You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@isis.apache.org by da...@apache.org on 2013/03/28 11:35:34 UTC
[10/20] ISIS-381: mothballing HTML viewer, SQL security, LDAP security
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/appended-resources/supplemental-models.xml
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/appended-resources/supplemental-models.xml b/mothballed/component/security/ldap/src/main/appended-resources/supplemental-models.xml
new file mode 100644
index 0000000..ecd3906
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/appended-resources/supplemental-models.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor
+ license agreements. See the NOTICE file distributed with this work for additional
+ information regarding copyright ownership. The ASF licenses this file to
+ you under the Apache License, Version 2.0 (the "License"); you may not use
+ this file except in compliance with the License. You may obtain a copy of
+ the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required
+ by applicable law or agreed to in writing, software distributed under the
+ License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
+ OF ANY KIND, either express or implied. See the License for the specific
+ language governing permissions and limitations under the License. -->
+<supplementalDataModels xmlns="http://maven.apache.org/supplemental-model/1.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/supplemental-model/1.0.0 http://maven.apache.org/xsd/supplemental-model-1.0.0.xsd">
+
+ <supplement>
+ <project>
+ <groupId>aopalliance</groupId>
+ <artifactId>aopalliance</artifactId>
+ <version>1.0</version>
+ <licenses>
+ <license>
+ <name>Public Domain</name>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <!-- not quite sure why licenses:download-license flags this, since license info seems to be in its POM -->
+ <project>
+ <groupId>org.datanucleus</groupId>
+ <artifactId>datanucleus-jodatime</artifactId>
+ <version>3.1.1</version>
+ <licenses>
+ <license>
+ <name>The Apache Software License, Version 2.0</name>
+ <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <project>
+ <groupId>org.scannotation</groupId>
+ <artifactId>scannotation</artifactId>
+ <version>1.0.3</version>
+ <licenses>
+ <license>
+ <name>The Apache Software License, Version 2.0</name>
+ <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <project>
+ <groupId>dom4j</groupId>
+ <artifactId>dom4j</artifactId>
+ <version>1.6.1</version>
+ <licenses>
+ <license>
+ <name>BSD License</name>
+ <url>http://dom4j.sourceforge.net/dom4j-1.6.1/license.html</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <project>
+ <groupId>net.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <version>1.0</version>
+ <licenses>
+ <license>
+ <name>Creative Commons Attribution 2.5 License</name>
+ <url>http://creativecommons.org/licenses/by/2.5/</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+
+ <supplement>
+ <project>
+ <groupId>xalan</groupId>
+ <artifactId>xalan</artifactId>
+ <version>2.7.0</version>
+ <licenses>
+ <license>
+ <name>The Apache Software License, Version 2.0</name>
+ <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+
+</supplementalDataModels>
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationConstants.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationConstants.java b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationConstants.java
new file mode 100644
index 0000000..4997151
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationConstants.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authentication;
+
+import org.apache.isis.core.commons.config.ConfigurationConstants;
+import org.apache.isis.core.runtime.authentication.AuthenticationManagerInstaller;
+
+public final class LdapAuthenticationConstants {
+
+ public static final String ROOT = ConfigurationConstants.ROOT + AuthenticationManagerInstaller.TYPE + "." + LdapAuthenticationManagerInstaller.NAME + ".";
+
+ public static final String SERVER_KEY = ROOT + "server";
+ public static final String SERVER_DEFAULT = "com.sun.jndi.ldap.LdapCtxFactory";
+
+ public static final String LDAPDN_KEY = ROOT + "dn";
+
+ public static String FILTER = "(objectclass=organizationalRole)";
+
+ private LdapAuthenticationConstants() {
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationManagerInstaller.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationManagerInstaller.java b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationManagerInstaller.java
new file mode 100644
index 0000000..4f8abd3
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticationManagerInstaller.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authentication;
+
+import java.util.List;
+
+import com.google.common.collect.Lists;
+
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.runtime.authentication.AuthenticationManagerStandardInstallerAbstractForDfltRuntime;
+import org.apache.isis.core.runtime.authentication.standard.Authenticator;
+
+public class LdapAuthenticationManagerInstaller extends AuthenticationManagerStandardInstallerAbstractForDfltRuntime {
+
+ public static String NAME = "ldap";
+
+ public LdapAuthenticationManagerInstaller() {
+ super(NAME);
+ }
+
+ @Override
+ protected List<Authenticator> createAuthenticators(final IsisConfiguration configuration) {
+ return Lists.<Authenticator> newArrayList(new LdapAuthenticator(configuration));
+ }
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticator.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticator.java b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticator.java
new file mode 100644
index 0000000..19f5ec1
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authentication/LdapAuthenticator.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authentication;
+
+import java.util.ArrayList;
+import java.util.Hashtable;
+import java.util.List;
+
+import javax.naming.AuthenticationException;
+import javax.naming.Context;
+import javax.naming.NamingEnumeration;
+import javax.naming.NamingException;
+import javax.naming.directory.DirContext;
+import javax.naming.directory.InitialDirContext;
+import javax.naming.directory.SearchControls;
+import javax.naming.directory.SearchResult;
+
+import org.apache.log4j.Logger;
+
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.commons.ensure.Assert;
+import org.apache.isis.core.commons.exceptions.IsisException;
+import org.apache.isis.core.runtime.authentication.AuthenticationRequest;
+import org.apache.isis.core.runtime.authentication.AuthenticationRequestPassword;
+import org.apache.isis.core.runtime.authentication.standard.AuthenticatorAbstract;
+
+public class LdapAuthenticator extends AuthenticatorAbstract {
+
+ private static final Logger LOG = Logger.getLogger(LdapAuthenticator.class);
+
+ private final String ldapProvider;
+ private final String ldapDn;
+
+ public LdapAuthenticator(final IsisConfiguration configuration) {
+ super(configuration);
+ ldapProvider = getConfiguration().getString(LdapAuthenticationConstants.SERVER_KEY);
+ ldapDn = getConfiguration().getString(LdapAuthenticationConstants.LDAPDN_KEY);
+ }
+
+ @Override
+ public final boolean canAuthenticate(final Class<? extends AuthenticationRequest> authenticationRequestClass) {
+ return AuthenticationRequestPassword.class.isAssignableFrom(authenticationRequestClass);
+ }
+
+ private void setRoles(final DirContext authContext, final AuthenticationRequest request, final String username) throws NamingException {
+ final List<String> roles = new ArrayList<String>();
+ final SearchControls controls = new SearchControls();
+ controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
+ controls.setReturningAttributes(new String[] { "cn" });
