use of org.eclipse.kapua.model.id.KapuaId in project kapua by eclipse.
the class KapuaSecurityBrokerFilter method removeConnection.
@Override
public void removeConnection(ConnectionContext context, ConnectionInfo info, Throwable error) throws Exception {
if (!isPassThroughConnection(context)) {
Context loginRemoveConnectionTimeContext = metricLoginRemoveConnectionTime.time();
try {
KapuaSecurityContext kapuaSecurityContext = getKapuaSecurityContext(context);
// TODO fix the kapua session when run as feature will be implemented
KapuaPrincipal kapuaPrincipal = ((KapuaPrincipal) kapuaSecurityContext.getMainPrincipal());
KapuaSession kapuaSession = new KapuaSession(null, kapuaPrincipal.getAccountId(), kapuaPrincipal.getAccountId(), kapuaPrincipal.getUserId(), kapuaPrincipal.getName());
KapuaSecurityUtils.setSession(kapuaSession);
String clientId = kapuaPrincipal.getClientId();
KapuaId accountId = kapuaPrincipal.getAccountId();
String username = kapuaSecurityContext.getUserName();
String remoteAddress = (context.getConnection() != null) ? context.getConnection().getRemoteAddress() : "";
KapuaId scopeId = ((KapuaPrincipal) kapuaSecurityContext.getMainPrincipal()).getAccountId();
// multiple account stealing link fix
String fullClientId = MessageFormat.format(AclConstants.MULTI_ACCOUNT_CLIENT_ID, accountId, clientId);
if (!isAdminUser(username)) {
// Stealing link check
ConnectionId connectionId = connectionMap.get(fullClientId);
boolean stealingLinkDetected = false;
if (connectionId != null) {
stealingLinkDetected = !connectionId.equals(info.getConnectionId());
} else {
logger.error("Cannot find connection id for client id {} on connection map. Currect connection id is {} - IP: {}", new Object[] { clientId, info.getConnectionId(), info.getClientIp() });
}
if (stealingLinkDetected) {
metricLoginStealingLinkDisconnect.inc();
// stealing link detected, skip info
logger.warn("Detected Stealing link for cliend id {} - account id {} - last connection id was {} - current connection id is {} - IP: {} - No disconnection info will be added!", new Object[] { clientId, accountId, connectionId, info.getConnectionId(), info.getClientIp() });
} else {
KapuaId deviceConnectionId = kapuaSecurityContext.getConnectionId();
DeviceConnection deviceConnection = null;
try {
deviceConnection = KapuaSecurityUtils.doPriviledge(new Callable<DeviceConnection>() {
@Override
public DeviceConnection call() throws Exception {
return deviceConnectionService.findByClientId(scopeId, clientId);
}
});
} catch (Exception e) {
throw new ShiroException("Error while updating the device connection!", e);
}
// the device connection must be not null
// cleanup stealing link detection map
connectionMap.remove(fullClientId);
final DeviceConnection deviceConnectionToUpdate = deviceConnection;
if (error == null) {
// update device connection
deviceConnectionToUpdate.setStatus(DeviceConnectionStatus.DISCONNECTED);
try {
KapuaSecurityUtils.doPriviledge(() -> {
deviceConnectionService.update(deviceConnectionToUpdate);
return null;
});
} catch (Exception e) {
throw new ShiroException("Error while updating the device connection status!", e);
}
} else {
// send missing message
// update device connection
deviceConnectionToUpdate.setStatus(DeviceConnectionStatus.MISSING);
try {
KapuaSecurityUtils.doPriviledge(() -> {
deviceConnectionService.update(deviceConnectionToUpdate);
return null;
});
} catch (Exception e) {
throw new ShiroException("Error while updating the device connection status!", e);
}
}
}
metricClientDisconnectionClient.inc();
} else {
metricClientDisconnectionKapuasys.inc();
}
// multiple account stealing link fix
info.setClientId(fullClientId);
context.setClientId(fullClientId);
} finally {
loginRemoveConnectionTimeContext.stop();
authenticationService.logout();
}
}
super.removeConnection(context, info, error);
context.setSecurityContext(null);
}
use of org.eclipse.kapua.model.id.KapuaId in project kapua by eclipse.
the class KapuaSecurityBrokerFilter method addExternalConnection.
private void addExternalConnection(ConnectionContext context, ConnectionInfo info) throws Exception {
// Clean-up credentials possibly associated with the current thread by previous connection.
