atg.security
Class RepositoryAccountManager

java.lang.Object
  atg.nucleus.logging.VariableArgumentApplicationLoggingImpl
      atg.nucleus.GenericService
          atg.nucleus.RegisteredService
              atg.security.GenericUserAuthority
                  atg.security.RepositoryAccountManager

All Implemented Interfaces:

NameContextBindingListener, NameContextElement, NameResolver, AdminableService, ApplicationLogging, atg.nucleus.logging.ApplicationLoggingSender, atg.nucleus.logging.TraceApplicationLogging, VariableArgumentApplicationLogging, ComponentNameResolver, Service, ServiceListener, AccountManager, AccountTypes, LoginUserAuthority, UserAuthority, UserAuthority2, java.util.EventListener

Direct Known Subclasses:

LDAPRepositoryAccountManager

public class RepositoryAccountManager
extends GenericUserAuthority
implements AccountTypes, AccountManager, LoginUserAuthority

An account manager and user authority that works against a Dynamo repository.

The repository must provide at least one view, the login view, and optionally a second, the group view, for account storage. This allows you to split user (login) accounts from auxiliary accounts (groups and privileges) if you'd prefer to keep the login account tables clean (a good idea in the profile repository, for instance). The group view must have a "type" property that allows the following integer values:

• (1) Login account.
• (2) Group account.
• (4) Privilege account.

If no group view is specified the login view must have this property. If a group view is specified the type property of all account sin the login view is assumed to be 1, and no type property is necessary nor will one be utilized if specified.

The user interface desires certain attributes for different account types.

Accounts in the "login" view must have the following properties:

firstName

The first name of the account's user.

lastName

The last name of the account's user.

password

The password used to authenticate the user. This password will be encoded using the PasswordHasher specified by the passwordHasher property.

Accounts in the "group" view should have a "description" property, which is a human-readable description of the account.

Any repository item property that should be exposed via this interface must be specified in the propertyNames property (setPropertyNames(String[])).

Field Summary

static java.lang.String

CLASS_VERSION

Fields inherited from class atg.nucleus.GenericService

SERVICE_INFO_KEY

Fields inherited from interface atg.security.AccountTypes

ANY_ACCOUNT, GROUP_ACCOUNT, LOGIN_ACCOUNT, PRIVILEGE_ACCOUNT

Fields inherited from interface atg.nucleus.logging.TraceApplicationLogging

DEFAULT_LOG_TRACE_STATUS

Fields inherited from interface atg.nucleus.logging.ApplicationLogging

DEFAULT_LOG_DEBUG_STATUS, DEFAULT_LOG_ERROR_STATUS, DEFAULT_LOG_INFO_STATUS, DEFAULT_LOG_WARNING_STATUS

Constructor Summary

	RepositoryAccountManager()
protected	RepositoryAccountManager(java.lang.String pName)

Method Summary

Account	createAccount(java.lang.String pAccountName, int pType, java.util.Map pAttributes) Creates a new account with a given set of attributes.
void	doStartService() This is called after a Service has been created, placed into the naming hierarchy, and initialized with its configured property values.
Account	getAccount(java.lang.String pAccountName) Retrieves the account object for the account with the given name.
AccountInitializer	getAccountInitializer() Returns the account initializer that will set up our standard accounts, if any.
RepositoryItem	getAccountItem(java.lang.String pAccountName, java.lang.String pDescriptorName) Returns the repository item corresponding to the specified account name, or null if it doesn't exist.
java.lang.String	getAccountNameProperty() Returns the name of the repository item property used to store the name of the account.
int	getAccountQueryLimit() Returns the maximum number of accounts that will be returned by listAccounts() or listMatchingAccounts() before throwing TooManyAccountsException.
java.lang.String	getAccountTypeProperty() Returns the repository item property used for storing the account type information.
java.lang.String	getAttributeResourceBundle() Returns the name of the resource bundle used for translating attribute names to resource names.
java.lang.String[]	getDefaultGroupAttributes() Returns the default attributes that are assigned to login accounts when they are created.
java.lang.String[]	getDefaultLoginAttributes() Returns the default attributes that are assigned to login accounts when they are created.
java.lang.String[]	getDefaultLoginGroups() Returns the set of groups that are assigned to a new login account.
java.lang.String[]	getDefaultPrivilegeAttributes() Returns the default attributes that are assigned to login accounts when they are created.
java.lang.String	getDescriptionAttribute() Returns the name of the group or privilege account attribute that describes the account in human-readable terms.
java.lang.String	getDescriptionProperty() Returns the repository item property used for storing the description of a group or privilege.
java.lang.String	getFirstNameAttribute() Returns the name of the attribute that contains the first name of the owner of a login account.
java.lang.String	getFirstNameProperty() Returns the repository item property used for storing the first name of a login account holder.
java.lang.String	getGroupDescriptorName() Returns the name of the repository item descriptor used for managing group and privilege accounts.
java.lang.String[]	getGroupPropertyNames() Returns a list of all of the property names allowed to login accounts by the account manager.
java.lang.String	getGroupsProperty() Returns the repository item property used for storing the set of groups that an account is a member of.
boolean	getItemNameIsAccountName() Returns true if the account name can be used to retrieve items from the repository directly, or false if a query must be used.
java.lang.String	getLastNameAttribute() Returns the name of the attribute that contains the last name of the owner of a login account.
java.lang.String	getLastNameProperty() Returns the repository item property used for storing the last name of a login account holder.
java.lang.String	getLastPasswordUpdatePropertyName() Returns the name of the repository item property name used for storing the last password update date.
java.lang.String	getLoginDescriptorName() Returns the name of the repository item descriptor used for managing login accounts.
java.lang.String[]	getLoginPropertyNames() Returns a list of all of the property names allowed to login accounts by the account manager.
java.lang.String	getPasswordAttribute() Returns the name of the attribute that contains the password for a login account.
PasswordHasher	getPasswordHasher() Returns the password hasher that this account manager will use to obfuscate passwords in the repository.
java.lang.String	getPasswordProperty() Returns the repository item property used for storing the password for a login account.
Persona	getPersona(java.lang.Object id) Returns a persona for the given ID object.
java.lang.String	getPreviousNPasswordArrayPropertyName() Returns the name of the repository item property name used for storing the previous N password array
MutableRepository	getRepository() Returns the repository that this account manager is using for persistance.
javax.transaction.TransactionManager	getTransactionManager() Returns the transaction manager that should be used for managing repository transactions.
java.util.Iterator	listAccounts(int pType) Returns an iterator of accounts with a particular set of types.
java.util.Iterator	listGroupsFor(java.lang.String pAccountName) Lists accounts that match a given expression.
java.util.Iterator	listMatchingAccounts(java.lang.String pExpression, int pType) Lists accounts that match a given expression.
boolean	login(User pUser, java.lang.String pLoginName, java.lang.String pPassword, java.lang.Object pHashKey) Authenticates a user, populating the User object with appropriate personae.
void	removeAccount(java.lang.String pAccountName) Removes an account with the indicated name, if possible.
void	setAccountInitializer(AccountInitializer pInitializer) Changes the account initializer that will set up our standard accounts, if any.
void	setAccountNameProperty(java.lang.String pAccountNameProperty) Changes the name of the repository item property used to store the name of the account.
void	setAccountQueryLimit(int pNewLimit) Changes the maximum number of accounts that will be returned by listAccounts() or listMatchingAccounts() before throwing TooManyAccountsException.
void	setAccountTypeProperty(java.lang.String pAccountTypeProperty) Changes the repository item property used for storing the account type information.
void	setAttributeResourceBundle(java.lang.String pBundleName) Changes the resource bundle used for translating attribute names to resource names.
void	setDefaultGroupAttributes(java.lang.String[] pNewAttributes) Changes the default attributes that are assigned to login accounts when they are created.
void	setDefaultLoginAttributes(java.lang.String[] pNewAttributes) Changes the default attributes that are assigned to login accounts when they are created.
void	setDefaultLoginGroups(java.lang.String[] pGroups) Changes the set of groups that are assigned to a new login account.
void	setDefaultPrivilegeAttributes(java.lang.String[] pNewAttributes) Changes the default attributes that are assigned to privilege accounts when they are created.
void	setDescriptionProperty(java.lang.String pDescriptionProperty) Changes the repository item property used for storing the description of a group or privilege.
void	setFirstNameProperty(java.lang.String pFirstNameProperty) Changes the repository item property used for storing the first name of a login account holder.
void	setGroupDescriptorName(java.lang.String pGroupDescriptorName) Changes the name of the repository item descriptor used for managing group and privilege accounts.
void	setGroupPropertyNames(java.lang.String[] pPropertyNames) Changes the list of all of the property names allowed to group/privilege accounts by the account manager.
void	setGroupsProperty(java.lang.String pGroupsProperty) Changes the repository item property used for storing the set of groups that an account is a member of.
void	setItemNameIsAccountName(boolean b) If set to true the account name can be used to retrieve items from the repository directly.
void	setLastNameProperty(java.lang.String pLastNameProperty) Changes the repository item property used for storing the last name of a login account holder.
void	setLastPasswordUpdatePropertyName(java.lang.String pLastPasswordUpdatePropertyName) Sets the name of the repository item property name used for storing the last password update date.
void	setLoginDescriptorName(java.lang.String pLoginDescriptorName) Changes the name of the repository item descriptor used for managing login accounts.
void	setLoginPropertyNames(java.lang.String[] pPropertyNames) Changes the list of all of the property names allowed to login accounts by the account manager.
void	setPasswordHasher(PasswordHasher pPasswordHasher) Changes the password hasher used to encrypt passwords.
void	setPasswordProperty(java.lang.String pPasswordProperty) Changes the repository item property used for storing the password for a login account.
void	setPreviousNPasswordArrayPropertyName(java.lang.String pPreviousNPasswordArrayPropertyName) Sets the name of the repository item property name used for storing the previous N password array
void	setRepository(MutableRepository pRepository) Changes the repository that this account manager is to use for persistance.
void	setTransactionManager(javax.transaction.TransactionManager pTransactionManager) Changes the transaction manager that should be used for managing repository transactions.
void	userDestroyed(User user) Called by a User object when it is destroyed.

