Examples with UserMapping com.emc.storageos.security.authorization.BasePermissionsHelper.UserMapping used on opensource projects

Example 1 with UserMapping

use of com.emc.storageos.security.authorization.BasePermissionsHelper.UserMapping in project coprhd-controller by CoprHD.

the class TenantsService method addUserMappings.

/**
 * Add the list of user mappings to the tenant. Check for conflicting mappings that
 * already exist.
 *
 * @param tenant
 * @param userMappingParams
 */
private void addUserMappings(TenantOrg tenant, List<UserMappingParam> userMappingParams, StorageOSUser user) {
    List<UserMapping> userMappings = UserMapping.fromParamList(userMappingParams);
    Map<String, Map<URI, List<UserMapping>>> domainUserMappingMap = new HashMap<String, Map<URI, List<UserMapping>>>();
    for (UserMapping userMapping : userMappings) {
        if (null == userMapping.getDomain() || userMapping.getDomain().isEmpty()) {
            throw APIException.badRequests.requiredParameterMissingOrEmpty("domain");
        }
        trimGroupAndDomainNames(userMapping);
        if (!authNProviderExistsForDomain(userMapping.getDomain())) {
            throw APIException.badRequests.invalidParameter("domain", userMapping.getDomain());
        }
        String domain = userMapping.getDomain();
        Map<URI, List<UserMapping>> domainMappings = domainUserMappingMap.get(domain);
        if (null == domainMappings) {
            domainMappings = _permissionsHelper.getAllUserMappingsForDomain(domain);
            domainUserMappingMap.put(domain, domainMappings);
        }
        for (Entry<URI, List<UserMapping>> existingMappingEntry : domainMappings.entrySet()) {
            if (!tenant.getId().equals(existingMappingEntry.getKey())) {
                for (UserMapping existingMapping : existingMappingEntry.getValue()) {
                    if (userMapping.isMatch(existingMapping)) {
                        URI dupTenantURI = existingMappingEntry.getKey();
                        throw _permissionsHelper.userHasGivenRole(user, dupTenantURI, Role.TENANT_ADMIN) ? APIException.badRequests.userMappingDuplicatedInAnotherTenantExtended(userMapping.toString(), dupTenantURI.toString()) : APIException.badRequests.userMappingDuplicatedInAnotherTenant(userMapping.toString());
                    }
                }
            }
        }
        // user group and groups in authentication provider.
        if (!isValidMapping(userMapping)) {
            throw APIException.badRequests.invalidParameter("user_mapping", userMapping.toString());
        }
        tenant.addUserMapping(userMapping.getDomain(), userMapping.toString());
    }
}

Example 2 with UserMapping

use of com.emc.storageos.security.authorization.BasePermissionsHelper.UserMapping in project coprhd-controller by CoprHD.

the class StorageOSLdapPersonAttributeDao method getStorageOSUser.

/*
     * another implementation of getStorageOSUser which throws Exception with error message instead of using failure reason.
     */
@Override
public StorageOSUserDAO getStorageOSUser(final Credentials credentials) {
    final String username = ((UsernamePasswordCredentials) credentials).getUserName();
    ValidationFailureReason[] failureReason = new ValidationFailureReason[1];
    UserAndTenants userAndTenants = getStorageOSUserAndTenants(username, failureReason);
    if (userAndTenants == null) {
        switch(failureReason[0]) {
            case LDAP_CONNECTION_FAILED:
                throw SecurityException.fatals.communicationToLDAPResourceFailed();
            case LDAP_MANAGER_AUTH_FAILED:
                throw SecurityException.fatals.ldapManagerAuthenticationFailed();
            case USER_OR_GROUP_NOT_FOUND_FOR_TENANT:
            default:
                throw APIException.badRequests.principalSearchFailed(username);
        }
    }
    StorageOSUserDAO user = userAndTenants._user;
    Map<URI, UserMapping> tenants = userAndTenants._tenants;
    if (null == tenants || tenants.isEmpty()) {
        _log.error("User {} did not match any tenant", username);
        throw APIException.forbidden.userDoesNotMapToAnyTenancy(user.getUserName());
    }
    if (tenants.keySet().size() > 1) {
        _log.error("User {} mapped to tenants {}", username, tenants.keySet().toArray());
        throw APIException.forbidden.userBelongsToMultiTenancy(user.getUserName(), tenantName(tenants.keySet()));
    }
    user.setTenantId(tenants.keySet().iterator().next().toString());
    return user;
}

Example 3 with UserMapping

use of com.emc.storageos.security.authorization.BasePermissionsHelper.UserMapping in project coprhd-controller by CoprHD.

the class StorageOSLdapPersonAttributeDao method getStorageOSUserAndTenants.

private UserAndTenants getStorageOSUserAndTenants(String username, ValidationFailureReason[] failureReason, URI tenantURI, List<UserMapping> usermapping) {
    BasePermissionsHelper permissionsHelper = new BasePermissionsHelper(_dbClient, false);
    final String[] userDomain = username.split("@");
    if (userDomain.length < 2) {
        _log.error("Illegal username {} missing domain", username);
        failureReason[0] = ValidationFailureReason.USER_OR_GROUP_NOT_FOUND_FOR_TENANT;
        return null;
    }
    final String domain = userDomain[1];
    final String ldapQuery = LdapFilterUtil.getPersonFilterWithValues(_filter, username);
    if (ldapQuery == null) {
        _log.error("Null query filter from string {} for username", _filter, username);
        failureReason[0] = ValidationFailureReason.USER_OR_GROUP_NOT_FOUND_FOR_TENANT;
        return null;
    }
    StringSet authnProviderDomains = getAuthnProviderDomains(domain);
    List<String> attrs = new ArrayList<String>();
    Map<URI, List<UserMapping>> tenantToMappingMap = permissionsHelper.getAllUserMappingsForDomain(authnProviderDomains);
    if (_searchControls.getReturningAttributes() != null) {
        Collections.addAll(attrs, _searchControls.getReturningAttributes());
    }
    if (tenantURI != null) {
        tenantToMappingMap.put(tenantURI, usermapping);
    }
    printTenantToMappingMap(tenantToMappingMap);
    // Add attributes that need to be released for tenant mapping
    for (List<UserMapping> mappings : tenantToMappingMap.values()) {
        if (mappings == null) {
            continue;
        }
        for (UserMapping mapping : mappings) {
            if (mapping.getAttributes() != null && !mapping.getAttributes().isEmpty()) {
                for (UserMappingAttribute mappingAttribute : mapping.getAttributes()) {
                    attrs.add(mappingAttribute.getKey());
                }
            }
        }
    }
    // Now get the returning attributes from the userGroup table.
    getReturningAttributesFromUserGroups(permissionsHelper, domain, attrs);
    // Create search controls with the additional attributes to return
    SearchControls dnSearchControls = new SearchControls(_searchControls.getSearchScope(), _searchControls.getCountLimit(), _searchControls.getTimeLimit(), attrs.toArray(new String[attrs.size()]), _searchControls.getReturningObjFlag(), _searchControls.getDerefLinkFlag());
    Map<String, List<String>> userMappingAttributes = new HashMap<String, List<String>>();
    StorageOSUserMapper userMapper = new StorageOSUserMapper(username, getDistinguishedNameAttribute(), userMappingAttributes);
    // Execute the query
    @SuppressWarnings("unchecked") final List<StorageOSUserDAO> storageOSUsers = safeLdapSearch(_baseDN, ldapQuery, dnSearchControls, userMapper, failureReason);
    if (null == storageOSUsers) {
        _log.error("Query for user {} failed", username);
        return null;
    }
    StorageOSUserDAO storageOSUser = null;
    try {
        storageOSUser = DataAccessUtils.requiredUniqueResult(storageOSUsers);
        if (null == storageOSUser) {
            _log.error("Query for user {} yielded no results", username);
            failureReason[0] = ValidationFailureReason.USER_OR_GROUP_NOT_FOUND_FOR_TENANT;
            return null;
        }
    } catch (IncorrectResultSizeDataAccessException ex) {
        _log.error("Query for user {} yielded incorrect number of results.", username, ex);
        failureReason[0] = ValidationFailureReason.USER_OR_GROUP_NOT_FOUND_FOR_TENANT;
        return null;
    }
    // If the type is AD then fetch the users tokenGroups
    if (_type == AuthnProvider.ProvidersType.ad) {
        List<String> groups = queryTokenGroups(ldapQuery, storageOSUser);
        StringBuilder groupsString = new StringBuilder("[ ");
        for (String group : groups) {
            groupsString.append(group + " ");
            storageOSUser.addGroup(group);
        }
        groupsString.append("]");
        _log.debug("User {} adding groups {}", username, groupsString);
    } else {
        if (!updateGroupsAndRootGroupsInLDAPByMemberAttribute(storageOSUser, failureReason)) {
            // null means Exception has been thrown and error logged already, empty means no group found in LDAP/AD
            _log.info("User {} is not in any AD/LDAP groups.", storageOSUser.getDistinguishedName());
        }
    }
    // Add the user's group based on the attributes.
    addUserGroupsToUserGroupList(permissionsHelper, domain, storageOSUser);
    return new UserAndTenants(storageOSUser, mapUserToTenant(authnProviderDomains, storageOSUser, userMappingAttributes, tenantToMappingMap, failureReason));
}

