Skip to content
Snippets Groups Projects
Commit b07078f8 authored by Dustin Jenkins's avatar Dustin Jenkins
Browse files

Fixes #27

parent b13beea6
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
cadc-access-control/build.gradle
+ 1
− 2
View file @ b07078f8
...@@ -15,7 +15,7 @@ sourceCompatibility = 1.7 ...@@ -15,7 +15,7 @@ sourceCompatibility = 1.7
group = 'org.opencadc' group = 'org.opencadc'
version = '1.1.4' version = '1.1.5'
mainClassName = 'ca.nrc.cadc.ac.client.Main' mainClassName = 'ca.nrc.cadc.ac.client.Main'
...@@ -29,7 +29,6 @@ dependencies { ...@@ -29,7 +29,6 @@ dependencies {
compile 'org.opencadc:cadc-registry:1.+' compile 'org.opencadc:cadc-registry:1.+'
testCompile 'junit:junit:4.+' testCompile 'junit:junit:4.+'
testCompile 'org.easymock:easymock:3.+'
testCompile 'xerces:xercesImpl:2.+' testCompile 'xerces:xercesImpl:2.+'
testCompile 'org.skyscreamer:jsonassert:1.+' testCompile 'org.skyscreamer:jsonassert:1.+'
} }
......
cadc-access-control/src/main/java/ca/nrc/cadc/ac/client/GMSClient.java
+ 63
− 69
View file @ b07078f8
...@@ -89,6 +89,8 @@ import javax.net.ssl.HttpsURLConnection; ...@@ -89,6 +89,8 @@ import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSocketFactory; import javax.net.ssl.SSLSocketFactory;
import javax.security.auth.Subject; import javax.security.auth.Subject;
import ca.nrc.cadc.auth.*;
import ca.nrc.cadc.net.*;
import org.apache.log4j.Logger; import org.apache.log4j.Logger;
import ca.nrc.cadc.ac.Group; import ca.nrc.cadc.ac.Group;
...@@ -100,16 +102,6 @@ import ca.nrc.cadc.ac.WriterException; ...@@ -100,16 +102,6 @@ import ca.nrc.cadc.ac.WriterException;
import ca.nrc.cadc.ac.xml.GroupListReader; import ca.nrc.cadc.ac.xml.GroupListReader;
import ca.nrc.cadc.ac.xml.GroupReader; import ca.nrc.cadc.ac.xml.GroupReader;
import ca.nrc.cadc.ac.xml.GroupWriter; import ca.nrc.cadc.ac.xml.GroupWriter;
import ca.nrc.cadc.auth.AuthMethod;
import ca.nrc.cadc.auth.AuthenticationUtil;
import ca.nrc.cadc.auth.HttpPrincipal;
import ca.nrc.cadc.auth.SSLUtil;
import ca.nrc.cadc.net.HttpDownload;
import ca.nrc.cadc.net.HttpPost;
import ca.nrc.cadc.net.HttpTransfer;
import ca.nrc.cadc.net.HttpUpload;
import ca.nrc.cadc.net.InputStreamWrapper;
import ca.nrc.cadc.net.NetUtil;
import ca.nrc.cadc.net.event.TransferEvent; import ca.nrc.cadc.net.event.TransferEvent;
import ca.nrc.cadc.net.event.TransferListener; import ca.nrc.cadc.net.event.TransferListener;
import ca.nrc.cadc.reg.Standards; import ca.nrc.cadc.reg.Standards;
...@@ -182,7 +174,7 @@ public class GMSClient implements TransferListener ...@@ -182,7 +174,7 @@ public class GMSClient implements TransferListener
UserNotFoundException, WriterException, IOException UserNotFoundException, WriterException, IOException
{ {
URL createGroupURL = getRegistryClient() URL createGroupURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
log.debug("createGroupURL request to " + createGroupURL.toString()); log.debug("createGroupURL request to " + createGroupURL.toString());
// reset the state of the cache // reset the state of the cache
...@@ -254,7 +246,7 @@ public class GMSClient implements TransferListener ...@@ -254,7 +246,7 @@ public class GMSClient implements TransferListener
throws GroupNotFoundException, AccessControlException, IOException throws GroupNotFoundException, AccessControlException, IOException
{ {
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL getGroupURL = new URL(groupsURL.toExternalForm() + "/" + groupName); URL getGroupURL = new URL(groupsURL.toExternalForm() + "/" + groupName);
log.debug("getGroup request to " + getGroupURL.toString()); log.debug("getGroup request to " + getGroupURL.toString());
...@@ -310,7 +302,7 @@ public class GMSClient implements TransferListener ...@@ -310,7 +302,7 @@ public class GMSClient implements TransferListener
throws AccessControlException, IOException throws AccessControlException, IOException
{ {
URL getGroupNamesURL = getRegistryClient() URL getGroupNamesURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
log.debug("getGroupNames request to " + getGroupNamesURL.toString()); log.debug("getGroupNames request to " + getGroupNamesURL.toString());
...@@ -388,7 +380,7 @@ public class GMSClient implements TransferListener ...@@ -388,7 +380,7 @@ public class GMSClient implements TransferListener
AccessControlException, WriterException, IOException AccessControlException, WriterException, IOException
{ {
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL updateGroupURL = new URL(groupsURL.toExternalForm() + "/" + group.getID().getName()); URL updateGroupURL = new URL(groupsURL.toExternalForm() + "/" + group.getID().getName());
log.debug("updateGroup request to " + updateGroupURL.toString()); log.debug("updateGroup request to " + updateGroupURL.toString());
...@@ -401,7 +393,7 @@ public class GMSClient implements TransferListener ...@@ -401,7 +393,7 @@ public class GMSClient implements TransferListener
log.debug("updateGroup: " + groupXML); log.debug("updateGroup: " + groupXML);
HttpPost transfer = new HttpPost(updateGroupURL, groupXML.toString(), HttpPost transfer = new HttpPost(updateGroupURL, groupXML.toString(),
"application/xml", true); "application/xml", false);
transfer.setSSLSocketFactory(getSSLSocketFactory()); transfer.setSSLSocketFactory(getSSLSocketFactory());
transfer.setTransferListener(this); transfer.setTransferListener(this);
transfer.run(); transfer.run();
...@@ -431,18 +423,21 @@ public class GMSClient implements TransferListener ...@@ -431,18 +423,21 @@ public class GMSClient implements TransferListener
throw new IOException(error); throw new IOException(error);
} }
try return getGroup(group.getID().getName());
{
String retXML = transfer.getResponseBody(); // Cookie gets lost when following redirect and pulling the XML down!
log.debug("getGroup returned: " + retXML); // try
GroupReader groupReader = new GroupReader(); // {
return groupReader.read(retXML); // String retXML = transfer.getResponseBody();
} // log.debug("getGroup returned: " + retXML);
catch (Exception bug) // GroupReader groupReader = new GroupReader();
{ // return groupReader.read(retXML);
log.error("Unexpected exception", bug); // }
throw new RuntimeException(bug); // catch (Exception bug)
} // {
// log.error("Unexpected exception", bug);
// throw new RuntimeException(bug);
// }
} }
/** /**
...@@ -457,55 +452,37 @@ public class GMSClient implements TransferListener ...@@ -457,55 +452,37 @@ public class GMSClient implements TransferListener
throws GroupNotFoundException, AccessControlException, IOException throws GroupNotFoundException, AccessControlException, IOException
{ {
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL deleteGroupURL = new URL(groupsURL.toExternalForm() + "/" + groupName); URL deleteGroupURL = new URL(groupsURL.toExternalForm() + "/" + groupName);
log.debug("deleteGroup request to " + deleteGroupURL.toString()); log.debug("deleteGroup request to " + deleteGroupURL.toString());
// reset the state of the cache // reset the state of the cache
clearCache(); clearCache();
HttpURLConnection conn = HttpDelete delete = new HttpDelete(deleteGroupURL, true);
(HttpURLConnection) deleteGroupURL.openConnection(); delete.setSSLSocketFactory(getSSLSocketFactory());
conn.setRequestMethod("DELETE"); delete.run();
SSLSocketFactory sf = getSSLSocketFactory(); Throwable error = delete.getThrowable();
if ((sf != null) && ((conn instanceof HttpsURLConnection))) if (error != null)
{
((HttpsURLConnection) conn)
.setSSLSocketFactory(sf);
}
final int responseCode;
try
{
responseCode = conn.getResponseCode();
}
catch(Exception e)
{
throw new AccessControlException(e.getMessage());
}
if (responseCode != 200)
{ {
String errMessage = NetUtil.getErrorBody(conn); // transfer returns a -1 code for anonymous access.
log.debug("deleteGroup response " + responseCode + ": " + if ((delete.getResponseCode() == -1) ||
errMessage); (delete.getResponseCode() == 401) ||
(delete.getResponseCode() == 403))
if ((responseCode == 401) || (responseCode == 403) ||
(responseCode == -1))
{ {
throw new AccessControlException(errMessage); throw new AccessControlException(error.getMessage());
} }
if (responseCode == 400) if (delete.getResponseCode() == 400)
{ {
throw new IllegalArgumentException(errMessage); throw new IllegalArgumentException(error.getMessage());
} }
if (responseCode == 404) if (delete.getResponseCode() == 404)
{ {
throw new GroupNotFoundException(errMessage); throw new GroupNotFoundException(error.getMessage());
} }
throw new IOException("HttpResponse (" + responseCode + ") - " + errMessage);
throw new IOException(error);
} }
} }
...@@ -526,7 +503,7 @@ public class GMSClient implements TransferListener ...@@ -526,7 +503,7 @@ public class GMSClient implements TransferListener
String path = "/" + targetGroupName + "/groupMembers/" + groupMemberName; String path = "/" + targetGroupName + "/groupMembers/" + groupMemberName;
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL addGroupMemberURL = new URL(groupsURL.toExternalForm() + path); URL addGroupMemberURL = new URL(groupsURL.toExternalForm() + path);
log.debug("addGroupMember request to " + addGroupMemberURL.toString()); log.debug("addGroupMember request to " + addGroupMemberURL.toString());
...@@ -587,7 +564,7 @@ public class GMSClient implements TransferListener ...@@ -587,7 +564,7 @@ public class GMSClient implements TransferListener
String userIDType = AuthenticationUtil.getPrincipalType(userID); String userIDType = AuthenticationUtil.getPrincipalType(userID);
String path = "/" + targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType; String path = "/" + targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType;
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL addUserMemberURL = new URL(groupsURL.toExternalForm() + path); URL addUserMemberURL = new URL(groupsURL.toExternalForm() + path);
log.debug("addUserMember request to " + addUserMemberURL.toString()); log.debug("addUserMember request to " + addUserMemberURL.toString());
...@@ -644,7 +621,7 @@ public class GMSClient implements TransferListener ...@@ -644,7 +621,7 @@ public class GMSClient implements TransferListener
String path = "/" + targetGroupName + "/groupMembers/" + groupMemberName; String path = "/" + targetGroupName + "/groupMembers/" + groupMemberName;
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL removeGroupMemberURL = new URL(groupsURL.toExternalForm() + path); URL removeGroupMemberURL = new URL(groupsURL.toExternalForm() + path);
log.debug("removeGroupMember request to " + log.debug("removeGroupMember request to " +
removeGroupMemberURL.toString()); removeGroupMemberURL.toString());
...@@ -713,7 +690,7 @@ public class GMSClient implements TransferListener ...@@ -713,7 +690,7 @@ public class GMSClient implements TransferListener
log.debug("removeUserMember: " + targetGroupName + " - " + userID.getName() + " type: " + userIDType); log.debug("removeUserMember: " + targetGroupName + " - " + userID.getName() + " type: " + userIDType);
String path = "/" + targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType; String path = "/" + targetGroupName + "/userMembers/" + NetUtil.encode(userID.getName()) + "?idType=" + userIDType;
URL groupsURL = getRegistryClient() URL groupsURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_GROUPS_01, getAuthMethod());
URL removeUserMemberURL = new URL(groupsURL.toExternalForm() + path); URL removeUserMemberURL = new URL(groupsURL.toExternalForm() + path);
log.debug("removeUserMember: " + removeUserMemberURL.toString()); log.debug("removeUserMember: " + removeUserMemberURL.toString());
...@@ -822,10 +799,10 @@ public class GMSClient implements TransferListener ...@@ -822,10 +799,10 @@ public class GMSClient implements TransferListener
StringBuilder searchGroupPath = new StringBuilder("?"); StringBuilder searchGroupPath = new StringBuilder("?");
//searchGroupURL.append("ID=").append(NetUtil.encode(id)); //searchGroupURL.append("ID=").append(NetUtil.encode(id));
//searchGroupURL.append("&IDTYPE=").append(NetUtil.encode(idType)); //searchGroupURL.append("&IDTYPE=").append(NetUtil.encode(idType));
searchGroupPath.append("&ROLE=").append(NetUtil.encode(roleString)); searchGroupPath.append("ROLE=").append(NetUtil.encode(roleString));
URL searchURL = getRegistryClient() URL searchURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_SEARCH_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_SEARCH_01, getAuthMethod());
URL getMembershipsURL = new URL(searchURL.toExternalForm() + searchGroupPath.toString()); URL getMembershipsURL = new URL(searchURL.toExternalForm() + searchGroupPath.toString());
log.debug("getMemberships request to " + getMembershipsURL.toString()); log.debug("getMemberships request to " + getMembershipsURL.toString());
...@@ -936,7 +913,7 @@ public class GMSClient implements TransferListener ...@@ -936,7 +913,7 @@ public class GMSClient implements TransferListener
searchGroupPath.append("&GROUPID=").append(NetUtil.encode(groupName)); searchGroupPath.append("&GROUPID=").append(NetUtil.encode(groupName));
URL searchURL = getRegistryClient() URL searchURL = getRegistryClient()
.getServiceURL(this.serviceID, Standards.GMS_SEARCH_01, AuthMethod.CERT); .getServiceURL(this.serviceID, Standards.GMS_SEARCH_01, getAuthMethod());
URL getMembershipURL = new URL(searchURL.toExternalForm() + searchGroupPath.toString()); URL getMembershipURL = new URL(searchURL.toExternalForm() + searchGroupPath.toString());
log.debug("getMembership request to " + getMembershipURL.toString()); log.debug("getMembership request to " + getMembershipURL.toString());
...@@ -1179,4 +1156,21 @@ public class GMSClient implements TransferListener ...@@ -1179,4 +1156,21 @@ public class GMSClient implements TransferListener
return new RegistryClient(); return new RegistryClient();
} }
private AuthMethod getAuthMethod()
{
Subject subject = AuthenticationUtil.getCurrentSubject();
if (subject != null)
{
for (Object o : subject.getPublicCredentials())
{
if (o instanceof X509CertificateChain)
return AuthMethod.CERT;
if (o instanceof SSOCookieCredential)
return AuthMethod.COOKIE;
// AuthMethod.PASSWORD not supported
// AuthMethod.TOKEN not supported
}
}
return AuthMethod.ANON;
}
} }
cadc-access-control/src/test/java/ca/nrc/cadc/ac/client/GMSClientTest.java
+ 2
− 40
View file @ b07078f8
