com.goldencode.p2j.security

Class SecurityManager

java.lang.Object

com.goldencode.expr.Scope

com.goldencode.p2j.security.SecurityManager

All Implemented Interfaces:

SecurityConstants

public final class SecurityManager
extends Scope
implements SecurityConstants

This class is the core of P2J security management.

Details on client authentication protocol:
Once the TLS connection is established and certificates are exchanged and verified:

• if the connection is anonymous (client didn't send certificate):
  • the client sends the AUTHTYPE packet, where the content can be either AUTH_REQ_PROCESS or AUTH_REQ_USER; if AUTHTYPE is AUTH_REQ_USER then id of the target user is send (it may be empty if it is not know at the beginning of authentication process).
  • for AUTH_REQ_PROCESS, the server immediately sets AUTH_MODE_REQ to either SUCCESS (if anonymous connections are allowed, or FAILURE otherwise;
  • the case of AUTH_REQ_USER processing continues with the next step
• the server sends the AUTHMODEREQ packet;
• the client reads the AUTHMODEREQ packet (with an authentication mode and a disposition/action code) and checks the disposition; if the disposition is either AUTH_ACTION_ABORT (on fatal error) or AUTH_ACTION_DONE (on success due to certificate based or anonymous authenticaion), the procedure is over; otherwise it continues with the next step;
• if the mode is AUTH_MODE_CUSTOM, the server should have sent and the client reads AUTHCUSTOM packet which delivers the class name and parameters of the custom authentication hook; this hook class is run (which can display any UI and interact with the user OR it may access any device/facility such as a smart card); the result is a userid and password
• if the mode is AUTH_MODE_IDPW or AUTH_MODE_X509_IDPW, then a generic client side processing is performed which reads the userid and password
• either custom or standard modes produce a byte array of authentication data which are sent in AUTHDATA packet back to server;
• server responds with AUTHRESULT packet (includes a return code and a disposition/action code) which reports either AUTH_ACTION_ABORT (on fatal failure), AUTH_ACTION_RETRY (retryable failure) or AUTH_ACTION_DONE (on success)
• on the client, any action of AUTH_ACTION_RETRY will cause the processing to repeat starting with the AUTHMODEREQ packet; note that the return code sent in the AUTHRESULT packet will be provided to the authentication plugin at that time;
• on the client, any action of AUTH_ACTION_ABORT causes the processing to halt and any action of AUTH_ACTION_DONE authentication has successfully completed, either way the processing is over;

The AUTHDATA packet for the standard modes is made of a String userID followed by char[] password. UserID is serialized using writeUTF() method. Password is serialized using writeShort() encoding the array length, plus writeChar for every character in the array.

A unique session ID is assigned to each security context upon creation. Whenever a thread is assigned to a context, it is mapped to a new ID. While the thread IDs (which are integers) could theoretically wrap, such that a thread associated with a very long running context could be assigned an ID already in use, the combination of session ID and thread ID is guaranteed always to be unique, and it is really only this combination which is meaningful for practical use.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	SecurityManager.CertificateSecurityManager Wrapper class for certificate / encryption related logic.
class	SecurityManager.ContextSecurityManager Wrapper class for Context related logic.
static interface	SecurityManager.EncryptedKeyStoreFunction An interface to expose the SecurityManager.CertificateSecurityManager.getEncryptedKeyStoreWorker(java.lang.String, java.lang.String, java.lang.String, com.goldencode.p2j.main.ServerKeyStore.Store) to threads which have proper server context.
private class	SecurityManager.HookClassLoader This class extends ClassLoader to enable the loading of a class file stored as a byte array in memory.
private class	SecurityManager.PasswordChange Implements password change that requires the privilege of running within the initial security context.
private class	SecurityManager.SecurityCacheRefresh Implements concurrent security cache refresh function.
class	SecurityManager.SessionSecurityManager Wrapper class for session related logic.
class	SecurityManager.SsoSecurityManager Wrapper class for SSO related logic.
class	SecurityManager.VirtualConnectionSecurityManager Wrapper class for virtual connection related logic.

Field Summary

Fields

Modifier and Type	Field and Description
AccountExtUtil	accountExt Container for the account ext logic.
private static int	ALWAYS_RETRY Constant used when no retries are allowed in authentication process.
private SecurityCache	cache Caches context data.
private int	cacheSerial Last used serial number for security cache creation.
SecurityManager.CertificateSecurityManager	certificateSm Wrapper for certificate related logic.
private BootstrapConfig	cfg The bootstrap configuration.
private java.util.Map<java.lang.Object,java.lang.Boolean>	cleanupLocks Map containing flags which inform other threads that cleanup for a certain context is in progress, so they should skip it.
SecurityManager.ContextSecurityManager	contextSm Wrapper for context related logic.
private boolean	init Flag to detect if we are initialized or not.
private java.util.Map<java.lang.String,java.util.concurrent.atomic.AtomicInteger>	interactiveSessions Tracks the total number of interactive sessions currently active by user account name.
private int	interactiveUsers Records the current number of user accounts which have at least one active interactive session.
LegacyWebSecurityManager	legacyWebSm Container for the legacy web security logic.
private static CentralLogger	LOG Logger.
private int	nextThreadID Next available, unique thread ID.
(package private) java.lang.Object	pwchSync Object for serializing password change requests.
private static java.lang.ThreadGroup	secThreads Thread group for all security threads.
private static SecurityManager	securityManager Reference to the singleton instance.
(package private) SecurityManagerAuthenticator	serverAuthenticator Authenticator instance.
SecurityManager.SessionSecurityManager	sessionSm Wrapper for session related logic.
SecurityManager.SsoSecurityManager	ssoSm Wrapper for SSO related logic.
private static java.lang.ThreadLocal<java.lang.Integer>	THREAD_ID The thread ID, to uniquely identify the Java Thread.
private TransportSecurity	tranSec Provides network socket security services.
private boolean	useGCM Use Galois/counter mode ciphers Disabling this mode will allow only "confidentiality only" modes (no AEAD) which can be more efficient
private java.lang.Object	userLimitLock Manages access to user limit state.
SecurityManager.VirtualConnectionSecurityManager	virtualSm Wrapper for virtual connection related logic.

