Examples with AuthnProvider com.emc.storageos.db.client.model.AuthnProvider used on opensource projects

Example 1 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class ImmutableAuthenticationProviders method checkProviderStatus.

/**
 * Verifies basic connectivity of the provider by attempting a connection with
 * the manager DN and password to the provided url
 *
 * @param param contains the connection parameter
 * @param errorString will contain the message from the exception in case an exception is
 * @return true if success, false if failure
 */
public static boolean checkProviderStatus(CoordinatorClient coordinator, final AuthnProviderParamsToValidate param, KeystoneRestClientFactory keystoneFactory, StringBuilder errorString, DbClient dbClient) {
    AuthnProvider authConfig = new AuthnProvider();
    authConfig.setManagerDN(param.getManagerDN());
    authConfig.setManagerPassword(param.getManagerPwd());
    StringSet urls = new StringSet();
    urls.addAll(param.getUrls());
    authConfig.setServerUrls(urls);
    if (AuthnProvider.ProvidersType.keystone.toString().equalsIgnoreCase(param.getMode())) {
        authConfig.setMode(AuthnProvider.ProvidersType.keystone.toString());
        checkKeystoneProviderConnectivity(authConfig, keystoneFactory);
        return true;
    } else {
        // we don't need AD specifics here
        authConfig.setMode(AuthnProvider.ProvidersType.ldap.toString());
    }
    LdapServerList servers = createLdapServerList(coordinator, authConfig, SystemPropertyUtil.getLdapConnectionTimeout(coordinator));
    _log.info("Checking the status of the provider whose urls are {}", param.getUrls());
    boolean good = false;
    // Checking in order and return good if meeting one good.
    for (LdapOrADServer server : servers.getConnectedServers()) {
        good = doCheckProviderStatusOnSingleServer(server, param, errorString, dbClient);
        if (good) {
            _log.info("Checked provider against server {} successfully", server.getContextSource().getUrls()[0]);
            return true;
        }
    }
    return false;
}

Example 2 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class LdapProviderMonitor method queryAuthnProviderFromDB.

private AuthnProvider queryAuthnProviderFromDB(Set<String> domains) {
    URIQueryResultList providers = new URIQueryResultList();
    // Must have at lease one
    String domain = (String) domains.toArray()[0];
    try {
        dbClient.queryByConstraint(AlternateIdConstraint.Factory.getAuthnProviderDomainConstraint(domain), providers);
        Iterator<URI> it = providers.iterator();
        while (it.hasNext()) {
            URI providerURI = it.next();
            AuthnProvider provider = dbClient.queryObject(AuthnProvider.class, providerURI);
            if (provider != null && provider.getDisable() == false) {
                return provider;
            }
        }
    } catch (DatabaseException ex) {
        log.error("Could not query for authn providers to check for existing domain {}", domain, ex);
        throw ex;
    }
    return null;
}

Example 3 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class CustomAuthenticationManagerTest method createValidAuthProviderInDB.

private AuthnProvider createValidAuthProviderInDB() throws Exception {
    // Create the a good authConfig
    AuthnProvider authConfig = new AuthnProvider();
    authConfig.setId(URIUtil.createId(AuthnProvider.class));
    authConfig.setMode("ad");
    StringSet domains = new StringSet();
    domains.add("sanity.local");
    authConfig.setDomains(domains);
    authConfig.setManagerDN("CN=Administrator,CN=Users,DC=sanity,DC=local");
    authConfig.setManagerPassword(_adManagerPassword);
    StringSet urls = new StringSet();
    urls.add(LDAP_SERVER_2);
    authConfig.setServerUrls(urls);
    authConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    authConfig.setSearchFilter("sAMAccountName=%U");
    authConfig.setGroupAttribute("CN");
    authConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(authConfig);
    reloadConfig(true);
    return authConfig;
}

Example 4 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class CustomAuthenticationManagerTest method testUserRefresh.

@Test
public void testUserRefresh() throws Exception {
    AuthnProvider authConfig = createValidAuthProviderInDB();
    // First try to refresh a user that does not exist in the DB- Should fail with a
    // BadRequestException, where the message says that the parameter is not valid
    String userName = "iShouldntExistAnywhereInTheWholeWideWorld@sanity.local".toLowerCase();
    boolean exceptionWasCaught = false;
    try {
        _authManager.refreshUser(userName);
    } catch (SecurityException e) {
        // should not get here.
        Assert.fail("Got a securityExcpetion instead of BadRequestException, message is " + e.getLocalizedMessage());
    } catch (APIException e) {
        // this is what is expected
        String errorMessage = "Invalid value " + userName + " for parameter username";
        assertServiceError(HttpStatus.SC_BAD_REQUEST, ServiceCode.API_PARAMETER_INVALID, errorMessage, e);
        exceptionWasCaught = true;
    } finally {
        Assert.assertTrue("Refresh user call for a user that does not exist in DB did not throw an exception", exceptionWasCaught);
    }
    // try to refresh a user that doesn't exist in ldap, but exists in the DB- should
    // fail with a BadRequestException- Search for {0} failed for this tenant, or
    // could not be found for this tenant. make sure the user gets deleted
    StorageOSUserDAO userDAO = new StorageOSUserDAO();
    userDAO.setId(URIUtil.createId(StorageOSUserDAO.class));
    userDAO.setUserName(userName);
    _dbClient.createObject(userDAO);
    exceptionWasCaught = false;
    try {
        _authManager.refreshUser(userName);
    } catch (SecurityException e) {
        Assert.fail("Got a securityExcpetion instead of BadRequestException, message is " + e.getLocalizedMessage());
    } catch (APIException e) {
        String errorMessage = "Search for " + userName + " failed for this tenant, or could not be found for this tenant.";
        assertServiceError(HttpStatus.SC_BAD_REQUEST, ServiceCode.API_BAD_REQUEST, errorMessage, e);
        exceptionWasCaught = true;
    } finally {
        Assert.assertTrue("Refresh user call for a user that does not exist in LDAP did not throw an exception", exceptionWasCaught);
    }
    StorageOSUserDAO userDAOAfterRefresh = _dbClient.queryObject(StorageOSUserDAO.class, userDAO.getId());
    if (userDAOAfterRefresh != null) {
        Assert.assertTrue(userDAOAfterRefresh.getInactive());
    }
    // disable the authProvider and refresh a user- should fail with a
    // BadRequestException - Search for {0} failed for this tenant, or
    // could not be found for this tenant. make sure the user gets deleted
    cleanupProviders();
    userName = "sanity_user@sanity.local".toLowerCase();
    userDAO = new StorageOSUserDAO();
    userDAO.setId(URIUtil.createId(StorageOSUserDAO.class));
    userDAO.setUserName(userName);
    _dbClient.createObject(userDAO);
    exceptionWasCaught = false;
    try {
        _authManager.refreshUser(userName);
    } catch (SecurityException e) {
        Assert.fail("Got a securityExcpetion instead of BadRequestException, message is " + e.getLocalizedMessage());
    } catch (APIException e) {
        String errorMessage = "Search for " + userName + " failed for this tenant, or could not be found for this tenant.";
        assertServiceError(HttpStatus.SC_BAD_REQUEST, ServiceCode.API_BAD_REQUEST, errorMessage, e);
        exceptionWasCaught = true;
    } finally {
        Assert.assertTrue("Refresh user call for a user who is not supported by any authentication handler did not throw an exception", exceptionWasCaught);
    }
    userDAOAfterRefresh = _dbClient.queryObject(StorageOSUserDAO.class, userDAO.getId());
    if (userDAOAfterRefresh != null) {
        Assert.assertTrue(userDAOAfterRefresh.getInactive());
    }
    // enable the authProvider and test user refresh - should not throw
    authConfig = createValidAuthProviderInDB();
    userDAO = new StorageOSUserDAO();
    userDAO.setId(URIUtil.createId(StorageOSUserDAO.class));
    userDAO.setUserName(userName);
    _dbClient.createObject(userDAO);
    try {
        // refresh the user
        _authManager.refreshUser(userName);
    } catch (SecurityException e) {
        Assert.fail("Got a FatalSecurityException, message is " + e.getLocalizedMessage());
    } catch (APIException e) {
        Assert.fail("Got a BadRequestException, message is " + e.getLocalizedMessage());
    }
    userDAOAfterRefresh = _dbClient.queryObject(StorageOSUserDAO.class, userDAO.getId());
    Assert.assertNotNull(userDAOAfterRefresh.getTenantId());
    Assert.assertTrue("sanity_user@sanity.local is supposed to be mapped to root tenant", _rootTenantId.toString().equals(userDAOAfterRefresh.getTenantId()));
}

Example 5 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class CustomAuthenticationManagerTest method testreload.

@Test
public void testreload() throws Exception {
    List<AuthenticationProvider> authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS, authProvidersList.size());
    // Create the a good authConfig
    AuthnProvider adAuthConfig = new AuthnProvider();
    adAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    adAuthConfig.setMode("ad");
    StringSet adDomains = new StringSet();
    adDomains.add("sanity.local");
    adAuthConfig.setDomains(adDomains);
    adAuthConfig.setManagerDN("CN=Administrator,CN=Users,DC=sanity,DC=local");
    adAuthConfig.setManagerPassword(_adManagerPassword);
    StringSet adUrls = new StringSet();
    adUrls.add(LDAP_SERVER_2);
    adAuthConfig.setServerUrls(adUrls);
    adAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    adAuthConfig.setSearchFilter("userPrincipalName=%u");
    adAuthConfig.setGroupAttribute("CN");
    adAuthConfig.setLastModified(System.currentTimeMillis());
    _log.info("adding new provider");
    _dbClient.createObject(adAuthConfig);
    // force db error
    _dbClient.stop();
    _log.info("dbclient stopped");
    reloadConfig(true);
    _log.info("sleep for dbclient timeout");
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS, authProvidersList.size());
    // Looks like astyannax upgrade introduced a longer (5min) timeout on dbclient connections
    // we need to investigate that further ... for now, increasing this timeout for this test to continue
    Thread.sleep(5 * 60 * 1000);
    _log.info("restarting dbclient");
    _dbClient = getDbClient();
    _authManager.setDbClient(_dbClient);
    // wait for dbclient to come up
    Thread.sleep(60 * 1000);
    // The AD auth handler should now be in the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 1, authProvidersList.size());
    // Create the authConfig with some unknown mode
    StringSet domains = new StringSet();
    domains.add("somedomain");
    StringSet urls = new StringSet();
    urls.add("ldap://somehost");
    // Create the authConfig with a null manager dn
    AuthnProvider badManagerAuthConfig = new AuthnProvider();
    badManagerAuthConfig.setMode("ad");
    badManagerAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    badManagerAuthConfig.setDomains(domains);
    badManagerAuthConfig.setManagerDN(null);
    badManagerAuthConfig.setManagerPassword(_adManagerPassword);
    badManagerAuthConfig.setServerUrls(urls);
    badManagerAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    badManagerAuthConfig.setSearchFilter("sAMAccountName=%U");
    badManagerAuthConfig.setGroupAttribute("CN");
    badManagerAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(badManagerAuthConfig);
    reloadConfig(true);
    // The null manager should not have been added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 1, authProvidersList.size());
    _dbClient.removeObject(badManagerAuthConfig);
    _authManager.reload();
    // Create the authConfig with a null password
    AuthnProvider badPasswordAuthConfig = new AuthnProvider();
    badPasswordAuthConfig.setMode("ad");
    badPasswordAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    badPasswordAuthConfig.setDomains(domains);
    badPasswordAuthConfig.setManagerDN("CN=Users,DC=sanity,DC=local");
    badPasswordAuthConfig.setManagerPassword(null);
    badPasswordAuthConfig.setServerUrls(urls);
    badPasswordAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    badPasswordAuthConfig.setSearchFilter("sAMAccountName=%U");
    badPasswordAuthConfig.setGroupAttribute("CN");
    badPasswordAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(badPasswordAuthConfig);
    reloadConfig(true);
    // The null password should not have been added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 1, authProvidersList.size());
    _dbClient.removeObject(badPasswordAuthConfig);
    _authManager.reload();
    // Create the authConfig with no URLs
    AuthnProvider noUrlsAuthConfig = new AuthnProvider();
    noUrlsAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    noUrlsAuthConfig.setMode("ad");
    noUrlsAuthConfig.setDomains(domains);
    noUrlsAuthConfig.setManagerDN("CN=Users,DC=sanity,DC=local");
    noUrlsAuthConfig.setManagerPassword("P@ssword");
    noUrlsAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    noUrlsAuthConfig.setSearchFilter("sAMAccountName=%U");
    noUrlsAuthConfig.setGroupAttribute("CN");
    noUrlsAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(noUrlsAuthConfig);
    reloadConfig(true);
    // The no URLs config should not have been added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 1, authProvidersList.size());
    _dbClient.removeObject(noUrlsAuthConfig);
    _authManager.reload();
    // Create the authConfig with a null search base
    AuthnProvider nullSearchBaseAuthConfig = new AuthnProvider();
    nullSearchBaseAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    nullSearchBaseAuthConfig.setMode("ad");
    nullSearchBaseAuthConfig.setDomains(domains);
    nullSearchBaseAuthConfig.setManagerDN("CN=Users,DC=sanity,DC=local");
    nullSearchBaseAuthConfig.setManagerPassword("P@ssword");
    nullSearchBaseAuthConfig.setServerUrls(urls);
    nullSearchBaseAuthConfig.setSearchBase(null);
    nullSearchBaseAuthConfig.setSearchFilter("sAMAccountName=%U");
    nullSearchBaseAuthConfig.setGroupAttribute("CN");
    nullSearchBaseAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(nullSearchBaseAuthConfig);
    reloadConfig(true);
    // The null search base should not have been added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 1, authProvidersList.size());
    _dbClient.removeObject(nullSearchBaseAuthConfig);
    _authManager.reload();
    // Create the authConfig with a null filter
    AuthnProvider nullFilterAuthConfig = new AuthnProvider();
    nullFilterAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    nullFilterAuthConfig.setMode("ad");
    nullFilterAuthConfig.setDomains(domains);
    nullFilterAuthConfig.setManagerDN("CN=Users,DC=sanity,DC=local");
    nullFilterAuthConfig.setManagerPassword("P@ssword");
    nullFilterAuthConfig.setServerUrls(urls);
    nullFilterAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    nullFilterAuthConfig.setSearchFilter(null);
    nullFilterAuthConfig.setGroupAttribute("CN");
    nullFilterAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(nullFilterAuthConfig);
    reloadConfig(true);
    // The null search base should not have been added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 1, authProvidersList.size());
    _dbClient.removeObject(nullFilterAuthConfig);
    reloadConfig(true);
    // Create the authConfig with a missing search_scope (should be ok, will defaut to one level)
    AuthnProvider nullScope = new AuthnProvider();
    nullScope.setId(URIUtil.createId(AuthnProvider.class));
    nullScope.setMode("ad");
    nullScope.setDomains(domains);
    nullScope.setManagerDN("CN=Users,DC=sanity,DC=local");
    nullScope.setManagerPassword("P@ssword");
    nullScope.setServerUrls(urls);
    nullScope.setSearchBase("CN=Users,DC=sanity,DC=local");
    nullScope.setSearchFilter("sAMAccountName=%U");
    nullScope.setGroupAttribute(null);
    _dbClient.createObject(nullScope);
    reloadConfig(true);
    // The null scope config should still be added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 2, authProvidersList.size());
    // Create the authConfig with a bad search_scope (should be ok, will default to onelevel)
    AuthnProvider badScope = new AuthnProvider();
    badScope.setId(URIUtil.createId(AuthnProvider.class));
    badScope.setMode("ad");
    badScope.setDomains(domains);
    badScope.setManagerDN("CN=Users,DC=sanity,DC=local");
    badScope.setManagerPassword("P@ssword");
    badScope.setServerUrls(urls);
    badScope.setSearchBase("CN=Users,DC=sanity,DC=local");
    badScope.setSearchFilter("sAMAccountName=%U");
    badScope.setSearchScope("bad");
    badScope.setGroupAttribute(null);
    _dbClient.createObject(badScope);
    reloadConfig(true);
