You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by sm...@apache.org on 2015/12/11 23:41:21 UTC
directory-fortress-core git commit: FC-127 - AuthN Validator
Repository: directory-fortress-core
Updated Branches:
refs/heads/master 5deb0ecac -> 69930fe2b
FC-127 - AuthN Validator
Project: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/commit/69930fe2
Tree: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/tree/69930fe2
Diff: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/diff/69930fe2
Branch: refs/heads/master
Commit: 69930fe2bd2d77b9be5910bf9c55483fd5622bab
Parents: 5deb0ec
Author: Shawn McKinney <sm...@apache.org>
Authored: Fri Dec 11 00:00:41 2015 -0600
Committer: Shawn McKinney <sm...@apache.org>
Committed: Fri Dec 11 00:00:41 2015 -0600
----------------------------------------------------------------------
apacheds.properties.example | 53 --------------
.../directory/fortress/core/GlobalErrIds.java | 5 ++
.../fortress/core/impl/DSDChecker.java | 4 +-
.../fortress/core/util/AuthNValidator.java | 73 ++++++++++++++++++++
.../directory/fortress/core/util/VUtil.java | 8 +--
.../fortress/core/util/time/ClockTime.java | 4 +-
.../directory/fortress/core/util/time/Date.java | 4 +-
.../directory/fortress/core/util/time/Day.java | 4 +-
.../fortress/core/util/time/LockDate.java | 3 +-
.../fortress/core/util/time/Timeout.java | 4 +-
.../fortress/core/util/time/Validator.java | 4 +-
src/test/jmeter/ftCheckAccess.jmx | 4 +-
12 files changed, 104 insertions(+), 66 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/apacheds.properties.example
----------------------------------------------------------------------
diff --git a/apacheds.properties.example b/apacheds.properties.example
deleted file mode 100644
index 4c88921..0000000
--- a/apacheds.properties.example
+++ /dev/null
@@ -1,53 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-#
-########################################################################
-# 0. About the fortress apacheds.properties file
-########################################################################
-
-# Use this property file to specify environment settings specific to apache directory server runtime components.
-# These parameters will be loaded into the following locations by the Fortress during the init targets within the build.xml ant management utility:
-# a. fortress.properties - Fortress' configuration file tells fortress runtime how to connect to remote resources
-# b. refreshLDAPData.xml - Used by fortress to initialize and base load the LDAP DIT data structures. Fortress also stores runtime params inside 'ou=Config' container on remote server.
-
-########################################################################
-# 1. BEGIN LDAP CLIENT CONFIGURATION SECTION: (Ignore if using HTTP):
-########################################################################
-
-# This is default, tells fortress what type of ldap server in use:
-ldap.server.type=apacheds
-
-# These parameters point fortress to LDAP host:
-ldap.host=localhost
-ldap.port=10389
-enable.ldap.ssl=false
-
-# These are the connection parameters used for LDAP service account:
-root.dn=uid=admin,ou=system
-# This admin pass is bound for fortress.properties used by 'admin' pooled connections:
-cfg.root.pw=secret
-
-# These are needed for client SSL connections with LDAP Server:
-#enable.ldap.ssl=true
-#ldap.host=fortressdemo2.com
-#ldap.port=10636
-#enable.ldap.ssl.debug=true
-#trust.store=src/test/resources/certs/mytruststore
-#trust.store.password=changeit
-#trust.store.set.prop=true
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java b/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
index b7989cb..6825bf8 100755
--- a/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
+++ b/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
@@ -488,6 +488,11 @@ public final class GlobalErrIds
public static final int ACTV_FAILED_DSD = 2055;
/**
+ * Entity activation failed due to Dynamic Separation of Duty restriction on Role.
