Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that implements administrative methods

 *  Copyright: 2008 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Michael Daigle

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat.util;

import java.util.Calendar;

import java.util.Vector;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpSession;

import edu.ucsb.nceas.metacat.shared.ServiceException;

import edu.ucsb.nceas.utilities.StringUtil;

    public static Logger logMetacat = Logger.getLogger(AuthUtil.class);

	private static Vector<String> administrators = null;

	private static Vector<String> moderators = null;

	private static Vector<String> allowedSubmitters = null;

	private static Vector<String> deniedSubmitters = null;

	/**

	 * private constructor - all methods are static so there is no no need to

	 * instantiate.

	 */

	/**

	 * Get the administrators from metacat.properties

	 *

	 * @return a Vector of Strings holding the administrators

	 */

			populateAdministrators();

		}

		return administrators;

	}

	/**

	 * Get the allowed submitters from metacat.properties

	 *

	 * @return a Vector of Strings holding the submitters

	 */

			populateAllowedSubmitters();

		}

		return allowedSubmitters;

	}

	/**

	 * Get the denied submitters from metacat.properties

	 *

	 * @return a Vector of Strings holding the denied submitters

	 */

			populateDeniedSubmitters();

		}

		return deniedSubmitters;

	}

	/**

	 *

	 * @return a Vector of Strings holding the moderators

	 */

			populateModerators();

		}

		return moderators;

	}

	/**

	 * and put into global administrators list

	 */

		try {

			administratorString =

							+ pnfe.getMessage());

		}

		administrators = StringUtil.toVector(administratorString, ':');

		String d1NodeAdmin = null;

		try {

			d1NodeAdmin = PropertyService.getProperty("dataone.subject");

			administrators.add(d1NodeAdmin);

		} catch (PropertyNotFoundException e) {

			String msg = "Could not get metacat property: dataone.subject "

					+ "There will be no registered DataONE adminstrator";

			logMetacat.error(msg, e);

		}

	/**

	 * Get the vector of allowed submitter credentials from metacat.properties

	 * and put into global allowedSubmitters list

	 */

		try {

					+ pnfe.getMessage());

		}

		allowedSubmitters = StringUtil.toVector(allowedSubmitterString, ':');

	}

	/**

	 * Get the vector of denied submitter credentials from metacat.properties

	 * and put into global deniedSubmitters list

	 */

		try {

		}

		deniedSubmitters = StringUtil.toVector(deniedSubmitterString, ':');

	}

	/**

	 * Get the vector of moderator credentials from metacat.properties

	 * and put into global administrators list

	 */

		try {

			moderatorString =

				PropertyService.getProperty("auth.moderators");

		} catch (PropertyNotFoundException pnfe) {

							+ pnfe.getMessage());

		}

		moderators = StringUtil.toVector(moderatorString, ':');

	}

	/**

	 * log the user in against ldap.  If the login is successful, add

	 * the session information to the session list in SessionUtil.

	 *

	 * @param request the http request.

	 */

		// make sure we have username and password.

		// Create auth session

		try {

			authSession = new AuthSession();

		} catch (Exception e) {

		}

		// authenticate user against ldap

		String sessionId = session.getId();

		try {

				(String[]) session.getAttribute("groupnames"),

				(String) session.getAttribute("name"));

	/**

	 * Checks to see if the user is logged in by grabbing the session from the

	 * request and seeing if it exists in the global session list.

