Author: dj
Date: Thu Aug 18 14:50:13 2016
New Revision: 1756800
URL: http://svn.apache.org/viewvc?rev=1756800&view=rev
Log:
OAK-4679 : Backport OAK-4119, OAK-4101, OAK-4087 and OAK-4344
- backported OAK-4087
Added:
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/SyncHandlerMapping.java
- copied unchanged from r1746408,
jackrabbit/oak/trunk/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/SyncHandlerMapping.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleAutoMembershipTest.java
- copied unchanged from r1746408,
jackrabbit/oak/trunk/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleAutoMembershipTest.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/PrincipalProviderAutoMembershipTest.java
- copied unchanged from r1746408,
jackrabbit/oak/trunk/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/PrincipalProviderAutoMembershipTest.java
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/external/
- copied from r1746408,
jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/authentication/external/
Removed:
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/defaultusersync.md
Modified:
jackrabbit/oak/branches/1.2/ (props changed)
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModuleFactory.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfiguration.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/AbstractExternalAuthTest.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleFactoryTest.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleTestBase.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContextTest.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/AbstractPrincipalTest.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProviderTest.java
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfigurationTest.java
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/AbstractSecurityTest.java
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/evaluation/VersionStorageTest.java
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/externalloginmodule.md
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/usersync.md
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/principal/principalprovider.md
jackrabbit/oak/branches/1.2/oak-run/pom.xml
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/BenchmarkRunner.java
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/AbstractExternalTest.java
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/ExternalLoginTest.java
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncAllExternalUsersTest.java
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncExternalUsersTest.java
Propchange: jackrabbit/oak/branches/1.2/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Thu Aug 18 14:50:13 2016
@@ -1,4 +1,4 @@
/jackrabbit/oak/branches/1.0:1665962
/jackrabbit/oak/branches/1.4:1745750,1747354,1750078,1750512
-/jackrabbit/oak/trunk:1672350,1672468-1672469,1672537,1672603,1672611,1672642,1672644,1672834-1672835,1673351,1673410,1673414-1673415,1673436,1673644,1673662-1673664,1673669,1673695,1673713,1673738,1673787,1673791,1674046,1674065,1674075,1674107,1674228,1674780,1674880,1675054-1675055,1675089,1675319,1675332,1675354,1675357,1675382,1675555,1675566,1675593,1676198,1676237,1676407,1676458,1676539,1676670,1676693,1676703,1676725,1677579,1677581,1677609,1677611,1677774,1677788,1677797,1677804,1677806,1677939,1677991,1678023,1678095-1678096,1678124,1678171,1678173,1678202,1678211,1678323,1678758,1678938,1678954,1679144,1679165,1679191,1679232,1679235,1679503,1679958,1679961,1680170,1680172,1680182,1680222,1680232,1680236,1680461,1680633,1680643,1680747,1680805-1680806,1680903,1681282,1681767,1681918,1681921,1681955,1682042,1682218,1682235,1682437,1682488,1682494,1682555,1682855,1682904,1683059,1683089,1683213,1683249,1683259,1683278,1683323,1683687,1683700,1684174-1684175,1684186,1684376
,1684442,1684561,1684570,1684601,1684618,1684669,1684820,1684868,1684894,1685023,1685075,1685370,1685541,1685552,1685589-1685590,1685834,1685839-1685840,1685964,1685977,1685989,1685999,1686003,1686023,1686032,1686097,1686162,1686229,1686234,1686253,1686414,1686772,1686780,1686790,1686854,1686857,1686971,1687053-1687055,1687175,1687196,1687198,1687220,1687239-1687240,1687301,1687441,1687553,1688089-1688090,1688172,1688179,1688349,1688421,1688436,1688453,1688616,1688622,1688634,1688636,1688817,1689003-1689004,1689008,1689577,1689581,1689623,1689810,1689828,1689831,1689833,1689903,1690017,1690043,1690047,1690057,1690247,1690249,1690634-1690637,1690650,1690657,1690669,1690672,1690674,1690885,1690941,1691139,1691151,1691159,1691167,1691183,1691188,1691201,1691210,1691217-1691218,1691280,1691307,1691331-1691333,1691345,1691384-1691385,1691394,1691401,1691498,1691509,1692133-1692134,1692156,1692250,1692272,1692274,1692363,1692382,1692393,1692478,1692955,1693002,1693030,1693050,1693209,1693
401,1693421,1693525-1693526,1694007,1694049,1694393-1694394,1694651,1694653-1694654,1695032,1695050,1695122,1695223,1695280,1695299,1695420,1695457,1695482,1695492,1695507,1695521,1695540,1695571,1695829-1695830,1695905,1696190,1696194,1696242,1696285,1696375,1696522,1696578,1696759,1696916,1697363,1697373,1697383,1697410,1697582,1697589,1697616,1697672,1697896,1698096,1698144,1700191,1700231,1700397,1700403,1700506,1700571,1700709,1700718,1700720,1700727,1700749,1700769,1700775,1701065,1701613,1701619,1701733,1701743,1701750,1701768,1701806,1701810,1701814,1701907,1701948,1701955,1701959,1701965,1701986,1702014,1702022,1702045,1702051,1702241,1702272,1702371,1702387,1702405,1702423,1702426,1702428,1702860,1702866,1702942,1702960,1703212,1703382,1703395,1703411,1703428,1703430,1703568,1703592,1703758,1703858,1703878,1704256,1704282,1704285,1704457,1704479,1704490,1704614,1704629,1704636,1704655,1704670,1704886,1705005,1705027,1705043,1705055,1705250,1705268,1705273,1705323,1705677,1
705701,1705871,1705992,1705998,1706009,1706037,1706059,1706212,1706218,1706270,1706764,1706772,1707049,1707189,1707191,1707331,1707435,1707509,1707753,1708049,1708105,1708307,1708315,1708401,1708546,1708592,1708738,1708766,1709012,1709852,1709978,1710013,1710031,1710049,1710205,1710242,1710559,1710575,1710590,1710614,1710637,1710789,1710800,1710811,1710816,1710972,1711209,1711248,1711282,1711296,1711405,1711498,1711654,1712018,1712042,1712319,1712490,1712531,1712730,1712785,1712963,1713008,1713439,1713461,1713580,1713586,1713599-1713600,1713626,1713698,1713803,1713809,1714034,1714061,1714084,1714170,1714174,1714213,1714229,1714238,1714519-1714520,1714543-1714544,1714730,1714739,1714779,1714956,1714961,1715010,1715092,1715191,1715346,1715716,1715767,1715771,1715888,1715898,1716100,1716178,1716426,1716576,1716588-1716589,1716596,1716616,1716703,1716712,1716815,1716823,1716830,1716883,1717203,1717277,1717393-1717394,1717410,1717462,1717632,1717768-1717769,1717784,1717789,1717988,171852
8,1718533,1718546-1718548,1718553,1718626,1718646,1718772,1718801-1718802,1718895,1719111,1719288,1719869,1720306,1720335,1720350,1720354,1720500,1721160,1721172,1721337,1722141,1722832,1723227,1723239,1723241,1723251,1723254,1723333,1723347,1723350,1723565,1723584,1723713,1723731,1724026,1724057,1724186,1724210,1724401,1724628,1724631,1725216,1725477,1725515,1725555,1725895,1725899,1725935,1725941,1725960,1726232,1726237,1726570,1726579,1726585-1726586,1726621,1726795,1726797,1726809,1726812,1726981,1726993,1727026,1727254,1727331,1727350,1727358,1727429,1727476,1727483,1727508,1727515-1727518,1727813,1727816,1727831-1727832,1727841,1727893,1727895,1727912-1727913,1727923,1727991,1728037,1728041,1728070,1728114,1728281,1728443,1728525,1728642,1729200,1729505,1729578,1729599,1729957,1729962,1729979,1730050,1730216,1730527,1730581,1730629,1730801,1731627,1731647-1731648,1731789,1731797,1732131,1732268,1732278,1732330,1732647-1732648,1732864,1733615,1733929,1734230,1734254,1735052,173
