com.goldencode.p2j.security

Class SecurityAdmin

java.lang.Object

com.goldencode.p2j.security.SecurityAdmin

All Implemented Interfaces:

SecurityConstants

public class SecurityAdmin
extends java.lang.Object
implements SecurityConstants

This is a collection of workers that have to be in the security package but used from the admin package. This class also maintains the session related security cache which reflects the current state of the system being edited in the persistent storage.

Field Summary

Fields

Modifier and Type	Field and Description
private AdminAccountExtension	ae instance of account extension plugin
private AdminResource	ar instance of admin resource plugin
private static java.lang.String	CERT_BEG certificate encoding start mark
private static java.lang.String	CERT_END certificate encoding end mark
private DirectoryService	ds instance of directory service
private static CentralLogger	LOG Logger
private java.util.Map<java.lang.Integer,java.lang.String>	mapId current map from mapTypes
private java.util.Map<java.lang.String,java.util.Map<java.lang.String,java.util.Map<java.lang.Integer,java.lang.String>>>	mapInst maps ACL instance name into map of resource types
private java.util.Map<java.lang.String,java.util.Map<java.lang.Integer,java.lang.String>>	mapTypes current map from mapInst
private static java.lang.String[]	prof list of admin resource instance names maing up a profile
private SecurityCache	sc instance of current offline security cache
private SecurityManager	sm instance of security manager
private static int	SPLIT_CHUNK certificate encoding I/O chunk (as in *.PEM files)
private SystemResource	sr instance of system resource plugin

Fields inherited from interface com.goldencode.p2j.security.SecurityConstants

AUTH_ACTION_ABORT, AUTH_ACTION_CONTINUE, AUTH_ACTION_DONE, AUTH_ACTION_RETRY, AUTH_MODE_CUSTOM, AUTH_MODE_HIGHEST, AUTH_MODE_IDPW, AUTH_MODE_LOWEST, AUTH_MODE_NONE, AUTH_MODE_X509, AUTH_MODE_X509_IDPW, AUTH_REQ_PROCESS, AUTH_REQ_PROGRAM, AUTH_REQ_SSO, AUTH_REQ_USER, AUTH_RESULT_INSUFFICIENT_RIGHTS, AUTH_RESULT_INVALID_PASSWORD, AUTH_RESULT_INVALID_USERID, AUTH_RESULT_NONE, AUTH_RESULT_PER_USER_SESSION_LIMIT_REACHED, AUTH_RESULT_SKIP_TO_NEXT, AUTH_RESULT_SUCCESS, AUTH_RESULT_SYSTEM_SESSION_LIMIT_REACHED, AUTH_RESULT_UNSPECIFIED_FAILURE, PKT_SIZE_SKIP_TO_NEXT

Constructor Summary

Constructors

Constructor and Description
SecurityAdmin(DirectoryService ds) Constructor.

