Examples with DelegationPrivilege com.sun.identity.delegation.DelegationPrivilege used on opensource projects

Example 1 with DelegationPrivilege

use of com.sun.identity.delegation.DelegationPrivilege in project OpenAM by OpenRock.

the class RemovePrivileges method handleRequest.

/**
     * Services a Commandline Request.
     *
     * @param rc Request Context.
     * @throws CLIException if the request cannot serviced.
     */
public void handleRequest(RequestContext rc) throws CLIException {
    super.handleRequest(rc);
    SSOToken adminSSOToken = getAdminSSOToken();
    IOutput outputWriter = getOutputWriter();
    String realm = getStringOptionValue(IArgument.REALM_NAME);
    String idName = getStringOptionValue(ARGUMENT_ID_NAME);
    String type = getStringOptionValue(ARGUMENT_ID_TYPE);
    List privileges = (List) rc.getOption(IArgument.PRIVILEGES);
    IdType idType = convert2IdType(type);
    String[] params = { realm, type, idName };
    try {
        writeLog(LogWriter.LOG_ACCESS, Level.INFO, "ATTEMPT_IDREPO_REMOVE_PRIVILEGES", params);
        DelegationManager mgr = new DelegationManager(adminSSOToken, realm);
        Set privilegeObjects = mgr.getPrivileges();
        AMIdentity amid;
        if (idType.equals(IdType.ROLE) && idName.equalsIgnoreCase(ALL_AUTHENTICATED_USERS)) {
            //realm needs to be /, see DelegationPolicyImpl#privilegeToPolicy implementation
            amid = new AMIdentity(adminSSOToken, idName, idType, "/", null);
        //do not check the existense of all authenticated users role as it would fail
        } else {
            amid = new AMIdentity(adminSSOToken, idName, idType, realm, null);
        }
        String uid = amid.getUniversalId();
        for (Iterator i = privileges.iterator(); i.hasNext(); ) {
            String name = (String) i.next();
            DelegationPrivilege dp = getDelegationPrivilege(name, privilegeObjects);
            boolean removed = false;
            if (dp != null) {
                Set subjects = dp.getSubjects();
                if (subjects.contains(uid)) {
                    subjects.remove(uid);
                    mgr.addPrivilege(dp);
                    removed = true;
                }
            }
            if (!removed) {
                String[] args = { idName, name };
                String msg = MessageFormat.format(getResourceString("delegation-does-not-have-privilege"), (Object[]) args);
                throw new CLIException(msg, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
            }
        }
        outputWriter.printlnMessage(MessageFormat.format(getResourceString("idrepo-remove-privileges-succeed"), (Object[]) params));
        writeLog(LogWriter.LOG_ACCESS, Level.INFO, "SUCCEED_IDREPO_REMOVE_PRIVILEGES", params);
    } catch (DelegationException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("RemovePrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_REMOVE_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    } catch (SSOException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("RemovePrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_REMOVE_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    }
}

Example 2 with DelegationPrivilege

use of com.sun.identity.delegation.DelegationPrivilege in project OpenAM by OpenRock.

the class AddPrivileges method handleRequest.

