Package org.openiam.authmanager.service.impl

Class AuthorizationManagerServiceImpl

java.lang.Object

org.openiam.common.authmanager.service.AbstractAuthorizationManagerService

org.openiam.authmanager.service.impl.AuthorizationManagerServiceImpl

All Implemented Interfaces:

AuthorizationManagerService, Sweepable, org.springframework.beans.factory.Aware, org.springframework.context.ApplicationContextAware

@Service("authorizationManagerService")
public class AuthorizationManagerServiceImpl
extends AbstractAuthorizationManagerService
implements AuthorizationManagerService, org.springframework.context.ApplicationContextAware, Sweepable

Author:

Lev Bornovalov Use this class for checking Entitlements between Users, Groups, Roles, Organizations, and Resources This class uses JDBC Daos directly, in order to circumvent Hibernate. In order to have a high-performing partial-cache, custom JDBC Queries are required under high load (hence, the reason Hibernate is not used here) This class is READ-ONLY! No Database writes should be performed

Field Summary

Fields inherited from class org.openiam.common.authmanager.service.AbstractAuthorizationManagerService

resourceDAO, resourcePropDAO, transactionTemplate

Constructor Summary

Constructors

Constructor

Description

AuthorizationManagerServiceImpl(org.springframework.transaction.PlatformTransactionManager platformTransactionManager, PropertyValueCache propertyValueSweeper, UserRabbitMQService userRabbitMQService, RabbitMQSender rabbitMQSender, MembershipDAO membershipDAO, AuthManagerDAO authManagerDAO, ProvisionBulkQueue provisionQueue, AuthorizationManagerDataProvider dataProvider, org.apache.tinkerpop.gremlin.process.traversal.dsl.graph.GraphTraversalSource graphSource, org.redisson.api.RedissonClient redissonClient, EdgeIdCacheSweeper edgeIdCacheSweeper, EntitltementsObjectCache publicResourceCache, org.springframework.data.redis.core.RedisTemplate<String,AuthorizationCacheToken> remoteEntitlementsCache, GraphIdCacheSweeper graphIdCacheSweeper, AbstractGraphIdProvider graphIdProvider, GraphOperations graphOperations, EntitltementsObjectCacheSweeper entitlementsObjectsCacheSweeper, AuthManagerMQService authManagerMQService, org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor entitlementsExecutor)

Method Summary

Modifier and Type	Method	Description
void	fixDataInconsistencies()	In case of errors (database transaction timeout, etc), this method will TRY to fix it
Map<String,Boolean>	getEntitlementMap(String userId, Set<String> resourceIds)
Set<GroupAuthorizationRight>	getGroupsForUser(String userId)
ResourceEntitlementToken	getNonCachedEntitlementsForGroup(NonCachedEntitlementRequest request)
ResourceEntitlementToken	getNonCachedEntitlementsForOrganization(NonCachedEntitlementRequest request)
ResourceEntitlementToken	getNonCachedEntitlementsForResource(NonCachedEntitlementRequest request)
ResourceEntitlementToken	getNonCachedEntitlementsForRole(NonCachedEntitlementRequest request)
ResourceEntitlementToken	getNonCachedEntitlementsForUser(NonCachedEntitlementRequest request)
Set<OrganizationAuthorizationRight>	getOrganizationsForUser(String userId)
Set<String>	getOwnerIdsForGroup(String groupId)
HashMap<String,SetStringResponse>	getOwnerIdsForGroupSet(Set<String> groupIdSet)
HashMap<String,SetStringResponse>	getOwnerIdsForResourceSet(Set<String> resourceIdSet)
Set<ResourceAuthorizationRight>	getResourcesForUser(String userId)
Set<RoleAuthorizationRight>	getRolesForUser(String userId)
void	init()
void	invalidateUserEntitlementsFromCache(String id)
boolean	isEntitled(String userId, String resourceId)
boolean	isEntitled(String userId, String resourceId, String rightId)
boolean	isMemberOfGroup(String userId, String groupId)
boolean	isMemberOfGroup(String userId, String groupId, String rightId)
boolean	isMemberOfOrganization(String userId, String organizationId)
boolean	isMemberOfOrganization(String userId, String organizationId, String rightId)
boolean	isMemberOfRole(String userId, String roleId)
boolean	isMemberOfRole(String userId, String roleId, String rightId)
void	markUserAsEntitlementsLoadingInProgress(String userId, boolean inProgress)
void	rebuildGraph()	For test or emergency use only.
void	removeExpiredEdges()	this method removes expired edges from the database
void	setApplicationContext(org.springframework.context.ApplicationContext ctx)
boolean	showOnlyVisibleObjects(String userId)
void	sweep()	This function builds a graph of entitelements in the underlying graph database

Methods inherited from class org.openiam.common.authmanager.service.AbstractAuthorizationManagerService

createMenuTrees, getAccessRight, getAccessRight, getAllMenuTrees, getMembershipMapByEntityId, getMembershipMapByMemberEntityId, getMenus, getMenuTree, getRightMap, localize

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AuthorizationManagerServiceImpl

public AuthorizationManagerServiceImpl(@Qualifier("transactionManager")
                                       org.springframework.transaction.PlatformTransactionManager platformTransactionManager,
                                       PropertyValueCache propertyValueSweeper,
                                       UserRabbitMQService userRabbitMQService,
                                       RabbitMQSender rabbitMQSender,
                                       MembershipDAO membershipDAO,
                                       AuthManagerDAO authManagerDAO,
                                       ProvisionBulkQueue provisionQueue,
                                       AuthorizationManagerDataProvider dataProvider,
                                       org.apache.tinkerpop.gremlin.process.traversal.dsl.graph.GraphTraversalSource graphSource,
                                       org.redisson.api.RedissonClient redissonClient,
                                       EdgeIdCacheSweeper edgeIdCacheSweeper,
                                       EntitltementsObjectCache publicResourceCache,
                                       @Qualifier("remoteEntitlementsCache")
                                       org.springframework.data.redis.core.RedisTemplate<String,AuthorizationCacheToken> remoteEntitlementsCache,
                                       GraphIdCacheSweeper graphIdCacheSweeper,
                                       AbstractGraphIdProvider graphIdProvider,
                                       GraphOperations graphOperations,
                                       EntitltementsObjectCacheSweeper entitlementsObjectsCacheSweeper,
                                       AuthManagerMQService authManagerMQService,
                                       @Qualifier("entitlementsExecutor")
                                       org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor entitlementsExecutor)

Method Detail

rebuildGraph

public void rebuildGraph()

Description copied from interface: AuthorizationManagerService

For test or emergency use only. If your data set is large, this function will likely time-out if calling via HTTP and/or RabbitMQ This function will delete the entire graph, and rebuild it from scratch

Specified by:

rebuildGraph in interface AuthorizationManagerService

init

@PostConstruct
public void init()

fixDataInconsistencies

@Transactional
@Scheduled(initialDelay=10000L,
           fixedRateString="${org.openiam.authorization.manager.gremlin.fix.data.time.ms}")
public void fixDataInconsistencies()

In case of errors (database transaction timeout, etc), this method will TRY to fix it

In addition, this method will insert edges where startDate and/or endDate is within the current range

Specified by:

fixDataInconsistencies in interface AuthorizationManagerService

removeExpiredEdges

@Scheduled(initialDelayString="${org.openiam.authorization.manager.gremlin.edge.sync.time.ms}",
           fixedRateString="${org.openiam.authorization.manager.gremlin.edge.sync.time.ms}")
@Transactional
public void removeExpiredEdges()

this method removes expired edges from the database

Specified by:

removeExpiredEdges in interface AuthorizationManagerService

sweep

public void sweep()

This function builds a graph of entitelements in the underlying graph database

Specified by:

sweep in interface Sweepable

setApplicationContext

public void setApplicationContext(org.springframework.context.ApplicationContext ctx)
                           throws org.springframework.beans.BeansException

Specified by:

setApplicationContext in interface org.springframework.context.ApplicationContextAware

Throws:

org.springframework.beans.BeansException

isMemberOfGroup

public boolean isMemberOfGroup(String userId,
                               String groupId)

Specified by:

isMemberOfGroup in interface AuthorizationManagerService

isMemberOfGroup

public boolean isMemberOfGroup(String userId,
                               String groupId,
                               String rightId)

Specified by:

isMemberOfGroup in interface AuthorizationManagerService

isMemberOfRole

public boolean isMemberOfRole(String userId,
                              String roleId)

Specified by:

isMemberOfRole in interface AuthorizationManagerService

isMemberOfRole

public boolean isMemberOfRole(String userId,
                              String roleId,
                              String rightId)

Specified by:

isMemberOfRole in interface AuthorizationManagerService

getResourcesForUser

public Set<ResourceAuthorizationRight> getResourcesForUser(String userId)

Specified by:

getResourcesForUser in interface AuthorizationManagerService

getGroupsForUser

public Set<GroupAuthorizationRight> getGroupsForUser(String userId)

Specified by:

getGroupsForUser in interface AuthorizationManagerService

getOrganizationsForUser

public Set<OrganizationAuthorizationRight> getOrganizationsForUser(String userId)

Specified by:

getOrganizationsForUser in interface AuthorizationManagerService

getRolesForUser

public Set<RoleAuthorizationRight> getRolesForUser(String userId)

Specified by:

getRolesForUser in interface AuthorizationManagerService

isEntitled

public boolean isEntitled(String userId,
                          String resourceId)

Specified by:

isEntitled in interface AuthorizationManagerService

isEntitled

public boolean isEntitled(String userId,
                          String resourceId,
                          String rightId)

Specified by:

isEntitled in interface AuthorizationManagerService

isMemberOfOrganization

public boolean isMemberOfOrganization(String userId,
                                      String organizationId)

Specified by:

isMemberOfOrganization in interface AuthorizationManagerService

isMemberOfOrganization

public boolean isMemberOfOrganization(String userId,
                                      String organizationId,
                                      String rightId)

Specified by:

isMemberOfOrganization in interface AuthorizationManagerService

showOnlyVisibleObjects

public boolean showOnlyVisibleObjects(String userId)

Specified by:

showOnlyVisibleObjects in interface AuthorizationManagerService

getEntitlementMap

public Map<String,Boolean> getEntitlementMap(String userId,
                                                   Set<String> resourceIds)

Specified by:

getEntitlementMap in interface AuthorizationManagerService

invalidateUserEntitlementsFromCache

public void invalidateUserEntitlementsFromCache(String id)

Specified by:

invalidateUserEntitlementsFromCache in interface AuthorizationManagerService

getNonCachedEntitlementsForUser

public ResourceEntitlementToken getNonCachedEntitlementsForUser(NonCachedEntitlementRequest request)
                                                         throws NoGraphIdFoundException

Specified by:

getNonCachedEntitlementsForUser in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getNonCachedEntitlementsForGroup

public ResourceEntitlementToken getNonCachedEntitlementsForGroup(NonCachedEntitlementRequest request)
                                                          throws NoGraphIdFoundException

Specified by:

getNonCachedEntitlementsForGroup in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getNonCachedEntitlementsForResource

public ResourceEntitlementToken getNonCachedEntitlementsForResource(NonCachedEntitlementRequest request)
                                                             throws NoGraphIdFoundException

Specified by:

getNonCachedEntitlementsForResource in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getNonCachedEntitlementsForRole

public ResourceEntitlementToken getNonCachedEntitlementsForRole(NonCachedEntitlementRequest request)
                                                         throws NoGraphIdFoundException

Specified by:

getNonCachedEntitlementsForRole in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getNonCachedEntitlementsForOrganization

public ResourceEntitlementToken getNonCachedEntitlementsForOrganization(NonCachedEntitlementRequest request)
                                                                 throws NoGraphIdFoundException

Specified by:

getNonCachedEntitlementsForOrganization in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getOwnerIdsForResourceSet

public HashMap<String,SetStringResponse> getOwnerIdsForResourceSet(Set<String> resourceIdSet)
                                                                  throws NoGraphIdFoundException

Specified by:

getOwnerIdsForResourceSet in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getOwnerIdsForGroup

public Set<String> getOwnerIdsForGroup(String groupId)
                                throws NoGraphIdFoundException

Specified by:

getOwnerIdsForGroup in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

getOwnerIdsForGroupSet

public HashMap<String,SetStringResponse> getOwnerIdsForGroupSet(Set<String> groupIdSet)
                                                               throws NoGraphIdFoundException

Specified by:

getOwnerIdsForGroupSet in interface AuthorizationManagerService

Throws:

NoGraphIdFoundException

markUserAsEntitlementsLoadingInProgress

public void markUserAsEntitlementsLoadingInProgress(String userId,
                                                    boolean inProgress)

Specified by:

markUserAsEntitlementsLoadingInProgress in interface AuthorizationManagerService

Parameters:

userId - - the user ID

inProgress - - if the user's entitlements are being loaded If the user's entitlements are currently being loaded, or if they are finished loading, this method will mark this as such