+ final String name = "uid=" + username + ", " + ldapDn;
+ final NamingEnumeration<SearchResult> answer = authContext.search(name, LdapAuthenticationConstants.FILTER, controls);
+ while (answer.hasMore()) {
+ final SearchResult result = answer.nextElement();
+ final String roleName = (String) result.getAttributes().get("cn").get(0);
+ roles.add(roleName);
+ LOG.debug("Adding role: " + roleName);
+ }
+ request.setRoles(roles);
+ }
+
+ @Override
+ public boolean isValid(final AuthenticationRequest request) {
+ final AuthenticationRequestPassword passwordRequest = (AuthenticationRequestPassword) request;
+ final String username = passwordRequest.getName();
+ Assert.assertNotNull(username);
+ if (username.equals("")) {
+ LOG.debug("empty username");
+ return false; // failed authentication
+ }
+ final String password = passwordRequest.getPassword();
+ Assert.assertNotNull(password);
+
+ final Hashtable<String, String> env = new Hashtable<String, String>(4);
+ env.put(Context.INITIAL_CONTEXT_FACTORY, LdapAuthenticationConstants.SERVER_DEFAULT);
+ env.put(Context.PROVIDER_URL, ldapProvider);
+ env.put(Context.SECURITY_PRINCIPAL, "uid=" + username + ", " + ldapDn);
+ env.put(Context.SECURITY_CREDENTIALS, password);
+
+ DirContext authContext = null;
+ try {
+ authContext = new InitialDirContext(env);
+ setRoles(authContext, request, username);
+ return true;
+ } catch (final AuthenticationException e) {
+ return false;
+ } catch (final NamingException e) {
+ throw new IsisException("Failed to authenticate using LDAP", e);
+ } finally {
+ try {
+ if (authContext != null) {
+ authContext.close();
+ }
+ } catch (final NamingException e) {
+ throw new IsisException("Failed to authenticate using LDAP", e);
+ }
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationConstants.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationConstants.java b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationConstants.java
new file mode 100644
index 0000000..973e853
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationConstants.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authorization;
+
+import org.apache.isis.core.commons.config.ConfigurationConstants;
+import org.apache.isis.core.runtime.authorization.AuthorizationManagerInstaller;
+import org.apache.isis.core.runtime.authorization.standard.AuthorizationConstants;
+import org.apache.isis.security.ldap.authentication.LdapAuthenticationConstants;
+
+public final class LdapAuthorizationConstants {
+
+ private static final String ROOT = ConfigurationConstants.ROOT + AuthorizationManagerInstaller.TYPE + "." + LdapAuthorizationManagerInstaller.NAME + ".";
+
+ public static final String SERVER_KEY = ROOT + "server";
+ public static final String SERVER_DEFAULT = LdapAuthenticationConstants.SERVER_DEFAULT;
+
+ public static final String LDAPDN_KEY = ROOT + "dn";
+
+ public static final String APP_DN_KEY = ROOT + "application.dn";
+
+ public static final String LEARN_KEY = AuthorizationConstants.LEARN;
+ public static final boolean LEARN_DEFAULT = AuthorizationConstants.LEARN_DEFAULT;
+
+ private LdapAuthorizationConstants() {
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationManagerInstaller.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationManagerInstaller.java b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationManagerInstaller.java
new file mode 100644
index 0000000..7b9d5ad
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizationManagerInstaller.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authorization;
+
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.runtime.authorization.standard.AuthorizationManagerStandardInstallerAbstract;
+import org.apache.isis.core.runtime.authorization.standard.Authorizor;
+
+public class LdapAuthorizationManagerInstaller extends AuthorizationManagerStandardInstallerAbstract {
+
+ public static String NAME = "ldap";
+
+ public LdapAuthorizationManagerInstaller() {
+ super(NAME);
+ }
+
+ @Override
+ protected Authorizor createAuthorizor(final IsisConfiguration configuration) {
+ return new LdapAuthorizor(configuration);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizor.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizor.java b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizor.java
new file mode 100644
index 0000000..d88255e
--- /dev/null
+++ b/mothballed/component/security/ldap/src/main/java/org/apache/isis/security/ldap/authorization/LdapAuthorizor.java
@@ -0,0 +1,274 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authorization;
+
+import java.util.Hashtable;
+
+import javax.naming.AuthenticationException;
+import javax.naming.Context;
+import javax.naming.NameAlreadyBoundException;
+import javax.naming.NameNotFoundException;
+import javax.naming.NamingEnumeration;
+import javax.naming.NamingException;
+import javax.naming.directory.Attribute;
+import javax.naming.directory.Attributes;
+import javax.naming.directory.BasicAttribute;
+import javax.naming.directory.BasicAttributes;
+import javax.naming.directory.DirContext;
+import javax.naming.directory.InitialDirContext;
+import javax.naming.directory.SearchControls;
+import javax.naming.directory.SearchResult;
+
+import org.apache.log4j.Logger;
+
+import org.apache.isis.applib.Identifier;
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.commons.exceptions.IsisException;
+import org.apache.isis.core.runtime.authorization.standard.AuthorizorAbstract;
+
+public class LdapAuthorizor extends AuthorizorAbstract {
+
+ private static final Logger LOG = Logger.getLogger(LdapAuthorizor.class);
+
+ private static final String FILTER = "(&(uniquemember={0}) (|(cn={1}) (cn={2}) (cn={3})))";
+ private static final String ACCESS_QUALIFIER_RW = "RW";
+
+ private final String ldapProvider;
+ @SuppressWarnings("unused")
+ private final String ldapDn;
+ private final String appDn;
+ private final boolean learn;
+
+ public LdapAuthorizor(final IsisConfiguration configuration) {
+ super(configuration);
+
+ ldapProvider = getConfiguration().getString(LdapAuthorizationConstants.SERVER_KEY);
+ ldapDn = getConfiguration().getString(LdapAuthorizationConstants.LDAPDN_KEY);
+ appDn = getConfiguration().getString(LdapAuthorizationConstants.APP_DN_KEY);
+ learn = getConfiguration().getBoolean(LdapAuthorizationConstants.LEARN_KEY, LdapAuthorizationConstants.LEARN_DEFAULT);
+ }
+
+ // ////////////////////////////////////////////////////////
+ // init, shutdown
+ // ////////////////////////////////////////////////////////
+
+ @Override
+ public void init() {
+ }
+
+ @Override
+ public void shutdown() {
+ // do nothing
+ }
+
+ // ////////////////////////////////////////////////////////
+ // API
+ // ////////////////////////////////////////////////////////
+
+ @Override
+ public boolean isUsableInRole(final String role, final Identifier member) {
+ if(role == null) {
+ return false;
+ }
+ return isAuthorised(role, member, ACCESS_QUALIFIER_RW);
+ }
+
+ @Override
+ public boolean isVisibleInRole(final String role, final Identifier member) {
+ if(role == null) {
+ return false;
+ }
+ return isAuthorised(role, member, null);
+ }
+
+ private boolean isAuthorised(final String role, final Identifier member, final String flag) {
+
+ final Hashtable<String, String> env = new Hashtable<String, String>(4);
+ env.put(Context.INITIAL_CONTEXT_FACTORY, LdapAuthorizationConstants.SERVER_DEFAULT);
+ env.put(Context.PROVIDER_URL, ldapProvider);
+
+ if (learn) {
+ env.put(Context.SECURITY_PRINCIPAL, "uid=admin, ou=system");
+ env.put(Context.SECURITY_CREDENTIALS, "secret");
+ }
+
+ DirContext authContext = null;
+ try {
+ authContext = new InitialDirContext(env);
+ if (learn) {
+ return bindNames(authContext, role, member);