5081,1735141,1735267,1735405,1735484,1735564,1735588,1736176,1737309-1737310,1737334,1737349,1738138,1738252,1738833,1738950,1738957,1739712,1739760,1739867,1739894,1739959-1739960,1740114,1740116,1740250,1740333,1740360,1740626,1740774,1740837,1740971,1741016,1741032,1741339,1741343,1742117,1742520,1742888,1742916,1743097,1743172,1743343,1743674,1744265,1744292,1744959,1745038,1745197,1746117,1746696,1746981,1747341-1747342,1747492,1748505,1748553,1748722,1748870,1749350,1749464,1749475,1749645,1749662,1749815,1749872,1749875,1749899,1750052,1750076-1750077,1750287,1750457,1750462,1750465,1750495,1750626,1750809,1750886,1751410,1751445-1751446,1751478,1751755,1752198,1752202,1752273-1752274,1752438,1752508,1752659,1752672,1753262,1753331-1753332,1753355,1753444,1754117,1754239,1755366,1756520,1756580
+/jackrabbit/oak/trunk:1672350,1672468-1672469,1672537,1672603,1672611,1672642,1672644,1672834-1672835,1673351,1673410,1673414-1673415,1673436,1673644,1673662-1673664,1673669,1673695,1673713,1673738,1673787,1673791,1674046,1674065,1674075,1674107,1674228,1674780,1674880,1675054-1675055,1675089,1675319,1675332,1675354,1675357,1675382,1675555,1675566,1675593,1676198,1676237,1676407,1676458,1676539,1676670,1676693,1676703,1676725,1677579,1677581,1677609,1677611,1677774,1677788,1677797,1677804,1677806,1677939,1677991,1678023,1678095-1678096,1678124,1678171,1678173,1678202,1678211,1678323,1678758,1678938,1678954,1679144,1679165,1679191,1679232,1679235,1679503,1679958,1679961,1680170,1680172,1680182,1680222,1680232,1680236,1680461,1680633,1680643,1680747,1680805-1680806,1680903,1681282,1681767,1681918,1681921,1681955,1682042,1682218,1682235,1682437,1682488,1682494,1682555,1682855,1682904,1683059,1683089,1683213,1683249,1683259,1683278,1683323,1683687,1683700,1684174-1684175,1684186,1684376
,1684442,1684561,1684570,1684601,1684618,1684669,1684820,1684868,1684894,1685023,1685075,1685370,1685541,1685552,1685589-1685590,1685834,1685839-1685840,1685964,1685977,1685989,1685999,1686003,1686023,1686032,1686097,1686162,1686229,1686234,1686253,1686414,1686772,1686780,1686790,1686854,1686857,1686971,1687053-1687055,1687175,1687196,1687198,1687220,1687239-1687240,1687301,1687441,1687553,1688089-1688090,1688172,1688179,1688349,1688421,1688436,1688453,1688616,1688622,1688634,1688636,1688817,1689003-1689004,1689008,1689577,1689581,1689623,1689810,1689828,1689831,1689833,1689903,1690017,1690043,1690047,1690057,1690247,1690249,1690634-1690637,1690650,1690657,1690669,1690672,1690674,1690885,1690941,1691139,1691151,1691159,1691167,1691183,1691188,1691201,1691210,1691217-1691218,1691280,1691307,1691331-1691333,1691345,1691384-1691385,1691394,1691401,1691498,1691509,1692133-1692134,1692156,1692250,1692272,1692274,1692363,1692382,1692393,1692478,1692955,1693002,1693030,1693050,1693209,1693
401,1693421,1693525-1693526,1694007,1694049,1694393-1694394,1694651,1694653-1694654,1695032,1695050,1695122,1695223,1695280,1695299,1695420,1695457,1695482,1695492,1695507,1695521,1695540,1695571,1695829-1695830,1695905,1696190,1696194,1696242,1696285,1696375,1696522,1696578,1696759,1696916,1697363,1697373,1697383,1697410,1697582,1697589,1697616,1697672,1697896,1698096,1698144,1700191,1700231,1700397,1700403,1700506,1700571,1700709,1700718,1700720,1700727,1700749,1700769,1700775,1701065,1701613,1701619,1701733,1701743,1701750,1701768,1701806,1701810,1701814,1701907,1701948,1701955,1701959,1701965,1701986,1702014,1702022,1702045,1702051,1702241,1702272,1702371,1702387,1702405,1702423,1702426,1702428,1702860,1702866,1702942,1702960,1703212,1703382,1703395,1703411,1703428,1703430,1703568,1703592,1703758,1703858,1703878,1704256,1704282,1704285,1704457,1704479,1704490,1704614,1704629,1704636,1704655,1704670,1704886,1705005,1705027,1705043,1705055,1705250,1705268,1705273,1705323,1705677,1
705701,1705871,1705992,1705998,1706009,1706037,1706059,1706212,1706218,1706270,1706764,1706772,1707049,1707189,1707191,1707331,1707435,1707509,1707753,1708049,1708105,1708307,1708315,1708401,1708546,1708592,1708738,1708766,1709012,1709852,1709978,1710013,1710031,1710049,1710205,1710242,1710559,1710575,1710590,1710614,1710637,1710789,1710800,1710811,1710816,1710972,1711209,1711248,1711282,1711296,1711405,1711498,1711654,1712018,1712042,1712319,1712490,1712531,1712730,1712785,1712963,1713008,1713439,1713461,1713580,1713586,1713599-1713600,1713626,1713698,1713803,1713809,1714034,1714061,1714084,1714170,1714174,1714213,1714229,1714238,1714519-1714520,1714543-1714544,1714730,1714739,1714779,1714956,1714961,1715010,1715092,1715191,1715346,1715716,1715767,1715771,1715888,1715898,1716100,1716178,1716426,1716576,1716588-1716589,1716596,1716616,1716703,1716712,1716815,1716823,1716830,1716883,1717203,1717277,1717393-1717394,1717410,1717462,1717632,1717768-1717769,1717784,1717789,1717988,171852
8,1718533,1718546-1718548,1718553,1718626,1718646,1718772,1718801-1718802,1718895,1719111,1719288,1719869,1720306,1720335,1720350,1720354,1720500,1721160,1721172,1721337,1722141,1722832,1723227,1723239,1723241,1723251,1723254,1723333,1723347,1723350,1723565,1723584,1723713,1723731,1724026,1724057,1724186,1724210,1724401,1724628,1724631,1725216,1725477,1725515,1725555,1725895,1725899,1725935,1725941,1725960,1726232,1726237,1726570,1726579,1726585-1726586,1726621,1726795,1726797,1726809,1726812,1726981,1726993,1727026,1727254,1727331,1727350,1727358,1727429,1727476,1727483,1727508,1727515-1727518,1727813,1727816,1727831-1727832,1727841,1727893,1727895,1727912-1727913,1727923,1727991,1728037,1728041,1728070,1728114,1728281,1728443,1728525,1728642,1729200,1729505,1729578,1729599,1729957,1729962,1729979,1730050,1730216,1730527,1730581,1730629,1730801,1731627,1731647-1731648,1731789,1731797,1732131,1732268,1732278,1732330,1732647-1732648,1732864,1733615,1733929,1734230,1734254,1735052,173
5081,1735141,1735267,1735405,1735484,1735564,1735588,1736176,1737309-1737310,1737334,1737349,1738138,1738252,1738833,1738950,1738957,1739712,1739760,1739867,1739894,1739959-1739960,1740114,1740116,1740250,1740333,1740360,1740626,1740774,1740837,1740971,1741016,1741032,1741339,1741343,1742117,1742520,1742888,1742916,1743097,1743172,1743343,1743674,1744265,1744292,1744670,1744672,1744959,1745038,1745127,1745197,1746117,1746408,1746696,1746981,1747341-1747342,1747492,1748505,1748553,1748722,1748870,1749350,1749464,1749475,1749645,1749662,1749815,1749872,1749875,1749899,1750052,1750076-1750077,1750287,1750457,1750462,1750465,1750495,1750626,1750809,1750886,1751410,1751445-1751446,1751478,1751755,1752198,1752202,1752273-1752274,1752438,1752508,1752659,1752672,1753262,1753331-1753332,1753355,1753444,1754117,1754239,1755366,1756520,1756580
/jackrabbit/trunk:1345480
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
Thu Aug 18 14:50:13 2016
@@ -135,6 +135,11 @@ public class DynamicSyncContext extends
}
}
+ @Override
+ protected void applyMembership(@Nonnull Authorizable member, @Nonnull
Set<String> groups) throws RepositoryException {
+ log.debug("Dynamic membership sync enabled => omit setting
auto-membership for {} ", member.getID());
+ }
+
/**
* Recursively collect the principal names of the given declared group
* references up to the given depth.
