inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-31 17:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged V2.2 to HEAD

Browse Source 
8144: Fix for AR-1850, AR-2046

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@8487 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Jan Vonka
2008-03-10 17:02:24 +00:00
parent d05655f3c7
commit c5edd151e9
7 changed files with 663 additions and 404 deletions
Download Patch File Download Diff File Expand all files Collapse all files

155
source/java/org/alfresco/repo/security/authentication/AbstractAuthenticationService.java Normal file
View File

@@ -0,0 +1,155 @@
/*
* Copyright (C) 2005-2007 Alfresco Software Limited.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
* As a special exception to the terms and conditions of version 2.0 of
* the GPL, you may redistribute this Program in connection with Free/Libre
* and Open Source Software ("FLOSS") applications as described in Alfresco's
* FLOSS exception. You should have recieved a copy of the text describing
* the FLOSS exception, and it is also available here:
* http://www.alfresco.com/legal/licensing"
*/
package org.alfresco.repo.security.authentication;
import java.util.List;
import java.util.Set;
import org.alfresco.repo.cache.SimpleCache;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.springframework.beans.factory.InitializingBean;
/**
* Common code for authentication services
*
* @author andyh
*/
public abstract class AbstractAuthenticationService implements AuthenticationService, InitializingBean
{
private SimpleCache<String, Object> sysAdminCache;
private static final String KEY_SYSADMIN_ALLOWED_USERS = "sysAdminCache.authAllowedUsers";
private static final String KEY_SYSADMIN_MAX_USERS = "sysAdminCache.authMaxUsers";
private boolean initialised = false;
private Integer initialMaxUsers = null;
private List<String> initialAllowedUsers = null;
public void setSysAdminCache(SimpleCache<String, Object> sysAdminCache)
{
this.sysAdminCache = sysAdminCache;
}
public void preAuthenticationCheck(String userName) throws AuthenticationException
{
if (sysAdminCache != null)
{
List<String> allowedUsers = (List<String>) sysAdminCache.get(KEY_SYSADMIN_ALLOWED_USERS);
if ((allowedUsers != null) && (!allowedUsers.contains(userName)))
{
throw new AuthenticationDisallowedException("Username not allowed: " + userName);
}
Integer maxUsers = (Integer) sysAdminCache.get(KEY_SYSADMIN_MAX_USERS);
if ((maxUsers != null) && (maxUsers != -1) && (getUsersWithTickets(true).size() >= maxUsers))
{
throw new AuthenticationMaxUsersException("Max users exceeded: " + maxUsers);
}
}
}
public void setAllowedUsers(List<String> allowedUsers)
{
if (initialised)
{
if (sysAdminCache != null)
{
sysAdminCache.put(KEY_SYSADMIN_ALLOWED_USERS, allowedUsers);
}
}
else
{
initialAllowedUsers = allowedUsers;
}
}
@SuppressWarnings("unchecked")
public List<String> getAllowedUsers()
{
if (sysAdminCache != null)
{
return (List<String>) sysAdminCache.get(KEY_SYSADMIN_ALLOWED_USERS);
}
else
{
return null;
}
}
public void setMaxUsers(int maxUsers)
{
if (initialised)
{
if (sysAdminCache != null)
{
sysAdminCache.put(KEY_SYSADMIN_MAX_USERS, new Integer(maxUsers));
}
}
else
{
initialMaxUsers = new Integer(maxUsers);
}
}
@SuppressWarnings("unchecked")
public int getMaxUsers()
{
if (sysAdminCache != null)
{
Integer maxUsers = (Integer) sysAdminCache.get(KEY_SYSADMIN_MAX_USERS);
return (maxUsers == null ? -1 : maxUsers.intValue());
}
else
{
return -1;
}
}
public abstract Set<String> getUsersWithTickets(boolean nonExpiredOnly);
public abstract int invalidateTickets(boolean nonExpiredOnly);
public abstract int countTickets(boolean nonExpiredOnly);
public abstract Set<TicketComponent> getTicketComponents();
final public void afterPropertiesSet() throws Exception
{
initialised = true;
if (sysAdminCache != null)
{
sysAdminCache.put(KEY_SYSADMIN_MAX_USERS, initialMaxUsers);
sysAdminCache.put(KEY_SYSADMIN_ALLOWED_USERS, initialAllowedUsers);
}
}
}

73
source/java/org/alfresco/repo/security/authentication/AuthenticationServiceImpl.java
View File

@@ -25,14 +25,11 @@
package org.alfresco.repo.security.authentication;
import java.util.Collections;
import java.util.List;
import java.util.Set;
import org.alfresco.repo.cache.SimpleCache;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.PermissionService;
public class AuthenticationServiceImpl implements AuthenticationService
public class AuthenticationServiceImpl extends AbstractAuthenticationService
{
MutableAuthenticationDao authenticationDao;
@@ -48,22 +45,11 @@ public class AuthenticationServiceImpl implements AuthenticationService
private boolean allowsUserPasswordChange = true;
// SysAdmin cache - used to cluster certain JMX operations
private SimpleCache<String, Object> sysAdminCache;
private final static String KEY_SYSADMIN_ALLOWED_USERS = "sysAdminCache.authAllowedUsers"; // List<String>
private final static String KEY_SYSADMIN_MAX_USERS = "sysAdminCache.authMaxUsers"; // Integer
public AuthenticationServiceImpl()
{
super();
}
public void setSysAdminCache(SimpleCache<String, Object> sysAdminCache)
{
this.sysAdminCache = sysAdminCache;
}
public void setAuthenticationDao(MutableAuthenticationDao authenticationDao)
{
this.authenticationDao = authenticationDao;
@@ -124,22 +110,7 @@ public class AuthenticationServiceImpl implements AuthenticationService
{
try
{
// clear context - to avoid MT concurrency issue (causing domain mismatch) - see also 'validate' below
clearCurrentSecurityContext();
List<String> allowedUsers = (List<String>)sysAdminCache.get(KEY_SYSADMIN_ALLOWED_USERS);
if ((allowedUsers != null) && (! allowedUsers.contains(userName)))
{
throw new AuthenticationDisallowedException("Username not allowed: " + userName);
}
Integer maxUsers = (Integer)sysAdminCache.get(KEY_SYSADMIN_MAX_USERS);
if ((maxUsers != null) && (maxUsers != -1) && (ticketComponent.getUsersWithTickets(true).size() >= maxUsers))
{
throw new AuthenticationMaxUsersException("Max users exceeded: " + maxUsers);
}
preAuthenticationCheck(userName);
authenticationComponent.authenticate(userName, password);
}
catch(AuthenticationException ae)
@@ -171,29 +142,6 @@ public class AuthenticationServiceImpl implements AuthenticationService
{
return ticketComponent.getUsersWithTickets(nonExpiredOnly);
}
public void setAllowedUsers(List<String> allowedUsers)
{
sysAdminCache.put(KEY_SYSADMIN_ALLOWED_USERS, allowedUsers);
}
@SuppressWarnings("unchecked")
public List<String> getAllowedUsers()
{
return (List<String>)sysAdminCache.get(KEY_SYSADMIN_ALLOWED_USERS);
}
public void setMaxUsers(int maxUsers)
{
sysAdminCache.put(KEY_SYSADMIN_MAX_USERS, new Integer(maxUsers));
}
@SuppressWarnings("unchecked")
public int getMaxUsers()
{
Integer maxUsers = (Integer)sysAdminCache.get(KEY_SYSADMIN_MAX_USERS);
return (maxUsers == null ? -1 : maxUsers.intValue());
}
public void invalidateTicket(String ticket) throws AuthenticationException
{
@@ -250,15 +198,10 @@ public class AuthenticationServiceImpl implements AuthenticationService
@SuppressWarnings("unchecked")
public void authenticateAsGuest() throws AuthenticationException
{
List<String> allowedUsers = (List<String>)sysAdminCache.get(KEY_SYSADMIN_ALLOWED_USERS);
if ((allowedUsers != null) && (! allowedUsers.contains(PermissionService.GUEST_AUTHORITY)))
{
throw new AuthenticationException("Guest authentication is not allowed");
}
preAuthenticationCheck(PermissionService.GUEST_AUTHORITY);
authenticationComponent.setGuestUserAsCurrentUser();
ticketComponent.clearCurrentTicket();
ticketComponent.getCurrentTicket(PermissionService.GUEST_AUTHORITY); // to ensure new ticket is created (even if client does not explicitly call getCurrentTicket)
}
public boolean guestUserAuthenticationAllowed()
@@ -347,7 +290,9 @@ public class AuthenticationServiceImpl implements AuthenticationService
}
}
@Override
public Set<TicketComponent> getTicketComponents()
{
return Collections.singleton(ticketComponent);
}
}

58
source/java/org/alfresco/repo/security/authentication/ChainingAuthenticationServiceImpl.java
View File

@@ -30,6 +30,7 @@ import java.util.List;
import java.util.Set;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.PermissionService;
/**
* This class implements a simple chaining authentication service.
@@ -51,7 +52,7 @@ import org.alfresco.service.cmr.security.AuthenticationService;
*
* @author Andy Hind
*/
public class ChainingAuthenticationServiceImpl implements AuthenticationService
public class ChainingAuthenticationServiceImpl extends AbstractAuthenticationService
{
private List<AuthenticationService> authenticationServices;
@@ -157,6 +158,7 @@ public class ChainingAuthenticationServiceImpl implements AuthenticationService
public void authenticate(String userName, char[] password) throws AuthenticationException
{
preAuthenticationCheck(userName);
for (AuthenticationService authService : getUsableAuthenticationServices())
{
try
@@ -175,6 +177,7 @@ public class ChainingAuthenticationServiceImpl implements AuthenticationService
public void authenticateAsGuest() throws AuthenticationException
{
preAuthenticationCheck(PermissionService.GUEST_AUTHORITY);
for (AuthenticationService authService : getUsableAuthenticationServices())
{
try
@@ -411,4 +414,57 @@ public class ChainingAuthenticationServiceImpl implements AuthenticationService
return domains;
}
@Override
public Set<String> getUsersWithTickets(boolean nonExpiredOnly)
{
HashSet<String> users = new HashSet<String>();
for (AuthenticationService authService : getUsableAuthenticationServices())
{
if(authService instanceof AbstractAuthenticationService)
{
users.addAll( ((AbstractAuthenticationService)authService).getUsersWithTickets(nonExpiredOnly));
}
}
return users;
}
@Override
public int countTickets(boolean nonExpiredOnly)
{
int count = 0;
for(TicketComponent tc : getTicketComponents())
{
count += tc.countTickets(nonExpiredOnly);
}
return count;
}
@Override
public int invalidateTickets(boolean nonExpiredOnly)
{
int count = 0;
for (AuthenticationService authService : getUsableAuthenticationServices())
{
if(authService instanceof AbstractAuthenticationService)
{
count += ((AbstractAuthenticationService)authService).invalidateTickets(nonExpiredOnly);
}
}
return count;
}
@Override
public Set<TicketComponent> getTicketComponents()
{
Set<TicketComponent> tcs = new HashSet<TicketComponent>();
for (AuthenticationService authService : getUsableAuthenticationServices())
{
if(authService instanceof AbstractAuthenticationService)
{
tcs.addAll(((AbstractAuthenticationService)authService).getTicketComponents());
}
}
return tcs;
}
}

35
source/java/org/alfresco/repo/security/authentication/InMemoryTicketComponentImpl.java
View File

@@ -34,6 +34,7 @@ import java.util.zip.CRC32;
import org.alfresco.repo.cache.SimpleCache;
import org.alfresco.service.cmr.repository.datatype.Duration;
import org.alfresco.util.GUID;
import org.apache.commons.codec.binary.Hex;
import org.safehaus.uuid.UUIDGenerator;
@@ -56,6 +57,8 @@ public class InMemoryTicketComponentImpl implements TicketComponent
private Duration validDuration;
private boolean oneOff;
private String guid;
private SimpleCache<String, Ticket> ticketsCache; // Can't use Ticket as it's private
@@ -66,6 +69,7 @@ public class InMemoryTicketComponentImpl implements TicketComponent
public InMemoryTicketComponentImpl()
{
super();
guid = GUID.generate();
}
/**
@@ -234,6 +238,37 @@ public class InMemoryTicketComponentImpl implements TicketComponent
}
}
@Override
public int hashCode()
{
final int PRIME = 31;
int result = 1;
result = PRIME * result + ((guid == null) ? 0 : guid.hashCode());
return result;
}
@Override
public boolean equals(Object obj)
{
if (this == obj)
return true;
if (obj == null)
return false;
if (getClass() != obj.getClass())
return false;
final InMemoryTicketComponentImpl other = (InMemoryTicketComponentImpl) obj;
if (guid == null)
{
if (other.guid != null)
return false;
}
else if (!guid.equals(other.guid))
return false;
return true;
}
/**
* Ticket
* @author andyh