Examples with AuthnProvider com.emc.storageos.db.client.model.AuthnProvider used on opensource projects

Example 16 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class CustomAuthenticationManagerTest method createADLDAPProviders.

private void createADLDAPProviders() throws Exception {
    // Create the a good authConfig
    AuthnProvider adAuthConfig = new AuthnProvider();
    adAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    adAuthConfig.setMode("ad");
    StringSet adDomains = new StringSet();
    adDomains.add("sanity.local");
    adAuthConfig.setDomains(adDomains);
    adAuthConfig.setManagerDN("CN=Administrator,CN=Users,DC=sanity,DC=local");
    adAuthConfig.setManagerPassword(_adManagerPassword);
    StringSet adUrls = new StringSet();
    adUrls.add(LDAP_SERVER_1);
    adAuthConfig.setServerUrls(adUrls);
    adAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    adAuthConfig.setSearchFilter("userPrincipalName=%u");
    adAuthConfig.setGroupAttribute("CN");
    adAuthConfig.setLastModified(System.currentTimeMillis());
    _log.info("adding new provider");
    _dbClient.createObject(adAuthConfig);
    // Create an LDAP auth config
    AuthnProvider ldapAuthConfig = new AuthnProvider();
    ldapAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    ldapAuthConfig.setMode("ldap");
    StringSet ldapDomains = new StringSet();
    ldapDomains.add("root.com");
    ldapAuthConfig.setDomains(ldapDomains);
    ldapAuthConfig.setManagerDN("cn=Manager,dc=root,dc=com");
    ldapAuthConfig.setManagerPassword("secret");
    StringSet ldapURLs = new StringSet();
    ldapURLs.add(LDAP_SERVER_2);
    ldapAuthConfig.setServerUrls(ldapURLs);
    ldapAuthConfig.setSearchBase("ou=People,dc=root,dc=com");
    ldapAuthConfig.setSearchFilter("(uid=%U)");
    ldapAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(ldapAuthConfig);
    reloadConfig(true);
}

Example 17 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class CustomAuthenticationManagerTest method testAuthentication.

