001: /*
002: * DSameDatabaseSecurityModule.java
003: *
004: * Created on October 25, 2006, 9:48 AM
005: *
006: * To change this template, choose Tools | Template Manager
007: * and open the template in the editor.
008: */
009:
010: package com.sun.portal.search.rdmserver;
011:
012: import com.iplanet.am.sdk.AMStoreConnection;
013: import com.iplanet.am.sdk.AMUser;
014: import com.iplanet.am.util.AdminUtils;
015: import com.iplanet.am.util.SystemProperties;
016: import com.iplanet.sso.SSOToken;
017: import com.sun.portal.search.db.DatabaseSecurityModule;
018: import com.sun.portal.search.db.SToken;
019: import com.sun.portal.search.rdm.RDMException;
020: import com.sun.portal.search.soif.SOIF;
021: import com.sun.portal.search.util.SearchConfig;
022: import com.sun.portal.search.util.SearchLogger;
023: import java.util.Enumeration;
024: import java.util.HashSet;
025: import java.util.Set;
026: import java.util.logging.Level;
027:
028: public class DSameDatabaseSecurityModule implements
029: DatabaseSecurityModule {
030: static boolean group_support = false;
031: static final String ADMIN_CN = "cn=Top-level Admin Role";
032: static String role_admin = null;
033: boolean enabled = true;
034: static public final String myName = "DsameRolesACL";
035:
036: /** Creates a new instance of DSameDatabaseSecurityModule */
037: public DSameDatabaseSecurityModule() {
038: String admin = SearchConfig
039: .getValue(SearchConfig.SECSUPERADMIN);
040: if (admin != null) {
041: role_admin = admin;
042: SearchLogger.getLogger().log(Level.FINEST,
043: "PSSP_CSPSRDMS0001", role_admin);
044: } else {
045: String ts = SystemProperties
046: .get("com.iplanet.am.rootsuffix");
047: if (ts != null) {
048: ts = "," + ts;
049: } else {
050: String userDN = AdminUtils.getAdminDN();
051: SearchLogger.getLogger().log(Level.FINEST,
052: "PSSP_CSPSRDMS0002", userDN);
053: int i = 0;
054: if (userDN != null)
055: i = userDN.lastIndexOf(",");
056: if (i > 0)
057: ts = userDN.substring(i);
058: else
059: ts = ",o=isp";
060: }
061: SearchLogger.getLogger().log(Level.FINEST,
062: "PSSP_CSPSRDMS0003", ts);
063: role_admin = ADMIN_CN + ts;
064: SearchLogger.getLogger().log(Level.FINEST,
065: "PSSP_CSPSRDMS0004", role_admin);
066: }
067: //checking the module is enabled;
068: String mode = SearchConfig.getValue(SearchConfig.SECMODE);
069: enabled = (mode != null && mode.equalsIgnoreCase("ON"));
070: mode = SearchConfig.getValue(SearchConfig.SECDSAME);
071: group_support = (mode != null && mode.compareToIgnoreCase("ON") == 0);
072:
073: if (SearchLogger.getLogger().isLoggable(Level.FINEST)) {
074: Enumeration en = SystemProperties.getAll().propertyNames();
075: while (en.hasMoreElements()) {
076: String arg = (String) en.nextElement();
077: SearchLogger.getLogger()
078: .log(
079: Level.FINEST,
080: "PSSP_CSPSRDMS0005",
081: new Object[] { arg,
082: SystemProperties.get(arg) });
083: }
084: }
085: }
086:
087: /**
088: * Returns true if the module is on
089: */
090: public boolean isEnabled() {
091: return enabled;
092: }
093:
094: public String getName() {
095: return myName;
096: }
097:
098: public boolean checkDatabasePermission(SToken st,
099: String permissionName, SOIF rd) throws RDMException {
100: return true;
101: }
102:
103: public boolean onCreateCallback(SOIF dbsoif) {
104: return false;
105: }
106:
107: public Set getUserRoles(SToken st) throws Exception {
108: if (!enabled) {
109: return null;
110: }
111: Object token = st.getNativeToken();
112: if (token == null && !(token instanceof SSOToken)) {
113: Set roles = new HashSet();
114: return roles;
115: }
116: SSOToken ssotoken = (SSOToken) token;
117: String userDN = ssotoken.getPrincipal().getName();
118: if (userDN.equals(AdminUtils.getAdminDN())) {
119: if (st.isProxy()) {
120: userDN = st.getProxyDN();
121: } else {
122: return null;
123: }
124: }
125: AMStoreConnection dpsc = new AMStoreConnection(ssotoken);
126: AMUser dpuser = dpsc.getUser(userDN);
127:
128: int i = 0;
129: boolean result = true;
130: Set roles = dpuser.getRoleDNs();
131: String filteredRoles = SearchConfig
132: .getValue(SearchConfig.SECDSAME_USE_FILTERED_ROLES);
133: if ("true".equals(filteredRoles)) {
134: roles.addAll(dpuser.getFilteredRoleDNs());
135: }
136: if (roles.contains(role_admin)) {
137: return null;
138: }
139:
140: if (group_support) {
141: roles.addAll(dpuser.getStaticGroupDNs());
142: roles.addAll(dpuser.getAssignableDynamicGroupDNs());
143: }
144: roles.add(userDN);
145: return roles;
146: }
147:
148: }
|