am/util/AdminUtils.java

8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Copyright (c) 2005 Sun Microsystems Inc. All Rights Reserved
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The contents of this file are subject to the terms
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * of the Common Development and Distribution License
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * (the License). You may not use this file except in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * compliance with the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * You can obtain a copy of the License at
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * opensso/legal/CDDLv1.0.txt
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * See the License for the specific language governing
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * permission and limitations under the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * When distributing Covered Code, include this CDDL
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Header Notice in each file and include the License file
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * at opensso/legal/CDDLv1.0.txt.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * If applicable, add the following below the CDDL Header,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * with the fields enclosed by brackets [] replaced by
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * your own identifying information:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * $Id: AdminUtils.java,v 1.6 2008/06/25 05:41:27 qcheng Exp $
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Portions Copyrighted [2011] [ForgeRock AS]
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpackage com.iplanet.am.util;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.services.ldap.DSConfigMgr;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.services.ldap.LDAPServiceException;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.services.ldap.LDAPUser;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.services.ldap.ServerInstance;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.services.util.Crypt;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.ums.IUMSConstants;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.security.ISSecurityPermission;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.security.ServerInstanceAction;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.shared.debug.Debug;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.security.AccessController;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * This class contains methods to retrieve Top Level Administrator information.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The information comes from the server configuration file
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * (<code>serverconfig.xml</code>).
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @supported.all.api
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpublic class AdminUtils {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static String adminDN = null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static byte[] adminPassword = null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static Debug debug;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    static {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        initialize();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public static void initialize() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        debug = Debug.getInstance(IUMSConstants.UMS_DEBUG);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            DSConfigMgr dscMgr = DSConfigMgr.getDSConfigMgr();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ServerInstance svrInstance = dscMgr
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    .getServerInstance(LDAPUser.Type.AUTH_ADMIN);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (svrInstance != null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                adminDN = svrInstance.getAuthID();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                String adminPW = (String) AccessController
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        .doPrivileged(new ServerInstanceAction(svrInstance));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                adminPassword = xor(adminPW.getBytes());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.error("AdminUtils.initialize: server instance not found");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } catch (LDAPServiceException e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (SystemProperties.isServerMode()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.error("AdminUtils.initialize: Initialize admin info ", e);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            } else if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.message(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                "AdminUtilsinitialize: Could not initialize admin info message:"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    + e.getMessage());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns the DN of the Top Level Administrator.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return The DN of the Top Level Administrator; null if the Top Level
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *         Administrator is not defined in the server configuration file.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public static String getAdminDN() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (Crypt.checkCaller()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ISSecurityPermission isp = new ISSecurityPermission("access",
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    "adminpassword");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (Crypt.securityManager != null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    Crypt.securityManager.checkPermission(isp);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            } catch (SecurityException e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.error(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        "Security Alert: Unauthorized access to Administative "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                                + "password utility: Returning NULL", e);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                return null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return adminDN;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns the password of the Top Level Administrator.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return The password of the Top Level Administrator; null if the Top
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *         Level Administrator is not defined in the server configuration
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *         file.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public static byte[] getAdminPassword() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (Crypt.checkCaller()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ISSecurityPermission isp = new ISSecurityPermission("access",
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    "adminpassword");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (Crypt.securityManager != null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    Crypt.securityManager.checkPermission(isp);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            } catch (SecurityException e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.error(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        "Security Alert: Unauthorized access to Administative "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                                + "password utility: Returning NULL", e);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                return null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return xor(adminPassword);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * To encode and decode the password.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static byte[] xor(byte[] password) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (password != null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            int len = password.length;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            byte[] retPassword = new byte[len];
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            for (int i = 0; i < len; i++) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                retPassword[i] = (byte) (password[i] ^ 1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return retPassword;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster}