Metacat

					+ request.getSession().getId() + " is not valid.");

import edu.ucsb.nceas.metacat.service.SessionService;

import edu.ucsb.nceas.metacat.util.SessionData;

   public boolean hasPermission(String sessionId, String myPermission) throws SQLException {

	   SessionData sessionData = SessionService.getRegisteredSession(sessionId);

	   if (sessionData == null) {

		   return false;

	   }

	   return hasPermission(sessionData.getUserName(), sessionData.getGroupNames(), myPermission); 

   }

import java.io.PrintWriter;

import java.sql.SQLException;

import java.util.Hashtable;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import edu.ucsb.nceas.metacat.McdbException;

import edu.ucsb.nceas.metacat.PermissionController;

import edu.ucsb.nceas.metacat.service.SessionService;

import edu.ucsb.nceas.metacat.shared.MetacatUtilException;

import edu.ucsb.nceas.metacat.util.SessionData;

import edu.ucsb.nceas.utilities.ParseLSIDException;

import edu.ucsb.nceas.utilities.LSIDUtil;

    public static void isAuthorized(PrintWriter out, Hashtable<String,String[]> params, 

    		HttpServletRequest request, HttpServletResponse response) throws MetacatUtilException {

    	String resourceLsid;

    	String[] resourceLsids = params.get("resourceLsid");

    	if (resourceLsids == null) {

    		throw new MetacatUtilException("DocumentUtil.isAuthorized - " + 

    				"resourceLsid parameter cannot be null.");

    	}

    	resourceLsid = resourceLsids[0];

    	String permission;

    	String[] permissions = params.get("permission");

    	if (permissions == null) {

    		throw new MetacatUtilException("DocumentUtil.isAuthorized - " + 

    				"permission parameter cannot be null.");

    	}

    	permission = permissions[0];

    	String sessionId;

    	String[] sessionIds = params.get("sessionId");

    	if (sessionIds == null) {

    		throw new MetacatUtilException("DocumentUtil.isAuthorized - " + 

    				"sessionId parameter cannot be null.");

    	}

    	sessionId = sessionIds[0];

    	String isAuthorized = "false";

    	String message = "";

    	String result = "<resourceAuthorization>";

    	result += "<resourceId>" + resourceLsid + "</resourceId>"; 

    	result += "<permission>" + permission + "</permission>";

    	result += "<sessionId>" + sessionId + "</sessionId>";

    	if (!SessionService.isSessionRegistered(sessionId)) {

    		message = "Session is not logged in";

    	} else {

    		SessionData sessionData = SessionService.getRegisteredSession(sessionId);

    		String docId = null;

    		try {

    			docId = LSIDUtil.getDocId(resourceLsid, true);

    			PermissionController pc = new PermissionController(docId);   

    			if (pc.hasPermission(sessionData.getUserName(), sessionData.getGroupNames(), permission)) {

    				isAuthorized = "true";

    				message = " docid: " + docId + " is authorized for session";

    			}

    		} catch (ParseLSIDException ple) {

    			message = "unparseable resource lsid: " + ple.getMessage();

    		} catch (McdbException me) {

    			message = "could not create permission controller for docid: " + docId + " : " + me.getMessage();

    		} catch (SQLException sqle) {

    			message = "SQL error getting permissions for docid: " + docId + " : " + sqle.getMessage();

    		}

    	}

    	result += "<isAuthorized>" + isAuthorized + "</isAuthorized>";

    	result += "<message>" + message + "</message>";

    	result += "</resourceAuthorization>";

    	out.write(result);

    }

//        if (this.sessionId != null) {

//        	prop.put("sessionid", sessionId);

//        }

        if (this.sessionId != null) {

        	prop.put("sessionid", sessionId);

        }

     *  Method used to log in to a metacat server. Implementations will need

     *  to cache a cookie value to make the session persistent.  Each time a

     *  call is made to one of the other methods (e.g., read), the cookie will

     *  need to be passed back to the metacat server along with the request.

     *

     *  @param username   the username of the user, like an LDAP DN

     *  @param password   the password for that user for authentication

     *  @return the response string from metacat in XML format

     *  @throws MetacatAuthException when the username/password could

     *                    not be authenticated

     */

    public String isAuthorized(String resourceLsid, String permission, String sessionId)

    		throws MetacatAuthException, MetacatInaccessibleException {

        Properties prop = new Properties();

        prop.put("action", "isauthorized");

        prop.put("resourceLsid", resourceLsid);

        prop.put("permission", permission);

        prop.put("sessionId", sessionId);

        String response = null;

        try {

            response = sendDataForString(prop, null, null, 0);

        } catch (Exception e) {

            throw new MetacatInaccessibleException(e.getMessage());

        }

        if (response.indexOf("<resourceAuthorization>") == -1) {

        	System.out.println("invalid response: " + response);

            throw new MetacatAuthException(response);

        } 

        return response;

    }

    /**