprise.server.auth.SubjectManagerLocal;
-import org.rhq.enterprise.server.authz.RoleManagerLocal;
import org.rhq.enterprise.server.exception.LdapCommunicationException;
import org.rhq.enterprise.server.exception.LdapFilterException;
-import org.rhq.enterprise.server.resource.group.LdapGroupManager;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.system.SystemManagerLocal;
import org.rhq.enterprise.server.util.LookupUtil;
@@ -55,6 +55,11 @@ import org.rhq.enterprise.server.util.LookupUtil;
* Registers a user. Triggered when authenticated via LDAP.
*/
public class RegisterAction extends BaseAction {
+
+ SubjectManagerLocal subjectManager = LookupUtil.getSubjectManager();
+ SystemManagerLocal systemManager = LookupUtil.getSystemManager();
+ LdapGroupManagerLocal ldapManager = LookupUtil.getLdapGroupManager();
+
/**
* Create the user with the attributes specified in the given <code>NewForm</code> and save it into the session
* attribute <code>Constants.USER_ATTR</code>.
@@ -96,7 +101,6 @@ public class RegisterAction extends BaseAction {
String password = (String) session.getAttribute(Constants.PASSWORD_SES_ATTR);
session.removeAttribute(Constants.PASSWORD_SES_ATTR);
- SubjectManagerLocal subjectManager = LookupUtil.getSubjectManager();
Subject superuser = subjectManager.getOverlord();
// create the subject, but don't add a principal since LDAP will handle authentication
@@ -118,8 +122,7 @@ public class RegisterAction extends BaseAction {
parms.put(Constants.USER_PARAM, newSubject.getId());
//BZ-580127: only do group authz check if one or both of group filter fields is set
- SystemManagerLocal manager = LookupUtil.getSystemManager();
- Properties options = manager.getSystemConfiguration();
+ Properties options = systemManager.getSystemConfiguration();
String groupFilter = (String) options.getProperty(RHQConstants.LDAPGroupFilter, "");
String groupMember = (String) options.getProperty(RHQConstants.LDAPGroupMember, "");
if ((groupFilter.trim().length() > 0) || (groupMember.trim().length() > 0)) {
@@ -127,11 +130,32 @@ public class RegisterAction extends BaseAction {
String provider = LookupUtil.getSystemManager().getSystemConfiguration().getProperty(
RHQConstants.JAASProvider);
if (RHQConstants.LDAPJAASProvider.equals(provider)) {
- List<String> groupNames = new ArrayList(LdapGroupManager.getInstance().findAvailableGroupsFor(
- newSubject.getName()));
- RoleManagerLocal roleManager = LookupUtil.getRoleManager();
- roleManager.assignRolesToLdapSubject(newSubject.getId(), groupNames);
-
+ List<String> groupNames = new ArrayList(ldapManager.findAvailableGroupsFor(newSubject.getName()));
+ ldapManager.assignRolesToLdapSubject(newSubject.getId(), groupNames);
+ }
+ } catch (EJBException ejx) {
+ //this is the exception type thrown now that we use SLSB.Local methods
+ // mine out other exceptions
+ Exception cause = ejx.getCausedByException();
+ if (cause == null) {
+ ActionMessages actionMessages = new ActionMessages();
+ actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage("errors.cam.general"));
+ saveErrors(request, actionMessages);
+ } else {
+ if (cause instanceof LdapFilterException) {
+ ActionMessages actionMessages = new ActionMessages();
+ actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(
+ "admin.role.LdapGroupFilterMessage"));
+ saveErrors(request, actionMessages);
+ } else if (cause instanceof LdapCommunicationException) {
+ ActionMessages actionMessages = new ActionMessages();
+ SystemManagerLocal manager = LookupUtil.getSystemManager();
+ options = manager.getSystemConfiguration();
+ String providerUrl = options.getProperty(RHQConstants.LDAPUrl, "(unavailable)");
+ actionMessages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(
+ "admin.role.LdapCommunicationMessage", providerUrl));
+ saveErrors(request, actionMessages);
+ }
}
} catch (LdapFilterException lce) {
ActionMessages actionMessages = new ActionMessages();
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerBean.java
index 8e4d96e..00d4c31 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerBean.java
@@ -20,9 +20,7 @@ package org.rhq.enterprise.server.authz;
import java.util.ArrayList;
import java.util.Arrays;
-import java.util.Collections;
import java.util.HashSet;
-import java.util.LinkedList;
import java.util.List;
import java.util.Set;
@@ -40,7 +38,6 @@ import org.rhq.core.domain.auth.Subject;
import org.rhq.core.domain.authz.Permission;
import org.rhq.core.domain.authz.Role;
import org.rhq.core.domain.criteria.RoleCriteria;
-import org.rhq.core.domain.resource.group.LdapGroup;
import org.rhq.core.domain.resource.group.ResourceGroup;
import org.rhq.core.domain.util.PageControl;
import org.rhq.core.domain.util.PageList;
@@ -91,29 +88,6 @@ public class RoleManagerBean implements RoleManagerLocal, RoleManagerRemote {
return roles;
}
- @Override
- public PageList<LdapGroup> findLdapGroupsByRole(int roleId, PageControl pageControl) {
- Role role = entityManager.find(Role.class, roleId);
- if (role == null) {
- throw new IllegalArgumentException("Could not find role[" + roleId + "] to lookup ldap Groups on");
- }
- return new PageList<LdapGroup>(role.getLdapGroups(), role.getLdapGroups().size(), pageControl);
- }
-
- public PageList<LdapGroup> findLdapGroups(PageControl pc) {
-
- pc.initDefaultOrderingField("g.name");
-
- String queryName = LdapGroup.QUERY_FIND_ALL;
- Query queryCount = PersistenceUtility.createCountQuery(entityManager, queryName);
- Query query = PersistenceUtility.createQueryWithOrderBy(entityManager, queryName, pc);
-
- long count = (Long) queryCount.getSingleResult();
- // List<Role> roles = query.getResultList();
- List<LdapGroup> groups = query.getResultList();
- return new PageList<LdapGroup>(groups, (int) count, pc);
- }
-
/**
* @see org.rhq.enterprise.server.authz.RoleManagerLocal#findRoles(PageControl)
*/
@@ -466,83 +440,6 @@ public class RoleManagerBean implements RoleManagerLocal, RoleManagerRemote {
}
}
- /**
- * @see org.rhq.enterprise.server.authz.RoleManagerLocal#addResourceGroupsToRole(Subject, int, int[])
- */
- @RequiredPermission(Permission.MANAGE_SECURITY)
- public void addLdapGroupsToRole(Subject subject, int roleId, List<String> groupIds) {
- if ((groupIds != null) && (groupIds.size() > 0)) {
- Role role = entityManager.find(Role.class, roleId);
- if (role == null) {
- throw new IllegalArgumentException("Could not find role[" + roleId + "] to add resourceGroups to");
- }
- role.getLdapGroups().size(); // load them in
-
- for (String groupId : groupIds) {
- LdapGroup group = new LdapGroup();
- group.setName(groupId);
- if (role == null) {
- throw new IllegalArgumentException("Tried to add ldapGroup[" + groupId + "] to role[" + roleId
- + "], but resourceGroup was not found");
- }
- role.addLdapGroup(group);
- }
- }
- }
-
- /**
- * @see org.rhq.enterprise.server.authz.RoleManagerLocal#removeLdapGroupsFromRole(Subject, int, int[])
- */
-
- @RequiredPermission(Permission.MANAGE_SECURITY)
- public void removeLdapGroupsFromRole(Subject subject, int roleId, int[] groupIds) {
- if ((groupIds != null) && (groupIds.length > 0)) {
- Role role = entityManager.find(Role.class, roleId);
- if (role == null) {
- throw new IllegalArgumentException("Could not find role[" + roleId + "] to remove resourceGroups from");
- }
- role.getLdapGroups().size(); // load them in
-
- for (Integer groupId : groupIds) {
- LdapGroup doomedGroup = entityManager.find(LdapGroup.class, groupId);
- if (doomedGroup == null) {
- throw new IllegalArgumentException("Tried to remove doomedGroup[" + groupId + "] from role["
- + roleId + "], but subject was not found");
- }
- role.removeLdapGroup(doomedGroup);
- }
-
- Query purgeQuery = entityManager.createNamedQuery(LdapGroup.DELETE_BY_ID);
-
- List<Integer> ids = new LinkedList<Integer>();
- for (int i : groupIds) {
- ids.add(i);
- }
- purgeQuery.setParameter("ids", ids);
- purgeQuery.executeUpdate();
- }
- }
-
- private List<Role> findRolesByLdapGroupNames(List<String> ldapGroupNames) {
- if (ldapGroupNames.isEmpty()) {
- return Collections.EMPTY_LIST;
- }
- Query query = entityManager.createNamedQuery(LdapGroup.FIND_BY_ROLES_GROUP_NAMES);
- query.setParameter("names", ldapGroupNames);
- return (List<Role>) query.getResultList();
- }
-
- public void assignRolesToLdapSubject(int subjectId, List<String> ldapGroupNames) {
- Subject sub = entityManager.find(Subject.class, subjectId);
- List<Role> roles = findRolesByLdapGroupNames(ldapGroupNames);
- sub.getRoles().clear();
- sub.getLdapRoles().clear();
- for (Role role : roles) {
- sub.addRole(role);
- sub.addLdapRole(role);
- }
- }
-
private void processDependentPermissions(Role role) {
/*
* if you can control user/roles, then you can give yourself permissions, too; so we might as well
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerLocal.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerLocal.java
index b89020f..58f962a 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerLocal.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/authz/RoleManagerLocal.java
@@ -18,7 +18,6 @@
*/
package org.rhq.enterprise.server.authz;
-import java.util.List;
import java.util.Set;
import javax.ejb.Local;
@@ -27,7 +26,6 @@ import org.rhq.core.domain.auth.Subject;
import org.rhq.core.domain.authz.Permission;
import org.rhq.core.domain.authz.Role;
import org.rhq.core.domain.criteria.RoleCriteria;
-import org.rhq.core.domain.resource.group.LdapGroup;
import org.rhq.core.domain.util.PageControl;
import org.rhq.core.domain.util.PageList;
@@ -161,8 +159,6 @@ public interface RoleManagerLocal {
Role getRole(Subject subject, int roleId);
- PageList<LdapGroup> findLdapGroupsByRole(int roleId, PageControl pageControl);
-
PageList<Role> findSubjectAssignedRoles(Subject subject, int subjectId, PageControl pc);
//This is a proxy of getAvailableRolesForSubject but without pendingRoleIds as required by remote spec
@@ -202,8 +198,6 @@ public interface RoleManagerLocal {
void addRolesToResourceGroup(Subject subject, int groupId, int[] roleIds);
- void addLdapGroupsToRole(Subject subject, int roleId, List<String> groupIds);
-
/**
* Removes the given resource groups from the given role.