Method Summary

Modifier and Type	Method and Description
boolean	addAcl(java.lang.String resourceType, Acl acl, java.util.Map<java.lang.Integer,java.lang.String> subjMap) Adds new set of ACLs based on the contents of the given ACL definition.
boolean	addCert(CertDef cert) Adds a new certificate according to its definition.
boolean	addGroup(GroupDef group) Adds new group account definition.
boolean	addOsUser(OsUserDef user) Adds new OS user account definition.
boolean	addProcess(ProcessDef process, java.io.Serializable ext) Adds new process account definition.
boolean	addUser(UserDef user, java.io.Serializable ext) Adds new user account definition.
boolean	adminAccess() Checks the rights of the caller to perform admin operations.
int	bulkAuthModeUpdate(int targetAccounts, java.lang.String[] excludedAccounts, int authMode, java.lang.String authPlugin) Preforms bulk update of authentication settings of the accounts of the specified type.
boolean	canRefresh() Check if there user can perform refresh.
boolean	changeGroupUsers(java.lang.String name, java.lang.String[] additions, java.lang.String[] deletions) Changes the group by adding and/or removing users.
private boolean	changeGroupUsersWorker(java.lang.String name, java.lang.String[] additions, java.lang.String[] deletions) Changes the group by adding and/or removing users.
private boolean	checkAcl(java.lang.String resourceType, Acl acl, java.util.Map<java.lang.Integer,java.lang.String> subjMap, java.lang.String[] subjects, boolean setInstance, boolean setSubjects, boolean setRights, boolean addOrSet) Checks an ACL for validity.
private boolean	checkCAAlias(java.lang.String alias) Checks certificate alias for duplication in CA domain.
private boolean	checkCache() Checks to see if the cache is available and stores a message if not.
private byte[]	checkCertificate(CertDef cert) Reassembles certificate encoding from its definition.
private boolean	checkPeerAlias(java.lang.String alias) Checks certificate alias for duplication in peer domain.
private boolean	checkPermission() Admin permissions check routine.
private boolean	checkPermission(java.lang.String name, int mode) Admin permission check routine for a specific resource instance, leaf node and permission.
private boolean	checkPermissions(java.lang.String name, int[] mode) Admin permission check routine for a specific resource instance, leaf node and permission.
private int	checkResourceType(java.lang.String resourceType) Checks the resource type name for validity.
boolean	cloneAcl(java.lang.String resourceType, java.lang.String instanceName, int oid, int cloneOid) Clones the specified ACL to another position within the same ACL instance.
boolean	cloneGroup(java.lang.String nameFrom, java.lang.String nameTo, boolean acls) Clones an existing group account into a new one.
boolean	cloneProcess(java.lang.String nameFrom, java.lang.String nameTo, boolean acls) Clones an existing process account into a new one.
private boolean	cloneSubjectInACLs(java.lang.String name, java.lang.String nameTo) Modifies all ACLs that refer to the given subject so that they also refer to the clone.
boolean	cloneUser(java.lang.String nameFrom, java.lang.String nameTo, boolean acls, boolean replacePassword, byte[] newPassword) Clones an existing user account into a new one.
private java.lang.String	commonParent(java.lang.String snode, java.lang.String tnode) Calculates the common parent node for two given nodes.
boolean	consReloadDirectory() Causes the live system to reload the P2J directory from the back storage.
private boolean	createCertNode(java.lang.String id, byte[] enc) Creates a certificate directory object.
private boolean	createGroupNode(java.lang.String gid, java.lang.String text, int mode, java.lang.String authPlugin) Creates a group account directory object.
private boolean	createOsUserNode(java.lang.String uid, java.lang.String description, boolean enabled, byte[] password, DateValue date, TimeValue time) Creates a OS user account directory object.
private boolean	createProcessNode(java.lang.String id, boolean enabled, java.lang.String text, java.lang.String alias, boolean server, boolean master) Creates a process account directory object.
private boolean	createUserNode(java.lang.String uid, boolean enabled, java.lang.String person, java.lang.String osuser, int mode, java.lang.String authPlugin, java.lang.String alias, java.lang.String[] groups, boolean protect, byte[] password, DateValue date, TimeValue time) Creates a user account directory object.
private boolean	currentCache() Creates new security cache generation offline.
boolean	deleteAcl(java.lang.String resourceType, java.lang.String instanceName, int oid) Deletes the specified ACL from the specified ACL instance.
boolean	deleteCert(java.lang.String alias, boolean force) Deletes an existing certificate conditionally or unconditionally.
boolean	deleteGroup(java.lang.String name) Deletes a group account definition.
boolean	deleteOsUser(java.lang.String name) Deletes an OS user definition.
boolean	deleteProcess(java.lang.String name) Deletes a process account definition.
boolean	deleteUser(java.lang.String name) Deletes a user account definition.
private static void	encode(java.lang.String[] args) User password encoding utility.
private static boolean	encodeWorker(DirectoryService ds, java.lang.String attrName) Modifies all ACLs in the specified ACL instance which refer to a given subject ID.
private java.lang.String[]	enumerateACLInstancePaths() Enumerates ACL instances defined in the directory.
private java.lang.String[]	enumerateACLInstances() Enumerates ACL instances defined in the directory.
private java.lang.String[]	enumerateACLInstances(java.lang.String resourceType) Enumerates ACL instances defined in the directory, that have ACLs defined for the specified resource type.
private int	enumerateACLs(java.lang.String path, java.util.Map<java.lang.Integer,java.lang.String> comb, int badIds) Enumerates ACLs under the given directory path and combines then into the given map.
AccountReportsExtension	getAccountReportsExtension() Account reports extension point.
AclDef	getAcl(java.lang.String resourceType, java.lang.String instanceName) Gets the full ACL definition information from the directory for the specified ACL instance and resource type.
AclDef[]	getAcls(java.lang.String instanceName) Gets the full ACL definition information from the directory for the specified ACL instance or all of them.
private AclDef	getAclWorker(java.lang.String resourceType, java.lang.String instanceName, java.lang.String mpath, java.lang.String opath) Creates an ACL definition from the ACLs for the specified resource type.
SessionInfo[]	getActiveSessions(java.lang.String jar, java.lang.String iface) Get the list of all active sessions which have executed API(s) associated to this jar.
AdminDef	getAdminDef() Returns the configuration information about the administration interface itself.
CertDef	getCert(java.lang.String alias) Returns a DER-encoded certificate like those found in *.PEM files.
TaggedName[]	getCertAccounts(java.lang.String alias) Returns an array of all account names with their description for accounts sharing this certificate.
TaggedName[]	getCertProcesses(java.lang.String alias) Returns an array of process account names with their description for processes sharing this certificate.
TaggedName[]	getCertUsers(java.lang.String alias) Returns an array of user account names with their description for users sharing this certificate.
private AdminAccountExtension	getExtension() Utility method to get the custom server extension interface.
GroupDef	getGroup(java.lang.String name) Returns the group definition for the specified group name.
OsUserDef	getOsUser(java.lang.String name) Returns the OS user account definition for the specified account name.
ProcessDef	getProcess(java.lang.String name) Returns the process definition for the specified process name.
AdminProfile[]	getProfile(java.lang.String[] name) Returns the admin permissions profile for an arbitrary set of resource instance names.
AdminProfile[]	getProfile(java.lang.String name, int[] perm) Returns the admin permissions profile for an arbitrary set of permissions for a resource instance name.
java.lang.String	getResourceType(java.lang.String name) Returns the registered resource type name for the given resource plugin.
SessionInfo[]	getSessionList() Creates a report of all current user and process sessions.
UserDef	getUser(java.lang.String name) Returns the user account definition for the specified account name.
boolean	isMaster() Tells whether the server can modify the directory.
private static void	johndoe(java.lang.String[] args) ACL subjects list verification utility.
void	killSession(int sid) Forcibly terminates (closes) the socket in use for the given session.
java.lang.String[]	listAclInstances() Locates all instances of ACLs in the directory and returns their names.
java.lang.String[]	listAclInstances(java.lang.String resourceType) Locates all instances of ACLs in the directory and returns their names for those instances which have ACLs defined for the specified resource type.
TaggedName[]	listAssociatedFwdUsers(java.lang.String osUser) Returns an array of defined FWD user names, associated with the OS user.
TaggedName[]	listAuthPlugins() Get the list of available auth plugins.
private TaggedName[]	listCertAccounts(java.lang.String alias, int type) Returns an array of account names with their description for accounts sharing this certificate.
TaggedName[]	listCerts(boolean auth, boolean unusedOnly) Returns an array of defined CA or peer certificates with their distinctive names.
TaggedName[]	listGroups() Returns a tagged array of defined group names.
TaggedName[]	listGroupUsers(java.lang.String name) Enumerates the users of a named group.
java.lang.String[]	listInstanceAcls(java.lang.String instanceName) Lists resource names for which the specified ACL instance has ACLs defined.
TaggedName[]	listOsUsers() Returns all OS user account definitions.
TaggedName[]	listProcesses() Returns a tagged array of defined process names.
java.lang.String[]	listResourceNames() Returns an array of resource plugin names.
TaggedName[]	listUserGroups(java.lang.String name) Enumerates the groups the named user is part of.
TaggedName[]	listUsers() Returns an array of defined user account names and their owners.
static void	main(java.lang.String[] args) Application entry point.
private void	message(java.lang.String msg) Utility method to store server messages for later retrieval by clients.
private void	message(java.lang.String[] msg) Utility method to store server messages for later retrieval by clients.
private static void	migrate(java.lang.String[] args) ACL migration utility.
private static boolean	modifySubjectsInACLs(DirectoryService ds, java.lang.String origin, java.lang.String name, java.lang.String[] namesDel, java.lang.String[] namesAdd) Modifies all ACLs in the specified ACL instance which refer to a given subject ID.
boolean	moveAcl(java.lang.String resourceType, java.lang.String instanceName, int oid, int newOid) Moves the specified ACL to another position within the same ACL instance.
boolean	moveAcl(java.lang.String resourceType, java.lang.String instanceName, int oid, java.lang.String newInstanceName) Moves the specified ACL to another ACL instance, private or shared.
boolean	moveCert(java.lang.String aliasFrom, java.lang.String aliasTo) Changes the certificate's alias.
private static void	printMessages(java.util.List<java.lang.String[]> msgBuf) Message buffer printout
private boolean	queryPermission(java.lang.String name, int mode) Admin permission check routine for a specific resource instance, leaf node and permission.
void	refreshPlugin(java.lang.String resourceType) Send a refresh request to specified plugin.
private boolean	removeSubjectFromACLs(java.lang.String name) Modifies all ACLs that refer to the given subject so that they no longer do.
boolean	resequenceAcls(java.lang.String resourceType, java.lang.String instanceName, int start, int step) Assigns new object IDs sequentially for all ACLs in the given ACL instance and resource type.
private static void	resource(java.lang.String[] args) ACL resource name verification utility.
java.lang.String	searchCert(java.lang.String dn) Searches the CA directory for an alias of the certificate by the distinctive name of the subject.
boolean	setAcl(java.lang.String resourceType, Acl acl, java.util.Map<java.lang.Integer,java.lang.String> subjMap, boolean setInstance, boolean setInstanceMode, boolean setSubjects, boolean setRights) Conditionally edits the existing ACL based on the contents of the given ACL and the selected conditions.
boolean	setCert(CertDef cert) Replaces an existing certificate with the given one.
boolean	setGroup(GroupDef group) Changes the group definition for the named group.
boolean	setOsUser(OsUserDef user) Changes the OS user account definition.
boolean	setProcess(ProcessDef process, java.io.Serializable ext, boolean syncExt) Changes the process definition for the named process.
boolean	setUser(UserDef user, java.io.Serializable ext, boolean syncExt) Changes the user account definition for the named account.
private static void	subjects(java.lang.String[] args) ACL subjects filtering and editing utility.
private boolean	syncAuthSettings(java.lang.String node, int authMode, java.lang.String authPlugin) Synchronizes authentication-related directory node attributes with the given values.
private boolean	syncBoolean(java.lang.String id, java.lang.String attr, java.lang.Boolean value) Synchronizes a directory node attribute with the given value.
private boolean	syncBytes(java.lang.String id, java.lang.String attr, byte[] value) Synchronizes a directory node attribute with the given value.
private boolean	syncDate(java.lang.String id, java.lang.String attr, DateValue value) Synchronizes a directory node attribute with the given value.
private boolean	syncInteger(java.lang.String id, java.lang.String attr, java.lang.Integer value) Synchronizes a directory node attribute with the given value.
private boolean	syncString(java.lang.String id, java.lang.String attr, java.lang.String value) Synchronizes a directory node attribute with the given value.
private boolean	syncStrings(java.lang.String id, java.lang.String attr, java.lang.String[] value) Synchronizes a directory node attribute with the given value.
private boolean	syncTime(java.lang.String id, java.lang.String attr, TimeValue value) Synchronizes a directory node attribute with the given value.
boolean	terminateSessions(java.lang.String jar, java.lang.String iface) Terminate all active sessions which have invoked the given APIs in the given jar.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SPLIT_CHUNK