Example 4 with UserMapping

use of com.emc.storageos.security.authorization.BasePermissionsHelper.UserMapping in project coprhd-controller by CoprHD.

the class StorageOSLdapPersonAttributeDao method getStorageOSUser.

/*
     * @see com.emc.storageos.auth.StorageOSPersonAttributeDao#getPerson(java.lang.String)
     */
@Override
public StorageOSUserDAO getStorageOSUser(final Credentials credentials, ValidationFailureReason[] failureReason) {
    final String username = ((UsernamePasswordCredentials) credentials).getUserName();
    UserAndTenants userAndTenants = getStorageOSUserAndTenants(username, failureReason);
    if (null != userAndTenants) {
        StorageOSUserDAO user = userAndTenants._user;
        Map<URI, UserMapping> tenants = userAndTenants._tenants;
        if (null == tenants || tenants.isEmpty()) {
            _log.error("User {} did not match any tenant", username);
        } else if (tenants.keySet().size() > 1) {
            _log.error("User {} mapped to tenants {}", username, tenants.keySet().toArray());
        } else {
            user.setTenantId(tenants.keySet().iterator().next().toString());
        }
        return user;
    }
    return null;
}

Example 5 with UserMapping

use of com.emc.storageos.security.authorization.BasePermissionsHelper.UserMapping in project coprhd-controller by CoprHD.

the class UserTenantResource method getUserTenant.

@GET
@Produces(MediaType.APPLICATION_XML)
public Response getUserTenant(@QueryParam("username") String username, @QueryParam("tenantURI") String tenantURI, @QueryParam("usermappings") String strUserMappings) {
    if (username == null || username.isEmpty()) {
        Response.status(Status.BAD_REQUEST).entity("Query parameter username is required").build();
    }
    Map<URI, UserMapping> userTenants = null;
    if (StringUtils.isEmpty(tenantURI)) {
        userTenants = _authManager.getUserTenants(username);
    } else {
        List<UserMapping> userMappings = null;
        if (!StringUtils.isEmpty(strUserMappings)) {
            userMappings = MarshallUtil.convertStringToUserMappingList(strUserMappings);
            _log.debug("usermapping parameter after convert: " + userMappings);
        }
        userTenants = _authManager.peekUserTenants(username, URI.create(tenantURI), userMappings);
    }
    if (null != userTenants) {
        UserTenantList userTenantList = new UserTenantList();
        userTenantList._userTenantList = new ArrayList<UserTenant>();
        for (Entry<URI, UserMapping> userTenantEntry : userTenants.entrySet()) {
            UserTenant userTenant = new UserTenant();
            userTenant._id = userTenantEntry.getKey();
            userTenant._userMapping = userTenantEntry.getValue();
            userTenantList._userTenantList.add(userTenant);
        }
        return Response.ok(userTenantList).build();
    }
    return Response.status(Status.BAD_REQUEST).entity(String.format("Invalid username")).build();
}