+ }
+ return isPermitted(authContext, role, member, flag);
+ } catch (final AuthenticationException e) {
+ throw new IsisException("Failed to authorise using LDAP", e);
+ } catch (final NameNotFoundException e) {
+ // missing class in ldap server - treat as authorisation failure
+ LOG.error(e);
+ return false;
+ } catch (final NamingException e) {
+ throw new IsisException("Failed to authorise using LDAP", e);
+ } finally {
+ try {
+ if (authContext != null) {
+ authContext.close();
+ }
+ } catch (final NamingException e) {
+ throw new IsisException("Failed to authorise using LDAP", e);
+ }
+ }
+ }
+
+ private boolean isPermitted(final DirContext authContext, final String role, final Identifier member, final String flag) throws NamingException {
+ final String cls = member.toIdentityString(Identifier.CLASS);
+ final String name = member.toIdentityString(Identifier.MEMBERNAME_ONLY);
+ final String parms = member.toIdentityString(Identifier.PARAMETERS_ONLY);
+
+ final Object[] args = new Object[] { role, cls, name, parms };
+ final SearchControls controls = new SearchControls();
+ controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
+ final String searchName = buildSearchName(cls, appDn);
+ final NamingEnumeration<SearchResult> answer = authContext.search(searchName, FILTER, args, controls);
+ while (answer.hasMore()) {
+ // if we have a class match must be OK
+ // if we have a name match must be OK (parent must be class by
+ // definition)
+ // but parm matches need to check that parent = name
+ final SearchResult result = answer.nextElement();
+ final String cn = (String) result.getAttributes().get("cn").get(0);
+ // result.getname gives relative path from class - so if contains
+ // 'name' it is parent of parms
+ // entry
+ if (cn.equals(cls) || cn.equals(name) || ((cn.equals(parms) && result.getName().contains(name)))) {
+ // last check if there is a flag attribute
+ if (flag != null) {
+ final Attribute flagAttribute = result.getAttributes().get("flag");
+ if (flagAttribute != null) {
+ // since there is a flag need to check is match
+ return flag.equalsIgnoreCase((String) flagAttribute.get(0));
+ }
+ }
+ return true;
+ }
+ }
+ return false;
+ }
+
+ private String buildSearchName(final String cls, final String appDn) {
+ final StringBuffer search = new StringBuffer();
+ search.append("cn=").append(cls).append(", ").append(appDn);
+ final String searchName = search.toString();
+ return searchName;
+ }
+
+ private Attributes createCommonAttributes(final String cnName, final String role, final boolean isClass) {
+ final Attributes attrs = new BasicAttributes(true); // case-ignore
+ final Attribute objclass = new BasicAttribute("objectclass");
+ objclass.add("top");
+ objclass.add("javaContainer");
+ objclass.add("groupOfUniqueNames");
+ if (isClass) {
+ objclass.add("javaObject");
+ }
+ final Attribute cn = new BasicAttribute("cn");
+ cn.add(cnName);
+ final Attribute uniqueMember = new BasicAttribute("uniquemember");
+ uniqueMember.add(role);
+ if (isClass) {
+ final Attribute javaClass = new BasicAttribute("javaclassname");
+ javaClass.add(cnName);
+ attrs.put(javaClass);
+ }
+ attrs.put(objclass);
+ attrs.put(cn);
+ attrs.put(uniqueMember);
+ return attrs;
+ }
+
+ private String createClassBindname(final String cls) {
+ final StringBuffer bindName = new StringBuffer();
+ bindName.append("cn=").append(cls).append(", ").append(appDn);
+ return bindName.toString();
+ }
+
+ private void bindClass(final DirContext authContext, final String role, final Identifier member) throws NamingException {
+ final String cls = member.toIdentityString(Identifier.CLASS);
+ final Attributes attrs = createCommonAttributes(cls, role, true);
+ try {
+ authContext.createSubcontext(createClassBindname(cls), attrs);
+ } catch (final NameAlreadyBoundException e) {
+ // ignore as this is just debug code
+ // and we don't check if this is already bound first
+ LOG.debug(e);
+ }
+ }
+
+ private String createNameBindname(final String cls, final String name) {
+ final StringBuffer bindName = new StringBuffer();
+ bindName.append("cn=").append(name).append(", ");
+ bindName.append(createClassBindname(cls));
+ return bindName.toString();
+ }
+
+ private void bindName(final DirContext authContext, final String role, final Identifier member) throws NamingException {
+ final String cls = member.toIdentityString(Identifier.CLASS);
+ final String name = member.toIdentityString(Identifier.MEMBERNAME_ONLY);
+ final Attributes attrs = createCommonAttributes(name, role, false);
+ try {
+ authContext.createSubcontext(createNameBindname(cls, name), attrs);
+ } catch (final NameAlreadyBoundException e) {
+ // ignore as this is just debug code
+ // and we don't check if this is already bound first
+ LOG.debug(e);
+ }
+ }
+
+ private String createParmsBindname(final String cls, final String name, final String parms) {
+ final StringBuffer bindName = new StringBuffer();
+ bindName.append("cn=").append(parms).append(", ");
+ bindName.append(createNameBindname(cls, name));
+ return bindName.toString();
+ }
+
+ private void bindParms(final DirContext authContext, final String role, final Identifier member) throws NamingException {
+ final String cls = member.toIdentityString(Identifier.CLASS);
+ final String name = member.toIdentityString(Identifier.MEMBERNAME_ONLY);
+ // have to escape any commas in parms string or ldap parser is not happy
+ final String parms = member.toIdentityString(Identifier.PARAMETERS_ONLY).replace(",", "\\,");
+ if (parms.length() == 0) {
+ return;
+ }
+ final Attributes attrs = createCommonAttributes(parms, role, false);
+ try {
+ authContext.createSubcontext(createParmsBindname(cls, name, parms), attrs);
+ } catch (final NameAlreadyBoundException e) {
+ // ignore as this is just debug code
+ // and we don't check if this is already bound first
+ LOG.debug(e);
+ }
+ }
+
+ private boolean bindNames(final DirContext authContext, final String role, final Identifier member) throws NamingException {
+ bindClass(authContext, role, member);
+ bindName(authContext, role, member);
+ bindParms(authContext, role, member);
+ return true;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/site/apt/index.apt
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/site/apt/index.apt b/mothballed/component/security/ldap/src/site/apt/index.apt
new file mode 100644
index 0000000..8978117
--- /dev/null
+++ b/mothballed/component/security/ldap/src/site/apt/index.apt
@@ -0,0 +1,44 @@
+~~ Licensed to the Apache Software Foundation (ASF) under one
+~~ or more contributor license agreements. See the NOTICE file
+~~ distributed with this work for additional information
+~~ regarding copyright ownership. The ASF licenses this file
+~~ to you under the Apache License, Version 2.0 (the
+~~ "License"); you may not use this file except in compliance
+~~ with the License. You may obtain a copy of the License at
+~~
+~~ http://www.apache.org/licenses/LICENSE-2.0
+~~
+~~ Unless required by applicable law or agreed to in writing,
+~~ software distributed under the License is distributed on an
+~~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+~~ KIND, either express or implied. See the License for the
+~~ specific language governing permissions and limitations
+~~ under the License.
+
+
+
+Security LDAP Implementation
+
+ The <ldap security> module provides an implementation of Isis' authentication and
+ authorization APIs where credentials are stored in a well-known LDAP server.
+
+ This makes the LDAP security implementation suitable for deployment where an
+ LDAP exists. Optionally it may be combined with other implementations (for example
+ the authorization might be performed using the file-based implementation).
