Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that implements administrative methods 

 *  Copyright: 2008 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Michael Daigle

 * 

 *   '$Author: daigle $'

 *     '$Date: 2008-08-22 16:24:53 -0700 (Fri, 22 Aug 2008) $'

 * '$Revision: 4298 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat.util;

import java.util.Calendar;

import java.util.Vector;

import javax.naming.AuthenticationException;

import javax.naming.NamingException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpSession;

import edu.ucsb.nceas.metacat.AuthLdap;

import edu.ucsb.nceas.metacat.AuthSession;

import edu.ucsb.nceas.metacat.service.PropertyService;

import edu.ucsb.nceas.metacat.service.SessionService;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

import edu.ucsb.nceas.utilities.StringUtil;

public class LDAPUtil {

	private static Vector<String> administrators = null;

	private static Vector<String> moderators = null;

	private static Vector<String> allowedSubmitters = null;

	private static Vector<String> deniedSubmitters = null;

	/**

	 * private constructor - all methods are static so there is no no need to

	 * instantiate.

	 */

	private LDAPUtil() {}

	/**

	 * Get the administrators from metacat.properties

	 * 

	 * @return a Vector of Strings holding the administrators

	 */

	public static Vector<String> getAdministrators() throws UtilException {

		if (administrators == null) {

			populateAdministrators();

		}

		return administrators;

	}

	/**

	 * Get the allowed submitters from metacat.properties

	 * 

	 * @return a Vector of Strings holding the submitters

	 */

	public static Vector<String> getAllowedSubmitters() throws UtilException {

		if (allowedSubmitters == null) {			

			populateAllowedSubmitters();	

		}

		return allowedSubmitters;

	}

	/**

	 * Get the denied submitters from metacat.properties

	 * 

	 * @return a Vector of Strings holding the denied submitters

	 */

	public static Vector<String> getDeniedSubmitters() throws UtilException {

		if (deniedSubmitters == null) {

			populateDeniedSubmitters();

		}

		return deniedSubmitters;

	}

	/**

	 * Get the vector of administrator credentials from metacat.properties

	 * and put into global administrators list

	 */

	private static void populateAdministrators() throws UtilException {

		String administratorString = null;

		try {

			administratorString = 

				PropertyService.getProperty("ldap.administrators");

		} catch (PropertyNotFoundException pnfe) {

			throw new UtilException("Could not get metacat property: ldap.administrators. "

							+ "There will be no registered metacat adminstrators: "

							+ pnfe.getMessage());

		}

		administrators = StringUtil.toVector(administratorString, ':');

	}

	/**

	 * Get the vector of allowed submitter credentials from metacat.properties

	 * and put into global allowedSubmitters list

	 */

	private static void populateAllowedSubmitters() throws UtilException {

		String allowedSubmitterString = null;

		try {

			allowedSubmitterString = PropertyService.getProperty("ldap.allowedSubmitters");

		} catch (PropertyNotFoundException pnfe) {

			throw new UtilException("Could not get metacat property: ldap.allowedSubmitters. "

					+ "Anyone will be allowed to submit: "

					+ pnfe.getMessage());

		}		

		allowedSubmitters = StringUtil.toVector(allowedSubmitterString, ':');		

	}

	/**

	 * Get the vector of denied submitter credentials from metacat.properties

	 * and put into global deniedSubmitters list

	 */

	private static void populateDeniedSubmitters() throws UtilException {

		String deniedSubmitterString = null;

		try {

			deniedSubmitterString = PropertyService.getProperty("ldap.deniedSubmitters");

		} catch (PropertyNotFoundException pnfe) {

			throw new UtilException("Could not get metacat property: ldap.deniedSubmitters: "

					+ pnfe.getMessage());

		}		

		deniedSubmitters = StringUtil.toVector(deniedSubmitterString, ':');		

	}

	/**

	 * Validate connectivity to the ldap server. This does not test user

	 * authentication. Validation methods return a string error message if there

	 * is an issue. This allows the calling code to run several validations and

	 * compile the errors into a list that can be displayed on a web page if

	 * desired.

	 * 

	 * @param ldapurl

	 *            the url of the ldap server

	 * @param ldapbase

	 *            the ldap base value to test

	 * @return a string holding error message if validation fails.