	 *

	 * @param request the http request that holds the login session

	 * @return boolean that is true if the user is logged in, false otherwise

	 */

		String sessionId = request.getSession().getId();

		try {

				// get the timeout limit

				String sessionTimeout = PropertyService.getProperty("auth.timeoutMinutes");

				int sessionTimeoutInt = Integer.parseInt(sessionTimeout);

				// get the last time the session was accessed

				Calendar lastAccessedTime = sessionData.getLastAccessedTime();

				// get the current time and set back "sessionTimoutInt" minutes

				Calendar now = Calendar.getInstance();

				now.add(Calendar.MINUTE, 0 - sessionTimeoutInt);

				// if the last accessed time is before now minus the timeout,

				// the session has expired. Unregister it and return false.

				if (lastAccessedTime.before(now)) {

				}

				return true;

			}

		} catch (PropertyNotFoundException pnfe) {

		} catch (NumberFormatException nfe) {

		}

		return false;

	}

	/**

	 * Checks to see if the user is logged in as admin by first checking if the

	 * user is logged in and then seeing if the user's account is on the

	 * administrators list in metacat.properties.

	 *

	 * @param request

	 *            the http request that holds the login session

	 * @return boolean that is true if the user is logged in as admin, false

	 *         otherwise

	 */

			return false;

		}

		String userName = getUserName(request);

		boolean isAdmin = isAdministrator(userName, null);

		return isAdmin;

	}

	/**

	 * Gets the user name from the login session on the http request

	 *

	 * @param request

	 *            the http request that holds the login session

	 * @return String that holds the user name

	 */

	public static String getUserName(HttpServletRequest request) {

		String userName = (String)request.getSession().getAttribute("username");

		return userName;

	}

	/**

	 * Gets the user group names from the login session on the http request

	 *

	 * @param request

	 *            the http request that holds the login session

	 * @return String array that holds the user groups

	 */

	public static String[] getGroupNames(HttpServletRequest request) {

		String sessionId = request.getSession().getId();;

		if (sessionData != null) {

			groupNames = sessionData.getGroupNames();

		}

		return groupNames;

	}

	/**

	 * Creates an ldap credentail string from the username, organization

	 * and dn list.

	 *

	 * @param username the user name

	 * @param organization the organization

	 * @param dnList a list of dns

	 * @return String holding the ldap login string

	 */

	public static String createLDAPString(String username, String organization,

		if (username == null || organization == null || dnList == null || dnList.size() == 0) {

		String ldapString = "uid=" + username + ",o=" + organization;

		for (String dn : dnList) {

			ldapString += "," + dn;

		}

		return ldapString;

	}

	/**

	 * Reports whether LDAP is fully configured.

	 *

	 * @return a boolean that is true if all sections are configured and false

	 *         otherwise

	 */

		}

	/**

	 * Check if the specified user is part of the administrators list

	 *

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isAdministrator(String username, String[] groups)

	}

	/**

	 * Check if the specified user is part of the moderators list

	 *

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	/**

	 * Check if the specified user is part of the moderators list

	 *

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isAllowedSubmitter(String username, String[] groups)

			// no allowedSubmitters list specified -

			// hence everyone should be allowed

			return true;

		}

		return (onAccessList(getAllowedSubmitters(), username, groups));

	}

	/**

	 * Check if the specified user is part of the moderators list

	 *

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isDeniedSubmitter(String username, String[] groups)

	}

	/**

	 * Check if the specified user can insert the document

	 *

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean canInsertOrUpdate(String username, String[] groups)

				groups));

	}

	/**

	 * Check if the user is on a given access list.  This is true if either the

	 * user or the user's group is on the list.

	 *

	 * @param accessList the list we want to check against

	 * @param username the name of the user we want to check

	 * @param groups a list of the user's groups

	 */

	private static boolean onAccessList(Vector<String> accessList, String username,

			String[] groups) {

		// this should never happen.  All calls to this method should use the

		// appropriate getter to retrieve the accessList.  That should guarentee

		// that the access is at least an empty Vector.

		if (accessList == null) {

			return false;

		}

		// Check that the user is authenticated as an administrator account

		for (String accessString : accessList) {

			// check the given admin dn is a group dn...

			if (groups != null && accessString.startsWith("cn=")) {

				// is a group dn

				for (int j = 0; j < groups.length; j++) {

					}

				}

			} else {

				// is a user dn

				if (username != null && username.equals(accessString)) {

					return true;

				}

			}

		}

		return false;

	}

}