Methods inherited from class atg.security.GenericUserAuthority

addAuthenticationFailedListener, addAuthenticationSucceededListener, addSpecialPersona, fireAuthenticationFailedEvent, fireAuthenticationSucceededEvent, getProxyUserAuthorities, getSpecialPersonae, getSupportsEveryone, getUserAuthorityName, removeAuthenticationFailedListener, removeAuthenticationSucceededListener, removeSpecialPersona, setProxyUserAuthorities, setSpecialPersonae, setSupportsEveryone, setUserAuthorityName

Methods inherited from class atg.nucleus.RegisteredService

addToRegistry, getRegistry, getRegistryName, getServiceName, removeFromRegistry, setRegistryName, setServiceName, startService, stopService

Methods inherited from class atg.nucleus.GenericService

addLogListener, createAdminServlet, doStopService, getAbsoluteName, getAdminServlet, getLoggingForVlogging, getLogListenerCount, getLogListeners, getName, getNameContext, getNucleus, getRoot, getServiceConfiguration, getServiceInfo, isLoggingDebug, isLoggingError, isLoggingInfo, isLoggingTrace, isLoggingWarning, isRunning, logDebug, logDebug, logDebug, logError, logError, logError, logInfo, logInfo, logInfo, logTrace, logTrace, logTrace, logWarning, logWarning, logWarning, nameContextElementBound, nameContextElementUnbound, removeLogListener, reResolveThis, resolveName, resolveName, resolveName, resolveName, sendLogEvent, setLoggingDebug, setLoggingError, setLoggingInfo, setLoggingTrace, setLoggingWarning, setNucleus, setServiceInfo

Methods inherited from class atg.nucleus.logging.VariableArgumentApplicationLoggingImpl

vlogDebug, vlogDebug, vlogDebug, vlogDebug, vlogError, vlogError, vlogError, vlogError, vlogInfo, vlogInfo, vlogInfo, vlogInfo, vlogTrace, vlogTrace, vlogTrace, vlogTrace, vlogWarning, vlogWarning, vlogWarning, vlogWarning

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface atg.security.UserAuthority

addAuthenticationFailedListener, addAuthenticationSucceededListener, getUserAuthorityName, removeAuthenticationFailedListener, removeAuthenticationSucceededListener