+
+ See the security
+ {{{../docbkx/html/guide/isis-security.html}HTML}} or
+ {{{../docbkx/pdf/isis-security.pdf}PDF}} documentation for more detail.
+
+Alternatives
+
+ Alternatives include:
+
+ * the {{{../dflt/index.html}default}} (no-op) security implementation, for prototyping use only
+
+ * the {{{../file/index.html}file-based}} security (reading from simple flat files)
+
+ * the {{{../sql/index.html}SQL}} security (reading from simple SQL tables)
+
+ []
+
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/site/apt/jottings.apt
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/site/apt/jottings.apt b/mothballed/component/security/ldap/src/site/apt/jottings.apt
new file mode 100644
index 0000000..c5d1200
--- /dev/null
+++ b/mothballed/component/security/ldap/src/site/apt/jottings.apt
@@ -0,0 +1,24 @@
+~~ Licensed to the Apache Software Foundation (ASF) under one
+~~ or more contributor license agreements. See the NOTICE file
+~~ distributed with this work for additional information
+~~ regarding copyright ownership. The ASF licenses this file
+~~ to you under the Apache License, Version 2.0 (the
+~~ "License"); you may not use this file except in compliance
+~~ with the License. You may obtain a copy of the License at
+~~
+~~ http://www.apache.org/licenses/LICENSE-2.0
+~~
+~~ Unless required by applicable law or agreed to in writing,
+~~ software distributed under the License is distributed on an
+~~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+~~ KIND, either express or implied. See the License for the
+~~ specific language governing permissions and limitations
+~~ under the License.
+
+
+
+Jottings
+
+ This page is to capture any random jottings relating to this module prior
+ to being moved into formal documentation.
+
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/site/site.xml
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/site/site.xml b/mothballed/component/security/ldap/src/site/site.xml
new file mode 100644
index 0000000..1f465f4
--- /dev/null
+++ b/mothballed/component/security/ldap/src/site/site.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project>
+
+ <body>
+ <breadcrumbs>
+ <item name="LDAP" href="index.html"/>
+ </breadcrumbs>
+
+ <menu name="LDAP Security">
+ <item name="About" href="index.html" />
+ <item name="Jottings" href="jottings.html" />
+ </menu>
+
+ <menu name="Security Modules">
+ <item name="Default (No-op)" href="../dflt/index.html" />
+ <item name="File" href="../file/index.html" />
+ <item name="LDAP" href="../ldap/index.html" />
+ <item name="SQL" href="../sql/index.html" />
+ </menu>
+
+ <menu name="Maven Reports" ref="reports" />
+ </body>
+</project>
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/ldap/src/test/java/org/apache/isis/security/ldap/authentication/LdapAuthenticatorTester.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/ldap/src/test/java/org/apache/isis/security/ldap/authentication/LdapAuthenticatorTester.java b/mothballed/component/security/ldap/src/test/java/org/apache/isis/security/ldap/authentication/LdapAuthenticatorTester.java
new file mode 100644
index 0000000..e84ec1c
--- /dev/null
+++ b/mothballed/component/security/ldap/src/test/java/org/apache/isis/security/ldap/authentication/LdapAuthenticatorTester.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.ldap.authentication;
+
+import org.apache.isis.core.runtime.authentication.AuthenticationRequestPassword;
+import org.apache.isis.core.runtime.system.context.IsisContext;
+
+public class LdapAuthenticatorTester {
+
+ public static void main(final String[] args) {
+ final LdapAuthenticator auth = new LdapAuthenticator(IsisContext.getConfiguration());
+
+ AuthenticationRequestPassword req = new AuthenticationRequestPassword("unauth", "pass");
+ try {
+ System.out.println("unauth auth=" + auth.isValid(req));
+ } catch (final Exception e) {
+ System.out.println("unauth failed authentication!");
+ e.printStackTrace();
+ }
+ req = new AuthenticationRequestPassword("joe", "pass");
+ try {
+ System.out.println("joe auth=" + auth.isValid(req));
+ } catch (final Exception e) {
+ System.out.println("joe auth failed!!");
+ e.printStackTrace();
+ }
+ req = new AuthenticationRequestPassword("joe", "wrongpass");
+ try {
+ System.out.println("joe wrongpass auth=" + auth.isValid(req));
+ } catch (final Exception e) {
+ System.out.println("joe wrongpass auth failed!!");
+ e.printStackTrace();
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/NOTICE
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/NOTICE b/mothballed/component/security/sql/NOTICE
new file mode 100755
index 0000000..ba21d0c
--- /dev/null
+++ b/mothballed/component/security/sql/NOTICE
@@ -0,0 +1,7 @@
+Apache Isis
+Copyright 2010-2013 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/hsql-db/authenticator-tests.script
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/hsql-db/authenticator-tests.script b/mothballed/component/security/sql/hsql-db/authenticator-tests.script
new file mode 100644
index 0000000..18d5aac
--- /dev/null
+++ b/mothballed/component/security/sql/hsql-db/authenticator-tests.script
@@ -0,0 +1,51 @@
+SET DATABASE UNIQUE NAME HSQLDB3B5AA06E81
+SET DATABASE GC 0
+SET DATABASE DEFAULT RESULT MEMORY ROWS 0
+SET DATABASE EVENT LOG LEVEL 0
+SET DATABASE SQL NAMES FALSE
+SET DATABASE SQL REGULAR NAMES TRUE
+SET DATABASE SQL REFERENCES FALSE
+SET DATABASE SQL SIZE TRUE
+SET DATABASE SQL TYPES FALSE
+SET DATABASE SQL TDC DELETE TRUE
+SET DATABASE SQL TDC UPDATE TRUE
+SET DATABASE SQL TRANSLATE TTI TYPES TRUE
+SET DATABASE SQL CONCAT NULLS TRUE
+SET DATABASE SQL NULLS FIRST TRUE
+SET DATABASE SQL UNIQUE NULLS TRUE
+SET DATABASE SQL CONVERT TRUNCATE TRUE
+SET DATABASE SQL AVG SCALE 0
+SET DATABASE SQL DOUBLE NAN TRUE
+SET DATABASE SQL LONGVAR IS LOB FALSE
+SET DATABASE TRANSACTION CONTROL LOCKS
+SET DATABASE DEFAULT ISOLATION LEVEL READ COMMITTED
+SET DATABASE TRANSACTION ROLLBACK ON CONFLICT TRUE
+SET DATABASE TEXT TABLE DEFAULTS ''
+SET FILES WRITE DELAY 500 MILLIS
+SET FILES BACKUP INCREMENT TRUE
+SET FILES CACHE SIZE 10000
+SET FILES CACHE ROWS 50000
+SET FILES SCALE 32
+SET FILES LOB SCALE 32
+SET FILES DEFRAG 0
+SET FILES NIO TRUE
+SET FILES NIO SIZE 256
+SET FILES LOG TRUE
+SET FILES LOG SIZE 50
+CREATE USER SA PASSWORD DIGEST 'd41d8cd98f00b204e9800998ecf8427e'
+ALTER USER SA SET LOCAL TRUE
+CREATE SCHEMA PUBLIC AUTHORIZATION DBA
+SET SCHEMA PUBLIC
+CREATE MEMORY TABLE PUBLIC.USERS(EMAIL VARCHAR(32),PASSWORD VARCHAR(32))
+ALTER SEQUENCE SYSTEM_LOBS.LOB_ID RESTART WITH 1
+SET DATABASE DEFAULT INITIAL SCHEMA PUBLIC
+GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.YES_OR_NO TO PUBLIC
+GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.TIME_STAMP TO PUBLIC
+GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.CARDINAL_NUMBER TO PUBLIC
+GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.CHARACTER_DATA TO PUBLIC
+GRANT USAGE ON DOMAIN INFORMATION_SCHEMA.SQL_IDENTIFIER TO PUBLIC
+GRANT DBA TO SA
+SET SCHEMA SYSTEM_LOBS
+INSERT INTO BLOCKS VALUES(0,2147483647,0)
+SET SCHEMA PUBLIC
+INSERT INTO USERS VALUES('user1','password1')
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/pom.xml
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/pom.xml b/mothballed/component/security/sql/pom.xml
new file mode 100755
index 0000000..1463ac4
--- /dev/null
+++ b/mothballed/component/security/sql/pom.xml
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.apache.isis.core</groupId>
+ <artifactId>isis</artifactId>
+ <version>1.1.1-SNAPSHOT</version>
