org.yamcs.security

Class Privilege

java.lang.Object

org.yamcs.security.Privilege

public class Privilege
extends Object

Implements privileges loaded and short-term cached from realm. Extending classes provide concrete method to identify the user, which this class then uses to load privileges. This class also provides methods to extract a username from a supplied certificate. Requests are usually made in short bursts, so privileges loaded from realm are cached for a short period to reduce load on the realm service and retain responsiveness.

Author:

nm

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	Privilege.SystemPrivilege
static class	Privilege.Type

Field Summary

Fields

Modifier and Type	Field and Description
static Privilege	instance
static int	maxNoSessions
static boolean	usePrivileges

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	Privilege() loads the configuration of the privilege.

Method Summary

Modifier and Type	Method and Description
CompletableFuture<AuthenticationToken>	authenticateHttp(io.netty.channel.ChannelHandlerContext ctx, io.netty.handler.codec.http.FullHttpRequest req)
org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager	getArtemisAuthModule()
AuthModule	getAuthModule()
static String	getAuthModuleName()
static String	getDefaultUser() Returns the default user if this server is unsecured.
static Privilege	getInstance()
int	getMaxNoSessions()
String[]	getRoles(AuthenticationToken authenticationToken)
Collection<String>	getTmPacketNames(String yamcsInstance, AuthenticationToken authToken, String namespace) Get packet names this user has appropriate privileges for.
Collection<String>	getTmParameterNames(String yamcsInstance, AuthenticationToken authToken, String namespace) Get parameter names this user has appropriate privileges for.
User	getUser(AuthenticationToken authToken)
String	getUsername(AuthenticationToken authToken)
boolean	hasPrivilege(AuthenticationToken authenticationToken, Privilege.SystemPrivilege privilege)
boolean	hasPrivilege(AuthenticationToken authenticationToken, Privilege.Type type, String privilege)
boolean	hasPrivilege1(AuthenticationToken authToken, Privilege.SystemPrivilege sysPrivilege) Like above but instead of throwing InvalidAuthenticationToken, it returns false if the token is not valid.
boolean	hasPrivilege1(AuthenticationToken authenticationToken, Privilege.Type type, String privilege) Like the method above but instead of throwing InvalidAuthenticationToken, it returns false in case the token is not valid.
boolean	hasRole(AuthenticationToken authenticationToken, String role) Convenience method, check if user has specific role.
boolean	isEnabled()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

usePrivileges

public static boolean usePrivileges

maxNoSessions

public static int maxNoSessions

instance

public static Privilege instance

Constructor Detail

Privilege

protected Privilege()
             throws ConfigurationException

loads the configuration of the privilege. If privileges.enabled is not set to false in the privileges.properties, then load the privileges from the LDAP.

Throws:

ConfigurationException - when the privileges.enabled is not set to false and the ldap parammeters are not present

Method Detail

getRoles

public String[] getRoles(AuthenticationToken authenticationToken)
                  throws InvalidAuthenticationToken

Throws:

InvalidAuthenticationToken

getInstance

public static Privilege getInstance()

isEnabled

public boolean isEnabled()

Returns:

true if privileges are enabled

hasRole

public boolean hasRole(AuthenticationToken authenticationToken,
                       String role)
                throws InvalidAuthenticationToken

Convenience method, check if user has specific role.

Parameters:

authenticationToken -

role - Title or full dn.

Returns:

True if usePrivileges enabled and user has role, false otherwise.

Throws:

InvalidAuthenticationToken

hasPrivilege

public boolean hasPrivilege(AuthenticationToken authenticationToken,
                            Privilege.Type type,
                            String privilege)
                     throws InvalidAuthenticationToken

Parameters:

authenticationToken -

type -

privilege - a opsname of tc, tm parameter or tm packet

Returns:

true if the privilege is known and the current user has it.

Throws:

InvalidAuthenticationToken

hasPrivilege1

public boolean hasPrivilege1(AuthenticationToken authenticationToken,
                             Privilege.Type type,
                             String privilege)

Like the method above but instead of throwing InvalidAuthenticationToken, it returns false in case the token is not valid. To be used to avoid dealing with the exception in case we know that the token must be valid (i.e. immediately after a authenticate)

Parameters:

authenticationToken -

type -

privilege -

Returns:

true if the user has the system privilege

hasPrivilege

public boolean hasPrivilege(AuthenticationToken authenticationToken,
                            Privilege.SystemPrivilege privilege)
                     throws InvalidAuthenticationToken

Parameters:

authenticationToken -

privilege -

Returns:

true if the user has the system privilege

Throws:

InvalidAuthenticationToken

hasPrivilege1

public boolean hasPrivilege1(AuthenticationToken authToken,
                             Privilege.SystemPrivilege sysPrivilege)

Like above but instead of throwing InvalidAuthenticationToken, it returns false if the token is not valid.

Parameters:

authToken -

sysPrivilege -

Returns:

true if the user has the system privilege

getAuthModuleName

public static String getAuthModuleName()

getDefaultUser

public static String getDefaultUser()

Returns the default user if this server is unsecured. Returns null in all other cases.

Returns:

default username

getTmPacketNames

public Collection<String> getTmPacketNames(String yamcsInstance,
                                           AuthenticationToken authToken,
                                           String namespace)
                                    throws ConfigurationException,
                                           InvalidAuthenticationToken

Get packet names this user has appropriate privileges for.

Parameters:

yamcsInstance - Used to get MDB.

authToken -

namespace - If null defaults to "MDB:OPS Name"

Returns:

A collection of TM packet names in the specified namespace for which the user has privileges.

Throws:

ConfigurationException

InvalidAuthenticationToken

getTmParameterNames

public Collection<String> getTmParameterNames(String yamcsInstance,
                                              AuthenticationToken authToken,
                                              String namespace)
                                       throws ConfigurationException,
                                              InvalidAuthenticationToken

Get parameter names this user has appropriate privileges for.

Parameters:

yamcsInstance - Used to get MDB.

authToken -

namespace - If null defaults to "MDB:OPS Name"

Returns:

A collection of TM parameter names in the specified namespace for which the user has privileges.

Throws:

ConfigurationException

InvalidAuthenticationToken

getMaxNoSessions

public int getMaxNoSessions()

getUsername

public String getUsername(AuthenticationToken authToken)

getUser

public User getUser(AuthenticationToken authToken)

getAuthModule

public AuthModule getAuthModule()

getArtemisAuthModule

public org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager getArtemisAuthModule()

authenticateHttp

public CompletableFuture<AuthenticationToken> authenticateHttp(io.netty.channel.ChannelHandlerContext ctx,
                                                               io.netty.handler.codec.http.FullHttpRequest req)