@Test
public void testAuthentication() throws Exception {
    createADLDAPProviders();
    UsernamePasswordCredentials sanityUserCreds = new UsernamePasswordCredentials("sanity_user@sanity.local", "P@ssw0rd");
    Assert.assertNotNull(_authManager.authenticate(sanityUserCreds));
    UsernamePasswordCredentials ldapUserCreds = new UsernamePasswordCredentials("user@root.com", "password");
    Assert.assertNotNull(_authManager.authenticate(ldapUserCreds));
    UsernamePasswordCredentials badDomainUserCreds = new UsernamePasswordCredentials("sanity_user@baddomain", "P@ssw0rd");
    Assert.assertNull(_authManager.authenticate(badDomainUserCreds));
    UsernamePasswordCredentials noDomainUserCreds = new UsernamePasswordCredentials("sanity_user", "P@ssw0rd");
    Assert.assertNull(_authManager.authenticate(noDomainUserCreds));
    UsernamePasswordCredentials badUserUserCreds = new UsernamePasswordCredentials("sanity_user@root.com", "P@ssw0rd");
    Assert.assertNull(_authManager.authenticate(badUserUserCreds));
    UsernamePasswordCredentials badPasswordUserCreds = new UsernamePasswordCredentials("sanity_user@sanity.local", "badpassword");
    Assert.assertNull(_authManager.authenticate(badPasswordUserCreds));
    UsernamePasswordCredentials emptyUsernameUserCreds = new UsernamePasswordCredentials("", "P@ssw0rd");
    Assert.assertNull(_authManager.authenticate(emptyUsernameUserCreds));
    UsernamePasswordCredentials emptyPasswordUserCreds = new UsernamePasswordCredentials("sanity_user@sanity.local", "");
    Assert.assertNull(_authManager.authenticate(emptyPasswordUserCreds));
    UsernamePasswordCredentials nullPasswordUserCreds = new UsernamePasswordCredentials("sanity_user@sanity.local", null);
    Assert.assertNull(_authManager.authenticate(nullPasswordUserCreds));
    UserMapping tenantMapping = new UserMapping();
    UserMappingAttribute tenantAttr = new UserMappingAttribute();
    tenantAttr.setKey("o");
    tenantAttr.setValues(Collections.singletonList("sales"));
    tenantMapping.setAttributes(Collections.singletonList(tenantAttr));
    tenantMapping.setDomain("root.com");
    UserMapping tenantMapping2 = new UserMapping();
    tenantMapping2.setGroups(Collections.singletonList("Test Group"));
    tenantMapping2.setDomain("sanity.local");
    StringSetMap mappings = new StringSetMap();
    mappings.put(tenantMapping.getDomain(), tenantMapping.toString());
    mappings.put(tenantMapping2.getDomain(), tenantMapping2.toString());
    _subtenantId = URIUtil.createId(TenantOrg.class);
    TenantOrg subtenant = new TenantOrg();
    subtenant.setLabel("subtenant");
    subtenant.setDescription("auth subtenant");
    subtenant.setId(_subtenantId);
    subtenant.setParentTenant(new NamedURI(_rootTenantId, "subtenant"));
    subtenant.setUserMappings(mappings);
    _dbClient.persistObject(subtenant);
    StorageOSUserDAO user = _authManager.authenticate(sanityUserCreds);
    Assert.assertEquals(_rootTenantId.toString(), user.getTenantId());
    // this user has the o=sales attribute so should be in the subtenant
    user = _authManager.authenticate(ldapUserCreds);
    Assert.assertEquals(_subtenantId.toString(), user.getTenantId());
    // this user is in the group Test Group so should be in the subtenant
    UsernamePasswordCredentials groupUserCreds = new UsernamePasswordCredentials("testuser@sanity.local", "P@ssw0rd");
    user = _authManager.authenticate(groupUserCreds);
    Assert.assertEquals(_subtenantId.toString(), user.getTenantId());
    // Create the a good authConfig with whitelist values
    AuthnProvider adAuthConfig = new AuthnProvider();
    adAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    adAuthConfig.setMode("ad");
    StringSet adDomains = new StringSet();
    adDomains.add("whitelist1");
    adDomains.add("whitelist2");
    adAuthConfig.setDomains(adDomains);
    adAuthConfig.setManagerDN("CN=Administrator,CN=Users,DC=sanity,DC=local");
    adAuthConfig.setManagerPassword(_adManagerPassword);
    StringSet adUrls = new StringSet();
    adUrls.add(LDAP_SERVER_2);
    adAuthConfig.setServerUrls(adUrls);
    adAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    adAuthConfig.setSearchFilter("sAMAccountName=%U");
    adAuthConfig.setGroupAttribute("CN");
    StringSet whitelistValues = new StringSet();
    whitelistValues.add("*Users*");
    whitelistValues.add("ProjectAdmins");
    adAuthConfig.setGroupWhitelistValues(whitelistValues);
    adAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(adAuthConfig);
    reloadConfig(true);
    // Login the user the user that is in the group "Test Group" but it is not in the whitelist in
    // the auth config so the user should end up in the root tenant
    UsernamePasswordCredentials whitelist1GroupUserCreds = new UsernamePasswordCredentials("testuser@whitelist1", "P@ssw0rd");
    user = _authManager.authenticate(whitelist1GroupUserCreds);
    Assert.assertEquals(_rootTenantId.toString(), user.getTenantId());
    // log the same user in to the other domain to make sure it is mapped to the same domain
    UsernamePasswordCredentials whitelist2GroupUserCreds = new UsernamePasswordCredentials("testuser@whitelist2", "P@ssw0rd");
    user = _authManager.authenticate(whitelist2GroupUserCreds);
    Assert.assertEquals(_rootTenantId.toString(), user.getTenantId());
    ValidationFailureReason[] failureReason = new ValidationFailureReason[1];
    _authManager.validateUser("sanity_user@sanity.local", _rootTenantId.toString(), null);
    thrown.expect(APIException.class);
    _authManager.validateUser("sanity_user@sanity.local", _subtenantId.toString(), null);
    _authManager.validateUser("sanity_user@sanity.local", _subtenantId.toString(), _rootTenantId.toString());
    _authManager.validateUser("user2@root.com", _rootTenantId.toString(), null);
    thrown.expect(APIException.class);
    _authManager.validateUser("user2@root.com", _subtenantId.toString(), null);
    _authManager.validateUser("user2@root.com", _subtenantId.toString(), _rootTenantId.toString());