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java
Thu Aug 18 14:50:13 2016
@@ -69,12 +69,12 @@ public class ExternalLoginModule extends
/**
* Name of the parameter that configures the name of the external identity
provider.
*/
- public static final String PARAM_IDP_NAME = "idp.name";
+ public static final String PARAM_IDP_NAME =
SyncHandlerMapping.PARAM_IDP_NAME;
/**
* Name of the parameter that configures the name of the synchronization
handler.
*/
- public static final String PARAM_SYNC_HANDLER_NAME = "sync.handlerName";
+ public static final String PARAM_SYNC_HANDLER_NAME =
SyncHandlerMapping.PARAM_SYNC_HANDLER_NAME;
private ExternalIdentityProviderManager idpManager;
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModuleFactory.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModuleFactory.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModuleFactory.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModuleFactory.java
Thu Aug 18 14:50:13 2016
@@ -17,12 +17,12 @@
package org.apache.jackrabbit.oak.spi.security.authentication.external.impl;
import java.util.Hashtable;
-
import javax.jcr.Repository;
import javax.management.MalformedObjectNameException;
import javax.management.ObjectName;
import javax.security.auth.spi.LoginModule;
+import com.google.common.collect.ImmutableMap;
import org.apache.felix.jaas.LoginModuleFactory;
import org.apache.felix.scr.annotations.Activate;
import org.apache.felix.scr.annotations.Component;
@@ -43,8 +43,6 @@ import org.osgi.service.component.Compon
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.google.common.collect.ImmutableMap;
-
/**
* Implements a LoginModuleFactory that creates {@link ExternalLoginModule}s
and allows to configure login modules
* via OSGi config.
@@ -56,7 +54,7 @@ import com.google.common.collect.Immutab
configurationFactory = true
)
@Service
-public class ExternalLoginModuleFactory implements LoginModuleFactory {
+public class ExternalLoginModuleFactory implements LoginModuleFactory,
SyncHandlerMapping {
private static final Logger log =
LoggerFactory.getLogger(ExternalLoginModuleFactory.class);
@@ -92,14 +90,14 @@ public class ExternalLoginModuleFactory
label = "Identity Provider Name",
description = "Name of the identity provider (for example:
'ldap')."
)
- public static final String PARAM_IDP_NAME =
ExternalLoginModule.PARAM_IDP_NAME;
+ public static final String PARAM_IDP_NAME =
SyncHandlerMapping.PARAM_IDP_NAME;
@Property(
value = "default",
label = "Sync Handler Name",
description = "Name of the sync handler."
)
- public static final String PARAM_SYNC_HANDLER_NAME =
ExternalLoginModule.PARAM_SYNC_HANDLER_NAME;
+ public static final String PARAM_SYNC_HANDLER_NAME =
SyncHandlerMapping.PARAM_SYNC_HANDLER_NAME;
@Reference
private SyncManager syncManager;
@@ -120,6 +118,7 @@ public class ExternalLoginModuleFactory
*/
private Registration mbeanRegistration;
+ //----------------------------------------------------< SCR integration
>---
/**
* Activates the LoginModuleFactory service
* @param context the component context
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java
Thu Aug 18 14:50:13 2016
@@ -19,12 +19,14 @@ package org.apache.jackrabbit.oak.spi.se
import java.security.Principal;
import java.security.acl.Group;
import java.text.ParseException;
+import java.util.Collection;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
import javax.annotation.CheckForNull;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -54,6 +56,7 @@ import org.apache.jackrabbit.oak.api.Tre
import org.apache.jackrabbit.oak.api.Type;
import org.apache.jackrabbit.oak.namepath.NamePathMapper;
import org.apache.jackrabbit.oak.spi.query.PropertyValues;
+import
org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityRef;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncConfig;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalIdentityConstants;
import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl;
@@ -95,12 +98,18 @@ class ExternalGroupPrincipalProvider imp
private final Root root;
private final NamePathMapper namePathMapper;
+
private final UserManager userManager;
+ private final AutoMembershipPrincipals autoMembershipPrincipals;
- ExternalGroupPrincipalProvider(Root root, UserConfiguration uc,
NamePathMapper namePathMapper) {
+ ExternalGroupPrincipalProvider(@Nonnull Root root, @Nonnull
UserConfiguration uc,
+ @Nonnull NamePathMapper namePathMapper,
+ @Nonnull Map<String, String[]>
autoMembershipMapping) {
this.root = root;
this.namePathMapper = namePathMapper;
+
userManager = uc.getUserManager(root, namePathMapper);
+ autoMembershipPrincipals = new
AutoMembershipPrincipals(autoMembershipMapping);
}
//--------------------------------------------------< PrincipalProvider
>---
@@ -164,6 +173,15 @@ class ExternalGroupPrincipalProvider imp
}
//------------------------------------------------------------< private
>---
+ @CheckForNull
+ private String getIdpName(@Nonnull Tree userTree) {
+ PropertyState ps = userTree.getProperty(REP_EXTERNAL_ID);
+ if (ps != null) {
+ return
ExternalIdentityRef.fromString(ps.getValue(Type.STRING)).getProviderName();
+ } else {
+ return null;
+ }
+ }
private Set<Group> getGroupPrincipals(@CheckForNull Authorizable
authorizable) throws RepositoryException {
if (authorizable != null && !authorizable.isGroup()) {
@@ -178,10 +196,14 @@ class ExternalGroupPrincipalProvider imp
if (userTree.exists() && UserUtil.isType(userTree,
AuthorizableType.USER) && userTree.hasProperty(REP_EXTERNAL_PRINCIPAL_NAMES)) {
PropertyState ps =
userTree.getProperty(REP_EXTERNAL_PRINCIPAL_NAMES);
if (ps != null) {
+ // we have an 'external' user that has been synchronized with
the dynamic-membership option
Set<Group> groupPrincipals = Sets.newHashSet();
for (String principalName : ps.getValue(Type.STRINGS)) {
groupPrincipals.add(new
ExternalGroupPrincipal(principalName));
}
+
+ // add existing group principals as defined with the
_autoMembership_ option.
+
groupPrincipals.addAll(autoMembershipPrincipals.get(getIdpName(userTree)));
return groupPrincipals;
}
}
@@ -194,6 +216,10 @@ class ExternalGroupPrincipalProvider imp
* {@link #REP_EXTERNAL_PRINCIPAL_NAMES} properties that match the given
* name or name hint.
*
+ * NOTE: ignore any principals listed in the {@link
DefaultSyncConfig.User#autoMembership}
+ * because they are expected to exist in the system and thus will be found
+ * by another principal provider instance.
