de.deepamehta.plugins.accesscontrol
Class AccessControlPlugin

Show UML class diagram

java.lang.Object
  de.deepamehta.core.osgi.PluginActivator
      de.deepamehta.plugins.accesscontrol.AccessControlPlugin

All Implemented Interfaces:

PluginContext, AllPluginsActiveListener, IntroduceAssociationTypeListener, IntroduceTopicTypeListener, PostCreateAssociationListener, PostCreateTopicListener, PostUpdateTopicListener, PreSendAssociationTypeListener, PreSendTopicTypeListener, ResourceRequestFilterListener, ServiceRequestFilterListener, EventListener, PluginService, AccessControlService, BundleActivator

public class AccessControlPlugin
extends PluginActivator
implements AccessControlService, AllPluginsActiveListener, PostCreateTopicListener, PostCreateAssociationListener, PostUpdateTopicListener, IntroduceTopicTypeListener, IntroduceAssociationTypeListener, ServiceRequestFilterListener, ResourceRequestFilterListener, PreSendTopicTypeListener, PreSendAssociationTypeListener

Field Summary

private static String	AUTHENTICATION_REALM
private static AccessControlList	DEFAULT_INSTANCE_ACL
private static String	DEFAULT_PASSWORD
private static AccessControlList	DEFAULT_TYPE_ACL
private static AccessControlList	DEFAULT_USER_ACCOUNT_ACL
private static String	DEFAULT_USERNAME
private Logger	logger
private static DeepaMehtaEvent	POST_LOGIN_USER
private static DeepaMehtaEvent	POST_LOGOUT_USER
private static boolean	READ_REQUIRES_LOGIN
private javax.servlet.http.HttpServletRequest	request
private static String	SUBNET_FILTER
private static String	URI_ACL
private static String	URI_CREATOR
private static String	URI_OWNER
private static boolean	WRITE_REQUIRES_LOGIN
private WorkspacesService	wsService

Fields inherited from class de.deepamehta.core.osgi.PluginActivator

bundle, dms

Constructor Summary

AccessControlPlugin()

Method Summary

private void	_login(String username, javax.servlet.http.HttpServletRequest request)
private void	_logout(javax.servlet.http.HttpServletRequest request)
void	allPluginsActive() Setup access control for the default user and the default topicmap.
private void	assignToDefaultWorkspace(Topic topic, String info)
private void	checkAuthorization(javax.servlet.http.HttpServletRequest request)
private boolean	checkCredentials(Credentials cred)
private void	checkRequestOrigin(javax.servlet.http.HttpServletRequest request)
private Permissions	createPermissions(boolean write)
private Permissions	createPermissions(boolean write, boolean create)
private Topic	createUserAccount(Credentials cred)
private void	enrichWithPermissions(Type type, Permissions permissions)
private Topic	fetchDefaultTopicmap()
private Topic	fetchDefaultUser() Fetches the default user ("admin").
private Topic	fetchUserAccount(Topic username) Prerequisite: username is not null.
AccessControlList	getACL(DeepaMehtaObject object) Returns the Access Control List of a topic or an association.
Permissions	getAssociationPermissions(long assocId)
Collection<Association>	getAssociationsByCreator(String username)
Collection<Association>	getAssociationsByOwner(String username)
String	getCreator(DeepaMehtaObject object) Returns the creator of a topic or an association.
String	getOwner(DeepaMehtaObject object) Returns the owner of a topic or an association.
private Permissions	getPermissions(DeepaMehtaObject object)
private Permissions	getPermissions(Type type)
Permissions	getTopicPermissions(long topicId)
Collection<Topic>	getTopicsByCreator(String username)
Collection<Topic>	getTopicsByOwner(String username)
String	getUsername() Returns the username of the logged in user.
Topic	getUsername(String username) Returns the "Username" topic for the specified username.
private Topic	getUsernameOrThrow(String username)
private boolean	hasPermission(String username, Operation operation, DeepaMehtaObject object) Checks if a user is allowed to perform an operation on an object (topic or association).
private String	info(DeepaMehtaObject object)
private String	info(javax.servlet.http.HttpServletRequest request)
private String	info(javax.servlet.http.HttpSession session)
void	init()
void	introduceAssociationType(AssociationType assocType, ClientState clientState)
void	introduceTopicType(TopicType topicType, ClientState clientState)
private boolean	isLoginRequired(javax.servlet.http.HttpServletRequest request)
private boolean	isUserAccount(Topic topic)
private void	joinIfWorkspace(Topic topic)
void	joinWorkspace(String username, long workspaceId)
void	joinWorkspace(Topic username, long workspaceId)
void	login() Checks weather the credentials in the authorization string match an existing User Account, and if so, creates an HTTP session.
void	logout() Logs the user out.
private boolean	matches(Topic username, String password) Prerequisite: username is not null.
private String	password(Topic userAccount)
private CompositeValueModel	permissions(DeepaMehtaObject object)
void	postCreateAssociation(Association assoc, ClientState clientState, Directives directives)
void	postCreateTopic(Topic topic, ClientState clientState, Directives directives)
void	postInstall()
void	postUpdateTopic(Topic topic, TopicModel newModel, TopicModel oldModel, ClientState clientState, Directives directives)
void	preSendAssociationType(AssociationType assocType, ClientState clientState)
void	preSendTopicType(TopicType topicType, ClientState clientState)
private void	requestFilter(javax.servlet.http.HttpServletRequest request)
void	resourceRequestFilter(javax.servlet.http.HttpServletRequest servletRequest)
void	serviceArrived(PluginService service)
void	serviceGone(PluginService service)
void	serviceRequestFilter(com.sun.jersey.spi.container.ContainerRequest containerRequest)
void	setACL(DeepaMehtaObject object, AccessControlList acl) Sets the Access Control List for a topic or an association.
void	setCreator(DeepaMehtaObject object, String username) Sets the creator of a topic or an association.
void	setOwner(DeepaMehtaObject object, String username) Sets the owner of a topic or an association.
private void	setupAccessControl(DeepaMehtaObject object, AccessControlList acl, String username)
private void	setupAccessControlForDefaultTopicmap(Topic defaultTopicmap)
private void	setupDefaultAccessControl(DeepaMehtaObject object) Sets the logged in user as the creator and the owner of the specified object and creates a default access control entry for it.
private void	setupDefaultAccessControl(Type type)
private void	setupUserAccountAccessControl(Topic topic)
private void	setupViewConfigAccessControl(ViewConfiguration viewConfig)
private void	throw401Unauthorized()
private void	throw403Forbidden()
private boolean	tryLogin(Credentials cred, javax.servlet.http.HttpServletRequest request) Checks weather the credentials are valid and if so logs the user in.
private String	userInfo(String username)
private boolean	userIsCreator(String username, DeepaMehtaObject object) Checks if a user is the creator of the object.
private boolean	userIsMember(String username, DeepaMehtaObject object) Checks if a user is a member of any workspace the object is assigned to.
private boolean	userIsOwner(String username, DeepaMehtaObject object) Checks if a user is the owner of the object.
private String	username(javax.servlet.http.HttpSession session)
private boolean	userOccupiesRole(String username, UserRole userRole, DeepaMehtaObject object) Checks if a user occupies a role with regard to the specified object.

Methods inherited from class de.deepamehta.core.osgi.PluginActivator

getBundleContext, getUri, publishDirectory, setCoreService, shutdown, start, stop, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

READ_REQUIRES_LOGIN

private static final boolean READ_REQUIRES_LOGIN

WRITE_REQUIRES_LOGIN

private static final boolean WRITE_REQUIRES_LOGIN

SUBNET_FILTER

private static final String SUBNET_FILTER

AUTHENTICATION_REALM

private static final String AUTHENTICATION_REALM

See Also:

Constant Field Values

DEFAULT_USERNAME

private static final String DEFAULT_USERNAME

See Also:

Constant Field Values

DEFAULT_PASSWORD

private static final String DEFAULT_PASSWORD

See Also:

Constant Field Values

DEFAULT_INSTANCE_ACL

private static final AccessControlList DEFAULT_INSTANCE_ACL

DEFAULT_TYPE_ACL

private static final AccessControlList DEFAULT_TYPE_ACL

DEFAULT_USER_ACCOUNT_ACL

private static final AccessControlList DEFAULT_USER_ACCOUNT_ACL

URI_CREATOR

private static String URI_CREATOR

URI_OWNER

private static String URI_OWNER

URI_ACL

private static String URI_ACL

POST_LOGIN_USER

private static DeepaMehtaEvent POST_LOGIN_USER

POST_LOGOUT_USER

private static DeepaMehtaEvent POST_LOGOUT_USER

wsService

private WorkspacesService wsService

request

@Context
private javax.servlet.http.HttpServletRequest request

logger

private Logger logger

Constructor Detail

AccessControlPlugin

public AccessControlPlugin()

Method Detail

login

public void login()

Description copied from interface: AccessControlService

Checks weather the credentials in the authorization string match an existing User Account, and if so, creates an HTTP session. ### FIXDOC

Specified by:

login in interface AccessControlService

logout

public void logout()

Description copied from interface: AccessControlService

Logs the user out. That is invalidating the session associated with the JSESSION ID cookie. For a "non-private" DM installation the response is 204 No Content. For a "private" DM installation the response is 401 Authorization Required. In this case the webclient is supposed to shutdown the DM GUI then. The webclient of a "private" DM installation must only be visible/usable when logged in.

Specified by:

logout in interface AccessControlService

getUsername

public String getUsername()

Description copied from interface: AccessControlService

Returns the username of the logged in user.

Specified by:

getUsername in interface AccessControlService

Returns:

The username, or null if no user is logged in.

getUsername

public Topic getUsername(String username)

Description copied from interface: AccessControlService

Returns the "Username" topic for the specified username.

Specified by:

getUsername in interface AccessControlService

Returns:

The "Username" topic (type dm4.accesscontrol.username), or null if no such username exists.

getTopicPermissions

public Permissions getTopicPermissions(long topicId)

Specified by:

getTopicPermissions in interface AccessControlService

getAssociationPermissions

public Permissions getAssociationPermissions(long assocId)

Specified by:

getAssociationPermissions in interface AccessControlService

getCreator

public String getCreator(DeepaMehtaObject object)

Description copied from interface: AccessControlService

Returns the creator of a topic or an association.

Specified by:

getCreator in interface AccessControlService

Returns:

The username of the creator, or null if no creator is set.

setCreator

public void setCreator(DeepaMehtaObject object,
                       String username)

Description copied from interface: AccessControlService

Sets the creator of a topic or an association.

Specified by:

setCreator in interface AccessControlService

getOwner

public String getOwner(DeepaMehtaObject object)

Description copied from interface: AccessControlService

Returns the owner of a topic or an association.

Specified by:

getOwner in interface AccessControlService

Returns:

The username of the owner, or null if no owner is set.

setOwner

public void setOwner(DeepaMehtaObject object,
                     String username)

Description copied from interface: AccessControlService

Sets the owner of a topic or an association.

Specified by:

setOwner in interface AccessControlService

getACL

public AccessControlList getACL(DeepaMehtaObject object)

Description copied from interface: AccessControlService

Returns the Access Control List of a topic or an association.

Specified by:

getACL in interface AccessControlService

Returns:

The Access Control List. If no one was set an empty Access Control List is returned.

setACL

public void setACL(DeepaMehtaObject object,
                   AccessControlList acl)

Description copied from interface: AccessControlService

Sets the Access Control List for a topic or an association.