	 */

	public static String validateLDAPConnectivity(String ldapurl,

			String ldapbase) {

		try {

			AuthLdap authLdap = new AuthLdap();

			authLdap.testCredentials(

					"uid=bogusname,o=NCEAS,dc=ecoinformatics,dc=org",

					"boguspassword", ldapurl, ldapbase);

		} catch (AuthenticationException ae) {

			// Do nothing here. We are using dummy uid and password, so we

			// expect authentication exceptions

		} catch (javax.naming.InvalidNameException ine) {

			return "An invalid domain name was provided: " + ine.getMessage();

		} catch (NamingException ne) {

			return "An invalid ldap name was provided: " + ne.getMessage();

		} catch (InstantiationException ie) {

			return "Could not instantiate AuthLdap: " + ie.getMessage();

		}

		return null;

	}

	/**

	 * log the user in against ldap.  If the login is successful, add

	 * the session information to the session list in SessionUtil.

	 * 

	 * @param request the http request.

	 */

	public static boolean logUserIn(HttpServletRequest request, String userName, String organization,

			Vector<String> dnList, String password) throws UtilException {

		AuthSession authSession = null;

		// make sure we have username and password.

		if (userName == null || password == null || dnList == null || dnList.size() == 0) {

			throw new UtilException("null username, password, or dn list when logging user in");

		}

		// put the login credentials into an LDAP string

		String ldapString = createLDAPString(userName, organization, dnList);

		// Create auth session

		try {

			authSession = new AuthSession();

		} catch (Exception e) {

			throw new UtilException("Could not instantiate AuthSession: "

					+ e.getMessage());

		}

		// authenticate user against ldap

		boolean isValid = authSession.authenticate(request, ldapString,

				password);

		// if login was successful, add the session information to the 

		// global session list.

		if (isValid) {

			HttpSession session = authSession.getSessions();

			String sessionId = session.getId();

			SessionService.registerSession(sessionId, 

					(String) session.getAttribute("username"), 

					(String[]) session.getAttribute("groupnames"),

					(String) session.getAttribute("password"));

		}

		return isValid;

	}

	/**

	 * Checks to see if the user is logged in by grabbing the session from the

	 * request and seeing if it exists in the global session list.

	 * 

	 * @param request the http request that holds the login session

	 * @return boolean that is true if the user is logged in, false otherwise

	 */

	public static boolean isUserLoggedIn(HttpServletRequest request) throws UtilException{

		SessionData sessionData = null;

		String sessionId = request.getSession().getId();

		try {

			if (sessionId != null && SessionService.isSessionRegistered(sessionId)) {

				// get the registered session data

				sessionData = SessionService.getRegisteredSession(sessionId);

				// get the timeout limit

				String sessionTimeout = PropertyService.getProperty("auth.timeoutMinutes");

				int sessionTimeoutInt = Integer.parseInt(sessionTimeout);

				// get the last time the session was accessed

				Calendar lastAccessedTime = sessionData.getLastAccessedTime();

				// get the current time and set back "sessionTimoutInt" minutes

				Calendar now = Calendar.getInstance();

				now.add(Calendar.MINUTE, 0 - sessionTimeoutInt);

				// if the last accessed time is before now minus the timeout,

				// the session has expired. Unregister it and return false.

				if (lastAccessedTime.before(now)) {

					SessionService.unRegisterSession(sessionId);

					return false;

				}

				return true;

			}

		} catch (PropertyNotFoundException pnfe) {

			throw new UtilException("Could not determine if user is logged in because " 

					+ "of property error: " + pnfe.getMessage());

		} catch (NumberFormatException nfe) {

			throw new UtilException("Could not determine if user is logged in because " 

					+ "of number conversion error: " + nfe.getMessage());

		}

		return false;

	}

	/**

	 * Checks to see if the user is logged in as admin by first checking if the

	 * user is logged in and then seeing if the user's account is on the

	 * administrators list in metacat.properties.