private static final int SPLIT_CHUNK

certificate encoding I/O chunk (as in *.PEM files)

See Also:

Constant Field Values

CERT_BEG

private static final java.lang.String CERT_BEG

certificate encoding start mark

See Also:

Constant Field Values

CERT_END

private static final java.lang.String CERT_END

certificate encoding end mark

See Also:

Constant Field Values

prof

private static final java.lang.String[] prof

list of admin resource instance names maing up a profile

LOG

private static final CentralLogger LOG

Logger

sm

private SecurityManager sm

instance of security manager

sr

private SystemResource sr

instance of system resource plugin

ar

private AdminResource ar

instance of admin resource plugin

sc

private SecurityCache sc

instance of current offline security cache

ds

private DirectoryService ds

instance of directory service

ae

private AdminAccountExtension ae

instance of account extension plugin

mapInst

private java.util.Map<java.lang.String,java.util.Map<java.lang.String,java.util.Map<java.lang.Integer,java.lang.String>>> mapInst

maps ACL instance name into map of resource types

mapTypes

private java.util.Map<java.lang.String,java.util.Map<java.lang.Integer,java.lang.String>> mapTypes

current map from mapInst

mapId

private java.util.Map<java.lang.Integer,java.lang.String> mapId

current map from mapTypes

Constructor Detail

SecurityAdmin

public SecurityAdmin(DirectoryService ds)

Constructor.

Parameters:

ds - instance of DirectoryService to use for directory access

Method Detail

adminAccess

public boolean adminAccess()

Checks the rights of the caller to perform admin operations.

Returns:

true if the caller has sufficient rights

isMaster

public boolean isMaster()

Tells whether the server can modify the directory. Only the master server can. The others have read-only access to the directory.

Returns:

true if it can

canRefresh

public boolean canRefresh()

Check if there user can perform refresh.

Returns:

true if current user has enough rights to perform security cache refresh.

getActiveSessions

public SessionInfo[] getActiveSessions(java.lang.String jar,
                                       java.lang.String iface)

Get the list of all active sessions which have executed API(s) associated to this jar.

Parameters:

jar - The name of the target jar file.

iface - The interface for which we need the sessions; if null, search through the entire jar.

Returns:

the list of all active sessions which have executed API(s) associated to this jar.

terminateSessions

public boolean terminateSessions(java.lang.String jar,
                                 java.lang.String iface)

Terminate all active sessions which have invoked the given APIs in the given jar. If the jar name is null, terminate all active tracked sessions. This method guarantees that all session termination listeners have been executed.

Parameters:

jar - The jar name; if null, terminate all active tracked sessions.

iface - The interface for which we need to terminate the sessions; if null, terminate all sessions for the given jar.

Returns:

true if operation was successful, false if you do not have admin rights.

listGroups

public TaggedName[] listGroups()

Returns a tagged array of defined group names. Tags are group descriptions.

Returns:

All defined group accounts or null

getGroup

public GroupDef getGroup(java.lang.String name)

Returns the group definition for the specified group name.

Parameters:

name - Group name.

Returns:

group definition or null

listGroupUsers

public TaggedName[] listGroupUsers(java.lang.String name)

Enumerates the users of a named group.

Parameters:

name - group name

Returns:

array of user names, that may be empty, or null if there is no such group

setGroup

public boolean setGroup(GroupDef group)

Changes the group definition for the named group.

Parameters:

group - group definition

Returns:

true if successfully changed the group

addGroup

public boolean addGroup(GroupDef group)

Adds new group account definition.