+ */
+ public static final int ACTV_FAILED_AUTHN = 2056;
+
+ /**
* 3000's - Permission Entity
*/
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/impl/DSDChecker.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/impl/DSDChecker.java b/src/main/java/org/apache/directory/fortress/core/impl/DSDChecker.java
index 21431fd..16e4e04 100755
--- a/src/main/java/org/apache/directory/fortress/core/impl/DSDChecker.java
+++ b/src/main/java/org/apache/directory/fortress/core/impl/DSDChecker.java
@@ -28,6 +28,7 @@ import org.apache.directory.fortress.core.model.SDSet;
import org.apache.directory.fortress.core.model.Session;
import org.apache.directory.fortress.core.model.UserRole;
import org.apache.directory.fortress.core.model.Warning;
+import org.apache.directory.fortress.core.util.VUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.apache.directory.fortress.core.GlobalErrIds;
@@ -69,10 +70,11 @@ public class DSDChecker
* @param session contains list of RBAC roles {@link org.apache.directory.fortress.core.model.UserRole} targeted for activation.
* @param constraint required for Validator interface, not used here..
* @param time required for Validator interface, not used here.
+ * @param type required by interface, not used here.
* @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_DSD} if failed.
*/
@Override
- public int validate( Session session, Constraint constraint, Time time )
+ public int validate( Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
throws org.apache.directory.fortress.core.SecurityException
{
int rc = 0;
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/AuthNValidator.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/AuthNValidator.java b/src/main/java/org/apache/directory/fortress/core/util/AuthNValidator.java
new file mode 100644
index 0000000..0b64b35
--- /dev/null
+++ b/src/main/java/org/apache/directory/fortress/core/util/AuthNValidator.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.directory.fortress.core.util;
+
+
+import org.apache.directory.fortress.core.GlobalErrIds;
+import org.apache.directory.fortress.core.model.Constraint;
+import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.time.Time;
+import org.apache.directory.fortress.core.util.time.Validator;
+
+/**
+ * This class performs authentication validation. This validator will ensure the current user has been authenticated before activating the role into their session.
+ *
+ * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
+ */
+public abstract class AuthNValidator
+ implements Validator
+{
+ protected String getRoleName()
+ {
+ return roleName;
+ }
+
+ protected void setRoleName(String roleName)
+ {
+ this.roleName = roleName;
+ }
+
+ private String roleName;
+
+
+ /**
+ * This method is called during entity activation, {@link org.apache.directory.fortress.core.util.VUtil#validateConstraints} and ensures the current user has been
+ * authenticated before activating the role into their session.
+ *
+ * This validation routine will automatically pass if session.isAuthenticated is true and the role matches the subclasses name.
+ *
+ * @param session contains the isAuthenticated flag.
+ * @param constraint contains the role name.
+ * @param time contains the current time stamp.
+ * @param type only constraints of type role use this.
+ * @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_AUTHN} if failed.
+ */
+
+ public int validate(Session session, Constraint constraint, Time time, VUtil.ConstraintType type)
+ {
+ int rc = 0;
+ if(type == VUtil.ConstraintType.ROLE && constraint.getName().equalsIgnoreCase( roleName ) && !session.isAuthenticated() )
+ {
+ rc = GlobalErrIds.ACTV_FAILED_AUTHN;
+ }
+ return rc;
+ }
+}
+
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/VUtil.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/VUtil.java b/src/main/java/org/apache/directory/fortress/core/util/VUtil.java
index c7f45c9..6dbcd66 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/VUtil.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/VUtil.java
@@ -568,7 +568,7 @@ public final class VUtil implements ConstraintValidator
// first check the constraint on the user:
if ( type == ConstraintType.USER )
{
- rc = val.validate( session, session.getUser(), currTime );
+ rc = val.validate( session, session.getUser(), currTime, type );
if ( rc > 0 )
{
String info = location + " user [" + session.getUserId() + "] was deactivated reason code [" + rc
@@ -587,7 +587,7 @@ public final class VUtil implements ConstraintValidator
while ( roleItems.hasNext() )
{
Constraint constraint = roleItems.next();