+ *
* @param nameHint The principal name or name hint to be searched for.
* @param exactMatch boolean flag indicating if the query should search for
* exact matching.
@@ -409,4 +435,54 @@ class ExternalGroupPrincipalProvider imp
return null;
}
}
+
+ private final class AutoMembershipPrincipals {
+
+ private final Map<String, String[]> autoMembershipMapping;
+ private final Map<String, Set<Group>> principalMap;
+
+ private AutoMembershipPrincipals(@Nonnull Map<String, String[]>
autoMembershipMapping) {
+ this.autoMembershipMapping = autoMembershipMapping;
+ this.principalMap = new ConcurrentHashMap<String,
Set<Group>>(autoMembershipMapping.size());
+ }
+
+ @Nonnull
+ private Collection<Group> get(@CheckForNull String idpName) {
+ if (idpName == null) {
+ return ImmutableSet.of();
+ }
+
+ Set<Group> principals;
+ if (!principalMap.containsKey(idpName)) {
+ String[] vs = autoMembershipMapping.get(idpName);
+ if (vs == null) {
+ principals = ImmutableSet.of();
+ } else {
+ ImmutableSet.Builder<Group> builder =
ImmutableSet.builder();
+ for (String groupId : autoMembershipMapping.get(idpName)) {
+ try {
+ Authorizable gr =
userManager.getAuthorizable(groupId);
+ if (gr != null && gr.isGroup()) {
+ Principal grPrincipal = gr.getPrincipal();
+ if (grPrincipal instanceof Group) {
+ builder.add((Group) grPrincipal);
+ } else {
+ log.warn("Principal of group {} is not of
type java.security.acl.Group -> Ignoring", groupId);
+ }
+ } else {
+ log.warn("Configured auto-membership group {}
does not exist -> Ignoring", groupId);
+ }
+ } catch (RepositoryException e) {
+ log.debug("Failed to retrieved 'auto-membership'
group with id {}", groupId, e);
+ }
+ }
+ principals = builder.build();
+ }
+ principalMap.put(idpName, principals);
+ } else {
+ principals = principalMap.get(idpName);
+ }
+ return principals;
+ }
+ }
}
\ No newline at end of file
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfiguration.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfiguration.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfiguration.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfiguration.java
Thu Aug 18 14:50:13 2016
@@ -18,6 +18,8 @@ package org.apache.jackrabbit.oak.spi.se
import java.security.Principal;
import java.security.acl.Group;
+import java.util.Arrays;
+import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
@@ -26,8 +28,11 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import com.google.common.base.Function;
+import com.google.common.base.Predicates;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterables;
import com.google.common.collect.Iterators;
import org.apache.felix.scr.annotations.Activate;
import org.apache.felix.scr.annotations.Component;
@@ -46,6 +51,8 @@ import org.apache.jackrabbit.oak.spi.sec
import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.SyncHandler;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncConfigImpl;
+import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModuleFactory;
+import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.SyncHandlerMapping;
import org.apache.jackrabbit.oak.spi.security.principal.PrincipalConfiguration;
import org.apache.jackrabbit.oak.spi.security.principal.PrincipalManagerImpl;
import org.apache.jackrabbit.oak.spi.security.principal.PrincipalProvider;
@@ -54,6 +61,8 @@ import org.apache.jackrabbit.oak.spi.xml
import org.osgi.framework.BundleContext;
import org.osgi.framework.ServiceReference;
import org.osgi.util.tracker.ServiceTracker;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
* Implementation of the {@code PrincipalConfiguration} interface that provides
@@ -73,7 +82,10 @@ import org.osgi.util.tracker.ServiceTrac
@Service({PrincipalConfiguration.class, SecurityConfiguration.class})
public class ExternalPrincipalConfiguration extends ConfigurationBase
implements PrincipalConfiguration {
+ private static final Logger log =
LoggerFactory.getLogger(ExternalPrincipalConfiguration.class);
+
private SyncConfigTracker syncConfigTracker;
+ private SyncHandlerMappingTracker syncHandlerMappingTracker;
@SuppressWarnings("UnusedDeclaration")
public ExternalPrincipalConfiguration() {
@@ -96,7 +108,7 @@ public class ExternalPrincipalConfigurat
public PrincipalProvider getPrincipalProvider(Root root, NamePathMapper
namePathMapper) {
if (dynamicMembershipEnabled()) {
UserConfiguration uc =
getSecurityProvider().getConfiguration(UserConfiguration.class);
- return new ExternalGroupPrincipalProvider(root, uc,
namePathMapper);
+ return new ExternalGroupPrincipalProvider(root, uc,
namePathMapper, syncConfigTracker.getAutoMembership());
} else {
return EmptyPrincipalProvider.INSTANCE;
}
@@ -132,8 +144,13 @@ public class ExternalPrincipalConfigurat
@Activate
private void activate(BundleContext bundleContext, Map<String, Object>
properties) {
setParameters(ConfigurationParameters.of(properties));
- syncConfigTracker = new SyncConfigTracker(bundleContext);
+ syncHandlerMappingTracker = new
SyncHandlerMappingTracker(bundleContext);
+ syncHandlerMappingTracker.open();
+
+ syncConfigTracker = new SyncConfigTracker(bundleContext,
syncHandlerMappingTracker);
syncConfigTracker.open();
+
+
}
@SuppressWarnings("UnusedDeclaration")
@@ -142,6 +159,9 @@ public class ExternalPrincipalConfigurat
if (syncConfigTracker != null) {
syncConfigTracker.close();
}
+ if (syncHandlerMappingTracker != null) {
+ syncHandlerMappingTracker.close();
+ }
}
//------------------------------------------------------------< private
>---
@@ -196,11 +216,14 @@ public class ExternalPrincipalConfigurat
*/
private static final class SyncConfigTracker extends ServiceTracker {
+ private final SyncHandlerMappingTracker mappingTracker;
+
private Set<ServiceReference> enablingRefs = new
HashSet<ServiceReference>();
private boolean isEnabled = false;
- public SyncConfigTracker(BundleContext context) {
+ public SyncConfigTracker(@Nonnull BundleContext context, @Nonnull
SyncHandlerMappingTracker mappingTracker) {
super(context, SyncHandler.class.getName(), null);
+ this.mappingTracker = mappingTracker;
}
@Override
@@ -234,5 +257,83 @@ public class ExternalPrincipalConfigurat
private static boolean hasDynamicMembership(ServiceReference
reference) {
return
PropertiesUtil.toBoolean(reference.getProperty(DefaultSyncConfigImpl.PARAM_USER_DYNAMIC_MEMBERSHIP),
DefaultSyncConfigImpl.PARAM_USER_DYNAMIC_MEMBERSHIP_DEFAULT);
}
+
+ private Map<String, String[]> getAutoMembership() {
+ Map<String, String[]> autoMembership = new HashMap<String,
String[]>();
+ for (ServiceReference ref : enablingRefs) {
+ String syncHandlerName =
PropertiesUtil.toString(ref.getProperty(DefaultSyncConfigImpl.PARAM_NAME),
DefaultSyncConfigImpl.PARAM_NAME_DEFAULT);
+ String[] membership =
PropertiesUtil.toStringArray(ref.getProperty(DefaultSyncConfigImpl.PARAM_GROUP_AUTO_MEMBERSHIP),
new String[0]);
+
+ for (String idpName :
mappingTracker.getIdpNames(syncHandlerName)) {
+ String[] previous = autoMembership.put(idpName,
membership);
+ if (previous != null) {
+ String msg = (Arrays.equals(previous, membership)) ?
"Duplicate" : "Colliding";
+ log.debug(msg + " auto-membership configuration for
IDP '{}'; replacing previous values {} by {} defined by SyncHandler '{}'",
+ idpName, Arrays.toString(previous),
Arrays.toString(membership), syncHandlerName);
+ }
+ }
+ }
+ return autoMembership;
+ }
+ }
+
+ /**
+ * {@code ServiceTracker} to detect any {@link SyncHandler} that has
+ * dynamic membership enabled.