*
@@ -215,11 +209,6 @@ public interface RoleManagerLocal {
void removeRolesFromResourceGroup(Subject subject, int groupId, int[] roleIds);
- void removeLdapGroupsFromRole(Subject subject, int roleId, int[] groupIds);
-
PageList<Role> findRolesByCriteria(Subject subject, RoleCriteria criteria);
- void assignRolesToLdapSubject(int subjectId, List<String> ldapGroupNames);
-
- PageList<LdapGroup> findLdapGroups(PageControl pc);
}
\ No newline at end of file
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/LdapLoginModule.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/LdapLoginModule.java
index d6fcaa7..d6e6ae8 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/LdapLoginModule.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/core/jaas/LdapLoginModule.java
@@ -45,7 +45,7 @@ import org.rhq.core.domain.util.PageControl;
import org.rhq.core.domain.util.PageList;
import org.rhq.enterprise.server.auth.SubjectManagerLocal;
import org.rhq.enterprise.server.authz.RoleManagerLocal;
-import org.rhq.enterprise.server.resource.group.LdapGroupManager;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.util.LookupUtil;
import org.rhq.enterprise.server.util.security.UntrustedSSLSocketFactory;
@@ -94,6 +94,8 @@ import org.rhq.enterprise.server.util.security.UntrustedSSLSocketFactory;
public class LdapLoginModule extends UsernamePasswordLoginModule {
private Log log = LogFactory.getLog(LdapLoginModule.class);
+ LdapGroupManagerLocal ldapManager = LookupUtil.getLdapGroupManager();
+
// The delimimiter to use when specifiying multiple BaseDN's.
private static final String BASEDN_DELIMITER = ";";
@@ -218,11 +220,11 @@ public class LdapLoginModule extends UsernamePasswordLoginModule {
//BUT still must always return true as authz is handled by RHQ if roles/groups correct
//retrieve all ldap groups that this user is authorized for based on ldap group filter and group member settings
- Set<String> authorizedLdapGroups = LdapGroupManager.getInstance().findAvailableGroupsFor(userName);
+ Set<String> authorizedLdapGroups = ldapManager.findAvailableGroupsFor(userName);
RoleManagerLocal roleManager = LookupUtil.getRoleManager();
//find all currently mapped ldap groups
- PageList<LdapGroup> allCurrentLdapGroupsRegistered = roleManager.findLdapGroups(PageControl
+ PageList<LdapGroup> allCurrentLdapGroupsRegistered = ldapManager.findLdapGroups(PageControl
.getUnlimitedInstance());
//find all roles for currently mapped ldap groups.
@@ -239,7 +241,7 @@ public class LdapLoginModule extends UsernamePasswordLoginModule {
//else add this subject back to all AuthoriziedLdapGroups
//lookup all roles that map to the authorizedLdapGroup names
List authorizedList = new ArrayList(authorizedLdapGroups);
- roleManager.assignRolesToLdapSubject(ldapSubject.getId(), authorizedList);
+ ldapManager.assignRolesToLdapSubject(ldapSubject.getId(), authorizedList);
}
return true;
}
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManager.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManager.java
deleted file mode 100644
index e372777..0000000
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManager.java
+++ /dev/null
@@ -1,304 +0,0 @@
-/*
- * RHQ Management Platform
- * Copyright (C) 2005-2009 Red Hat, Inc.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation version 2 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-package org.rhq.enterprise.server.resource.group;
-
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Properties;
-import java.util.Set;
-
-import javax.naming.Context;
-import javax.naming.NamingEnumeration;
-import javax.naming.NamingException;
-import javax.naming.directory.Attribute;
-import javax.naming.directory.InvalidSearchFilterException;
-import javax.naming.directory.SearchControls;
-import javax.naming.directory.SearchResult;
-import javax.naming.ldap.InitialLdapContext;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import org.rhq.enterprise.server.RHQConstants;
-import org.rhq.enterprise.server.exception.LdapCommunicationException;
-import org.rhq.enterprise.server.exception.LdapFilterException;
-import org.rhq.enterprise.server.system.SystemManagerLocal;
-import org.rhq.enterprise.server.util.LookupUtil;
-import org.rhq.enterprise.server.util.security.UntrustedSSLSocketFactory;
-
-/**
- * @author paji
- */
-public class LdapGroupManager {
- private static final LdapGroupManager INSTANCE = new LdapGroupManager();
- private static final String BASEDN_DELIMITER = ";";
- private Log log = LogFactory.getLog(LdapGroupManager.class);
-
- private LdapGroupManager() {
- }
-
- public static LdapGroupManager getInstance() {
- return INSTANCE;
- }
-
- public Set<Map<String, String>> findAvailableGroups() {
- SystemManagerLocal manager = LookupUtil.getSystemManager();
-
- Properties options = manager.getSystemConfiguration();
- String groupFilter = (String) options.get(RHQConstants.LDAPGroupFilter);
- String filter = String.format("(%s)", groupFilter);
-
- return buildGroup(options, filter);
- }
-
- public Set<String> findAvailableGroupsFor(String userName) {
- SystemManagerLocal manager = LookupUtil.getSystemManager();
- Properties options = manager.getSystemConfiguration();
- String groupFilter = (String) options.getProperty(RHQConstants.LDAPGroupFilter, "");
- String groupMember = (String) options.getProperty(RHQConstants.LDAPGroupMember, "");
- String userDN = getUserDN(options, userName);
- //TODO: spinder 4/21/10 put in error/debug logging messages for badly formatted filter combinations
- String filter = "";
- //form assumes examples where groupFilter is like 'objecclass=groupOfNames' and groupMember is 'member'
- // to produce ldaf filter like (&(objecclass=groupOfNames)(member=cn=Administrator,ou=People,dc=test,dc=com))
- filter = String.format("(&(%s)(%s=%s))", groupFilter, groupMember, userDN);
-
- Set<Map<String, String>> matched = buildGroup(options, filter);
-
- Set<String> ldapSet = new HashSet<String>();
- for (Map<String, String> match : matched) {
- ldapSet.add(match.get("id"));
- }
- return ldapSet;
- }
-
- private String getUserDN(Properties options, String userName) {
- // Load our LDAP specific properties
- Properties env = getProperties(options);
-
- // Load the BaseDN
- // Load the BaseDN
- String baseDN = (String) options.get(RHQConstants.LDAPBaseDN);
-
- // Load the LoginProperty
- String loginProperty = (String) options.get(RHQConstants.LDAPLoginProperty);
- if (loginProperty == null) {
- // Use the default
- loginProperty = "cn";
- }
- // Load any information we may need to bind
- String bindDN = (String) options.get(RHQConstants.LDAPBindDN);
- String bindPW = (String) options.get(RHQConstants.LDAPBindPW);
-
- // Load any search filter
- String searchFilter = (String) options.get(RHQConstants.LDAPFilter);
- if (bindDN != null) {
- env.setProperty(Context.SECURITY_PRINCIPAL, bindDN);
- env.setProperty(Context.SECURITY_CREDENTIALS, bindPW);
- env.setProperty(Context.SECURITY_AUTHENTICATION, "simple");
- }
-
- try {
- InitialLdapContext ctx = new InitialLdapContext(env, null);
- SearchControls searchControls = getSearchControls();
-
- // Add the search filter if specified. This only allows for a single search filter.. i.e. foo=bar.