- rc = val.validate( session, constraint, currTime );
+ rc = val.validate( session, constraint, currTime, type );
if ( rc > 0 )
{
@@ -607,7 +607,7 @@ public final class VUtil implements ConstraintValidator
while ( roleItems.hasNext() )
{
Constraint constraint = ( Constraint ) roleItems.next();
- rc = val.validate( session, constraint, currTime );
+ rc = val.validate( session, constraint, currTime, ConstraintType.ROLE );
if ( rc > 0 )
{
String msg = location + " admin role [" + constraint.getName() + "] for user ["
@@ -627,7 +627,7 @@ public final class VUtil implements ConstraintValidator
&& CollectionUtils.isNotEmpty( session.getRoles() ) )
{
Validator dsdVal = ( Validator ) ClassUtil.createInstance( DSDVALIDATOR );
- dsdVal.validate( session, session.getUser(), null );
+ dsdVal.validate( session, session.getUser(), null, null );
}
// reset the user's last access timestamp:
session.setLastAccess();
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/time/ClockTime.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/ClockTime.java b/src/main/java/org/apache/directory/fortress/core/util/time/ClockTime.java
index 3969d93..1fea6e0 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/time/ClockTime.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/ClockTime.java
@@ -24,6 +24,7 @@ import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.GlobalIds;
import org.apache.directory.fortress.core.model.Constraint;
import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.VUtil;
/**
@@ -52,10 +53,11 @@ public class ClockTime
* @param session required for {@link Validator} interface but not used here.
* @param constraint contains the begin and end times. Maps listed above.
* @param time contains the current time.
+ * @param type required by interface, not used here.
* @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_TIME} if failed.
*/
@Override
- public int validate( Session session, Constraint constraint, Time time )
+ public int validate( Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
{
int rc = GlobalErrIds.ACTV_FAILED_TIME;
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/time/Date.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/Date.java b/src/main/java/org/apache/directory/fortress/core/util/time/Date.java
index 193ad58..cdff948 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/time/Date.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/Date.java
@@ -23,6 +23,7 @@ import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.GlobalIds;
import org.apache.directory.fortress.core.model.Constraint;
import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.VUtil;
/**
* This class performs date validation for {@link Constraint}. This validator will ensure the current date falls between {@link Constraint#getBeginDate()} and {@link Constraint#getEndDate()}
@@ -54,10 +55,11 @@ public class Date
* @param session required for {@link Validator} interface but not used here.
* @param constraint contains the begin and end dates. Maps listed above.
* @param time contains the current time stamp.
+ * @param type required by interface, not used here.
* @return '0' if validation succeeds else {@link GlobalErrIds#ACTV_FAILED_DATE} if failed.
*/
@Override
- public int validate(Session session, Constraint constraint, Time time)
+ public int validate(Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
{
int rc = GlobalErrIds.ACTV_FAILED_DATE;
boolean noBegin = false;
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/time/Day.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/Day.java b/src/main/java/org/apache/directory/fortress/core/util/time/Day.java
index a6ba24a..256d3cf 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/time/Day.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/Day.java
@@ -23,6 +23,7 @@ import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.GlobalIds;
import org.apache.directory.fortress.core.model.Constraint;
import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.VUtil;
/**
* This class performs lock day of week validation for {@link Constraint}. This validator will ensure the current day is allowed for {@link Constraint#getDayMask()}.
@@ -49,10 +50,11 @@ public class Day
* @param session required for {@link Validator} interface but not used here.
* @param constraint contains the days of week entity may be activated. Data mappings listed above.
* @param time contains the current time stamp.
+ * @param type required by interface, not used here.
* @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_DAY} if failed.