    _authManager.validateUser("user@root.com", _subtenantId.toString(), null);
    thrown.expect(APIException.class);
    _authManager.validateUser("user@root.com", _rootTenantId.toString(), null);
    _authManager.validateUser("testuser@sanity.local", _subtenantId.toString(), null);
    thrown.expect(APIException.class);
    _authManager.validateUser("testuser@sanity.local", _rootTenantId.toString(), null);
    thrown.expect(APIException.class);
    _authManager.validateUser("testuser", _rootTenantId.toString(), null);
    thrown.expect(APIException.class);
    _authManager.validateUser("testuser", _subtenantId.toString(), null);
    Assert.assertTrue(_authManager.isGroupValid("Test Group@sanity.local", failureReason));
    Assert.assertFalse(_authManager.isGroupValid("Test Group@whitelist1", failureReason));
    Assert.assertEquals(failureReason[0], ValidationFailureReason.USER_OR_GROUP_NOT_FOUND_FOR_TENANT);
    Assert.assertFalse(_authManager.isGroupValid("Test Group@whitelist2", failureReason));
    Assert.assertTrue(_authManager.isGroupValid("Domain Users@whitelist2", failureReason));
    Assert.assertTrue(_authManager.isGroupValid("ProjectAdmins@whitelist1", failureReason));
    Assert.assertFalse(_authManager.isGroupValid("Test Group", failureReason));
    // Create the a good authConfig with the sid group attribute
    AuthnProvider sidAuthConfig = new AuthnProvider();
    sidAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    sidAuthConfig.setMode("ad");
    StringSet sidDomains = new StringSet();
    sidDomains.add("sidtest");
    sidAuthConfig.setDomains(sidDomains);
    sidAuthConfig.setManagerDN("CN=Administrator,CN=Users,DC=sanity,DC=local");
    sidAuthConfig.setManagerPassword(_adManagerPassword);
    StringSet sidUrls = new StringSet();
    sidUrls.add(LDAP_SERVER_2);
    sidAuthConfig.setServerUrls(sidUrls);
    sidAuthConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    sidAuthConfig.setSearchFilter("sAMAccountName=%U");
    sidAuthConfig.setGroupAttribute("objectSid");
    StringSet sidWhitelistValues = new StringSet();
    // Domain users ends in -513
    sidWhitelistValues.add("*-513");
    // Test group SID
    sidWhitelistValues.add("S-1-5-21-2759885641-1951973838-595118951-1135");
    sidAuthConfig.setGroupWhitelistValues(sidWhitelistValues);
    sidAuthConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(sidAuthConfig);
    reloadConfig(true);
    // Create a subtenant using the sid of Domain users from '@sidtest'
    // for mapping
    UserMapping sidGroupMapping = new UserMapping();
    sidGroupMapping.setDomain("sidtest");
    sidGroupMapping.setGroups(Collections.singletonList("S-1-5-21-2759885641-1951973838-595118951-513"));
    StringSetMap sidTestMappings = new StringSetMap();
    sidTestMappings.put(sidGroupMapping.getDomain(), sidGroupMapping.toString());
    URI subtenant2Id = URIUtil.createId(TenantOrg.class);
    TenantOrg subtenant2 = new TenantOrg();
    subtenant2.setLabel("subtenant2");
    subtenant2.setDescription("auth subtenant2");
    subtenant2.setId(subtenant2Id);
    subtenant2.setParentTenant(new NamedURI(_rootTenantId, "subtenant2"));
    subtenant2.setUserMappings(sidTestMappings);
    _dbClient.persistObject(subtenant2);
    // login the sanity_user (sanity_user@sanity.local) and verify that the user is in the
    // root tenant still despite being in 'Domain Users' group because it is a different domain
    user = _authManager.authenticate(sanityUserCreds);
    Assert.assertEquals(_rootTenantId.toString(), user.getTenantId());
    // Now try sanity_user@sidtest and the user should be in subtenant2
    UsernamePasswordCredentials sidTestUserCreds = new UsernamePasswordCredentials("sanity_user@sidtest", "P@ssw0rd");
    user = _authManager.authenticate(sidTestUserCreds);
    Assert.assertEquals(subtenant2Id.toString(), user.getTenantId());
    _authManager.validateUser("sanity_user@sidtest", subtenant2Id.toString(), null);
    _authManager.validateUser("testuser@sidtest", subtenant2Id.toString(), null);
    _authManager.validateUser("baduser@sidtest", subtenant2Id.toString(), null);
    // Test group
    Assert.assertTrue(_authManager.isGroupValid("S-1-5-21-2759885641-1951973838-595118951-1135@sidtest", failureReason));
    // Domain Users
    Assert.assertTrue(_authManager.isGroupValid("S-1-5-21-2759885641-1951973838-595118951-513@sidtest", failureReason));
    // non-existent group
    Assert.assertFalse(_authManager.isGroupValid("S-2-2-21-2759885641-1951973838-595118951-513@sidtest", failureReason));
    // non-whitelist group (ProjectAdmins)
    Assert.assertFalse(_authManager.isGroupValid("S-1-5-21-2759885641-1951973838-595118951-1111@sidtest", failureReason));
    // Create an config with a bad URL
    AuthnProvider ldapAuthConfig = new AuthnProvider();
    ldapAuthConfig.setId(URIUtil.createId(AuthnProvider.class));
    ldapAuthConfig.setMode("ldap");
    StringSet ldapDomains = new StringSet();
    ldapDomains.add("badurl.com");
    ldapAuthConfig.setDomains(ldapDomains);
    ldapAuthConfig.setManagerDN("cn=Manager,dc=root,dc=com");
    ldapAuthConfig.setManagerPassword("secret");
    StringSet ldapURLs = new StringSet();
    ldapURLs.add("ldap://xxx");
    ldapAuthConfig.setServerUrls(ldapURLs);
    ldapAuthConfig.setSearchBase("ou=People,dc=root,dc=com");
    ldapAuthConfig.setSearchFilter("(uid=%U)");
    _dbClient.createObject(ldapAuthConfig);
    UsernamePasswordCredentials badURLUserCreds = new UsernamePasswordCredentials("user@badurl.com", "password");
    // Check that authentication and validation operations fail
    // but do not throw connection exceptions
    user = _authManager.authenticate(badURLUserCreds);
    Assert.assertNull(user);
    thrown.expect(APIException.class);
    _authManager.validateUser("user@badurl.com", subtenant2Id.toString(), null);
    Assert.assertFalse(_authManager.isGroupValid("group@badurl.com", failureReason));
    cleanupProviders();
}