    // The null scope config should still be added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 3, authProvidersList.size());
    // Create the authConfig with a good search_scope
    AuthnProvider goodScope = new AuthnProvider();
    goodScope.setId(URIUtil.createId(AuthnProvider.class));
    goodScope.setMode("ad");
    goodScope.setDomains(domains);
    goodScope.setManagerDN("CN=Users,DC=sanity,DC=local");
    goodScope.setManagerPassword("P@ssword");
    goodScope.setServerUrls(urls);
    goodScope.setSearchBase("CN=Users,DC=sanity,DC=local");
    goodScope.setSearchFilter("sAMAccountName=%U");
    goodScope.setSearchScope(AuthnProvider.SearchScope.SUBTREE.toString());
    goodScope.setGroupAttribute(null);
    _dbClient.createObject(goodScope);
    reloadConfig(true);
    // The null scope config should still be added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 4, authProvidersList.size());
    // Create the authConfig with a null group Attribute
    AuthnProvider nullGroupAttribute = new AuthnProvider();
    nullGroupAttribute.setId(URIUtil.createId(AuthnProvider.class));
    nullGroupAttribute.setMode("ad");
    nullGroupAttribute.setDomains(domains);
    nullGroupAttribute.setManagerDN("CN=Users,DC=sanity,DC=local");
    nullGroupAttribute.setManagerPassword("P@ssword");
    nullGroupAttribute.setServerUrls(urls);
    nullGroupAttribute.setSearchBase("CN=Users,DC=sanity,DC=local");
    nullGroupAttribute.setSearchFilter("sAMAccountName=%U");
    nullGroupAttribute.setGroupAttribute(null);
    nullGroupAttribute.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(nullGroupAttribute);
    reloadConfig(true);
    // The null group attribute config should still be added to the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 5, authProvidersList.size());
    // Create an LDAP auth config
    AuthnProvider ldapAuthConfig = new AuthnProvider();
    ldapAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    ldapAuthConfig.setMode("ldap");
    StringSet ldapDomains = new StringSet();
    ldapDomains.add("root.com");
    ldapAuthConfig.setDomains(ldapDomains);
    ldapAuthConfig.setManagerDN("cn=Manager,dc=root,dc=com");
    ldapAuthConfig.setManagerPassword("secret");
    StringSet ldapURLs = new StringSet();
    ldapURLs.add(LDAP_SERVER_1);
    ldapAuthConfig.setServerUrls(ldapURLs);
    ldapAuthConfig.setSearchBase("ou=People,dc=root,dc=com");
    ldapAuthConfig.setSearchFilter("(uid=%U)");
    ldapAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(ldapAuthConfig);
    reloadConfig(true);
    // The ldap auth handler should be on the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 6, authProvidersList.size());
    // Disable a config and make sure it goes away
    ldapAuthConfig.setDisable(true);
    ldapAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.persistObject(ldapAuthConfig);
    reloadConfig(true);
    // The ldap auth handler should not be on the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 5, authProvidersList.size());
    // enable th config and make sure it comes back
    ldapAuthConfig.setDisable(false);
    ldapAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.persistObject(ldapAuthConfig);
    reloadConfig(true);
    // The ldap auth handler should be on the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 6, authProvidersList.size());
    // Delete it and verify that it is gone
    _dbClient.removeObject(ldapAuthConfig);
    reloadConfig(true);
    // The ldap auth handler should be on the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 5, authProvidersList.size());
    // Add it back. Later tests use it
    ldapAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    ldapAuthConfig.setDisable(false);
    ldapAuthConfig.setInactive(false);
    ldapAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.persistObject(ldapAuthConfig);
    reloadConfig(true);
    // The ldap auth handler should be on the list
    authProvidersList = _authManager.getAuthenticationProviders();
    Assert.assertEquals(_INITIAL_HANDLERS + 6, authProvidersList.size());
}