+ <relativePath>../../../core/pom.xml</relativePath>
+ </parent>
+
+ <groupId>org.apache.isis.security</groupId>
+ <artifactId>isis-security-sql</artifactId>
+ <version>1.0.0-SNAPSHOT</version>
+
+ <name>Isis SQL Security</name>
+
+ <properties>
+ <siteBaseDir>.</siteBaseDir>
+ <relativeUrl/>
+ </properties>
+
+ <!-- used in Site generation for relative references. -->
+ <url>http://isis.apache.org/${relativeUrl}</url>
+
+ <build>
+ <pluginManagement>
+ <plugins>
+ <!-- Apache Release Audit Tool -->
+ <plugin>
+ <groupId>org.apache.rat</groupId>
+ <artifactId>apache-rat-plugin</artifactId>
+ <version>0.8</version>
+ <configuration>
+ <excludes>
+ <!--
+ overriding inherited excludes from oia.core:isis
+ with a more specific set for this component
+ -->
+ <exclude>**/target/**</exclude>
+ <exclude>**/target-ide/**</exclude>
+
+ <exclude>**/*.project</exclude>
+ <exclude>**/.classpath</exclude>
+ <exclude>**/.settings/**</exclude>
+ </excludes>
+ </configuration>
+ </plugin>
+ </plugins>
+ </pluginManagement>
+ </build>
+
+ <reporting>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-project-info-reports-plugin</artifactId>
+ <version>${maven-project-info-reports-plugin}</version>
+ <inherited>false</inherited>
+ <configuration>
+ <dependencyLocationsEnabled>false</dependencyLocationsEnabled>
+ </configuration>
+ <reportSets>
+ <reportSet>
+ <inherited>false</inherited>
+ <reports>
+ <report>dependencies</report>
+ <report>dependency-convergence</report>
+ <report>plugins</report>
+ <report>summary</report>
+ </reports>
+ </reportSet>
+ </reportSets>
+ </plugin>
+ </plugins>
+ </reporting>
+
+ <dependencyManagement>
+ <!-- for benefit of application developers, using scope=import -->
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.isis.security</groupId>
+ <artifactId>isis-security-sql</artifactId>
+ <version>1.0.0-SNAPSHOT</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.hsqldb</groupId>
+ <artifactId>hsqldb</artifactId>
+ <scope>test</scope>
+ </dependency>
+
+ <dependency>
+ <groupId>org.apache.isis.core</groupId>
+ <artifactId>isis-core-runtime</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.isis.core</groupId>
+ <artifactId>isis-core-runtime</artifactId>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+</project>
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/main/appended-resources/supplemental-models.xml
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/main/appended-resources/supplemental-models.xml b/mothballed/component/security/sql/src/main/appended-resources/supplemental-models.xml
new file mode 100644
index 0000000..ecd3906
--- /dev/null
+++ b/mothballed/component/security/sql/src/main/appended-resources/supplemental-models.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor
+ license agreements. See the NOTICE file distributed with this work for additional
+ information regarding copyright ownership. The ASF licenses this file to
+ you under the Apache License, Version 2.0 (the "License"); you may not use
+ this file except in compliance with the License. You may obtain a copy of
+ the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required
+ by applicable law or agreed to in writing, software distributed under the
+ License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
+ OF ANY KIND, either express or implied. See the License for the specific
+ language governing permissions and limitations under the License. -->
+<supplementalDataModels xmlns="http://maven.apache.org/supplemental-model/1.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/supplemental-model/1.0.0 http://maven.apache.org/xsd/supplemental-model-1.0.0.xsd">
+
+ <supplement>
+ <project>
+ <groupId>aopalliance</groupId>
+ <artifactId>aopalliance</artifactId>
+ <version>1.0</version>
+ <licenses>
+ <license>
+ <name>Public Domain</name>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <!-- not quite sure why licenses:download-license flags this, since license info seems to be in its POM -->
+ <project>
+ <groupId>org.datanucleus</groupId>
+ <artifactId>datanucleus-jodatime</artifactId>
+ <version>3.1.1</version>
+ <licenses>
+ <license>
+ <name>The Apache Software License, Version 2.0</name>
+ <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <project>
+ <groupId>org.scannotation</groupId>
+ <artifactId>scannotation</artifactId>
+ <version>1.0.3</version>
+ <licenses>
+ <license>
+ <name>The Apache Software License, Version 2.0</name>
+ <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <project>
+ <groupId>dom4j</groupId>
+ <artifactId>dom4j</artifactId>
+ <version>1.6.1</version>
+ <licenses>
+ <license>
+ <name>BSD License</name>
+ <url>http://dom4j.sourceforge.net/dom4j-1.6.1/license.html</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+ <supplement>
+ <project>
+ <groupId>net.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <version>1.0</version>
+ <licenses>
+ <license>
+ <name>Creative Commons Attribution 2.5 License</name>
+ <url>http://creativecommons.org/licenses/by/2.5/</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+
+ <supplement>
+ <project>
+ <groupId>xalan</groupId>
+ <artifactId>xalan</artifactId>
+ <version>2.7.0</version>
+ <licenses>
+ <license>
+ <name>The Apache Software License, Version 2.0</name>
+ <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+ </project>
+ </supplement>
+
+
+</supplementalDataModels>
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationConstants.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationConstants.java b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationConstants.java
new file mode 100755
index 0000000..24c7298
--- /dev/null
+++ b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationConstants.java
@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.sql.authentication;
+
+public class SqlAuthenticationConstants {
+
+ private SqlAuthenticationConstants() {
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationManagerInstaller.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationManagerInstaller.java b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationManagerInstaller.java
new file mode 100755
index 0000000..9dc53e2
--- /dev/null
+++ b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticationManagerInstaller.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.sql.authentication;
+
+import java.lang.reflect.InvocationTargetException;
+import java.util.List;
+
+import com.google.common.collect.Lists;
+
+import org.apache.isis.applib.ApplicationException;
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.runtime.authentication.AuthenticationManagerStandardInstallerAbstractForDfltRuntime;
+import org.apache.isis.core.runtime.authentication.standard.Authenticator;
+
+public class SqlAuthenticationManagerInstaller extends AuthenticationManagerStandardInstallerAbstractForDfltRuntime {
+
+ public static final String NAME = "sql";
+
+ public SqlAuthenticationManagerInstaller() {
+ super(NAME);
+ }
+
+ @Override
+ protected List<Authenticator> createAuthenticators(final IsisConfiguration configuration) {
+ return Lists.<Authenticator> newArrayList(createAuthenticator(configuration));
+ }
+
+ protected Authenticator createAuthenticator(final IsisConfiguration configuration) {
+ final String className = configuration.getString("isis.authentication.authenticator");
+ if (className == null) {
+ return new SqlAuthenticator(configuration);
+ }
+ try {
+ final Class<?> authenticatorClass = Class.forName(className);
