dpro/session/DNOrIPAddressListTokenRestriction.java

	DNOrIPAddressListTokenRestriction.java revision 8af80418ba1ec431c8027fa9668e5678658d3611
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Copyright (c) 2005 Sun Microsystems Inc. All Rights Reserved
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The contents of this file are subject to the terms
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * of the Common Development and Distribution License
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * (the License). You may not use this file except in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * compliance with the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * You can obtain a copy of the License at
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * opensso/legal/CDDLv1.0.txt
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * See the License for the specific language governing
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * permission and limitations under the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * When distributing Covered Code, include this CDDL
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Header Notice in each file and include the License file
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * at opensso/legal/CDDLv1.0.txt.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * If applicable, add the following below the CDDL Header,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * with the fields enclosed by brackets [] replaced by
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * your own identifying information:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * $Id: DNOrIPAddressListTokenRestriction.java,v 1.7 2009/10/29 17:33:29 ericow Exp $
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Portions Copyrighted 2011-2012 ForgeRock Inc
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpackage com.iplanet.dpro.session;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.am.util.Misc;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.dpro.session.service.SessionService;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.sso.SSOToken;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.security.AdminTokenAction;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.shared.datastruct.CollectionHelper;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.shared.debug.Debug;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.sm.ServiceSchema;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.sm.ServiceSchemaManager;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.net.InetAddress;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.net.UnknownHostException;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.security.AccessController;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Collections;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.HashSet;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Iterator;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.List;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Map;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Set;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.StringTokenizer;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * <code>DNOrIPAddressListTokenRestriction</code> implements
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * {@link TokenRestriction} interface and handles the restriction of
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * the <code>DN</code> or <code>IPAddress</code>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpublic class DNOrIPAddressListTokenRestriction implements TokenRestriction {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    static final long serialVersionUID = 8352965917649287133L;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private String dn;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static Debug debug;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private Set<InetAddress> addressList = new HashSet<InetAddress>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private String asString;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * boolean to indicate if the restriction checking is strictly based on DN
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * or not during cookie hijacking mitigation mode.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * By default if DN is absent or cannot be determined,restriction is
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * set to IP address of the client. This property if not defined in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * is assumed false.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * If strict DN checking is desired this property needs to be defined
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      * with value "true"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster      */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static boolean dnRestrictionOnly;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String SESSION_DNRESTRICTIONONLY_ATTR_NAME =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "iplanet-am-session-dnrestrictiononly";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String AM_SESSION_SERVICE = "iPlanetAMSessionService";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster   static {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster       debug = Debug.getInstance("amSession");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster       dnRestrictionOnly = getDNRestrictionOnly();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster       if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster           debug.message(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster               "DNOrIPAddressListTokenRestriction"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster             +": fetching value for dnRestrictionOnly:"+
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster              dnRestrictionOnly);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster       }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster   }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster   /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * Constructs <code>DNOrIPAddressListTokenRestriction</code> object based on
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * the <code>DN</code> and list of host names to be restricted.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * @param dn the <code>DN</code> of the user
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * @param hostNames list of host names.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * @exception Exception if finding IP Address of host to be restricted or
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    *            if something goes wrong.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public DNOrIPAddressListTokenRestriction(String dn, List<String> hostNames) throws Exception {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        StringBuilder buf = null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (dn.indexOf('|') > 0) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            StringTokenizer st = new StringTokenizer(dn, "|");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            while (st.hasMoreTokens()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (buf == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    buf = new StringBuilder(Misc.canonicalize(st.nextToken()));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    buf.append('|').append(Misc.canonicalize(st.nextToken()));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            buf = new StringBuilder(Misc.canonicalize(dn));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        this.dn = buf.toString();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (!dnRestrictionOnly) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            boolean hostmatch = false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            Iterator<String> it = hostNames.iterator();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            while (it.hasNext()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                String val = it.next();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    addressList.add(InetAddress.getByName(val));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    hostmatch = true;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                } catch (UnknownHostException e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    if (SessionService.sessionDebug.warningEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        SessionService.sessionDebug.warning(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                                "DNOrIPAddressListTokenRestriction.constructor: "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                                + "failure resolving host " + val);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    if (!it.hasNext() && !hostmatch) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        throw new UnknownHostException(val);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        buf.append('\n');
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Collections.sort(hostNames);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        for (String hostName : hostNames) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            buf.append(hostName).append('\n');
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        asString = buf.toString();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            debug.message("DNOrIPAddressListTokenRestriction.new " + asString);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * This method returns the restriction as a string.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return A concatenated string of DN and/or Host Name/IP Address.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    @Override
