Class UGSubsystem

java.lang.Object

com.netscape.cmscore.usrgrp.UGSubsystem

public class UGSubsystem
extends Object

This class defines low-level LDAP usr/grp management usr/grp information is located remotely on another LDAP server.

Version:

$Revision$, $Date$

Author:

thomask, cfu

Field Summary

Fields

Modifier and Type	Field	Description
protected static final String	GROUP_ATTR_VALUE
protected static final String	LDAP_ATTR_CERTDN
protected static final String	LDAP_ATTR_PROFILE_ID
protected static final String	LDAP_ATTR_USER_CERT
protected static final String	LDAP_ATTR_USER_CERT_STRING
static org.slf4j.Logger	logger
protected String	mBaseDN
protected static final String	MEMBER_ATTR
protected LdapBoundConnFactory	mLdapConnFactory
protected static final String	OBJECTCLASS_ATTR
static final String	SUPER_CERT_ADMINS

Constructor Summary

Constructors

Constructor	Description
UGSubsystem()	Constructs LDAP based usr/grp management

Method Summary

Modifier and Type	Method	Description
void	addGroup(Group group)	Adds a group of identities.
void	addSeeAlso(String userID, String value)
void	addUser(User user)	Adds identity.
void	addUserCert(String userID, X509Certificate cert)	adds a user certificate to user
void	addUserToGroup(Group grp, String userid)
protected Group	buildGroup(netscape.ldap.LDAPEntry entry)	builds an instance of a Group entry
protected Enumeration<Group>	buildGroups(netscape.ldap.LDAPSearchResults res)
protected User	buildUser(netscape.ldap.LDAPEntry entry)	builds a User instance.
protected Enumeration<User>	buildUsers(netscape.ldap.LDAPSearchResults res)
protected String	convertUIDtoDN(String uid)	Converts an uid attribute to a DN.
Group	createGroup(String id)
User	createUser(String id)
boolean	evaluate(String type, User id, String op, String value)	Evalutes the given context with the attribute critieria.
Group	findGroup(String filter)
Enumeration<Group>	findGroups(String filter)	Finds groups.
Enumeration<Group>	findGroupsByUser(String userDn, String filter)
User	findUser(X509Certificate cert)	Locates a user by certificate.
Enumeration<User>	findUsers(String filter)
User	findUsersByCert(String filter)	Searchs for identities that matches the certificate locater generated filter.
Enumeration<User>	findUsersByKeyword(String keyword)	Searchs for identities that matches the filter.
String	getCertificateString(X509Certificate cert)
protected String	getCertificateStringWithoutVersion(X509Certificate cert)	Converts certificate into string format.
protected netscape.ldap.LDAPConnection	getConn()
Group	getGroup(String groupDN)	Retrieves a group from LDAP NOTE - LH This takes a full LDAP DN.
Group	getGroupFromName(String name)	Retrieves a group from LDAP NOTE - this takes just the group name.
User	getUser(String userID)	Retrieves a user from LDAP
String	getUserDN(String userID)
void	init(PKISocketConfig socketConfig, UGSubsystemConfig config, IPasswordStore passwordStore)
boolean	isGroupPresent(String name)	Checks if the given group exists
protected boolean	isMatched(String dn1, String dn2)	Checks if the given DNs are the same after normalization.
boolean	isMemberOf(User id, String name)	Checks if the given user is a member of the given group (now runs an ldap search to find the user, instead of fetching the entire group entry)
boolean	isMemberOf(String userid, String groupname)
protected boolean	isMemberOfLdapGroup(String userid, String groupname)	checks if the given user DN is in the specified group by running an ldap search for the user in the group
protected User	lbuildUser(netscape.ldap.LDAPEntry entry)	builds a User instance.
protected Enumeration<User>	lbuildUsers(netscape.ldap.LDAPSearchResults res)
Enumeration<Group>	listGroups(String filter)	List groups.
Enumeration<User>	listUsers(String filter)	Searchs for identities that matches the filter.
void	modifyGroup(Group group)	Modifies an existing group in the database.
void	modifyUser(User identity)	modifies user attributes.
void	removeGroup(String name)	Removes a group.
void	removeSeeAlso(String userID, String value)
void	removeUser(String userid)	Removes identity.
void	removeUserCert(User identity)	Removes a user certificate for a user entry given a user certificate DN (actually, a combination of version, serialNumber, issuerDN, and SubjectDN), and it gets removed
void	removeUserFromGroup(Group grp, String userid)
protected void	returnConn(netscape.ldap.LDAPConnection conn)
void	shutdown()	Disconnects usr/grp manager from the LDAP

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

logger

public static org.slf4j.Logger logger

SUPER_CERT_ADMINS

public static final String SUPER_CERT_ADMINS

See Also:

• Constant Field Values

OBJECTCLASS_ATTR

protected static final String OBJECTCLASS_ATTR

See Also:

• Constant Field Values

MEMBER_ATTR

protected static final String MEMBER_ATTR

See Also:

• Constant Field Values

GROUP_ATTR_VALUE

protected static final String GROUP_ATTR_VALUE

See Also:

• Constant Field Values

LDAP_ATTR_USER_CERT_STRING

protected static final String LDAP_ATTR_USER_CERT_STRING

See Also:

• Constant Field Values

LDAP_ATTR_CERTDN

protected static final String LDAP_ATTR_CERTDN

See Also:

• Constant Field Values

LDAP_ATTR_USER_CERT

protected static final String LDAP_ATTR_USER_CERT

See Also:

• Constant Field Values

LDAP_ATTR_PROFILE_ID

protected static final String LDAP_ATTR_PROFILE_ID

See Also:

• Constant Field Values

mLdapConnFactory

protected transient LdapBoundConnFactory mLdapConnFactory

mBaseDN

protected String mBaseDN

Constructor Details

UGSubsystem

public UGSubsystem()

Constructs LDAP based usr/grp management

Method Details

init

public void init(PKISocketConfig socketConfig,
 UGSubsystemConfig config,
 IPasswordStore passwordStore)
          throws Exception

Throws:

Exception

shutdown

public void shutdown()

Disconnects usr/grp manager from the LDAP

createUser

public User createUser(String id)

createGroup

public Group createGroup(String id)

getUser

public User getUser(String userID)
             throws EUsrGrpException

Retrieves a user from LDAP

Throws:

EUsrGrpException

findUser

public User findUser(X509Certificate cert)
              throws EUsrGrpException

Locates a user by certificate.

Throws:

EUsrGrpException

findUsersByCert

public User findUsersByCert(String filter)
                     throws EUsrGrpException

Searchs for identities that matches the certificate locater generated filter.

Throws:

EUsrGrpException

findUsersByKeyword

public Enumeration<User> findUsersByKeyword(String keyword)
                                     throws EUsrGrpException

Searchs for identities that matches the filter.

Throws:

EUsrGrpException

findUsers

public Enumeration<User> findUsers(String filter)
                            throws EUsrGrpException

Throws:

EUsrGrpException

listUsers

public Enumeration<User> listUsers(String filter)
                            throws EUsrGrpException

Searchs for identities that matches the filter. retrieves uid only, for efficiency of user listing

Throws:

EUsrGrpException

lbuildUsers

protected Enumeration<User> lbuildUsers(netscape.ldap.LDAPSearchResults res)
                                 throws EUsrGrpException

Throws:

EUsrGrpException

buildUsers

protected Enumeration<User> buildUsers(netscape.ldap.LDAPSearchResults res)
                                throws EUsrGrpException

Throws:

EUsrGrpException

lbuildUser

protected User lbuildUser(netscape.ldap.LDAPEntry entry)
                   throws EUsrGrpException

builds a User instance. Sets only uid for user entry retrieved from LDAP server. for listing efficiency only.

Returns:

the User entity.

Throws:

EUsrGrpException

buildUser

protected User buildUser(netscape.ldap.LDAPEntry entry)
                  throws EUsrGrpException

builds a User instance. Set all attributes retrieved from LDAP server and set them on User.

Returns:

the User entity.

Throws:

EUsrGrpException

addUser

public void addUser(User user)
             throws EUsrGrpException

Adds identity. Certificates handled by a separate call to addUserCert()

Throws:

EUsrGrpException

addUserCert

public void addUserCert(String userID,
 X509Certificate cert)
                 throws EUsrGrpException

adds a user certificate to user

Throws:

EUsrGrpException

addSeeAlso

public void addSeeAlso(String userID,
 String value)
                throws EUsrGrpException

Throws:

EUsrGrpException

removeSeeAlso

public void removeSeeAlso(String userID,
 String value)
                   throws EUsrGrpException

Throws:

EUsrGrpException

removeUserCert

public void removeUserCert(User identity)
                    throws EUsrGrpException

Removes a user certificate for a user entry given a user certificate DN (actually, a combination of version, serialNumber, issuerDN, and SubjectDN), and it gets removed

Throws:

EUsrGrpException

addUserToGroup

public void addUserToGroup(Group grp,
 String userid)
                    throws EUsrGrpException

Throws:

EUsrGrpException

removeUserFromGroup

public void removeUserFromGroup(Group grp,
 String userid)
                         throws EUsrGrpException

Throws:

EUsrGrpException

removeUser

public void removeUser(String userid)
                throws EUsrGrpException

Removes identity.

Throws:

EUsrGrpException

modifyUser

public void modifyUser(User identity)
                throws EUsrGrpException

modifies user attributes. Certs are handled separately

Throws:

EUsrGrpException

buildGroups

protected Enumeration<Group> buildGroups(netscape.ldap.LDAPSearchResults res)
                                  throws EUsrGrpException

Throws:

EUsrGrpException

findGroups

public Enumeration<Group> findGroups(String filter)
                              throws EUsrGrpException

Finds groups.

Throws:

EUsrGrpException

findGroup

public Group findGroup(String filter)
                throws EUsrGrpException

Throws:

EUsrGrpException

listGroups

public Enumeration<Group> listGroups(String filter)
                              throws EUsrGrpException

List groups. more efficient than find Groups. only retrieves group names and description.

Throws:

EUsrGrpException

findGroupsByUser

public Enumeration<Group> findGroupsByUser(String userDn,
 String filter)
                                    throws EUsrGrpException

Throws:

EUsrGrpException

buildGroup

protected Group buildGroup(netscape.ldap.LDAPEntry entry)
                    throws EUsrGrpException

builds an instance of a Group entry

Throws:

EUsrGrpException

getGroupFromName

public Group getGroupFromName(String name)

Retrieves a group from LDAP NOTE - this takes just the group name.

getGroup

public Group getGroup(String groupDN)

Retrieves a group from LDAP NOTE - LH This takes a full LDAP DN.

isGroupPresent

public boolean isGroupPresent(String name)

Checks if the given group exists

isMemberOf

public boolean isMemberOf(String userid,
 String groupname)

isMemberOf

public boolean isMemberOf(User id,
 String name)

Checks if the given user is a member of the given group (now runs an ldap search to find the user, instead of fetching the entire group entry)

isMemberOfLdapGroup

protected boolean isMemberOfLdapGroup(String userid,
 String groupname)

checks if the given user DN is in the specified group by running an ldap search for the user in the group

addGroup

public void addGroup(Group group)
              throws EUsrGrpException

Adds a group of identities.

Throws:

EUsrGrpException

removeGroup

public void removeGroup(String name)
                 throws EUsrGrpException

Removes a group. Can't remove SUPER_CERT_ADMINS

Throws:

EUsrGrpException

modifyGroup

public void modifyGroup(Group group)
                 throws EUsrGrpException

Modifies an existing group in the database.

Parameters:

group - an existing group that has been modified in memory

Throws:

EUsrGrpException

evaluate

public boolean evaluate(String type,
 User id,
 String op,
 String value)

Evalutes the given context with the attribute critieria.

convertUIDtoDN

protected String convertUIDtoDN(String uid)
                         throws netscape.ldap.LDAPException

Converts an uid attribute to a DN.

Throws:

netscape.ldap.LDAPException

isMatched

protected boolean isMatched(String dn1,
 String dn2)

Checks if the given DNs are the same after normalization.

getCertificateStringWithoutVersion

protected String getCertificateStringWithoutVersion(X509Certificate cert)

Converts certificate into string format. should eventually go into the locator itself

getCertificateString

public String getCertificateString(X509Certificate cert)

getUserDN

public String getUserDN(String userID)

getConn

protected netscape.ldap.LDAPConnection getConn()
                                        throws ELdapException

Throws:

ELdapException

returnConn

protected void returnConn(netscape.ldap.LDAPConnection conn)