- String filter;
- if ((searchFilter != null) && (searchFilter.length() != 0)) {
- filter = "(&(" + loginProperty + "=" + userName + ")" + "(" + searchFilter + "))";
- } else {
- filter = "(" + loginProperty + "=" + userName + ")";
- }
-
- log.debug("Using LDAP filter=" + filter);
-
- // Loop through each configured base DN. It may be useful
- // in the future to allow for a filter to be configured for
- // each BaseDN, but for now the filter will apply to all.
- String[] baseDNs = baseDN.split(BASEDN_DELIMITER);
- for (int x = 0; x < baseDNs.length; x++) {
- NamingEnumeration answer = ctx.search(baseDNs[x], filter, searchControls);
- if (!answer.hasMoreElements()) { //BZ:582471- ldap api bug change
- log.debug("User " + userName + " not found for BaseDN " + baseDNs[x]);
- // Nothing found for this DN, move to the next one if we have one.
- continue;
- }
-
- // We use the first match
- SearchResult si = (SearchResult) answer.next();
-
- // Construct the UserDN
- String userDN = si.getName() + "," + baseDNs[x];
- return userDN;
- }
-
- // If we try all the BaseDN's and have not found a match, return false
- return "";
- } catch (NamingException e) {
- throw new RuntimeException(e);
- }
- }
-
- /**
- * @throws NamingException
- * @see org.jboss.security.auth.spi.UsernamePasswordLoginModule#validatePassword(java.lang.String,java.lang.String)
- */
- protected Set<Map<String, String>> buildGroup(Properties options, String filter) {
- Set<Map<String, String>> ret = new HashSet<Map<String, String>>();
- // Load our LDAP specific properties
- Properties env = getProperties(options);
-
- // Load the BaseDN
- String baseDN = (String) options.get(RHQConstants.LDAPBaseDN);
-
- // Load the LoginProperty
- String loginProperty = (String) options.get(RHQConstants.LDAPLoginProperty);
- if (loginProperty == null) {
- // Use the default
- loginProperty = "cn";
- }
- // Load any information we may need to bind
- String bindDN = (String) options.get(RHQConstants.LDAPBindDN);
- String bindPW = (String) options.get(RHQConstants.LDAPBindPW);
- if (bindDN != null) {
- env.setProperty(Context.SECURITY_PRINCIPAL, bindDN);
- env.setProperty(Context.SECURITY_CREDENTIALS, bindPW);
- env.setProperty(Context.SECURITY_AUTHENTICATION, "simple");
- }
- try {
- InitialLdapContext ctx = new InitialLdapContext(env, null);
- SearchControls searchControls = getSearchControls();
- /*String filter = "(&(objectclass=groupOfUniqueNames)(uniqueMember=uid=" + userName
- + ",ou=People, dc=rhndev, dc=redhat, dc=com))";*/
-
- // Loop through each configured base DN. It may be useful
- // in the future to allow for a filter to be configured for
- // each BaseDN, but for now the filter will apply to all.
- String[] baseDNs = baseDN.split(BASEDN_DELIMITER);
-
- for (int x = 0; x < baseDNs.length; x++) {
- NamingEnumeration answer = ctx.search(baseDNs[x], filter, searchControls);
- boolean ldapApiEnumerationBugEncountered = false;
- while ((!ldapApiEnumerationBugEncountered) && answer.hasMoreElements()) {//BZ:582471- ldap api bug change
- // We use the first match
- SearchResult si = null;
- try {
- si = (SearchResult) answer.next();
- } catch (NullPointerException npe) {
- ldapApiEnumerationBugEncountered = true;
- break;
- }
- Map<String, String> entry = new HashMap<String, String>();
- String name = (String) si.getAttributes().get("cn").get();
- name = name.trim();
- Attribute desc = si.getAttributes().get("description");
- String description = desc != null ? (String) desc.get() : "";
- description = description.trim();
- entry.put("id", name);
- entry.put("name", name);
- entry.put("description", description);
- ret.add(entry);
- }
- }
- } catch (NamingException e) {
- if (e instanceof InvalidSearchFilterException) {
- InvalidSearchFilterException fException = (InvalidSearchFilterException) e;
- String message = "The ldap group filter defined is invalid ";
- log.error(message, fException);
- throw new LdapFilterException(message + " " + fException.getMessage());
- }
- //TODO: check for ldap connection/unavailable/etc. exceptions.
- else {
- log.error("LDAP communication error: " + e.getMessage(), e);
- throw new LdapCommunicationException(e);
- }
- }
-
- return ret;
- }
-
- /**
- * Load a default set of properties to use when connecting to the LDAP server. If basic authentication is needed,
- * the caller must set Context.SECURITY_PRINCIPAL, Context.SECURITY_CREDENTIALS and Context.SECURITY_AUTHENTICATION
- * appropriately.
