org.yamcs.security

Class Privilege

java.lang.Object

org.yamcs.security.Privilege

public class Privilege
extends Object

Implements privileges loaded and short-term cached from realm. Extending classes provide concrete method to identify the user, which this class then uses to load privileges. This class also provides methods to extract a username from a supplied certificate. Requests are usually made in short bursts, so privileges loaded from realm are cached for a short period to reduce load on the realm service and retain responsiveness.

Author:

nm

Method Summary

Modifier and Type	Method and Description
CompletableFuture<AuthenticationToken>	authenticateHttp(io.netty.channel.ChannelHandlerContext ctx, io.netty.handler.codec.http.HttpRequest req)
AuthModule	getAuthModule()
String	getAuthModuleName()
String	getDefaultUser() Returns the default user if this server is unsecured.
static Privilege	getInstance()
int	getMaxNoSessions()
String[]	getRoles(AuthenticationToken authenticationToken)
Collection<String>	getTmPacketNames(String yamcsInstance, AuthenticationToken authToken) Get packet names this user has appropriate privileges for.
User	getUser(AuthenticationToken authToken)
String	getUsername(AuthenticationToken authToken)
boolean	hasPrivilege(AuthenticationToken authenticationToken, PrivilegeType type, String privilege)
boolean	hasPrivilege(AuthenticationToken authenticationToken, SystemPrivilege privilege)
boolean	hasPrivilege1(AuthenticationToken authenticationToken, PrivilegeType type, String privilege) Like the method above but instead of throwing InvalidAuthenticationToken, it returns false in case the token is not valid.
boolean	hasPrivilege1(AuthenticationToken authToken, SystemPrivilege sysPrivilege) Like above but instead of throwing InvalidAuthenticationToken, it returns false if the token is not valid.
boolean	hasRole(AuthenticationToken authenticationToken, String role) Convenience method, check if user has specific role.
boolean	isEnabled()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getRoles

public String[] getRoles(AuthenticationToken authenticationToken)
                  throws InvalidAuthenticationToken

Throws:

InvalidAuthenticationToken

getInstance

public static Privilege getInstance()

isEnabled

public boolean isEnabled()

Returns:

true if privileges are enabled

hasRole

public boolean hasRole(AuthenticationToken authenticationToken,
                       String role)
                throws InvalidAuthenticationToken

Convenience method, check if user has specific role.

Parameters:

authenticationToken -

role - Title or full dn.

Returns:

True if usePrivileges enabled and user has role, false otherwise.

Throws:

InvalidAuthenticationToken

hasPrivilege

public boolean hasPrivilege(AuthenticationToken authenticationToken,
                            PrivilegeType type,
                            String privilege)
                     throws InvalidAuthenticationToken

Parameters:

authenticationToken -

type -

privilege - a opsname of tc, tm parameter or tm packet

Returns:

true if the privilege is known and the current user has it.

Throws:

InvalidAuthenticationToken

hasPrivilege1

public boolean hasPrivilege1(AuthenticationToken authenticationToken,
                             PrivilegeType type,
                             String privilege)

Like the method above but instead of throwing InvalidAuthenticationToken, it returns false in case the token is not valid. To be used to avoid dealing with the exception in case we know that the token must be valid (i.e. immediately after a authenticate)

Parameters:

authenticationToken -

type -

privilege -

Returns:

true if the user has the system privilege

hasPrivilege

public boolean hasPrivilege(AuthenticationToken authenticationToken,
                            SystemPrivilege privilege)
                     throws InvalidAuthenticationToken

Parameters:

authenticationToken -

privilege -

Returns:

true if the user has the system privilege

Throws:

InvalidAuthenticationToken

hasPrivilege1

public boolean hasPrivilege1(AuthenticationToken authToken,
                             SystemPrivilege sysPrivilege)

Like above but instead of throwing InvalidAuthenticationToken, it returns false if the token is not valid.

Parameters:

authToken -

sysPrivilege -

Returns:

true if the user has the system privilege

getAuthModuleName

public String getAuthModuleName()

getDefaultUser

public String getDefaultUser()

Returns the default user if this server is unsecured. Returns null in all other cases.

Returns:

default username

getTmPacketNames

public Collection<String> getTmPacketNames(String yamcsInstance,
                                           AuthenticationToken authToken)
                                    throws ConfigurationException

Get packet names this user has appropriate privileges for.

Parameters:

yamcsInstance - Used to get MDB.

authToken -

namespace - If null defaults to "MDB:OPS Name"

Returns:

A collection of TM packet names in the specified namespace for which the user has privileges.

Throws:

ConfigurationException

InvalidAuthenticationToken

getMaxNoSessions

public int getMaxNoSessions()

getUsername

public String getUsername(AuthenticationToken authToken)

getUser

public User getUser(AuthenticationToken authToken)

getAuthModule

public AuthModule getAuthModule()

authenticateHttp

public CompletableFuture<AuthenticationToken> authenticateHttp(io.netty.channel.ChannelHandlerContext ctx,
                                                               io.netty.handler.codec.http.HttpRequest req)