Examples with UserSessionBase org.apache.ranger.common.UserSessionBase used on opensource projects

Example 31 with UserSessionBase

use of org.apache.ranger.common.UserSessionBase in project ranger by apache.

the class SessionMgr method processSuccessLogin.

public UserSessionBase processSuccessLogin(int authType, String userAgent, HttpServletRequest httpRequest) {
    boolean newSessionCreation = true;
    UserSessionBase userSession = null;
    RangerSecurityContext context = RangerContextHolder.getSecurityContext();
    if (context != null) {
        userSession = context.getUserSession();
    }
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails();
    String currentLoginId = authentication.getName();
    if (userSession != null) {
        if (validateUserSession(userSession, currentLoginId)) {
            newSessionCreation = false;
        }
    }
    if (newSessionCreation) {
        getSSOSpnegoAuthCheckForAPI(currentLoginId, httpRequest);
        // Need to build the UserSession
        XXPortalUser gjUser = daoManager.getXXPortalUser().findByLoginId(currentLoginId);
        if (gjUser == null) {
            logger.error("Error getting user for loginId=" + currentLoginId, new Exception());
            return null;
        }
        XXAuthSession gjAuthSession = new XXAuthSession();
        gjAuthSession.setLoginId(currentLoginId);
        gjAuthSession.setUserId(gjUser.getId());
        gjAuthSession.setAuthTime(DateUtil.getUTCDate());
        gjAuthSession.setAuthStatus(XXAuthSession.AUTH_STATUS_SUCCESS);
        gjAuthSession.setAuthType(authType);
        if (details != null) {
            gjAuthSession.setExtSessionId(details.getSessionId());
            gjAuthSession.setRequestIP(details.getRemoteAddress());
        }
        if (userAgent != null) {
            gjAuthSession.setRequestUserAgent(userAgent);
        }
        gjAuthSession.setDeviceType(httpUtil.getDeviceType(userAgent));
        HttpSession session = httpRequest.getSession();
        if (session != null) {
            if (session.getAttribute("auditLoginId") == null) {
                synchronized (session) {
                    if (session.getAttribute("auditLoginId") == null) {
                        boolean isDownloadLogEnabled = PropertiesUtil.getBooleanProperty("ranger.downloadpolicy.session.log.enabled", false);
                        if (isDownloadLogEnabled) {
                            gjAuthSession = storeAuthSession(gjAuthSession);
                            session.setAttribute("auditLoginId", gjAuthSession.getId());
                        } else if (!StringUtils.isEmpty(httpRequest.getRequestURI()) && !(httpRequest.getRequestURI().contains("/secure/policies/download/") || httpRequest.getRequestURI().contains("/secure/download/"))) {
                            gjAuthSession = storeAuthSession(gjAuthSession);
                            session.setAttribute("auditLoginId", gjAuthSession.getId());
                        } else if (StringUtils.isEmpty(httpRequest.getRequestURI())) {
                            gjAuthSession = storeAuthSession(gjAuthSession);
                            session.setAttribute("auditLoginId", gjAuthSession.getId());
                        } else {
                        // NOPMD
                        // do not log the details for download policy and tag
                        }
                    }
                }
            }
        }
        userSession = new UserSessionBase();
        userSession.setXXPortalUser(gjUser);
        userSession.setXXAuthSession(gjAuthSession);
        if (httpRequest.getAttribute("spnegoEnabled") != null && (boolean) httpRequest.getAttribute("spnegoEnabled")) {
            userSession.setSpnegoEnabled(true);
        }
        resetUserSessionForProfiles(userSession);
        resetUserModulePermission(userSession);
        Calendar cal = Calendar.getInstance();
        if (details != null) {
            logger.info("Login Success: loginId=" + currentLoginId + ", sessionId=" + gjAuthSession.getId() + ", sessionId=" + details.getSessionId() + ", requestId=" + details.getRemoteAddress() + ", epoch=" + cal.getTimeInMillis());
        } else {
            logger.info("Login Success: loginId=" + currentLoginId + ", sessionId=" + gjAuthSession.getId() + ", details is null" + ", epoch=" + cal.getTimeInMillis());
        }
    }
    return userSession;
}

Example 32 with UserSessionBase

use of org.apache.ranger.common.UserSessionBase in project ranger by apache.

the class SessionMgr method resetUserModulePermission.

public void resetUserModulePermission(UserSessionBase userSession) {
    XXUser xUser = daoManager.getXXUser().findByUserName(userSession.getLoginId());
    if (xUser != null) {
        List<String> permissionList = daoManager.getXXModuleDef().findAccessibleModulesByUserId(userSession.getUserId(), xUser.getId());
        CopyOnWriteArraySet<String> userPermissions = new CopyOnWriteArraySet<String>(permissionList);
        UserSessionBase.RangerUserPermission rangerUserPermission = userSession.getRangerUserPermission();
        if (rangerUserPermission == null) {
            rangerUserPermission = new UserSessionBase.RangerUserPermission();
        }
        rangerUserPermission.setUserPermissions(userPermissions);
        rangerUserPermission.setLastUpdatedTime(Calendar.getInstance().getTimeInMillis());
        userSession.setRangerUserPermission(rangerUserPermission);
        logger.info("UserSession Updated to set new Permissions to User: " + userSession.getLoginId());
    } else {
        logger.error("No XUser found with username: " + userSession.getLoginId() + "So Permission is not set for the user");
    }
}

Example 33 with UserSessionBase

use of org.apache.ranger.common.UserSessionBase in project ranger by apache.

the class UserMgr method checkAccessForUpdate.

public void checkAccessForUpdate(XXPortalUser gjUser) {
    if (gjUser == null) {
        throw restErrorUtil.create403RESTException("serverMsg.userMgrWrongUser");
    }
    UserSessionBase sess = ContextUtil.getCurrentUserSession();
    if (sess != null) {
        // Admin
        if (sess.isUserAdmin()) {
            return;
        }
        // Self
        if (sess.getXXPortalUser().getId().equals(gjUser.getId())) {
            return;
        }
    }
    VXResponse vXResponse = new VXResponse();
    vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
    vXResponse.setMsgDesc("User " + " access denied. loggedInUser=" + (sess != null ? sess.getXXPortalUser().getId() : "Not Logged In") + ", accessing user=" + gjUser.getId());
    throw restErrorUtil.generateRESTException(vXResponse);
}

Example 34 with UserSessionBase

use of org.apache.ranger.common.UserSessionBase in project ranger by apache.

the class UserMgr method addUserRole.

public XXPortalUserRole addUserRole(Long userId, String userRole) {
    rangerBizUtil.blockAuditorRoleUser();
    List<XXPortalUserRole> roleList = daoManager.getXXPortalUserRole().findByUserId(userId);
    boolean publicRole = false;
    for (String publicRoleStr : publicRoles) {
        if (publicRoleStr.equalsIgnoreCase(userRole)) {
            publicRole = true;
            break;
        }
    }
    if (!publicRole) {
        UserSessionBase sess = ContextUtil.getCurrentUserSession();
        if (sess == null) {
            return null;
        }
        // Admin
        if (!sess.isUserAdmin() && !sess.isKeyAdmin()) {
            logger.error("SECURITY WARNING: User trying to add non public role. userId=" + userId + ", role=" + userRole + ", session=" + sess.toString(), new Throwable());
            return null;
        }
    }
    for (XXPortalUserRole gjUserRole : roleList) {
        if (userRole.equalsIgnoreCase(gjUserRole.getUserRole())) {
            return gjUserRole;
        }
    }
    XXPortalUserRole userRoleObj = new XXPortalUserRole();
    if (!VALID_ROLE_LIST.contains(userRole.toUpperCase())) {
        throw restErrorUtil.createRESTException("Invalid user role, please provide valid user role.", MessageEnums.INVALID_INPUT_DATA);
    }
    userRoleObj.setUserRole(userRole.toUpperCase());
    userRoleObj.setUserId(userId);
    userRoleObj.setStatus(RangerConstants.STATUS_ENABLED);
    daoManager.getXXPortalUserRole().create(userRoleObj);
    // If role is not OTHER, then remove OTHER
    if (!RangerConstants.ROLE_OTHER.equalsIgnoreCase(userRole)) {
        deleteUserRole(userId, RangerConstants.ROLE_OTHER);
    }
    sessionMgr.resetUserSessionForProfiles(ContextUtil.getCurrentUserSession());
    return null;
}

Example 35 with UserSessionBase

use of org.apache.ranger.common.UserSessionBase in project ranger by apache.

the class UserMgr method gjUserToUserProfile.

private void gjUserToUserProfile(XXPortalUser user, VXPortalUser userProfile) {
    UserSessionBase sess = ContextUtil.getCurrentUserSession();
    if (sess == null) {
        return;
    }
    // Admin
    if (sess.isUserAdmin() || sess.isKeyAdmin() || sess.getXXPortalUser().getId().equals(user.getId())) {
        userProfile.setLoginId(user.getLoginId());
        userProfile.setStatus(user.getStatus());
        userProfile.setUserRoleList(new ArrayList<String>());
        String emailAddress = user.getEmailAddress();
        if (emailAddress != null && stringUtil.validateEmail(emailAddress)) {
            userProfile.setEmailAddress(user.getEmailAddress());
        }
        userProfile.setUserSource(sess.getAuthProvider());
        List<XXPortalUserRole> gjUserRoleList = daoManager.getXXPortalUserRole().findByParentId(user.getId());
        for (XXPortalUserRole gjUserRole : gjUserRoleList) {
            userProfile.getUserRoleList().add(gjUserRole.getUserRole());
        }
        userProfile.setId(user.getId());
        List<XXUserPermission> xUserPermissions = daoManager.getXXUserPermission().findByUserPermissionIdAndIsAllowed(userProfile.getId());
        List<XXGroupPermission> xxGroupPermissions = daoManager.getXXGroupPermission().findbyVXPortalUserId(userProfile.getId());
        List<VXGroupPermission> groupPermissions = new ArrayList<VXGroupPermission>();
        List<VXUserPermission> vxUserPermissions = new ArrayList<VXUserPermission>();
        for (XXGroupPermission xxGroupPermission : xxGroupPermissions) {
            VXGroupPermission groupPermission = xGroupPermissionService.populateViewBean(xxGroupPermission);
            groupPermission.setModuleName(daoManager.getXXModuleDef().findByModuleId(groupPermission.getModuleId()).getModule());
            groupPermissions.add(groupPermission);
        }
        for (XXUserPermission xUserPermission : xUserPermissions) {
            VXUserPermission vXUserPermission = xUserPermissionService.populateViewBean(xUserPermission);
            vXUserPermission.setModuleName(daoManager.getXXModuleDef().findByModuleId(vXUserPermission.getModuleId()).getModule());
            vxUserPermissions.add(vXUserPermission);
        }
        userProfile.setGroupPermissions(groupPermissions);
        userProfile.setUserPermList(vxUserPermissions);
        userProfile.setFirstName(user.getFirstName());
        userProfile.setLastName(user.getLastName());
        userProfile.setPublicScreenName(user.getPublicScreenName());
    }
}