- *
- * @return properties that are to be used when connecting to LDAP server
- */
- private Properties getProperties(Properties options) {
- Properties env = new Properties(options);
- // Set our default factory name if one is not given
- String factoryName = env.getProperty(RHQConstants.LDAPFactory);
- env.setProperty(Context.INITIAL_CONTEXT_FACTORY, factoryName);
-
- // Setup SSL if requested
- String protocol = env.getProperty(RHQConstants.LDAPProtocol);
- if ((protocol != null) && protocol.equals("ssl")) {
- String ldapSocketFactory = env.getProperty("java.naming.ldap.factory.socket");
- if (ldapSocketFactory == null) {
- env.put("java.naming.ldap.factory.socket", UntrustedSSLSocketFactory.class.getName());
- }
- env.put(Context.SECURITY_PROTOCOL, "ssl");
- }
-
- // Set the LDAP url
- String providerUrl = env.getProperty(RHQConstants.LDAPUrl);
- if (providerUrl == null) {
- providerUrl = "ldap://localhost:" + (((protocol != null) && protocol.equals("ssl")) ? "636" : "389");
- }
-
- env.setProperty(Context.PROVIDER_URL, providerUrl);
-
- // Follow referrals automatically
- env.setProperty(Context.REFERRAL, "ignore"); //BZ:582471- active directory query change
-
- return env;
- }
-
- /**
- * A simple method to construct a SearchControls object for use when doing LDAP searches. All of the defaults are
- * used, with the exception of the scope, which is set to SUBTREE rather than the default of ONE_LEVEL
- *
- * @return controls what is searched in LDAP
- */
- private SearchControls getSearchControls() {
- // Set the scope to subtree, default is one-level
- int scope = SearchControls.SUBTREE_SCOPE;
-
- // No limit on the time waiting for a response
- int timeLimit = 0;
-
- // No limit on the number of entries returned
- long countLimit = 0;
-
- // Attributes to return.
- String[] returnedAttributes = null;
-
- // Don't return the object
- boolean returnObject = false;
-
- // No dereferencing during the search
- boolean deference = false;
-
- SearchControls constraints = new SearchControls(scope, countLimit, timeLimit, returnedAttributes, returnObject,
- deference);
- return constraints;
- }
-}
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerBean.java
new file mode 100644
index 0000000..63e36db
--- /dev/null
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerBean.java
@@ -0,0 +1,426 @@
+/*
+ * RHQ Management Platform
+ * Copyright (C) 2005-2009 Red Hat, Inc.
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+package org.rhq.enterprise.server.resource.group;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+
+import javax.ejb.EJB;
+import javax.ejb.Stateless;
+import javax.naming.Context;
+import javax.naming.NamingEnumeration;
+import javax.naming.NamingException;
+import javax.naming.directory.Attribute;
+import javax.naming.directory.InvalidSearchFilterException;
+import javax.naming.directory.SearchControls;
+import javax.naming.directory.SearchResult;
+import javax.naming.ldap.InitialLdapContext;
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceContext;
+import javax.persistence.Query;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.rhq.core.domain.auth.Subject;
+import org.rhq.core.domain.authz.Permission;
+import org.rhq.core.domain.authz.Role;
+import org.rhq.core.domain.resource.group.LdapGroup;
+import org.rhq.core.domain.util.PageControl;
+import org.rhq.core.domain.util.PageList;
+import org.rhq.core.server.PersistenceUtility;
+import org.rhq.enterprise.server.RHQConstants;
+import org.rhq.enterprise.server.auth.SubjectManagerLocal;
+import org.rhq.enterprise.server.authz.RequiredPermission;
+import org.rhq.enterprise.server.exception.LdapCommunicationException;
+import org.rhq.enterprise.server.exception.LdapFilterException;
+import org.rhq.enterprise.server.system.SystemManagerLocal;
+import org.rhq.enterprise.server.util.security.UntrustedSSLSocketFactory;
+
+/**
+ * This bean provides functionality to manipulate the ldap auth/authz funcitonality.
+ * That is, adding/modifying/deleting ldap group/users and their
+ * associated subjects and permissions are performed by this manager.
+ * @author paji
+ * @author Simeon Pinder
+ */
+@Stateless
+public class LdapGroupManagerBean implements LdapGroupManagerLocal {
+
+ // private static final LdapGroupManagerBean INSTANCE = new LdapGroupManagerBean();
+ private Log log = LogFactory.getLog(LdapGroupManagerBean.class);
+
+ private static final String BASEDN_DELIMITER = ";";
+
+ @PersistenceContext(unitName = RHQConstants.PERSISTENCE_UNIT_NAME)
+ private EntityManager entityManager;
+
+ @EJB
+ private SubjectManagerLocal subjectManager;
+
+ @EJB
+ private SystemManagerLocal systemManager;
+
+ public Set<Map<String, String>> findAvailableGroups() {
+ Properties options = systemManager.getSystemConfiguration();
+ String groupFilter = (String) options.get(RHQConstants.LDAPGroupFilter);
+ String filter = String.format("(%s)", groupFilter);
+
+ return buildGroup(options, filter);
+ }
+
+ public Set<String> findAvailableGroupsFor(String userName) {
+ Properties options = systemManager.getSystemConfiguration();
+ String groupFilter = (String) options.getProperty(RHQConstants.LDAPGroupFilter, "");
+ String groupMember = (String) options.getProperty(RHQConstants.LDAPGroupMember, "");
+ String userDN = getUserDN(options, userName);
+ //TODO: spinder 4/21/10 put in error/debug logging messages for badly formatted filter combinations
+ String filter = "";
+ //form assumes examples where groupFilter is like 'objecclass=groupOfNames' and groupMember is 'member'
+ // to produce ldaf filter like (&(objecclass=groupOfNames)(member=cn=Administrator,ou=People,dc=test,dc=com))
+ filter = String.format("(&(%s)(%s=%s))", groupFilter, groupMember, userDN);
+
+ Set<Map<String, String>> matched = buildGroup(options, filter);
+
+ Set<String> ldapSet = new HashSet<String>();
+ for (Map<String, String> match : matched) {
+ ldapSet.add(match.get("id"));
+ }
+ return ldapSet;
+ }
+
+ /**
+ * @see org.rhq.enterprise.server.authz.RoleManagerLocal#addResourceGroupsToRole(Subject, int, int[])
+ */
+ @RequiredPermission(Permission.MANAGE_SECURITY)
+ public void addLdapGroupsToRole(Subject subject, int roleId, List<String> groupIds) {
+ if ((groupIds != null) && (groupIds.size() > 0)) {
+ Role role = entityManager.find(Role.class, roleId);
+ if (role == null) {
+ throw new IllegalArgumentException("Could not find role[" + roleId + "] to add resourceGroups to");
+ }
+ role.getLdapGroups().size(); // load them in
+
+ for (String groupId : groupIds) {
+ LdapGroup group = new LdapGroup();
+ group.setName(groupId);
+ if (role == null) {
+ throw new IllegalArgumentException("Tried to add ldapGroup[" + groupId + "] to role[" + roleId
+ + "], but resourceGroup was not found");
+ }
+ role.addLdapGroup(group);
+ }
+ }
+ }
+
+ /**
+ * @see org.rhq.enterprise.server.authz.RoleManagerLocal#removeLdapGroupsFromRole(Subject, int, int[])
+ */
+
+ @RequiredPermission(Permission.MANAGE_SECURITY)
+ public void removeLdapGroupsFromRole(Subject subject, int roleId, int[] groupIds) {
+ if ((groupIds != null) && (groupIds.length > 0)) {
+ Role role = entityManager.find(Role.class, roleId);
+ if (role == null) {
+ throw new IllegalArgumentException("Could not find role[" + roleId + "] to remove resourceGroups from");
+ }
+ role.getLdapGroups().size(); // load them in
+
+ for (Integer groupId : groupIds) {
+ LdapGroup doomedGroup = entityManager.find(LdapGroup.class, groupId);
+ if (doomedGroup == null) {
+ throw new IllegalArgumentException("Tried to remove doomedGroup[" + groupId + "] from role["
+ + roleId + "], but subject was not found");
+ }
+ role.removeLdapGroup(doomedGroup);
+ }
+
+ Query purgeQuery = entityManager.createNamedQuery(LdapGroup.DELETE_BY_ID);
+
+ List<Integer> ids = new LinkedList<Integer>();
+ for (int i : groupIds) {
+ ids.add(i);
+ }
+ purgeQuery.setParameter("ids", ids);
+ purgeQuery.executeUpdate();
+ }
+ }
+
+ private List<Role> findRolesByLdapGroupNames(List<String> ldapGroupNames) {
+ if (ldapGroupNames.isEmpty()) {
+ return Collections.EMPTY_LIST;
+ }
+ Query query = entityManager.createNamedQuery(LdapGroup.FIND_BY_ROLES_GROUP_NAMES);
+ query.setParameter("names", ldapGroupNames);
+ return (List<Role>) query.getResultList();
+ }
+
+ public void assignRolesToLdapSubject(int subjectId, List<String> ldapGroupNames) {
+ Subject sub = entityManager.find(Subject.class, subjectId);
+ List<Role> roles = findRolesByLdapGroupNames(ldapGroupNames);
+ sub.getRoles().clear();
+ sub.getLdapRoles().clear();
+ for (Role role : roles) {
+ sub.addRole(role);
+ sub.addLdapRole(role);
+ }
+ }
+
+ @Override
+ public PageList<LdapGroup> findLdapGroupsByRole(int roleId, PageControl pageControl) {
+ Role role = entityManager.find(Role.class, roleId);
+ if (role == null) {
+ throw new IllegalArgumentException("Could not find role[" + roleId + "] to lookup ldap Groups on");
+ }
+ return new PageList<LdapGroup>(role.getLdapGroups(), role.getLdapGroups().size(), pageControl);
+ }
+
+ public PageList<LdapGroup> findLdapGroups(PageControl pc) {
+
+ pc.initDefaultOrderingField("g.name");
+
+ String queryName = LdapGroup.QUERY_FIND_ALL;
+ Query queryCount = PersistenceUtility.createCountQuery(entityManager, queryName);
+ Query query = PersistenceUtility.createQueryWithOrderBy(entityManager, queryName, pc);
+
+ long count = (Long) queryCount.getSingleResult();
+ // List<Role> roles = query.getResultList();
+ List<LdapGroup> groups = query.getResultList();
+ return new PageList<LdapGroup>(groups, (int) count, pc);
+ }
+
+ private String getUserDN(Properties options, String userName) {
+ // Load our LDAP specific properties
+ Properties env = getProperties(options);
+
+ // Load the BaseDN
+ // Load the BaseDN
+ String baseDN = (String) options.get(RHQConstants.LDAPBaseDN);
+
+ // Load the LoginProperty
+ String loginProperty = (String) options.get(RHQConstants.LDAPLoginProperty);
+ if (loginProperty == null) {
+ // Use the default
+ loginProperty = "cn";
+ }
+ // Load any information we may need to bind
+ String bindDN = (String) options.get(RHQConstants.LDAPBindDN);
+ String bindPW = (String) options.get(RHQConstants.LDAPBindPW);
+
+ // Load any search filter
+ String searchFilter = (String) options.get(RHQConstants.LDAPFilter);
+ if (bindDN != null) {
+ env.setProperty(Context.SECURITY_PRINCIPAL, bindDN);
+ env.setProperty(Context.SECURITY_CREDENTIALS, bindPW);
+ env.setProperty(Context.SECURITY_AUTHENTICATION, "simple");
+ }
+
+ try {
+ InitialLdapContext ctx = new InitialLdapContext(env, null);
+ SearchControls searchControls = getSearchControls();
+
+ // Add the search filter if specified. This only allows for a single search filter.. i.e. foo=bar.
+ String filter;
+ if ((searchFilter != null) && (searchFilter.length() != 0)) {
+ filter = "(&(" + loginProperty + "=" + userName + ")" + "(" + searchFilter + "))";
+ } else {
+ filter = "(" + loginProperty + "=" + userName + ")";
+ }
+
+ log.debug("Using LDAP filter=" + filter);
+
+ // Loop through each configured base DN. It may be useful
+ // in the future to allow for a filter to be configured for
+ // each BaseDN, but for now the filter will apply to all.
+ String[] baseDNs = baseDN.split(BASEDN_DELIMITER);
+ for (int x = 0; x < baseDNs.length; x++) {
+ NamingEnumeration answer = ctx.search(baseDNs[x], filter, searchControls);
+ if (!answer.hasMoreElements()) { //BZ:582471- ldap api bug change
+ log.debug("User " + userName + " not found for BaseDN " + baseDNs[x]);
+ // Nothing found for this DN, move to the next one if we have one.
+ continue;
+ }
+
+ // We use the first match
+ SearchResult si = (SearchResult) answer.next();
+
+ // Construct the UserDN
+ String userDN = si.getName() + "," + baseDNs[x];
+ return userDN;
+ }
+
+ // If we try all the BaseDN's and have not found a match, return false
+ return "";
+ } catch (NamingException e) {
+ throw new RuntimeException(e);
+ }
+ }
+
+ /**
+ * @throws NamingException
+ * @see org.jboss.security.auth.spi.UsernamePasswordLoginModule#validatePassword(java.lang.String,java.lang.String)
+ */
+ protected Set<Map<String, String>> buildGroup(Properties options, String filter) {
+ Set<Map<String, String>> ret = new HashSet<Map<String, String>>();
+ // Load our LDAP specific properties
+ Properties env = getProperties(options);
+
+ // Load the BaseDN
+ String baseDN = (String) options.get(RHQConstants.LDAPBaseDN);
+
+ // Load the LoginProperty
+ String loginProperty = (String) options.get(RHQConstants.LDAPLoginProperty);
+ if (loginProperty == null) {
+ // Use the default
+ loginProperty = "cn";
+ }
+ // Load any information we may need to bind
+ String bindDN = (String) options.get(RHQConstants.LDAPBindDN);
+ String bindPW = (String) options.get(RHQConstants.LDAPBindPW);
+ if (bindDN != null) {
+ env.setProperty(Context.SECURITY_PRINCIPAL, bindDN);
+ env.setProperty(Context.SECURITY_CREDENTIALS, bindPW);
+ env.setProperty(Context.SECURITY_AUTHENTICATION, "simple");
+ }
+ try {
+ InitialLdapContext ctx = new InitialLdapContext(env, null);
+ SearchControls searchControls = getSearchControls();
+ /*String filter = "(&(objectclass=groupOfUniqueNames)(uniqueMember=uid=" + userName
+ + ",ou=People, dc=rhndev, dc=redhat, dc=com))";*/
+
+ // Loop through each configured base DN. It may be useful
+ // in the future to allow for a filter to be configured for
+ // each BaseDN, but for now the filter will apply to all.
+ String[] baseDNs = baseDN.split(BASEDN_DELIMITER);
+
+ for (int x = 0; x < baseDNs.length; x++) {
+ NamingEnumeration answer = ctx.search(baseDNs[x], filter, searchControls);
+ boolean ldapApiEnumerationBugEncountered = false;
+ while ((!ldapApiEnumerationBugEncountered) && answer.hasMoreElements()) {//BZ:582471- ldap api bug change
+ // We use the first match
+ SearchResult si = null;
+ try {
+ si = (SearchResult) answer.next();
+ } catch (NullPointerException npe) {
+ ldapApiEnumerationBugEncountered = true;
+ break;
+ }
+ Map<String, String> entry = new HashMap<String, String>();
+ String name = (String) si.getAttributes().get("cn").get();
+ name = name.trim();
+ Attribute desc = si.getAttributes().get("description");
+ String description = desc != null ? (String) desc.get() : "";
+ description = description.trim();
+ entry.put("id", name);
+ entry.put("name", name);
+ entry.put("description", description);
+ ret.add(entry);
+ }
+ }
+ } catch (NamingException e) {
+ if (e instanceof InvalidSearchFilterException) {
+ InvalidSearchFilterException fException = (InvalidSearchFilterException) e;
+ String message = "The ldap group filter defined is invalid ";
+ log.error(message, fException);
+ throw new LdapFilterException(message + " " + fException.getMessage());
+ }
+ //TODO: check for ldap connection/unavailable/etc. exceptions.
+ else {
+ log.error("LDAP communication error: " + e.getMessage(), e);
+ throw new LdapCommunicationException(e);
+ }
+ }
+
+ return ret;
+ }
+
+ /**
+ * Load a default set of properties to use when connecting to the LDAP server. If basic authentication is needed,
+ * the caller must set Context.SECURITY_PRINCIPAL, Context.SECURITY_CREDENTIALS and Context.SECURITY_AUTHENTICATION
+ * appropriately.
+ *
+ * @return properties that are to be used when connecting to LDAP server
+ */
+ private Properties getProperties(Properties options) {
+ Properties env = new Properties(options);
+ // Set our default factory name if one is not given
+ String factoryName = env.getProperty(RHQConstants.LDAPFactory);
+ env.setProperty(Context.INITIAL_CONTEXT_FACTORY, factoryName);
+
+ // Setup SSL if requested
+ String protocol = env.getProperty(RHQConstants.LDAPProtocol);
+ if ((protocol != null) && protocol.equals("ssl")) {
+ String ldapSocketFactory = env.getProperty("java.naming.ldap.factory.socket");
+ if (ldapSocketFactory == null) {
+ env.put("java.naming.ldap.factory.socket", UntrustedSSLSocketFactory.class.getName());
+ }
+ env.put(Context.SECURITY_PROTOCOL, "ssl");
+ }
+
+ // Set the LDAP url
+ String providerUrl = env.getProperty(RHQConstants.LDAPUrl);
+ if (providerUrl == null) {
+ providerUrl = "ldap://localhost:" + (((protocol != null) && protocol.equals("ssl")) ? "636" : "389");
+ }
+
+ env.setProperty(Context.PROVIDER_URL, providerUrl);
+
+ // Follow referrals automatically
+ env.setProperty(Context.REFERRAL, "ignore"); //BZ:582471- active directory query change
+
+ return env;
+ }
+
+ /**
+ * A simple method to construct a SearchControls object for use when doing LDAP searches. All of the defaults are
+ * used, with the exception of the scope, which is set to SUBTREE rather than the default of ONE_LEVEL
+ *
+ * @return controls what is searched in LDAP
+ */
+ private SearchControls getSearchControls() {
+ // Set the scope to subtree, default is one-level
+ int scope = SearchControls.SUBTREE_SCOPE;
+
+ // No limit on the time waiting for a response
+ int timeLimit = 0;
+
+ // No limit on the number of entries returned
+ long countLimit = 0;
+
+ // Attributes to return.
