git.aero2k.de Git - tmp/jakarta-migration.git/blob

   1 /**
   2  *  This document is a part of the source code and related artifacts
   3  *  for CollectionSpace, an open source collections management system
   4  *  for museums and related institutions:
   5
   6  *  http://www.collectionspace.org
   7  *  http://wiki.collectionspace.org
   8
   9  *  Copyright 2009 University of California at Berkeley
  10
  11  *  Licensed under the Educational Community License (ECL), Version 2.0.
  12  *  You may not use this file except in compliance with this License.
  13
  14  *  You may obtain a copy of the ECL 2.0 License at
  15
  16  *  https://source.collectionspace.org/collection-space/LICENSE.txt
  17
  18  *  Unless required by applicable law or agreed to in writing, software
  19  *  distributed under the License is distributed on an "AS IS" BASIS,
  20  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  21  *  See the License for the specific language governing permissions and
  22  *  limitations under the License.
  23  */
  24 package org.collectionspace.services.authorization.importer;
  25
  26 import java.io.File;
  27 import org.slf4j.Logger;
  28 import org.slf4j.LoggerFactory;
  29 import java.util.ArrayList;
  30 import java.util.Date;
  31 import java.util.Hashtable;
  32 import java.util.List;
  33 import java.util.UUID;
  34 import javax.xml.bind.JAXBContext;
  35 import javax.xml.bind.Marshaller;
  36 import org.collectionspace.services.authorization.ActionType;
  37 import org.collectionspace.services.authorization.Permission;
  38 import org.collectionspace.services.authorization.EffectType;
  39 import org.collectionspace.services.authorization.PermissionAction;
  40 import org.collectionspace.services.authorization.PermissionActionUtil;
  41 import org.collectionspace.services.authorization.PermissionRole;
  42 import org.collectionspace.services.authorization.PermissionValue;
  43 import org.collectionspace.services.authorization.PermissionsList;
  44 import org.collectionspace.services.authorization.PermissionsRolesList;
  45 import org.collectionspace.services.authorization.Role;
  46 import org.collectionspace.services.authorization.RoleValue;
  47 import org.collectionspace.services.authorization.RolesList;
  48 import org.collectionspace.services.authorization.SubjectType;
  49 import org.collectionspace.services.common.config.TenantBindingConfigReaderImpl;
  50 import org.collectionspace.services.common.service.ServiceBindingType;
  51 import org.collectionspace.services.common.tenant.TenantBindingType;
  52 import org.collectionspace.services.common.security.SecurityUtils;
  53
  54 /**
  55  * AuthorizationGen generates authorizations (permissions and roles)
  56  * for tenant services
  57  * @author
  58  */
  59 public class AuthorizationGen {
  60
  61     final public static String ROLE_ADMINISTRATOR = "ROLE_ADMINISTRATOR";
  62     final public static String ROLE_TENANT_ADMINISTRATOR = "ROLE_TENANT_ADMINISTRATOR";
  63     final public static String ROLE_TENANT_READER = "ROLE_TENANT_READER";
  64     final public static String ROLE_ADMINISTRATOR_ID = "0";
  65     //
  66     // ActionGroup labels/constants
  67     //
  68     final public static String ACTIONGROUP_CRUDL = "CRUDL";
  69     final public static String ACTIONGROUP_RL = "RL";
  70
  71     final Logger logger = LoggerFactory.getLogger(AuthorizationGen.class);
  72     private List<Permission> adminPermList = new ArrayList<Permission>();
  73     private List<PermissionRole> adminPermRoleList = new ArrayList<PermissionRole>();
  74     private List<Permission> readerPermList = new ArrayList<Permission>();
  75     private List<PermissionRole> readerPermRoleList = new ArrayList<PermissionRole>();
  76     private List<Role> adminRoles = new ArrayList<Role>();
  77     private List<Role> readerRoles = new ArrayList<Role>();
  78     private Role cspaceAdminRole;
  79     private Hashtable<String, TenantBindingType> tenantBindings =
  80             new Hashtable<String, TenantBindingType>();
  81
  82     public void initialize(String tenantBindingFileName) throws Exception {
  83         TenantBindingConfigReaderImpl tenantBindingConfigReader =
  84                 new TenantBindingConfigReaderImpl(null);
  85         tenantBindingConfigReader.read(tenantBindingFileName);
  86         tenantBindings = tenantBindingConfigReader.getTenantBindings();
  87         cspaceAdminRole = buildCSpaceAdminRole();
  88
  89         if (logger.isDebugEnabled()) {
