[MRM-1736] map roles to ldap groups

make authorizer impls dynamic

git-svn-id: https://svn.apache.org/repos/asf/archiva/trunk@1430611 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/archiva-modules/archiva-base/archiva-configuration/src/main/mdo/configuration.mdo b/archiva-modules/archiva-base/archiva-configuration/src/main/mdo/configuration.mdo
index 4f13ef806d72accc696bd20ff4808f895987e737..a9a393b7cc03658108a52b27ea4cc6ab05d8ccbd 100644 (file)
--- a/archiva-modules/archiva-base/archiva-configuration/src/main/mdo/configuration.mdo
+++ b/archiva-modules/archiva-base/archiva-configuration/src/main/mdo/configuration.mdo
@@ -1495,6 +1495,15 @@
             <multiplicity>*</multiplicity>
           </association>
         </field>
+        <field>
+          <name>authorizerImpls</name>
+          <description>The authorizer impls to use.</description>
+          <version>1.4.0+</version>
+          <association>
+            <type>String</type>
+            <multiplicity>*</multiplicity>
+          </association>
+        </field>
         <field>
           <name>ldapConfiguration</name>
           <description>the ldap configuration</description>

diff --git a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-api/src/main/java/org/apache/archiva/admin/model/beans/RedbackRuntimeConfiguration.java b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-api/src/main/java/org/apache/archiva/admin/model/beans/RedbackRuntimeConfiguration.java
index 29538025290e445a3f0cea16647a8786954fb25d..ac47544c967ac4ddfdecb61c18511f2449f2fdce 100644 (file)
--- a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-api/src/main/java/org/apache/archiva/admin/model/beans/RedbackRuntimeConfiguration.java
+++ b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-api/src/main/java/org/apache/archiva/admin/model/beans/RedbackRuntimeConfiguration.java
@@ -39,6 +39,11 @@ public class RedbackRuntimeConfiguration
      */
     private List<String> userManagerImpls = new ArrayList<String>();
 
+    /**
+     * Field authorizerImpls.
+     */
+    private java.util.List<String> authorizerImpls;
+
     private LdapConfiguration ldapConfiguration;
 
     /**
@@ -153,12 +158,23 @@ public class RedbackRuntimeConfiguration
         this.usersCacheConfiguration = usersCacheConfiguration;
     }
 
+    public List<String> getAuthorizerImpls()
+    {
+        return authorizerImpls;
+    }
+
+    public void setAuthorizerImpls( List<String> authorizerImpls )
+    {
+        this.authorizerImpls = authorizerImpls;
+    }
+
     @Override
     public String toString()
     {
         final StringBuilder sb = new StringBuilder();
         sb.append( "RedbackRuntimeConfiguration" );
         sb.append( "{userManagerImpls=" ).append( userManagerImpls );
+        sb.append( ", authorizerImpls=" ).append( authorizerImpls );
         sb.append( ", ldapConfiguration=" ).append( ldapConfiguration );
         sb.append( ", migratedFromRedbackConfiguration=" ).append( migratedFromRedbackConfiguration );
         sb.append( ", configurationProperties=" ).append( configurationProperties );

diff --git a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/runtime/DefaultRedbackRuntimeConfigurationAdmin.java b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/runtime/DefaultRedbackRuntimeConfigurationAdmin.java
index a4fea1b361dfb05018beef200cb2a8d47104e5ca..73f04ac0f46e5736d39cd5fca5242ab5ae29cde3 100644 (file)
--- a/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/runtime/DefaultRedbackRuntimeConfigurationAdmin.java
+++ b/archiva-modules/archiva-base/archiva-repository-admin/archiva-repository-admin-default/src/main/java/org/apache/archiva/admin/repository/runtime/DefaultRedbackRuntimeConfigurationAdmin.java
@@ -40,7 +40,10 @@ import org.springframework.stereotype.Service;
 import javax.annotation.PostConstruct;
 import javax.inject.Inject;
 import javax.inject.Named;
+import java.util.Collection;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 /**
  * @author Olivier Lamy
@@ -75,7 +78,8 @@ public class DefaultRedbackRuntimeConfigurationAdmin
             if ( !redbackRuntimeConfiguration.isMigratedFromRedbackConfiguration() )
             {
                 // so migrate if available
-                String userManagerImpl = userConfiguration.getString( UserConfigurationKeys.USER_MANAGER_IMPL );
+                String userManagerImpl =
+                    userConfiguration.getConcatenatedList( UserConfigurationKeys.USER_MANAGER_IMPL, "jdo" );
                 if ( StringUtils.isNotEmpty( userManagerImpl ) )
                 {
                     if ( StringUtils.contains( userManagerImpl, ',' ) )
@@ -92,6 +96,25 @@ public class DefaultRedbackRuntimeConfigurationAdmin
                     }
                 }
 