ThreadContext.unbindSubject();
Context loginTotalContext = metricLoginAddConnectionTime.time();
String username = info.getUserName();
String password = info.getPassword();
String clientId = info.getClientId();
String clientIp = info.getClientIp();
ConnectionId connectionId = info.getConnectionId();
List<String> authDestinations = null;
if (logger.isDebugEnabled()) {
authDestinations = new ArrayList<>();
}
try {
// Build KapuaUsername
// User username = User.parse(username);//KapuaUserName
logger.info("User name {} - client id {}", new Object[] { username, clientId });
Context loginPreCheckTimeContext = metricLoginPreCheckTime.time();
// 1) validate client id
// Check the device Mqtt ClientId
// TODO move to deviceservice
// MqttUtils.checkDeviceClientId(clientId);
loginPreCheckTimeContext.stop();
Context loginShiroLoginTimeContext = metricLoginShiroLoginTime.time();
AuthenticationCredentials credentials = credentialsFactory.newInstance(username, password.toCharArray());
AccessToken accessToken = authenticationService.login(credentials);
KapuaId scopeId = accessToken.getScopeId();
KapuaId userId = accessToken.getUserId();
final Account account;
try {
account = KapuaSecurityUtils.doPriviledge(() -> accountService.find(scopeId));
} catch (Exception e) {
// to preserve the original exception message (if possible)
if (e instanceof AuthenticationException) {
throw (AuthenticationException) e;
} else {
throw new ShiroException("Error while find account!", e);
}
}
String accountName = account.getName();
loginShiroLoginTimeContext.stop();
// if a user acts as a child MOVED INSIDE KapuaAuthorizingRealm otherwise through REST API and console this @accountName won't work
// get account id and name from kapua session methods that check for the run as
//
// String accountName = kapuaSession.getSessionAccountName();
// long accountId = kapuaSession.getSessionAccountId();
// multiple account stealing link fix
String fullClientId = MessageFormat.format(AclConstants.MULTI_ACCOUNT_CLIENT_ID, scopeId.getId().longValue(), clientId);
KapuaPrincipal principal = new KapuaPrincipalImpl(accessToken, username, clientId, clientIp);
DeviceConnection deviceConnection = null;
// 3) check authorization
DefaultAuthorizationMap authMap = null;
if (isAdminUser(username)) {
metricLoginKapuasysTokenAttempt.inc();
// 3-1) admin authMap
authMap = buildAdminAuthMap(authDestinations, principal, fullClientId);
metricClientConnectedKapuasys.inc();
} else {
Context loginNormalUserTimeContext = metricLoginNormalUserTime.time();
metricLoginNormalUserAttempt.inc();
// 3-3) check permissions
Context loginCheckAccessTimeContext = metricLoginCheckAccessTime.time();
boolean[] hasPermissions = new boolean[] { // TODO check the permissions... move them to a constants class?
authorizationService.isPermitted(permissionFactory.newPermission(DeviceLifecycleDomain.DEVICE_LIFECYCLE, Actions.connect, scopeId)), authorizationService.isPermitted(permissionFactory.newPermission(DeviceManagementDomain.DEVICE_MANAGEMENT, Actions.write, scopeId)), authorizationService.isPermitted(permissionFactory.newPermission(DatastoreDomain.DATA_STORE, Actions.read, scopeId)), authorizationService.isPermitted(permissionFactory.newPermission(DatastoreDomain.DATA_STORE, Actions.write, scopeId)) };
if (!hasPermissions[AclConstants.BROKER_CONNECT_IDX]) {
throw new KapuaIllegalAccessException(permissionFactory.newPermission(DeviceLifecycleDomain.DEVICE_LIFECYCLE, Actions.connect, scopeId).toString());
}
loginCheckAccessTimeContext.stop();
// 3-4) build authMap
authMap = buildAuthMap(authDestinations, principal, hasPermissions, accountName, clientId, fullClientId);
// 4) find device
Context loginFindClientIdTimeContext = metricLoginFindClientIdTime.time();
deviceConnection = deviceConnectionService.findByClientId(scopeId, clientId);
loginFindClientIdTimeContext.stop();
Context loginFindDevTimeContext = metricLoginFindDevTime.time();
// send connect message
ConnectionId previousConnectionId = connectionMap.get(fullClientId);
boolean stealingLinkDetected = (previousConnectionId != null);
// Update map for stealing link detection on disconnect
connectionMap.put(fullClientId, info.getConnectionId());
if (deviceConnection == null) {
DeviceConnectionCreator deviceConnectionCreator = deviceConnectionFactory.newCreator(scopeId);
deviceConnectionCreator.setClientId(clientId);
deviceConnectionCreator.setClientIp(clientIp);
deviceConnectionCreator.setProtocol("MQTT");
// TODO to be filled with the proper value
deviceConnectionCreator.setServerIp(null);
deviceConnectionCreator.setUserId(userId);
deviceConnection = deviceConnectionService.create(deviceConnectionCreator);
} else {
deviceConnection.setClientIp(clientIp);
deviceConnection.setProtocol("MQTT");
// TODO to be filled with the proper value
deviceConnection.setServerIp(null);
deviceConnection.setUserId(userId);
deviceConnection.setStatus(DeviceConnectionStatus.CONNECTED);
deviceConnectionService.update(deviceConnection);
// TODO manage the stealing link event (may be a good idea to use different connect status (connect -stealing)?