  90             logger.debug("initialized with tenant bindings from " + tenantBindingFileName);
  91         }
  92     }
  93
  94     /**
  95      * createDefaultPermissions creates default admin and reader permissions
  96      * for each tenant found in the given tenant binding file
  97      * @see initialize
  98      * @return
  99      */
 100     public void createDefaultPermissions() {
 101         for (String tenantId : tenantBindings.keySet()) {
 102             List<Permission> adminPerms = createDefaultAdminPermissions(tenantId);
 103             adminPermList.addAll(adminPerms);
 104
 105             List<Permission> readerPerms = createDefaultReaderPermissions(tenantId);
 106             readerPermList.addAll(readerPerms);
 107         }
 108     }
 109
 110     /**
 111      * createDefaultAdminPermissions creates default admin permissions for all services
 112      * used by the given tenant
 113      * @param tenantId
 114      * @return
 115      */
 116     public List<Permission> createDefaultAdminPermissions(String tenantId) {
 117         ArrayList<Permission> apcList = new ArrayList<Permission>();
 118         TenantBindingType tbinding = tenantBindings.get(tenantId);
 119         for (ServiceBindingType sbinding : tbinding.getServiceBindings()) {
 120
 121             //add permissions for the main path
 122                 String resourceName = sbinding.getName().toLowerCase().trim();
 123                 if (SecurityUtils.isEntityProxy() == true) {
 124                         resourceName = SecurityUtils.getResourceEntity(resourceName);
 125                 }
 126             Permission perm = buildAdminPermission(tbinding.getId(),
 127                     resourceName);
 128             apcList.add(perm);
 129
 130             //add permissions for alternate paths
 131             if (SecurityUtils.isEntityProxy() == false) {
 132                     List<String> uriPaths = sbinding.getUriPath();
 133                     for (String uriPath : uriPaths) {
 134                         perm = buildAdminPermission(tbinding.getId(),
 135                                 uriPath.toLowerCase());
 136                         apcList.add(perm);
 137                     }
 138             }
 139         }
 140
 141         return apcList;
 142     }
 143
 144     private Permission buildAdminPermission(String tenantId, String resourceName) {
 145         String id = UUID.randomUUID().toString();
 146         Permission perm = new Permission();
 147         perm.setCsid(id);
 148         perm.setDescription("generated admin permission");
 149         perm.setCreatedAtItem(new Date());
 150         perm.setResourceName(resourceName.toLowerCase().trim());
 151         perm.setEffect(EffectType.PERMIT);
 152         perm.setTenantId(tenantId);
 153
 154         perm.setActionGroup(ACTIONGROUP_CRUDL);
 155         ArrayList<PermissionAction> pas = new ArrayList<PermissionAction>();
 156         perm.setActions(pas);
 157
 158         PermissionAction permAction = PermissionActionUtil.create(perm, ActionType.CREATE);
 159         pas.add(permAction);
 160
 161         permAction = PermissionActionUtil.create(perm, ActionType.READ);
 162         pas.add(permAction);
 163
 164         permAction = PermissionActionUtil.create(perm, ActionType.UPDATE);
 165         pas.add(permAction);
 166
 167         permAction = PermissionActionUtil.create(perm, ActionType.DELETE);
 168         pas.add(permAction);
 169
 170         permAction = PermissionActionUtil.create(perm, ActionType.SEARCH);
 171         pas.add(permAction);
 172
 173         return perm;
 174     }
 175
 176     /**
 177      * createDefaultReaderPermissions creates read only permissions for all services
 178      * used by the given tenant
 179      * @param tenantId
 180      * @return
 181      */
 182     public List<Permission> createDefaultReaderPermissions(String tenantId) {
 183         ArrayList<Permission> apcList = new ArrayList<Permission>();
 184         TenantBindingType tbinding = tenantBindings.get(tenantId);
 185         for (ServiceBindingType sbinding : tbinding.getServiceBindings()) {
 186             //add permissions for the main path
 187                 String resourceName = sbinding.getName().toLowerCase().trim();
 188                 if (SecurityUtils.isEntityProxy() == true) {
 189                         resourceName = SecurityUtils.getResourceEntity(resourceName);
 190                 }
 191             Permission perm = buildReaderPermission(tbinding.getId(),
 192                     resourceName);
 193             apcList.add(perm);
 194
 195             //add permissions for alternate paths
 196             if (SecurityUtils.isEntityProxy() == false) {
 197                     List<String> uriPaths = sbinding.getUriPath();
 198                     for (String uriPath : uriPaths) {
 199                         perm = buildReaderPermission(tbinding.getId(),
 200                                 uriPath.toLowerCase());
 201                         apcList.add(perm);
 202                     }
 203             }
 204         }
 205         return apcList;
 206
 207     }
 208
 209     private Permission buildReaderPermission(String tenantId, String resourceName) {
 210         String id = UUID.randomUUID().toString();
 211         Permission perm = new Permission();
 212         perm.setCsid(id);
 213         perm.setCreatedAtItem(new Date());
 214         perm.setDescription("generated readonly permission");
 215         perm.setResourceName(resourceName.toLowerCase().trim());
 216         perm.setEffect(EffectType.PERMIT);
 217         perm.setTenantId(tenantId);
 218
 219         perm.setActionGroup(ACTIONGROUP_RL);
 220         ArrayList<PermissionAction> pas = new ArrayList<PermissionAction>();
 221         perm.setActions(pas);
 222
 223         PermissionAction permAction = PermissionActionUtil.create(perm, ActionType.READ);
 224         pas.add(permAction);
 225
 226         permAction = PermissionActionUtil.create(perm, ActionType.SEARCH);
 227         pas.add(permAction);
 228
 229         return perm;
 230     }
 231
 232     public List<Permission> getDefaultPermissions() {
 233         List<Permission> allPermList = new ArrayList<Permission>();
 234         allPermList.addAll(adminPermList);
 235         allPermList.addAll(readerPermList);
 236         return allPermList;
 237     }
 238
 239     public List<Permission> getDefaultAdminPermissions() {
 240         return adminPermList;
 241     }
 242
 243     public List<Permission> getDefaultReaderPermissions() {
 244         return readerPermList;
 245     }
 246
 247     /**
 248      * createDefaultRoles creates default admin and reader roles
 249      * for each tenant found in the given tenant binding file
 250      */
 251     public void createDefaultRoles() {
 252         for (String tenantId : tenantBindings.keySet()) {
 253
 254             Role arole = buildTenantAdminRole(tenantId);
 255             adminRoles.add(arole);
 256
 257             Role rrole = buildTenantReaderRole(tenantId);
 258             readerRoles.add(rrole);
 259         }
 260     }
 261
 262     private Role buildTenantAdminRole(String tenantId) {
 263         Role role = new Role();
 264         role.setCreatedAtItem(new Date());
 265         role.setRoleName(ROLE_TENANT_ADMINISTRATOR);
 266         String id = UUID.randomUUID().toString();
 267         role.setCsid(id);
 268         role.setDescription("generated tenant admin role");
 269         role.setTenantId(tenantId);
 270         return role;
 271     }
 272
 273     private Role buildTenantReaderRole(String tenantId) {
 274         Role role = new Role();
 275         role.setCreatedAtItem(new Date());
 276         role.setRoleName(ROLE_TENANT_READER);
 277         String id = UUID.randomUUID().toString();
 278         role.setCsid(id);
 279         role.setDescription("generated tenant read only role");
 280         role.setTenantId(tenantId);
 281         return role;
 282     }
 283
 284     public List<Role> getDefaultRoles() {
 285         List<Role> allRoleList = new ArrayList<Role>();
 286         allRoleList.addAll(adminRoles);
 287         allRoleList.addAll(readerRoles);
 288         return allRoleList;
 289     }
 290
 291     public void associateDefaultPermissionsRoles() {
 292         List<Role> roles = new ArrayList<Role>();
 293         roles.add(cspaceAdminRole);
 294         for (Permission p : adminPermList) {
 295             PermissionRole permAdmRole = associatePermissionRoles(p, adminRoles);
 296             adminPermRoleList.add(permAdmRole);
 297
 298             //CSpace Administrator has all access
 299             PermissionRole permCAdmRole = associatePermissionRoles(p, roles);
 300             adminPermRoleList.add(permCAdmRole);
 301         }
 302
 303         for (Permission p : readerPermList) {
 304             PermissionRole permRdrRole = associatePermissionRoles(p, readerRoles);
 305             readerPermRoleList.add(permRdrRole);
 306         }
 307     }
 308
 309     public List<PermissionRole> associatePermissionsRoles(List<Permission> perms, List<Role> roles) {
 310         List<PermissionRole> permRoles = new ArrayList<PermissionRole>();
 311         for (Permission perm : perms) {
 312             PermissionRole permRole = associatePermissionRoles(perm, roles);
 313             permRoles.add(permRole);
 314         }
 315         return permRoles;
 316     }
 317
 318     private PermissionRole associatePermissionRoles(Permission perm,
 319             List<Role> roles) {
 320
 321         PermissionRole pr = new PermissionRole();
 322         pr.setSubject(SubjectType.ROLE);
 323         List<PermissionValue> permValues = new ArrayList<PermissionValue>();
 324         pr.setPermissions(permValues);
 325         PermissionValue permValue = new PermissionValue();
 326         permValue.setPermissionId(perm.getCsid());
 327         permValue.setResourceName(perm.getResourceName().toLowerCase());
 328         permValue.setActionGroup(perm.getActionGroup());
 329         permValues.add(permValue);
 330
 331         List<RoleValue> roleValues = new ArrayList<RoleValue>();
 332         for (Role role : roles) {
 333             RoleValue rv = new RoleValue();
 334             // This needs to use the qualified name, not the display name
 335             rv.setRoleName(role.getRoleName().toUpperCase());
 336             rv.setRoleId(role.getCsid());
 337             roleValues.add(rv);
 338         }
 339         pr.setRoles(roleValues);
 340
 341         return pr;
 342     }
 343
 344     public List<PermissionRole> getDefaultPermissionRoles() {
 345         List<PermissionRole> allPermRoleList = new ArrayList<PermissionRole>();
 346         allPermRoleList.addAll(adminPermRoleList);
 347         allPermRoleList.addAll(readerPermRoleList);
 348         return allPermRoleList;
 349     }
 350
 351     public List<PermissionRole> getDefaultAdminPermissionRoles() {
 352         return adminPermRoleList;
 353     }
 354
 355     public List<PermissionRole> getDefaultReaderPermissionRoles() {
 356         return readerPermRoleList;
 357     }
 358
 359     private Role buildCSpaceAdminRole() {
 360         Role role = new Role();
 361         role.setRoleName(ROLE_ADMINISTRATOR);
 362         role.setCsid(ROLE_ADMINISTRATOR_ID);
 363         return role;
 364     }
 365
 366     public void exportDefaultRoles(String fileName) {
 367         RolesList rList = new RolesList();
 368         List<Role> allRoleList = new ArrayList<Role>();
 369         allRoleList.addAll(adminRoles);
 370         allRoleList.addAll(readerRoles);
 371         rList.setRoles(allRoleList);
 372         toFile(rList, RolesList.class,
 373                 fileName);
 374         if (logger.isDebugEnabled()) {
 375             logger.debug("exported roles to " + fileName);
 376         }
 377     }
 378
 379     public void exportDefaultPermissions(String fileName) {
 380         PermissionsList pcList = new PermissionsList();
 381         List<Permission> allPermList = new ArrayList<Permission>();
 382         allPermList.addAll(adminPermList);
 383         allPermList.addAll(readerPermList);
 384         pcList.setPermissions(allPermList);
 385         toFile(pcList, PermissionsList.class,
 386                 fileName);
 387         if (logger.isDebugEnabled()) {
 388             logger.debug("exported permissions to " + fileName);
 389         }
 390     }
 391
 392     public void exportDefaultPermissionRoles(String fileName) {
 393         PermissionsRolesList psrsl = new PermissionsRolesList();
 394         List<PermissionRole> allPermRoleList = new ArrayList<PermissionRole>();
 395         allPermRoleList.addAll(adminPermRoleList);
 396         allPermRoleList.addAll(readerPermRoleList);
 397         psrsl.setPermissionRoles(allPermRoleList);
 398         toFile(psrsl, PermissionsRolesList.class,
 399                 fileName);
 400         if (logger.isDebugEnabled()) {
 401             logger.debug("exported permissions-roles to " + fileName);
 402         }
 403     }
 404
 405     private void toFile(Object o, Class jaxbClass, String fileName) {
 406         File f = new File(fileName);
 407         try {
 408             JAXBContext jc = JAXBContext.newInstance(jaxbClass);
 409             Marshaller m = jc.createMarshaller();
 410             m.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT,
 411                     Boolean.TRUE);
 412             m.marshal(o, f);
 413         } catch (Exception e) {
 414             e.printStackTrace();
 415         }
 416     }
 417 }