Parameters:

group - group definition for a new account

Returns:

true if successfully added the group

deleteGroup

public boolean deleteGroup(java.lang.String name)

Deletes a group account definition. The account is deleted. All references to this group are deleted from the user accounts and from ACLs.

The directory modification is done in multiple separate transactions:

• unassigning users from the group - /security/accounts/users
• removing the group from the ACLs - /security/acl and /security/acls
• removing the group account - /security/accounts/groups

This approach may leave the directory partially modified.

Parameters:

name - group name for the group being deleted

Returns:

true if successfully deleted the group

cloneGroup

public boolean cloneGroup(java.lang.String nameFrom,
                          java.lang.String nameTo,
                          boolean acls)

Clones an existing group account into a new one. Users of the source group become also the users of the clone. ACLs are modified to give the source group's rights to the clone, if this option is requested.

Parameters:

nameFrom - group name for the source group

nameTo - group name for the clone

acls - true tells to clone ACLs as well

Returns:

true if successfully cloned the group

changeGroupUsers

public boolean changeGroupUsers(java.lang.String name,
                                java.lang.String[] additions,
                                java.lang.String[] deletions)

Changes the group by adding and/or removing users.

This API requires ADLU_GROUP_ACCESS permission.

Parameters:

name - group name

additions - array of user names to be added to the group; may be empty

deletions - array of user names to be excluded from the group; may be empty

Returns:

true if successfully changed the group

listUsers

public TaggedName[] listUsers()

Returns an array of defined user account names and their owners.

This API requires ADLU_ENUMERATE_ACCESS permission.

Returns:

All defined user accounts or null

getAdminDef

public AdminDef getAdminDef()

Returns the configuration information about the administration interface itself. This information should be used to get access to the custom admin extensions

Returns:

container with admin related configuration information

getProfile

public AdminProfile[] getProfile(java.lang.String[] name)

Returns the admin permissions profile for an arbitrary set of resource instance names.

Parameters:

name - array of admin resource instance names to query

Returns:

permissions for the given names or null

getProfile

public AdminProfile[] getProfile(java.lang.String name,
                                 int[] perm)

Returns the admin permissions profile for an arbitrary set of permissions for a resource instance name.

Parameters:

name - admin leaf resource instance name to query

perm - array of permissions to query

Returns:

permissions for the given name or null

listOsUsers

public TaggedName[] listOsUsers()

Returns all OS user account definitions. This API requires one of the following permission ADLU_READ_ACCESS.

Returns:

An array of all OS user account definitions.

getOsUser

public OsUserDef getOsUser(java.lang.String name)

Returns the OS user account definition for the specified account name. This API requires one of the following permission ADLU_READ_ACCESS.

Parameters:

name - OS user account name

Returns:

OS user account definition or null if no such OS user

addOsUser

public boolean addOsUser(OsUserDef user)

Adds new OS user account definition.

The mandatory fields of the OS user definition container are validated. Optional fields are added, depending on their presence in the container.

This API requires ADLU_CREATE_ACCESS permission.

Parameters:

user - user account definition

Returns:

true if successfully added the OS user

setOsUser

public boolean setOsUser(OsUserDef user)

Changes the OS user account definition. Optional fields are synchronized with the directory. Password aging information is set only if a password is set.

This API requires one of the following permissions:

• ADLU_WRITE_ACCESS
• ADLU_PASSWORD_ACCESS

The ADLU_PASSWORD_ACCESS permission allows changing the password and its timestamp only. No validation of the rest of the user definition is done in this case.

Parameters:

user - user account definition

Returns:

true if successfully changed the OS user

deleteOsUser

public boolean deleteOsUser(java.lang.String name)

Deletes an OS user definition.

This API requires ADLU_DELETE_ACCESS permission.

Parameters:

name - OS user name being deleted

Returns:

true if successfully deleted the account

listAssociatedFwdUsers

public TaggedName[] listAssociatedFwdUsers(java.lang.String osUser)

Returns an array of defined FWD user names, associated with the OS user.

Parameters:

osUser - The OS user name

Returns:

The associated FWD users or null

getUser

public UserDef getUser(java.lang.String name)

Returns the user account definition for the specified account name.

This API requires one of the following permissions:

• ADLU_READ_ACCESS
• ADLU_WRITE_ACCESS
• ADLU_PASSWORD_ACCESS

Parameters:

name - user account name

Returns:

user account definition or null if no such user

setUser

public boolean setUser(UserDef user,
                       java.io.Serializable ext,
                       boolean syncExt)

Changes the user account definition for the named account. Optional fields are synchronized with the directory. Password aging information is set only if a password is set. If the account is password protected and the password is present, but both the date and time fields are NOT present, then they are automatically set to the current date and time.

This API requires one of the following permissions:

• ADLU_WRITE_ACCESS
• ADLU_PASSWORD_ACCESS

The ADLU_PASSWORD_ACCESS permission allows changing the password and its timestamp only. No validation of the rest of the user definition is done in this case.

Parameters:

user - user account definition

ext - optional extension container for custom account extensions

syncExt - if true, the state of the account should sync'ed with the state of the extension container; otherwise the state of the account extensions does not change

Returns:

true if successfully changed the account

addUser

public boolean addUser(UserDef user,
                       java.io.Serializable ext)

Adds new user account definition.

The mandatory fields of the user definition container are validated. Optional fields are added, depending on their presence in the container. One exception is the password timestamp: if the account is password protected and the password is present, but both the date and time fields are NOT present, then they are automatically set to the current date and time.

This API requires ADLU_CREATE_ACCESS permission.

Parameters:

user - user account definition

ext - optional extension container for custom account extensions

Returns:

true if successfully added the account

deleteUser

public boolean deleteUser(java.lang.String name)

Deletes a user account definition. The account is deleted. All references to this account are deleted from the ACLs, but the associated user certificate is left untouched.

The directory modification is done in multiple separate transactions:

• removing the user from the ACLs - /security/acl and /security/acls
• removing the user account - /security/accounts/users

This approach may leave the directory partially modified.

This API requires ADLU_DELETE_ACCESS permission.

Parameters:

name - user account name being deleted

Returns:

true if successfully deleted the account

cloneUser

public boolean cloneUser(java.lang.String nameFrom,
                         java.lang.String nameTo,
                         boolean acls,
                         boolean replacePassword,
                         byte[] newPassword)

Clones an existing user account into a new one. ACLs are modified to give the source user rights to the clone, if this option is requested.

This API requires ADLU_CREATE_ACCESS permission.

