Metacat

import javax.naming.NamingEnumeration;

import javax.naming.NamingException;

import javax.naming.InitialContext;

import javax.naming.directory.Attribute;

import javax.naming.directory.Attributes;

import javax.naming.directory.BasicAttribute;

    String ldapsUrl = this.ldapsUrl;

    String ldapBase = this.ldapBase;

    boolean authenticated = false;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

            "com.sun.jndi.ldap.LdapCtxFactory");

    try {

      /*

       * get all subtrees first in the current dir context 

//      while ( enum.hasMoreElements() ) {

//        ldapBase = (String)enum.nextElement();

//        ldapUrl = (String)subtrees.get(ldapBase);

        if (identifier != null && !password.equals("")) {

          // Now that we have the dn, we can authenticate, so

          // authenticate this time when opening the DirContext

          env.put(Context.PROVIDER_URL, ldapsUrl + ldapBase);

          if ( !ldapsUrl.equals(ldapUrl) ) {

            // ldap is set on default port 389

      // If we find a record, determine the dn for the record

      util.debugMessage("\nStarting search phase...\n");

      if (answer.hasMore()) {

        SearchResult sr = (SearchResult)answer.next();

        identifier = sr.getName();

         throws ConnectException

  {

    HashMap attributes = new HashMap();

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

        "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Find out the identifying attribute for the user

      // Ask for all attributes of the user 

      Attributes attrs = ctx.getAttributes(userident);

    StringBuffer out = new StringBuffer();

    Vector usersIn = new Vector();

    out.append("<?xml version=\"1.0\"?>\n");

    out.append("<principals>\n");

      if ( groups.length > 0 ) {

        for (int i=0; i < groups.length; i++ ) {

          out.append("    <group>\n");

          String[] usersForGroup = getUsers(user,password,groups[i]);

          for (int j=0; j < usersForGroup.length; j++ ) {

            usersIn.addElement(usersForGroup[j]);

            out.append("      <user>\n");

            out.append("      </user>\n");

          }

          out.append("    </group>\n");

      for (int j=0; j < users.length; j++ ) {

        if ( !usersIn.contains(users[j]) ) {

          out.append("    <user>\n");

          out.append("    </user>\n");

        }

      }

      }

      // get the whole list groups and users in XML format

      if (isValid) {

        authservice = new AuthLdap();

        String out = authservice.getPrincipals(user, password);

        java.io.FileWriter fw = new java.io.FileWriter(f);

        java.io.BufferedWriter buff = new java.io.BufferedWriter(fw);

        buff.write(out);

        buff.close();

        fw.close();

      }

    } catch (ConnectException ce) {

      System.err.println(ce.getMessage());

    } catch (java.io.IOException ioe) {

    session.setAttribute("username", username);

    session.setAttribute("password", password);

    if ( groups.length > 0 ) {

    }

    return session;

   * @param user the username of the user

   * @param group the group of the user

   */

  {

  }

  /** 

   * @param group the group of the user

   * @param useXMLIndex flag whether to search using the path index

   */

                                 boolean useXMLIndex)

  {

      Hashtable   docListResult = new Hashtable();

        while (tableHasRows) 

        {

          docid = rs.getString(1).trim();

            // Advance to the next record in the cursor

            tableHasRows = rs.next();

            continue;

          while(tableHasRows) 

          {

            docid = rs.getString(1).trim();

              // Advance to the next record in the cursor

              tableHasRows = rs.next();

              continue;

    * from DB connection 

    */

  private boolean hasPermission ( Connection conn, String user,

                  throws SQLException

  {

    AccessControlList aclobj = new AccessControlList(conn);

  }

}

      // other than "login" and "logout"

      String username = null;

      String password = null;

      String sess_id = null;

      // handle login action

        } else {

          username = (String)sess.getAttribute("username");

          password = (String)sess.getAttribute("password");

          try {

            sess_id = (String)sess.getId();

          } catch(IllegalStateException ise) {

      // Now that we know the session is valid, we can delegate the request

      // to a particular action handler

      if(action.equals("query")) {

      } else if(action.equals("squery")) {

        if(params.containsKey("query")) {

        } else {

          PrintWriter out = response.getWriter();

          out.println("Illegal action squery without \"query\" parameter");

        }

      } else if (action.equals("read")) {

      } else if (action.equals("insert") || action.equals("update")) {

        PrintWriter out = response.getWriter();

        if ( (username != null) &&  !username.equals("public") ) {

        } else {  

          out.println("Permission denied for " + action);

        }  

      } else if (action.equals("delete")) {

        PrintWriter out = response.getWriter();

        if ( (username != null) &&  !username.equals("public") ) {

        } else {  

          out.println("Permission denied for " + action);

        }  

        handleValidateAction(out, params, response); 

      } else if (action.equals("getaccesscontrol")) {

        PrintWriter out = response.getWriter();

      } else if (action.equals("getprincipals")) {

        PrintWriter out = response.getWriter();

        handleGetPrincipalsAction(out, username, password);  

   * @param conn the database connection 

   */

  protected void handleSQuery(PrintWriter out, Hashtable params, 

  { 

    String xmlquery = ((String[])params.get("query"))[0];

    String qformat = ((String[])params.get("qformat"))[0];

    String resultdoc = null;

    resultdoc = createResultDocument(doclist, transformQuery(xmlquery));

    * @param response the response object linked to the client

    */ 

  protected void handleQuery(PrintWriter out, Hashtable params, 

  {

    //create the query and run it

    String xmlquery = DBQuery.createSQuery(params);

    String qformat = ((String[])params.get("qformat"))[0];

    String resultdoc = null;

   *

   * @param xmlquery the query to run

   */

  {

    Hashtable doclist=null;

    Connection conn = null;

    {

      conn = util.getConnection();

      DBQuery queryobj = new DBQuery(conn, saxparser);

      util.returnConnection(conn);

      return doclist;

    } 

   * @param params the Hashtable of HTTP request parameters

   * @param response the HTTP response object linked to the client

   * @param user the username sent the request

   */

  private void handleReadAction(Hashtable params, HttpServletResponse response,

  {

    ServletOutputStream out = null;

    ZipOutputStream zout = null;

              addDocToZip(docid, zout);

            } else {

              readFromMetacat(response, docid, qformat, abstrpath,

            }

          // case docid="http://.../filename"

            addDocToZip(docid, zout);

          } else {

            readFromMetacat(response, docid, qformat, abstrpath,

          }

        }

  // read metadata or data from Metacat

  private void readFromMetacat(HttpServletResponse response, String docid,

                               String qformat, String abstrpath, String user,

               throws ClassNotFoundException, IOException, SQLException, 

                      McdbException, Exception

  {

   * to the database connection

   */

  private void handleInsertOrUpdateAction(PrintWriter out, Hashtable params, 

    Connection conn = null;

              accNumber = null;

            }

            newdocid = DocumentImpl.write(conn, xml, pub, dtd, doAction,

          } catch (NullPointerException npe) {

            newdocid = DocumentImpl.write(conn, xml, pub, dtd, doAction,

          }

        } finally {

          util.returnConnection(conn);

   * from the database connection

   */

  private void handleDeleteAction(PrintWriter out, Hashtable params, 

    String[] docid = (String[])params.get("docid");

    Connection conn = null;

                                      // FOR EXISTENCE OF DOCID PARAM

                                      // BEFORE ACCESSING ARRAY

      try { 

        response.setContentType("text/xml");

        out.println("<?xml version=\"1.0\"?>");

        out.println("<success>");

   */

  private void handleGetAccessControlAction(PrintWriter out, Hashtable params, 

                                       HttpServletResponse response, 

    Connection conn = null;

    String docid = ((String[])params.get("docid"))[0];

        // get connection from the pool

        conn = util.getConnection();

        AccessControlList aclobj = new AccessControlList(conn);

        out.println(acltext);

    } catch (Exception e) {

    // Get the session information

    String username = null;

    String password = null;

    String sess_id = null;