Fields inherited from interface com.goldencode.p2j.security.SecurityConstants

AUTH_ACTION_ABORT, AUTH_ACTION_CONTINUE, AUTH_ACTION_DONE, AUTH_ACTION_RETRY, AUTH_MODE_CUSTOM, AUTH_MODE_HIGHEST, AUTH_MODE_IDPW, AUTH_MODE_LOWEST, AUTH_MODE_NONE, AUTH_MODE_X509, AUTH_MODE_X509_IDPW, AUTH_REQ_PROCESS, AUTH_REQ_PROGRAM, AUTH_REQ_SSO, AUTH_REQ_USER, AUTH_RESULT_INSUFFICIENT_RIGHTS, AUTH_RESULT_INVALID_PASSWORD, AUTH_RESULT_INVALID_USERID, AUTH_RESULT_NONE, AUTH_RESULT_PER_USER_SESSION_LIMIT_REACHED, AUTH_RESULT_SKIP_TO_NEXT, AUTH_RESULT_SUCCESS, AUTH_RESULT_SYSTEM_SESSION_LIMIT_REACHED, AUTH_RESULT_UNSPECIFIED_FAILURE, PKT_SIZE_SKIP_TO_NEXT

Constructor Summary

Constructors

Modifier	Constructor and Description
private	SecurityManager(BootstrapConfig bc) Private constructor to enable this as a singleton class.

Method Summary

Modifier and Type	Method and Description
private boolean	adminAccess() Checks the rights of the caller to perform admin operations.
int	adminGetCacheSerial(boolean scope) Gets the server's account name.
java.lang.String	adminGetServerName(boolean scope) Gets the server's account name.
int	adminRefresh(java.util.List<java.lang.String[]> msgBuf) Refreshes the security cache from the current state of the directory.
(package private) java.lang.Object[]	allowAccount(java.lang.String pid, java.lang.String uid, boolean iact) Check if the given account is allowed to be used by an authentication request.
AuthData	authenticateClient(NetSocket socket, BootstrapConfig config) Performs the requester side of a process or interactive client authentication.
private AuthData	authenticateClientWorker(NetSocket socket, BootstrapConfig config) Core worker for authenticateClient().
java.lang.Object	authenticateLocal(NetSocket socket) Implements the server side of the authentication procedure for processes or interactive clients.
java.lang.Object	authenticateRemote(java.lang.String identity) Verifies peer's credentials and performs remote authentication.
java.lang.Object	authenticateServer(BootstrapConfig cfg) Authenticate the current in-JVM thread using the configured certificate.
int	authenticateServer(java.lang.Object sessionId, java.lang.String userid, java.lang.String password) After this call the initial security context of the admin server will be established.
boolean	changePassword() Initiates the password change procedure, calls the configured password input hook, and changes the password for the current user when it is verified.
private boolean	checkMaxSystemUsers(SecurityCache sc, java.lang.String uid) Detect if the total number of interactive user accounts in use exceeds the allowed number of interactive users.
boolean	checkShutdownAccess() Checks access rights of the current subject with regards to the "shutdown" instance of the "system" abstract resource.
private boolean	checkUserAccountLimit(SecurityCache sc, java.lang.String uid) Detect if total number of simultaneous sessions from the given user account is more than the configured per-account limit.
static void	clearInstance() Clean the storage caches.
boolean	closeBatch(boolean disposition) Notifies the Security Manager about a batch editing session to be closed assuming the security cache to be refreshed.
boolean	closeBatch(boolean disposition, boolean refresh) Notifies the Security Manager about a batch editing session to be closed.
void	closeRightsSearch(int handle, boolean decision, boolean cache) Terminates the open search of Rights and frees up the related resources.
void	closeRightsSearch(java.lang.String subject, int handle, boolean decision) Terminates the open search of Rights and frees up the related resources.
static SecurityManager	createInstance(BootstrapConfig bc) Instantiates SecurityManager as a singleton.
java.lang.Object	evaluate(int resourceId, java.lang.Object link, java.lang.String expr) Compiles and evalautes an expression.
java.lang.String[]	filterCiphers(java.lang.String[] ciphers) Filter allowed ciphers
private Account	getAccount(java.lang.String uid) Get the account associated with the given user id.
java.lang.String	getAccountAlias(java.lang.String subjectId) Get the certificate alias for the specified subject.
java.lang.String[]	getAccountIds() Returns ALL subject IDs associated with the current context.
java.lang.String[]	getAccountIds(java.lang.String acct) Get all the subject IDs associated with the given P2J account.
java.lang.String[]	getAccountsForAppserver(java.lang.String appServer) Get the accounts configured to start the given appserver.
private static java.util.function.Predicate<AccessControlList>	getAclMatcher(AbstractResource plugin, java.lang.String instName) Returns a predicate capable to filter access control list based on the supplied plugin and resource name.
AccessControlList[]	getACLs(int resourceId) Returns the array of all ACLs defined for the specified resource type.
java.lang.String[]	getAllSubjects() Gets IDs of all defined accounts.
java.lang.String[]	getAllUsers() Gets IDs of all defined user accounts.
java.lang.String	getAppServer() Returns the the appserver associated with the current context.
java.lang.String	getAppserverForProcess(java.lang.String pid) Resolve the appserver associated with the given process ID.
java.lang.String	getBrokerForProcess(java.lang.String pid) Resolve the broker associated with the given process ID.
(package private) SecurityCache	getCache() Safely gets the reference to the security cache in a multithreaded environment.
java.lang.Boolean	getCachedDecision(int resourceId, java.lang.String instanceName, int mode) Searches the cache for a previously made decision.
(package private) BootstrapConfig	getConfig() Returns the bootstrap configuration used to construct this instance.
java.util.Map<java.lang.String,java.util.Map<java.lang.Integer,Rights>>	getConsolidatedACLs(java.lang.String type) Get a map of consolidated ACL's, per each function.
static Control	getCurrentContextControl() Gives the context local information of a currently running thread.
java.lang.String	getCustomClientExt() Gets custom client extension plugin name.
java.lang.String	getCustomServerExt() Gets custom server extension plugin name.
Scope	getEnclosingScope() Gets the parent scope for this scope.
private java.lang.String	getHookParam(SecurityCache cache, java.lang.String hookName) Get the default "option" value (specified into directory) for the given custom auth hook.
java.lang.String	getIdByOrdinal(int ordinal) Gets IDs by thier ordinals.
static SecurityManager	getInstance() Returns the reference to the instance of SecurityManager.
AbstractResource	getMandatoryPluginInstance(java.lang.String resourceTypeName) Searches abstract resource registry for a plugin that is responsible for the resources of the specified type.
Rights	getNextRights(int handle) Returns an instance of Rights interface to be used next in the access rights check loop.
Rights	getNextRights(java.lang.String subject, int handle) Returns an instance of Rights interface to be used next in the access rights check loop.
java.lang.String[]	getOsUserCredByFwdAcc(java.lang.String fwdUsername) Returns the OS username and password associated with FWD username.
java.lang.String[]	getOsUserCredByName(java.lang.String osUser) Returns the OS username and password associated with FWD username.
private java.lang.String[]	getOsUserPassFromNode(DirectoryService ds, java.lang.String parentNodeId, java.lang.String osUser) Reads the directory node where the OS user details are supposed to reside.
java.lang.String	getPeerHost() Get the peer (remote) host for this session.
int	getPeerPort() Get the peer (remote) port for this session.
private NetSocket	getPeerSocket() Get the peer (remote) socket for this session.
AbstractResource	getPluginInstance(java.lang.String resourceTypeName) Searches abstract resource registry for a plugin that is responsible for the resources of the specified type.
java.lang.String	getServerAlias() Get the certificate alias for the running sever.
java.lang.String	getServerId() Get the server account ID.
private java.util.Map<java.lang.String,java.util.Set<java.lang.Integer>>	getSubjectsByInstanceName(int resourceId) Consolidate all the subjects for each instance with defined ACLs, for the given resources.
java.lang.String	getSystemPassword(java.lang.String subjectId) Get the system user password used to authenticate this subjectId on the machine running the P2J server.
java.lang.String	getSystemUser(java.lang.String subjectId) Get the system user used to authenticate this subjectId on the machine running the P2J server.
java.lang.Integer	getThreadId() Get the identifier mapped to the current thread.
java.lang.String	getUserId() Returns the subject ID associated with the current context.
java.lang.String	getWebServerAlias() Get the certificate alias for the web sever.
private static int	hostMatch(java.lang.String host, java.util.List<java.lang.String> list) Compares the list of DNS names with the given host name.
static boolean	initialized() Returns a flag indicating the readiness of the security manager to properly operate.
boolean	isClient() Returns true if this is a client (not server) application.
boolean	isEditing() Checks to see if a batch editing is in progress.
boolean	isGroupDefined(java.lang.String uid) Checks whether the specified group account exists.
boolean	isPasswordAged() Gets password age status for the current account.
boolean	isProcessDefined(java.lang.String pid) Checks whether the specified process account exists.
boolean	isServer() Returns true if this is the server application.
boolean	isServerAccount() Checks if the current context is the server one.
boolean	isUserDefined(java.lang.String uid) Checks whether the specified user account exists.
(package private) void	logResource(SecurityCache cache, int resourceId, java.lang.String instanceName, int mode, boolean decision) Creates an audit record for a resource instance access event.
(package private) void	logResource(SecurityCache cache, int resourceId, java.lang.String instanceName, int mode, boolean decision, java.lang.String message) Creates an audit record for a resource instance access event.
private Authenticator	obtainCustomAuthHook(java.lang.String hookName) Get an instance of the in-process authentication class.
private Authenticator	obtainCustomClientHook(NetSocket dis) Gets custom authentication class and parameters from the server and runs the specified method.
int	openBatch(java.lang.String nodeId) Notifies the Security Manager about a batch editing session to be started for the specified directory branch.
int	openRightsSearch(int resourceId, java.lang.String instanceName, int mode) Creates a search handle.
int	openRightsSearch(java.lang.String subject, int resourceId, java.lang.String instanceName, int mode) Creates a search handle.
(package private) java.lang.Object[]	postAuthenticateWorker(java.lang.Object sid, java.lang.String pid, java.lang.String uid, boolean iact) Implements the server side of the authentication procedure for processes or interactive clients.
private AuthenticationResponse	runCustomServerHook(SecurityCache sc, java.lang.String targetHookName, Authenticator serverAuth, java.lang.String entity, byte[] auth) Instantiates and runs the server side of the custom authentication hook.
private boolean	sendAuthResult(NetSocket socket, int authResult, int authAction) Worker to send back the authentication result and a disposition code.
private boolean	sendAuthType(NetSocket socket, BootstrapConfig cfg) Send the client's requested authorization type on the given connection.
private void	setCache(SecurityCache cache) Safely sets the reference to the security cache in a mutithreaded environment.
void	setCleanupLock(java.lang.Object context, java.lang.Object lock) Set the context cleanup lock, to avoid concurrent cleanups.
(package private) boolean	setPassword(java.lang.String newPassword) Sets new password for the current user account.
static void	stopAfterInterrupt(Control control) Sets the context local to a control of a Conversation thread.
java.lang.String	toString() Returns the string representation of this object.
static boolean	updateCachedUserAccount(UserDef user) Find and update user account stored in cache.

Methods inherited from class com.goldencode.expr.Scope

getLibraries, getLibraryClasses, getLibsByClass, getVariableList, getVariables

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

contextSm

public final SecurityManager.ContextSecurityManager contextSm

Wrapper for context related logic.

sessionSm

public final SecurityManager.SessionSecurityManager sessionSm

Wrapper for session related logic.

certificateSm

public final SecurityManager.CertificateSecurityManager certificateSm

Wrapper for certificate related logic.

virtualSm

public final SecurityManager.VirtualConnectionSecurityManager virtualSm

Wrapper for virtual connection related logic.

ssoSm

public final SecurityManager.SsoSecurityManager ssoSm

Wrapper for SSO related logic.

legacyWebSm

public final LegacyWebSecurityManager legacyWebSm

Container for the legacy web security logic.

accountExt

public final AccountExtUtil accountExt

Container for the account ext logic.

serverAuthenticator

final SecurityManagerAuthenticator serverAuthenticator

Authenticator instance.

pwchSync

final java.lang.Object pwchSync

Object for serializing password change requests.

LOG

private static final CentralLogger LOG

Logger.

ALWAYS_RETRY

private static final int ALWAYS_RETRY

Constant used when no retries are allowed in authentication process.

See Also:

Constant Field Values

securityManager

private static SecurityManager securityManager

Reference to the singleton instance.

secThreads

private static java.lang.ThreadGroup secThreads

Thread group for all security threads.

cfg

private BootstrapConfig cfg

The bootstrap configuration.

cache

private SecurityCache cache

Caches context data.

cacheSerial

private int cacheSerial

Last used serial number for security cache creation.

tranSec

private TransportSecurity tranSec

Provides network socket security services.

nextThreadID

private int nextThreadID

Next available, unique thread ID.

THREAD_ID

private static final java.lang.ThreadLocal<java.lang.Integer> THREAD_ID

The thread ID, to uniquely identify the Java Thread.

init

private boolean init

Flag to detect if we are initialized or not.

interactiveUsers

private int interactiveUsers

Records the current number of user accounts which have at least one active interactive session.

interactiveSessions

private java.util.Map<java.lang.String,java.util.concurrent.atomic.AtomicInteger> interactiveSessions

Tracks the total number of interactive sessions currently active by user account name.

userLimitLock

private java.lang.Object userLimitLock

Manages access to user limit state.

cleanupLocks

private java.util.Map<java.lang.Object,java.lang.Boolean> cleanupLocks

Map containing flags which inform other threads that cleanup for a certain context is in progress, so they should skip it.

useGCM

private final boolean useGCM

Use Galois/counter mode ciphers Disabling this mode will allow only "confidentiality only" modes (no AEAD) which can be more efficient

Constructor Detail

SecurityManager

private SecurityManager(BootstrapConfig bc)
                 throws ConfigurationException,
                        java.lang.NoSuchMethodException

Private constructor to enable this as a singleton class. Instantiation occurs via createInstance(com.goldencode.p2j.cfg.BootstrapConfig).

Parameters:

bc - an instance of BootstrapConfig class used to get the security related configuration information

Throws:

ConfigurationException - may be thrown in SecurityCache

java.lang.NoSuchMethodException - may be thrown in SecurityCache

Method Detail

clearInstance

public static void clearInstance()
                          throws RestrictedUseException

Clean the storage caches.

Throws:

RestrictedUseException - If called outside of expected code.

createInstance

public static SecurityManager createInstance(BootstrapConfig bc)
                                      throws ConfigurationException,
                                             java.lang.NoSuchMethodException

Instantiates SecurityManager as a singleton.

Parameters:

bc - an instance of BootstrapConfig class used to get the security related configuration information

Returns:

instance of SecurityManager

Throws:

ConfigurationException - may be thrown in SecurityManager constructor

java.lang.NoSuchMethodException - may be thrown in SecurityCache

getInstance

public static SecurityManager getInstance()

Returns the reference to the instance of SecurityManager.

Returns:

instance of SecurityManager

initialized

public static boolean initialized()

Returns a flag indicating the readiness of the security manager to properly operate.

Returns:

true if the security manager is ready to accept requests.

updateCachedUserAccount

public static boolean updateCachedUserAccount(UserDef user)
                                       throws RestrictedUseException

Find and update user account stored in cache.

Parameters:

user - User account parameters.

Returns:

true if account is found and updated. false if account not found.

Throws:

RestrictedUseException - If called improperly.

getCurrentContextControl

public static Control getCurrentContextControl()
                                        throws RestrictedUseException

Gives the context local information of a currently running thread.

Returns:

Context local information.

Throws:

RestrictedUseException - If called improperly.

stopAfterInterrupt

public static void stopAfterInterrupt(Control control)
                               throws RestrictedUseException

Sets the context local to a control of a Conversation thread.

Parameters:

control - Control related to a Conversation thread.

Throws:

RestrictedUseException - If called improperly.

getCustomServerExt

public java.lang.String getCustomServerExt()

Gets custom server extension plugin name.

Returns:

custom server extension plugin name

getCustomClientExt

public java.lang.String getCustomClientExt()

Gets custom client extension plugin name.

Returns:

custom client extension plugin name

hostMatch

private static int hostMatch(java.lang.String host,
                             java.util.List<java.lang.String> list)

Compares the list of DNS names with the given host name. Leftmost * in DNS names like *.tld matches any.name.tld. Comparison is case insensitive.

Parameters:

host - name to check

list - list of names

Returns:

index of matching name in the list or -1 of no matches found

obtainCustomAuthHook

private Authenticator obtainCustomAuthHook(java.lang.String hookName)

Get an instance of the in-process authentication class.

Returns:

The instance of the custom client authentication hook.

obtainCustomClientHook

private Authenticator obtainCustomClientHook(NetSocket dis)

Gets custom authentication class and parameters from the server and runs the specified method.

The AUTHCUSTOM packet is two consecutive strings written using the writeUTF() method. The first is the class name, followed by the parameters. The no parameter case is handled as if it was an empty string.

Parameters:

dis - The input stream to read from.

Returns:

The instance of the custom client authentication hook.

adminGetServerName

public java.lang.String adminGetServerName(boolean scope)

Gets the server's account name. This is an admin API support method.

Parameters:

scope - true means using the latest security cache, otherwise the session security cache

Returns:

server's name or null

adminGetCacheSerial

public int adminGetCacheSerial(boolean scope)

Gets the server's account name. This is an admin API support method.

Parameters:

scope - true means using the latest security cache, otherwise the session security cache

Returns:

security cache generation serial number

adminRefresh

public int adminRefresh(java.util.List<java.lang.String[]> msgBuf)

Refreshes the security cache from the current state of the directory. This is an admin API support method.

Parameters:

msgBuf - list to receive messages if logmode enables admin messages

Returns:

The security cache generation serial number.

getEnclosingScope

public final Scope getEnclosingScope()

Gets the parent scope for this scope. Security Manager's scope has no parent.

Specified by:

getEnclosingScope in class Scope

Returns:

parent Scope object, which is null.

setCleanupLock

public void setCleanupLock(java.lang.Object context,
                           java.lang.Object lock)

Set the context cleanup lock, to avoid concurrent cleanups.

Parameters:

context - The SecurityContext instance to configure.

lock - The instance on which to lock for context cleanup.

authenticateClient

public AuthData authenticateClient(NetSocket socket,
                                   BootstrapConfig config)
                            throws RestrictedUseException

Performs the requester side of a process or interactive client authentication. Based on configuration, this method can validate the server's certificate.

If required, the server's X.509 certificate is validated first. If this does not fail, its DNS name is checked as defined in RFC2830, p3.6:

• if the certificate contains subjectAlternateNames of type dNSName, the set of those names is taken;
• otherwise, the CN (common name) portion of the subject's DN is taken
• the resulting set of names is compared against the hostname used in establishing the TLS connection
• '*' can be used as the leftmost component of the DNS name; it matches any name in that position

If the DNS name check fails, an alternative check is done: the server's certificate is compared with the certificate pointed to by the truststore alias. The comparison is done for encoded certificates and they have to be identical.

The next and last step is the client authentication procedure.

Restricted use. This method checks the caller to be com.goldencode.p2j.net.SessionManager.createQueue().

Parameters:

socket - The socket identifying this connection.

config - BootstrapConfig instance which should override the security manager's version; null to use default config.

Returns:

The data used to authenticate, or null if authentication failed.

Throws:

RestrictedUseException - If called improperly.

authenticateClientWorker

private AuthData authenticateClientWorker(NetSocket socket,
                                          BootstrapConfig config)

Core worker for authenticateClient(). Temporarily uses the provided configuration instance.

Parameters:

socket - The socket identifying this connection.

config - BootstrapConfig instance which should override the security Can't be null.

Returns:

The data used to authenticate, or null if authentication failed.

authenticateLocal

public java.lang.Object authenticateLocal(NetSocket socket)
                                   throws RestrictedUseException

Implements the server side of the authentication procedure for processes or interactive clients. Optionally verifies client's credentials.

Restricted use. This method checks the caller to be com.goldencode.p2j.net.RouterSessionManager$Incoming.run().

There are two major classes of connections: certified and anonymous.

Parameters:

socket - Socket identifying this connection.

Returns:

Reference to an object serving as the session key if authenticated, otherwise either null for failures or a string describing normal client exit from authentication.

Throws:

RestrictedUseException - If called improperly.

authenticateServer

public java.lang.Object authenticateServer(BootstrapConfig cfg)
                                    throws RestrictedUseException

Authenticate the current in-JVM thread using the configured certificate.

Parameters:

cfg - The configuration.

Returns:

The newly created context or null if authentication failed.

Throws:

RestrictedUseException - If this method is called from restricted context

authenticateServer

public int authenticateServer(java.lang.Object sessionId,
                              java.lang.String userid,
                              java.lang.String password)
                       throws RestrictedUseException

After this call the initial security context of the admin server will be established.

Parameters:

sessionId - The session id

userid - The user id

password - The password

Returns:

The code of the authorization result

Throws:

RestrictedUseException - If this method is called from restricted context

getOsUserCredByFwdAcc

public java.lang.String[] getOsUserCredByFwdAcc(java.lang.String fwdUsername)

Returns the OS username and password associated with FWD username. If fwd user has attribute osUser, try to locate the OS user in directory. OS user nodes can have an optional attr `password`.

Parameters:

fwdUsername - The FWD account.

Returns:

Null or string array containing OS user at first position and OS pass at second.

getOsUserCredByName

public java.lang.String[] getOsUserCredByName(java.lang.String osUser)

Returns the OS username and password associated with FWD username. If fwd user has attribute osUser, try to locate the OS user in directory. OS user nodes can have an optional attr `password`.

Parameters:

osUser - The OS username.

Returns:

Null or string array containing OS user at first position and OS pass at second.

getOsUserPassFromNode

private java.lang.String[] getOsUserPassFromNode(DirectoryService ds,
                                                 java.lang.String parentNodeId,
                                                 java.lang.String osUser)

Reads the directory node where the OS user details are supposed to reside. If valid osuser node is not found, returns null. Otherwise, returns an array with user ID at position 0 and user pass at position 1.

Parameters:

ds - The directory service.

parentNodeId - The parent directory node.

osUser - The OS user ID.

Returns:

Null, if the OS user not found, or string array containing OS user ID at first position and OS user pass at second.

getServerId

public java.lang.String getServerId()

Get the server account ID.

Returns:

See above.

getUserId

public java.lang.String getUserId()

Returns the subject ID associated with the current context.

The subject ID returned is either userID, or processId, if no user is logged on.

Returns:

subject ID or "" if nothing is established

getAppServer

public java.lang.String getAppServer()

Returns the the appserver associated with the current context.

If no appserver is associated with the current context, it returns null

Returns:

See above.

getPeerHost

public java.lang.String getPeerHost()

Get the peer (remote) host for this session.

Returns:

See above.

getPeerPort

public int getPeerPort()

Get the peer (remote) port for this session.

Returns:

See above.

getServerAlias

public java.lang.String getServerAlias()

Get the certificate alias for the running sever.

Returns:

The server's alias or null if not called on a server thread.

getWebServerAlias

public java.lang.String getWebServerAlias()

Get the certificate alias for the web sever.

Returns:

The web server's alias or null if not called on a server thread.

getAccountAlias

public java.lang.String getAccountAlias(java.lang.String subjectId)

Get the certificate alias for the specified subject. May be null.

Returns:

See above.

getSystemUser

public java.lang.String getSystemUser(java.lang.String subjectId)

Get the system user used to authenticate this subjectId on the machine running the P2J server. The search is done using the subject ID, not the context's subject; both the per-server and per-account configurations are searched (using Utils.DirScope.BOTH.

If none configured, default to the subject ID.

Parameters:

subjectId - The subject ID.

Returns:

See above.

getSystemPassword

public java.lang.String getSystemPassword(java.lang.String subjectId)

Get the system user password used to authenticate this subjectId on the machine running the P2J server. The search is done using the subject ID, not the context's subject; both the per-server and per-account configurations are searched (using Utils.DirScope.BOTH.

If none configured, default to null.

Parameters:

subjectId - The subject ID.

Returns:

See above.

getThreadId

public java.lang.Integer getThreadId()

Get the identifier mapped to the current thread. This is only meaningful for a given unit of work, since threads generally are recycled into a thread pool (and their thread ID unmapped) when their unit of work is done.

Returns:

Current thread's ID.

getAccountIds

public java.lang.String[] getAccountIds(java.lang.String acct)

Get all the subject IDs associated with the given P2J account. For user accounts, this includes the passed account and any associated groups. For all others, just return the passed account.

Parameters:

acct - The P2J subject ID.

Returns:

A list with all the associated subject IDs.

getAccountIds

public java.lang.String[] getAccountIds()

Returns ALL subject IDs associated with the current context.

The first subject ID in the array is either a userID or a processId (if no user is logged on). All subsequent subject IDs are the list of group names. Note that as long as there is a security context, there will be at least 1 subject ID. The group subject IDs will only be there if the user or process belongs to 1 or more groups.

Returns:

The array of subject IDs or an empty array (length == 0) if no security context exists.

authenticateRemote

public java.lang.Object authenticateRemote(java.lang.String identity)
                                    throws RestrictedUseException

Verifies peer's credentials and performs remote authentication.

Restricted use. This method checks the caller to be com.goldencode.p2j.net.RouterSessionManager.authenticateRemote().

Parameters:

identity - remote application/client identity in the form "processID/userID"

Returns:

reference to an object serving as a key if authenticated, otherwise null

Throws:

RestrictedUseException - if called improperly

getPluginInstance

public AbstractResource getPluginInstance(java.lang.String resourceTypeName)

Searches abstract resource registry for a plugin that is responsible for the resources of the specified type.

Note that the security cache has to be taken from the security context of the thread, since in the current cache the resource plugin can be either registered under different ID or even be dropped.

Parameters:

resourceTypeName - resource type name

Returns:

AbstractResource object

getMandatoryPluginInstance

public AbstractResource getMandatoryPluginInstance(java.lang.String resourceTypeName)

Searches abstract resource registry for a plugin that is responsible for the resources of the specified type.

Note that the security cache has to be taken from the security context of the thread, since in the current cache the resource plugin can be either registered under different ID or even be dropped.

Parameters:

resourceTypeName - resource type name

Returns:

AbstractResource object, never null.

Throws:

java.lang.IllegalStateException - when the requested plugin is not available.

getCachedDecision

public java.lang.Boolean getCachedDecision(int resourceId,
                                           java.lang.String instanceName,
                                           int mode)

Searches the cache for a previously made decision.

Plugins call this method to check whether a cached access check decision is available. Cached access check decisions are identified by triplets of {resourceId, instanceName, mode} exactly as they were specified when the decision was taken.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

resourceId - resource identity

instanceName - resource instance name

mode - access mode (requested rights) the decision was made about

Returns:

Boolean that wraps a decision, or null if not available.

openRightsSearch

public int openRightsSearch(int resourceId,
                            java.lang.String instanceName,
                            int mode)

Creates a search handle.

Plugins call this method to initiate the access rights search for the specified resource instance and requested rights.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

resourceId - The resource identity.

instanceName - The resource instance name.

mode - The access mode (requested rights) the decision was made about.

Returns:

The integer handle value for the new search.

getAclMatcher

private static java.util.function.Predicate<AccessControlList> getAclMatcher(AbstractResource plugin,
                                                                             java.lang.String instName)

Returns a predicate capable to filter access control list based on the supplied plugin and resource name. The method calls AbstractResource.getACLMatcher() to retrieve a predicate, which is then used to filter matching ACLs. If no predicate is returned by the supplied plugin a default matching mechanism will be used as a fallback. The standard matching mechanism involves simple string comparison of the supplied resource name and the resource name defined in the ACLs.

Parameters:

plugin - A valid security plugin. Must not be null.

instName - Resource instance name.

Returns:

An ACL predicate.

getNextRights

public Rights getNextRights(int handle)

Returns an instance of Rights interface to be used next in the access rights check loop.

Plugins cast Rights to their own classes and use their custom methods to perform the check.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

handle - search handle

Returns:

next available instance of Rights

closeRightsSearch

public void closeRightsSearch(int handle,
                              boolean decision,
                              boolean cache)

Terminates the open search of Rights and frees up the related resources.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

handle - search handle

decision - true or false decision just made

cache - true if the decision has to be cached

openRightsSearch

public int openRightsSearch(java.lang.String subject,
                            int resourceId,
                            java.lang.String instanceName,
                            int mode)

Creates a search handle. This search handle is a temporary search, created within the context of the currently authenticated subject. This is used for cases when the current user needs to determine the actual permissions for another subject, different then the authenticated one.

Plugins call this method to initiate the access rights search for the specified resource instance and requested rights.

Note that the security cache has to be taken from the security context of the thread.

The search handle is created for the specified subject.

Parameters:

subject - subject ID to which this search belongs.

resourceId - resource identity

instanceName - resource instance name

mode - access mode (requested rights) the decision was made about

Returns:

integer handle value for the new search

getNextRights

public Rights getNextRights(java.lang.String subject,
                            int handle)

Returns an instance of Rights interface to be used next in the access rights check loop. This search handle is a temporary search, created within the context of the currently authenticated subject. This is used for cases when the current user needs to determine the actual permissions for another subject, different then the authenticated one.

Plugins cast Rights to their own classes and use their custom methods to perform the check.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

subject - subject ID to which the search handle belongs.

handle - search handle

Returns:

next available instance of Rights

closeRightsSearch

public void closeRightsSearch(java.lang.String subject,
                              int handle,
                              boolean decision)

Terminates the open search of Rights and frees up the related resources.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

subject - subject ID to which the search handle belongs.

handle - search handle

decision - true or false decision just made

evaluate

public java.lang.Object evaluate(int resourceId,
                                 java.lang.Object link,
                                 java.lang.String expr)

Compiles and evalautes an expression.

The expression may refer to Security Manager's variables and functions and to the plugin's variables and functions, should one decide to expose any.

The current implementation arbitrates names clashes using natural scoping provided by Expression Engine, which can be modified by using qualifiers in the expression.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

resourceId - resource identity

link - an Object that supplies the raw data for this computation and is shared between the resource plugin and its library of exports

expr - expression to compile and evaluate

Returns:

the result. If expression compilation fails, null is returned

openBatch

public int openBatch(java.lang.String nodeId)

Notifies the Security Manager about a batch editing session to be started for the specified directory branch. If the branch is either /security or any of its branches, notes the state of batch editing.

