Bdb packages | Design docs | Source docs | Guidelines | Recent releases
	Search | Site Map .

                 

---

/BdbAccess/BdbAuthFederation.cc

Go to the documentation of this file.

//--------------------------------------------------------------------------
// File and Version Information:
//      $Id: BdbAuthFederation.cc,v 1.3 2002/06/21 18:30:19 ryd Exp $
//
// Description:
//      This class provides an access to and management of the BaBar
//      Database athorization records for a federation.
//
// Environment:
//      Software developed for the BaBar Detector at the SLAC B-Factory.
//
// Author List:
//      Igor A. Gaponenko       Original Author
//
// History:
//      Copyright (C) 2001      Lawrence Berkeley Laboratory
//
//------------------------------------------------------------------------
        /////////////////////////
        // This Class's Header //
        /////////////////////////

#include "BdbAccess/BdbAuthFederation.hh"

        ///////////////
        // C Headers //
        ///////////////

extern "C" {
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <time.h>
}

        /////////////////
        // C++ Headers //
        /////////////////

#include <iostream.h>
#include <string>
using std::string;

        /////////////////////////////////
        // Collaborating Class Headers //
        /////////////////////////////////

#include "BdbApplication/BdbDomain.hh"
#include "BdbAccess/BdbAuthRegistry.hh"
#include "BdbAccess/BdbAuthUser.hh"
#include "BdbAccess/BdbAuthGroup.hh"
#include "BdbAccess/BdbDbAccessMgr.hh"
#include "BdbAccess/BdbAuthCache.hh"
#include "BdbAccess/BdbAuthStatisticsMonitor.hh"


        /////////////////////////////////////////////////////////////////////////
        // Local Macros, Typedefs, Structures, Unions and Forward Declarations //
        /////////////////////////////////////////////////////////////////////////

static const char rcsid[] = "$Id: BdbAuthFederation.cc,v 1.3 2002/06/21 18:30:19 ryd Exp $";


        ////////////////////////////////////
        // Static Data Member Definitions //
        ////////////////////////////////////

const char* 
BdbAuthFederation::RegistryNames[] = { "Registry_of_Conditions",
                                       "Registry_of_Events",
                                       "Registry_of_Online",
                                       "Registry_of_Spatial",
                                       "Registry_of_Temporal",
                                       "Registry_of_Configuration",
                                       "Registry_of_Ambient" };

        ////////////////
        // Destructor //
        ////////////////

BdbAuthFederation::~BdbAuthFederation( )
{
    delete _statMon;
    delete _cache;
}

        /////////////////
        // Constructor //
        /////////////////

BdbAuthFederation::BdbAuthFederation( const char* theName ) :
    _shortTransactionIsDisabled(false),
    _shortTransactionIsActive(false),
    _cachingIsDisabled(false),
    _statMon(0),
    _cache(0),
    _myName("")
{
    if( 0 != theName ) _myName = theName;

    _statMon = new BdbAuthStatisticsMonitor( theName );

  // The actual database operations are deffered in order to allow someone else
  // to establish the proper context. 

    _isInitialized = false;
}

bool
BdbAuthFederation::initialize( )
{
    if( _isInitialized ) return _isInitialized;
    
  // Check for availability of short transaction, which is enabled by default.
  // This can be changed if the corresponding environment variable is found.

    if( 0 != getenv( "BDBAUTH_DISABLE_NESTED_TRANSACTIONS" )) {
        _shortTransactionIsDisabled = true;
    }
    
  // Check for availability of caching some frequently used information.
  // By default it's enabled.
  // The default behavior could be changed by defining
  // the following environment variable:
  //
  //    "BDBAUTH_DISABLE_CACHING"
  //

    if( 0 != getenv( "BDBAUTH_DISABLE_CACHING" )) {
        _cachingIsDisabled = true;
    }

  // Invalidate ::isAuthorized( ) cache.

    invalidateCache( );

  // Execute the rest of the method withing a short transaction in order to avoid
  // leaving the locked persistent objects.

    if( ! startShortReadTransaction( )) return _isInitialized;

    while( true ) {

      // Check if the database is properly configured.
      // Then lookup the registries in the authorization container.

