sirius.web.security

Class GenericUserManager

java.lang.Object

sirius.web.security.GenericUserManager

All Implemented Interfaces:

UserManager

Direct Known Subclasses:

PublicUserManager

public abstract class GenericUserManager
extends Object
implements UserManager

Base class for various implementations of UserManager.

Provides session handling and roles expansion using profiles (security.profiles).

Field Summary

Fields

Modifier and Type	Field and Description
protected sirius.kernel.settings.Extension	config
protected List<String>	defaultRoles
protected UserInfo	defaultUser
protected String	hashFunction
protected boolean	keepLoginEnabled
protected Duration	loginCookieTTL
protected List<String>	publicRoles
protected ScopeInfo	scope
protected boolean	ssoEnabled
protected long	ssoGraceInterval
protected String	ssoSecret
protected List<String>	trustedRoles

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	GenericUserManager(ScopeInfo scope, sirius.kernel.settings.Extension config)

Method Summary

Modifier and Type	Method and Description
void	attachToSession(UserInfo user, WebContext ctx) Attaches the given user to the current session.
UserInfo	bindToRequest(WebContext ctx) Tries to find the current user in the current session or by checking the request for valid credentials
protected UserInfo	buildDefaultUser()
protected abstract String	computeLang(WebContext ctx, String userId) Compues the langange code of the given user and request.
protected abstract Set<String>	computeRoles(WebContext ctx, String userId) Tries to compute the roles for the given user and request.
protected String	computeSSOHashInput(String user, String timestamp) Computes the input for the hash function used to generate the auth hash.
String	computeSSOToken(String username) Computes an auth token which can be used to perform an SSO Login.
protected abstract String	computeTenantname(WebContext ctx, String tenantId) Compues the name of the given tenant and request.
protected abstract String	computeUsername(WebContext ctx, String userId) Compues the name of the given user and request.
void	detachFromSession(UserInfo user, WebContext ctx) Removes all stored user information from the current session.
protected Set<String>	determineRolesOfDefaultUser()
protected sirius.kernel.commons.Tuple<String,String>	extractChallengeAndResponse(WebContext ctx)
UserInfo	findUserForRequest(WebContext ctx) Tries to find the current user in the current session.
protected UserInfo	findUserInSession(WebContext ctx) Tries to fetch the current user from the current session.
protected UserSettings	getScopeSettings() Boilerplate for fetching the settings of the current scope.
protected com.google.common.hash.HashFunction	getSSOHashFunction() Determines which hash function is used to compute and verify SSO tokens.
protected abstract Object	getUserObject(UserInfo user) Resolves the given user info back into the original (underlying) user object.
protected UserSettings	getUserSettings(UserSettings scopeSettings, UserInfo user) Fetches the user specific configuration if available.
boolean	isKeepLoginSupported() Determines if the login can be stored longer than a usual session.
boolean	isLoginSupported() Determines if a login via username and password is possible.
protected boolean	isUserStillValid(String userId) Determines if the cached user object for the given ID is still valid.
protected void	log(String pattern, Object... params) Used to write a debug log.
protected void	recordUserLogin(WebContext ctx, UserInfo user) Provides a method which can track logins of users.
protected Set<String>	transformRoles(Collection<String> roles, boolean trusted) Applies profile transformations and adds default roles to the set of given roles.
protected void	updateLoginCookie(WebContext ctx, UserInfo user) Updates the lifetime of the login cooke if required.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface sirius.web.security.UserManager

findUserByCredentials, findUserByName

Field Detail

scope

protected final ScopeInfo scope

config

protected final sirius.kernel.settings.Extension config

hashFunction

protected final String hashFunction

ssoGraceInterval

protected final long ssoGraceInterval

ssoEnabled

protected boolean ssoEnabled

keepLoginEnabled

protected boolean keepLoginEnabled

ssoSecret

protected String ssoSecret

publicRoles

protected List<String> publicRoles

defaultRoles

protected List<String> defaultRoles

trustedRoles

protected List<String> trustedRoles

loginCookieTTL

protected Duration loginCookieTTL

defaultUser

protected UserInfo defaultUser

Constructor Detail

GenericUserManager

protected GenericUserManager(ScopeInfo scope,
                             sirius.kernel.settings.Extension config)

Method Detail

buildDefaultUser

protected UserInfo buildDefaultUser()

determineRolesOfDefaultUser

protected Set<String> determineRolesOfDefaultUser()

getUserObject

protected abstract Object getUserObject(UserInfo user)

Resolves the given user info back into the original (underlying) user object.

Parameters:

user - the user info which was passed to the outside world.

Returns:

the original (underlying) user object

getUserSettings

@Nonnull
protected UserSettings getUserSettings(@Nonnull
                                                UserSettings scopeSettings,
                                                UserInfo user)

Fetches the user specific configuration if available.

Parameters:

scopeSettings - the config of the outside scope

user - the user info which identifies the user to fetch the config for

Returns:

the config specific for this user. If no config is present, the scopeSettings can be returned.

bindToRequest

@Nonnull
public UserInfo bindToRequest(@Nonnull
                                       WebContext ctx)

Description copied from interface: UserManager

Tries to find the current user in the current session or by checking the request for valid credentials

Specified by:

bindToRequest in interface UserManager

Parameters:

ctx - the request to attach to

Returns:

the user found in the session. If no user is available UserInfo.NOBODY can be used.

findUserForRequest

@Nonnull
public UserInfo findUserForRequest(@Nonnull
                                            WebContext ctx)

Description copied from interface: UserManager

Tries to find the current user in the current session. In contrast to UserManager.bindToRequest(WebContext) this will not try to log a user in via credentials found in the request.

Specified by:

findUserForRequest in interface UserManager

Parameters:

ctx - the request to attach to

Returns:

the user found in the session. If no user is available UserInfo.NOBODY can be used.

recordUserLogin

protected void recordUserLogin(WebContext ctx,
                               UserInfo user)

Provides a method which can track logins of users.

Parameters:

ctx - the current request

user - the user which logged in

updateLoginCookie

protected void updateLoginCookie(WebContext ctx,
                                 UserInfo user)

Updates the lifetime of the login cooke if required.

Parameters:

ctx - the current request

user - the user that logged in

extractChallengeAndResponse

protected sirius.kernel.commons.Tuple<String,String> extractChallengeAndResponse(WebContext ctx)

computeSSOToken

public String computeSSOToken(String username)

Computes an auth token which can be used to perform an SSO Login.

If enabled, the computed token can be passed in using the token field.

Parameters:

username - the username to generate a token for

Returns:

a login token to be used for SSO

getSSOHashFunction

protected com.google.common.hash.HashFunction getSSOHashFunction()

Determines which hash function is used to compute and verify SSO tokens.

Returns:

the hash function to use for single sign-on tokens

computeSSOHashInput

protected String computeSSOHashInput(String user,
                                     String timestamp)

Computes the input for the hash function used to generate the auth hash.

Parameters:

user - the name of the user

timestamp - the timestamp used as challenge

Returns:

the input string used by the hash function

transformRoles

protected Set<String> transformRoles(Collection<String> roles,
                                     boolean trusted)

Applies profile transformations and adds default roles to the set of given roles.

Parameters:

roles - the roles granted to a user

trusted - determines if the user is considered a trusted user (Usually determined via WebContext.isTrusted()).

Returns:

a set of permissions which contain the given roles as well as the default roles and profile transformations

log

protected void log(String pattern,
                   Object... params)

Used to write a debug log.

Automatically contains the name of the user manager and the current scope.

Parameters:

pattern - the pattern used for logging

params - the parameters applied to the pattern

findUserInSession

protected UserInfo findUserInSession(WebContext ctx)

Tries to fetch the current user from the current session.

This can be either the client sided session (cookie) or the server session.

Parameters:

ctx - the current request to use the session from

Returns:

the user in the session or null if no user is attached

isUserStillValid

protected boolean isUserStillValid(String userId)

Determines if the cached user object for the given ID is still valid.

The method has to check the session data by itself.

Parameters:

userId - the user id to check

Returns:

true if the user is still valid, false otherwise

getScopeSettings

protected UserSettings getScopeSettings()

Boilerplate for fetching the settings of the current scope.

Returns:

the settings of the current scope

computeRoles

@Nullable
protected abstract Set<String> computeRoles(@Nullable
                                                      WebContext ctx,
                                                      String userId)

Tries to compute the roles for the given user and request.

If a server session is available, we try to load the roles from there.

Parameters:

ctx - the current request

userId - the id of the user to fetch roles for

Returns:

a set of roles granted to the user or an empty set if no roles were found

computeUsername

@Nonnull
protected abstract String computeUsername(@Nullable
                                                   WebContext ctx,
                                                   String userId)

Compues the name of the given user and request.

Parameters:

ctx - the current request

userId - the id of the user to fetch the name for

Returns:

the name of the user

computeTenantname

@Nonnull
protected abstract String computeTenantname(@Nullable
                                                     WebContext ctx,
                                                     String tenantId)

Compues the name of the given tenant and request.

Parameters:

ctx - the current request

tenantId - the id of the tenant to fetch the name for

Returns:

the name of the tenant

computeLang

@Nonnull
protected abstract String computeLang(WebContext ctx,
                                               String userId)

Compues the langange code of the given user and request.

Parameters:

ctx - the current request

userId - the id of the user to fetch the language for

Returns:

the language code for the user

attachToSession

public void attachToSession(@Nonnull
                            UserInfo user,
                            @Nonnull
                            WebContext ctx)

Attaches the given user to the current session.

This will make the login persistent across requests (if session management is enabled).

Specified by:

attachToSession in interface UserManager

Parameters:

user - the user to attach to the session

ctx - the current request to attach the user to

detachFromSession

public void detachFromSession(@Nonnull
                              UserInfo user,
                              @Nonnull
                              WebContext ctx)

Removes all stored user information from the current session.

Specified by:

detachFromSession in interface UserManager

Parameters:

user - the current user - passed in, in case a cache etc. has to be cleared

ctx - the request to remove all data from

isLoginSupported

public boolean isLoginSupported()

Description copied from interface: UserManager

Determines if a login via username and password is possible.

Specified by:

isLoginSupported in interface UserManager

Returns:

true if a username and password can be used to log a user in.

isKeepLoginSupported

public boolean isKeepLoginSupported()

Description copied from interface: UserManager

Determines if the login can be stored longer than a usual session.

Specified by:

isKeepLoginSupported in interface UserManager

Returns:

true if a "keep me logged in" function is available, false otherwise.