import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 *
 */
public static Session createAdminSession()
{
    Session adminSess = null;
    try
    {
        AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
        User admin = UserTestData.getUser( UserTestData.USERS_TU0[0] );
        adminSess = accessMgr.createSession( admin, false );
    }
    catch ( SecurityException ex )
    {
        String error = " static initializer caught SecurityException rc=" + ex.getErrorId() + ", msg="
            + ex.getMessage();
        LOG.error( error );
    }
    return adminSess;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * ************************************************************************************************************************************
 * BEGIN DELEGATEDACCESSMGR
 * **************************************************************************************************************************************
 */

/* No qualifier */ FortResponse canAssign(FortRequest request)
{
    FortResponse response = createResponse();

    try
    {
        UserRole uRole = (UserRole) request.getEntity();
        Session session = request.getSession();
        DelAccessMgr accessMgr = DelAccessMgrFactory.createInstance( request.getContextId() );
        boolean result = accessMgr.canAssign( session, new User( uRole.getUserId() ), new Role( uRole.getName() ) );
        response.setSession( session );
        response.setAuthorized( result );
    }
    catch ( SecurityException se )
    {
        createError( response, LOG, se );
    }
    
    return response;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
FortResponse canDeassign(FortRequest request)
{
    FortResponse response = createResponse();

    try
    {
        UserRole uRole = (UserRole) request.getEntity();
        Session session = request.getSession();
        DelAccessMgr accessMgr = DelAccessMgrFactory.createInstance( request.getContextId() );
        boolean result = accessMgr.canDeassign( session, new User( uRole.getUserId() ), new Role( uRole.getName() ) );
        response.setSession( session );
        response.setAuthorized( result );
    }
    catch ( SecurityException se )
    {
        createError( response, LOG, se );
    }
    
    return response;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
FortResponse canGrant(FortRequest request)
{
    FortResponse response = createResponse();

    try
    {
        RolePerm context = (RolePerm) request.getEntity();
        Session session = request.getSession();
        DelAccessMgr accessMgr = DelAccessMgrFactory.createInstance( request.getContextId() );
        boolean result = accessMgr.canGrant( session, new Role( context.getRole().getName() ), context.getPerm() );
        response.setSession( session );
        response.setAuthorized( result );
    }
    catch ( SecurityException se )
    {
        createError( response, LOG, se );
    }
    
    return response;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
FortResponse canRevoke(FortRequest request)
{
    FortResponse response = createResponse();

    try
    {
        RolePerm context = (RolePerm) request.getEntity();
        Session session = request.getSession();
        DelAccessMgr accessMgr = DelAccessMgrFactory.createInstance( request.getContextId() );
        boolean result = accessMgr.canRevoke( session, new Role( context.getRole().getName() ), context.getPerm() );
        response.setSession( session );
        response.setAuthorized( result );
    }
    catch ( SecurityException se )
    {
        createError( response, LOG, se );
    }
    
    return response;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
FortResponse addActiveAdminRole(FortRequest request)
{
    FortResponse response = createResponse();

    try
    {
        UserAdminRole uAdminRole = (UserAdminRole) request.getEntity();
        Session session = request.getSession();
        DelAccessMgr accessMgr = DelAccessMgrFactory.createInstance( request.getContextId() );
        accessMgr.addActiveRole( session, uAdminRole );
        response.setSession( session );
    }
    catch ( SecurityException se )
    {
        createError( response, LOG, se );
    }
    
    return response;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
FortResponse sessionAdminPermissions(FortRequest request)
{
    FortResponse response = createResponse();

    try
    {
        DelAccessMgr accessMgr = DelAccessMgrFactory.createInstance( request.getContextId() );
        Session session = request.getSession();
        List<Permission> perms = accessMgr.sessionPermissions( session );
        response.setSession( session );
        response.setEntities( perms );
    }
    catch ( SecurityException se )
    {
        createError( response, LOG, se );
    }
    
    return response;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * Test Utility wraps OpenAcccessManager createSession API.
 *
 * @param userId          String contains case insensitive userId field.
 * @param password        String contains case sensitive, clear text password field.
 * @param activationRoles array of Role names targeted for activation into User's RBAC Session.
 * @return User RBAC Session that is used for subsequent AccessMgr API calls.
 */
private static Session createSession( String userId, String password, String[] activationRoles, AccessMgr accessMgr )
{
    String szLocation = ".createSession";
    Session session = null;
    try
    {
        User user = new User( userId, password, activationRoles );
        user.addProperty( "system.user.name", System.getProperty( "user.name" ) );
        //user.addProperty("system.timezone VAL", System.getProperty("user.timezone VAL"));
        user.addProperty( "system.country", System.getProperty( "user.country" ) );

        // Create an Fortress Session.  The Session contains the user's activated
        // roles along with other related attributes and status information (i.e. password status)
        session = accessMgr.createSession( user, false );
        LOG.info( szLocation + " with roles successful" );
    }
    catch ( SecurityException ex )
    {
        LOG.error(
            szLocation + " with roles caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
            ex );
        fail( ex.getMessage() );
    }
    return session;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public boolean authenticate( String userId, String password ) throws SecurityException
{
    boolean result = false;
    Session session = accessMgr.authenticate( userId, password );
    
    if ( session != null )
    {
        result = true;
        LOG.debug( "{}.authenticate userId [{}], successful", CLS_NM, userId );
    }
    else
    {
        LOG.debug( "{}.authenticate userId [{}], failed", CLS_NM, userId );
    }

    return result;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public List<String> authorizedRoles( String userId ) throws SecurityException
{
    List<String> list = null;
    // This will check temporal constraints on User and Roles.
    Session session = createSession( new User( userId ), true );
    // Get the Set of authorized Roles.
    Set<String> authZRoleSet = accessMgr.authorizedRoles( session );
    
    // If User has authorized roles.
    if ( ( authZRoleSet != null ) && ( authZRoleSet.size() > 0 ) )
    {
        // Convert the Set into a List before returning:
        list = new ArrayList<String>( authZRoleSet );
    }
    
    return list;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * Create trusted RBAC Session.  This API will attempt to activate all of the User's assigned Roles.
 *
 * @param userId  Case insensitive userId.
 */
public static void createSessionTrusted(String userId)
{
    String szLocation = ".createSessionTrusted";
    try
    {
        // Instantiate the AccessMgr implementation which perform runtime RBAC operations.
        AccessMgr accessMgr = AccessMgrFactory.createInstance(TestUtils.getContext());

        // The User entity is used to pass data into the createSession API.
        User user = new User(userId);

        // The API will verify User is good and perform Role activations.  Request will fail if User is locked out of ldap for any reason.
        Session session = accessMgr.createSession(user, true);

        // createSession will throw SecurityException if fails thus the Session should never be null.
        assertNotNull(session);
        LOG.info(szLocation + "  userId [" + userId + "] successful");
    }
    catch (SecurityException ex)
    {
        LOG.error(szLocation + " userId [" + userId + "] caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex);
        fail(ex.getMessage());
    }
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public void addActiveRole(Session session, UserAdminRole role)
    throws SecurityException
{
    String methodName = CLS_NM + ".addActiveRole";
    VUtil.assertNotNull(session, GlobalErrIds.USER_SESS_NULL, methodName);
    VUtil.assertNotNull(role, GlobalErrIds.ARLE_NULL, methodName);
    FortRequest request = new FortRequest();
    request.setContextId(this.contextId);
    request.setSession(session);
    request.setEntity(role);
    String szRequest = RestUtils.marshal(request);
    String szResponse = RestUtils.getInstance().post(szRequest, HttpIds.ADMIN_ADD);
    FortResponse response = RestUtils.unmarshall(szResponse);
    if (response.getErrorCode() == 0)
    {
        Session outSession = response.getSession();
        session.copy(outSession);
    }
    else
    {
        throw new SecurityException(response.getErrorCode(), response.getErrorMessage());
    }
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
public void testAddActiveRole()
{
    LOG.info( "testAddActiveRole..." );
    try
    {
        AccelMgr accelMgr = AccelMgrFactory.createInstance( TestUtils.getContext() );
        Session session;
        User user = new User();
        // positive test case:
        user.setUserId( "rbacuser1" );
        user.setPassword( "secret" );
        user.setRoleName( "rbacrole1" );
        //user.setRole( "rbacrole2" );
        session = accelMgr.createSession( user, false );
        assertNotNull( session );
        assertTrue( session.isAuthenticated() );
        UserRole userRole = new UserRole( user.getUserId(), "rbacrole2" );
        accelMgr.addActiveRole( session, userRole );
    }
    catch( SecurityException se)
    {
        se.printStackTrace();
        fail();
    }
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public List<UserAdminRole> sessionAdminRoles(Session session)
    throws SecurityException
{
    VUtil.assertNotNull(session, GlobalErrIds.USER_SESS_NULL, CLS_NM + ".sessionAdminRoles");
    List<UserAdminRole> roles;
    FortRequest request = new FortRequest();
    request.setContextId(this.contextId);
    request.setSession(session);
    String szRequest = RestUtils.marshal(request);
    String szResponse = RestUtils.getInstance().post(szRequest, HttpIds.ADMIN_ROLES);
    FortResponse response = RestUtils.unmarshall(szResponse);
    if (response.getErrorCode() == 0)
    {
        roles = response.getEntities();
        Session outSession = response.getSession();
        session.copy(outSession);
    }
    else
    {
        throw new SecurityException(response.getErrorCode(), response.getErrorMessage());
    }
    return roles;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * @param msg
 * @param uArray
 */
public static void getUserIds( String msg, String[][] uArray )
{
    LogUtil.logIt( msg );
    try
    {
        AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
        for ( String[] usr : uArray )
        {
            User user = UserTestData.getUser( usr );
            Session session = accessMgr.authenticate( user.getUserId(), user.getPassword() );
            assertNotNull( session );
            String userId = accessMgr.getUserId( session );
            assertTrue( "getUserIds failed compare found userId [" + userId + "] valid userId ["
                + UserTestData.getUserId( usr ) + "]", userId.equalsIgnoreCase( UserTestData.getUserId( usr ) ) );
        }
        LOG.debug( "getUserIds successful" );
    }
    catch ( SecurityException ex )
    {
        LOG.error(
            "getUserIds: failed with SecurityException rc=" + ex.getErrorId() + ", msg="
                + ex.getMessage(), ex );
        fail( ex.getMessage() );
    }
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public List<Permission> sessionPermissions(Session session)
    throws SecurityException
{
    VUtil.assertNotNull(session, GlobalErrIds.USER_SESS_NULL, CLS_NM + ".sessionPermissions");
    List<Permission> retPerms;
    FortRequest request = new FortRequest();
    request.setContextId(this.contextId);
    request.setSession(session);
    String szRequest = RestUtils.marshal(request);
    String szResponse = RestUtils.getInstance().post(szRequest, HttpIds.ADMIN_PERMS);
    FortResponse response = RestUtils.unmarshall(szResponse);
    if (response.getErrorCode() == 0)
    {
        retPerms = response.getEntities();
        Session outSession = response.getSession();
        session.copy(outSession);
    }
    else
    {
        throw new SecurityException(response.getErrorCode(), response.getErrorMessage());
    }
    return retPerms;
    //throw new java.lang.UnsupportedOperationException();
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * This method is called during entity activation, {@link org.apache.directory.fortress.core.util.VUtil#validateConstraints} and ensures the elapsed time a particular entity has been activated does not exceed specified.
 * value {@link Constraint#getTimeout()}.
 *
 * @param session    required for {@link Validator} interface but not used here.
 * @param constraint contains the elapsed time entity may remain inactive in minutes.  Maps listed above.
 * @param time       contains the current timestamp.
 * @param type       required by interface, not used here.
 * @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_TIMEOUT} if failed.
 */
public int validate( Session session, Constraint constraint, Time time, VUtil.ConstraintType type )
{
    int rc = GlobalErrIds.ACTV_FAILED_TIMEOUT;
    long timeLimit;
    long lastTime = session.getLastAccess();

    if ( lastTime == 0 )
    {
        rc = 0;
    }
    else
    {
        long elapsedTime = System.currentTimeMillis() - lastTime;
        timeLimit = constraint.getTimeout() * 60000L;

        if ( ( elapsedTime < timeLimit ) || ( constraint.getTimeout() == 0 ) )
        {
            rc = 0;
        }
    }

    return rc;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * The authenticate API is used for use cases where RBAC authorization is not required.  This API will authenticate
 * the User's password and will check password policies but will not activate User's Roles into the return Session.
 *
 * @param userId   String contains case insensitive userId field.
 * @param password String contains case sensitive, clear text password field.
 * @return User Session that has no Roles activated thus will fail checkAccess and sessionPermission calls.
 */
private static Session authenticate( String userId, String password, AccessMgr accessMgr )
{
    String szLocation = ".authenticate";
    Session session = null;
    try
    {
        // authenticate will check the password but will not activated any roles into Session.
        session = accessMgr.authenticate( userId, password );
        LOG.info( szLocation + " successful" );
    }
    catch ( SecurityException ex )
    {
        LOG.error( szLocation + " caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
        fail( ex.getMessage() );
    }
    return session;
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public void dropActiveRole(Session session, UserAdminRole role)
    throws SecurityException
{
    String methodName = "dropActiveRole";
    assertContext(CLS_NM, methodName, session, GlobalErrIds.USER_SESS_NULL);
    assertContext(CLS_NM, methodName, role, GlobalErrIds.ARLE_NULL);
    role.setUserId(session.getUserId());
    List<UserAdminRole> roles = session.getAdminRoles();
    VUtil.assertNotNull(roles, GlobalErrIds.ARLE_DEACTIVE_FAILED, methodName);
    int indx = roles.indexOf(role);
    if (indx != -1)
    {
        roles.remove(role);
    }
    else
    {
        String info = methodName + " Admin Role [" + role.getName() + "] User [" + session.getUserId() + "], not previously activated";
        throw new SecurityException(GlobalErrIds.ARLE_NOT_ACTIVE, info);
    }
}
 

import org.apache.directory.fortress.core.model.Session; //导入依赖的package包/类
@Test
public void testSessionRoles()
{
    LOG.info( "testSessionRoles..." );
    User user = new User();
    user.setUserId( "rbacuser1" );
    user.setPassword( "secret" );
    try
    {
        AccelMgr accelMgr = AccelMgrFactory.createInstance( TestUtils.getContext() );
        Session session;
        session = accelMgr.createSession( user, false );
        assertNotNull( session );
        accelMgr.sessionRoles( session );
    }
    catch( org.apache.directory.fortress.core.SecurityException se)
    {
        se.printStackTrace();
    }
}