Parameters:

nameFrom - user account name for the source

nameTo - user account name for the clone

acls - true tells to clone ACLs as well

replacePassword - true tells to assign the provided password instead of cloning it

newPassword - a replacement password for the clone

Returns:

true if successfully cloned the user account

listUserGroups

public TaggedName[] listUserGroups(java.lang.String name)

Enumerates the groups the named user is part of.

This API requires one of the following permissions:

• ADLU_READ_ACCESS
• ADLU_WRITE_ACCESS
• ADLU_PASSWORD_ACCESS

Parameters:

name - user account name

Returns:

array of tagged group names, that may be empty, or null if there is no such user etc

listResourceNames

public java.lang.String[] listResourceNames()

Returns an array of resource plugin names.

Returns:

All defined resource plugin names

getResourceType

public java.lang.String getResourceType(java.lang.String name)

Returns the registered resource type name for the given resource plugin.

Parameters:

name - plugin name

Returns:

registered resource type name or null if no match

listProcesses

public TaggedName[] listProcesses()

Returns a tagged array of defined process names. Tags are process descriptions.

Returns:

All defined group accounts or null

getProcess

public ProcessDef getProcess(java.lang.String name)

Returns the process definition for the specified process name.

Parameters:

name - Process name.

Returns:

process definition or null

setProcess

public boolean setProcess(ProcessDef process,
                          java.io.Serializable ext,
                          boolean syncExt)

Changes the process definition for the named process.

Parameters:

process - process definition

ext - optional extension container for custom account extensions

syncExt - if true, the state of the account should sync'ed with the state of the extension container; otherwise the state of the account extensions does not change

Returns:

true if successfully changed the process

addProcess

public boolean addProcess(ProcessDef process,
                          java.io.Serializable ext)

Adds new process account definition.

Parameters:

process - process definition for a new account

ext - optional extension container for custom account extensions

Returns:

true if successfully added the process

deleteProcess

public boolean deleteProcess(java.lang.String name)

Deletes a process account definition. The account is deleted. All references to this process are deleted from the ACLs, but the associated process certificate is left untouched.

The directory modification is done in multiple separate transactions:

• removing the process from the ACLs - /security/acl and /security/acls
• removing the process account - /security/accounts/processes

This approach may leave the directory partially modified.

Parameters:

name - process account name being deleted

Returns:

true if successfully deleted the process

cloneProcess

public boolean cloneProcess(java.lang.String nameFrom,
                            java.lang.String nameTo,
                            boolean acls)

Clones an existing process account into a new one. Master server flag is always false for the clone. ACLs are modified to give the source process' rights to the clone, if this option is requested.

Parameters:

nameFrom - process name for the source

nameTo - process name for the clone

acls - true tells to clone ACLs as well

Returns:

true if successfully cloned the process

listCerts

public TaggedName[] listCerts(boolean auth,
                              boolean unusedOnly)

Returns an array of defined CA or peer certificates with their distinctive names.

Parameters:

auth - if true, list CA certificates. otherwise peer certificates

unusedOnly - if true, lists unused certificates only, otherwise all certificates

Returns:

All defined certificates of a given type or null

getCertUsers

public TaggedName[] getCertUsers(java.lang.String alias)

Returns an array of user account names with their description for users sharing this certificate.

Parameters:

alias - certificate alias name

Returns:

all user accounts referring to this certificate or null

getCertProcesses

public TaggedName[] getCertProcesses(java.lang.String alias)

Returns an array of process account names with their description for processes sharing this certificate.

Parameters:

alias - certificate alias name

Returns:

all process accounts referring to this certificate or null

getCertAccounts

public TaggedName[] getCertAccounts(java.lang.String alias)

Returns an array of all account names with their description for accounts sharing this certificate.

Parameters:

alias - certificate alias name

Returns:

all accounts referring to this certificate or null

getCert

public CertDef getCert(java.lang.String alias)

Returns a DER-encoded certificate like those found in *.PEM files.

Parameters:

alias - the alias of the certificate to get

Returns:

the encoded certificate or null

setCert

public boolean setCert(CertDef cert)

Replaces an existing certificate with the given one.

Parameters:

cert - encoded certificate

Returns:

true if replaced, false if errors

addCert

public boolean addCert(CertDef cert)

Adds a new certificate according to its definition.

Parameters:

cert - encoded certificate

Returns:

true if added, false if errors

deleteCert

public boolean deleteCert(java.lang.String alias,
                          boolean force)

Deletes an existing certificate conditionally or unconditionally. Conditional deletion means the certificate belongs to the peer domain and is not used by any account.

Parameters:

alias - the alias of the certificate being deleted

force - if true, the certificate is deleted even if in use

Returns:

true if deleted, false if errors

moveCert

public boolean moveCert(java.lang.String aliasFrom,
                        java.lang.String aliasTo)

Changes the certificate's alias.

Parameters:

aliasFrom - current certificate's alias

aliasTo - new certificate's alias

Returns:

true if changed, false if errors

searchCert

public java.lang.String searchCert(java.lang.String dn)

Searches the CA directory for an alias of the certificate by the distinctive name of the subject.

Parameters:

dn - distinctive name

Returns:

alias of the certificate if exists, or null

consReloadDirectory

public boolean consReloadDirectory()

Causes the live system to reload the P2J directory from the back storage.

Returns:

true if successful

getSessionList

public SessionInfo[] getSessionList()

Creates a report of all current user and process sessions.

Returns:

Session descriptors suitable for reporting purposes or null if insufficient rights exist to obtain the list.

killSession

public void killSession(int sid)

Forcibly terminates (closes) the socket in use for the given session.

Parameters:

sid - Session ID to terminate.

listAclInstances

public java.lang.String[] listAclInstances()

Locates all instances of ACLs in the directory and returns their names. The shared instance has an empty name.

ACL instances are the directory branches that store ACLs. The shared instance is the one found under /security/acl branch. Private instances are found under /security/acls/name branches.

Returns:

array of ACL instance names; may be empty

listAclInstances

public java.lang.String[] listAclInstances(java.lang.String resourceType)

Locates all instances of ACLs in the directory and returns their names for those instances which have ACLs defined for the specified resource type. The shared instance has an empty name.

ACL instances are the directory branches that store ACLs. The shared instance is the one found under /security/acl branch. Private instances are found under /security/acls/name branches.

Parameters:

resourceType - name of the resource of interest

Returns:

array of ACL instance names; may be empty

listInstanceAcls

public java.lang.String[] listInstanceAcls(java.lang.String instanceName)

Lists resource names for which the specified ACL instance has ACLs defined.

Parameters:

instanceName - name of the ACL instance; empty string for the shared one

Returns:

array of resource type names; may be empty

getAcl

public AclDef getAcl(java.lang.String resourceType,
                     java.lang.String instanceName)

Gets the full ACL definition information from the directory for the specified ACL instance and resource type.

Parameters:

resourceType - name of the resource of interest; can't be null

instanceName - name of the ACL instance; empty string for the shared one, or null for the effective list of this server

Returns:

ACL definition or null

getAcls

public AclDef[] getAcls(java.lang.String instanceName)

Gets the full ACL definition information from the directory for the specified ACL instance or all of them.

Parameters:

instanceName - name of the ACL instance; empty string for the shared one; if null, all ACLs are returned and some may be combined

Returns:

an array of ACL definitions, one per resource type and instance, or null

addAcl

public boolean addAcl(java.lang.String resourceType,
                      Acl acl,
                      java.util.Map<java.lang.Integer,java.lang.String> subjMap)

Adds new set of ACLs based on the contents of the given ACL definition. Both the target ACL instance and resource part will be created if they don't exist.

Parameters:

resourceType - name of the resource to add the ACL for

acl - ACL definition, that should come fully defined, including the instance name.

subjMap - a map to translate numeric subject IDs back to names

Returns:

true if added, false if errors

listAuthPlugins

public TaggedName[] listAuthPlugins()

Get the list of available auth plugins.

Returns:

the list of available auth plugins encoded into tagged names or null if no plugins are available.

bulkAuthModeUpdate

public int bulkAuthModeUpdate(int targetAccounts,
                              java.lang.String[] excludedAccounts,
                              int authMode,
                              java.lang.String authPlugin)

Preforms bulk update of authentication settings of the accounts of the specified type.

Parameters:

targetAccounts - Type of accounts to update. Account.ACC_USER and Account.ACC_GROUP are supported.

excludedAccounts - The list of IDs of the accounts that should NOT be updated. Can be null.

authMode - Authentication mode to set.

authPlugin - Authentication plugin to set.

Returns:

the number of updated accounts or -1 if an error has occured.

refreshPlugin

public void refreshPlugin(java.lang.String resourceType)

Send a refresh request to specified plugin.

Parameters:

resourceType -

setAcl

public boolean setAcl(java.lang.String resourceType,
                      Acl acl,
                      java.util.Map<java.lang.Integer,java.lang.String> subjMap,
                      boolean setInstance,
                      boolean setInstanceMode,
                      boolean setSubjects,
                      boolean setRights)

Conditionally edits the existing ACL based on the contents of the given ACL and the selected conditions.

Parameters:

resourceType - name of the resource to set the ACL for

acl - ACL definition

subjMap - a map to translate numeric subject IDs back to names; needed only when setSubjects is true and can be null all other times

setInstance - true if setting the resource instance name

setInstanceMode - true if setting the resource instance name mode

setSubjects - true if setting the subjects IDs

setRights - true if setting the rights for this ACL

Returns:

true if added, false if errors

moveAcl

public boolean moveAcl(java.lang.String resourceType,
                       java.lang.String instanceName,
                       int oid,
                       int newOid)

Moves the specified ACL to another position within the same ACL instance.

Parameters:

resourceType - name of the resource of interest

instanceName - name of the source ACL instance; empty string for the shared one

oid - ACL object ID that selects the ACL to move

newOid - new ACL object ID

Returns:

true if moved, false if errors

moveAcl

public boolean moveAcl(java.lang.String resourceType,
                       java.lang.String instanceName,
                       int oid,
                       java.lang.String newInstanceName)

Moves the specified ACL to another ACL instance, private or shared. The target instance will be created, if it doesn't exist.

Parameters:

resourceType - name of the resource of interest

instanceName - name of the source ACL instance; empty string for the shared one

oid - ACL object ID that selects the ACL to move

newInstanceName - name of the target ACL instance; empty string for the shared one

Returns:

true if moved, false if errors

deleteAcl

public boolean deleteAcl(java.lang.String resourceType,
                         java.lang.String instanceName,
                         int oid)

Deletes the specified ACL from the specified ACL instance.

Parameters:

resourceType - name of the resource of interest

instanceName - name of the source ACL instance; empty string for the shared one

oid - ACL object ID that selects the ACL to delete

Returns:

true if deleted, false if errors

cloneAcl

public boolean cloneAcl(java.lang.String resourceType,
                        java.lang.String instanceName,
                        int oid,
                        int cloneOid)

Clones the specified ACL to another position within the same ACL instance.

Parameters:

resourceType - name of the resource of interest

instanceName - name of the source ACL instance; empty string for the shared one

oid - ACL object ID that selects the ACL to clone

cloneOid - ACL object ID for the clone

Returns:

true if cloned, false if errors

resequenceAcls

public boolean resequenceAcls(java.lang.String resourceType,
                              java.lang.String instanceName,
                              int start,
                              int step)

Assigns new object IDs sequentially for all ACLs in the given ACL instance and resource type.

Parameters:

resourceType - name of the resource of interest

instanceName - name of the source ACL instance; empty string for the shared one

start - the starting number

step - the increment

Returns:

true if success, false if errors

getAccountReportsExtension

public AccountReportsExtension getAccountReportsExtension()

Account reports extension point.

Returns:

An instance of AccountReportsExtension or null if no extension is present.

checkAcl

private boolean checkAcl(java.lang.String resourceType,
                         Acl acl,
                         java.util.Map<java.lang.Integer,java.lang.String> subjMap,
                         java.lang.String[] subjects,
                         boolean setInstance,
                         boolean setSubjects,
                         boolean setRights,
                         boolean addOrSet)

Checks an ACL for validity.

Parameters:

resourceType - name of the resource to add the ACL for

acl - ACL definition

subjMap - a map to translate numeric subject IDs back to names

subjects - array to store the subject names

setInstance - true if setting the resource instance name

setSubjects - true if setting the subjects IDs

setRights - true if setting the rights for this ACL

addOrSet - true if adding new ACL, else setting existing ACL

Returns:

true if valid

checkResourceType

private int checkResourceType(java.lang.String resourceType)

Checks the resource type name for validity.

Parameters:

resourceType - resource type name

Returns:

registered resource type ordinal or -1 if no match

checkCAAlias

private boolean checkCAAlias(java.lang.String alias)

Checks certificate alias for duplication in CA domain.

Parameters:

alias - certificate alias

Returns:

true if there is no duplicate

checkPeerAlias

private boolean checkPeerAlias(java.lang.String alias)

Checks certificate alias for duplication in peer domain.

Parameters:

alias - certificate alias

Returns:

true if there is no duplicate

checkCertificate

private byte[] checkCertificate(CertDef cert)

Reassembles certificate encoding from its definition. Verifies the certificate's domain and its validity.

The domain verification is based on the presence and contents of the BasicConstraints X.509 extension, object ID 2.5.29.19. To avoid using a DER decoder, this particular case takes a shortcut, based on the knowledge of the expected result.

First, the result of the getExtensionValue() is always an OCTET STRING. Second, the BasicConstraints value is

    BasicConstraints ::= SEQUENCE {
         cA                      BOOLEAN DEFAULT FALSE,
         pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
 

Thus, the DER encoding should look like this:

• - 4 or more bytes
• - byte 0 is 0x04 typically for OCTET STRING
• - byte 1 encodes the length of the rest
• - byte 2, if present, is 0x30 for SEQUENCE
• - byte 3, if present, is a BOOLEAN cA

Parameters:

cert - certificate definition

Returns:

array of bytes of the encoded certificate or null

listCertAccounts

private TaggedName[] listCertAccounts(java.lang.String alias,
                                      int type)

Returns an array of account names with their description for accounts sharing this certificate.

Parameters:

alias - certificate alias name

type - account type

Returns:

all accounts referring to this certificate or null

currentCache

private boolean currentCache()

Creates new security cache generation offline.

Returns:

true if cache is OK

checkCache

private boolean checkCache()

Checks to see if the cache is available and stores a message if not.

Returns:

true if cache is OK

changeGroupUsersWorker

private boolean changeGroupUsersWorker(java.lang.String name,
                                       java.lang.String[] additions,
                                       java.lang.String[] deletions)

Changes the group by adding and/or removing users.

Parameters:

name - group name

additions - array of user names to be added to the group; may be empty

deletions - array of user names to be excluded from the group; may be empty

Returns:

true if successfully changed the group

syncString

private boolean syncString(java.lang.String id,
                           java.lang.String attr,
                           java.lang.String value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

syncStrings

private boolean syncStrings(java.lang.String id,
                            java.lang.String attr,
                            java.lang.String[] value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

syncBoolean

private boolean syncBoolean(java.lang.String id,
                            java.lang.String attr,
                            java.lang.Boolean value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

syncInteger

private boolean syncInteger(java.lang.String id,
                            java.lang.String attr,
                            java.lang.Integer value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

syncBytes

private boolean syncBytes(java.lang.String id,
                          java.lang.String attr,
                          byte[] value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

syncDate

private boolean syncDate(java.lang.String id,
                         java.lang.String attr,
                         DateValue value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

syncTime

private boolean syncTime(java.lang.String id,
                         java.lang.String attr,
                         TimeValue value)

Synchronizes a directory node attribute with the given value. It means setting or removing the attribute value.

Parameters:

id - object ID for a directory node

attr - node attribute name

value - attribute value to sync with; may be null

Returns:

true if successful

createGroupNode

private boolean createGroupNode(java.lang.String gid,
                                java.lang.String text,
                                int mode,
                                java.lang.String authPlugin)

Creates a group account directory object.

Parameters:

gid - object ID for the new directory object

text - group description

mode - authorization mode

authPlugin - custom authentication plugin class

Returns:

true if successful

createUserNode

private boolean createUserNode(java.lang.String uid,
                               boolean enabled,
                               java.lang.String person,
                               java.lang.String osuser,
                               int mode,
                               java.lang.String authPlugin,
                               java.lang.String alias,
                               java.lang.String[] groups,
                               boolean protect,
                               byte[] password,
                               DateValue date,
                               TimeValue time)

Creates a user account directory object.

Parameters:

uid - object ID for the new directory object

enabled - enabled/disabled status of the account

person - account owner's name; may be null

osuser - the OS user associated with the account

mode - account authentication mode

alias - related certificate's alias; may be null

groups - array of group names this account is a part of; may be null

protect - password-protected status of the account

password - password hash; may be null

date - date of the last password change; may be null

time - time of the last password change; may be null

authPlugin - custom authentication plugin class

Returns:

true if successful

createOsUserNode

private boolean createOsUserNode(java.lang.String uid,
                                 java.lang.String description,
                                 boolean enabled,
                                 byte[] password,
                                 DateValue date,
                                 TimeValue time)

Creates a OS user account directory object.

Parameters:

uid - object ID for the new directory object

description - description of the OS user

enabled - enabled/disabled status of the account

password - password hash; may be null

date - date of the last password change; may be null

time - time of the last password change; may be null

protect - protect the password

Returns:

true if successful

createProcessNode

private boolean createProcessNode(java.lang.String id,
                                  boolean enabled,
                                  java.lang.String text,
                                  java.lang.String alias,
                                  boolean server,
                                  boolean master)

Creates a process account directory object.

Parameters:

id - object ID for the new directory object

enabled - enabled/disabled status of the account

text - description

alias - process certificate alias

server - true if this process is a server, false if an application

master - true if this server process is a master server, false otherwise

Returns:

true if successful

createCertNode

private boolean createCertNode(java.lang.String id,
                               byte[] enc)

Creates a certificate directory object.

Parameters:

id - object ID for the new directory object

enc - certificate encoding

Returns:

true if successful

removeSubjectFromACLs

private boolean removeSubjectFromACLs(java.lang.String name)

Modifies all ACLs that refer to the given subject so that they no longer do. If the subject was the only one in an ACL, the ACL gets removed.

Parameters:

name - subject name to be removed from all ACLs

Returns:

true if successful

cloneSubjectInACLs

private boolean cloneSubjectInACLs(java.lang.String name,
                                   java.lang.String nameTo)

Modifies all ACLs that refer to the given subject so that they also refer to the clone.

Parameters:

name - subject name to be cloned in all ACLs

nameTo - clone name

Returns:

true if successful

enumerateACLInstances

private java.lang.String[] enumerateACLInstances()

Enumerates ACL instances defined in the directory. Instances are identified by their directory path. The shared ACL instance has the fixed path /security/acl

Returns:

array of instance names, which may be empty

enumerateACLInstances

private java.lang.String[] enumerateACLInstances(java.lang.String resourceType)

Enumerates ACL instances defined in the directory, that have ACLs defined for the specified resource type.