        BdbHandle(BdbDBObj) theDbH;
        BdbDbAccessMgr      theAccessMgr;

        theAccessMgr.openManagementDb( theDbH, BdbcRead );
        if( BdbIsNull( theDbH )) {
            error( BdbDomain::IllegalDomain, "Unable to open/create Management DB." );
            break;
        }

      // Collect the information about registries for all known domains.
      //
      // NOTE: We are assuming that there is no holes in the enumeration of
      //       the domains.

        BdbHandle(BdbAuthRegistry) theRegH;

        for( int domain = BdbDomain::FirstDomain; domain < BdbDomain::IllegalDomain; domain++ ) {
            if( _registry[ domain - BdbDomain::FirstDomain ].isNull( )) {
                theRegH.lookupObj( theDbH, RegistryNames[ domain - BdbDomain::FirstDomain ], BdbcRead );
                _registry[ domain - BdbDomain::FirstDomain ] = theRegH;
            }
        }

      // And finally...

        bool transactionIsAvailable = true;
        if( ! populateCache( transactionIsAvailable )) {
            error( BdbDomain::IllegalDomain, "Failed to populate transient cache from the database." );
            break;
        }

      // Now, its all done.

        _isInitialized = true;

        break;
    }
    commitShortTransaction( );

    return _isInitialized;
}

        ///////////////
        // Utilities //
        ///////////////

char*
BdbAuthFederation::current_time( )
{
    time_t tt;
    char* buf;
    char* str;
    int i;

  // Obtain current time in ASCII in the following format:
  //   "Thu Sep  4 22:25:44 1997"

    tt  = time ( &tt );
    buf = ctime( &tt );

  // Compress the interesting information into:
  //   "Sep  4 22:25 1997"

    str = new char[18];

    // This does not work for unknown reason.
    // replaced by a stupid loop.
    //
    //    strncpy( &(str[0]), &(buf[4]), 12 );

    for( i = 0; i < 12; i++ )
        str[0+i] = buf[4+i];

    str[12] = ' ';

    // This does not work for unknown reason.
    // replaced by a stupid loop.
    //
    //    strncat( &(str[13]), &(buf[20]), 4  );

    for( i = 0; i < 4; i++ )
        str[13+i] = buf[20+i];

    str[17] = '\0';

    //    delete [] buf; We didn't do the new so I don't think we should delete it

    return str;
}

        ///////////////////////
        // Selectors (const) //
        ///////////////////////

string
BdbAuthFederation::getName( )
{
    return _myName;
}

        ///////////////
        // Selectors //
        ///////////////

d_Boolean
BdbAuthFederation::isInitialized( BdbDomain::Domains theDomain )
{
    assert( BdbDomain::isDomainValid( theDomain ));

    if( ! initialize( )) return false;

  // The domain is initialized if the corresponding Registry exists.

    return ( ! BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] ));
}

d_Boolean
BdbAuthFederation::isAuthorized( BdbDomain::Domains    theDomain,
                                 BdbDomain::AuthLevels theAuthLevel,
                                 const char*           theAuthName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid   ( theDomain    ));
    assert( BdbDomain::isAuthLevelValid( theAuthLevel ));

    const char* theUserName  = BdbDomain::userName( );
    const char* theGroupName = theAuthName;

    _statMon->increment_isAuthorized( );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Make sure the cache is populated (some actions modifying the contents
  // of the database may destroy it).

    bool transactionIsAvailable = false;
    if( ! populateCache( transactionIsAvailable )) {
        error( theDomain, "Failed to populate transient cache from the database." );
        return false;
    }

  // Try to find the record in the cache.

    if( tryCache( theDomain,
                  theAuthLevel,
                  theAuthName,
                  theUserName,
                  result )) return result;

  // WARNING:
  // ========
  //
  //   The following piece of code is executed within a short read-mode transaction
  //   in order to prevent possible locks.
  //
  //   The code is arranged in "exception-like" while-do loop. This is done in order
  //   to close transaction in the end.
  //
  //   A successfull sequence of execution is indicated by the "result"
  //   varisble set to "d_True" value.

    if( ! startShortReadTransaction( )) return result;

    while( true ) {

      // Use handles for better efficiency.

        BdbHandle(BdbAuthRegistry) theRegH;
        BdbHandle(BdbAuthGroup)    theGroupH;
        BdbHandle(BdbAuthUser)     theUserH;

        theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

      // Try to find this user in the database.

        theUserH = theRegH->getUser( theUserName );
        if( BdbIsNull( theUserH )) {
            error( theDomain, "User does not exist." );
            break;
        }

      // Make specific checking for the given authorization level.

        switch( theAuthLevel ) {

        case BdbDomain::System:

          // Verify if the user may assume SYSTEM-level rights.

            if( theUserH->isSystemManager( )) result = true;
            break;

        case BdbDomain::Group:

          // Verify if the user belongs to specified group (or is system manager)

            if( theUserH->isSystemManager( )) {
                result = true;
            } else {

                if( 0 == theGroupName ) {
                    error( theDomain, "Bad parameters. Group name must be specified." );
                } else {

                    theGroupH = theUserH->getGroup( theGroupName );
                    if( BdbIsNull( theGroupH )) {

                        char* buf = new char [ 45 + strlen(theGroupName) ];
                        sprintf(buf, "User is not a member of the group \"%s\".", theGroupName);

                        error( theDomain, buf );

                        delete [] buf;

                    } else {
                        result = true;
                    }
                }
            }
            break;

        case BdbDomain::User:

          // Here is nothing more to check, because such a user exists.

            result = true;

            break;
        }
        break;
    }

  // End current short transaction.

    commitShortTransaction( );

  // Update the cache.

    updateCache( theDomain,
                 theAuthLevel,
                 theAuthName,
                 theUserName,
                 result );

    return result;
}

d_Boolean
BdbAuthFederation::isSystemManager( BdbDomain::Domains theDomain,
                                    const char*        theUserName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return result;
    }

  // Obtain and return desired information.

    return theUserH->isSystemManager( );
}

d_Boolean
BdbAuthFederation::isGroupManager( BdbDomain::Domains theDomain,
                                   const char*        theUserName,
                                   const char*        theGroupName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );
    assert( 0 != theGroupName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return result;
    }

  // Try to find the group.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return result;
    }

  // Try to find the user in the group in the list of managers.

    theUserH = theGroupH->getManager( theUserName );

    return ( ! BdbIsNull( theUserH ));
}

d_Boolean
BdbAuthFederation::isGroupMember( BdbDomain::Domains theDomain,
                                  const char*        theUserName,
                                  const char*        theGroupName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );
    assert( 0 != theGroupName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return result;
    }

  // Try to find the group in the database.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return result;
    }

  // Try to find the user in the group.

    theUserH = theGroupH->getUser( theUserName );

    return ( ! BdbIsNull( theUserH ));
}

d_Boolean
BdbAuthFederation::isDomainMember( BdbDomain::Domains theDomain,
                                   const char*        theUserName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );

    return ( ! BdbIsNull( theUserH ));
}

d_Boolean
BdbAuthFederation::isAccessAllowed( BdbDomain::Domains theDomain,
                                    const char*        theUserName )
{
    d_Boolean result = isDomainMember( theDomain, theUserName );
    if( ! result ) {
        result = ( ! isDomainMember( theDomain, "registered_only" ));
    }
    return result;
}

const char*
BdbAuthFederation::getUserDescription( BdbDomain::Domains theDomain,
                                       const char*        theUserName )
{
    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );

    if( ! initialize( )) return 0;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return 0;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return 0;
    }

    return theUserH->getDescription( );
}

const char*
BdbAuthFederation::getUserCreated( BdbDomain::Domains theDomain,
                                   const char*        theUserName )
{
    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );

    if( ! initialize( )) return 0;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return 0;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return 0;
    }

    return theUserH->getCreated( );
}

const char*
BdbAuthFederation::getGroupDescription( BdbDomain::Domains theDomain,
                                        const char*        theGroupName )
{
    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theGroupName );

    if( ! initialize( )) return 0;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return 0;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this group in the database.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return 0;
    }

    return theGroupH->getDescription( );
}

const char*
BdbAuthFederation::getGroupCreated( BdbDomain::Domains theDomain,
                                    const char*        theGroupName )
{
    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theGroupName );

    if( ! initialize( )) return 0;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return 0;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Try to find this group in the database.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return 0;
    }

    return theGroupH->getCreated( );
}

        ////////////////
        // Operations //
        ////////////////

d_Boolean
BdbAuthFederation::initialize( BdbDomain::Domains theDomain )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));

    d_ULong status;

    if( ! initialize( )) return result;

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Delete domain information if it still exists (only a System Manager can do this).

    if( ! BdbIsNull( theRegH )) {

        if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
            error( theDomain, "No privileges for this operation." );
            return result;
        }
        BdbDelete( theRegH );
    }

  // Open the management database.

    BdbHandle(BdbDBObj) theDbH;
    BdbDbAccessMgr      theAccessMgr;

    theAccessMgr.openManagementDb( theDbH, BdbcRead );
    if( BdbIsNull( theDbH )) {
        error( theDomain, "Unable to open/create Management DB." );
        return result;
    }

  // Create the authorization container if it doesn't exist

    const char* authContName = "authorization";

    BdbHandle(BdbContObj) theContH;

    if( BdbcSuccess != theContH.exist( theDbH, authContName, BdbcRead )) {
        theContH = new( authContName, 0, 1, 1, theDbH ) BdbContObj;
        if( BdbIsNull( theContH )) {
            error( theDomain, "Unable to create authorization container" );
        }
    }

  // Create the registry object and give it a name.

    theRegH = new( theContH ) BdbAuthRegistry;
    if( BdbIsNull( theRegH )) {
        error( theDomain, "Unable to create a registry." );
        return result;
    }
    status = theRegH.nameObj( theDbH, RegistryNames[ theDomain - BdbDomain::FirstDomain ] );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to give a name to the registry." );
        return result;
    }

  // Create default group. Then add it to the registry.

    BdbHandle(BdbAuthGroup) theGroupH;

    theGroupH = new( theContH ) BdbAuthGroup( "Global", current_time( ), "default group" );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Unable to create default group." );
        return result;
    }
    status = theRegH->addGroup( theGroupH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add default group to the registry." );
        return result;
    }

  // Create initial user. Make him a system manager.
  // Then add his record to the registry and to default group.

    BdbHandle(BdbAuthUser) theUserH;

    theUserH = new( theContH ) BdbAuthUser( BdbDomain::userName( ), current_time( ), "initial system manager" );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "Unable to create initial user." );
        return result;
    }
    theUserH->setSystemManager( true );

    status = theRegH->addUser( theUserH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add the user to the registry." );
        return result;
    }
    status = theGroupH->addMember( theUserH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add a member to the group." );
        return result;
    }

  // Create lock container used during db creation.

    BdbHandle(BdbContObj) lockCont;
    const char* lockContName = "dbLock";

    if( BdbcSuccess != lockCont.exist( theDbH, lockContName, BdbcNoOpen )) {
        new( lockContName, 0, 1, 1, theDbH ) BdbContObj;
    }

  // Make the registry reference available.

    _registry[ theDomain - BdbDomain::FirstDomain ] = theRegH;

    return true;
}

d_Boolean
BdbAuthFederation::createUser( BdbDomain::Domains    theDomain,
                               BdbDomain::AuthLevels theAuthLevel,
                               const char*           theUserName,
                               const char*           theGroupName,
                               const char*           theDescription )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( BdbDomain::isAuthLevelValid( theAuthLevel ));
    assert( 0 != theUserName );

    d_ULong status;

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );
    if( ! BdbIsNull( theUserH )) {
        error( theDomain, "User already exists." );
        return result;
    }

  // Create new user record. Tune it.
  // Then add the record to the registry.

    theUserH = new( theRegH ) BdbAuthUser( theUserName, current_time( ), theDescription );

    if( BdbIsNull( theUserH )) {
        error( theDomain, "Unable to create the user." );
        return result;
    }
    if( BdbDomain::System == theAuthLevel ) {
        theUserH->setSystemManager( true );
    }

    status = theRegH->addUser( theUserH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add the user to the registry." );
        return result;
    }

  // Obtain the default group.
  // Then add user record to the default group.

    theGroupH = theRegH->getGroup( "Global" );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Default group does not exist." );
        BdbDelete( theUserH );
        return result;
    }

    status = theGroupH->addMember( theUserH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add a member to the group." );
        return result;
    }

  // If running on Group authorization level - try to find specified
  // group. Then add user there, if it is not the default group.

    if( BdbDomain::Group == theAuthLevel ) {

        if( 0 == theGroupName ) {
            error( theDomain, "Illegal parameters. Group name must be specified." );
            BdbDelete( theUserH );
            return result;
        }
        if( 0 == strcmp( "Global", theGroupName )) {
            error( theDomain, "Can not include the user into default group." );
            BdbDelete( theUserH );
            return result;
        }

        theGroupH = theRegH->getGroup( theGroupName );
        if( BdbIsNull( theGroupH )) {
            error( theDomain, "The group does not exist." );
            BdbDelete( theUserH );
            return result;
        }

        status = theGroupH->addMember( theUserH );
        if( BdbcSuccess != status ) {
            error( theDomain, "Unable to add a member to the group." );
            BdbDelete( theUserH );
            return result;
        }
    }

    return true;
}

d_Boolean
BdbAuthFederation::deleteUser( BdbDomain::Domains theDomain,
                               const char*        theUserName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // Try to find specified user in the database. Then delete it
  // if exists. The user will be atomatically excluded from
  // all the groups it belongs to.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return result;
    }
    BdbDelete( theUserH );

    return true;
}

d_Boolean
BdbAuthFederation::createGroup( BdbDomain::Domains theDomain,
                                const char*        theGroupName,
                                const char*        theDescription )
{
    d_Boolean result = false;

    d_ULong status;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theGroupName );
    assert( 0 != theDescription );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // Do not create the default group.

    if( 0 == strcmp( "Global", theGroupName )) {
        error( theDomain, "Default group can not be created." );
        return result;
    }

  // Try to find this group in the database.

    theGroupH = theRegH->getGroup( theGroupName );
    if( ! BdbIsNull( theGroupH )) {
        error( theDomain, "Group already exists." );
        return result;
    }

  // Make new group record then add it to registry.

    theGroupH = new( theRegH ) BdbAuthGroup( theGroupName, current_time( ), theDescription );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Unable to create the group." );
        return result;
    }

    status = theRegH->addGroup( theGroupH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add the group to the registry." );
        BdbDelete( theGroupH );
        return result;
    }

    return true;
}

d_Boolean
BdbAuthFederation::deleteGroup( BdbDomain::Domains theDomain,
                                const char*        theGroupName )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theGroupName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // Do not delete the default group.

    if( 0 == strcmp( "Global", theGroupName )) {
        error( theDomain, "Default group can not be deleted." );
        return result;
    }

  // Try to find specified group in the database. Then delete it
  // if exists.
  // All the existing group members will be automatically disconnected
  // from the group.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return result;
    }
    BdbDelete( theGroupH );

    return true;
}

d_Boolean
BdbAuthFederation::includeUser( BdbDomain::Domains theDomain,
                                const char*        theUserName,
                                const char*        theGroupName )
{
    d_Boolean result = false;

    d_ULong status;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );
    assert( 0 != theGroupName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        if( ! isGroupManager( theDomain, BdbDomain::userName( ), theGroupName )) {
            error( theDomain, "No privileges for this operation." );
            return result;
        }
    }

  // Do not include into default group.

    if( 0 == strcmp( "Global", theGroupName )) {
        error( theDomain, "Cannot include into default group." );
        return result;
    }

  // Try to find specified group in the databongs

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "The group does not exist." );
        return result;
    }

  // Try to find the user in this group.

    theUserH = theGroupH->getUser( theUserName );
    if( ! BdbIsNull( theUserH )) {
        warning( theDomain, "The user is already a member of this group." );
        return true;
    }

  // Try to find specified user in all the database.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "The user does not exist." );
        return result;
    }

  // Include user into the group.

    status = theGroupH->addMember( theUserH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add new member to the group." );
        return result;
    }

    return true;
}

d_Boolean
BdbAuthFederation::excludeUser( BdbDomain::Domains theDomain,
                                const char*        theUserName,
                                const char*        theGroupName )
{
    d_Boolean result = false;

    d_ULong status;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );
    assert( 0 != theGroupName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        if( ! isGroupManager( theDomain, BdbDomain::userName( ), theGroupName )) {
            error( theDomain, "No privileges for this operation." );
            return result;
        }
    }

  // Do not exclude from default group.

    if( 0 == strcmp( "Global", theGroupName )) {
        error( theDomain, "Cannot exclude from default group." );
        return result;
    }

  // Try to find specified group in the database.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return result;
    }

  // Try to find the user in this group.

    theUserH = theGroupH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        warning( theDomain, "User is not a member of this group." );
        return true;
    }

  // Exclude user from the group.

    status = theUserH->excludeFromGroup( theGroupH );
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to remove user from the group." );
        return result;
    }

    return true;
}

d_Boolean
BdbAuthFederation::deleteDomain( BdbDomain::Domains theDomain )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // Delete specified registry as a composite object.

    BdbDelete( theRegH );

  // Update information in the persistent cache.

    _registry[ theDomain - BdbDomain::FirstDomain ] = 0;

    return true;
}

d_Boolean
BdbAuthFederation::setSystemManager( BdbDomain::Domains theDomain,
                                     const char*        theUserName,
                                     d_Boolean          onOff )
{
    d_Boolean result = false;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // Try to find this user in the database.
  // Then set/reset his system management right.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return result;
    }
    theUserH->setSystemManager( onOff );

    return true;
}

d_Boolean
BdbAuthFederation::setGroupManager( BdbDomain::Domains theDomain,
                                    const char*        theUserName,
                                    const char*        theGroupName,
                                    d_Boolean          onOff )
{
    d_Boolean result = false;

    d_ULong status;

    assert( BdbDomain::isDomainValid( theDomain ));
    assert( 0 != theUserName );
    assert( 0 != theGroupName );

    if( ! initialize( )) return result;

    if( BdbIsNull( _registry[ theDomain - BdbDomain::FirstDomain ] )) {
        error( theDomain, "Authorization database is not configured." );
        return result;
    }

  // Use handles for better efficiency.

    BdbHandle(BdbAuthRegistry) theRegH;
    BdbHandle(BdbAuthUser)     theUserH;
    BdbHandle(BdbAuthGroup)    theGroupH;

    theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];

  // Invalidate ::isAuthorized( ) cache, for now we are going
  // to modify the contents of the database which eventually could
  // lead to the cache inconsistancy.

    invalidateCache( );

  // Check for the user rights to perform this operation.

    if( ! isSystemManager( theDomain, BdbDomain::userName( ))) {
        error( theDomain, "No privileges for this operation." );
        return result;
    }

  // This operation is not allowed for the default group.

    if( 0 == strcmp( "Global", theGroupName )) {
        error( theDomain, "The operation is not allowed for the default group." );
        return result;
    }
  // Try to find this user in the database.

    theUserH = theRegH->getUser( theUserName );
    if( BdbIsNull( theUserH )) {
        error( theDomain, "User does not exist." );
        return result;
    }

  // Try to find the group in the database.

    theGroupH = theRegH->getGroup( theGroupName );
    if( BdbIsNull( theGroupH )) {
        error( theDomain, "Group does not exist." );
        return result;
    }

  // Add/remove user as a manager of the group.

    if( onOff ) {
        status = theGroupH->addManager( theUserH );
    } else {
        status = theGroupH->removeManager( theUserH );
    }
    if( BdbcSuccess != status ) {
        error( theDomain, "Unable to add/remove user as a group manager." );
        return result;
    }

    return true;
}

        //////////////////////////////////
        // Short transaction management //
        //////////////////////////////////

d_Boolean
BdbAuthFederation::startShortReadTransaction( )
{
  // Avoid using short transactions if it's not required.

    if( _shortTransactionIsDisabled ) return true;

  // We allow one more level of nested transactions only.

    if( _shortTransactionIsActive ) {
        error( BdbDomain::IllegalDomain, "Short transaction is already active. Internal bug." );
        return false;
    }

  // Start a transaction in another context.

    BdbApplicationOrDomain* theApp = BdbApplicationOrDomain::activeInstance( );
    BdbStatus               status;

    status = theApp->startNestedRead( );
    if( BdbcSuccess != status ) {
        error( BdbDomain::IllegalDomain, "Failed to start nested transaction." );
        return false;
    }
    _shortTransactionIsActive = true;

    return true;
}

d_Boolean
BdbAuthFederation::commitShortTransaction( )
{
  // Avoid using short transactions if it's not required.

    if( _shortTransactionIsDisabled ) return true;

  // We allow one more level of nested transactions only. At this point this transaction
  // should be actiaved.

    if( ! _shortTransactionIsActive ) {
        error( BdbDomain::IllegalDomain, "Short transaction is not active. Internal bug." );
        return false;
    }

  // Commit current transaction.

    BdbApplicationOrDomain* theApp = BdbApplicationOrDomain::activeInstance( );
    BdbStatus               status;

    status = theApp->commitNested( );
    if( BdbcSuccess != status ) {
        error( BdbDomain::IllegalDomain, "Failed to commit nested transaction." );
        return false;
    }
    _shortTransactionIsActive = false;

  // Done.

    return true;
}

        ///////////////////////////////////////
        // ::isAuthorized( ) cache management //
        ///////////////////////////////////////

bool
BdbAuthFederation::tryCache( BdbDomain::Domains    theDomain,
                             BdbDomain::AuthLevels theAuthLevel,
                             const char*           theAuthName,
                             const char*           theUserName,
                             d_Boolean&            isAuthorizedFlag )
{
  // The cache is always empty if caching is disabled.

    if( _cachingIsDisabled ) return false;
    if( 0 == _cache )        return false;

    return _cache->tryCache( theDomain,
                             theAuthLevel,
                             theAuthName,
                             theUserName,
                             isAuthorizedFlag );
}
                       
void
BdbAuthFederation::updateCache( BdbDomain::Domains    theDomain,
                                BdbDomain::AuthLevels theAuthLevel,
                                const char*           theAuthName,
                                const char*           theUserName,
                                d_Boolean             isAuthorizedFlag )
{
  // The cache is never updated if caching is disabled.

    if( _cachingIsDisabled ) return;
    if( 0 == _cache ) _cache = new BdbAuthCache( );

    _cache->updateCache( theDomain,
                         theAuthLevel,
                         theAuthName,
                         theUserName,
                         isAuthorizedFlag );

  // Update statistics.

    _statMon->increment_reloadCache( );
}

void
BdbAuthFederation::invalidateCache( )
{
  // The cache is never touched if caching is disabled.

    if( _cachingIsDisabled ) return;

    delete _cache;
    _cache = 0;
}

bool
BdbAuthFederation::populateCache( bool transactionIsAvailable )
{
  // NOTE: The cache is never touched if caching is disabled
  //       or if it's already loaded.

    if( _cachingIsDisabled ) return true;
    if( 0 != _cache ) return true;

  // Do cache loading in a kind of exception loop to provide the flawless
  // transaction management logic (if the one is needed) and cleanup seqeunce
  // if the loading will fail.

    bool failed = false;

    if( ! transactionIsAvailable ) {
        if( ! startShortReadTransaction( )) return false;
    }
    _cache = new BdbAuthCache( );

    while( true ) {

      // Use handles for better efficiency.

        BdbHandle(BdbAuthRegistry) theRegH;
        BdbHandle(BdbAuthGroup)    theGroupH;
        BdbHandle(BdbAuthUser)     theUserH;

        const char* theUserName = BdbDomain::userName( );
        const char* theGroupName;

        for( int theDomain = BdbDomain::FirstDomain;
                 theDomain < BdbDomain::IllegalDomain;
                 theDomain++ ) {

          // Just ignore non-initialized domain. There will be no information
          // in the cache about this domain.

            theRegH = _registry[ theDomain - BdbDomain::FirstDomain ];
            if( BdbIsNull( theRegH )) continue;

          // Just ignore non-existing user. There will be no information
          // in the cache about this domain.

            theUserH = theRegH->getUser( theUserName );
            if( BdbIsNull( theUserH )) continue;

          // System

            d_Boolean resultForSystem = theUserH->isSystemManager( );

            updateCache( static_cast<BdbDomain::Domains>( theDomain ),
                         BdbDomain::System,
                         0,
                         theUserName,
                         resultForSystem );

          // Group
          //
          //    NOTE: If a user is a System Manager then he/she is authorized
          //          for all the known groups, if not then only for those
          //          ones he/she is explicitly registered in.

            BdbItr(BdbAuthGroup) theItr;

            if( resultForSystem ) {
                theRegH->setGroupsItr( theItr );
            } else {
                theUserH->setGroupsItr( theItr );
            }
            while( theItr.next( )) {

                theGroupH = (const BdbHandle(BdbAuthGroup)&) theItr;
                if( BdbIsNull( theGroupH )) {
                    BdbAuthFederation::error( static_cast<BdbDomain::Domains>( theDomain ), "Inconsistency in the Authorization database." );
                    failed = true;
                    break;
                }
                updateCache( static_cast<BdbDomain::Domains>( theDomain ),
                             BdbDomain::Group,
                             theGroupH->getName( ),
                             theUserName,
                             d_True );
            }
            if( failed ) break;

          // User
          //
          //    NOTE: There is nothing to check - the user already exist.

            updateCache( static_cast<BdbDomain::Domains>( theDomain ),
                         BdbDomain::User,
                         0,
                         theUserName,
                         d_True );
        }
        break;
    }
    if( failed ) {
        invalidateCache( );
    }
    if( ! transactionIsAvailable ) {
        commitShortTransaction( );
    }

    return ! failed;
}

        ////////////////////////
        // Messages reporting //
        ////////////////////////

void
BdbAuthFederation::message( BdbDomain::Domains theDomain,
                            const char*        theMessage )
{
    cout << "BdbAuthFederation::message() " << theMessage << endl
         << "    FEDERATION: " << _myName << endl
         << "    DOMAIN:     " << BdbDomain::domainName( theDomain ) << endl;
}

void
BdbAuthFederation::warning( BdbDomain::Domains theDomain,
                            const char*        theMessage )
{
    cout << "BdbAuthFederation::warning() " << theMessage << endl
         << "    FEDERATION: " << _myName << endl
         << "    DOMAIN:     " << BdbDomain::domainName( theDomain ) << endl;
}

void
BdbAuthFederation::error( BdbDomain::Domains theDomain,
                          const char*        theMessage )
{
    cout << "BdbAuthFederation::error() " << theMessage << endl
         << "    FEDERATION: " << _myName << endl
         << "    DOMAIN:     " << BdbDomain::domainName( theDomain ) << endl;
}

void
BdbAuthFederation::fatal( BdbDomain::Domains theDomain,
                          const char*        theMessage,
                          int                exitCode )
{
    cout << "BdbAuthFederation::fatal() " << theMessage << endl
         << "    FEDERATION: " << _myName << endl
         << "    DOMAIN:     " << BdbDomain::domainName( theDomain ) << endl;

    exit( exitCode );
}

/////////////////
// End Of File //
/////////////////

 

---

BaBar Public Site | SLAC | News | Links | Who's Who | Contact Us

Page Owner: Jacek Becla
Last Update: October 04, 2002