Example 18 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class CustomAuthenticationManagerTest method testAutoUpdate.

@Test
public void testAutoUpdate() throws Exception {
    // _authManager.setCoordinator(_coordinator);
    _authManager.setProviderUpdateCheckMinutes(1);
    // wait for initial load
    Thread.sleep(2 * 1000);
    int authProvidersSize = _authManager.getAuthenticationProviders().size();
    // Create the a good authConfig
    AuthnProvider updateTestConfig = new AuthnProvider();
    updateTestConfig.setId(URIUtil.createId(AuthnProvider.class));
    updateTestConfig.setMode("ad");
    StringSet adDomains = new StringSet();
    adDomains.add("auto-update");
    updateTestConfig.setDomains(adDomains);
    updateTestConfig.setManagerDN("CN=Administrator,CN=Users,DC=sanity,DC=local");
    updateTestConfig.setManagerPassword(_adManagerPassword);
    StringSet adUrls = new StringSet();
    adUrls.add(LDAP_SERVER_2);
    updateTestConfig.setServerUrls(adUrls);
    updateTestConfig.setSearchBase("CN=Users,DC=sanity,DC=local");
    updateTestConfig.setSearchFilter("userPrincipalName=%u");
    updateTestConfig.setGroupAttribute("CN");
    updateTestConfig.setLastModified(System.currentTimeMillis());
    _dbClient.createObject(updateTestConfig);
    // Wait one minute and the providers should be updated automatically
    Thread.sleep(61 * 1000);
    Assert.assertEquals(authProvidersSize + 1, _authManager.getAuthenticationProviders().size());
    // Disable the provider and wait a minute. nothing will change because we did not
    // update the time
    updateTestConfig.setDisable(true);
    _dbClient.persistObject(updateTestConfig);
    Thread.sleep(61 * 1000);
    Assert.assertEquals(authProvidersSize + 1, _authManager.getAuthenticationProviders().size());
    // now, update the time, and wait for reload
    updateTestConfig.setLastModified(System.currentTimeMillis());
    _dbClient.persistObject(updateTestConfig);
    Thread.sleep(61 * 1000);
    Assert.assertEquals(authProvidersSize, _authManager.getAuthenticationProviders().size());
}

