KickJava   Java API By Example, From Geeks To Geeks.

Java > Open Source Codes > org > mmbase > security > MMBaseCopConfig


1 /*
2
3 This software is OSI Certified Open Source Software.
4 OSI Certified is a certification mark of the Open Source Initiative.
5
6 The license (Mozilla version 1.0) can be read at the MMBase site.
7 See http://www.MMBase.org/license
8
9 */

10 package org.mmbase.security;
11
12 import org.mmbase.util.ResourceLoader;
13 import org.mmbase.util.ResourceWatcher;
14
15 import org.mmbase.util.logging.Logger;
16 import org.mmbase.util.logging.Logging;
17 import org.mmbase.util.xml.DocumentReader;
18
19 /**
20  * This class is the main class of the security system. It loads the authentication
21  * and authorization classes if needed, and they can be requested from this manager.
22  * @javadoc
23  * @author Eduard Witteveen
24  * @version $Id: MMBaseCopConfig.java,v 1.28 2006/02/10 16:12:43 michiel Exp $
25  */

26 public class MMBaseCopConfig {
27     private static final Logger log = Logging.getLoggerInstance(MMBaseCopConfig.class);
28
29     public static final ResourceLoader securityLoader = ResourceLoader.getConfigurationRoot().getChildResourceLoader("security");
30
31     /** looks if the files have been changed */
32     protected ResourceWatcher watcher;
33
34     /** our current authentication class */
35     private Authentication authentication;
36
37     /** our current authorization class */
38     private Authorization authorization;
39
40     /** if the securitymanager is configured to functionate */
41     private boolean active = false;
42
43     /** the shared secret used by this system */
44     private String JavaDoc sharedSecret = null;
45
46
47     /** the shared secret used by this system */
48     private MMBaseCop cop;
49
50     /** the class that watches if we have to reload...*/
51     private class SecurityConfigWatcher extends ResourceWatcher {
52         private MMBaseCop cop;
53
54         public SecurityConfigWatcher(MMBaseCop cop) {
55             super(securityLoader);
56             if(cop == null) throw new RuntimeException JavaDoc("MMBase cop was null");
57             // log.debug("Starting the file watcher");
58
this.cop = cop;
59         }
60
61         public void onChange(String JavaDoc s) {
62             try {
63                 cop.reload();
64             } catch(Exception JavaDoc e) {
65                 log.error(e);
66                 log.error(Logging.stackTrace(e));
67             }
68         }
69     }
70
71     /** Public ID of the Builder DTD version 1.0 */
72     public static final String JavaDoc PUBLIC_ID_SECURITY_1_0 = "-//MMBase//DTD security config 1.0//EN";
73     private static final String JavaDoc PUBLIC_ID_SECURITY_1_0_FAULT = "//MMBase - security//";
74
75     /** DTD resource filename of the Builder DTD version 1.0 */
76     public static final String JavaDoc DTD_SECURITY_1_0 = "security_1_0.dtd";
77
78     static {
79         org.mmbase.util.XMLEntityResolver.registerPublicID(PUBLIC_ID_SECURITY_1_0, DTD_SECURITY_1_0, MMBaseCopConfig.class);
80         org.mmbase.util.XMLEntityResolver.registerPublicID(PUBLIC_ID_SECURITY_1_0_FAULT, DTD_SECURITY_1_0, MMBaseCopConfig.class);
81     }
82
83     /**
84      * The constructor, will load the classes for authorization and authentication
85      * with their config files, as specied in the xml from configUrl
86      * @exception java.io.IOException When reading the file failed
87      * @exception .. When XML not validates.
88      * @exception org.mmbase.security.SecurityException When the class could not be loaded
89      *
90      * @param mmbaseCop The MMBaseCop for which this is a configurator
91      */

92     MMBaseCopConfig(MMBaseCop mmbaseCop) throws java.io.IOException JavaDoc, NoSuchMethodException JavaDoc, SecurityException JavaDoc {
93
94         java.net.URL JavaDoc config = securityLoader.getResource("security.xml");
95         log.info("using: '" + config + "' as configuration file for security");
96
97         watcher = new SecurityConfigWatcher(mmbaseCop);
98         watcher.add("security.xml");
99         watcher.start();
100
101         cop = mmbaseCop;
102
103
104     }
105
106     /**
107      * @since MMBase-1.8
108      */

109     void load() throws java.io.IOException JavaDoc {
110         DocumentReader reader = new DocumentReader(securityLoader.getInputSource("security.xml"), this.getClass());
111
112         // are we active ?
113
String JavaDoc sActive = reader.getElementAttributeValue(reader.getElementByPath("security"),"active");
114         if(sActive.equalsIgnoreCase("true")) {
115             log.debug("SecurityManager will be active");
116             active = true;
117         } else if(sActive.equalsIgnoreCase("false")) {
118             log.debug("SecurityManager will NOT be active");
119             active = false;
120         } else {
121             throw new SecurityException JavaDoc("security attribute 'active' must have the value 'true' or 'false'");
122         }
123
124         // load the sharedSecret
125
sharedSecret = reader.getElementValue(reader.getElementByPath("security.sharedsecret"));
126
127
128         if(active) {
129
130             // first instantiate authentication and authorization, during load they can check each others class then.
131

132             org.w3c.dom.Element JavaDoc entry = reader.getElementByPath("security.authentication");
133             String JavaDoc authenticationClass = reader.getElementAttributeValue(entry,"class");
134             String JavaDoc authenticationUrl = reader.getElementAttributeValue(entry, "url");
135             authentication = getAuthentication(authenticationClass);
136
137             // load the key
138
String JavaDoc key = reader.getElementValue(reader.getElementByPath("security.key"));
139             if (key != null && ! key.equals("")) {
140                 try {
141                     long k = Long.parseLong(key);
142                     authentication.key = k;
143                 } catch (NumberFormatException JavaDoc nfe) {
144                     log.error("Could not format '" + key + "', defaulting to " + authentication.key);
145                 }
146             }
147
148             entry = reader.getElementByPath("security.authorization");
149             String JavaDoc authorizationClass = reader.getElementAttributeValue(entry,"class");
150             String JavaDoc authorizationUrl = reader.getElementAttributeValue(entry,"url");
151             authorization = getAuthorization(authorizationClass);
152
153
154             if (log.isDebugEnabled()) {
155                 log.debug("Loading class:" + authentication.getClass().getName() + " with config:" + authenticationUrl + " for Authentication");
156             }
157             authentication.load(cop, watcher, authenticationUrl);
158
159             if (log.isDebugEnabled()) {
160                 log.debug("Using class:" + authorization.getClass().getName() + " with config:" + authorizationUrl + " for Authorization");
161             }
162             authorization.load(cop, watcher, authorizationUrl);
163
164
165         } else {
166             // we dont use security...
167
authentication = new NoAuthentication();
168             authentication.load(cop, watcher, null);
169             authorization = new NoAuthorization();
170             authorization.load(cop, watcher, null);
171             log.debug("Retrieved dummy security classes");
172         }
173     }
174
175     /**
176      * Returns the authentication class, which should be used.
177      * @return The authentication class which should be used.
178      */

179     public Authentication getAuthentication() {
180         return authentication;
181     }
182
183     /**
184      * Returns the authorization class, which should be used.
185      * @return The authorization class which should be used.
186      */

187     public Authorization getAuthorization() {
188         return authorization;
189     }
190
191     /**
192      * Returns the authorization class, which should be used(for optimizations)
193      * @return <code>true</code>When the SecurityManager should
194      * be used.
195      * <code>false</code>When not.
196      */

197     public boolean getActive() {
198         return active;
199     }
200
201     /**
202      * checks if the received shared secret is equals to your own shared secret
203      * @param received shared secret
204      * @return true if received shared secret equals your own shared secret
205      * @return false if received shared secret not equals your own shared secret
206      */

207     public boolean checkSharedSecret(String JavaDoc received) {
208         if (sharedSecret != null) {
209             if(sharedSecret.equals(received)) {
210                 return true;
211             } else {
212                 log.error("the shared " + sharedSecret + "!=" + received + " secrets don't match.");
213             }
214         }
215         return false;
216     }
217
218
219     /**
220      * get the shared Secret
221      * @return the shared Secret
222      */

223     public String JavaDoc getSharedSecret() {
224         return sharedSecret;
225     }
226
227     private Authentication getAuthentication(String JavaDoc className) throws SecurityException JavaDoc {
228         Authentication result;
229         try {
230             Class JavaDoc classType = Class.forName(className);
231             Object JavaDoc o = classType.newInstance();
232             result = (Authentication) o;
233             log.debug("Setting manager of " + result + " to " + cop);
234             result.manager = cop;
235         } catch(ClassNotFoundException JavaDoc cnfe) {
236             throw new SecurityException JavaDoc(cnfe);
237         } catch(IllegalAccessException JavaDoc iae) {
238             throw new SecurityException JavaDoc(iae);
239         } catch(InstantiationException JavaDoc ie) {
240             throw new SecurityException JavaDoc(ie);
241         }
242         return result;
243     }
244
245     private Authorization getAuthorization(String JavaDoc className) throws SecurityException JavaDoc {
246
247         Authorization result;
248         try {
249             Class JavaDoc classType = Class.forName(className);
250             Object JavaDoc o = classType.newInstance();
251             result = (Authorization) o;
252             log.debug("Setting manager of " + result + " to " + cop);
253             result.manager = cop;
254         }
255         catch(java.lang.ClassNotFoundException JavaDoc cnfe) {
256             log.debug("", cnfe);
257             throw new SecurityException JavaDoc(cnfe.toString());
258         }
259         catch(java.lang.IllegalAccessException JavaDoc iae) {
260             log.debug("", iae);
261             throw new SecurityException JavaDoc(iae.toString());
262         }
263         catch(java.lang.InstantiationException JavaDoc ie) {
264             log.debug("", ie);
265             throw new SecurityException JavaDoc(ie.toString());
266         }
267         return result;
268     }
269 }
270
Popular Tags