+ String[] returnedAttributes = null;
+
+ // Don't return the object
+ boolean returnObject = false;
+
+ // No dereferencing during the search
+ boolean deference = false;
+
+ SearchControls constraints = new SearchControls(scope, countLimit, timeLimit, returnedAttributes, returnObject,
+ deference);
+ return constraints;
+ }
+}
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerLocal.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerLocal.java
new file mode 100644
index 0000000..6709b32
--- /dev/null
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/group/LdapGroupManagerLocal.java
@@ -0,0 +1,53 @@
+/*
+ * RHQ Management Platform
+ * Copyright (C) 2005-2008 Red Hat, Inc.
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+package org.rhq.enterprise.server.resource.group;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import javax.ejb.Local;
+
+import org.rhq.core.domain.auth.Subject;
+import org.rhq.core.domain.resource.group.LdapGroup;
+import org.rhq.core.domain.util.PageControl;
+import org.rhq.core.domain.util.PageList;
+
+/**
+ * A manager that provides methods for creating, updating, deleting, and querying {@link LdapGroup}s.
+ *
+ * @author Simeon Pinder
+ */
+@Local
+public interface LdapGroupManagerLocal {
+
+ PageList<LdapGroup> findLdapGroupsByRole(int roleId, PageControl pageControl);
+
+ PageList<LdapGroup> findLdapGroups(PageControl pc);
+
+ void addLdapGroupsToRole(Subject subject, int roleId, List<String> groupIds);
+
+ void removeLdapGroupsFromRole(Subject subject, int roleId, int[] groupIds);
+
+ void assignRolesToLdapSubject(int subjectId, List<String> ldapGroupNames);
+
+ Set<Map<String, String>> findAvailableGroups();
+
+ Set<String> findAvailableGroupsFor(String userName);
+}
\ No newline at end of file
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/util/LookupUtil.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/util/LookupUtil.java
index c21526a..e5171e9 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/util/LookupUtil.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/util/LookupUtil.java
@@ -155,6 +155,8 @@ import org.rhq.enterprise.server.resource.ResourceTypeManagerLocal;
import org.rhq.enterprise.server.resource.ResourceTypeManagerRemote;
import org.rhq.enterprise.server.resource.cluster.ClusterManagerBean;
import org.rhq.enterprise.server.resource.cluster.ClusterManagerLocal;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerBean;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.resource.group.ResourceGroupManagerBean;
import org.rhq.enterprise.server.resource.group.ResourceGroupManagerLocal;
import org.rhq.enterprise.server.resource.group.definition.GroupDefinitionExpressionBuilderManagerBean;
@@ -655,4 +657,8 @@ public final class LookupUtil {
return lookupLocal(DataAccessManagerBean.class);
}
+ public static LdapGroupManagerLocal getLdapGroupManager() {
+ return lookupLocal(LdapGroupManagerBean.class);
+ }
+
}
\ No newline at end of file
diff --git a/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/RoleManagerBeanTest.java b/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/RoleManagerBeanTest.java
index 2315ee8..c0ae4d9 100644
--- a/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/RoleManagerBeanTest.java
+++ b/modules/enterprise/server/jar/src/test/java/org/rhq/enterprise/server/authz/test/RoleManagerBeanTest.java
@@ -33,6 +33,7 @@ import org.rhq.core.domain.util.PageList;
import org.rhq.enterprise.server.auth.SubjectManagerLocal;
import org.rhq.enterprise.server.authz.PermissionException;
import org.rhq.enterprise.server.authz.RoleManagerLocal;
+import org.rhq.enterprise.server.resource.group.LdapGroupManagerLocal;
import org.rhq.enterprise.server.test.AbstractEJB3Test;
import org.rhq.enterprise.server.util.LookupUtil;
@@ -43,6 +44,7 @@ import org.rhq.enterprise.server.util.LookupUtil;
public class RoleManagerBeanTest extends AbstractEJB3Test {
private SubjectManagerLocal subjectManager;
private RoleManagerLocal roleManager;
+ private LdapGroupManagerLocal ldapManager;
/**
* Prepares things for the entire test class.
@@ -51,6 +53,7 @@ public class RoleManagerBeanTest extends AbstractEJB3Test {
public void beforeClass() {
roleManager = LookupUtil.getRoleManager();
subjectManager = LookupUtil.getSubjectManager();
+ ldapManager = LookupUtil.getLdapGroupManager();
}
/**
@@ -263,7 +266,7 @@ public class RoleManagerBeanTest extends AbstractEJB3Test {
LdapGroup group = new LdapGroup();
group.setName("Foo");
role.addLdapGroup(group);
- assert roleManager.findLdapGroupsByRole(role.getId(), PageControl.getUnlimitedInstance()).size() == 1 : "Ldap Group Foo Should be assigned";
+ assert ldapManager.findLdapGroupsByRole(role.getId(), PageControl.getUnlimitedInstance()).size() == 1 : "Ldap Group Foo Should be assigned";
} finally {
getTransactionManager().rollback();
}