Return-Path: Delivered-To: apmail-directory-commits-archive@www.apache.org Received: (qmail 52497 invoked from network); 17 Jan 2011 15:54:53 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3) by minotaur.apache.org with SMTP; 17 Jan 2011 15:54:53 -0000 Received: (qmail 28426 invoked by uid 500); 17 Jan 2011 15:54:53 -0000 Delivered-To: apmail-directory-commits-archive@directory.apache.org Received: (qmail 28371 invoked by uid 500); 17 Jan 2011 15:54:51 -0000 Mailing-List: contact commits-help@directory.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@directory.apache.org Delivered-To: mailing list commits@directory.apache.org Received: (qmail 28355 invoked by uid 99); 17 Jan 2011 15:54:51 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 17 Jan 2011 15:54:51 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 17 Jan 2011 15:54:48 +0000 Received: by eris.apache.org (Postfix, from userid 65534) id 96D7823889DE; Mon, 17 Jan 2011 15:54:20 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r1059961 - /directory/apacheds/trunk/core/src/main/java/org/apache/directory/server/core/authz/AciAuthorizationInterceptor.java Date: Mon, 17 Jan 2011 15:54:20 -0000 To: commits@directory.apache.org From: elecharny@apache.org X-Mailer: svnmailer-1.0.8 Message-Id: <20110117155420.96D7823889DE@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: elecharny Date: Mon Jan 17 15:54:20 2011 New Revision: 1059961 URL: http://svn.apache.org/viewvc?rev=1059961&view=rev Log: Fix for https://issues.apache.org/jira/browse/DIRSERVER-1524 : the tuple and group cache are now reloaded at startup. Modified: directory/apacheds/trunk/core/src/main/java/org/apache/directory/server/core/authz/AciAuthorizationInterceptor.java Modified: directory/apacheds/trunk/core/src/main/java/org/apache/directory/server/core/authz/AciAuthorizationInterceptor.java URL: http://svn.apache.org/viewvc/directory/apacheds/trunk/core/src/main/java/org/apache/directory/server/core/authz/AciAuthorizationInterceptor.java?rev=1059961&r1=1059960&r2=1059961&view=diff ============================================================================== --- directory/apacheds/trunk/core/src/main/java/org/apache/directory/server/core/authz/AciAuthorizationInterceptor.java (original) +++ directory/apacheds/trunk/core/src/main/java/org/apache/directory/server/core/authz/AciAuthorizationInterceptor.java Mon Jan 17 15:54:20 2011 @@ -37,7 +37,6 @@ import org.apache.directory.server.core. import org.apache.directory.server.core.LdapPrincipal; import org.apache.directory.server.core.authz.support.ACDFEngine; import org.apache.directory.server.core.authz.support.AciContext; -import org.apache.directory.server.core.authz.GroupCache; import org.apache.directory.server.core.entry.ClonedServerEntry; import org.apache.directory.server.core.entry.ServerEntryUtils; import org.apache.directory.server.core.filtering.EntryFilter; @@ -59,6 +58,7 @@ import org.apache.directory.server.core. import org.apache.directory.server.core.interceptor.context.SearchOperationContext; import org.apache.directory.server.core.interceptor.context.SearchingOperationContext; import org.apache.directory.server.core.partition.ByPassConstants; +import org.apache.directory.server.core.partition.PartitionNexus; import org.apache.directory.server.core.subtree.SubentryInterceptor; import org.apache.directory.server.i18n.I18n; import org.apache.directory.shared.ldap.aci.ACIItem; @@ -71,10 +71,16 @@ import org.apache.directory.shared.ldap. import org.apache.directory.shared.ldap.entry.Entry; import org.apache.directory.shared.ldap.entry.EntryAttribute; import org.apache.directory.shared.ldap.entry.Modification; +import org.apache.directory.shared.ldap.entry.StringValue; import org.apache.directory.shared.ldap.entry.Value; import org.apache.directory.shared.ldap.exception.LdapException; import org.apache.directory.shared.ldap.exception.LdapNoPermissionException; import org.apache.directory.shared.ldap.exception.LdapOperationErrorException; +import org.apache.directory.shared.ldap.exception.LdapOperationException; +import org.apache.directory.shared.ldap.filter.EqualityNode; +import org.apache.directory.shared.ldap.filter.ExprNode; +import org.apache.directory.shared.ldap.filter.OrNode; +import org.apache.directory.shared.ldap.message.AliasDerefMode; import org.apache.directory.shared.ldap.name.DN; import org.apache.directory.shared.ldap.schema.AttributeType; import org.apache.directory.shared.ldap.schema.SchemaManager; @@ -167,8 +173,8 @@ public class AciAuthorizationInterceptor /** The ObjectClass AttributeType */ private static AttributeType OBJECT_CLASS_AT; - /** The AccessControlSubentry AttributeType */ - private static AttributeType ACCESS_CONTROL_SUBENTRY_AT; + /** The AccessControlSubentries AttributeType */ + private static AttributeType ACCESS_CONTROL_SUBENTRIES_AT; /** A storage for the entryACI attributeType */ private static AttributeType ENTRY_ACI_AT; @@ -176,10 +182,106 @@ public class AciAuthorizationInterceptor /** the subentry ACI attribute type */ private static AttributeType SUBENTRY_ACI_AT; + /** A reference to the nexus for direct backend operations */ + private PartitionNexus nexus; + + /** A reference to the DirectoryService instance */ + private DirectoryService directoryService; + public static final SearchControls DEFAULT_SEARCH_CONTROLS = new SearchControls(); /** + * Load the Tuples into the cache + */ + private void initTupleCache() throws LdapException + { + // Load all the prescriptiveACI : they are stored in AccessControlSubentry entries + DN adminDn = new DN( ServerDNConstants.ADMIN_SYSTEM_DN, schemaManager ); + + SearchControls controls = new SearchControls(); + controls.setSearchScope( SearchControls.SUBTREE_SCOPE ); + controls.setReturningAttributes( new String[] + { SchemaConstants.PRESCRIPTIVE_ACI_AT } ); + + ExprNode filter = + new EqualityNode( OBJECT_CLASS_AT, new StringValue( SchemaConstants.ACCESS_CONTROL_SUBENTRY_OC ) ); + + CoreSession adminSession = new DefaultCoreSession( new LdapPrincipal( adminDn, AuthenticationLevel.STRONG ), + directoryService ); + + SearchOperationContext searchOperationContext = new SearchOperationContext( adminSession, DN.EMPTY_DN, filter, + controls ); + + searchOperationContext.setAliasDerefMode( AliasDerefMode.NEVER_DEREF_ALIASES ); + + EntryFilteringCursor results = nexus.search( searchOperationContext ); + + try + { + while ( results.next() ) + { + Entry entry = results.get(); + + tupleCache.subentryAdded( entry.getDn(), entry ); + } + + results.close(); + } + catch ( Exception e ) + { + throw new LdapOperationException( e.getMessage() ); + } + } + + + /** + * Load the Groups into the cache + */ + private void initGroupCache() throws LdapException + { + // Load all the member/uniqueMember : they are stored in groupOfNames/groupOfUniqueName + DN adminDn = new DN( ServerDNConstants.ADMIN_SYSTEM_DN, schemaManager ); + + SearchControls controls = new SearchControls(); + controls.setSearchScope( SearchControls.SUBTREE_SCOPE ); + controls.setReturningAttributes( new String[] + { SchemaConstants.MEMBER_AT, SchemaConstants.UNIQUE_MEMBER_AT } ); + + ExprNode filter = + new OrNode( + new EqualityNode( OBJECT_CLASS_AT, new StringValue( SchemaConstants.GROUP_OF_NAMES_OC ) ), + new EqualityNode( OBJECT_CLASS_AT, new StringValue( SchemaConstants.GROUP_OF_UNIQUE_NAMES_OC ) ) ); + + CoreSession adminSession = new DefaultCoreSession( new LdapPrincipal( adminDn, AuthenticationLevel.STRONG ), + directoryService ); + + SearchOperationContext searchOperationContext = new SearchOperationContext( adminSession, DN.EMPTY_DN, filter, + controls ); + + searchOperationContext.setAliasDerefMode( AliasDerefMode.NEVER_DEREF_ALIASES ); + + EntryFilteringCursor results = nexus.search( searchOperationContext ); + + try + { + while ( results.next() ) + { + Entry entry = results.get(); + + groupCache.groupAdded( entry.getDn(), entry ); + } + + results.close(); + } + catch ( Exception e ) + { + throw new LdapOperationException( e.getMessage() ); + } + } + + + /** * Initializes this interceptor based service by getting a handle on the nexus, setting up * the tuple and group membership caches, the ACIItem parser and the ACDF engine. * @@ -188,7 +290,10 @@ public class AciAuthorizationInterceptor */ public void init( DirectoryService directoryService ) throws LdapException { - super.init( directoryService ); + LOG.debug( "Initializing the AciAuthorizationInterceptor" ); + + this.directoryService = directoryService; + nexus = directoryService.getPartitionNexus(); DN adminDn = directoryService.getDNFactory().create( ServerDNConstants.ADMIN_SYSTEM_DN ); CoreSession adminSession = new DefaultCoreSession( new LdapPrincipal( adminDn, AuthenticationLevel.STRONG ), @@ -202,7 +307,7 @@ public class AciAuthorizationInterceptor // look up some constant information OBJECT_CLASS_AT = schemaManager.getAttributeType( SchemaConstants.OBJECT_CLASS_AT ); - ACCESS_CONTROL_SUBENTRY_AT = schemaManager.getAttributeType( SchemaConstants.ACCESS_CONTROL_SUBENTRIES_AT ); + ACCESS_CONTROL_SUBENTRIES_AT = schemaManager.getAttributeType( SchemaConstants.ACCESS_CONTROL_SUBENTRIES_AT ); ENTRY_ACI_AT = schemaManager.getAttributeType( SchemaConstants.ENTRY_ACI_AT_OID ); SUBENTRY_ACI_AT = schemaManager.getAttributeType( SchemaConstants.SUBENTRY_ACI_AT_OID ); @@ -215,6 +320,10 @@ public class AciAuthorizationInterceptor SchemaConstants.SUBSCHEMA_SUBENTRY_AT ).get(); DN subschemaSubentryDnName = directoryService.getDNFactory().create( subschemaSubentry.getString() ); subschemaSubentryDn = subschemaSubentryDnName.getNormName(); + + // Init the caches now + initTupleCache(); + initGroupCache(); } @@ -284,7 +393,7 @@ public class AciAuthorizationInterceptor originalEntry = opContext.lookup( parentDn, ByPassConstants.LOOKUP_BYPASS ); } - EntryAttribute subentries = originalEntry.get( ACCESS_CONTROL_SUBENTRY_AT ); + EntryAttribute subentries = originalEntry.get( ACCESS_CONTROL_SUBENTRIES_AT ); if ( subentries == null ) {