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public String toString() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return asString;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns a hash code for this object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return a hash code value for this object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    @Override
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public int hashCode() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return toString().hashCode();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns a true if the restriction matches the context for which it was
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * set.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param context The context from which the restriction needs to be
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *        checked. The context can be any from the following - the Single
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *        Sign on token of the Application against which the restriction
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *        is being compared - the IP Address/Host Name of the Application
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *        against which the restriction is being compared
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return true if the restriction is satisfied.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @throws Exception is thrown if the there was an error.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public boolean isSatisfied(Object context) throws Exception {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (context == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else if (context instanceof SSOToken) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (SessionService.sessionDebug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                SessionService.sessionDebug.message(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                   "DNOrIPAddressListTokenRestriction"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                   +".isSatisfied(): context is instance of SSOToken");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            SSOToken usedBy = (SSOToken) context;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            String udn = Misc.canonicalize(usedBy.getPrincipal().getName());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            StringTokenizer st = new StringTokenizer(dn, "|");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            while(st.hasMoreTokens()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (st.nextToken().equals(udn)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    return true;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.message("DNOrIPAddressListTokenRestriction:isSatisfied SSOToken of " + udn + " does not match with restriction " + dn);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else if (context instanceof InetAddress) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (dnRestrictionOnly) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                //returning true here lessens the security, but truth to be told
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                //sessionservice endpoint should not be accessible externally
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (SessionService.sessionDebug.warningEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    SessionService.sessionDebug.warning(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            "DNOrIPAddressListTokenRestriction.isSatisfied():"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            + "dnRestrictionOnly is true, but IP has been received "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            + "as the restriction context, this could be a "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            + "suspicious activity. Received InetAddress is: "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            + ((InetAddress) context).toString());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                return true;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (SessionService.sessionDebug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    SessionService.sessionDebug.message(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                         "DNOrIPAddressListTokenRestriction"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        +".isSatisfied(): dnRestrictionOnly is false");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    SessionService.sessionDebug.message(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                         "DNOrIPAddressListTokenRestriction"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        +".isSatisfied(): IP based"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        +" restriction received and accepted");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                return addressList.contains((InetAddress) context);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (SessionService.sessionDebug.warningEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                SessionService.sessionDebug.warning("Unknown context type:"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        + context);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns true of <code>other</code> meets these criteria.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <ol type="1">
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <li>it is not null
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <li>it is an instance of {@link DNOrIPAddressListTokenRestriction}
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <li>it has the same distinguished name as this object and
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <li>it has the same set of IP addresses as this object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * </ol>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param other the object to be used for comparison.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return true if <code>other</code> meets the above criteria.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    @Override
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public boolean equals(Object other) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return other != null
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                && (other instanceof DNOrIPAddressListTokenRestriction)
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                && other.toString().equals(this.toString());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster   /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * Gets the admin token for checking the dn restriciton property
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * @return admin the admin {@link SSOToken}
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    static SSOToken getAdminToken() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return (SSOToken) AccessController.doPrivileged(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    AdminTokenAction.getInstance());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } catch (Exception e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            SessionService.sessionDebug.error(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    "Failed to get the admin token for "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    + "dnRestrictionOnly property checking.", e);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    static SessionService getSS() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        SessionService ss = SessionService.getSessionService();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (ss == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            SessionService.sessionDebug.error(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                "DNOrIPAddressListTokenRestriction: "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    + " Failed to get the session service instance");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return ss;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Gets the  value of the "iplanet-am-session-dnrestrictiononly"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * session global attribute.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return whether the DN restriction only is enabled
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static boolean getDNRestrictionOnly() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        boolean dnRestrictionOnly = false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ServiceSchemaManager ssm = new ServiceSchemaManager(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    AM_SESSION_SERVICE, getAdminToken());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ServiceSchema schema = ssm.getGlobalSchema();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            Map attrs = schema.getAttributeDefaults();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            dnRestrictionOnly = Boolean.valueOf(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    CollectionHelper.getMapAttr(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    attrs, SESSION_DNRESTRICTIONONLY_ATTR_NAME, "false")).booleanValue();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } catch (Exception e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (SessionService.sessionDebug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                SessionService.sessionDebug.message(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        "Failed to get the default dnRestrictionOnly"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        + "setting. => Set  dnRestrictionOnly to "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        + "false", e);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return dnRestrictionOnly;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster}