From 2999c560980d48bcf58befebbc6d9dde98db3a36 Mon Sep 17 00:00:00 2001 From: Michael Jumper Date: Tue, 10 Apr 2018 15:18:38 -0700 Subject: [PATCH] GUACAMOLE-220: Map and allow manipulation of the user group parents of users. --- .../JDBCAuthenticationProviderModule.java | 2 + .../guacamole/auth/jdbc/user/ModeledUser.java | 13 ++- .../jdbc/user/UserParentUserGroupMapper.java | 28 ++++++ .../jdbc/user/UserParentUserGroupSet.java | 59 ++++++++++++ .../jdbc/user/UserParentUserGroupMapper.xml | 96 +++++++++++++++++++ 5 files changed, 196 insertions(+), 2 deletions(-) create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.java create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupSet.java create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.xml diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java index 2d4c67a09..5203cfee7 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java @@ -91,6 +91,7 @@ import org.apache.guacamole.auth.jdbc.usergroup.UserGroupParentUserGroupMapper; import org.apache.guacamole.auth.jdbc.usergroup.UserGroupService; import org.mybatis.guice.MyBatisModule; import org.mybatis.guice.datasource.builtin.PooledDataSourceProvider; +import org.apache.guacamole.auth.jdbc.user.UserParentUserGroupMapper; /** * Guice module which configures the injections used by the JDBC authentication @@ -144,6 +145,7 @@ public class JDBCAuthenticationProviderModule extends MyBatisModule { addMapperClass(UserGroupParentUserGroupMapper.class); addMapperClass(UserGroupPermissionMapper.class); addMapperClass(UserMapper.class); + addMapperClass(UserParentUserGroupMapper.class); addMapperClass(UserPermissionMapper.class); addMapperClass(UserRecordMapper.class); diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java index 9b6547139..b7924edd9 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java @@ -20,6 +20,7 @@ package org.apache.guacamole.auth.jdbc.user; import com.google.inject.Inject; +import com.google.inject.Provider; import java.sql.Date; import java.sql.Time; import java.sql.Timestamp; @@ -49,7 +50,6 @@ import org.apache.guacamole.net.auth.ActivityRecord; import org.apache.guacamole.net.auth.Permissions; import org.apache.guacamole.net.auth.RelatedObjectSet; import org.apache.guacamole.net.auth.User; -import org.apache.guacamole.net.auth.simple.SimpleRelatedObjectSet; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -176,6 +176,13 @@ public class ModeledUser extends ModeledPermissions implements User { @Inject private SaltService saltService; + /** + * Provider for RelatedObjectSets containing the user groups of which this + * user is a member. + */ + @Inject + private Provider parentUserGroupSetProvider; + /** * Whether attributes which control access restrictions should be exposed * via getAttributes() or allowed to be set via setAttributes(). @@ -747,7 +754,9 @@ public class ModeledUser extends ModeledPermissions implements User { @Override public RelatedObjectSet getUserGroups() throws GuacamoleException { - return new SimpleRelatedObjectSet(); + UserParentUserGroupSet parentUserGroupSet = parentUserGroupSetProvider.get(); + parentUserGroupSet.init(getCurrentUser(), this); + return parentUserGroupSet; } @Override diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.java new file mode 100644 index 000000000..ee3d6a8dd --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.java @@ -0,0 +1,28 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.guacamole.auth.jdbc.user; + +import org.apache.guacamole.auth.jdbc.base.ObjectRelationMapper; + +/** + * Mapper for the one-to-many relationship between a user and the user groups + * of which it is a member. + */ +public interface UserParentUserGroupMapper extends ObjectRelationMapper {} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupSet.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupSet.java new file mode 100644 index 000000000..f88872962 --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupSet.java @@ -0,0 +1,59 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.guacamole.auth.jdbc.user; + +import com.google.inject.Inject; +import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.auth.jdbc.base.ObjectRelationMapper; +import org.apache.guacamole.auth.jdbc.base.RelatedObjectSet; +import org.apache.guacamole.net.auth.permission.ObjectPermissionSet; + +/** + * RelatedObjectSet implementation which represents the one-to-many + * relationship between a particular user and the user groups of which it is a + * member. + */ +public class UserParentUserGroupSet extends RelatedObjectSet { + + /** + * Mapper for the relations between users and the user groups of which they + * are members. + */ + @Inject + private UserParentUserGroupMapper userParentUserGroupMapper; + + @Override + protected ObjectRelationMapper getObjectRelationMapper() { + return userParentUserGroupMapper; + } + + @Override + protected ObjectPermissionSet + getParentObjectEffectivePermissionSet() throws GuacamoleException { + return getCurrentUser().getUser().getEffectivePermissions().getUserPermissions(); + } + + @Override + protected ObjectPermissionSet getChildObjectEffectivePermissionSet() + throws GuacamoleException { + return getCurrentUser().getUser().getEffectivePermissions().getUserGroupPermissions(); + } + +} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.xml new file mode 100644 index 000000000..bcff7a259 --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/user/UserParentUserGroupMapper.xml @@ -0,0 +1,96 @@ + + + + + + + + + + + + + + + + DELETE FROM guacamole_user_group_member + USING guacamole_user_group, guacamole_entity + WHERE + member_entity_id = #{parent.entityID,jdbcType=INTEGER} + AND guacamole_user_group.user_group_id = guacamole_user_group_member.user_group_id + AND guacamole_entity.entity_id = guacamole_user_group.entity_id + AND guacamole_entity.type = 'USER_GROUP'::guacamole_entity_type + AND guacamole_entity.name IN + + #{identifier,jdbcType=VARCHAR} + + + + + + INSERT INTO guacamole_user_group_member ( + user_group_id, + member_entity_id + ) + SELECT DISTINCT + guacamole_user_group.user_group_id, + #{parent.entityID,jdbcType=INTEGER} + FROM guacamole_user_group + JOIN guacamole_entity ON guacamole_user_group.entity_id = guacamole_entity.entity_id + WHERE + guacamole_entity.name IN + + #{identifier,jdbcType=VARCHAR} + + AND guacamole_entity.type = 'USER_GROUP'::guacamole_entity_type + AND guacamole_user_group.user_group_id NOT IN ( + SELECT guacamole_user_group_member.user_group_id + FROM guacamole_user_group_member + WHERE guacamole_user_group_member.member_entity_id = #{parent.entityID,jdbcType=INTEGER} + ) + + +