+ return (Authenticator) authenticatorClass.getConstructor(IsisConfiguration.class).newInstance(configuration);
+ } catch (final ClassNotFoundException e) {
+ throw new ApplicationException("Unable to find authenticator class", e);
+ } catch (final IllegalArgumentException e) {
+ throw new ApplicationException("IllegalArgumentException creating authenticator class", e);
+ } catch (final SecurityException e) {
+ throw new ApplicationException("SecurityException creating authenticator class", e);
+ } catch (final InstantiationException e) {
+ throw new ApplicationException("InstantiationException creating authenticator class", e);
+ } catch (final IllegalAccessException e) {
+ throw new ApplicationException("IllegalAccessException creating authenticator class", e);
+ } catch (final InvocationTargetException e) {
+ throw new ApplicationException("InvocationTargetException creating authenticator class", e);
+ } catch (final NoSuchMethodException e) {
+ throw new ApplicationException("NoSuchMethodException creating authenticator class", e);
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticator.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticator.java b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticator.java
new file mode 100755
index 0000000..63df436
--- /dev/null
+++ b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authentication/SqlAuthenticator.java
@@ -0,0 +1,325 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.sql.authentication;
+
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.StringTokenizer;
+
+import com.google.common.base.Strings;
+import com.google.inject.Inject;
+
+import org.apache.log4j.Logger;
+
+import org.apache.isis.applib.ApplicationException;
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.commons.ensure.Assert;
+import org.apache.isis.core.runtime.authentication.AuthenticationRequest;
+import org.apache.isis.core.runtime.authentication.AuthenticationRequestPassword;
+import org.apache.isis.core.runtime.authentication.standard.PasswordRequestAuthenticatorAbstract;
+import org.apache.isis.core.runtime.system.context.IsisContext;
+
+public class SqlAuthenticator extends PasswordRequestAuthenticatorAbstract {
+ private static final Logger LOG = Logger.getLogger(SqlAuthenticator.class);
+
+ static SqlAuthenticator instance;
+
+ public static SqlAuthenticator getInstance() {
+ return instance;
+ }
+
+ // Override this method if dbPasswords are encoded.
+ protected boolean verifyPasswordsAreEqual(final String loginPassword, final String dbPassword) {
+ return dbPassword.equals(loginPassword);
+ }
+
+ // Override this method
+ protected ResultSet postProcessLogin(final String user, final String password, final ResultSet results) {
+ return results;
+ }
+
+ // override this method
+ protected String getRoles(final ResultSet results, final String roles) {
+ try {
+ if (userRoleField != null) {
+ final String dbRoles = results.getString(userRoleField);
+ return roles + "|" + dbRoles;
+ }
+ } catch (final SQLException e) {
+ LOG.warn("Error fetching role", e);
+ }
+ return roles;
+ }
+
+ // Override this method, if you want to create data.
+ public void initialise() {
+ }
+
+ static final String PROPERTY_BASE = "isis.authentication.sql";
+ static final String USER_TABLE = PROPERTY_BASE + ".userTable";
+ static final String USER_TABLE_NAME_FIELD = PROPERTY_BASE + ".userNameField";
+ static final String USER_TABLE_PASSWORD_FIELD = PROPERTY_BASE + ".passwordField";
+ static final String USER_TABLE_ROLE_FIELD = PROPERTY_BASE + ".roleField";
+
+ private Connection connection;
+
+ final String passwordField;
+ final String userTable;
+ final String userNameField;
+ final String userRoleField;
+
+ public static String getPropertyBase() {
+ return PROPERTY_BASE;
+ }
+
+ public static String getPropertyUserTable() {
+ return USER_TABLE;
+ }
+
+ public static String getPropertyUserTableNameField() {
+ return USER_TABLE_NAME_FIELD;
+ }
+
+ public static String getPropertyUserTablePasswordField() {
+ return USER_TABLE_PASSWORD_FIELD;
+ }
+
+ public static String getPropertyUserTableRoleField() {
+ return USER_TABLE_ROLE_FIELD;
+ }
+
+ @Inject
+ public SqlAuthenticator(final IsisConfiguration configuration) {
+ super(configuration);
+
+ userTable = configuration.getString(USER_TABLE);
+ userNameField = configuration.getString(USER_TABLE_NAME_FIELD);
+ passwordField = configuration.getString(USER_TABLE_PASSWORD_FIELD);
+ userRoleField = configuration.getString(USER_TABLE_ROLE_FIELD);
+
+ instance = this;
+ }
+
+ @Override
+ public void init() {
+ if (connection != null) {
+ LOG.info("close");
+ }
+
+ final String BASE = PROPERTY_BASE + ".jdbc.";
+ final IsisConfiguration params = IsisContext.getConfiguration().getProperties(BASE);
+
+ try {
+ final String driver = params.getString(BASE + "driver");
+ final String url = params.getString(BASE + "connection");
+ final String user = params.getString(BASE + "user");
+ final String password = params.getString(BASE + "password");
+
+ if (connection != null) {
+ throw new ApplicationException("Connection already established");
+ }
+
+ if (driver == null) {
+ throw new ApplicationException("No driver specified for database connection");
+ }
+ if (url == null) {
+ throw new ApplicationException("No connection URL specified to database");
+ }
+ if (user == null) {
+ throw new ApplicationException("No user specified for database connection");
+ }
+ if (password == null) {
+ throw new ApplicationException("No password specified for database connection");
+ }
+
+ Class.forName(driver);
+ LOG.info("Connecting to " + url + " as " + user);
+ connection = DriverManager.getConnection(url, user, password);
+ if (connection == null) {
+ throw new ApplicationException("No connection established to " + url);
+ }
+ } catch (final SQLException e) {
+ throw new ApplicationException("Failed to start", e);
+ } catch (final ClassNotFoundException e) {
+ throw new ApplicationException("Could not find database driver", e);
+ }
+
+ }
+
+ @Override
+ public void shutdown() {
+ String sql;
+ sql = "SHUTDOWN";
+ update(sql);
+ closeConnection();
+ }
+
+ private void closeConnection() {
+ try {
+ connection.close();
+ connection = null;
+ } catch (final SQLException e) {
+ LOG.warn("Failed to close connection:" + e);
+ }
+ }
+
+ @Override
+ public final boolean isValid(final AuthenticationRequest request) {
+ final AuthenticationRequestPassword passwordRequest = (AuthenticationRequestPassword) request;
+ final String username = passwordRequest.getName();
+ if (Strings.isNullOrEmpty(username)) {
+ return false;
+ }
+ final String password = passwordRequest.getPassword();
+ Assert.assertNotNull(password);
+
+ return isPasswordValidForUser(passwordRequest, username, password);
+
+ }
+
+ private boolean isPasswordValidForUser(final AuthenticationRequest request, final String user, final String password) {
+ final ResultSet results = loadUserDetails(user, password);
+ if (results != null) {
+ final String roles = getRoles(results, "org.apache.isis.viewer.wicket.roles.USER|org.starobjects.wicket.roles.USER");
+ setRoles(request, roles);
+
+ return true;
+ }
+ return false;
+ }
+
+ protected ResultSet loadUserDetails(final String user, final String password) {
+ final String sql = "SELECT * FROM " + userTable + " WHERE UPPER(" + userNameField + ") = ?";
+ addToQueryValues(user.toUpperCase());
+ final ResultSet results = select(sql);
+ try {
+ while (results.next()) {
+ final String dbPassword = results.getString(passwordField);
+ if (verifyPasswordsAreEqual(password, dbPassword)) {