Specified by:

setACL in interface AccessControlService

joinWorkspace

public void joinWorkspace(String username,
                          long workspaceId)

Specified by:

joinWorkspace in interface AccessControlService

joinWorkspace

public void joinWorkspace(Topic username,
                          long workspaceId)

Specified by:

joinWorkspace in interface AccessControlService

getTopicsByCreator

public Collection<Topic> getTopicsByCreator(String username)

Specified by:

getTopicsByCreator in interface AccessControlService

getTopicsByOwner

public Collection<Topic> getTopicsByOwner(String username)

Specified by:

getTopicsByOwner in interface AccessControlService

getAssociationsByCreator

public Collection<Association> getAssociationsByCreator(String username)

Specified by:

getAssociationsByCreator in interface AccessControlService

getAssociationsByOwner

public Collection<Association> getAssociationsByOwner(String username)

Specified by:

getAssociationsByOwner in interface AccessControlService

postInstall

public void postInstall()

Specified by:

postInstall in interface PluginContext

Overrides:

postInstall in class PluginActivator

init

public void init()

Specified by:

init in interface PluginContext

Overrides:

init in class PluginActivator

serviceArrived

public void serviceArrived(PluginService service)

Specified by:

serviceArrived in interface PluginContext

Overrides:

serviceArrived in class PluginActivator

serviceGone

public void serviceGone(PluginService service)

Specified by:

serviceGone in interface PluginContext

Overrides:

serviceGone in class PluginActivator

allPluginsActive

public void allPluginsActive()

Setup access control for the default user and the default topicmap. 1) assign default user to default workspace 2) assign default topicmap to default workspace 3) setup access control for default topicmap

Specified by:

allPluginsActive in interface AllPluginsActiveListener

postCreateTopic

public void postCreateTopic(Topic topic,
                            ClientState clientState,
                            Directives directives)

Specified by:

postCreateTopic in interface PostCreateTopicListener

postCreateAssociation

public void postCreateAssociation(Association assoc,
                                  ClientState clientState,
                                  Directives directives)

Specified by:

postCreateAssociation in interface PostCreateAssociationListener

postUpdateTopic

public void postUpdateTopic(Topic topic,
                            TopicModel newModel,
                            TopicModel oldModel,
                            ClientState clientState,
                            Directives directives)

Specified by:

postUpdateTopic in interface PostUpdateTopicListener

introduceTopicType

public void introduceTopicType(TopicType topicType,
                               ClientState clientState)

Specified by:

introduceTopicType in interface IntroduceTopicTypeListener

introduceAssociationType

public void introduceAssociationType(AssociationType assocType,
                                     ClientState clientState)

Specified by:

introduceAssociationType in interface IntroduceAssociationTypeListener

serviceRequestFilter

public void serviceRequestFilter(com.sun.jersey.spi.container.ContainerRequest containerRequest)

Specified by:

serviceRequestFilter in interface ServiceRequestFilterListener

resourceRequestFilter

public void resourceRequestFilter(javax.servlet.http.HttpServletRequest servletRequest)

Specified by:

resourceRequestFilter in interface ResourceRequestFilterListener

preSendTopicType

public void preSendTopicType(TopicType topicType,
                             ClientState clientState)

Specified by:

preSendTopicType in interface PreSendTopicTypeListener

preSendAssociationType

public void preSendAssociationType(AssociationType assocType,
                                   ClientState clientState)

Specified by:

preSendAssociationType in interface PreSendAssociationTypeListener

createUserAccount

private Topic createUserAccount(Credentials cred)

isUserAccount

private boolean isUserAccount(Topic topic)

fetchDefaultUser

private Topic fetchDefaultUser()

Fetches the default user ("admin").

Returns:

The default user (a Topic of type "Username" / dm4.accesscontrol.username).

Throws:

RuntimeException - If the default user doesn't exist.

getUsernameOrThrow

private Topic getUsernameOrThrow(String username)

joinIfWorkspace

private void joinIfWorkspace(Topic topic)

assignToDefaultWorkspace

private void assignToDefaultWorkspace(Topic topic,
                                      String info)

setupAccessControlForDefaultTopicmap

private void setupAccessControlForDefaultTopicmap(Topic defaultTopicmap)

fetchDefaultTopicmap

private Topic fetchDefaultTopicmap()

requestFilter

private void requestFilter(javax.servlet.http.HttpServletRequest request)

checkRequestOrigin

private void checkRequestOrigin(javax.servlet.http.HttpServletRequest request)

checkAuthorization

private void checkAuthorization(javax.servlet.http.HttpServletRequest request)

isLoginRequired

private boolean isLoginRequired(javax.servlet.http.HttpServletRequest request)

tryLogin

private boolean tryLogin(Credentials cred,
                         javax.servlet.http.HttpServletRequest request)

Checks weather the credentials are valid and if so logs the user in.