Example 19 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class HostRescanDeviceController method getRescanAdapter.

private HostRescanAdapter getRescanAdapter(Host host) {
    if (HostType.Linux.name().equalsIgnoreCase(host.getType())) {
        return new LinuxSystemCLI(host.getHostName(), host.getPortNumber(), host.getUsername(), host.getPassword());
    } else if (HostType.AIX.name().equalsIgnoreCase(host.getType())) {
        return new AixSystem(host.getHostName(), host.getPortNumber(), host.getUsername(), host.getPassword());
    } else if (HostType.HPUX.name().equalsIgnoreCase(host.getType())) {
        return new HpuxSystem(host.getHostName(), host.getPortNumber(), host.getUsername(), host.getPassword());
    } else if (HostType.Windows.name().equalsIgnoreCase(host.getType())) {
        List<AuthnProvider> authProviders = new ArrayList<AuthnProvider>();
        for (URI authProviderId : getDbClient().queryByType(AuthnProvider.class, true)) {
            AuthnProvider authProvider = getDbClient().queryObject(AuthnProvider.class, authProviderId);
            authProviders.add(authProvider);
        }
        KerberosUtil.initializeKerberos(authProviders);
        return WindowsHostDiscoveryAdapter.createWindowsSystem(host);
    } else if (HostType.Esx.name().equalsIgnoreCase(host.getType())) {
        if (host.getUsername() != null && host.getPassword() != null) {
            VCenterAPI vcenterAPI = EsxHostDiscoveryAdapter.createVCenterAPI(host);
            List<HostSystem> hostSystems = vcenterAPI.listAllHostSystems();
            if (hostSystems != null && !hostSystems.isEmpty()) {
                return new HostStorageAPI(hostSystems.get(0));
            } else {
                return null;
            }
        } else if (host.getVcenterDataCenter() != null) {
            // Lookup the vcenter datacenter and vcenter to retreive the HostSystem
            VcenterDataCenter dataCenter = dbClient.queryObject(VcenterDataCenter.class, host.getVcenterDataCenter());
            if (dataCenter == null || dataCenter.getInactive()) {
                throw DeviceControllerException.exceptions.objectNotFound(host.getVcenterDataCenter());
            }
            Vcenter vcenter = dbClient.queryObject(Vcenter.class, dataCenter.getVcenter());
            if (vcenter == null || vcenter.getInactive()) {
                throw DeviceControllerException.exceptions.objectNotFound(dataCenter.getVcenter());
            }
            VCenterAPI vCenterAPI = VcenterDiscoveryAdapter.createVCenterAPI(vcenter);
            String datacenterName = dataCenter.getLabel();
            HostSystem hostSystem = vCenterAPI.findHostSystem(datacenterName, host.getHostName());
            if (hostSystem != null) {
                return new HostStorageAPI(hostSystem);
            } else {
                return null;
            }
        }
    } else {
        // Unanticipated host type
        return null;
    }
    return null;
}

Example 20 with AuthnProvider

use of com.emc.storageos.db.client.model.AuthnProvider in project coprhd-controller by CoprHD.

the class TenantsService method authNProviderExistsForDomain.

/**
 * Check if a provider exists for the given domain
 *
 * @param domain
 * @return
 */
private boolean authNProviderExistsForDomain(String domain) {
    URIQueryResultList providers = new URIQueryResultList();
    try {
        _dbClient.queryByConstraint(AlternateIdConstraint.Factory.getAuthnProviderDomainConstraint(domain), providers);
    } catch (DatabaseException ex) {
        _log.error("Could not query for authn providers to check for existing domain {}", domain, ex.getStackTrace());
        throw ex;
    }
    // check if there is an AuthnProvider contains the given domain and not in disabled state
    boolean bExist = false;
    Iterator<URI> it = providers.iterator();
    while (it.hasNext()) {
        URI providerURI = it.next();
        AuthnProvider provider = _dbClient.queryObject(AuthnProvider.class, providerURI);
        if (provider != null && provider.getDisable() == false) {
            bExist = true;
            break;
        }
    }
    return bExist;
}