+ */
+ private static final class SyncHandlerMappingTracker extends
ServiceTracker {
+
+ private Map<ServiceReference, String[]> referenceMap = new
HashMap<ServiceReference, String[]>();
+
+ public SyncHandlerMappingTracker(@Nonnull BundleContext context) {
+ super(context, SyncHandlerMapping.class.getName(), null);
+ }
+
+ @Override
+ public Object addingService(ServiceReference reference) {
+ addMapping(reference);
+ return super.addingService(reference);
+ }
+
+ @Override
+ public void modifiedService(ServiceReference reference, Object
service) {
+ addMapping(reference);
+ super.modifiedService(reference, service);
+ }
+
+ @Override
+ public void removedService(ServiceReference reference, Object service)
{
+ referenceMap.remove(reference);
+ super.removedService(reference, service);
+ }
+
+ private void addMapping(ServiceReference reference) {
+ String idpName =
PropertiesUtil.toString(reference.getProperty(ExternalLoginModuleFactory.PARAM_IDP_NAME),
null);
+ String syncHandlerName =
PropertiesUtil.toString(reference.getProperty(ExternalLoginModuleFactory.PARAM_SYNC_HANDLER_NAME),
null);
+
+ if (idpName != null && syncHandlerName != null) {
+ referenceMap.put(reference, new String[]{syncHandlerName,
idpName});
+ } else {
+ log.warn("Ignoring SyncHandlerMapping with incomplete mapping
of IDP '{}' and SyncHandler '{}'", idpName, syncHandlerName);
+ }
+ }
+
+ private Iterable<String> getIdpNames(@Nonnull final String
syncHandlerName) {
+ return Iterables.filter(Iterables.transform(referenceMap.values(),
new Function<String[], String>() {
+ @Nullable
+ @Override
+ public String apply(@Nullable String[] input) {
+ if (input != null && input.length == 2) {
+ if (syncHandlerName.equals(input[0])) {
+ return input[1];
+ } // else: different sync-handler
+ } else {
+ log.warn("Unexpected value of reference map.
Expected String[] with length = 2");
+ }
+ return null;
+ }
+ }
+ ), Predicates.notNull());
+ }
}
}
\ No newline at end of file
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/AbstractExternalAuthTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/AbstractExternalAuthTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/AbstractExternalAuthTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/AbstractExternalAuthTest.java
Thu Aug 18 14:50:13 2016
@@ -56,6 +56,7 @@ public abstract class AbstractExternalAu
protected ExternalIdentityProvider idp;
protected DefaultSyncConfig syncConfig;
+ protected ExternalPrincipalConfiguration externalPrincipalConfiguration =
new ExternalPrincipalConfiguration();
private Set<String> ids;
@@ -125,7 +126,7 @@ public abstract class AbstractExternalAu
@Override
protected SecurityProvider getSecurityProvider() {
if (securityProvider == null) {
- securityProvider = new
TestSecurityProvider(getSecurityConfigParameters(), new
ExternalPrincipalConfiguration());
+ securityProvider = new
TestSecurityProvider(getSecurityConfigParameters(),
externalPrincipalConfiguration);
}
return securityProvider;
}
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleFactoryTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleFactoryTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleFactoryTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleFactoryTest.java
Thu Aug 18 14:50:13 2016
@@ -36,7 +36,6 @@ import org.apache.jackrabbit.api.securit
import org.apache.jackrabbit.oak.AbstractSecurityTest;
import org.apache.jackrabbit.oak.Oak;
import org.apache.jackrabbit.oak.api.ContentSession;
-import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncConfig;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncHandler;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalIDPManagerImpl;
@@ -158,7 +157,6 @@ public class ExternalLoginModuleFactoryT
public void setUpJaasFactoryWithInjection() throws Exception{
context.registerService(Repository.class,
EasyMock.createMock(Repository.class));
context.registerService(SyncManager.class, new
SyncManagerImpl(whiteboard));
- context.registerService(SecurityProvider.class,
EasyMock.createMock(SecurityProvider.class));
context.registerService(ExternalIdentityProviderManager.class, new
ExternalIDPManagerImpl(whiteboard));
final LoginModuleFactory lmf =
context.registerInjectActivateService(new ExternalLoginModuleFactory());
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleTestBase.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleTestBase.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleTestBase.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/ExternalLoginModuleTestBase.java
Thu Aug 18 14:50:13 2016
@@ -57,10 +57,10 @@ public abstract class ExternalLoginModul
testIdpReg = whiteboard.register(ExternalIdentityProvider.class, idp,
Collections.<String, Object>emptyMap());
- options.put(ExternalLoginModule.PARAM_SYNC_HANDLER_NAME, "default");
- options.put(ExternalLoginModule.PARAM_IDP_NAME, idp.getName());
-
setSyncConfig(syncConfig);
+
+ options.put(ExternalLoginModule.PARAM_SYNC_HANDLER_NAME,
syncConfig.getName());
+ options.put(ExternalLoginModule.PARAM_IDP_NAME, idp.getName());
}
@After
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContextTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContextTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContextTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContextTest.java
Thu Aug 18 14:50:13 2016
@@ -18,6 +18,7 @@ package org.apache.jackrabbit.oak.spi.se
import java.util.HashSet;
import java.util.Set;
+import java.util.UUID;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.jcr.RepositoryException;
@@ -31,6 +32,7 @@ import com.google.common.collect.Iterabl
import com.google.common.collect.Sets;
import org.apache.jackrabbit.api.security.user.Authorizable;
import org.apache.jackrabbit.api.security.user.Group;
+import org.apache.jackrabbit.api.security.user.User;
import org.apache.jackrabbit.api.security.user.UserManager;
import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Root;
@@ -418,6 +420,21 @@ public class DynamicSyncContextTest exte
assertFalse(r.hasPendingChanges());
}
+ @Test
+ public void testAutoMembership() throws Exception {
+ Group gr = userManager.createGroup("group" + UUID.randomUUID());
+ r.commit();
+
+ syncConfig.user().setAutoMembership(gr.getID(), "non-existing-group");
+
+ SyncResult result = syncContext.sync(idp.getUser(USER_ID));
+ assertSame(SyncResult.Status.ADD, result.getStatus());
+
+ User u = userManager.getAuthorizable(USER_ID, User.class);
+ assertFalse(gr.isDeclaredMember(u));
+ assertFalse(gr.isMember(u));
+ }
+
private static final class TestUserWithGroupRefs extends
TestIdentityProvider.TestIdentity implements ExternalUser {
private Iterable<ExternalIdentityRef> declaredGroupRefs;
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/AbstractPrincipalTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/AbstractPrincipalTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/AbstractPrincipalTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/AbstractPrincipalTest.java
Thu Aug 18 14:50:13 2016
@@ -17,9 +17,11 @@
package
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal;
import java.security.Principal;
+import java.util.Set;
import java.util.UUID;
import javax.annotation.Nonnull;
+import com.google.common.collect.ImmutableMap;
import org.apache.jackrabbit.api.security.user.Group;
import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.namepath.NamePathMapper;
@@ -63,7 +65,9 @@ public abstract class AbstractPrincipalT
@Nonnull
PrincipalProvider createPrincipalProvider() {
- return new ExternalGroupPrincipalProvider(root,
getSecurityProvider().getConfiguration(UserConfiguration.class),
NamePathMapper.DEFAULT);
+ Set<String> autoMembership = syncConfig.user().getAutoMembership();
+ return new ExternalGroupPrincipalProvider(root,
getSecurityProvider().getConfiguration(UserConfiguration.class),
+ NamePathMapper.DEFAULT, ImmutableMap.of(idp.getName(),
autoMembership.toArray(new String[autoMembership.size()])));
}
@Override