+ return postProcessLogin(user, password, results);
+ }
+ }
+ } catch (final SQLException e) {
+ LOG.error("Error loading user details: " + sql);
+ throw new ApplicationException("Error loading user details", e);
+ }
+
+ return null;
+ }
+
+ private final void setRoles(final AuthenticationRequest request, final String line) {
+ final StringTokenizer tokens = new StringTokenizer(line, "|", false);
+ final String[] roles = new String[tokens.countTokens()];
+ for (int i = 0; tokens.hasMoreTokens(); i++) {
+ roles[i] = tokens.nextToken();
+ }
+ request.setRoles(Arrays.asList(roles));
+ }
+
+ public boolean isSetup() {
+ return hasTable(userTable);
+ }
+
+ // {{ JDBC Connection SQL helpers
+ protected int update(final String sql) {
+ LOG.debug("SQL: " + sql);
+ PreparedStatement statement;
+ try {
+ statement = connection.prepareStatement(sql);
+ addPreparedValues(statement);
+ final int updateCount = statement.executeUpdate();
+ statement.close();
+ return updateCount;
+ } catch (final SQLException e) {
+ LOG.error("failed to execute " + sql, e);
+ throw new ApplicationException("Error executing update", e);
+ } finally {
+ clearPreparedValues();
+ }
+
+ }
+
+ private ResultSet select(final String sql) {
+ LOG.debug("SQL: " + sql);
+ PreparedStatement statement;
+ try {
+ statement = connection.prepareStatement(sql);
+ addPreparedValues(statement);
+ return (statement.executeQuery());
+ } catch (final SQLException e) {
+ LOG.error("failed to execte select: " + sql, e);
+ throw new ApplicationException("Error executing select", e);
+ } finally {
+ clearPreparedValues();
+ }
+ }
+
+ private final List<Object> queryValues = new ArrayList<Object>();
+
+ public String addToQueryValues(final Object o) {
+ queryValues.add(o);
+ return "?";
+ }
+
+ private void clearPreparedValues() {
+ queryValues.clear();
+ }
+
+ private void addPreparedValues(final PreparedStatement statement) throws SQLException {
+ if (queryValues.size() > 0) {
+ int i = 1;
+ try {
+ for (final Object value : queryValues) {
+ statement.setObject(i, value);
+ i++;
+ }
+ } catch (final SQLException e) {
+ LOG.error("Error adding prepared value " + i + " of type " + queryValues.get(i - 1).getClass().getSimpleName(), e);
+ throw e;
+ }
+ }
+ }
+
+ private boolean hasTable(final String tableName) {
+ try {
+ final ResultSet set = connection.getMetaData().getTables(null, null, tableName, null);
+ if (set.next()) {
+ LOG.debug("Found " + set.getString("TABLE_NAME"));
+ set.close();
+ return true;
+ } else {
+ set.close();
+ return false;
+ }
+ } catch (final SQLException e) {
+ LOG.error("failed to find table: " + tableName, e);
+ throw new ApplicationException("Error checking for table: " + tableName, e);
+ }
+ }
+
+ // }}
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizationManagerInstaller.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizationManagerInstaller.java b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizationManagerInstaller.java
new file mode 100755
index 0000000..16e78fc
--- /dev/null
+++ b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizationManagerInstaller.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.sql.authorization;
+
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.runtime.authorization.standard.AuthorizationManagerStandardInstallerAbstract;
+import org.apache.isis.core.runtime.authorization.standard.Authorizor;
+
+public class SqlAuthorizationManagerInstaller extends AuthorizationManagerStandardInstallerAbstract {
+
+ public static final String NAME = "sql";
+
+ public SqlAuthorizationManagerInstaller() {
+ super(NAME);
+ }
+
+ @Override
+ protected Authorizor createAuthorizor(final IsisConfiguration configuration) {
+ return new SqlAuthorizor(configuration);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizor.java
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizor.java b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizor.java
new file mode 100755
index 0000000..de12010
--- /dev/null
+++ b/mothballed/component/security/sql/src/main/java/org/apache/isis/security/sql/authorization/SqlAuthorizor.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.isis.security.sql.authorization;
+
+import org.apache.isis.applib.Identifier;
+import org.apache.isis.core.commons.config.IsisConfiguration;
+import org.apache.isis.core.runtime.authorization.standard.AuthorizorAbstract;
+
+public class SqlAuthorizor extends AuthorizorAbstract {
+ // TODO: Need to implement this class.
+
+ // private static final Logger LOG = Logger.getLogger(SqlAuthorizor.class);
+
+ public SqlAuthorizor(final IsisConfiguration configuration) {
+ super(configuration);
+
+ }
+
+ // //////////////////////////////////////////////////////////////
+ // init, shutdown
+ // //////////////////////////////////////////////////////////////
+
+ @Override
+ public void init() {
+ // does nothing
+ }
+
+ @Override
+ public void shutdown() {
+ // does nothing
+ }
+
+ // //////////////////////////////////////////////////////////////
+ // API
+ // //////////////////////////////////////////////////////////////
+
+ @Override
+ public boolean isUsableInRole(final String role, final Identifier identifier) {
+ return true;
+ }
+
+ @Override
+ public boolean isVisibleInRole(final String user, final Identifier identifier) {
+ return true;
+ }
+
+ @Override
+ public boolean isVisibleInAnyRole(Identifier identifier) {
+ return true;
+ }
+
+ @Override
+ public boolean isUsableInAnyRole(Identifier identifier) {
+ return true;
+ }
+}
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/site.xml
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/site.xml b/mothballed/component/security/sql/src/site.xml
new file mode 100755
index 0000000..66aa164
--- /dev/null
+++ b/mothballed/component/security/sql/src/site.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project>
+
+ <body>
+ <breadcrumbs>
+ <item name="SQL" href="index.html"/>
+ </breadcrumbs>
+
+ <menu name="SQL Security">
+ <item name="About" href="index.html" />
+ <item name="Jottings" href="jottings.html" />
+ </menu>
+
+ <menu name="Security Modules">
+ <item name="Default (No-op)" href="../dflt/index.html" />
+ <item name="File" href="../file/index.html" />
+ <item name="LDAP" href="../ldap/index.html" />
+ <item name="SQL" href="../sql/index.html" />
+ </menu>
+
+ <menu name="Maven Reports" ref="reports" />
+ </body>
+</project>
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/site/apt/index.apt
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/site/apt/index.apt b/mothballed/component/security/sql/src/site/apt/index.apt
new file mode 100755
index 0000000..8451f4c
--- /dev/null
+++ b/mothballed/component/security/sql/src/site/apt/index.apt
@@ -0,0 +1,124 @@
+~~ Licensed to the Apache Software Foundation (ASF) under one
+~~ or more contributor license agreements. See the NOTICE file
+~~ distributed with this work for additional information
+~~ regarding copyright ownership. The ASF licenses this file
+~~ to you under the Apache License, Version 2.0 (the
+~~ "License"); you may not use this file except in compliance
+~~ with the License. You may obtain a copy of the License at
+~~
+~~ http://www.apache.org/licenses/LICENSE-2.0
+~~
+~~ Unless required by applicable law or agreed to in writing,
+~~ software distributed under the License is distributed on an
+~~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+~~ KIND, either express or implied. See the License for the
+~~ specific language governing permissions and limitations
+~~ under the License.
