Newer
Older
AccessControlContext acContext = AccessController.getContext();
Subject subject = Subject.getSubject(acContext);
// only consult cache if the userID is of the calling subject
if (userIsSubject(userID, subject))
Patrick Dowler
committed
Set<GroupMemberships> gset = subject.getPrivateCredentials(GroupMemberships.class);
if (gset == null || gset.isEmpty())
GroupMemberships mems = new GroupMemberships(serviceID.toString(), userID);
Patrick Dowler
committed
subject.getPrivateCredentials().add(mems);
return mems;
Patrick Dowler
committed
GroupMemberships mems = gset.iterator().next();
// check to ensure they have the same service URI
if (!serviceID.toString().equals(mems.getServiceURI()))
{
log.debug("Not using cache because of differing service URIs: " +
"[" + serviceID.toString() + "][" + mems.getServiceURI() + "]");
return null;
}
Patrick Dowler
committed
return mems;
Patrick Dowler
committed
return null; // no cache
}
protected Group getCachedGroup(Principal userID, String groupID, Role role)
Patrick Dowler
committed
{
List<Group> groups = getCachedGroups(userID, role, false);
Patrick Dowler
committed
if (groups == null)
return null; // no cache
for (Group g : groups)
{
if (g.getID().getName().equals(groupID))
Patrick Dowler
committed
return g;
protected List<Group> getCachedGroups(Principal userID, Role role, boolean complete)
Patrick Dowler
committed
{
GroupMemberships mems = getGroupCache(userID);
Patrick Dowler
committed
if (mems == null)
return null; // no cache
Patrick Dowler
committed
Boolean cacheState = mems.isComplete(role);
Patrick Dowler
committed
if (!complete || Boolean.TRUE.equals(cacheState))
Patrick Dowler
committed
return mems.getMemberships(role);
Patrick Dowler
committed
// caller wanted complete and we don't have that
Patrick Dowler
committed
protected void addCachedGroup(Principal userID, Group group, Role role)
GroupMemberships mems = getGroupCache(userID);
Patrick Dowler
committed
if (mems == null)
return; // no cache
Patrick Dowler
committed
}
protected void setCachedGroups(Principal userID, List<Group> groups, Role role)
GroupMemberships mems = getGroupCache(userID);
Patrick Dowler
committed
if (mems == null)
return; // no cache
protected boolean userIsSubject(Principal userID, Subject subject)
{
if (userID == null || subject == null)
{
return false;
}
for (Principal subjectPrincipal : subject.getPrincipals())
Patrick Dowler
committed
if (AuthenticationUtil.equals(subjectPrincipal, userID))
protected RegistryClient getRegistryClient()
{
return new RegistryClient();
}
/**
* Lookup the Service URL for the given standard. The current AuthMethod
* will be taken into account.
*
* @param standard The URI standard to look up.
* @return URL for the service.
* @throws AccessControlException If the URL cannot be found for the
* provided AuthMethod.
*/
private URL lookupServiceURL(final URI standard)
throws AccessControlException
{
final URL serviceURL = getRegistryClient()
.getServiceURL(this.serviceID, standard, getAuthMethod());
if (serviceURL == null)
{
String.format("Unable to get Service URL for '%s', '%s', '%s'",
serviceID.toString(), Standards.GMS_GROUPS_01,
getAuthMethod()));
}
else
{
return serviceURL;
}
}
private AuthMethod getAuthMethod()
{
Subject subject = AuthenticationUtil.getCurrentSubject();
if (subject != null)
{
for (Object o : subject.getPublicCredentials())
{
if (o instanceof X509CertificateChain)
return AuthMethod.CERT;
if (o instanceof SSOCookieCredential)
return AuthMethod.COOKIE;
// AuthMethod.PASSWORD not supported
// AuthMethod.TOKEN not supported
}
throw new AccessControlException("No valid public credentials.");
}
else
{
throw new AccessControlException("Anonymous access not supported.");