if (stealingLinkDetected) {
metricLoginStealingLinkConnect.inc();
// stealing link detected, skip info
logger.warn("Detected Stealing link for cliend id {} - account - last connection id was {} - current connection id is {} - IP: {} - No connection status changes!", new Object[] { clientId, accountName, previousConnectionId, info.getConnectionId(), info.getClientIp() });
}
}
loginFindDevTimeContext.stop();
loginNormalUserTimeContext.stop();
Context loginSendLogingUpdateMsgTimeContex = metricLoginSendLoginUpdateMsgTime.time();
loginSendLogingUpdateMsgTimeContex.stop();
metricClientConnectedClient.inc();
}
logAuthDestinationToLog(authDestinations);
ConnectorDescriptor connectorDescriptor = connectorsDescriptorMap.get((((TransportConnector) context.getConnector()).getName()));
KapuaSecurityContext securityCtx = new KapuaSecurityContext(principal, authMap, (deviceConnection != null ? deviceConnection.getId() : null), connectionId, connectorDescriptor);
context.setSecurityContext(securityCtx);
// multiple account stealing link fix
info.setClientId(fullClientId);
context.setClientId(fullClientId);
} catch (Exception e) {
metricLoginFailure.inc();
// fix ENTMQ-731
if (e instanceof KapuaAuthenticationException) {
KapuaAuthenticationException kapuaException = (KapuaAuthenticationException) e;
KapuaErrorCode errorCode = kapuaException.getCode();
if (errorCode.equals(KapuaAuthenticationErrorCodes.INVALID_USERNAME) || errorCode.equals(KapuaAuthenticationErrorCodes.INVALID_CREDENTIALS) || errorCode.equals(KapuaAuthenticationErrorCodes.INVALID_CREDENTIALS_TOKEN_PROVIDED)) {
logger.warn("Invalid username or password for user {} ({})", username, e.getMessage());
// activeMQ will map CredentialException into a CONNECTION_REFUSED_BAD_USERNAME_OR_PASSWORD message (see javadoc on top of this method)
CredentialException ce = new CredentialException("Invalid username and/or password or disabled or expired account!");
ce.setStackTrace(e.getStackTrace());
metricLoginInvalidUserPassword.inc();
throw ce;
} else if (errorCode.equals(KapuaAuthenticationErrorCodes.LOCKED_USERNAME) || errorCode.equals(KapuaAuthenticationErrorCodes.DISABLED_USERNAME) || errorCode.equals(KapuaAuthenticationErrorCodes.EXPIRED_CREDENTIALS)) {
logger.warn("User {} not authorized ({})", username, e.getMessage());
// activeMQ-MQ will map SecurityException into a CONNECTION_REFUSED_NOT_AUTHORIZED message (see javadoc on top of this method)
SecurityException se = new SecurityException("User not authorized!");
se.setStackTrace(e.getStackTrace());
throw se;
}
}
// Excluded CredentialException, InvalidClientIDException, SecurityException all others exceptions will be mapped by activeMQ to a CONNECTION_REFUSED_SERVER_UNAVAILABLE message (see
// javadoc on top of this method)
// Not trapped exception now:
// KapuaException
logger.info("@@ error", e);
throw e;
} finally {
// 7) logout
Context loginShiroLogoutTimeContext = metricLoginShiroLogoutTime.time();
authenticationService.logout();
ThreadContext.unbindSubject();
loginShiroLogoutTimeContext.stop();
loginTotalContext.stop();
}
}
use of org.eclipse.kapua.model.id.KapuaId in project kapua by eclipse.
the class AbstractKapuaConfigurableService method setConfigValues.