Field Detail

CLASS_VERSION

public static java.lang.String CLASS_VERSION

Constructor Detail

RepositoryAccountManager

public RepositoryAccountManager()

RepositoryAccountManager

protected RepositoryAccountManager(java.lang.String pName)

Method Detail

getAccountInitializer

public AccountInitializer getAccountInitializer()

Returns the account initializer that will set up our standard accounts, if any.

setAccountInitializer

public void setAccountInitializer(AccountInitializer pInitializer)

Changes the account initializer that will set up our standard accounts, if any.

getLastPasswordUpdatePropertyName

public java.lang.String getLastPasswordUpdatePropertyName()

Returns the name of the repository item property name used for storing the last password update date.

setLastPasswordUpdatePropertyName

public void setLastPasswordUpdatePropertyName(java.lang.String pLastPasswordUpdatePropertyName)

Sets the name of the repository item property name used for storing the last password update date.

getPreviousNPasswordArrayPropertyName

public java.lang.String getPreviousNPasswordArrayPropertyName()

Returns the name of the repository item property name used for storing the previous N password array

setPreviousNPasswordArrayPropertyName

public void setPreviousNPasswordArrayPropertyName(java.lang.String pPreviousNPasswordArrayPropertyName)

Sets the name of the repository item property name used for storing the previous N password array

getLoginDescriptorName

public java.lang.String getLoginDescriptorName()

Returns the name of the repository item descriptor used for managing login accounts.

setLoginDescriptorName

public void setLoginDescriptorName(java.lang.String pLoginDescriptorName)

Changes the name of the repository item descriptor used for managing login accounts.

getGroupDescriptorName

public java.lang.String getGroupDescriptorName()

Returns the name of the repository item descriptor used for managing group and privilege accounts.

setGroupDescriptorName

public void setGroupDescriptorName(java.lang.String pGroupDescriptorName)

Changes the name of the repository item descriptor used for managing group and privilege accounts.

getAccountNameProperty

public java.lang.String getAccountNameProperty()

Returns the name of the repository item property used to store the name of the account.

setAccountNameProperty

public void setAccountNameProperty(java.lang.String pAccountNameProperty)

Changes the name of the repository item property used to store the name of the account.

getAccountQueryLimit

public int getAccountQueryLimit()

Returns the maximum number of accounts that will be returned by listAccounts() or listMatchingAccounts() before throwing TooManyAccountsException.

setAccountQueryLimit

public void setAccountQueryLimit(int pNewLimit)

Changes the maximum number of accounts that will be returned by listAccounts() or listMatchingAccounts() before throwing TooManyAccountsException.

getAccountTypeProperty

public java.lang.String getAccountTypeProperty()

Returns the repository item property used for storing the account type information.

setAccountTypeProperty

public void setAccountTypeProperty(java.lang.String pAccountTypeProperty)

Changes the repository item property used for storing the account type information.

getAttributeResourceBundle

public java.lang.String getAttributeResourceBundle()

Returns the name of the resource bundle used for translating attribute names to resource names.

setAttributeResourceBundle

public void setAttributeResourceBundle(java.lang.String pBundleName)

Changes the resource bundle used for translating attribute names to resource names.

getDescriptionProperty

public java.lang.String getDescriptionProperty()

Returns the repository item property used for storing the description of a group or privilege.

setDescriptionProperty

public void setDescriptionProperty(java.lang.String pDescriptionProperty)

Changes the repository item property used for storing the description of a group or privilege.

getFirstNameProperty

public java.lang.String getFirstNameProperty()

Returns the repository item property used for storing the first name of a login account holder.

setFirstNameProperty

public void setFirstNameProperty(java.lang.String pFirstNameProperty)

Changes the repository item property used for storing the first name of a login account holder.

getGroupsProperty

public java.lang.String getGroupsProperty()

Returns the repository item property used for storing the set of groups that an account is a member of.

setGroupsProperty

public void setGroupsProperty(java.lang.String pGroupsProperty)

Changes the repository item property used for storing the set of groups that an account is a member of.

getLastNameProperty

public java.lang.String getLastNameProperty()

Returns the repository item property used for storing the last name of a login account holder.

setLastNameProperty

public void setLastNameProperty(java.lang.String pLastNameProperty)

Changes the repository item property used for storing the last name of a login account holder.

getPasswordProperty

public java.lang.String getPasswordProperty()

Returns the repository item property used for storing the password for a login account.

setPasswordProperty

public void setPasswordProperty(java.lang.String pPasswordProperty)

Changes the repository item property used for storing the password for a login account.

getLoginPropertyNames

public java.lang.String[] getLoginPropertyNames()

Returns a list of all of the property names allowed to login accounts by the account manager.

setLoginPropertyNames

public void setLoginPropertyNames(java.lang.String[] pPropertyNames)

Changes the list of all of the property names allowed to login accounts by the account manager. This list should be a subset of the properties supplied by the repository.

getGroupPropertyNames

public java.lang.String[] getGroupPropertyNames()

Returns a list of all of the property names allowed to login accounts by the account manager.

setGroupPropertyNames

public void setGroupPropertyNames(java.lang.String[] pPropertyNames)

Changes the list of all of the property names allowed to group/privilege accounts by the account manager. This list should be a subset of the properties supplied by the repository.

getDefaultGroupAttributes

public java.lang.String[] getDefaultGroupAttributes()

Returns the default attributes that are assigned to login accounts when they are created.

setDefaultGroupAttributes

public void setDefaultGroupAttributes(java.lang.String[] pNewAttributes)

Changes the default attributes that are assigned to login accounts when they are created.

getDefaultLoginAttributes

public java.lang.String[] getDefaultLoginAttributes()

Returns the default attributes that are assigned to login accounts when they are created.

setDefaultLoginAttributes

public void setDefaultLoginAttributes(java.lang.String[] pNewAttributes)

Changes the default attributes that are assigned to login accounts when they are created.

getDefaultPrivilegeAttributes

public java.lang.String[] getDefaultPrivilegeAttributes()

Returns the default attributes that are assigned to login accounts when they are created.

setDefaultPrivilegeAttributes

public void setDefaultPrivilegeAttributes(java.lang.String[] pNewAttributes)

Changes the default attributes that are assigned to privilege accounts when they are created.

getDefaultLoginGroups

public java.lang.String[] getDefaultLoginGroups()

Returns the set of groups that are assigned to a new login account.

setDefaultLoginGroups

public void setDefaultLoginGroups(java.lang.String[] pGroups)

Changes the set of groups that are assigned to a new login account.

getItemNameIsAccountName

public boolean getItemNameIsAccountName()

Returns true if the account name can be used to retrieve items from the repository directly, or false if a query must be used.

setItemNameIsAccountName

public void setItemNameIsAccountName(boolean b)

If set to true the account name can be used to retrieve items from the repository directly. If false if a query must be used.

getTransactionManager

public javax.transaction.TransactionManager getTransactionManager()

Returns the transaction manager that should be used for managing repository transactions.

setTransactionManager

public void setTransactionManager(javax.transaction.TransactionManager pTransactionManager)

Changes the transaction manager that should be used for managing repository transactions. This should be the same transaction manager used by the repository, if there is one.

If null, no transaction management is performed (which may cause failures in some repositories).

getRepository

public MutableRepository getRepository()

Returns the repository that this account manager is using for persistance.

setRepository

public void setRepository(MutableRepository pRepository)

Changes the repository that this account manager is to use for persistance.

setPasswordHasher

public void setPasswordHasher(PasswordHasher pPasswordHasher)

Changes the password hasher used to encrypt passwords.

listGroupsFor

public java.util.Iterator listGroupsFor(java.lang.String pAccountName)

Lists accounts that match a given expression.

Parameters:

expression - The expression to use to determine which accounts to list. Currently the language used for the expression is undefined. Defined for LDAPRepositoryAccountManager subclass

See Also:

LDAPRepositoryAccountManager

doStartService

public void doStartService()

Description copied from class: GenericService

This is called after a Service has been created, placed into the naming hierarchy, and initialized with its configured property values. The Service should override this method to start any processes it requires.

Overrides:

doStartService in class GenericService

getPersona

public Persona getPersona(java.lang.Object id)

Returns a persona for the given ID object. This is typically used by an ACL parser, where the ID is usually a string. Returns null if there is no persona for the indicated ID.

Specified by:

getPersona in interface UserAuthority

Overrides:

getPersona in class GenericUserAuthority

userDestroyed

public void userDestroyed(User user)

Called by a User object when it is destroyed. This can be used to clean up internal references to the user object.

Specified by:

userDestroyed in interface UserAuthority

Overrides:

userDestroyed in class GenericUserAuthority

listAccounts

public java.util.Iterator listAccounts(int pType)
                                throws TooManyAccountsException

Returns an iterator of accounts with a particular set of types. You may logical-or the account types together to select a union.

Specified by:

listAccounts in interface AccountManager

Parameters:

type - The account type(s) to list. You may logical-or the types togeter to select a union.

Throws:

TooManyAccountsException

See Also:

AccountTypes

listMatchingAccounts

public java.util.Iterator listMatchingAccounts(java.lang.String pExpression,
                                               int pType)
                                        throws TooManyAccountsException

Lists accounts that match a given expression.

Specified by:

listMatchingAccounts in interface AccountManager

Parameters:

expression - The expression to use to determine which accounts to list. Currently the language used for the expression is undefined.

type - The account type(s) to match against.

Throws:

TooManyAccountsException

See Also:

AccountTypes

getAccountItem

public RepositoryItem getAccountItem(java.lang.String pAccountName,
                                     java.lang.String pDescriptorName)

Returns the repository item corresponding to the specified account name, or null if it doesn't exist.

This method must always be called from within a transaction.

getAccount

public Account getAccount(java.lang.String pAccountName)

Retrieves the account object for the account with the given name.

Specified by:

getAccount in interface AccountManager

Parameters:

accountName - The name of the account to retrieve.

createAccount

public Account createAccount(java.lang.String pAccountName,
                             int pType,
                             java.util.Map pAttributes)
                      throws AccountExistsException,
                             InvalidAttributeException,
                             PermissionDeniedException

Creates a new account with a given set of attributes.

Specified by:

createAccount in interface AccountManager

Parameters:

accountName - The name of the account to create.

type - The type of the account to create.

attributes - Set of attributes that should be set in the new account. Usually at least "password" is required. All attribute values must be strings.

Throws:

AccountExistsException

InvalidAttributeException

PermissionDeniedException

See Also:

AccountTypes

removeAccount

public void removeAccount(java.lang.String pAccountName)
                   throws NoSuchAccountException,
                          PermissionDeniedException

Removes an account with the indicated name, if possible.

Specified by:

removeAccount in interface AccountManager

Throws:

NoSuchAccountException

PermissionDeniedException

getDescriptionAttribute

public java.lang.String getDescriptionAttribute()

Returns the name of the group or privilege account attribute that describes the account in human-readable terms.

Specified by:

getDescriptionAttribute in interface AccountManager

getFirstNameAttribute

public java.lang.String getFirstNameAttribute()

Returns the name of the attribute that contains the first name of the owner of a login account.

Specified by:

getFirstNameAttribute in interface AccountManager

getLastNameAttribute

public java.lang.String getLastNameAttribute()

Returns the name of the attribute that contains the last name of the owner of a login account.

Specified by:

getLastNameAttribute in interface AccountManager

getPasswordAttribute

public java.lang.String getPasswordAttribute()

Returns the name of the attribute that contains the password for a login account.

Specified by:

getPasswordAttribute in interface AccountManager

getPasswordHasher

public PasswordHasher getPasswordHasher()

Returns the password hasher that this account manager will use to obfuscate passwords in the repository. This is used to both set the value of the password attribute (by calling PasswordHasher.encryptPassword()) and to obfuscate it for login (by calling PasswordHasher.encryptPassword(PasswordHasher.hashPassword())).

Specified by:

getPasswordHasher in interface AccountManager

Specified by:

getPasswordHasher in interface LoginUserAuthority

login

public boolean login(User pUser,
                     java.lang.String pLoginName,
                     java.lang.String pPassword,
                     java.lang.Object pHashKey)

Description copied from interface: LoginUserAuthority

Authenticates a user, populating the User object with appropriate personae.

Specified by:

login in interface LoginUserAuthority

See Also:

PasswordHasher