mirror of
https://github.com/gyurix1968/guacamole-client.git
synced 2025-09-06 13:17:41 +00:00
GUACAMOLE-5: Replace UserRESTService with new resource-driven implementation.
This commit is contained in:
Michael Jumper
@@ -41,7 +41,7 @@ import org.apache.guacamole.rest.language.LanguageRESTService;
|
||||
import org.apache.guacamole.rest.patch.PatchRESTService;
|
||||
import org.apache.guacamole.rest.schema.SchemaRESTService;
|
||||
import org.apache.guacamole.rest.tunnel.TunnelRESTService;
|
||||
import org.apache.guacamole.rest.user.UserRESTService;
|
||||
import org.apache.guacamole.rest.user.UserModule;
|
||||
|
||||
/**
|
||||
* A Guice Module to set up the servlet mappings and authentication-specific
|
||||
@@ -94,7 +94,6 @@ public class RESTServiceModule extends ServletModule {
|
||||
bind(SchemaRESTService.class);
|
||||
bind(TokenRESTService.class);
|
||||
bind(TunnelRESTService.class);
|
||||
bind(UserRESTService.class);
|
||||
|
||||
// Root-level resources
|
||||
bind(SessionResource.class);
|
||||
@@ -104,6 +103,7 @@ public class RESTServiceModule extends ServletModule {
|
||||
install(new ActiveConnectionModule());
|
||||
install(new ConnectionModule());
|
||||
install(new ConnectionGroupModule());
|
||||
install(new UserModule());
|
||||
|
||||
// Set up the servlet and JSON mappings
|
||||
bind(GuiceContainer.class);
|
||||
|
||||
@@ -32,10 +32,12 @@ import org.apache.guacamole.GuacamoleException;
|
||||
import org.apache.guacamole.net.auth.ActiveConnection;
|
||||
import org.apache.guacamole.net.auth.Connection;
|
||||
import org.apache.guacamole.net.auth.ConnectionGroup;
|
||||
import org.apache.guacamole.net.auth.User;
|
||||
import org.apache.guacamole.net.auth.UserContext;
|
||||
import org.apache.guacamole.rest.activeconnection.APIActiveConnection;
|
||||
import org.apache.guacamole.rest.connection.APIConnection;
|
||||
import org.apache.guacamole.rest.connectiongroup.APIConnectionGroup;
|
||||
import org.apache.guacamole.rest.user.APIUser;
|
||||
|
||||
/**
|
||||
* A REST resource which exposes the contents of a particular UserContext.
|
||||
@@ -75,6 +77,13 @@ public class UserContextResource {
|
||||
private DirectoryResourceFactory<ConnectionGroup, APIConnectionGroup>
|
||||
connectionGroupDirectoryResourceFactory;
|
||||
|
||||
/**
|
||||
* Factory for creating DirectoryResources which expose a given
|
||||
* User Directory.
|
||||
*/
|
||||
@Inject
|
||||
private DirectoryResourceFactory<User, APIUser> userDirectoryResourceFactory;
|
||||
|
||||
/**
|
||||
* Creates a new UserContextResource which exposes the data within the
|
||||
* given UserContext.
|
||||
@@ -142,4 +151,22 @@ public class UserContextResource {
|
||||
userContext.getConnectionGroupDirectory());
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a new resource which represents the User Directory contained
|
||||
* within the UserContext exposed by this UserContextResource.
|
||||
*
|
||||
* @return
|
||||
* A new resource which represents the User Directory contained within
|
||||
* the UserContext exposed by this UserContextResource.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while retrieving the User Directory.
|
||||
*/
|
||||
@Path("users")
|
||||
public DirectoryResource<User, APIUser> getUserDirectoryResource()
|
||||
throws GuacamoleException {
|
||||
return userDirectoryResourceFactory.create(userContext,
|
||||
userContext.getUserDirectory());
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
/*
|
||||
* Licensed to the Apache Software Foundation (ASF) under one
|
||||
* or more contributor license agreements. See the NOTICE file
|
||||
* distributed with this work for additional information
|
||||
* regarding copyright ownership. The ASF licenses this file
|
||||
* to you under the Apache License, Version 2.0 (the
|
||||
* "License"); you may not use this file except in compliance
|
||||
* with the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
* KIND, either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
*/
|
||||
|
||||
package org.apache.guacamole.rest.user;
|
||||
|
||||
import com.google.inject.assistedinject.Assisted;
|
||||
import com.google.inject.assistedinject.AssistedInject;
|
||||
import javax.ws.rs.Consumes;
|
||||
import javax.ws.rs.Produces;
|
||||
import javax.ws.rs.core.MediaType;
|
||||
import org.apache.guacamole.GuacamoleException;
|
||||
import org.apache.guacamole.net.auth.User;
|
||||
import org.apache.guacamole.net.auth.Directory;
|
||||
import org.apache.guacamole.net.auth.UserContext;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectResource;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectResourceFactory;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
|
||||
import org.apache.guacamole.rest.directory.DirectoryResource;
|
||||
|
||||
/**
|
||||
* A REST resource which abstracts the operations available on a Directory of
|
||||
* Users.
|
||||
*
|
||||
* @author Michael Jumper
|
||||
*/
|
||||
@Produces(MediaType.APPLICATION_JSON)
|
||||
@Consumes(MediaType.APPLICATION_JSON)
|
||||
public class UserDirectoryResource extends DirectoryResource<User, APIUser> {
|
||||
|
||||
/**
|
||||
* The UserContext associated with the Directory which contains the
|
||||
* User exposed by this resource.
|
||||
*/
|
||||
private final UserContext userContext;
|
||||
|
||||
/**
|
||||
* The Directory exposed by this resource.
|
||||
*/
|
||||
private final Directory<User> directory;
|
||||
|
||||
/**
|
||||
* A factory which can be used to create instances of resources representing
|
||||
* Users.
|
||||
*/
|
||||
private final DirectoryObjectResourceFactory<User, APIUser> resourceFactory;
|
||||
|
||||
/**
|
||||
* Creates a new UserDirectoryResource which exposes the operations and
|
||||
* subresources available for the given User Directory.
|
||||
*
|
||||
* @param userContext
|
||||
* The UserContext associated with the given Directory.
|
||||
*
|
||||
* @param directory
|
||||
* The Directory being exposed.
|
||||
*
|
||||
* @param translator
|
||||
* A DirectoryObjectTranslator implementation which handles
|
||||
* Users.
|
||||
*
|
||||
* @param resourceFactory
|
||||
* A factory which can be used to create instances of resources
|
||||
* representing Users.
|
||||
*/
|
||||
@AssistedInject
|
||||
public UserDirectoryResource(@Assisted UserContext userContext,
|
||||
@Assisted Directory<User> directory,
|
||||
DirectoryObjectTranslator<User, APIUser> translator,
|
||||
DirectoryObjectResourceFactory<User, APIUser> resourceFactory) {
|
||||
super(userContext, directory, translator, resourceFactory);
|
||||
this.userContext = userContext;
|
||||
this.directory = directory;
|
||||
this.resourceFactory = resourceFactory;
|
||||
}
|
||||
|
||||
@Override
|
||||
public DirectoryObjectResource<User, APIUser>
|
||||
getObjectResource(String identifier) throws GuacamoleException {
|
||||
|
||||
// If username is own username, just use self - might not have query permissions
|
||||
if (userContext.self().getIdentifier().equals(identifier))
|
||||
return resourceFactory.create(userContext, directory, userContext.self());
|
||||
|
||||
return super.getObjectResource(identifier);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
/*
|
||||
* Licensed to the Apache Software Foundation (ASF) under one
|
||||
* or more contributor license agreements. See the NOTICE file
|
||||
* distributed with this work for additional information
|
||||
* regarding copyright ownership. The ASF licenses this file
|
||||
* to you under the Apache License, Version 2.0 (the
|
||||
* "License"); you may not use this file except in compliance
|
||||
* with the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
* KIND, either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
*/
|
||||
|
||||
package org.apache.guacamole.rest.user;
|
||||
|
||||
import com.google.inject.AbstractModule;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectResourceFactory;
|
||||
import org.apache.guacamole.rest.directory.DirectoryResourceFactory;
|
||||
import com.google.inject.TypeLiteral;
|
||||
import com.google.inject.assistedinject.FactoryModuleBuilder;
|
||||
import org.apache.guacamole.net.auth.User;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectResource;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
|
||||
import org.apache.guacamole.rest.directory.DirectoryResource;
|
||||
|
||||
/**
|
||||
* Guice Module which configures injections required for handling User resources
|
||||
* via the REST API.
|
||||
*
|
||||
* @author Michael Jumper
|
||||
*/
|
||||
public class UserModule extends AbstractModule {
|
||||
|
||||
@Override
|
||||
protected void configure() {
|
||||
|
||||
// Create the required DirectoryResourceFactory implementation
|
||||
install(new FactoryModuleBuilder()
|
||||
.implement(
|
||||
new TypeLiteral<DirectoryResource<User, APIUser>>() {},
|
||||
UserDirectoryResource.class
|
||||
)
|
||||
.build(new TypeLiteral<DirectoryResourceFactory<User, APIUser>>() {}));
|
||||
|
||||
// Create the required DirectoryObjectResourceFactory implementation
|
||||
install(new FactoryModuleBuilder()
|
||||
.implement(
|
||||
new TypeLiteral<DirectoryObjectResource<User, APIUser>>() {},
|
||||
UserResource.class
|
||||
)
|
||||
.build(new TypeLiteral<DirectoryObjectResourceFactory<User, APIUser>>() {}));
|
||||
|
||||
// Bind translator for converting between User and APIUser
|
||||
bind(new TypeLiteral<DirectoryObjectTranslator<User, APIUser>>() {})
|
||||
.to(UserObjectTranslator.class);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
/*
|
||||
* Licensed to the Apache Software Foundation (ASF) under one
|
||||
* or more contributor license agreements. See the NOTICE file
|
||||
* distributed with this work for additional information
|
||||
* regarding copyright ownership. The ASF licenses this file
|
||||
* to you under the Apache License, Version 2.0 (the
|
||||
* "License"); you may not use this file except in compliance
|
||||
* with the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
* KIND, either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
*/
|
||||
|
||||
package org.apache.guacamole.rest.user;
|
||||
|
||||
import org.apache.guacamole.GuacamoleException;
|
||||
import org.apache.guacamole.net.auth.User;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
|
||||
|
||||
/**
|
||||
* Translator which converts between User objects and APIUser objects.
|
||||
*
|
||||
* @author Michael Jumper
|
||||
*/
|
||||
public class UserObjectTranslator
|
||||
implements DirectoryObjectTranslator<User, APIUser> {
|
||||
|
||||
@Override
|
||||
public APIUser toExternalObject(User object)
|
||||
throws GuacamoleException {
|
||||
return new APIUser(object);
|
||||
}
|
||||
|
||||
@Override
|
||||
public User toInternalObject(APIUser object)
|
||||
throws GuacamoleException {
|
||||
return new APIUserWrapper(object);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void applyExternalChanges(User existingObject,
|
||||
APIUser object) throws GuacamoleException {
|
||||
|
||||
// Do not update the user password if no password was provided
|
||||
if (object.getPassword() != null)
|
||||
existingObject.setPassword(object.getPassword());
|
||||
|
||||
// Update user attributes
|
||||
existingObject.setAttributes(object.getAttributes());
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,644 +0,0 @@
|
||||
/*
|
||||
* Licensed to the Apache Software Foundation (ASF) under one
|
||||
* or more contributor license agreements. See the NOTICE file
|
||||
* distributed with this work for additional information
|
||||
* regarding copyright ownership. The ASF licenses this file
|
||||
* to you under the Apache License, Version 2.0 (the
|
||||
* "License"); you may not use this file except in compliance
|
||||
* with the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
* KIND, either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
*/
|
||||
|
||||
package org.apache.guacamole.rest.user;
|
||||
|
||||
import com.google.inject.Inject;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collection;
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.ws.rs.Consumes;
|
||||
import javax.ws.rs.DELETE;
|
||||
import javax.ws.rs.GET;
|
||||
import javax.ws.rs.POST;
|
||||
import javax.ws.rs.PUT;
|
||||
import javax.ws.rs.Path;
|
||||
import javax.ws.rs.PathParam;
|
||||
import javax.ws.rs.Produces;
|
||||
import javax.ws.rs.QueryParam;
|
||||
import javax.ws.rs.core.Context;
|
||||
import javax.ws.rs.core.MediaType;
|
||||
import org.apache.guacamole.GuacamoleClientException;
|
||||
import org.apache.guacamole.GuacamoleException;
|
||||
import org.apache.guacamole.GuacamoleResourceNotFoundException;
|
||||
import org.apache.guacamole.GuacamoleSecurityException;
|
||||
import org.apache.guacamole.net.auth.AuthenticationProvider;
|
||||
import org.apache.guacamole.net.auth.Credentials;
|
||||
import org.apache.guacamole.net.auth.Directory;
|
||||
import org.apache.guacamole.net.auth.User;
|
||||
import org.apache.guacamole.net.auth.UserContext;
|
||||
import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
|
||||
import org.apache.guacamole.net.auth.permission.ObjectPermission;
|
||||
import org.apache.guacamole.net.auth.permission.ObjectPermissionSet;
|
||||
import org.apache.guacamole.net.auth.permission.Permission;
|
||||
import org.apache.guacamole.net.auth.permission.SystemPermission;
|
||||
import org.apache.guacamole.net.auth.permission.SystemPermissionSet;
|
||||
import org.apache.guacamole.GuacamoleSession;
|
||||
import org.apache.guacamole.rest.APIPatch;
|
||||
import static org.apache.guacamole.rest.APIPatch.Operation.add;
|
||||
import static org.apache.guacamole.rest.APIPatch.Operation.remove;
|
||||
import org.apache.guacamole.rest.ObjectRetrievalService;
|
||||
import org.apache.guacamole.rest.PATCH;
|
||||
import org.apache.guacamole.rest.auth.AuthenticationService;
|
||||
import org.apache.guacamole.rest.permission.APIPermissionSet;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
/**
|
||||
* A REST Service for handling user CRUD operations.
|
||||
*
|
||||
* @author James Muehlner
|
||||
* @author Michael Jumper
|
||||
*/
|
||||
@Path("/data/{dataSource}/users")
|
||||
@Produces(MediaType.APPLICATION_JSON)
|
||||
@Consumes(MediaType.APPLICATION_JSON)
|
||||
public class UserRESTService {
|
||||
|
||||
/**
|
||||
* Logger for this class.
|
||||
*/
|
||||
private static final Logger logger = LoggerFactory.getLogger(UserRESTService.class);
|
||||
|
||||
/**
|
||||
* The prefix of any path within an operation of a JSON patch which
|
||||
* modifies the permissions of a user regarding a specific connection.
|
||||
*/
|
||||
private static final String CONNECTION_PERMISSION_PATCH_PATH_PREFIX = "/connectionPermissions/";
|
||||
|
||||
/**
|
||||
* The prefix of any path within an operation of a JSON patch which
|
||||
* modifies the permissions of a user regarding a specific connection group.
|
||||
*/
|
||||
private static final String CONNECTION_GROUP_PERMISSION_PATCH_PATH_PREFIX = "/connectionGroupPermissions/";
|
||||
|
||||
/**
|
||||
* The prefix of any path within an operation of a JSON patch which
|
||||
* modifies the permissions of a user regarding a specific active connection.
|
||||
*/
|
||||
private static final String ACTIVE_CONNECTION_PERMISSION_PATCH_PATH_PREFIX = "/activeConnectionPermissions/";
|
||||
|
||||
/**
|
||||
* The prefix of any path within an operation of a JSON patch which
|
||||
* modifies the permissions of a user regarding another, specific user.
|
||||
*/
|
||||
private static final String USER_PERMISSION_PATCH_PATH_PREFIX = "/userPermissions/";
|
||||
|
||||
/**
|
||||
* The path of any operation within a JSON patch which modifies the
|
||||
* permissions of a user regarding the entire system.
