/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2009 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* https://opensso.dev.java.net/public/CDDLv1.0.html or
* opensso/legal/CDDLv1.0.txt
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: OpenSSOGroupSubject.java,v 1.2 2009/08/21 21:52:01 hengming Exp $
*
* Portions Copyrighted 2014-2016 ForgeRock AS.
*/
package com.sun.identity.entitlement.opensso;
import com.iplanet.sso.SSOException;
import com.iplanet.sso.SSOToken;
import com.sun.identity.entitlement.EntitlementException;
import com.sun.identity.entitlement.GroupSubject;
import com.sun.identity.entitlement.PrivilegeManager;
import com.sun.identity.entitlement.SubjectAttributesCollector;
import com.sun.identity.entitlement.SubjectAttributesManager;
import com.sun.identity.entitlement.SubjectDecision;
import com.sun.identity.idm.AMIdentity;
import com.sun.identity.idm.IdRepoException;
import com.sun.identity.idm.IdType;
import com.sun.identity.idm.IdUtils;
import com.sun.identity.security.AdminTokenAction;
import javax.security.auth.Subject;
import java.security.AccessController;
import java.security.Principal;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
/**
* This class represents group identity for membership check
*
* @deprecated As of ForgeRock OpenAM 12.
*/
@Deprecated
public class OpenSSOGroupSubject extends GroupSubject {
/**
* Constructor.
*/
public OpenSSOGroupSubject() {
super();
}
/**
* Constructor.
*
* @param group the uuid of the group who is member of the
* EntitlementSubject.
*/
public OpenSSOGroupSubject(String group) {
super(group);
}
/**
* Constructs GroupSubject
*
* @param group the uuid of the group who is member of the
* EntitlementSubject
* @param pSubjectName subject name as used in OpenAM policy,
* this is relevant only when GroupSubject was created from
* OpenAM policy Subject
*/
public OpenSSOGroupSubject(String group, String pSubjectName) {
super(group, pSubjectName);
}
/**
* Returns <code>SubjectDecision</code> of
* <code>EntitlementSubject</code> evaluation
*
* @param realm Realm name.
* @param subject EntitlementSubject who is under evaluation.
* @param resourceName Resource name.
* @param environment Environment parameters.
* @return <code>SubjectDecision</code> of
* <code>EntitlementSubject</code> evaluation
* @throws com.sun.identity.entitlement, EntitlementException in case
* of any error
*/
@Override
public SubjectDecision evaluate(
String realm,
SubjectAttributesManager mgr,
Subject subject,
String resourceName,
Map<String, Set<String>> environment)
throws EntitlementException {
boolean satified = false;
if (mgr.isGroupMembershipSearchIndexEnabled()) {
Set publicCreds = subject.getPublicCredentials();
if ((publicCreds != null) && !publicCreds.isEmpty()) {
Map<String, Set<String>> attributes = (Map<String, Set<String>>)
publicCreds.iterator().next();
Set<String> values = attributes.get(
SubjectAttributesCollector.NAMESPACE_IDENTITY +
IdType.GROUP.getName());
String grpID = getID();
if (values != null) {
if (values.contains(grpID)) {
satified = true;
} else {
try {
SSOToken adminToken = (SSOToken)AccessController.
doPrivileged(AdminTokenAction.getInstance());
AMIdentity idGroup = IdUtils.getIdentity(adminToken,
grpID);
for(String value: values) {
AMIdentity amgrp = IdUtils.getIdentity(
adminToken, value);
if (idGroup.equals(amgrp)) {
satified = true;
break;
}
}
} catch (IdRepoException e) {
PrivilegeManager.debug.error(
"GroupSubject.evaluate", e);
}
}
}
}
} else {
try {
SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
AdminTokenAction.getInstance());
AMIdentity idGroup = IdUtils.getIdentity(adminToken, getID());
Set<IdType> supportedType = IdType.GROUP.canHaveMembers();
for (IdType type : supportedType) {
if (isMember(subject, type, idGroup)) {
satified = true;
break;
}
}
} catch (IdRepoException e) {
PrivilegeManager.debug.error("GroupSubject.evaluate", e);
} catch (SSOException e) {
PrivilegeManager.debug.error("GroupSubject.evaluate", e);
}
}
return new SubjectDecision(satified, Collections.EMPTY_MAP);
}
/**
* Returns search index attributes.
*
* @return search index attributes.
*/
@Override
public Map<String, Set<String>> getSearchIndexAttributes() {
SubjectAttributesManager sam = getSubjectAttributesManager();
if (sam != null) {
Map<String, Set<String>> map =
new HashMap<String, Set<String>>(4);
if (sam.isGroupMembershipSearchIndexEnabled()) {
Set<String> set = new HashSet<String>();
set.add(getID());
map.put(SubjectAttributesCollector.NAMESPACE_IDENTITY, set);
} else {
Set<String> set = new HashSet<String>();
set.add(SubjectAttributesCollector.ATTR_NAME_ALL_ENTITIES);
map.put(SubjectAttributesCollector.NAMESPACE_IDENTITY, set);
}
return map;
} else {
return super.getSearchIndexAttributes();
}
}
/**
* Returns required attribute names.
*
* @return required attribute names.
*/
@Override
public Set<String> getRequiredAttributeNames() {
SubjectAttributesManager sam = getSubjectAttributesManager();
if (sam != null) {
if (sam.isGroupMembershipSearchIndexEnabled()) {
Set<String> set = new HashSet<String>(2);
set.add(SubjectAttributesCollector.NAMESPACE_IDENTITY +
IdType.GROUP.getName());
return set;
} else {
return(Collections.EMPTY_SET);
}
} else {
return super.getRequiredAttributeNames();
}
}
private boolean isMember(
Subject subject,
IdType type,
AMIdentity idGroup
) throws IdRepoException, SSOException {
Set<Principal> userPrincipals = subject.getPrincipals();
SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
AdminTokenAction.getInstance());
for (Principal p : userPrincipals) {
AMIdentity amid = IdUtils.getIdentity(adminToken, p.getName());
Set<AMIdentity> memberships = amid.getMemberships(IdType.GROUP);
for(AMIdentity amgrp: memberships) {
if (amgrp.equals(idGroup)) {
return true;
}
}
}
return false;
}
private SubjectAttributesManager getSubjectAttributesManager() {
String uuid = getID();
if (uuid == null) {
return null;
}
try {
AMIdentity amid = new AMIdentity(null, uuid);
String realm = amid.getRealm();
SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
AdminTokenAction.getInstance());
return SubjectAttributesManager.getInstance(
SubjectUtils.createSubject(adminToken), realm);
} catch (IdRepoException idex) {
if (PrivilegeManager.debug.messageEnabled()) {
PrivilegeManager.debug.message(
"OpenSSOGroupSubject.getSubjectAttributesManager:", idex);
}
}
return null;
}
}