| 707 |
707 |
logMetacat.debug("In isAdminAuthorized(), checking CN or MN authorization for " +
|
| 708 |
708 |
session.getSubject().getValue());
|
| 709 |
709 |
|
| 710 |
|
// are we allowed to do this? only CNs are allowed
|
| 711 |
|
CNode cn = D1Client.getCN();
|
| 712 |
|
List<Node> nodes = cn.listNodes().getNodeList();
|
|
710 |
// check if this is the node calling itself (MN)
|
|
711 |
allowed = isNodeAdmin(session);
|
| 713 |
712 |
|
| 714 |
|
if ( nodes == null ) {
|
| 715 |
|
throw new ServiceFailure("4852", "Couldn't get node list.");
|
| 716 |
|
|
|
713 |
// check the CN list
|
|
714 |
if (!allowed) {
|
|
715 |
// are we allowed to do this? only CNs are allowed
|
|
716 |
CNode cn = D1Client.getCN();
|
|
717 |
List<Node> nodes = cn.listNodes().getNodeList();
|
|
718 |
|
|
719 |
if ( nodes == null ) {
|
|
720 |
throw new ServiceFailure("4852", "Couldn't get node list.");
|
|
721 |
|
|
722 |
}
|
|
723 |
|
|
724 |
// find the node in the node list
|
|
725 |
for ( Node node : nodes ) {
|
|
726 |
|
|
727 |
NodeReference nodeReference = node.getIdentifier();
|
|
728 |
logMetacat.debug("In isAdminAuthorized(), Node reference is: " + nodeReference.getValue());
|
|
729 |
|
|
730 |
Subject subject = session.getSubject();
|
|
731 |
|
|
732 |
if (node.getType() == NodeType.CN) {
|
|
733 |
List<Subject> nodeSubjects = node.getSubjectList();
|
|
734 |
|
|
735 |
// check if the session subject is in the node subject list
|
|
736 |
for (Subject nodeSubject : nodeSubjects) {
|
|
737 |
logMetacat.debug("In isAdminAuthorized(), comparing subjects: " +
|
|
738 |
nodeSubject.getValue() + " and " + subject.getValue());
|
|
739 |
if ( nodeSubject.equals(subject) ) {
|
|
740 |
allowed = true; // subject of session == target node subject
|
|
741 |
break;
|
|
742 |
|
|
743 |
}
|
|
744 |
}
|
|
745 |
}
|
|
746 |
}
|
| 717 |
747 |
}
|
| 718 |
748 |
|
| 719 |
|
// find the node in the node list
|
| 720 |
|
for ( Node node : nodes ) {
|
| 721 |
|
|
| 722 |
|
NodeReference nodeReference = node.getIdentifier();
|
| 723 |
|
logMetacat.debug("In isAdminAuthorized(), Node reference is: " + nodeReference.getValue());
|
| 724 |
|
|
| 725 |
|
Subject subject = session.getSubject();
|
| 726 |
|
|
| 727 |
|
if (node.getType() == NodeType.CN) {
|
| 728 |
|
List<Subject> nodeSubjects = node.getSubjectList();
|
| 729 |
|
|
| 730 |
|
// check if the session subject is in the node subject list
|
| 731 |
|
for (Subject nodeSubject : nodeSubjects) {
|
| 732 |
|
logMetacat.debug("In isAdminAuthorized(), comparing subjects: " +
|
| 733 |
|
nodeSubject.getValue() + " and " + subject.getValue());
|
| 734 |
|
if ( nodeSubject.equals(subject) ) {
|
| 735 |
|
allowed = true; // subject of session == target node subject
|
| 736 |
|
break;
|
| 737 |
|
|
| 738 |
|
}
|
| 739 |
|
}
|
| 740 |
|
}
|
| 741 |
|
}
|
| 742 |
|
|
| 743 |
|
|
| 744 |
749 |
return allowed;
|
| 745 |
750 |
}
|
| 746 |
751 |
|
check if the caller is the Node admin (the member node calling itself) as well as the existing check for the CN calling the service. Both of those callers should be given full admin rights.