/**
     * Services a Commandline Request.
     *
     * @param rc Request Context.
     * @throws CLIException if the request cannot serviced.
     */
public void handleRequest(RequestContext rc) throws CLIException {
    super.handleRequest(rc);
    SSOToken adminSSOToken = getAdminSSOToken();
    IOutput outputWriter = getOutputWriter();
    String realm = getStringOptionValue(IArgument.REALM_NAME);
    String idName = getStringOptionValue(ARGUMENT_ID_NAME);
    String type = getStringOptionValue(ARGUMENT_ID_TYPE);
    List privileges = (List) rc.getOption(IArgument.PRIVILEGES);
    IdType idType = convert2IdType(type);
    String[] params = { realm, type, idName };
    try {
        writeLog(LogWriter.LOG_ACCESS, Level.INFO, "ATTEMPT_IDREPO_ADD_PRIVILEGES", params);
        DelegationManager mgr = new DelegationManager(adminSSOToken, realm);
        Set privilegeObjects = mgr.getPrivileges();
        AMIdentity amid;
        if (idType.equals(IdType.ROLE) && idName.equalsIgnoreCase(ALL_AUTHENTICATED_USERS)) {
            //realm needs to be /, see DelegationPolicyImpl#privilegeToPolicy implementation
            amid = new AMIdentity(adminSSOToken, idName, idType, "/", null);
        //do not check the existense of all authenticated users role as it would fail
        } else {
            amid = new AMIdentity(adminSSOToken, idName, idType, realm, null);
            if (!amid.isExists()) {
                Object[] p = { idName, type };
                throw new CLIException(MessageFormat.format(getResourceString("idrepo-add-privileges-do-not-exist"), p), ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
            }
        }
        String uid = amid.getUniversalId();
        DelegationPrivilege newDp = null;
        for (Iterator i = privileges.iterator(); i.hasNext(); ) {
            String name = (String) i.next();
            DelegationPrivilege dp = getDelegationPrivilege(name, privilegeObjects);
            if (dp != null) {
                Set subjects = dp.getSubjects();
                if (!subjects.contains(uid)) {
                    subjects.add(uid);
                    newDp = new DelegationPrivilege(name, subjects, realm);
                    mgr.addPrivilege(newDp);
                } else {
                    String[] args = { idName, name };
                    String msg = MessageFormat.format(getResourceString("delegation-already-has-privilege"), (Object[]) args);
                    throw new CLIException(msg, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
                }
            } else {
                Set subjects = new HashSet(2);
                subjects.add(uid);
                newDp = new DelegationPrivilege(name, subjects, realm);
                mgr.addPrivilege(newDp);
            }
        }
        outputWriter.printlnMessage(MessageFormat.format(getResourceString("idrepo-add-privileges-succeed"), (Object[]) params));
        writeLog(LogWriter.LOG_ACCESS, Level.INFO, "SUCCEED_IDREPO_ADD_PRIVILEGES", params);
    } catch (IdRepoException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("AddPrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_ADD_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    } catch (DelegationException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("AddPrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_ADD_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    } catch (SSOException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("AddPrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_ADD_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    }
}

Example 3 with DelegationPrivilege

use of com.sun.identity.delegation.DelegationPrivilege in project OpenAM by OpenRock.

the class GetPrivileges method handleRequest.

/**
     * Services a Commandline Request.
     *
     * @param rc Request Context.
     * @throws CLIException if the request cannot serviced.
     */
public void handleRequest(RequestContext rc) throws CLIException {
    super.handleRequest(rc);
    SSOToken adminSSOToken = getAdminSSOToken();
    IOutput outputWriter = getOutputWriter();
    String realm = getStringOptionValue(IArgument.REALM_NAME);
    String idName = getStringOptionValue(ARGUMENT_ID_NAME);
    String type = getStringOptionValue(ARGUMENT_ID_TYPE);
    IdType idType = convert2IdType(type);
    String[] params = { realm, type, idName };
    try {
        DelegationManager mgr = new DelegationManager(adminSSOToken, realm);
        AMIdentityRepository amir = new AMIdentityRepository(adminSSOToken, realm);
        writeLog(LogWriter.LOG_ACCESS, Level.INFO, "ATTEMPT_IDREPO_GET_PRIVILEGES", params);
        AMIdentity amid;
        if (idType.equals(IdType.ROLE) && idName.equalsIgnoreCase(ALL_AUTHENTICATED_USERS)) {
            //realm needs to be /, see DelegationPolicyImpl#privilegeToPolicy implementation
            amid = new AMIdentity(adminSSOToken, idName, idType, "/", null);
        //do not check the existense of all authenticated users role as it would fail
        } else {
            amid = new AMIdentity(adminSSOToken, idName, idType, realm, null);
            if (!amid.isExists()) {
                Object[] p = { idName, type };
                throw new CLIException(MessageFormat.format(getResourceString("identity-does-not-exist"), p), ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
            }
        }
        Set results = mgr.getPrivileges(amid.getUniversalId());
        if ((results != null) && !results.isEmpty()) {
            String[] param = { "" };
            String msg = getResourceString("privilege-result");
            for (Iterator i = results.iterator(); i.hasNext(); ) {
                DelegationPrivilege p = (DelegationPrivilege) i.next();
                param[0] = p.getName();
                outputWriter.printlnMessage(MessageFormat.format(msg, (Object[]) param));
            }
        } else {
            outputWriter.printlnMessage(getResourceString("no-privileges"));
        }
        writeLog(LogWriter.LOG_ACCESS, Level.INFO, "SUCCEED_IDREPO_GET_PRIVILEGES", params);
    } catch (DelegationException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("GetPrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_GET_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    } catch (IdRepoException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("GetPrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_GET_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    } catch (SSOException e) {
        String[] args = { realm, type, idName, e.getMessage() };
        debugError("GetPrivileges.handleRequest", e);
        writeLog(LogWriter.LOG_ERROR, Level.INFO, "FAILED_IDREPO_GET_PRIVILEGES", args);
        throw new CLIException(e, ExitCodes.REQUEST_CANNOT_BE_PROCESSED);
    }
}