    // be aware of session expiration on every request  

    } else {

      username = (String)sess.getAttribute("username");

      password = (String)sess.getAttribute("password");

      try {

        sess_id = (String)sess.getId();

      } catch(IllegalStateException ise) {

    if ( action.equals("upload")) {

      if (username != null &&  !username.equals("public")) {

        handleUploadAction(request, response, params, fileList, 

      } else {

        try {

          out = response.getWriter();

  private void handleUploadAction(HttpServletRequest request,

                                  HttpServletResponse response, 

                                  Hashtable params, Hashtable fileList, 

  {

    PrintWriter out = null;

    Connection conn = null;

   private String   action = null;

   private String   docid = null;

   private String   user = null;

   private String   pub = null;

   private Thread   xmlIndex;

   private boolean endDocument = false;

    * @param action - "INSERT" or "UPDATE"

    * @param docid to be inserted or updated into JDBC connection

    * @param user the user connected to MetaCat servlet and owns the document

    * @param pub flag for public "read" access on document

    * @param serverCode the serverid from xml_replication on which this document

    *        resides.

    *

    */

   public DBSAXHandler(Connection conn, String action, String docid,

   {

     this(conn);

     this.action = action;

     this.docid = docid;

     this.user = user;

     this.pub = pub;

     this.serverCode = serverCode;

     this.xmlIndex = new Thread(this);

   }

   /** SAX Handler that receives notification of beginning of the document */

   public void startDocument() throws SAXException {

     MetaCatUtil.debugMessage("start Document");

        try {

          AccessControlList aclobj = 

          new AccessControlList(dbconn, docid, new StringReader(xml),

          dbconn.commit();

        } catch (SAXException e) {

          try {

   * @param docid the identifier of the document to be created

   * @param readNodes flag indicating whether the xmlnodes should be read

   */

  {

    try {

      this.conn = conn;

   * @param action the action to be performed (INSERT OR UPDATE)

   * @param docid the docid to use for the INSERT OR UPDATE

   * @param user the user that owns the document

   */

  public static String write(Connection conn,String filename,

                             String pub, String dtdfilename,

                             String action, String docid, String user,

                throws Exception {

    Reader dtd = null;

      dtd = new FileReader(new File(dtdfilename).toString());

    }

    return write ( conn, new FileReader(new File(filename).toString()),

  }

  public static String write(Connection conn,Reader xml,String pub,Reader dtd,

                             String action, String docid, String user,

                throws Exception {

  }

  public static String write(Connection conn, Reader xml, String pub,

                             String action, String docid, String user,

                throws Exception {

    if(action.equals("UPDATE"))

    {//if the document is being updated then use the servercode from the 

     //originally inserted document.

      DocumentImpl doc = new DocumentImpl(conn, docid);

      int servercode = doc.getServerlocation();

    }

    else

    {//if the file is being inserted then the servercode is always 1

    }

  }

  public static String write( Connection conn, Reader xml,

                              String action, String docid, String user,

                throws Exception

  {

  }

  public static String write( Connection conn, Reader xml, String pub,

                              String action, String docid, String user,

                throws Exception

  {

                 serverCode,false,false);

  }

  public static String write( Connection conn, Reader xml, String pub,

                              String action, String docid, String user,

                throws Exception

  {

                 serverCode,override,false);

  }

   * @param action the action to be performed (INSERT or UPDATE)

   * @param accnum the docid + rev# to use on INSERT or UPDATE

   * @param user the user that owns the document

   * @param serverCode the serverid from xml_replication on which this document

   *        resides.

   * @param override flag to stop insert replication checking.

  public static String write( Connection conn,Reader xml,String pub,Reader dtd,

                              String action, String accnum, String user,

                              boolean validate)

                throws Exception

  {

          MetacatReplication.replLog("lock granted for " + accnum + " from " +

                                      server);

          XMLReader parser = initializeParser(conn, action, docid, validate,

          conn.setAutoCommit(false);

          parser.parse(new InputSource(xml)); 

          conn.commit();

    if ( action.equals("UPDATE") ) {

      // check for 'write' permission for 'user' to update this document

        throw new Exception("User " + user + 

              " does not have permission to update XML Document #" + accnum);

      }          

    try 

    { 

      XMLReader parser = initializeParser(conn, action, docid, validate,

      conn.setAutoCommit(false);

      parser.parse(new InputSource(xml));

      conn.commit();

   * @param docid the ID of the document to be deleted from the database

   */

  public static void delete( Connection conn, String accnum,

                throws Exception 

  {

    // OLD

    // check for 'write' permission for 'user' to delete this document

      throw new Exception("User " + user + 

              " does not have permission to delete XML Document #" + accnum);

    }

  }

  /** 

    * from DB connection 

    */

  {

    AccessControlList aclobj = new AccessControlList(conn);

  }

  /**

   */

  private static XMLReader initializeParser(Connection conn, String action,

                                   String docid, boolean validate, 

                                   int serverCode, Reader dtd) 

                           throws Exception 

  {

    //

    try {

      ContentHandler chandler = new DBSAXHandler(conn, action, docid,

      EntityResolver eresolver= new DBEntityResolver(conn,

                                                 (DBSAXHandler)chandler, dtd);

      DTDHandler dtdhandler   = new DBDTDHandler(conn);

      // Get an instance of the parser

      parser = XMLReaderFactory.createXMLReader(parserName);

      // Turn on validation

  private String parserName;

  private Stack elementStack;

  private String server;

  private boolean	processingDTD;

  private String  user;

  private String  aclid;

  private String 	docname;

  private String 	doctype;

  private String 	systemid;

  private int    permission;

  private String permType;

  private String permOrder;

  private String beginTime;

  private String endTime;

  private int    ticketCount;

  private int    serverCode = 1;

  /**

   * Construct an instance of the AccessControlList class.

   * @param aclid the Accession# of the document with the acl data

   * @param acl the acl file containing acl data

   * @param user the user connected to MetaCat servlet and owns the document

   * @param serverCode the serverid from xml_replication on which this document

   *        resides.

   */

  public AccessControlList(Connection conn, String aclid, Reader acl,

  {

    this.conn = conn;

    this.parserName = parserName;

    this.elementStack = new Stack();

    this.user = user;

    this.aclid = aclid;

    this.resourceURL = new Vector();

    this.resourceID = new Vector();

    this.principal = new Vector();

    this.permission = 0;

    this.ticketCount = 0;

    this.serverCode = serverCode;

    // Initialize the parser and read the queryspec

   * @param docid the Accession# of the document with the acl data

   * @param aclfilename the name of acl file containing acl data

   * @param user the user connected to MetaCat servlet and owns the document

   */

  public AccessControlList( Connection conn, String aclid, String aclfilename,

  {

    this(conn, aclid, new FileReader(new File(aclfilename).toString()), 

  }

  /* Set up the SAX parser for reading the XML serialized ACL */

    //delete all previously submitted permissions @ relations

    //this happens only on UPDATE of the access file

    try {

      if ( aclid != null ) {

        deletePermissionsForRelatedResources(aclid);

      }

    } catch (SQLException sqle) {

      throw new SAXException(sqle);

        currentNode.setAttribute(atts.getLocalName(i), atts.getValue(i));

      }

    }

      permOrder = currentNode.getAttribute("order");

    }

    elementStack.push(currentNode); 

  }

    BasicNode currentNode = (BasicNode)elementStack.peek(); 

    String currentTag = currentNode.getTagName();

      }

  }

  /**

    BasicNode leaving = (BasicNode)elementStack.pop();

    String leavingTagName = leaving.getTagName();

      if ( permission > 0 ) {

        // insert into db calculated permission for the list of principals

        try {

        } catch (SQLException sqle) {

          throw new SAXException(sqle);

        }

      }

      endTime = null;

      ticketCount = 0;

    }

  }

    docname = name;

    doctype = publicId;

    systemid = systemId;

  }

  /** 

    return processingDTD;

  }

          throws SQLException 

  {

    // delete all acl records for resources related to @aclid if any

  }

          throws SQLException 

  {

    Statement stmt = conn.createStatement();

    stmt.close();

  }

  /* Insert into db calculated permission for the list of principals */

          throws SQLException 

  {

    PreparedStatement pstmt;

              "begin_time,end_time,ticket_count, accessfileid) VALUES " +

              "(?,?,?,?,?,to_date(?,'mm/dd/yy'),to_date(?,'mm/dd/yy'),?,?)");

      // Bind the values to the query

      pstmt.setInt(3, permission);

      pstmt.setString(4, permType);

      pstmt.setString(5, permOrder);

      } else {

        pstmt.setString(8, "");

      }

      String prName;

          }

        }

      }

      pstmt.close();

    }

  }

  /* Get permissions with permission order different than @permOrder. */

  private int getPermissions(int permission, String principal,

                             String docid, String permOrder)

    return txtPerm.append("\"").toString();

  }

  {

      }

    }

  /**

    * @param permission permission type to check for

    * @param principal name of principal to check for @permission

    */

                 throws SQLException

  {

    PreparedStatement pstmt;

    if ( permission.equals("READ") ) {

      try {

        pstmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

                "WHERE docid = ? AND public_access = 1");

        // Bind the values to the query

        pstmt.execute();

        ResultSet rs = pstmt.getResultSet();

      } catch (SQLException e) {

        throw new 

        SQLException("AccessControlList.hasPermission(). " +

                     ". " + e.getMessage());

      }

    }

    // since owner of resource has all permission on it,

    if ( principal != null ) {

      try {

        pstmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

                "WHERE docid = ? AND user_owner = ?");

        // Bind the values to the query

        pstmt.setString(2, principal);

        pstmt.execute();

        throw new 

        SQLException("AccessControlList.hasPermission(). " +

                     "Error checking ownership for " + principal +

      }

      int accessValue = 0;

      int ticketCount = 0;

      String permOrder = "";

                     "AND " + isnull + "(end_time," + sysdate + ")");

        // check if it is "deny" with "allowFirst" first

        // Bind the values to the query

        pstmt.setString(2, principal);

        pstmt.setString(3, "deny");

               ( permOrder.equals("allowFirst") ) &&

               ( rs.wasNull() || ticketCount > 0 ) ) {

            if ( !rs.wasNull() && ticketCount > 0 ) {

            }

            pstmt.close();

            return false;

        // it is not denied then check if it is "allow"

        // Bind the values to the query

        pstmt.setString(2, principal);

        pstmt.setString(3, "allow");

          if ( ( accessValue & intValue(permission) )==intValue(permission) &&

               ( rs.wasNull() || ticketCount > 0 ) ) {

            if ( !rs.wasNull() && ticketCount > 0 ) {

            }

            pstmt.close();

            return true;

        // it is not allowed then check if it is "deny" with "denyFirst"

        // Bind the values to the query

        pstmt.setString(2, principal);

        pstmt.setString(3, "deny");

               ( permOrder.equals("denyFirst") ) &&

               ( rs.wasNull() || ticketCount > 0 ) ) {

            if ( !rs.wasNull() && ticketCount > 0 ) {

            }

            pstmt.close();

            return false;

        throw new 

        SQLException("AccessControlList.hasPermission(). " +

                     "Error checking " + permission + " permission for " +

                     e.getMessage());

      }

    }

    return false;

  }

  private void decreaseNumberOfAccess(int permission, String principal,

                                      String permOrder) 

               throws SQLException

  {

            " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +

                 "AND " + isnull + "(end_time," + sysdate + ")");

    // Bind the values to the query

    pstmt.setString(2, principal);

    pstmt.setInt(3, permission);

    pstmt.setString(4, permType);

    * access control information for a document specified by @docid.

    * @param docid document identifier which acl info to get

    * @param user name of user connected to Metacat system

    */

          throws SQLException 

  {

    StringBuffer output = new StringBuffer();

        ticketCount = rs.getInt(8);

        // if @docid is not owned by @user, only ACL info from that

        // is extracted

        if ( !isOwned ) {

          if ( !acfid.equals(acfid_prev) ) {

            acfid_prev = acfid;