+
+
+
+Security SQL Implementation
+
+ The <SQL security> module is a simple implementation of Isis' authentication and
+ authorization APIs, that uses flat SQL tables to store user/passwords/roles (for authentication)
+ and role-based permissions (for authorization).
+
+ No additional helpers are provided to maintain the SQL tables used, so you will have
+ to find your own table viewers/editors to maintain them.
+
+ At the moment, authorisation learning has not been implemented.
+
+ The SqlAuthenticator classes use jdbc to access the database tables, with no reliance on the
+ Isis SqlObjectStore.
+
+
+Alternatives
+
+ Alternatives include:
+
+ * the {{{../dflt/index.html}default}} (no-op) security implementation, for prototyping use only
+
+ * the {{{../file/index.html}file}} security
+
+ * the {{{../ldap/index.html}LDAP}} security
+
+ See the security
+ {{{../docbkx/html/guide/isis-security.html}HTML}} or
+ {{{../docbkx/pdf/isis-security.pdf}PDF}} documentation for more details on these others.
+
+Setup
+
+ The SQL Authenticator is relatively easy to setup - just add the following to isis.properties:
+ Change the connection, userTable, etc, definitions, to reflect that of your configuration.
+
++--
+ isis.authentication=sql
+ isis.authentication.sql.jdbc.driver=org.hsqldb.jdbcDriver
+
+ # Connection string: e.g.
+ isis.authentication.sql.jdbc.connection=jdbc:hsqldb:file:hsql-db/authentication
+
+ # Connection authentication
+ isis.authentication.sql.jdbc.user=sa
+ isis.authentication.sql.jdbc.password=
+
+ isis.authentication.sql.userTable=RealNameOfUserTable
+ isis.authentication.sql.userNameField=RealFieldThatContainsUsernames
+ isis.authentication.sql.passwordField=RealFieldThatContainsPassword
+
+ # The following property is optional, for specifying roles:
+ # Roles are of the forms ROLE1|ROLE2|ROLE3
+ isis.authentication.sql.roleField=RealFieldThatContainsRoles
+
+ # Optional: If you wish to override the default SqlAuthenticator, you can specify
+ # your own, by providing the fully qualified class name of your class that extends
+ # PasswordRequestAuthenticatorAbstract:
+ isis.authentication.authenticator=domain.package.MyCustomSqlAuthenticator
++--
+
+ * Operation
+
+ The default SqlAuthenticator loads the record set from <<isis.authentication.sql.userTable>> with
+ values where <<isis.authentication.sql.userNameField>> matches the login form's username (converted to
+ upper-case, so the match is case-<<in>>sensitive).
+
+ A simple case-sensitive string comparison is performed to match the login form's password with the value
+ in <<isis.authentication.sql.passwordField>>.
+
+ If a match is found, the user roles are loaded from the field
+ <<isis.authentication.sql.roleField>>, if specified.
+
+Custom Authenticator
+
+ If you want to replace or extend the current behaviour, you need to
+ extend <<org.apache.isis.security.sql.authentication.SqlAuthenticator>> and optionally override
+ whichever of the following methods you need to:
+
++--
+ boolean verifyPasswordsAreEqual(String userPassword, String dbPassword)
+ ResultSet postProcessLogin(String user, String password, ResultSet results)
+ String getRoles(final ResultSet results, final String roles)
++--
+
+ * <<verifyPasswordsAreEqual>>
+
+ Lets you override the default password comparison check, which is a simple <loginPassword.equals(dbPassword)> check.
+
+ Use this if your database passwords are encrypted.
+
+ This method is called before postProcessLogin, which is only called if this method returns true.
+
+ * <<postProcessLogin>>
+
+ Lets you perform additional processing to see if the found RecordSet (which has already been verified to match the
+ provided username and password, should be allowed to login.
+
+ Simply return the results RecordSet, if so, else return null.
+
+ * <<getRoles>>
+
+ Lets you add additional roles to the default. Simply return your custom roles appended to the provided roles String.
+ Separate roles with a "|", e.g. <return roles+"|ROLE1|ROLE2">.
+
+ []
+
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/site/apt/jottings.apt
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/site/apt/jottings.apt b/mothballed/component/security/sql/src/site/apt/jottings.apt
new file mode 100755
index 0000000..c5d1200
--- /dev/null
+++ b/mothballed/component/security/sql/src/site/apt/jottings.apt
@@ -0,0 +1,24 @@
+~~ Licensed to the Apache Software Foundation (ASF) under one
+~~ or more contributor license agreements. See the NOTICE file
+~~ distributed with this work for additional information
+~~ regarding copyright ownership. The ASF licenses this file
+~~ to you under the Apache License, Version 2.0 (the
+~~ "License"); you may not use this file except in compliance
+~~ with the License. You may obtain a copy of the License at
+~~
+~~ http://www.apache.org/licenses/LICENSE-2.0
+~~
+~~ Unless required by applicable law or agreed to in writing,
+~~ software distributed under the License is distributed on an
+~~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+~~ KIND, either express or implied. See the License for the
+~~ specific language governing permissions and limitations
+~~ under the License.
+
+
+
+Jottings
+
+ This page is to capture any random jottings relating to this module prior
+ to being moved into formal documentation.
+
http://git-wip-us.apache.org/repos/asf/isis/blob/91a8000b/mothballed/component/security/sql/src/site/site.xml
----------------------------------------------------------------------
diff --git a/mothballed/component/security/sql/src/site/site.xml b/mothballed/component/security/sql/src/site/site.xml
new file mode 100755
index 0000000..66aa164
--- /dev/null
+++ b/mothballed/component/security/sql/src/site/site.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<project>
+
+ <body>
+ <breadcrumbs>
+ <item name="SQL" href="index.html"/>
+ </breadcrumbs>
+
+ <menu name="SQL Security">
+ <item name="About" href="index.html" />
+ <item name="Jottings" href="jottings.html" />
+ </menu>
+
+ <menu name="Security Modules">
+ <item name="Default (No-op)" href="../dflt/index.html" />
+ <item name="File" href="../file/index.html" />
+ <item name="LDAP" href="../ldap/index.html" />
+ <item name="SQL" href="../sql/index.html" />
+ </menu>
+
+ <menu name="Maven Reports" ref="reports" />
+ </body>
+</project>