use of com.emc.storageos.db.client.model.Token in project coprhd-controller by CoprHD.
the class CassandraTokenManager method getToken.
/**
* Persist/Update the StorageOSUserDAO record
* generates a new token or reuses an existing token.
*
* @return token as a String
*/
@Override
public String getToken(StorageOSUserDAO userDAO) {
try {
// always use lower case username for comparing/saving to db
userDAO.setUserName(userDAO.getUserName().toLowerCase());
// find an active user record, if there is one with an active token
List<StorageOSUserDAO> userRecords = getUserRecords(userDAO.getUserName());
StorageOSUserDAO user = updateDBWithUser(userDAO, userRecords);
// do we have a user account to use?
if (user == null) {
// No, create one
userDAO.setId(URIUtil.createId(StorageOSUserDAO.class));
_dbClient.persistObject(userDAO);
user = userDAO;
} else {
// check count
List<Token> tokensForUserId = getTokensForUserId(user.getId());
int maxTokens = user.getUserName().equalsIgnoreCase(PROXY_USER) ? _maxTokensForProxyUser : _maxTokensPerUserId;
double alertTokensSize = (maxTokens * TOKEN_WARNING_EIGHTY_PERCENT);
if (tokensForUserId.size() >= maxTokens) {
throw APIException.unauthorized.maxNumberOfTokenExceededForUser();
} else if (tokensForUserId.size() == (int) alertTokensSize) {
_log.warn("Prior to creating new token, user {} had {} tokens.", user.getUserName(), tokensForUserId.size());
}
}
return _tokenEncoder.encode(TokenOnWire.createTokenOnWire(createNewToken(user)));
} catch (DatabaseException ex) {
_log.error("Exception while persisting user information {}", userDAO.getUserName(), ex);
} catch (SecurityException e) {
_log.error("Token encoding exception. ", e);
}
return null;
}
use of com.emc.storageos.db.client.model.Token in project coprhd-controller by CoprHD.
the class TokenManagerTests method testVerifyAndResolveTokens.
/**
* Token tests for verify and resolve
*/
@Test
public void testVerifyAndResolveTokens() throws Exception {
commonDefaultSetupForSingleNodeTests();
// Test - new ticket issue
StorageOSUserDAO userDAO = new StorageOSUserDAO();
userDAO.setUserName("root");
userDAO.setIsLocal(true);
StringSet groups = new StringSet();
groups.add("gr1");
groups.add("gr2");
userDAO.setGroups(groups);
StringSet attributes = new StringSet();
attributes.add("atrr1");
attributes.add("attr2");
userDAO.setAttributes(attributes);
final String token = _tokenManager.getToken(userDAO);
Assert.assertNotNull(token);
Token tokenVerif = (Token) _tokenManager.verifyToken(token);
Assert.assertNotNull(tokenVerif);
StorageOSUserDAO gotUser = _tokenManager.resolveUser(tokenVerif);
Assert.assertTrue(gotUser.getIsLocal());
Assert.assertEquals(userDAO.getUserName(), gotUser.getUserName());
Assert.assertEquals(gotUser.getGroups().size(), groups.size());
Assert.assertEquals(gotUser.getAttributes().size(), attributes.size());
// Try with a non local user, make sure local flag is preserved
StorageOSUserDAO userDAO2 = new StorageOSUserDAO();
userDAO2.setUserName("user@domain.com");
userDAO2.setIsLocal(false);
final String token2 = _tokenManager.getToken(userDAO2);
Assert.assertNotNull(token2);
Token tokenVerif2 = (Token) _tokenManager.verifyToken(token2);
Assert.assertNotNull(tokenVerif2);
// make sure the is local flag checks out
StorageOSUserDAO gotUser2 = _tokenManager.resolveUser(tokenVerif2);
Assert.assertFalse(gotUser2.getIsLocal());
}
use of com.emc.storageos.db.client.model.Token in project coprhd-controller by CoprHD.
the class TokenManagerTests method testBasicTokenKeysRotation.
/**
* Basic rotation functionality is tested here using overridden rotation interval values
*
* @throws Exception
*/
@Test
public void testBasicTokenKeysRotation() throws Exception {
TokenMaxLifeValuesHolder holder = new TokenMaxLifeValuesHolder();
holder.setMaxTokenIdleTimeInMins(2);
holder.setMaxTokenLifeTimeInMins(4);
holder.setTokenIdleTimeGraceInMins(1);
holder.setKeyRotationIntervalInMSecs(5000);
CassandraTokenManager tokenManager = new CassandraTokenManager();
Base64TokenEncoder encoder = new Base64TokenEncoder();
TokenKeyGenerator tokenKeyGenerator = new TokenKeyGenerator();
DbClient dbClient = getDbClient();
CoordinatorClient coordinator = new TestCoordinator();
tokenManager.setTokenMaxLifeValuesHolder(holder);
tokenManager.setDbClient(dbClient);
tokenManager.setCoordinator(coordinator);
encoder.setCoordinator(coordinator);
tokenKeyGenerator.setTokenMaxLifeValuesHolder(holder);
encoder.setTokenKeyGenerator(tokenKeyGenerator);
encoder.managerInit();
tokenManager.setTokenEncoder(encoder);
StorageOSUserDAO userDAO = new StorageOSUserDAO();
userDAO.setUserName("user1");
userDAO.setIsLocal(true);
// get a regular token
final String token = tokenManager.getToken(userDAO);
Assert.assertNotNull(token);
TokenOnWire tw1 = encoder.decode(token);
Token tokenObj = dbClient.queryObject(Token.class, tw1.getTokenId());
Assert.assertNotNull(tokenObj);
// verify token
StorageOSUserDAO gotUser = tokenManager.validateToken(token);
Assert.assertNotNull(gotUser);
// get a proxy token
final String proxyToken = tokenManager.getProxyToken(gotUser);
Assert.assertNotNull(proxyToken);
// wait 6 seconds, this next token request will triggers a rotation
Thread.sleep(6000);
final String token2 = tokenManager.getToken(userDAO);
Assert.assertNotNull(token2);
// at this point, the first token should still be usable
gotUser = tokenManager.validateToken(token);
Assert.assertNotNull(gotUser);
// wait another 6 seconds, trigger another rotation.
Thread.sleep(6000);
final String token3 = tokenManager.getToken(userDAO);
Assert.assertNotNull(token3);
// has been rotated out from the current, then previous spot. It is gone.
try {
gotUser = tokenManager.validateToken(token);
Assert.fail("The token should not be usable.");
} catch (UnauthorizedException ex) {
// this exception is an expected one.
Assert.assertTrue(true);
}
// after several rotations, proxy token should be unaffected
gotUser = tokenManager.validateToken(proxyToken);
Assert.assertNotNull(gotUser);
}
use of com.emc.storageos.db.client.model.Token in project coprhd-controller by CoprHD.
the class TokenManagerTests method testProxyTokens.
/**
* Basic tests for proxy tokens
*/
@Test
public void testProxyTokens() throws Exception {
commonDefaultSetupForSingleNodeTests();
// Create a regular token
StorageOSUserDAO userDAO = new StorageOSUserDAO();
userDAO.setUserName("user111");
userDAO.setIsLocal(true);
userDAO.addAttribute("attr1=val1");
userDAO.addGroup("group1");
userDAO.setId((URIUtil.createId(StorageOSUserDAO.class)));
_dbClient.persistObject(userDAO);
final String token = _tokenManager.getToken(userDAO);
Assert.assertNotNull(token);
TokenOnWire tw = _encoder.decode(token);
Token tokenObj = _dbClient.queryObject(Token.class, tw.getTokenId());
Assert.assertNotNull(tokenObj);
// Check that the system knows it as a non-proxy token
Assert.assertFalse(BaseToken.isProxyToken(tokenObj));
// Do the same with a proxy token
final String proxyToken = _tokenManager.getProxyToken(userDAO);
Assert.assertNotNull(proxyToken);
TokenOnWire ptw = _encoder.decode(proxyToken);
ProxyToken proxyTokenObj = _dbClient.queryObject(ProxyToken.class, ptw.getTokenId());
Assert.assertNotNull(proxyTokenObj);
Assert.assertTrue(BaseToken.isProxyToken(proxyTokenObj));
Assert.assertTrue(ptw.isProxyToken());
Assert.assertNotNull(proxyTokenObj.getLastKnownIds());
// Check that user fetched from the id in the proxy token
// matches the user's properties of the userDAO that created the proxytoken
URI userId = proxyTokenObj.peekLastKnownId();
StorageOSUserDAO userFromProxyToken = _dbClient.queryObject(StorageOSUserDAO.class, userId);
Assert.assertNotNull(userFromProxyToken);
Assert.assertEquals(userFromProxyToken.getUserName(), userDAO.getUserName());
Assert.assertEquals(userFromProxyToken.getAttributes().size(), userDAO.getAttributes().size());
Assert.assertTrue(userFromProxyToken.getAttributes().containsAll(userDAO.getAttributes()));
Assert.assertEquals(userFromProxyToken.getGroups().size(), userDAO.getGroups().size());
Assert.assertTrue(userFromProxyToken.getGroups().containsAll(userDAO.getGroups()));
StorageOSUserDAO userFromProxyTokenValidation = _tokenManager.validateToken(proxyToken);
Assert.assertNotNull(userFromProxyTokenValidation);
Assert.assertEquals(userFromProxyTokenValidation.getUserName(), userDAO.getUserName());
Assert.assertEquals(userFromProxyTokenValidation.getAttributes().size(), userDAO.getAttributes().size());
Assert.assertTrue(userFromProxyTokenValidation.getAttributes().containsAll(userDAO.getAttributes()));
Assert.assertEquals(userFromProxyTokenValidation.getGroups().size(), userDAO.getGroups().size());
Assert.assertTrue(userFromProxyTokenValidation.getGroups().containsAll(userDAO.getGroups()));
// Make sure that once a proxy token is created for a user, it gets reused from then on
final String proxyToken2 = _tokenManager.getProxyToken(userDAO);
Assert.assertNotNull(proxyToken2);
Assert.assertEquals(proxyToken2, proxyToken);
// simulate logout by deleting the authtoken that we created earlier
_tokenManager.deleteToken(token.toString());
StorageOSUserDAO deletedUser = _tokenManager.validateToken(token);
Assert.assertNull(deletedUser);
StorageOSUserDAO userIsStillThere = _tokenManager.validateToken(proxyToken2);
Assert.assertNotNull(userIsStillThere);
Assert.assertEquals(userIsStillThere.getUserName(), userDAO.getUserName());
Assert.assertFalse(userIsStillThere.getInactive());
// Relogin. Get new auth and proxy tokens. Force expiration of auth token.
// Test that proxy token still works.
StorageOSUserDAO userDAO2 = new StorageOSUserDAO();
userDAO2.setUserName("user222");
userDAO2.setIsLocal(true);
userDAO2.setId((URIUtil.createId(StorageOSUserDAO.class)));
_dbClient.persistObject(userDAO2);
final String shortLivedTokenRaw = _tokenManager.getToken(userDAO2);
Assert.assertNotNull(shortLivedTokenRaw);
TokenOnWire sltw = _encoder.decode(shortLivedTokenRaw);
final String proxyToken3 = _tokenManager.getProxyToken(userDAO2);
Assert.assertNotNull(proxyToken3);
Token shortLivedToken = _dbClient.queryObject(Token.class, sltw.getTokenId());
Assert.assertNotNull(shortLivedToken);
shortLivedToken.setLastAccessTime((System.currentTimeMillis() / (60 * 1000)) - 3);
_dbClient.persistObject(shortLivedToken);
// validate that auth token is gone
deletedUser = _tokenManager.validateToken(shortLivedTokenRaw);
Assert.assertNull(deletedUser);
// validate that proxy token still works.
userIsStillThere = _tokenManager.validateToken(proxyToken3);
Assert.assertNotNull(userIsStillThere);
Assert.assertEquals(userIsStillThere.getUserName(), userDAO2.getUserName());
Assert.assertFalse(userIsStillThere.getInactive());
// Test that after proxy token gets deleted, the userDao is gone or marked inactive
// (its auth token has been expired above so proxy token was the last token)
_tokenManager.deleteAllTokensForUser(userDAO2.getUserName(), true);
StorageOSUserDAO inactiveUser = _dbClient.queryObject(StorageOSUserDAO.class, userDAO2.getId());
Assert.assertTrue(inactiveUser == null || inactiveUser.getInactive() == true);
// case sensitive username and proxy token optional deletion tests
StorageOSUserDAO userDAOBlah = new StorageOSUserDAO();
userDAOBlah.setUserName("user-blah");
userDAOBlah.setIsLocal(true);
final String blahToken = _tokenManager.getToken(userDAOBlah);
Assert.assertNotNull(blahToken);
TokenOnWire decoded = _encoder.decode(blahToken);
final String blahProxyToken = _tokenManager.getProxyToken(userDAOBlah);
Assert.assertNotNull(blahProxyToken);
userDAOBlah = new StorageOSUserDAO();
userDAOBlah.setUserName("User-Blah");
userDAOBlah.setIsLocal(true);
final String blahToken2 = _tokenManager.getToken(userDAOBlah);
Assert.assertNotNull(blahToken2);
TokenOnWire decoded2 = _encoder.decode(blahToken2);
final String blahProxyToken2 = _tokenManager.getProxyToken(userDAOBlah);
Assert.assertNotNull(blahProxyToken2);
Token blahTokenObj = _dbClient.queryObject(Token.class, decoded.getTokenId());
Token blahTokenObj2 = _dbClient.queryObject(Token.class, decoded2.getTokenId());
Assert.assertEquals(blahTokenObj.getUserId(), blahTokenObj2.getUserId());
Assert.assertEquals(blahProxyToken, blahProxyToken2);
_tokenManager.deleteAllTokensForUser("user-BLAH", false);
blahTokenObj = _dbClient.queryObject(Token.class, decoded.getTokenId());
blahTokenObj2 = _dbClient.queryObject(Token.class, decoded2.getTokenId());
Assert.assertNull(blahTokenObj);
Assert.assertNull(blahTokenObj2);
Assert.assertNull(_tokenManager.validateToken(blahToken));
Assert.assertNotNull(_tokenManager.validateToken(blahProxyToken));
_tokenManager.deleteAllTokensForUser("user-BLAH", true);
Assert.assertNull(_tokenManager.validateToken(blahProxyToken));
}
use of com.emc.storageos.db.client.model.Token in project coprhd-controller by CoprHD.
the class TokenManagerTests method testCrossVDCTokenValidation.
/**
* testCrossVDCTokenValidation
* Tests that a token from VDC2 and VDC3 can both be validated in VDC1
* given that VDC1's cache has these tokens and keys available.