Instances are identified by their directory path. The shared ACL instance has the fixed path /security/acl

Returns:

array of instance names, which may be empty

enumerateACLInstancePaths

private java.lang.String[] enumerateACLInstancePaths()

Enumerates ACL instances defined in the directory. Instances are identified by their directory path. The shared ACL instance has the fixed path /security/acl

Returns:

array of directory paths, which may be empty

enumerateACLs

private int enumerateACLs(java.lang.String path,
                          java.util.Map<java.lang.Integer,java.lang.String> comb,
                          int badIds)

Enumerates ACLs under the given directory path and combines then into the given map.

Parameters:

path - directory branch to process

comb - a map to receive the IDs to object paths mappings

badIds - starting counter of bad IDs that should be incremented

Returns:

new count of bad object IDs

getAclWorker

private AclDef getAclWorker(java.lang.String resourceType,
                            java.lang.String instanceName,
                            java.lang.String mpath,
                            java.lang.String opath)

Creates an ACL definition from the ACLs for the specified resource type. Gets the ACLs for the named instance only, if requested. Otherwise combines the ACLs of the shared and private instances. Creates the oid to the directory object map for all found ACLs.

Parameters:

resourceType - name of the resource of interest

instanceName - name of the ACL instance or null meaning the effective combination is requested

mpath - mandatory directory path to the resource container; can't be null

opath - optional directory path to the resource container; must be null if instanceNamwe is given; otherwise must be specified

Returns:

ACL definition

commonParent

private java.lang.String commonParent(java.lang.String snode,
                                      java.lang.String tnode)

Calculates the common parent node for two given nodes.

Parameters:

snode - a directory node

tnode - another directory node

Returns:

common parent node, which may be just the root node "/".

message

private void message(java.lang.String[] msg)

Utility method to store server messages for later retrieval by clients.

Parameters:

msg - array of strings that constitutes a message

message

private void message(java.lang.String msg)

Utility method to store server messages for later retrieval by clients.

Parameters:

msg - a single string that constitutes a message

syncAuthSettings

private boolean syncAuthSettings(java.lang.String node,
                                 int authMode,
                                 java.lang.String authPlugin)

Synchronizes authentication-related directory node attributes with the given values. It means setting or removing the attribute values.

Parameters:

node - Object ID for a directory node.

authMode - Authentication mode to set.

authPlugin - Authentication plugin to set.

Returns:

true if successful

getExtension

private AdminAccountExtension getExtension()

Utility method to get the custom server extension interface.

Returns:

the custom server extension interface or null

checkPermission

private boolean checkPermission()

Admin permissions check routine.

Returns:

true if any admin permission is assigned

checkPermissions

private boolean checkPermissions(java.lang.String name,
                                 int[] mode)

Admin permission check routine for a specific resource instance, leaf node and permission.

Parameters:

name - resource instance name

mode - access modes (requested permission)

Returns:

true if access granted to any permission

checkPermission

private boolean checkPermission(java.lang.String name,
                                int mode)

Admin permission check routine for a specific resource instance, leaf node and permission.

Parameters:

name - resource instance name

mode - access mode (requested permission)

Returns:

true if access granted

queryPermission

private boolean queryPermission(java.lang.String name,
                                int mode)

Admin permission check routine for a specific resource instance, leaf node and permission.

Parameters:

name - resource instance name

mode - access mode (requested permission)

Returns:

true if access granted

modifySubjectsInACLs

private static boolean modifySubjectsInACLs(DirectoryService ds,
                                            java.lang.String origin,
                                            java.lang.String name,
                                            java.lang.String[] namesDel,
                                            java.lang.String[] namesAdd)

Modifies all ACLs in the specified ACL instance which refer to a given subject ID. The modification consists of the deletions and the additions of the subject IDs. Both operations are conditional - they don't fail if the state is already final.

Parameters:

ds - instance of DirectoryService to use (should be bound)

origin - directory path to the ACLs to process, f.i. /security/acl/application-specific-acls

name - subject name which works as a selector; may be null if no selection needed

namesDel - array of subject IDs to delete conditionally; may be null

namesAdd - array of subject IDs to add conditionally; may be null

Returns:

true if successful

subjects

private static void subjects(java.lang.String[] args)
                      throws ConfigurationException

ACL subjects filtering and editing utility.

Parameters:

args - args[0] - the directory file to process args[1] - the path to the ACLs args[2] - the selector name in "" args[3] - the names being deleted in "" args[4] - the names being added in ""

Throws:

ConfigurationException

migrate

private static void migrate(java.lang.String[] args)
                     throws ConfigurationException,
                            java.lang.NoSuchMethodException

ACL migration utility.

Parameters:

args - args[0] - the directory file to process args[1] - the path to the ACLs args[2] - the class name for the resource plugin

Throws:

ConfigurationException

java.lang.NoSuchMethodException

johndoe

private static void johndoe(java.lang.String[] args)
                     throws ConfigurationException,
                            java.lang.NoSuchMethodException

ACL subjects list verification utility.

Parameters:

args - args[0] - the directory file to process args[1] - the path to the ACLs args[2] - the class name for the resource plugin

Throws:

ConfigurationException

java.lang.NoSuchMethodException

resource

private static void resource(java.lang.String[] args)
                      throws ConfigurationException,
                             java.lang.NoSuchMethodException

ACL resource name verification utility.

Parameters:

args - args[0] - the directory file to process args[1] - the path to the ACLs args[2] - the class name for the resource plugin

Throws:

ConfigurationException

java.lang.NoSuchMethodException

encodeWorker

private static boolean encodeWorker(DirectoryService ds,
                                    java.lang.String attrName)

Modifies all ACLs in the specified ACL instance which refer to a given subject ID. The modification consists of the deletions and the additions of the subject IDs. Both operations are conditional - they don't fail if the state is already final.

Parameters:

ds - instance of DirectoryService to use (should be bound)

attrName - attribute name to take the plain text password from

Returns:

true if successful

encode

private static void encode(java.lang.String[] args)
                    throws ConfigurationException

User password encoding utility.

Parameters:

args - args[0] - the directory file to process args[1] - the attribute name to take plain password from

Throws:

ConfigurationException

printMessages

private static void printMessages(java.util.List<java.lang.String[]> msgBuf)

Message buffer printout

Parameters:

msgBuf - Message buffer after SecurityCache

main

public static void main(java.lang.String[] args)

Application entry point. Since more than one operation cab be performed, the operation has to be specified with the first argument.

Parameters:

args - Command line parameters. The first one specifies the utility and the rest is utility specific. The currently implemented utilities are:

• subjects - filters the ACLs by a subject and edits the list of subjects with deletions and additions
• migrate - migrates the ACLs from the old to the new style
• johndoe - verifies the accounts validity in ACLs
• resource - verifies the resource names in ACLs
• encode - encodes passwords in user accounts