|
||||
*/
|
||||
private static final String SYSTEM_PERMISSION_PATCH_PATH = "/systemPermissions";
|
||||
|
||||
/**
|
||||
* A service for authenticating users from auth tokens.
|
||||
*/
|
||||
@Inject
|
||||
private AuthenticationService authenticationService;
|
||||
|
||||
/**
|
||||
* Service for convenient retrieval of objects.
|
||||
*/
|
||||
@Inject
|
||||
private ObjectRetrievalService retrievalService;
|
||||
|
||||
/**
|
||||
* Gets a list of users in the given data source (UserContext), filtering
|
||||
* the returned list by the given permission, if specified.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext from which the users are to be retrieved.
|
||||
*
|
||||
* @param permissions
|
||||
* The set of permissions to filter with. A user must have one or more
|
||||
* of these permissions for a user to appear in the result.
|
||||
* If null, no filtering will be performed.
|
||||
*
|
||||
* @return
|
||||
* A list of all visible users. If a permission was specified, this
|
||||
* list will contain only those users for whom the current user has
|
||||
* that permission.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error is encountered while retrieving users.
|
||||
*/
|
||||
@GET
|
||||
public List<APIUser> getUsers(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@QueryParam("permission") List<ObjectPermission.Type> permissions)
|
||||
throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
// An admin user has access to any user
|
||||
User self = userContext.self();
|
||||
SystemPermissionSet systemPermissions = self.getSystemPermissions();
|
||||
boolean isAdmin = systemPermissions.hasPermission(SystemPermission.Type.ADMINISTER);
|
||||
|
||||
// Get the directory
|
||||
Directory<User> userDirectory = userContext.getUserDirectory();
|
||||
|
||||
// Filter users, if requested
|
||||
Collection<String> userIdentifiers = userDirectory.getIdentifiers();
|
||||
if (!isAdmin && permissions != null && !permissions.isEmpty()) {
|
||||
ObjectPermissionSet userPermissions = self.getUserPermissions();
|
||||
userIdentifiers = userPermissions.getAccessibleObjects(permissions, userIdentifiers);
|
||||
}
|
||||
|
||||
// Retrieve all users, converting to API users
|
||||
List<APIUser> apiUsers = new ArrayList<APIUser>();
|
||||
for (User user : userDirectory.getAll(userIdentifiers))
|
||||
apiUsers.add(new APIUser(user));
|
||||
|
||||
return apiUsers;
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieves an individual user.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext from which the requested user is to be retrieved.
|
||||
*
|
||||
* @param username
|
||||
* The username of the user to retrieve.
|
||||
*
|
||||
* @return user
|
||||
* The user having the given username.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while retrieving the user.
|
||||
*/
|
||||
@GET
|
||||
@Path("/{username}")
|
||||
public APIUser getUser(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@PathParam("username") String username)
|
||||
throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
|
||||
// Retrieve the requested user
|
||||
User user = retrievalService.retrieveUser(session, authProviderIdentifier, username);
|
||||
return new APIUser(user);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a new user and returns the user that was created.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext in which the requested user is to be created.
|
||||
*
|
||||
* @param user
|
||||
* The new user to create.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If a problem is encountered while creating the user.
|
||||
*
|
||||
* @return
|
||||
* The newly created user.
|
||||
*/
|
||||
@POST
|
||||
public APIUser createUser(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier, APIUser user)
|
||||
throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
// Get the directory
|
||||
Directory<User> userDirectory = userContext.getUserDirectory();
|
||||
|
||||
// Randomly set the password if it wasn't provided
|
||||
if (user.getPassword() == null)
|
||||
user.setPassword(UUID.randomUUID().toString());
|
||||
|
||||
// Create the user
|
||||
userDirectory.add(new APIUserWrapper(user));
|
||||
|
||||
return user;
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates an individual existing user.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext in which the requested user is to be updated.
|
||||
*
|
||||
* @param username
|
||||
* The username of the user to update.
|
||||
*
|
||||
* @param user
|
||||
* The data to update the user with.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while updating the user.
|
||||
*/
|
||||
@PUT
|
||||
@Path("/{username}")
|
||||
public void updateUser(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@PathParam("username") String username, APIUser user)
|
||||
throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
// Get the directory
|
||||
Directory<User> userDirectory = userContext.getUserDirectory();
|
||||
|
||||
// Validate data and path are sane
|
||||
if (!user.getUsername().equals(username))
|
||||
throw new GuacamoleClientException("Username in path does not match username provided JSON data.");
|
||||
|
||||
// A user may not use this endpoint to modify himself
|
||||
if (userContext.self().getIdentifier().equals(user.getUsername()))
|
||||
throw new GuacamoleSecurityException("Permission denied.");
|
||||
|
||||
// Get the user
|
||||
User existingUser = retrievalService.retrieveUser(userContext, username);
|
||||
|
||||
// Do not update the user password if no password was provided
|
||||
if (user.getPassword() != null)
|
||||
existingUser.setPassword(user.getPassword());
|
||||
|
||||
// Update user attributes
|
||||
existingUser.setAttributes(user.getAttributes());
|
||||
|
||||
// Update the user
|
||||
userDirectory.update(existingUser);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates the password for an individual existing user.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext in which the requested user is to be updated.
