- package org.apache.archiva.web.startup;
-
- /*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
- import org.apache.archiva.common.ArchivaException;
- import org.apache.archiva.configuration.ArchivaConfiguration;
- import org.apache.archiva.configuration.ConfigurationNames;
- import org.apache.archiva.configuration.ManagedRepositoryConfiguration;
- import org.apache.archiva.redback.rbac.RBACManager;
- import org.apache.archiva.redback.role.RoleManagerException;
- import org.apache.archiva.redback.system.check.EnvironmentCheck;
- import org.apache.archiva.security.common.ArchivaRoleConstants;
- import org.apache.commons.collections.CollectionUtils;
- import org.apache.commons.lang.StringUtils;
- import org.apache.archiva.redback.rbac.RbacManagerException;
- import org.apache.archiva.redback.rbac.UserAssignment;
- import org.apache.archiva.redback.role.RoleManager;
- import org.apache.archiva.redback.users.UserManager;
- import org.apache.archiva.redback.components.registry.RegistryListener;
- import org.apache.commons.lang.time.StopWatch;
- import org.slf4j.Logger;
- import org.slf4j.LoggerFactory;
- import org.springframework.context.ApplicationContext;
- import org.springframework.stereotype.Service;
-
- import javax.annotation.PostConstruct;
- import javax.inject.Inject;
- import javax.inject.Named;
- import java.util.ArrayList;
- import java.util.HashMap;
- import java.util.List;
- import java.util.Map;
- import java.util.Map.Entry;
-
- /**
- * ConfigurationSynchronization
- */
- @Service
- public class SecuritySynchronization
- implements RegistryListener
- {
- private Logger log = LoggerFactory.getLogger( SecuritySynchronization.class );
-
- @Inject
- private RoleManager roleManager;
-
- @Inject
- @Named(value = "rbacManager#cached")
- private RBACManager rbacManager;
-
- private Map<String, EnvironmentCheck> checkers;
-
- @Inject
- private ArchivaConfiguration archivaConfiguration;
-
- @Inject
- private ApplicationContext applicationContext;
-
- @PostConstruct
- public void initialize()
- {
- checkers = getBeansOfType( EnvironmentCheck.class );
- }
-
- protected <T> Map<String, T> getBeansOfType( Class<T> clazz )
- {
- //TODO do some caching here !!!
- // olamy : with plexus we get only roleHint
- // as per convention we named spring bean role#hint remove role# if exists
- Map<String, T> springBeans = applicationContext.getBeansOfType( clazz );
-
- Map<String, T> beans = new HashMap<String, T>( springBeans.size() );
-
- for ( Entry<String, T> entry : springBeans.entrySet() )
- {
- String key = StringUtils.substringAfterLast( entry.getKey(), "#" );
- beans.put( key, entry.getValue() );
- }
- return beans;
- }
-
- public void afterConfigurationChange( org.apache.archiva.redback.components.registry.Registry registry,
- String propertyName, Object propertyValue )
- {
- if ( ConfigurationNames.isManagedRepositories( propertyName ) && propertyName.endsWith( ".id" ) )
- {
- if ( propertyValue != null )
- {
- syncRepoConfiguration( (String) propertyValue );
- }
- }
- }
-
- public void beforeConfigurationChange( org.apache.archiva.redback.components.registry.Registry registry,
- String propertyName, Object propertyValue )
- {
- /* do nothing */
- }
-
- private void synchConfiguration( List<ManagedRepositoryConfiguration> repos )
- {
- // NOTE: Remote Repositories do not have roles or security placed around them.
-
- for ( ManagedRepositoryConfiguration repoConfig : repos )
- {
- syncRepoConfiguration( repoConfig.getId() );
- }
- }
-
- private void syncRepoConfiguration( String id )
- {
- // manage roles for repositories
- try
- {
- if ( !roleManager.templatedRoleExists( ArchivaRoleConstants.TEMPLATE_REPOSITORY_OBSERVER, id ) )
- {
- roleManager.createTemplatedRole( ArchivaRoleConstants.TEMPLATE_REPOSITORY_OBSERVER, id );
- }
- else
- {
- roleManager.verifyTemplatedRole( ArchivaRoleConstants.TEMPLATE_REPOSITORY_OBSERVER, id );
- }
-
- if ( !roleManager.templatedRoleExists( ArchivaRoleConstants.TEMPLATE_REPOSITORY_MANAGER, id ) )
- {
- roleManager.createTemplatedRole( ArchivaRoleConstants.TEMPLATE_REPOSITORY_MANAGER, id );
- }
- else
- {
- roleManager.verifyTemplatedRole( ArchivaRoleConstants.TEMPLATE_REPOSITORY_MANAGER, id );
- }
- }
- catch ( RoleManagerException e )
- {
- // Log error.
- log.error( "Unable to create roles for configured repositories: " + e.getMessage(), e );
- }
- }
-
- public void startup()
- throws ArchivaException
- {
- executeEnvironmentChecks();
-
- synchConfiguration( archivaConfiguration.getConfiguration().getManagedRepositories() );
- archivaConfiguration.addChangeListener( this );
-
- if ( archivaConfiguration.isDefaulted() )
- {
- assignRepositoryObserverToGuestUser( archivaConfiguration.getConfiguration().getManagedRepositories() );
- }
- }
-
- private void executeEnvironmentChecks()
- throws ArchivaException
- {
- if ( ( checkers == null ) || CollectionUtils.isEmpty( checkers.values() ) )
- {
- throw new ArchivaException(
- "Unable to initialize the Redback Security Environment, " + "no Environment Check components found." );
- }
-
- StopWatch stopWatch = new StopWatch();
- stopWatch.reset();
- stopWatch.start();
-
- List<String> violations = new ArrayList<>();
-
- for ( Entry<String, EnvironmentCheck> entry : checkers.entrySet() )
- {
- EnvironmentCheck check = entry.getValue();
- List<String> v = new ArrayList<>();
- check.validateEnvironment( v );
- log.info( "Environment Check: {} -> {} violation(s)", entry.getKey(), v.size() );
- for ( String s : v )
- {
- violations.add( "[" + entry.getKey() + "] " + s );
- }
- }
-
- if ( CollectionUtils.isNotEmpty( violations ) )
- {
- StringBuilder msg = new StringBuilder();
- msg.append( "EnvironmentCheck Failure.\n" );
- msg.append( "======================================================================\n" );
- msg.append( " ENVIRONMENT FAILURE !! \n" );
- msg.append( "\n" );
-
- for ( String violation : violations )
- {
- msg.append( violation ).append( "\n" );
- }
-
- msg.append( "\n" );
- msg.append( "======================================================================" );
- log.error( msg.toString() );
-
- throw new ArchivaException( "Unable to initialize Redback Security Environment, [" + violations.size()
- + "] violation(s) encountered, See log for details." );
- }
-
- stopWatch.stop();
- log.info( "time to execute all EnvironmentCheck: {} ms", stopWatch.getTime() );
- }
-
-
- private void assignRepositoryObserverToGuestUser( List<ManagedRepositoryConfiguration> repos )
- {
- for ( ManagedRepositoryConfiguration repoConfig : repos )
- {
- String repoId = repoConfig.getId();
-
- String principal = UserManager.GUEST_USERNAME;
-
- try
- {
- UserAssignment ua;
-
- if ( rbacManager.userAssignmentExists( principal ) )
- {
- ua = rbacManager.getUserAssignment( principal );
- }
- else
- {
- ua = rbacManager.createUserAssignment( principal );
- }
-
- ua.addRoleName( ArchivaRoleConstants.toRepositoryObserverRoleName( repoId ) );
- rbacManager.saveUserAssignment( ua );
- }
- catch ( RbacManagerException e )
- {
- log.warn( "Unable to add role [{}] to {} user.", ArchivaRoleConstants.toRepositoryObserverRoleName( repoId ), principal, e );
- }
- }
- }
- }
|