Restricted use. This method checks the caller to be:

• method openBatch in com.goldencode.p2j.directory.DirectoryService

DirectoryService calls this method before it opens a batch. This method checks the subject's access rights to the "system", "change" instance, if the batch is for any branch of "/security".

The action is different for master servers versus regular ones. Only master servers are allowed to edit the P2J security directory. Regular servers cannot edit, but still need this call as a way of refreshing their internal caches.

Note that the security cache has to be taken from the security context of the thread.

Parameters:

nodeId - Subtree which will be edited.

Returns:

One of the following codes:

• -1 if the subject has no rights to open batch or another batch is currently open
• 0 if the batch can be opened
• 1 if the batch can be opened R/O; not a master server

isEditing

public boolean isEditing()

Checks to see if a batch editing is in progress.

Restricted use. This method checks the caller to be:

• method isEditing in com.goldencode.p2j.directory.DirectoryService

Returns:

true if there is an open editing batch

closeBatch

public boolean closeBatch(boolean disposition)

Notifies the Security Manager about a batch editing session to be closed assuming the security cache to be refreshed.

DirectoryService calls this method after having successfully commited the changes to the directory (disposition is true) or to signal rollback.

Restricted use. This method checks the caller to be:

• method closeBatchInt in com.goldencode.p2j.directory.DirectoryService

Parameters:

disposition - If this parameter is true then changes need to be committed. Otherwise they are just thrown away and lock is removed.

Returns:

true if operation was successful and tree was successfully updated.

closeBatch

public boolean closeBatch(boolean disposition,
                          boolean refresh)

Notifies the Security Manager about a batch editing session to be closed.

DirectoryService calls this method after having successfully commited the changes to the directory (disposition is true) or to signal rollback.

Restricted use. This method checks the caller to be:

• method closeBatchInt in com.goldencode.p2j.directory.DirectoryService

Parameters:

disposition - If this parameter is true then changes need to be committed. Otherwise they are just thrown away and lock is removed.

refresh - when committing the batch, tells whether to refresh the security cache or not

Returns:

true if operation was successful and tree was successfully updated.

checkShutdownAccess

public boolean checkShutdownAccess()

Checks access rights of the current subject with regards to the "shutdown" instance of the "system" abstract resource.

Returns:

true if access is allowed.

isServerAccount

public boolean isServerAccount()

Checks if the current context is the server one.

Note that the value returned by this method is sometimes different that isServer(). This is because isServer() will return true on all contexts created on P2J server application, while this method will return false for eventual client contexts additionally created inside the process (like an appserver Agent class instance entity).

Returns:

true only when called on server account context.

isServer

public boolean isServer()

Returns true if this is the server application.

Ultimately, this method checks the type attribute of the root node of the bootstrap configuration file. If the current process was launched using a server value, then this method returns true.

Returns:

true if current process is the P2J server application.

isClient

public boolean isClient()

Returns true if this is a client (not server) application. This is the complementary of the above method.

Returns:

true if on the client.

isUserDefined

public boolean isUserDefined(java.lang.String uid)

Checks whether the specified user account exists.

Parameters:

uid - user ID

Returns:

true if such user account exists

isProcessDefined

public boolean isProcessDefined(java.lang.String pid)

Checks whether the specified process account exists.

Parameters:

pid - process ID

Returns:

true if such process account exists

getAppserverForProcess

public java.lang.String getAppserverForProcess(java.lang.String pid)

Resolve the appserver associated with the given process ID.

Parameters:

pid - The process ID.

Returns:

The appserver or null if the passed ID is not for a process or there is no associated appserver for the process.

getBrokerForProcess

public java.lang.String getBrokerForProcess(java.lang.String pid)

Resolve the broker associated with the given process ID.

Parameters:

pid - The process ID.

Returns:

The broker or null if the passed ID is not for a process or there is no associated broker for the process.

isGroupDefined

public boolean isGroupDefined(java.lang.String uid)

Checks whether the specified group account exists.

Parameters:

uid - group ID

Returns:

true is such group account exists

getAccountsForAppserver

public java.lang.String[] getAccountsForAppserver(java.lang.String appServer)

Get the accounts configured to start the given appserver. If the appServer is null, this will return an array of length 0.

Parameters:

appServer - The appserver for which the accounts are needed.

Returns:

The accounts configured for this appServer, if any.

getAllUsers

public java.lang.String[] getAllUsers()

Gets IDs of all defined user accounts.

Returns:

array of all defined user IDs

getAllSubjects

public java.lang.String[] getAllSubjects()

Gets IDs of all defined accounts.

Returns:

array of all defined subject IDs

getIdByOrdinal

public java.lang.String getIdByOrdinal(int ordinal)

Gets IDs by thier ordinals.

Parameters:

ordinal - ordinal number of some subject ID

Returns:

a subject ID that corresponds to the ordinal number given.

getACLs

public AccessControlList[] getACLs(int resourceId)

Returns the array of all ACLs defined for the specified resource type.

Parameters:

resourceId - resource identity

Returns:

array of AccessControlLists. The array is empty if the caller has no access rights to the system/accounts resource instance.

getConsolidatedACLs

public java.util.Map<java.lang.String,java.util.Map<java.lang.Integer,Rights>> getConsolidatedACLs(java.lang.String type)

Get a map of consolidated ACL's, per each function. For each function name there will be a map of subject indexes to their permissions.

Parameters:

type - The resource type name for which the consolidated ACLs are needed

Returns:

a map of consolidated ACL's, for the specified resource type.

getSubjectsByInstanceName

private java.util.Map<java.lang.String,java.util.Set<java.lang.Integer>> getSubjectsByInstanceName(int resourceId)

Consolidate all the subjects for each instance with defined ACLs, for the given resources.

Parameters:

resourceId - resource identity

Returns:

a map which holds a set of subjects for each resource instance

changePassword

public boolean changePassword()

Initiates the password change procedure, calls the configured password input hook, and changes the password for the current user when it is verified.

Returns:

true if password has been changed successfully.

isPasswordAged

public boolean isPasswordAged()

Gets password age status for the current account.

Returns:

true if this password is too old and needs changing

toString

public java.lang.String toString()

Returns the string representation of this object.

Overrides:

toString in class java.lang.Object

Returns:

string describing this object

getCache

SecurityCache getCache()

Safely gets the reference to the security cache in a multithreaded environment.

Returns:

reference to the curent copy of SecurityCache

getConfig

BootstrapConfig getConfig()

Returns the bootstrap configuration used to construct this instance.

Returns:

instance of BootstrapConfig associated with this object

adminAccess

private boolean adminAccess()

Checks the rights of the caller to perform admin operations.

Returns:

true if the caller has sufficient rights

getAccount

private Account getAccount(java.lang.String uid)

Get the account associated with the given user id.

Parameters:

uid - user ID

Returns:

The account, if it exists, and the caller has sufficient rights to retrieve it, else null

logResource

void logResource(SecurityCache cache,
                 int resourceId,
                 java.lang.String instanceName,
                 int mode,
                 boolean decision,
                 java.lang.String message)

Creates an audit record for a resource instance access event.

Parameters:

cache - security cache where to log this event

resourceId - resource identity

instanceName - resource instance name

mode - access mode (requested rights) the decision was made about

decision - access decision

message - additional text

logResource

void logResource(SecurityCache cache,
                 int resourceId,
                 java.lang.String instanceName,
                 int mode,
                 boolean decision)

Creates an audit record for a resource instance access event.

Parameters:

cache - security cache where to log this event

resourceId - resource identity

instanceName - resource instance name

mode - access mode (requested rights) the decision was made about

decision - access decision

setPassword

boolean setPassword(java.lang.String newPassword)

Sets new password for the current user account.

Parameters:

newPassword - new password as plain text

Returns:

true if password has been set successfully

sendAuthType

private boolean sendAuthType(NetSocket socket,
                             BootstrapConfig cfg)

Send the client's requested authorization type on the given connection.

This method inspects the bootstrap configuration to see what kind of authentication to pick:

• security.keystore.processalias is set; AUTH_REQ_PROCESS will be sent.
• security.keystore.processalias is not set, but security.authentication.type is set and equals PROGRAM; AUTH_REQ_PROGRAM will be sent.
• otherwise AUTH_REQ_USER will be sent.

Parameters:

socket - The socket on which to write our type.

cfg - The attempted connection's configuration.

Returns:

true if successful

setCache

private void setCache(SecurityCache cache)

Safely sets the reference to the security cache in a mutithreaded environment.

In the multithreaded environment, after the closing of a batch editing session, a newly created thread rereads the directory and builds a new instance of SecurityCache while the existing one continues to serve the needs of the server. This call is the last step in the refreshing of the security cache.

Parameters:

cache - reference to a copy of SecurityCache

runCustomServerHook

private AuthenticationResponse runCustomServerHook(SecurityCache sc,
                                                   java.lang.String targetHookName,
                                                   Authenticator serverAuth,
                                                   java.lang.String entity,
                                                   byte[] auth)

Instantiates and runs the server side of the custom authentication hook.

Accepts the byte array produced by the client side authorization hook as the authentication input, and custom parameters.

Parameters:

sc - The security cache generation to be used.

targetHookName - The name of the custom auth hook to run as it is represented into the directory. Cannot be null.

serverAuth - The instance of the server hook or null to obtain the default processing.

entity - Custom parameters.

auth - The authorization input from the client.

Returns:

The result of the authentication processing.

filterCiphers

public java.lang.String[] filterCiphers(java.lang.String[] ciphers)

Filter allowed ciphers

Parameters:

ciphers - available ciphers

Returns:

filtered cipers.

sendAuthResult

private boolean sendAuthResult(NetSocket socket,
                               int authResult,
                               int authAction)

Worker to send back the authentication result and a disposition code.

Parameters:

socket - The socket to send on.

authResult - The authentication result.

authAction - The authentication disposition code.

Returns:

true if sent successfully.

getHookParam

private java.lang.String getHookParam(SecurityCache cache,
                                      java.lang.String hookName)

Get the default "option" value (specified into directory) for the given custom auth hook.

Parameters:

cache - The security cache generation to be used.

hookName - The name of the target custom hook.

Returns:

the "option" value for the given custom auth hook.

allowAccount

java.lang.Object[] allowAccount(java.lang.String pid,
                                java.lang.String uid,
                                boolean iact)

Check if the given account is allowed to be used by an authentication request.

Parameters:

pid - The local process account being authenticated.

uid - The local user account being authenticated.

iact - true if this is a call that can be an interactive user session.

Returns:

If the account is allowed to be used, it will return null. Otherwise, it returns an Object[5] array with the indexes: 0 = auth result (see SecurityConstants.AUTH_RESULT*), 1 = auth action (see SecurityConstants.AUTH_ACTION*), 2 = not used 3 = not used 4 = not used

postAuthenticateWorker

java.lang.Object[] postAuthenticateWorker(java.lang.Object sid,
                                          java.lang.String pid,
                                          java.lang.String uid,
                                          boolean iact)
                                   throws RestrictedUseException

Implements the server side of the authentication procedure for processes or interactive clients. The method validates the process and user accounts, creates new security context, creates new session and check access rights to the system/logon resource.

Parameters:

sid - The new session id.

pid - The local process account being authenticated.

uid - The local user account being authenticated.

iact - true if this is a call that can be an interactive user session.

Returns:

an Object[5] array with the indexes: 0 = auth result (see SecurityConstants.AUTH_RESULT*), 1 = auth action (see SecurityConstants.AUTH_ACTION*), 2 = app server name associated with the supplied process account, 3 = the created security context, 4 = the created session.

Throws:

RestrictedUseException

checkUserAccountLimit

private boolean checkUserAccountLimit(SecurityCache sc,
                                      java.lang.String uid)

Detect if total number of simultaneous sessions from the given user account is more than the configured per-account limit.

Parameters:

sc - The current security cache.

uid - The userid of the interactive account

Returns:

true if a user limit is NOT exceeded.

checkMaxSystemUsers

private boolean checkMaxSystemUsers(SecurityCache sc,
                                    java.lang.String uid)

Detect if the total number of interactive user accounts in use exceeds the allowed number of interactive users.

Parameters:

sc - The current security cache.

uid - The userid of the interactive account

Returns:

true if the max user limit is NOT exceeded.

getPeerSocket

private NetSocket getPeerSocket()

Get the peer (remote) socket for this session.

Returns:

See above.