...@@ -69,12 +69,7 @@ ...@@ -69,12 +69,7 @@
package ca.nrc.cadc.ac.client; package ca.nrc.cadc.ac.client;
import static org.easymock.EasyMock.createMock;
import static org.easymock.EasyMock.expect;
import static org.easymock.EasyMock.replay;
import java.net.URI; import java.net.URI;
import java.net.URL;
import java.security.PrivilegedExceptionAction; import java.security.PrivilegedExceptionAction;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
...@@ -88,10 +83,7 @@ import org.junit.Test; ...@@ -88,10 +83,7 @@ import org.junit.Test;
import ca.nrc.cadc.ac.Group; import ca.nrc.cadc.ac.Group;
import ca.nrc.cadc.ac.GroupURI; import ca.nrc.cadc.ac.GroupURI;
import ca.nrc.cadc.ac.Role; import ca.nrc.cadc.ac.Role;
import ca.nrc.cadc.auth.AuthMethod;
import ca.nrc.cadc.auth.HttpPrincipal; import ca.nrc.cadc.auth.HttpPrincipal;
import ca.nrc.cadc.reg.Standards;
import ca.nrc.cadc.reg.client.RegistryClient;
import ca.nrc.cadc.util.Log4jInit; import ca.nrc.cadc.util.Log4jInit;
...@@ -103,7 +95,6 @@ public class GMSClientTest ...@@ -103,7 +95,6 @@ public class GMSClientTest
} }
@Test @Test
public void testUserIsSubject() throws Exception public void testUserIsSubject() throws Exception
{ {
...@@ -112,24 +103,9 @@ public class GMSClientTest ...@@ -112,24 +103,9 @@ public class GMSClientTest
HttpPrincipal userID2 = new HttpPrincipal("test2"); HttpPrincipal userID2 = new HttpPrincipal("test2");
subject.getPrincipals().add(userID); subject.getPrincipals().add(userID);
final RegistryClient mockRegistryClient =
createMock(RegistryClient.class);
final URI serviceID = URI.create("ivo://mysite.com/users"); final URI serviceID = URI.create("ivo://mysite.com/users");
expect(mockRegistryClient.getServiceURL(serviceID, Standards.UMS_USERS_01, AuthMethod.CERT)) GMSClient client = new GMSClient(serviceID);
.andReturn(new URL("http://mysite.com/users"));
replay(mockRegistryClient);
GMSClient client = new GMSClient(serviceID)
{
@Override
protected RegistryClient getRegistryClient()
{
return mockRegistryClient;
}
};
Assert.assertFalse(client.userIsSubject(null, null)); Assert.assertFalse(client.userIsSubject(null, null));
Assert.assertFalse(client.userIsSubject(userID, null)); Assert.assertFalse(client.userIsSubject(userID, null));
Assert.assertFalse(client.userIsSubject(null, subject)); Assert.assertFalse(client.userIsSubject(null, subject));
...@@ -152,21 +128,7 @@ public class GMSClientTest ...@@ -152,21 +128,7 @@ public class GMSClientTest
subject.getPrincipals().add(test1UserID); subject.getPrincipals().add(test1UserID);
final URI serviceID = URI.create("ivo://mysite.com/users"); final URI serviceID = URI.create("ivo://mysite.com/users");
final RegistryClient mockRegistryClient = final GMSClient client = new GMSClient(serviceID);
createMock(RegistryClient.class);
expect(mockRegistryClient.getServiceURL(serviceID, Standards.GMS_GROUPS_01, AuthMethod.CERT ))
.andReturn(new URL("http://mysite.com/users"));
replay(mockRegistryClient);
final GMSClient client = new GMSClient(serviceID)
{
@Override
protected RegistryClient getRegistryClient()
{
return mockRegistryClient;
}
};
Subject.doAs(subject, new PrivilegedExceptionAction<Object>() Subject.doAs(subject, new PrivilegedExceptionAction<Object>()
{ {
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment