DSAMERole.java revision bee2440354b4bc8796e1de0b6cbd60e1f68deba0
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: DSAMERole.java,v 1.4 2009/01/28 05:35:01 ww203982 Exp $
*
* Portions Copyrighted 2011-2015 ForgeRock AS.
*/
/**
* DSAME Role plugin lets policy admins specify the DSAME roles as a subject.
* The plugin validates a user belonging to a DSAME role specified with this
* plugin.
*/
private boolean initialized;
private String organizationDN;
private int timeLimit;
private int maxResults;
private int roleSearchScope;
private String ldapServer;
// Debug
public DSAMERole() {
// do nothing
}
/**
* This method initializes the DSAME Role plugin with the organization
* DN, search configuration, ldap server name, in which this plugin
* is specified for a <code>Policy</code>.
*
* @param configParams configuration parameters as a map.
* The values in the map is <code>java.util.Set</code>,
* which contains one or more configuration paramaters.
*
* @exception PolicyException if an error occured during
* initialization of <code>Subject</code> instance
*/
if (configuredLdapServer == null) {
+ "server name. If you enter more than one server name "
+ "in the policy config service's Primary LDAP Server "
+ "field, please make sure the ldap server name is preceded "
+ "with the local server name.");
}
} else {
}
try {
} catch (NumberFormatException nfe) {
timeLimit = 5;
maxResults = 100;
}
initialized = true;
}
/**
* Returns the syntax of the values this <code>Subject</code>
* implementation can have.
* @see com.sun.identity.policy.Syntax
*
* @param token the <code>SSOToken</code> that will be used
* to determine the syntax
*
* @return set of of valid names for the user collection.
*
* @exception SSOException if SSO token is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*
* @return syntax of the values for the <code>Subject</code>
*/
return (Syntax.MULTIPLE_CHOICE);
}
/**
* Returns a list of possible values for the <code>Subject</code>.
*
* @param token the <code>SSOToken</code> that will be used
* to determine the possible values
*
* @return <code>ValidValues</code> object
*
* @exception SSOException if SSO token is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*/
}
/**
* Returns a list of possible values for the <code>Subject
* </code> that matches the pattern.
*
* @param token the <code>SSOToken</code> that will be used
* to determine the possible values
*
* @return <code>ValidValues</code> object
*
* @exception SSOException if SSO token is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*/
throws SSOException, PolicyException {
if (!initialized) {
}
try {
int status;
switch(results.getErrorCode()) {
case AMSearchResults.SUCCESS:
break;
break;
break;
default:
}
} catch (AMException e) {
}
if (additionalMsg != null) {
} else {
throw new PolicyException(errorMsg);
}
}
throw new PolicyException(e);
}
}
/**
* Returns the display name for the value for the given locale.
* For all the valid values obtained through the methods
* <code>getValidValues</code> this method must be called
* by GUI and CLI to get the corresponding display name.
* The <code>locale</code> variable could be used by the
* plugin to customize the display name for the given locale.
* The <code>locale</code> variable could be <code>null</code>,
* in which case the plugin must use the default locale (most probabily
* en_US).
* Alternatively, if the plugin does not have to localize
* the value, it can just return the <code>value</code> as is.
*
* @param value one of the valid value for the plugin
* @param locale locale for which the display name must be customized
*
* @exception NameNotFoundException if the given <code>value</code>
* is not one of the valid values for the plugin
*/
throws NameNotFoundException {
}
/**
* Returns the values that was set using the
* method <code>setValues</code>.
*
* @return values that have been set for the user collection
*/
if (subjectRoles == null) {
return (Collections.EMPTY_SET);
}
return (subjectRoles);
}
/**
* Sets the names for the instance of the <code>Subject</code>
* object. The names are obtained from the policy object,
* usually configured when a policy is created.
*
* @param names names selected for the instance of
* the user collection object.
*
* @exception InvalidNameException if the given names are not valid
*/
}
} else {
subjectRoles = new HashSet();
}
}
}
if (debug.messageEnabled()) {
}
}
/**
* Determines if the user belongs to this instance of the
* <code>Subject</code> object.
*
* @param token single-sign-on token of the user
*
* @return <code>true</code> if the user is memeber of the
* given subject; <code>false</code> otherwise.
*
* @exception SSOException if SSO token is not valid
* @exception PolicyException if an error occured while
* checking if the user is a member of this subject
*/
throws SSOException, PolicyException {
boolean listenerAdded = false;
boolean roleMatch = false;
if (debug.messageEnabled()) {
+" in DSAME role "+valueDN
}
if (result) {
return result;
} else {
continue;
}
}
// got here so entry not in subject evalauation cache
if (!listenerAdded) {
tokenID))
{
if (debug.messageEnabled()) {
+ " sso listener added .\n");
}
listenerAdded = true;
}
}
if (debug.messageEnabled()) {
+valueDN+" not in subject evaluation cache, fetching "
+"from NS User Cache.");
}
}
if (debug.messageEnabled()) {
"\n user roles: " + roleSet +
"\n subject roles: " + subjectRoles);
}
roleMatch = true;
}
}
if (debug.messageEnabled()) {
+" in subject evaluation cache.");
}
if (roleMatch) {
break;
}
}
}
if (debug.messageEnabled()) {
if (!roleMatch) {
+ " is not a member of this DSAMERole object");
} else {
+ " is a member of this DSAMERole object");
}
}
return roleMatch;
}
/**
* Return a hash code for this <code>DSAMERole</code>.
*
* @return a hash code for this <code>DSAMERole</code> object.
*/
public int hashCode() {
return subjectRoles.hashCode();
}
/**
* Indicates whether some other object is "equal to" this one.
*
* @param o another object that will be compared with this one
*
* @return <code>true</code> if eqaul; <code>false</code>
* otherwise
*/
if (o instanceof DSAMERole) {
}
return (false);
}
/**
* Creates and returns a copy of this object.
*
* @return a copy of this object
*/
try {
} catch (CloneNotSupportedException e) {
// this should never happen
throw new InternalError();
}
if (subjectRoles != null) {
}
return theClone;
}
}