@Override
public void setConfigValues(KapuaId scopeId, Map<String, Object> values) throws KapuaException {
KapuaLocator locator = KapuaLocator.getInstance();
AuthorizationService authorizationService = locator.getService(AuthorizationService.class);
PermissionFactory permissionFactory = locator.getFactory(PermissionFactory.class);
authorizationService.checkPermission(permissionFactory.newPermission(domain, Actions.write, scopeId));
KapuaTocd ocd = this.getConfigMetadata();
validateConfigurations(this.pid, ocd, values);
Properties props = toProperties(values);
AndPredicate predicate = new AndPredicate().and(new AttributePredicate<String>("pid", this.pid, Operator.EQUAL)).and(new AttributePredicate<KapuaId>("scopeId", scopeId, Operator.EQUAL));
ServiceConfigQueryImpl query = new ServiceConfigQueryImpl(scopeId);
query.setPredicate(predicate);
ServiceConfig serviceConfig = null;
EntityManager em = this.entityManagerFactory.createEntityManager();
ServiceConfigListResultImpl result = ServiceConfigDAO.query(em, ServiceConfig.class, ServiceConfigImpl.class, new ServiceConfigListResultImpl(), query);
// In not exists create then return
if (result == null || result.getSize() == 0) {
ServiceConfigImpl serviceConfigNew = new ServiceConfigImpl(scopeId);
serviceConfigNew.setPid(this.pid);
serviceConfigNew.setConfigurations(props);
serviceConfig = this.create(em, serviceConfigNew);
return;
}
// If exists update it
serviceConfig = result.getItem(0);
serviceConfig.setConfigurations(props);
this.update(em, serviceConfig);
return;
}
use of org.eclipse.kapua.model.id.KapuaId in project kapua by eclipse.
the class AbstractKapuaConfigurableService method getConfigValues.
@Override
public Map<String, Object> getConfigValues(KapuaId scopeId) throws KapuaException {
KapuaLocator locator = KapuaLocator.getInstance();
AuthorizationService authorizationService = locator.getService(AuthorizationService.class);
PermissionFactory permissionFactory = locator.getFactory(PermissionFactory.class);
authorizationService.checkPermission(permissionFactory.newPermission(domain, Actions.read, scopeId));
AndPredicate predicate = new AndPredicate().and(new AttributePredicate<String>("pid", this.pid, Operator.EQUAL)).and(new AttributePredicate<KapuaId>("scopeId", scopeId, Operator.EQUAL));
ServiceConfigQueryImpl query = new ServiceConfigQueryImpl(scopeId);
query.setPredicate(predicate);
Properties properties = null;
EntityManager em = this.entityManagerFactory.createEntityManager();
ServiceConfigListResult result = ServiceConfigDAO.query(em, ServiceConfig.class, ServiceConfigImpl.class, new ServiceConfigListResultImpl(), query);
if (result != null && result.getSize() > 0)
properties = result.getItem(0).getConfigurations();
KapuaTocd ocd = this.getConfigMetadata();
return toValues(ocd, properties);
}
use of org.eclipse.kapua.model.id.KapuaId in project kapua by eclipse.
the class AbstractKapuaConfigurableService method getConfigMetadata.
@Override
public KapuaTocd getConfigMetadata() throws KapuaException {
KapuaLocator locator = KapuaLocator.getInstance();
AuthorizationService authorizationService = locator.getService(AuthorizationService.class);
PermissionFactory permissionFactory = locator.getFactory(PermissionFactory.class);
KapuaId scopeId = KapuaSecurityUtils.getSession().getScopeId();
authorizationService.checkPermission(permissionFactory.newPermission(domain, Actions.read, scopeId));
try {
TmetadataImpl metadata = readMetadata(this.pid);
if (metadata.getOCD() != null && metadata.getOCD().size() > 0) {
for (KapuaTocd ocd : metadata.getOCD()) {
if (ocd.getId() != null && ocd.getId().equals(pid)) {
return ocd;
}
}
}
return null;
} catch (Exception e) {
throw KapuaConfigurationException.internalError(e);
}
}
Aggregations