com.goldencode.p2j.security

Class LegacyWebSecurityManager

java.lang.Object

com.goldencode.p2j.security.LegacyWebSecurityManager

public class LegacyWebSecurityManager
extends java.lang.Object

Wrapper class for all method related to legacy services. WebServiceHandler SoapHandler RestHandler

Using it through SecurityManager.legacyWebSm allows resetting SecurityManager instance.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private static class	LegacyWebSecurityManager.WebServiceLogin A thread inheriting the FWD server context, used to perform authentication and authorization work for web requests.

Field Summary

Fields

Modifier and Type	Field and Description
private static CentralLogger	LOG Logger
private SecurityManager	sm SecurityManager instance.
private java.util.Map<java.lang.String,WebRequestContext>	webRequestContexts The map of currently active web requests, with their context data.
private java.lang.Thread	webServiceContextCleaner A thread used to cleanup the expired webRequestContexts.
private LegacyWebSecurityManager.WebServiceLogin	webServiceLogin The work which does the authentication and authorization requires a server context.

Constructor Summary

Constructors

Constructor and Description
LegacyWebSecurityManager(SecurityManager sm) Public constructor.

Method Summary

Modifier and Type	Method and Description
boolean	authWebRequest(java.lang.String account, java.lang.String webServiceToken) Check if the given credentials (user account and token) is allowed to access FWD web services.
boolean	checkAuthorization(java.lang.String token, java.util.function.Supplier<java.lang.Boolean> task) Execute the given task in the webServiceLogin thread, so that it can check if the web request identified with the given authentication token is authorized for that web request.
private void	cleanExpiredWebRequestContexts() The main work performed by webServiceContextCleaner, it goes through the webRequestContexts every 10 seconds and cleans any contexts which are not in use and are expired.
java.lang.String	createWebRequestContext(java.lang.String account, java.lang.String webServiceToken, int timeout) Authenticate and create the FWD context
boolean	destroyWebRequestContext(java.lang.String token) Destroy the context for the web request identified by the specified token.
void	executeInContext(java.lang.String token, java.lang.Runnable task) Execute the specified task in the context associated with the web request identified via the specified authentication token.
void	executeInContext(java.lang.String token, java.lang.Runnable task, boolean useInitial) Execute the specified task in the context associated with the web request identified via the specified authentication token.
ContextSwitcher	getContextSwitcher(java.lang.Runnable auth) Given an authentication related code, return a ContextSwitcher instance, if the authentication was performed.
boolean	hasWebRequestContext(java.lang.String token) Check if the specified token is associated with an active and not expired web request context.
void	startWebServiceContextThreads() Start the webServiceContextCleaner and webServiceLogin threads, using the server context.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOG

private static final CentralLogger LOG

Logger

sm

private final SecurityManager sm

SecurityManager instance.

webRequestContexts

private java.util.Map<java.lang.String,WebRequestContext> webRequestContexts

The map of currently active web requests, with their context data. The key is the token resolved after the initial authentication was performed.

webServiceContextCleaner

private java.lang.Thread webServiceContextCleaner

A thread used to cleanup the expired webRequestContexts. Only contexts which are not active being used will be cleaned.

webServiceLogin

private LegacyWebSecurityManager.WebServiceLogin webServiceLogin

The work which does the authentication and authorization requires a server context. As it can originate either from the web request thread or from the web service worker thread, an AssociatedThread will be started if any web services has enabled authentication, and this is where the work will be performed.

Constructor Detail

LegacyWebSecurityManager

LegacyWebSecurityManager(SecurityManager sm)

Public constructor. Accepts a SecurityManager instance to avoid deadlocks.

Parameters:

sm - SecurityManager instance.

Method Detail

authWebRequest

public boolean authWebRequest(java.lang.String account,
                              java.lang.String webServiceToken)
                       throws RestrictedUseException

Check if the given credentials (user account and token) is allowed to access FWD web services. Authorization will be done later, via checkAuthorization(java.lang.String, java.util.function.Supplier<java.lang.Boolean>).

Parameters:

account - The FWD user account.

webServiceToken - The web service token.

Returns:

true if there is a FWD user account with that name and web service token.

Throws:

RestrictedUseException - If this method is called from restricted context

createWebRequestContext

public java.lang.String createWebRequestContext(java.lang.String account,
                                                java.lang.String webServiceToken,
                                                int timeout)
                                         throws RestrictedUseException

Authenticate and create the FWD context

Parameters:

account - The FWD user account.

webServiceToken - The web service token.

timeout - The timeout after which the FWD context will be destroyed. If set to zero, the context will live until a logout operation is performed.

Returns:

The authentication token which can be used for other calls.

Throws:

RestrictedUseException - If this method is called from restricted context

startWebServiceContextThreads

public void startWebServiceContextThreads()

Start the webServiceContextCleaner and webServiceLogin threads, using the server context.

destroyWebRequestContext

public boolean destroyWebRequestContext(java.lang.String token)

Destroy the context for the web request identified by the specified token.

Parameters:

token - The authentication token.

Returns:

true if webRequestContexts has this token and the FWD session was terminated.

hasWebRequestContext

public boolean hasWebRequestContext(java.lang.String token)

Check if the specified token is associated with an active and not expired web request context.

If the web request is expired, it will be destroyed.

Parameters:

token - The authentication token.

Returns:

true if the token exists and the web request is not expired.

executeInContext

public void executeInContext(java.lang.String token,
                             java.lang.Runnable task)

Execute the specified task in the context associated with the web request identified via the specified authentication token.

Parameters:

token - The authentication token.

task - The task to be performed.

executeInContext

public void executeInContext(java.lang.String token,
                             java.lang.Runnable task,
                             boolean useInitial)

Execute the specified task in the context associated with the web request identified via the specified authentication token.

Parameters:

token - The authentication token.

task - The task to be performed.

useInitial - Flag indicating to create an initial security context.

checkAuthorization

public boolean checkAuthorization(java.lang.String token,
                                  java.util.function.Supplier<java.lang.Boolean> task)

Execute the given task in the webServiceLogin thread, so that it can check if the web request identified with the given authentication token is authorized for that web request.

Parameters:

token - The authentication token.

task - The authorization task.

Returns:

true if the web request token is authorized.

getContextSwitcher

public ContextSwitcher getContextSwitcher(java.lang.Runnable auth)

Given an authentication related code, return a ContextSwitcher instance, if the authentication was performed.

This switcher allows a thread to establish the context, if it knows a session ID.

Parameters:

auth - The authentication code.

Returns:

A context switcher instance.

cleanExpiredWebRequestContexts

private void cleanExpiredWebRequestContexts()

The main work performed by webServiceContextCleaner, it goes through the webRequestContexts every 10 seconds and cleans any contexts which are not in use and are expired.