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProviderTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProviderTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProviderTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProviderTest.java
Thu Aug 18 14:50:13 2016
@@ -53,7 +53,7 @@ import static org.junit.Assert.fail;
public class ExternalGroupPrincipalProviderTest extends AbstractPrincipalTest {
- private void syncWithMembership(@Nonnull ExternalUser externalUser, long
depth) throws Exception {
+ void syncWithMembership(@Nonnull ExternalUser externalUser, long depth)
throws Exception {
DefaultSyncConfig sc = new DefaultSyncConfig();
sc.user().setMembershipNestingDepth(depth);
@@ -68,7 +68,11 @@ public class ExternalGroupPrincipalProvi
root.refresh();
}
- private Set<Principal> getDeclaredGroupPrincipals(@Nonnull String userId)
throws ExternalIdentityException {
+ Set<Principal> getExpectedGroupPrincipals(@Nonnull String userId) throws
Exception {
+ return getDeclaredGroupPrincipals(userId);
+ }
+
+ Set<Principal> getDeclaredGroupPrincipals(@Nonnull String userId) throws
Exception {
Set<Principal> principals =
ImmutableSet.copyOf(Iterables.transform(idp.getUser(userId).getDeclaredGroups(),
new Function<ExternalIdentityRef, Principal>() {
@Nullable
@Override
@@ -76,16 +80,24 @@ public class ExternalGroupPrincipalProvi
try {
return new
PrincipalImpl(idp.getIdentity(input).getPrincipalName());
} catch (ExternalIdentityException e) {
- fail(e.getMessage());
- return null;
+ throw new RuntimeException(e);
}
- }
-
- ;
+ };
}));
return principals;
}
+ void collectExpectedPrincipals(Set<Principal> grPrincipals, @Nonnull
Iterable<ExternalIdentityRef> declaredGroups, long depth) throws Exception {
+ if (depth <= 0) {
+ return;
+ }
+ for (ExternalIdentityRef ref : declaredGroups) {
+ ExternalIdentity ei = idp.getIdentity(ref);
+ grPrincipals.add(new PrincipalImpl(ei.getPrincipalName()));
+ collectExpectedPrincipals(grPrincipals, ei.getDeclaredGroups(),
depth - 1);
+ }
+ }
+
@Test
public void testGetPrincipalLocalUser() throws Exception {
assertNull(principalProvider.getPrincipal(getTestUser().getPrincipal().getName()));
@@ -233,7 +245,7 @@ public class ExternalGroupPrincipalProvi
Authorizable user = getUserManager(root).getAuthorizable(USER_ID);
assertNotNull(user);
- Set<Principal> expected = getDeclaredGroupPrincipals(USER_ID);
+ Set<Principal> expected = getExpectedGroupPrincipals(USER_ID);
Set<? extends Principal> principals =
principalProvider.getGroupMembership(user.getPrincipal());
assertEquals(expected, principals);
@@ -274,17 +286,6 @@ public class ExternalGroupPrincipalProvi
assertEquals(expectedGrPrincipals, principals);
}
- private void collectExpectedPrincipals(Set<Principal> grPrincipals,
@Nonnull Iterable<ExternalIdentityRef> declaredGroups, long depth) throws
ExternalIdentityException {
- if (depth <= 0) {
- return;
- }
- for (ExternalIdentityRef ref : declaredGroups) {
- ExternalIdentity ei = idp.getIdentity(ref);
- grPrincipals.add(new PrincipalImpl(ei.getPrincipalName()));
- collectExpectedPrincipals(grPrincipals, ei.getDeclaredGroups(),
depth - 1);
- }
- }
-
@Test
public void testGetGroupMembershipExternalGroup() throws Exception {
Authorizable group =
getUserManager(root).getAuthorizable("secondGroup");
@@ -313,7 +314,7 @@ public class ExternalGroupPrincipalProvi
@Test
public void testGetPrincipalsExternalUser() throws Exception {
Set<? extends Principal> principals =
principalProvider.getPrincipals(USER_ID);
- assertEquals(getDeclaredGroupPrincipals(USER_ID), principals);
+ assertEquals(getExpectedGroupPrincipals(USER_ID), principals);
}
@Test
Modified:
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfigurationTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfigurationTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfigurationTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalPrincipalConfigurationTest.java
Thu Aug 18 14:50:13 2016
@@ -34,6 +34,7 @@ import org.apache.jackrabbit.oak.namepat
import org.apache.jackrabbit.oak.spi.commit.MoveTracker;
import org.apache.jackrabbit.oak.spi.commit.ValidatorProvider;
import org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer;
+import org.apache.jackrabbit.oak.spi.security.Context;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.AbstractExternalAuthTest;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityProvider;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.SyncContext;
Modified:
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/AbstractSecurityTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/AbstractSecurityTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/AbstractSecurityTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/AbstractSecurityTest.java
Thu Aug 18 14:50:13 2016
@@ -53,7 +53,9 @@ import org.apache.jackrabbit.oak.plugins
import org.apache.jackrabbit.oak.plugins.nodetype.TypeEditorProvider;
import org.apache.jackrabbit.oak.plugins.nodetype.write.InitialContent;
import org.apache.jackrabbit.oak.plugins.value.ValueFactoryImpl;
+import org.apache.jackrabbit.oak.plugins.version.VersionEditorProvider;
import org.apache.jackrabbit.oak.security.SecurityProviderImpl;
+import org.apache.jackrabbit.oak.spi.commit.EditorHook;
import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
import org.apache.jackrabbit.oak.spi.security.authentication.ConfigurationUtil;
@@ -83,6 +85,7 @@ public abstract class AbstractSecurityTe
public void before() throws Exception {
Oak oak = new Oak()
.with(new InitialContent())
+ .with(new EditorHook(new VersionEditorProvider()))
.with(JcrConflictHandler.createJcrConflictHandler())
.with(new NamespaceEditorProvider())
.with(new ReferenceEditorProvider())
@@ -171,7 +174,7 @@ public abstract class AbstractSecurityTe
protected PrincipalManager getPrincipalManager(Root root) {
return
getConfig(PrincipalConfiguration.class).getPrincipalManager(root,
getNamePathMapper());
}
-
+
protected JackrabbitAccessControlManager getAccessControlManager(Root
root) {
AccessControlManager acMgr =
getConfig(AuthorizationConfiguration.class).getAccessControlManager(root,
NamePathMapper.DEFAULT);
if (acMgr instanceof JackrabbitAccessControlManager) {
Modified:
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/evaluation/VersionStorageTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/evaluation/VersionStorageTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/evaluation/VersionStorageTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/evaluation/VersionStorageTest.java
Thu Aug 18 14:50:13 2016
@@ -100,11 +100,6 @@ public class VersionStorageTest extends
root.commit();
}
- @Override
- protected Oak withEditors(Oak oak) {
- return oak.with(new VersionEditorProvider());
- }
-
@Test
public void testGetVersionStorage() throws Exception {
Tree vs = getTestRoot().getTree(VersionConstants.VERSION_STORE_PATH);
Modified:
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/externalloginmodule.md
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/externalloginmodule.md?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/externalloginmodule.md
(original)
+++
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/externalloginmodule.md
Thu Aug 18 14:50:13 2016
@@ -64,7 +64,7 @@ if the user is not yet present in the lo
check the credentials with the external system during the `login()` method.
The details of the default user/group synchronization mechanism are described
in section
-[User and Group Synchronization : The Default
Implementation](defaultusersync.html)
+[User and Group Synchronization : The Default
Implementation](external/defaultusersync.html)
##### Supported Credentials
Modified:
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/usersync.md
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/usersync.md?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/usersync.md
(original)
+++
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/authentication/usersync.md
Thu Aug 18 14:50:13 2016
@@ -51,7 +51,7 @@ for the following tasks:
Oak 1.0 provides a default implementation of the user synchronization API that
allow
to plug additional `SyncHandler` implementations.
-Default implementation is described in section [User and Group Synchronization
: The Default Implementation](defaultusersync.html).
+Default implementation is described in section [User and Group Synchronization
: The Default Implementation](external/defaultusersync.html).
### Pluggability
Modified:
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/principal/principalprovider.md
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/principal/principalprovider.md?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/principal/principalprovider.md
(original)
+++
jackrabbit/oak/branches/1.2/oak-doc/src/site/markdown/security/principal/principalprovider.md
Thu Aug 18 14:50:13 2016
@@ -79,7 +79,7 @@ principals on the IDP but relies on a pe
the names of these external principals are synchronized to based on a
configurable
expiration time.
-See section [User and Group Synchronization : The Default
Implementation](../authentication/defaultusersync.html)
+See section [User and Group Synchronization : The Default
Implementation](../authentication/external/defaultusersync.html)
for additional details.
Since Oak 1.5.3
Modified: jackrabbit/oak/branches/1.2/oak-run/pom.xml
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-run/pom.xml?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.2/oak-run/pom.xml (original)
+++ jackrabbit/oak/branches/1.2/oak-run/pom.xml Thu Aug 18 14:50:13 2016
@@ -390,6 +390,12 @@
<optional>true</optional>
</dependency>
+ <dependency>
+ <groupId>org.apache.sling</groupId>
+ <artifactId>org.apache.sling.testing.osgi-mock</artifactId>
+ <scope>compile</scope>
+ </dependency>
+
<!-- Findbugs annotations -->
<dependency>
<groupId>com.google.code.findbugs</groupId>
Modified:
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/BenchmarkRunner.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/BenchmarkRunner.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/BenchmarkRunner.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/BenchmarkRunner.java
Thu Aug 18 14:50:13 2016
@@ -120,6 +120,10 @@ public class BenchmarkRunner {
OptionSpec<Boolean> setScope = parser.accepts("setScope", "Whether to
use include setScope in the user query.")
.withOptionalArg().ofType(Boolean.class)
.defaultsTo(Boolean.FALSE);
+ OptionSpec<Boolean> dynamicMembership =
parser.accepts("dynamicMembership", "Enable dynamic membership handling during
synchronisation of external users.")
+
.withOptionalArg().ofType(Boolean.class).defaultsTo(Boolean.FALSE);
+ OptionSpec<String> autoMembership = parser.accepts("autoMembership",
"Ids of those groups a given external identity automatically become member of.")
+
.withOptionalArg().ofType(String.class).withValuesSeparatedBy(',');
OptionSpec<String> nonOption = parser.nonOptions();
OptionSpec help = parser.acceptsAll(asList("h", "?", "help"), "show
help").forHelp();
OptionSet options = parser.parse(args);
@@ -299,9 +303,9 @@ public class BenchmarkRunner {
new FindAuthorizableWithScopeTest(numberOfUsers.value(options),
setScope.value(options)),
// benchmarks for oak-auth-external
- new ExternalLoginTest(numberOfUsers.value(options),
numberOfGroups.value(options), expiration.value(options), false),
- new SyncAllExternalUsersTest(numberOfUsers.value(options),
numberOfGroups.value(options), expiration.value(options), false),
- new SyncExternalUsersTest(numberOfUsers.value(options),
numberOfGroups.value(options), expiration.value(options), false,
batchSize.value(options))
+ new ExternalLoginTest(numberOfUsers.value(options),
numberOfGroups.value(options), expiration.value(options),
dynamicMembership.value(options), autoMembership.values(options)),
+ new SyncAllExternalUsersTest(numberOfUsers.value(options),
numberOfGroups.value(options), expiration.value(options),
dynamicMembership.value(options), autoMembership.values(options)),
+ new SyncExternalUsersTest(numberOfUsers.value(options),
numberOfGroups.value(options), expiration.value(options),
dynamicMembership.value(options), autoMembership.values(options),
batchSize.value(options))
};
Set<String> argset = Sets.newHashSet(nonOption.values(options));
Modified:
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/AbstractExternalTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/AbstractExternalTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/AbstractExternalTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/AbstractExternalTest.java
Thu Aug 18 14:50:13 2016
@@ -33,6 +33,8 @@ import javax.security.auth.login.Configu
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
+import org.apache.jackrabbit.api.JackrabbitSession;
+import org.apache.jackrabbit.api.security.user.UserManager;
import org.apache.jackrabbit.oak.Oak;
import org.apache.jackrabbit.oak.benchmark.AbstractTest;
import org.apache.jackrabbit.oak.fixture.JcrCreator;
@@ -52,14 +54,19 @@ import org.apache.jackrabbit.oak.spi.sec
import
org.apache.jackrabbit.oak.spi.security.authentication.external.SyncHandler;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.SyncManager;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncConfig;
+import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncConfigImpl;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncHandler;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalIDPManagerImpl;
+import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.SyncHandlerMapping;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.SyncManagerImpl;
import
org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal.ExternalPrincipalConfiguration;
import
org.apache.jackrabbit.oak.spi.security.principal.CompositePrincipalConfiguration;
import org.apache.jackrabbit.oak.spi.security.principal.PrincipalConfiguration;
+import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl;
import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
import org.apache.jackrabbit.oak.spi.whiteboard.Whiteboard;
+import org.apache.jackrabbit.oak.spi.whiteboard.WhiteboardUtils;
+import org.apache.sling.testing.mock.osgi.context.OsgiContextImpl;
import static com.google.common.base.Preconditions.checkNotNull;
@@ -68,19 +75,23 @@ import static com.google.common.base.Pre
*
* The setup currently defines the following configuration options:
*
- * - {@code numberofUsers} : number of user accounts that are 'known' to the
IDP
- * - {@code numberofGroups}: number of groups 'known' to the IDP and equally
used to define the membershipSize of each user.
+ * - {@code numberOfUsers} : number of user accounts that are 'known' to the
IDP
+ * - {@code numberOfGroups}: number of groups 'known' to the IDP and equally
used to define the membershipSize of each user.
* - {@code expirationTime}: expiration time as set with
* {@link DefaultSyncConfig.Authorizable#setExpirationTime(long)}, used for
both users and groups
* - {@code dynamicMembership}: boolean flag to enable dynamic membership (see
OAK-4101)
*
* Note: by default the {@link
DefaultSyncConfig.User#setMembershipNestingDepth(long)}
* is set to 1 and each user will become member of each of the groups as
defined
- * by {@code numberofGroups}.
+ * by {@code numberOfGroups}.
*/
abstract class AbstractExternalTest extends AbstractTest {
private static final String PATH_PREFIX = "pathPrefix";
+
+ private final Random random = new Random();
+ private final ExternalPrincipalConfiguration
externalPrincipalConfiguration = new ExternalPrincipalConfiguration();
+
final DefaultSyncConfig syncConfig = new DefaultSyncConfig();
final SyncHandler syncHandler = new DefaultSyncHandler(syncConfig);
@@ -89,13 +100,14 @@ abstract class AbstractExternalTest exte
SyncManagerImpl syncManager;
ExternalIdentityProviderManager idpManager;
- private final Random random = new Random();
-
- protected AbstractExternalTest(int numberofUsers, int numberofGroups, long
expTime, boolean dynamicMembership) {
- idp = new TestIdentityProvider(numberofUsers, numberofGroups);
+ protected AbstractExternalTest(int numberOfUsers, int numberOfGroups,
+ long expTime, boolean dynamicMembership,
+ @Nonnull List<String> autoMembership) {
+ idp = new TestIdentityProvider(numberOfUsers, numberOfGroups);
syncConfig.user()
.setMembershipNestingDepth(1)
.setDynamicMembership(dynamicMembership)
+ .setAutoMembership(autoMembership.toArray(new
String[autoMembership.size()]))
.setExpirationTime(expTime).setPathPrefix(PATH_PREFIX);
syncConfig.group()
.setExpirationTime(expTime).setPathPrefix(PATH_PREFIX);
@@ -104,7 +116,7 @@ abstract class AbstractExternalTest exte
protected abstract Configuration createConfiguration();
protected String getRandomUserId() {
- int index = random.nextInt(((TestIdentityProvider) idp).numberofUsers);
+ int index = random.nextInt(((TestIdentityProvider) idp).numberOfUsers);
return "u" + index;
}
@@ -120,6 +132,19 @@ abstract class AbstractExternalTest exte
super.run(iterable, concurrencyLevels);
}
+ @Override
+ protected void beforeSuite() throws Exception {
+ Set<String> autoMembership = syncConfig.user().getAutoMembership();
+ if (!autoMembership.isEmpty()) {
+ Session s = loginAdministrative();
+ UserManager userManager = ((JackrabbitSession) s).getUserManager();
+ for (String groupId : autoMembership) {
+ userManager.createGroup(groupId, new PrincipalImpl(groupId),
PATH_PREFIX);
+ }
+ s.save();
+ }
+ }
+
/**
* Remove any user/group accounts that have been synchronized into the
repo.
*
@@ -154,6 +179,27 @@ abstract class AbstractExternalTest exte
whiteboard.register(ExternalIdentityProvider.class, idp,
Collections.emptyMap());
whiteboard.register(SyncHandler.class, syncHandler,
Collections.emptyMap());
+ // assert proper init of the
'externalPrincipalConfiguration' if dynamic membership is enabled
+ if (syncConfig.user().getDynamicMembership()) {
+ OsgiContextImpl context = new OsgiContextImpl();
+
+ // register the ExternalPrincipal configuration in
order to have it's
+ // activate method invoked.
+
context.registerInjectActivateService(externalPrincipalConfiguration);
+
+ // now register the sync-handler with the dynamic
membership config
+ // in order to enable dynamic membership with the
external principal configuration
+ Map props = ImmutableMap.of(
+
DefaultSyncConfigImpl.PARAM_USER_DYNAMIC_MEMBERSHIP,
syncConfig.user().getDynamicMembership(),
+
DefaultSyncConfigImpl.PARAM_GROUP_AUTO_MEMBERSHIP,
syncConfig.user().getAutoMembership());
+ context.registerService(SyncHandler.class,
WhiteboardUtils.getService(whiteboard, SyncHandler.class), props);
+
+ Map shMappingProps = ImmutableMap.of(
+ SyncHandlerMapping.PARAM_IDP_NAME,
idp.getName(),
+ SyncHandlerMapping.PARAM_SYNC_HANDLER_NAME,
syncConfig.getName());
+ context.registerService(SyncHandlerMapping.class, new
SyncHandlerMapping() {}, shMappingProps);
+ }
+
SecurityProvider sp = new
TestSecurityProvider(ConfigurationParameters.EMPTY);
return new Jcr(oak).with(sp);
}
@@ -171,7 +217,7 @@ abstract class AbstractExternalTest exte
throw new IllegalStateException();
} else {
PrincipalConfiguration defConfig =
checkNotNull(((CompositePrincipalConfiguration)
principalConfiguration).getDefaultConfig());
- bindPrincipalConfiguration((new
ExternalPrincipalConfiguration(this)));
+ bindPrincipalConfiguration(externalPrincipalConfiguration);
bindPrincipalConfiguration(defConfig);
}
}
@@ -179,11 +225,11 @@ abstract class AbstractExternalTest exte
private final class TestIdentityProvider implements
ExternalIdentityProvider {
- private final int numberofUsers;
+ private final int numberOfUsers;
private final int membershipSize;
- private TestIdentityProvider(int numberofUsers, int membershipSize) {
- this.numberofUsers = numberofUsers;
+ private TestIdentityProvider(int numberOfUsers, int membershipSize) {
+ this.numberOfUsers = numberOfUsers;
this.membershipSize = membershipSize;
}
@@ -227,7 +273,7 @@ abstract class AbstractExternalTest exte
@Override
public Iterator<ExternalUser> listUsers() {
Set<ExternalUser> all = new HashSet<ExternalUser>();
- for (long i = 0; i < numberofUsers; i++) {
+ for (long i = 0; i < numberOfUsers; i++) {
all.add(new TestUser(i));
}
return all.iterator();
Modified:
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/ExternalLoginTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/ExternalLoginTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/ExternalLoginTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/ExternalLoginTest.java
Thu Aug 18 14:50:13 2016
@@ -16,6 +16,8 @@
*/
package org.apache.jackrabbit.oak.benchmark.authentication.external;
+import java.util.List;
+import javax.annotation.Nonnull;
import javax.jcr.SimpleCredentials;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
@@ -34,8 +36,9 @@ import org.apache.jackrabbit.oak.spi.sec
*/
public class ExternalLoginTest extends AbstractExternalTest {
- public ExternalLoginTest(int numberofUsers, int numberofGroups, long
expTime, boolean dynamicMembership) {
- super(numberofUsers, numberofGroups, expTime, dynamicMembership);
+ public ExternalLoginTest(int numberOfUsers, int numberOfGroups, long
expTime,
+ boolean dynamicMembership, @Nonnull List<String>
autoMembership) {
+ super(numberOfUsers, numberOfGroups, expTime, dynamicMembership,
autoMembership);
}
@Override
Modified:
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncAllExternalUsersTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncAllExternalUsersTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncAllExternalUsersTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncAllExternalUsersTest.java
Thu Aug 18 14:50:13 2016
@@ -16,6 +16,8 @@
*/
package org.apache.jackrabbit.oak.benchmark.authentication.external;
+import java.util.List;
+import javax.annotation.Nonnull;
import javax.security.auth.login.Configuration;
import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
@@ -30,8 +32,9 @@ public class SyncAllExternalUsersTest ex
private SynchronizationMBean bean;
- public SyncAllExternalUsersTest(int numberofUsers, int membershipSize,
long expTime, boolean dynamicMembership) {
- super(numberofUsers, membershipSize, expTime, dynamicMembership);
+ public SyncAllExternalUsersTest(int numberOfUsers, int membershipSize,
long expTime,
+ boolean dynamicMembership, @Nonnull
List<String> autoMembership) {
+ super(numberOfUsers, membershipSize, expTime, dynamicMembership,
autoMembership);
}
@Override
Modified:
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncExternalUsersTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncExternalUsersTest.java?rev=1756800&r1=1756799&r2=1756800&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncExternalUsersTest.java
(original)
+++
jackrabbit/oak/branches/1.2/oak-run/src/main/java/org/apache/jackrabbit/oak/benchmark/authentication/external/SyncExternalUsersTest.java
Thu Aug 18 14:50:13 2016
@@ -16,6 +16,8 @@
*/
package org.apache.jackrabbit.oak.benchmark.authentication.external;
+import java.util.List;
+import javax.annotation.Nonnull;
import javax.security.auth.login.Configuration;
import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
@@ -33,9 +35,10 @@ public class SyncExternalUsersTest exten
private final int batchSize;
private SynchronizationMBean bean;
- public SyncExternalUsersTest(int numberofUsers, int membershipSize, long
expTime,
- boolean dynamicMembership, int batchSize) {
- super(numberofUsers, membershipSize, expTime, dynamicMembership);
+ public SyncExternalUsersTest(int numberOfUsers, int membershipSize, long
expTime,
+ boolean dynamicMembership, @Nonnull
List<String> autoMembership,
+ int batchSize) {
+ super(numberOfUsers, membershipSize, expTime, dynamicMembership,
autoMembership);
this.batchSize = batchSize;
}