+                String authorizerImpls =
+                    userConfiguration.getConcatenatedList( UserConfigurationKeys.AUTHORIZER_IMPL, "rbac" );
+
+                if ( StringUtils.isNotEmpty( authorizerImpls ) )
+                {
+                    if ( StringUtils.contains( authorizerImpls, ',' ) )
+                    {
+                        String[] impls = StringUtils.split( authorizerImpls, ',' );
+                        for ( String impl : impls )
+                        {
+                            redbackRuntimeConfiguration.getAuthorizerImpls().add( impl );
+                        }
+                    }
+                    else
+                    {
+                        redbackRuntimeConfiguration.getAuthorizerImpls().add( userManagerImpl );
+                    }
+                }
+
                 // now ldap
 
                 LdapConfiguration ldapConfiguration = redbackRuntimeConfiguration.getLdapConfiguration();
@@ -130,6 +153,15 @@ public class DefaultRedbackRuntimeConfigurationAdmin
                 updateRedbackRuntimeConfiguration( redbackRuntimeConfiguration );
             }
 
+            // we ensure authorizerImpls is not empty if so put
+            if ( redbackRuntimeConfiguration.getAuthorizerImpls().isEmpty() )
+            {
+                log.info(
+                    "redbackRuntimeConfiguration with empty authorizerImpls so force at least rbac implementation !" );
+                redbackRuntimeConfiguration.getAuthorizerImpls().add( "rbac" );
+                updateRedbackRuntimeConfiguration( redbackRuntimeConfiguration );
+            }
+
             boolean save = false;
 
             // NPE free
@@ -502,4 +534,15 @@ public class DefaultRedbackRuntimeConfigurationAdmin
         }
         return userConfiguration.getConcatenatedList( key, defaultValue );
     }
+
+    public Collection<String> getKeys()
+    {
+        Collection<String> keys = userConfiguration.getKeys();
+
+        Set<String> keysSet = new HashSet<String>( keys );
+
+        keysSet.addAll( getRedbackRuntimeConfiguration().getConfigurationProperties().keySet() );
+
+        return keysSet;
+    }
 }

diff --git a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/security/ArchivaAuthorizer.java b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/security/ArchivaAuthorizer.java
index d5f6c9eed3d472d73bd5460a881d7d28e8e1ad42..cd599fa516ee39fd4d16adcb38eb35d8abf75374 100644 (file)
--- a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/security/ArchivaAuthorizer.java
+++ b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/security/ArchivaAuthorizer.java
@@ -18,12 +18,16 @@ package org.apache.archiva.web.security;
  * under the License.
  */
 
+import org.apache.archiva.admin.model.RepositoryAdminException;
+import org.apache.archiva.admin.model.beans.RedbackRuntimeConfiguration;
+import org.apache.archiva.admin.model.runtime.RedbackRuntimeConfigurationAdmin;
 import org.apache.archiva.redback.authorization.AuthorizationDataSource;
 import org.apache.archiva.redback.authorization.AuthorizationException;
 import org.apache.archiva.redback.authorization.AuthorizationResult;
 import org.apache.archiva.redback.authorization.Authorizer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.context.ApplicationContext;
 import org.springframework.stereotype.Service;
 
 import javax.inject.Inject;
@@ -40,13 +44,10 @@ public class ArchivaAuthorizer
     private Logger log = LoggerFactory.getLogger( getClass() );
 
     @Inject
-    @Named( value = "authorizer#rbac" )
-    private Authorizer rbacAuthorizer;
-
+    private ApplicationContext applicationContext;
 
     @Inject
-    @Named( value = "authorizer#ldap" )
-    private Authorizer ldapAuthorizer;
+    private RedbackRuntimeConfigurationAdmin redbackRuntimeConfigurationAdmin;
 
     public String getId()
     {
@@ -58,11 +59,54 @@ public class ArchivaAuthorizer
     {
         log.debug( "isAuthorized source: {}", source );
 
-        AuthorizationResult result = ldapAuthorizer.isAuthorized( source );
+        try
+        {
+            RedbackRuntimeConfiguration redbackRuntimeConfiguration =
+                redbackRuntimeConfigurationAdmin.getRedbackRuntimeConfiguration();
+
+            AuthorizationException authorizationException = null;
+
+            AuthorizationResult lastResult = null;
+
+            for ( String id : redbackRuntimeConfiguration.getAuthorizerImpls() )
+            {
+                Authorizer authorizer = getAuthorizer( id );
 
+                AuthorizationResult result = null;
+                try
+                {
+                    result = authorizer.isAuthorized( source );
+                    log.debug( "AuthorizationResult {} with id '{}", result, id );
+                }
+                catch ( AuthorizationException e )
+                {
+                    log.debug( "AuthorizationException {} with id '{}", e.getMessage(), id );
+                    authorizationException = e;
+                }
 
+                if ( result.isAuthorized() )
+                {
+                    return result;
+                }
 
-        return rbacAuthorizer.isAuthorized( source );
+                lastResult = result;
+            }
+            if ( authorizationException != null )
+            {
+                throw authorizationException;
+            }
+            return lastResult;
+        }
+        catch ( RepositoryAdminException e )
+        {
+            throw new AuthorizationException( e.getMessage(), e );
+        }
+
+    }
+
+    private Authorizer getAuthorizer( String id )
+    {
+        return applicationContext.getBean( "authorizer#" + id, Authorizer.class );
     }
 
     public boolean isFinalImplementation()