*/
@Override
- public int validate(Session session, Constraint constraint, Time time)
+ public int validate(Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
{
int rc = GlobalErrIds.ACTV_FAILED_DAY;
if (constraint.getDayMask() == null || constraint.getDayMask().compareToIgnoreCase(GlobalIds.ALL) == 0)
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/time/LockDate.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/LockDate.java b/src/main/java/org/apache/directory/fortress/core/util/time/LockDate.java
index 402f50d..857aad5 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/time/LockDate.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/LockDate.java
@@ -24,6 +24,7 @@ import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.GlobalIds;
import org.apache.directory.fortress.core.model.Constraint;
import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.VUtil;
/**
* This class performs lock date validation for {@link org.apache.directory.fortress.core.model.Constraint}. This validator will ensure the current date falls outside {@link org.apache.directory.fortress.core.model.Constraint#getBeginLockDate()} and {@link Constraint#getEndLockDate()} range.
@@ -58,7 +59,7 @@ public class LockDate
* @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_LOCK} if failed.
*/
@Override
- public int validate(Session session, Constraint constraint, Time time)
+ public int validate(Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
{
int rc = GlobalErrIds.ACTV_FAILED_LOCK;
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/time/Timeout.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/Timeout.java b/src/main/java/org/apache/directory/fortress/core/util/time/Timeout.java
index 253dcd9..07969de 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/time/Timeout.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/Timeout.java
@@ -23,6 +23,7 @@ package org.apache.directory.fortress.core.util.time;
import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.model.Constraint;
import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.VUtil;
/**
@@ -49,9 +50,10 @@ public class Timeout implements Validator
* @param session required for {@link Validator} interface but not used here.
* @param constraint contains the elapsed time entity may remain inactive in minutes. Maps listed above.
* @param time contains the current timestamp.
+ * @param type required by interface, not used here.
* @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_TIMEOUT} if failed.
*/
- public int validate( Session session, Constraint constraint, Time time )
+ public int validate( Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
{
int rc = GlobalErrIds.ACTV_FAILED_TIMEOUT;
long timeLimit;
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/main/java/org/apache/directory/fortress/core/util/time/Validator.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/Validator.java b/src/main/java/org/apache/directory/fortress/core/util/time/Validator.java
index 5b5ef17..4fbedab 100755
--- a/src/main/java/org/apache/directory/fortress/core/util/time/Validator.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/Validator.java
@@ -22,6 +22,7 @@ package org.apache.directory.fortress.core.util.time;
import org.apache.directory.fortress.core.model.Constraint;
import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.util.VUtil;
/**
@@ -76,9 +77,10 @@ public interface Validator
* @param session contains the reference to Fortress entities that are targets for constraints.
* @param constraint contains the temporal attributes.
* @param time current time of day.
+ * @param type contains type of either role or user constraint.
* @return activation failure code.
* @throws org.apache.directory.fortress.core.SecurityException in the event of validation fails or system exception.
*/
- int validate( Session session, Constraint constraint, Time time )
+ int validate( Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
throws org.apache.directory.fortress.core.SecurityException;
}
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/69930fe2/src/test/jmeter/ftCheckAccess.jmx
----------------------------------------------------------------------
diff --git a/src/test/jmeter/ftCheckAccess.jmx b/src/test/jmeter/ftCheckAccess.jmx
index 72b3fdf..77cd208 100644
--- a/src/test/jmeter/ftCheckAccess.jmx
+++ b/src/test/jmeter/ftCheckAccess.jmx
@@ -45,9 +45,9 @@
<elementProp name="ThreadGroup.main_controller" elementType="LoopController" guiclass="LoopControlPanel" testclass="LoopController" testname="Loop Controller" enabled="true">
<boolProp name="LoopController.continue_forever">false</boolProp>
- <stringProp name="LoopController.loops">50000</stringProp>
+ <stringProp name="LoopController.loops">5000</stringProp>
</elementProp>
- <stringProp name="ThreadGroup.num_threads">25</stringProp>
+ <stringProp name="ThreadGroup.num_threads">10</stringProp>
<stringProp name="ThreadGroup.ramp_time">25</stringProp>
<boolProp name="ThreadGroup.scheduler">false</boolProp>
<stringProp name="ThreadGroup.duration"></stringProp>