*
* @throws Exception
*/
@Test
public void testCrossVDCTokenValidation() throws Exception {
commonDefaultSetupForSingleNodeTests();
TokenMaxLifeValuesHolder holder = new TokenMaxLifeValuesHolder();
// VDC1 (validator)
CoordinatorClient coordinatorVDC1 = new TestCoordinator();
InterVDCTokenCacheHelper cacheHelperVDC1 = new InterVDCTokenCacheHelper();
cacheHelperVDC1.setCoordinator(coordinatorVDC1);
cacheHelperVDC1.setDbClient(_dbClient);
cacheHelperVDC1.setMaxLifeValuesHolder(holder);
TokenKeyGenerator tokenKeyGeneratorVDC1 = new TokenKeyGenerator();
tokenKeyGeneratorVDC1.setTokenMaxLifeValuesHolder(holder);
Base64TokenEncoder encoderVDC1 = new Base64TokenEncoder();
encoderVDC1.setCoordinator(coordinatorVDC1);
encoderVDC1.setInterVDCTokenCacheHelper(cacheHelperVDC1);
encoderVDC1.setTokenKeyGenerator(tokenKeyGeneratorVDC1);
encoderVDC1.managerInit();
CassandraTokenManager tokenManagerVDC1 = new CassandraTokenManager();
tokenManagerVDC1.setDbClient(_dbClient);
tokenManagerVDC1.setCoordinator(coordinatorVDC1);
tokenManagerVDC1.setInterVDCTokenCacheHelper(cacheHelperVDC1);
tokenManagerVDC1.setTokenEncoder(encoderVDC1);
tokenManagerVDC1.setTokenMaxLifeValuesHolder(holder);
// VDC2 (creator of token)
CoordinatorClient coordinatorVDC2 = new TestCoordinator();
TokenKeyGenerator tokenKeyGeneratorVDC2 = new TokenKeyGenerator();
tokenKeyGeneratorVDC2.setTokenMaxLifeValuesHolder(holder);
Base64TokenEncoder encoderVDC2 = new Base64TokenEncoder();
encoderVDC2.setCoordinator(coordinatorVDC2);
encoderVDC2.setTokenKeyGenerator(tokenKeyGeneratorVDC2);
encoderVDC2.managerInit();
CassandraTokenManager tokenManagerVDC2 = new CassandraTokenManager();
tokenManagerVDC2.setDbClient(_dbClient);
tokenManagerVDC2.setCoordinator(coordinatorVDC2);
tokenManagerVDC2.setTokenEncoder(encoderVDC2);
tokenManagerVDC2.setTokenMaxLifeValuesHolder(holder);
// VDC3 (creator of token)
CoordinatorClient coordinatorVDC3 = new TestCoordinator();
TokenKeyGenerator tokenKeyGeneratorVDC3 = new TokenKeyGenerator();
tokenKeyGeneratorVDC3.setTokenMaxLifeValuesHolder(holder);
Base64TokenEncoder encoderVDC3 = new Base64TokenEncoder();
encoderVDC3.setCoordinator(coordinatorVDC3);
encoderVDC3.setTokenKeyGenerator(tokenKeyGeneratorVDC3);
encoderVDC3.managerInit();
CassandraTokenManager tokenManagerVDC3 = new CassandraTokenManager();
tokenManagerVDC3.setDbClient(_dbClient);
tokenManagerVDC3.setCoordinator(coordinatorVDC3);
tokenManagerVDC3.setTokenEncoder(encoderVDC3);
tokenManagerVDC3.setTokenMaxLifeValuesHolder(holder);
// VDC2 create a token
// set VdcUtil localvdcid to vdc2 to resulting token is identified as such
VirtualDataCenter localVdc = VdcUtil.getLocalVdc();
localVdc.setShortId("vdc2");
_dbClient.persistObject(localVdc);
VdcUtil.invalidateVdcUrnCache();
StorageOSUserDAO userDAOVDC2 = new StorageOSUserDAO();
userDAOVDC2.setUserName("user1@domain.com");
userDAOVDC2.setIsLocal(false);
String tokenVDC2 = tokenManagerVDC2.getToken(userDAOVDC2);
Assert.assertNotNull(tokenVDC2);
TokenOnWire twVDC2 = encoderVDC2.decode(tokenVDC2);
final Token tokenObjVDC2 = _dbClient.queryObject(Token.class, twVDC2.getTokenId());
Assert.assertNotNull(tokenObjVDC2);
URI userIdVDC2 = tokenObjVDC2.getUserId();
Assert.assertNotNull(userIdVDC2);
final StorageOSUserDAO gotUserVDC2 = tokenManagerVDC2.validateToken(tokenVDC2);
Assert.assertNotNull(gotUserVDC2);
// because we are running this on the same "db" as opposed to 2 different VDCs,
// there will be a conflict when caching the token, since the original is already there
// with the same id. So we are changing the token id and user record id for this
// purpose.
tokenObjVDC2.setId(URIUtil.createId(Token.class));
gotUserVDC2.setId(URIUtil.createId(StorageOSUserDAO.class));
tokenObjVDC2.setUserId(gotUserVDC2.getId());
TokenOnWire tokenToBeCachedVDC2 = TokenOnWire.createTokenOnWire(tokenObjVDC2);
// this re-encoded alternate token is the token that will be cached and validated
// from cache.
final String newEncodedVDC2 = encoderVDC2.encode(tokenToBeCachedVDC2);
// VDC3 create a token
// set VdcUtil localvdcid to vdc3 to resulting token is identified as such
localVdc.setShortId("vdc3");
_dbClient.persistObject(localVdc);
VdcUtil.invalidateVdcUrnCache();
StorageOSUserDAO userDAOVDC3 = new StorageOSUserDAO();
userDAOVDC3.setUserName("user2@domain.com");
userDAOVDC3.setIsLocal(false);
String tokenVDC3 = tokenManagerVDC3.getToken(userDAOVDC3);
Assert.assertNotNull(tokenVDC3);
TokenOnWire twVDC3 = encoderVDC3.decode(tokenVDC3);
final Token tokenObjVDC3 = _dbClient.queryObject(Token.class, twVDC3.getTokenId());
Assert.assertNotNull(tokenObjVDC3);
URI userIdVDC3 = tokenObjVDC3.getUserId();
Assert.assertNotNull(userIdVDC3);
final StorageOSUserDAO gotUserVDC3 = tokenManagerVDC3.validateToken(tokenVDC3);
Assert.assertNotNull(gotUserVDC3);
tokenObjVDC3.setId(URIUtil.createId(Token.class));
gotUserVDC3.setId(URIUtil.createId(StorageOSUserDAO.class));
tokenObjVDC3.setUserId(gotUserVDC3.getId());
TokenOnWire tokenToBeCachedVDC3 = TokenOnWire.createTokenOnWire(tokenObjVDC3);
// this re-encoded alternate token is the token that will be cached and validated
// from cache.
final String newEncodedVDC3 = encoderVDC3.encode(tokenToBeCachedVDC3);
// Cache VDC2 &3's tokens and keys in VDC1.cache
TokenKeysBundle bundleVDC2 = tokenKeyGeneratorVDC2.readBundle();
TokenKeysBundle bundleVDC3 = tokenKeyGeneratorVDC3.readBundle();
TokenResponseArtifacts artifactsVDC2 = new TokenResponseArtifacts(gotUserVDC2, tokenObjVDC2, bundleVDC2);
TokenResponseArtifacts artifactsVDC3 = new TokenResponseArtifacts(gotUserVDC3, tokenObjVDC3, bundleVDC3);
cacheHelperVDC1.cacheForeignTokenAndKeys(artifactsVDC2, "vdc2");
cacheHelperVDC1.cacheForeignTokenAndKeys(artifactsVDC3, "vdc3");
Assert.assertEquals(2, cacheHelperVDC1.getAllCachedBundles().size());
// Validate both tokens using VDC1
// set VdcUtil localvdcid to vdc1 to resulting token is identified as such
localVdc.setShortId("vdc1");
_dbClient.persistObject(localVdc);
VdcUtil.invalidateVdcUrnCache();
StorageOSUserDAO userValidate = tokenManagerVDC1.validateToken(newEncodedVDC2);
Assert.assertNotNull(userValidate);
Assert.assertEquals(userValidate.getUserName(), userDAOVDC2.getUserName());
StorageOSUserDAO userValidate2 = tokenManagerVDC1.validateToken(newEncodedVDC3);
Assert.assertNotNull(userValidate2);
Assert.assertEquals(userValidate2.getUserName(), userDAOVDC3.getUserName());
}
Aggregations