	 * 

	 * @param request

	 *            the http request that holds the login session

	 * @return boolean that is true if the user is logged in as admin, false

	 *         otherwise

	 */

	public static boolean isUserLoggedInAsAdmin(HttpServletRequest request) throws UtilException {

		if (!isUserLoggedIn(request)) {

			return false;

		}

		String userName = getUserName(request);

		boolean isAdmin = isAdministrator(userName, null);

		return isAdmin;

	}

	/**

	 * Gets the user name from the login session on the http request

	 * 

	 * @param request

	 *            the http request that holds the login session

	 * @return String that holds the user name

	 */

	public static String getUserName(HttpServletRequest request) {

		String userName = (String)request.getSession().getAttribute("username");

		return userName;

	}

	/**

	 * Gets the user group names from the login session on the http request

	 * 

	 * @param request

	 *            the http request that holds the login session

	 * @return String array that holds the user groups

	 */

	public static String[] getGroupNames(HttpServletRequest request) {

		String sessionId = request.getSession().getId();;

		SessionData sessionData = SessionService.getRegisteredSession(sessionId);

		String[] groupNames = { "" };

		if (sessionData != null) {

			groupNames = sessionData.getGroupNames();

		}

		return groupNames;

	}

	/**

	 * Creates an ldap credentail string from the username, organization

	 * and dn list.

	 * 

	 * @param username the user name

	 * @param organization the organization

	 * @param dnList a list of dns

	 * @return String holding the ldap login string

	 */	

	public static String createLDAPString(String username, String organization,

			Vector<String> dnList) throws UtilException {

		if (username == null || organization == null || dnList == null || dnList.size() == 0) {

			throw new UtilException("Could not generate LDAP user string.  One of the following is null: username, organization or dnlist");

		}

		String ldapString = "uid=" + username + ",o=" + organization;

		for (String dn : dnList) {

			ldapString += "," + dn;

		}

		return ldapString;

	}

	/**

	 * Reports whether LDAP is fully configured.

	 * 

	 * @return a boolean that is true if all sections are configured and false

	 *         otherwise

	 */

	public static boolean isLDAPConfigured() throws UtilException {

		String ldapConfiguredString = PropertyService.UNCONFIGURED;

		try {

			ldapConfiguredString = PropertyService.getProperty("configutil.ldapConfigured");

		} catch (PropertyNotFoundException pnfe) {

			throw new UtilException("Could not determine if LDAP is configured: "

					+ pnfe.getMessage());

		}

		return !ldapConfiguredString.equals(PropertyService.UNCONFIGURED);

	}

	/**

	 * Check if the specified user is part of the administrators list

	 * 

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isAdministrator(String username, String[] groups)

			throws UtilException {

		return onAccessList(getAdministrators(), username, groups);

	}

	/**

	 * Check if the specified user is part of the moderators list

	 * 

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isModerator(String username, String[] groups) {

		return onAccessList(moderators, username, groups);

	}

	/**

	 * Check if the specified user is part of the moderators list

	 * 

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isAllowedSubmitter(String username, String[] groups)

			throws UtilException {

		if (getAllowedSubmitters().size() == 0) {

			// no allowedSubmitters list specified -

			// hence everyone should be allowed

			return true;

		}

		return (onAccessList(getAllowedSubmitters(), username, groups));

	}

	/**

	 * Check if the specified user is part of the moderators list

	 * 

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean isDeniedSubmitter(String username, String[] groups)

			throws UtilException {

		return (onAccessList(getDeniedSubmitters(), username, groups));

	}

	/**

	 * Check if the specified user can insert the document

	 * 

	 * @param username

	 *            the user login credentails

	 * @param groups

	 *            a list of the user's groups

	 */

	public static boolean canInsertOrUpdate(String username, String[] groups)

			throws UtilException {

		return (isAllowedSubmitter(username, groups) && !isDeniedSubmitter(username,

				groups));

	}

	/**

	 * Check if the user is on a given access list.  This is true if either the 

	 * user or the user's group is on the list.

	 * 

	 * @param accessList the list we want to check against

	 * @param username the name of the user we want to check

	 * @param groups a list of the user's groups

	 */

	private static boolean onAccessList(Vector<String> accessList, String username,

			String[] groups) {

		// this should never happen.  All calls to this method should use the 

		// appropriate getter to retrieve the accessList.  That should guarentee

		// that the access is at least an empty Vector.

		if (accessList == null) {

			return false;

		}

		// Check that the user is authenticated as an administrator account

		for (String accessString : accessList) {

			// check the given admin dn is a group dn...

			if (groups != null && accessString.startsWith("cn=")) {

				// is a group dn

				for (int j = 0; j < groups.length; j++) {

					if (groups[j].equals(accessString)) {

						return true;

					}

				}

			} else {

				// is a user dn

				if (username != null && username.equals(accessString)) {

					return true;

				}

			}

		}

		return false;

	}

}