Example 4 with DelegationPrivilege

use of com.sun.identity.delegation.DelegationPrivilege in project OpenAM by OpenRock.

the class DelegationPropertiesViewBean method getPrivileges.

private Map getPrivileges(DelegationModel model) {
    Map map = null;
    String curRealm = (String) getPageSessionAttribute(AMAdminConstants.CURRENT_REALM);
    String uid = (String) getPageSessionAttribute(CURRENT_IDENTITY);
    try {
        Set privileges = model.getPrivileges(curRealm, uid);
        if ((privileges != null) && !privileges.isEmpty()) {
            map = new HashMap(privileges.size() * 2);
            for (Iterator iter = privileges.iterator(); iter.hasNext(); ) {
                DelegationPrivilege p = (DelegationPrivilege) iter.next();
                Set val = new HashSet(2);
                val.add(Boolean.TRUE.toString());
                map.put(p.getName(), val);
            }
        }
    } catch (AMConsoleException a) {
        setInlineAlertMessage(CCAlert.TYPE_WARNING, "message.warning", "nopermissions.message");
    }
    return (map == null) ? Collections.EMPTY_MAP : map;
}

Example 5 with DelegationPrivilege

use of com.sun.identity.delegation.DelegationPrivilege in project OpenAM by OpenRock.

the class DelegationPolicyImpl method getPrivileges.

/**
     * Returns all the delegation privileges associated with a realm.
     * 
     * @param  token  The <code>SSOToken</code> of the requesting user
     * @param  orgName The name of the realm from which the 
     *         delegation privileges are fetched.
     * 
     * @return <code>Set</code> of <code>DelegationPrivilege</code> objects 
     *         associated with the realm.
     * 
     * @throws SSOException  invalid or expired single-sign-on token
     * @throws DelegationException  for any abnormal condition
     */
public Set getPrivileges(SSOToken token, String orgName) throws SSOException, DelegationException {
    try {
        Set privileges = new HashSet();
        // Need to check if user has "delegate" permissions for org
        if (hasDelegationPermissionsForRealm(token, orgName)) {
            // Replace token with AdminToken
            token = (SSOToken) AccessController.doPrivileged(AdminTokenAction.getInstance());
        }
        PolicyManager pm = new PolicyManager(token, POLICY_REPOSITORY_REALM);
        Set pnames = pm.getPolicyNames();
        if (pnames != null) {
            /* the name of the policy is in the form of 
                 * orgName^^privilegeName, the privilegeName is the
                 * name of the delegation privilege that the policy 
                 * is corresponding to. In case the orgName is in a 
                 * DN format, the special char ',' is replaced to avoid
                 * saving problem.
                 */
            String prefix = null;
            if (orgName != null) {
                prefix = orgName.toLowerCase() + NAME_DELIMITER;
                prefix = prefix.replace(',', REPLACEMENT_FOR_COMMA);
            } else {
                prefix = NAME_DELIMITER;
            }
            int prefixLength = prefix.length();
            Iterator it = pnames.iterator();
            while (it.hasNext()) {
                String pname = (String) it.next();
                if (pname.toLowerCase().startsWith(prefix)) {
                    Policy p = pm.getPolicy(pname);
                    // converts the policy to its corresponding 
                    // delegation privilege
                    DelegationPrivilege dp = policyToPrivilege(p);
                    if (dp != null) {
                        dp.setName(pname.substring(prefixLength));
                        privileges.add(dp);
                    }
                }
            }
        }
        return (privileges);
    } catch (Exception e) {
        DelegationManager.debug.error("unable to get privileges from realm " + orgName);
        throw new DelegationException(e);
    }
}