Returns:

true if the credentials are valid.

checkCredentials

private boolean checkCredentials(Credentials cred)

_login

private void _login(String username,
                    javax.servlet.http.HttpServletRequest request)

_logout

private void _logout(javax.servlet.http.HttpServletRequest request)

matches

private boolean matches(Topic username,
                        String password)

Prerequisite: username is not null.

Parameters:

password - The encrypted password.

fetchUserAccount

private Topic fetchUserAccount(Topic username)

Prerequisite: username is not null.

username

private String username(javax.servlet.http.HttpSession session)

password

private String password(Topic userAccount)

Returns:

The encryted password of the specified User Account.

throw401Unauthorized

private void throw401Unauthorized()

throw403Forbidden

private void throw403Forbidden()

setupDefaultAccessControl

private void setupDefaultAccessControl(DeepaMehtaObject object)

Sets the logged in user as the creator and the owner of the specified object and creates a default access control entry for it. If no user is logged in, nothing is performed.

setupDefaultAccessControl

private void setupDefaultAccessControl(Type type)

setupUserAccountAccessControl

private void setupUserAccountAccessControl(Topic topic)

setupViewConfigAccessControl

private void setupViewConfigAccessControl(ViewConfiguration viewConfig)

setupAccessControl

private void setupAccessControl(DeepaMehtaObject object,
                                AccessControlList acl,
                                String username)

Parameters:

username - must not be null.

getPermissions

private Permissions getPermissions(DeepaMehtaObject object)

getPermissions

private Permissions getPermissions(Type type)

hasPermission

private boolean hasPermission(String username,
                              Operation operation,
                              DeepaMehtaObject object)

Checks if a user is allowed to perform an operation on an object (topic or association). If so, true is returned.

Parameters:

username - the logged in user (a Topic of type "Username" / dm4.accesscontrol.username), or null if no user is logged in.

userOccupiesRole

private boolean userOccupiesRole(String username,
                                 UserRole userRole,
                                 DeepaMehtaObject object)

Checks if a user occupies a role with regard to the specified object. If so, true is returned.

Parameters:

username - the logged in user (a Topic of type "Username" / dm4.accesscontrol.username), or null if no user is logged in.

userIsMember

private boolean userIsMember(String username,
                             DeepaMehtaObject object)

Checks if a user is a member of any workspace the object is assigned to. If so, true is returned. Prerequisite: a user is logged in (username is not null).

Parameters:

username - a Topic of type "Username" (dm4.accesscontrol.username). ### FIXDOC

object - the object in question.

userIsOwner

private boolean userIsOwner(String username,
                            DeepaMehtaObject object)

Checks if a user is the owner of the object. If so, true is returned. Prerequisite: a user is logged in (username is not null).

Parameters:

username - a Topic of type "Username" (dm4.accesscontrol.username). ### FIXDOC

userIsCreator

private boolean userIsCreator(String username,
                              DeepaMehtaObject object)

Checks if a user is the creator of the object. If so, true is returned. Prerequisite: a user is logged in (username is not null).

Parameters:

username - a Topic of type "Username" (dm4.accesscontrol.username). ### FIXDOC

enrichWithPermissions

private void enrichWithPermissions(Type type,
                                   Permissions permissions)

permissions

private CompositeValueModel permissions(DeepaMehtaObject object)

createPermissions

private Permissions createPermissions(boolean write)

createPermissions

private Permissions createPermissions(boolean write,
                                      boolean create)

info

private String info(DeepaMehtaObject object)

userInfo

private String userInfo(String username)

info

private String info(javax.servlet.http.HttpSession session)

info

private String info(javax.servlet.http.HttpServletRequest request)