|
||||
*
|
||||
* @param username
|
||||
* The username of the user to update.
|
||||
*
|
||||
* @param userPasswordUpdate
|
||||
* The object containing the old password for the user, as well as the
|
||||
* new password to set for that user.
|
||||
*
|
||||
* @param request
|
||||
* The HttpServletRequest associated with the password update attempt.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while updating the user's password.
|
||||
*/
|
||||
@PUT
|
||||
@Path("/{username}/password")
|
||||
public void updatePassword(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@PathParam("username") String username,
|
||||
APIUserPasswordUpdate userPasswordUpdate,
|
||||
@Context HttpServletRequest request) throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
// Build credentials
|
||||
Credentials credentials = new Credentials();
|
||||
credentials.setUsername(username);
|
||||
credentials.setPassword(userPasswordUpdate.getOldPassword());
|
||||
credentials.setRequest(request);
|
||||
credentials.setSession(request.getSession(true));
|
||||
|
||||
// Verify that the old password was correct
|
||||
try {
|
||||
AuthenticationProvider authProvider = userContext.getAuthenticationProvider();
|
||||
if (authProvider.authenticateUser(credentials) == null)
|
||||
throw new GuacamoleSecurityException("Permission denied.");
|
||||
}
|
||||
|
||||
// Pass through any credentials exceptions as simple permission denied
|
||||
catch (GuacamoleCredentialsException e) {
|
||||
throw new GuacamoleSecurityException("Permission denied.");
|
||||
}
|
||||
|
||||
// Get the user directory
|
||||
Directory<User> userDirectory = userContext.getUserDirectory();
|
||||
|
||||
// Get the user that we want to updates
|
||||
User user = retrievalService.retrieveUser(userContext, username);
|
||||
|
||||
// Set password to the newly provided one
|
||||
user.setPassword(userPasswordUpdate.getNewPassword());
|
||||
|
||||
// Update the user
|
||||
userDirectory.update(user);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Deletes an individual existing user.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext from which the requested user is to be deleted.
|
||||
*
|
||||
* @param username
|
||||
* The username of the user to delete.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while deleting the user.
|
||||
*/
|
||||
@DELETE
|
||||
@Path("/{username}")
|
||||
public void deleteUser(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@PathParam("username") String username)
|
||||
throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
// Get the directory
|
||||
Directory<User> userDirectory = userContext.getUserDirectory();
|
||||
|
||||
// Get the user
|
||||
User existingUser = userDirectory.get(username);
|
||||
if (existingUser == null)
|
||||
throw new GuacamoleResourceNotFoundException("No such user: \"" + username + "\"");
|
||||
|
||||
// Delete the user
|
||||
userDirectory.remove(username);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a list of permissions for the user with the given username.
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext in which the requested user is to be found.
|
||||
*
|
||||
* @param username
|
||||
* The username of the user to retrieve permissions for.
|
||||
*
|
||||
* @return
|
||||
* A list of all permissions granted to the specified user.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while retrieving permissions.
|
||||
*/
|
||||
@GET
|
||||
@Path("/{username}/permissions")
|
||||
public APIPermissionSet getPermissions(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@PathParam("username") String username)
|
||||
throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
User user;
|
||||
|
||||
// If username is own username, just use self - might not have query permissions
|
||||
if (userContext.self().getIdentifier().equals(username))
|
||||
user = userContext.self();
|
||||
|
||||
// If not self, query corresponding user from directory
|
||||
else {
|
||||
user = userContext.getUserDirectory().get(username);
|
||||
if (user == null)
|
||||
throw new GuacamoleResourceNotFoundException("No such user: \"" + username + "\"");
|
||||
}
|
||||
|
||||
return new APIPermissionSet(user);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates the given permission set patch by queuing an add or remove
|
||||
* operation for the given permission based on the given patch operation.
|
||||
*
|
||||
* @param <PermissionType>
|
||||
* The type of permission stored within the permission set.
|
||||
*
|
||||
* @param operation
|
||||
* The patch operation to perform.
|
||||
*
|
||||
* @param permissionSetPatch
|
||||
* The permission set patch being modified.
|
||||
*
|
||||
* @param permission
|
||||
* The permission being added or removed from the set.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If the requested patch operation is not supported.
|
||||
*/
|
||||
private <PermissionType extends Permission> void updatePermissionSet(
|
||||
APIPatch.Operation operation,
|
||||
PermissionSetPatch<PermissionType> permissionSetPatch,
|
||||
PermissionType permission) throws GuacamoleException {
|
||||
|
||||
// Add or remove permission based on operation
|
||||
switch (operation) {
|
||||
|
||||
// Add permission
|
||||
case add:
|
||||
permissionSetPatch.addPermission(permission);
|
||||
break;
|
||||
|
||||
// Remove permission
|
||||
case remove:
|
||||
permissionSetPatch.removePermission(permission);
|
||||
break;
|
||||
|
||||
// Unsupported patch operation
|
||||
default:
|
||||
throw new GuacamoleClientException("Unsupported patch operation: \"" + operation + "\"");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Applies a given list of permission patches. Each patch specifies either
|
||||
* an "add" or a "remove" operation for a permission type, represented by
|
||||
* a string. Valid permission types depend on the path of each patch
|
||||
* operation, as the path dictates the permission being modified, such as
|
||||
* "/connectionPermissions/42" or "/systemPermissions".
|
||||
*
|
||||
* @param authToken
|
||||
* The authentication token that is used to authenticate the user
|
||||
* performing the operation.
|
||||
*
|
||||
* @param authProviderIdentifier
|
||||
* The unique identifier of the AuthenticationProvider associated with
|
||||
* the UserContext in which the requested user is to be found.
|
||||
*
|
||||
* @param username
|
||||
* The username of the user to modify the permissions of.
|
||||
*
|
||||
* @param patches
|
||||
* The permission patches to apply for this request.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If a problem is encountered while modifying permissions.
|
||||
*/
|
||||
@PATCH
|
||||
@Path("/{username}/permissions")
|
||||
public void patchPermissions(@QueryParam("token") String authToken,
|
||||
@PathParam("dataSource") String authProviderIdentifier,
|
||||
@PathParam("username") String username,
|
||||
List<APIPatch<String>> patches) throws GuacamoleException {
|
||||
|
||||
GuacamoleSession session = authenticationService.getGuacamoleSession(authToken);
|
||||
UserContext userContext = retrievalService.retrieveUserContext(session, authProviderIdentifier);
|
||||
|
||||
// Get the user
|
||||
User user = userContext.getUserDirectory().get(username);
|
||||
if (user == null)
|
||||
throw new GuacamoleResourceNotFoundException("No such user: \"" + username + "\"");
|
||||
|
||||
// Permission patches for all types of permissions
|
||||
PermissionSetPatch<ObjectPermission> connectionPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<ObjectPermission> connectionGroupPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<ObjectPermission> activeConnectionPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<ObjectPermission> userPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<SystemPermission> systemPermissionPatch = new PermissionSetPatch<SystemPermission>();
|
||||
|
||||
// Apply all patch operations individually
|
||||
for (APIPatch<String> patch : patches) {
|
||||
|
||||
String path = patch.getPath();
|
||||
|
||||
// Create connection permission if path has connection prefix
|
||||
if (path.startsWith(CONNECTION_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(CONNECTION_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), connectionPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create connection group permission if path has connection group prefix
|
||||
else if (path.startsWith(CONNECTION_GROUP_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(CONNECTION_GROUP_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), connectionGroupPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create active connection permission if path has active connection prefix
|
||||
else if (path.startsWith(ACTIVE_CONNECTION_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(ACTIVE_CONNECTION_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), activeConnectionPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create user permission if path has user prefix
|
||||
else if (path.startsWith(USER_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(USER_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), userPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create system permission if path is system path
|
||||
else if (path.equals(SYSTEM_PERMISSION_PATCH_PATH)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
SystemPermission.Type type = SystemPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
SystemPermission permission = new SystemPermission(type);
|
||||
updatePermissionSet(patch.getOp(), systemPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Otherwise, the path is not supported
|
||||
else
|
||||
throw new GuacamoleClientException("Unsupported patch path: \"" + path + "\"");
|
||||
|
||||
} // end for each patch operation
|
||||
|
||||
// Save the permission changes
|
||||
connectionPermissionPatch.apply(user.getConnectionPermissions());
|
||||
connectionGroupPermissionPatch.apply(user.getConnectionGroupPermissions());
|
||||
activeConnectionPermissionPatch.apply(user.getActiveConnectionPermissions());
|
||||
userPermissionPatch.apply(user.getUserPermissions());
|
||||
systemPermissionPatch.apply(user.getSystemPermissions());
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,329 @@
|
||||
/*
|
||||
* Licensed to the Apache Software Foundation (ASF) under one
|
||||
* or more contributor license agreements. See the NOTICE file
|
||||
* distributed with this work for additional information
|
||||
* regarding copyright ownership. The ASF licenses this file
|
||||
* to you under the Apache License, Version 2.0 (the
|
||||
* "License"); you may not use this file except in compliance
|
||||
* with the License. You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing,
|
||||
* software distributed under the License is distributed on an
|
||||
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
* KIND, either express or implied. See the License for the
|
||||
* specific language governing permissions and limitations
|
||||
* under the License.
|
||||
*/
|
||||
|
||||
package org.apache.guacamole.rest.user;
|
||||
|
||||
import com.google.inject.assistedinject.Assisted;
|
||||
import com.google.inject.assistedinject.AssistedInject;
|
||||
import java.util.List;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.ws.rs.Consumes;
|
||||
import javax.ws.rs.GET;
|
||||
import javax.ws.rs.PUT;
|
||||
import javax.ws.rs.Path;
|
||||
import javax.ws.rs.Produces;
|
||||
import javax.ws.rs.core.Context;
|
||||
import javax.ws.rs.core.MediaType;
|
||||
import org.apache.guacamole.GuacamoleClientException;
|
||||
import org.apache.guacamole.GuacamoleException;
|
||||
import org.apache.guacamole.GuacamoleSecurityException;
|
||||
import org.apache.guacamole.net.auth.AuthenticationProvider;
|
||||
import org.apache.guacamole.net.auth.Credentials;
|
||||
import org.apache.guacamole.net.auth.User;
|
||||
import org.apache.guacamole.net.auth.Directory;
|
||||
import org.apache.guacamole.net.auth.UserContext;
|
||||
import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
|
||||
import org.apache.guacamole.net.auth.permission.ObjectPermission;
|
||||
import org.apache.guacamole.net.auth.permission.Permission;
|
||||
import org.apache.guacamole.net.auth.permission.SystemPermission;
|
||||
import org.apache.guacamole.rest.APIPatch;
|
||||
import org.apache.guacamole.rest.PATCH;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectResource;
|
||||
import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
|
||||
import org.apache.guacamole.rest.permission.APIPermissionSet;
|
||||
|
||||
/**
|
||||
* A REST resource which abstracts the operations available on an existing
|
||||
* User.
|
||||
*
|
||||
* @author Michael Jumper
|
||||
*/
|
||||
@Produces(MediaType.APPLICATION_JSON)
|
||||
@Consumes(MediaType.APPLICATION_JSON)
|
||||
public class UserResource
|
||||
extends DirectoryObjectResource<User, APIUser> {
|
||||
|
||||
/**
|
||||
* The UserContext associated with the Directory which contains the User
|
||||
* exposed by this resource.
|
||||
*/
|
||||
private final UserContext userContext;
|
||||
|
||||
/**
|
||||
* The Directory which contains the User object represented by this
|
||||
* UserResource.
|
||||
*/
|
||||
private final Directory<User> directory;
|
||||
|
||||
/**
|
||||
* The User object represented by this UserResource.
|
||||
*/
|
||||
private final User user;
|
||||
|
||||
/**
|
||||
* Creates a new UserResource which exposes the operations and subresources
|
||||
* available for the given User.
|
||||
*
|
||||
* @param userContext
|
||||
* The UserContext associated with the given Directory.
|
||||
*
|
||||
* @param directory
|
||||
* The Directory which contains the given User.
|
||||
*
|
||||
* @param user
|
||||
* The User that this UserResource should represent.
|
||||
*
|
||||
* @param translator
|
||||
* A DirectoryObjectTranslator implementation which handles Users.
|
||||
*/
|
||||
@AssistedInject
|
||||
public UserResource(@Assisted UserContext userContext,
|
||||
@Assisted Directory<User> directory,
|
||||
@Assisted User user,
|
||||
DirectoryObjectTranslator<User, APIUser> translator) {
|
||||
super(directory, user, translator);
|
||||
this.userContext = userContext;
|
||||
this.directory = directory;
|
||||
this.user = user;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void updateObject(APIUser modifiedObject) throws GuacamoleException {
|
||||
|
||||
// A user may not use this endpoint to modify himself
|
||||
if (userContext.self().getIdentifier().equals(modifiedObject.getUsername()))
|
||||
throw new GuacamoleSecurityException("Permission denied.");
|
||||
|
||||
super.updateObject(modifiedObject);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates the password for an individual existing user.
|
||||
*
|
||||
* @param userPasswordUpdate
|
||||
* The object containing the old password for the user, as well as the
|
||||
* new password to set for that user.
|
||||
*
|
||||
* @param request
|
||||
* The HttpServletRequest associated with the password update attempt.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while updating the user's password.
|
||||
*/
|
||||
@PUT
|
||||
@Path("password")
|
||||
public void updatePassword(APIUserPasswordUpdate userPasswordUpdate,
|
||||
@Context HttpServletRequest request) throws GuacamoleException {
|
||||
|
||||
// Build credentials
|
||||
Credentials credentials = new Credentials();
|
||||
credentials.setUsername(user.getIdentifier());
|
||||
credentials.setPassword(userPasswordUpdate.getOldPassword());
|
||||
credentials.setRequest(request);
|
||||
credentials.setSession(request.getSession(true));
|
||||
|
||||
// Verify that the old password was correct
|
||||
try {
|
||||
AuthenticationProvider authProvider = userContext.getAuthenticationProvider();
|
||||
if (authProvider.authenticateUser(credentials) == null)
|
||||
throw new GuacamoleSecurityException("Permission denied.");
|
||||
}
|
||||
|
||||
// Pass through any credentials exceptions as simple permission denied
|
||||
catch (GuacamoleCredentialsException e) {
|
||||
throw new GuacamoleSecurityException("Permission denied.");
|
||||
}
|
||||
|
||||
// Set password to the newly provided one
|
||||
user.setPassword(userPasswordUpdate.getNewPassword());
|
||||
directory.update(user);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a list of permissions for the user with the given username.
|
||||
*
|
||||
* @return
|
||||
* A list of all permissions granted to the specified user.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If an error occurs while retrieving permissions.
|
||||
*/
|
||||
@GET
|
||||
@Path("permissions")
|
||||
public APIPermissionSet getPermissions() throws GuacamoleException {
|
||||
return new APIPermissionSet(user);
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates the given permission set patch by queuing an add or remove
|
||||
* operation for the given permission based on the given patch operation.
|
||||
*
|
||||
* @param <PermissionType>
|
||||
* The type of permission stored within the permission set.
|
||||
*
|
||||
* @param operation
|
||||
* The patch operation to perform.
|
||||
*
|
||||
* @param permissionSetPatch
|
||||
* The permission set patch being modified.
|
||||
*
|
||||
* @param permission
|
||||
* The permission being added or removed from the set.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If the requested patch operation is not supported.
|
||||
*/
|
||||
private <PermissionType extends Permission> void updatePermissionSet(
|
||||
APIPatch.Operation operation,
|
||||
PermissionSetPatch<PermissionType> permissionSetPatch,
|
||||
PermissionType permission) throws GuacamoleException {
|
||||
|
||||
// Add or remove permission based on operation
|
||||
switch (operation) {
|
||||
|
||||
// Add permission
|
||||
case add:
|
||||
permissionSetPatch.addPermission(permission);
|
||||
break;
|
||||
|
||||
// Remove permission
|
||||
case remove:
|
||||
permissionSetPatch.removePermission(permission);
|
||||
break;
|
||||
|
||||
// Unsupported patch operation
|
||||
default:
|
||||
throw new GuacamoleClientException("Unsupported patch operation: \"" + operation + "\"");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Applies a given list of permission patches. Each patch specifies either
|
||||
* an "add" or a "remove" operation for a permission type, represented by
|
||||
* a string. Valid permission types depend on the path of each patch
|
||||
* operation, as the path dictates the permission being modified, such as
|
||||
* "/connectionPermissions/42" or "/systemPermissions".
|
||||
*
|
||||
* @param patches
|
||||
* The permission patches to apply for this request.
|
||||
*
|
||||
* @throws GuacamoleException
|
||||
* If a problem is encountered while modifying permissions.
|
||||
*/
|
||||
@PATCH
|
||||
@Path("permissions")
|
||||
public void patchPermissions(List<APIPatch<String>> patches)
|
||||
throws GuacamoleException {
|
||||
|
||||
// Permission patches for all types of permissions
|
||||
PermissionSetPatch<ObjectPermission> connectionPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<ObjectPermission> connectionGroupPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<ObjectPermission> activeConnectionPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<ObjectPermission> userPermissionPatch = new PermissionSetPatch<ObjectPermission>();
|
||||
PermissionSetPatch<SystemPermission> systemPermissionPatch = new PermissionSetPatch<SystemPermission>();
|
||||
|
||||
// Apply all patch operations individually
|
||||
for (APIPatch<String> patch : patches) {
|
||||
|
||||
String path = patch.getPath();
|
||||
|
||||
// Create connection permission if path has connection prefix
|
||||
if (path.startsWith(CONNECTION_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(CONNECTION_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), connectionPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create connection group permission if path has connection group prefix
|
||||
else if (path.startsWith(CONNECTION_GROUP_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(CONNECTION_GROUP_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), connectionGroupPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create active connection permission if path has active connection prefix
|
||||
else if (path.startsWith(ACTIVE_CONNECTION_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(ACTIVE_CONNECTION_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), activeConnectionPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create user permission if path has user prefix
|
||||
else if (path.startsWith(USER_PERMISSION_PATCH_PATH_PREFIX)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
String identifier = path.substring(USER_PERMISSION_PATCH_PATH_PREFIX.length());
|
||||
ObjectPermission.Type type = ObjectPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
ObjectPermission permission = new ObjectPermission(type, identifier);
|
||||
updatePermissionSet(patch.getOp(), userPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Create system permission if path is system path
|
||||
else if (path.equals(SYSTEM_PERMISSION_PATCH_PATH)) {
|
||||
|
||||
// Get identifier and type from patch operation
|
||||
SystemPermission.Type type = SystemPermission.Type.valueOf(patch.getValue());
|
||||
|
||||
// Create and update corresponding permission
|
||||
SystemPermission permission = new SystemPermission(type);
|
||||
updatePermissionSet(patch.getOp(), systemPermissionPatch, permission);
|
||||
|
||||
}
|
||||
|
||||
// Otherwise, the path is not supported
|
||||
else
|
||||
throw new GuacamoleClientException("Unsupported patch path: \"" + path + "\"");
|
||||
|
||||
} // end for each patch operation
|
||||
|
||||
// Save the permission changes
|
||||
connectionPermissionPatch.apply(user.getConnectionPermissions());
|
||||
connectionGroupPermissionPatch.apply(user.getConnectionGroupPermissions());
|
||||
activeConnectionPermissionPatch.apply(user.getActiveConnectionPermissions());
|
||||
userPermissionPatch.apply(user.getUserPermissions());
|
||||
systemPermissionPatch.apply(user.getSystemPermissions());
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -50,9 +50,10 @@ angular.module('rest').factory('userService', ['$injector',
|
||||
* If null, no filtering will be performed. Valid values are listed
|
||||
* within PermissionSet.ObjectType.
|
||||
*
|
||||
* @returns {Promise.<User[]>}
|
||||
* A promise which will resolve with an array of @link{User} objects
|
||||
* upon success.
|
||||
* @returns {Promise.<Object.<String, User>>}
|
||||
* A promise which will resolve with a map of @link{User} objects
|
||||
* where each key is the identifier (username) of the corresponding
|
||||
* user.
|
||||
*/
|
||||
service.getUsers = function getUsers(dataSource, permissionTypes) {
|
||||
|
||||
|
||||
@@ -227,14 +227,14 @@ angular.module('settings').directive('guacSettingsUsers', [function guacSettings
|
||||
PermissionSet.ObjectPermissionType.DELETE
|
||||
]);
|
||||
|
||||
userPromise.then(function usersReceived(userArrays) {
|
||||
userPromise.then(function usersReceived(allUsers) {
|
||||
|
||||
var addedUsers = {};
|
||||
$scope.manageableUsers = [];
|
||||
|
||||
// For each user in each data source
|
||||
angular.forEach(dataSources, function addUserList(dataSource) {
|
||||
angular.forEach(userArrays[dataSource], function addUser(user) {
|
||||
angular.forEach(allUsers[dataSource], function addUser(user) {
|
||||
|
||||
// Do not add the same user twice
|
||||
if (addedUsers[user.username])
|
||||
|
||||
Reference in New Issue
Block a user