Module: OpenTox::Authorization

Defined in:
lib/authorization.rb

Overview

Module for Authorization and Authentication

Examples:

Authentication

require "opentox-ruby-api-wrapper" 
OpenTox::Authorization::AA_SERVER = "https://opensso.in-silico.ch" #if not set in .opentox/conf/[environment].yaml 
token = OpenTox::Authorization.authenticate("benutzer", "passwort")

See Also:

Defined Under Namespace

Classes: AA

Class Method Summary collapse

Class Method Details

.authenticate(user, pw) ⇒ String?

Authentication against OpenSSO. Returns token. Requires Username and Password.



60
61
62
63
64
65
66
67
68
69
 
# File 'lib/authorization.rb', line 60

def self.authenticate(user, pw)
  return nil if !AA_SERVER
  begin 
    resource = RestClient::Resource.new("#{AA_SERVER}/auth/authenticate")
    out = resource.post(:username=>user, :password => pw).sub("token.id=","").sub("\n","")
    return out
  rescue
    return nil
  end
end

.authorize(uri, action, subjectid) ⇒ Boolean?

Authorization against OpenSSO for a URI with request-method (action) [GET/POST/PUT/DELETE]



87
88
89
90
91
92
93
94
95
 
# File 'lib/authorization.rb', line 87

def self.authorize(uri, action, subjectid)
  return true if !AA_SERVER
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/auth/authorize")
    return true if resource.post(:uri => uri, :action => action, :subjectid => subjectid) == "boolean=true\n"
  rescue
    return nil
  end    
end

.authorized?(uri, request_method, subjectid) ⇒ Boolean

Check Authorization for a resource (identified via URI) with method and subjectid.



328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
 
# File 'lib/authorization.rb', line 328

def self.authorized?(uri, request_method, subjectid)
  if CONFIG[:authorization][:free_request].include?(request_method)  
    #LOGGER.debug "authorized? >>true<< (request is free), method: #{request_method}, URI: #{uri}, subjectid: #{subjectid}"
    true
  elsif OpenTox::Authorization.free_uri?(uri, request_method)
    #LOGGER.debug "authorized? >>true<< (uris is free_uri), method: #{request_method}, URI: #{uri}, subjectid: #{subjectid}"
    true
  elsif CONFIG[:authorization][:authenticate_request].include?(request_method)
    ret = OpenTox::Authorization.is_token_valid(subjectid)
    LOGGER.debug "authorized? >>#{ret}<< (token is in/valid), method: #{request_method}, URI: #{uri}, subjectid: #{subjectid}" unless ret
    ret
  elsif OpenTox::Authorization.authorize_exception?(uri, request_method)
    ret = OpenTox::Authorization.is_token_valid(subjectid)
    LOGGER.debug "authorized? >>#{ret}<< (uris is authorize exception, token is in/valid), method: #{request_method}, URI: #{uri}, subjectid: #{subjectid}" unless ret
    ret
  elsif CONFIG[:authorization][:authorize_request].include?(request_method)
    ret = OpenTox::Authorization.authorize(uri, request_method, subjectid)
    LOGGER.debug "authorized? >>#{ret}<< (uri (not) authorized), method: #{request_method}, URI: #{uri}, subjectid: #{subjectid}" unless ret
    ret
  else 
    LOGGER.error "invalid request/uri method: #{request_method}, URI: #{uri}, subjectid: #{subjectid}"
    false
  end
end

.check_policy(uri, subjectid) ⇒ Boolean

Checks (if subjectid is valid) if a policy exist and create default policy if not



293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
 
# File 'lib/authorization.rb', line 293

def self.check_policy(uri, subjectid)
  return true unless uri and subjectid
  token_valid = OpenTox::Authorization.is_token_valid(subjectid)      
  LOGGER.debug "OpenTox::Authorization.check_policy with uri: #{uri}, subjectid: #{subjectid} is valid: #{token_valid}"
  # check if subjectid is valid
  unless token_valid
    # abort if invalid
    LOGGER.error "OpenTox::Authorization.check_policy, subjectid NOT valid: #{subjectid}" 
    return false
  end
  
  if !uri_has_policy(uri, subjectid)
    # if no policy exists, create a policy, return result of send policy
    send_policy(uri, subjectid)
  else
    # if policy exists check for POST rights 
    if authorize(uri, "POST", subjectid)
      true
   else
      LOGGER.error "OpenTox::Authorization.check_policy, already exists, but no POST-authorization with subjectid: #{subjectid}" 
      false
    end
  end
  true
end

.create_policy(policy, subjectid) ⇒ Object

Sends a policy in xml-format to opensso server. Requires policy-xml and token. return [Boolean] returns true if policy is created



193
194
195
196
197
198
199
200
201
 
# File 'lib/authorization.rb', line 193

def self.create_policy(policy, subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/Pol/opensso-pol")
    LOGGER.debug "OpenTox::Authorization.create_policy policy: #{policy[168,43]} with token:" + subjectid.to_s + " length: " + subjectid.length.to_s 
    return true if resource.post(policy, :subjectid => subjectid, :content_type =>  "application/xml")
  rescue
    return false
  end
end

.delete_policies_from_uri(uri, subjectid) ⇒ Boolean

Deletes all policies of an URI



280
281
282
283
284
285
286
287
 
# File 'lib/authorization.rb', line 280

def self.delete_policies_from_uri(uri, subjectid)
  policies = list_uri_policies(uri, subjectid)
  policies.each do |policy|
    ret = delete_policy(policy, subjectid)
    LOGGER.debug "OpenTox::Authorization delete policy: #{policy} - with result: #{ret}"
  end    
  return true
end

.delete_policy(policy, subjectid) ⇒ Boolean?

Deletes a policy



206
207
208
209
210
211
212
213
214
 
# File 'lib/authorization.rb', line 206

def self.delete_policy(policy, subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/pol")
    LOGGER.debug "OpenTox::Authorization.delete_policy policy: #{policy} with token: #{subjectid}"
    return true if resource.delete(:subjectid => subjectid, :id => policy)        
  rescue
    return nil
  end
end

.get_uri_owner(uri, subjectid) ⇒ Object

Returns the owner (who created the first policy) of an URI return [String, nil]owner,nil returns owner of the URI



154
155
156
157
158
159
160
161
 
# File 'lib/authorization.rb', line 154

def self.get_uri_owner(uri, subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/pol")
    return resource.get(:uri => uri, :subjectid => subjectid).sub("\n","")
  rescue
    return nil
  end      
end

.get_user(subjectid) ⇒ String

Returns the owner (user id) of a token



249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
 
# File 'lib/authorization.rb', line 249

def self.get_user(subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/opensso/identity/attributes")
    out = resource.post(:subjectid => subjectid, :attributes_names => "uid")
    user = ""; check = false
    out.split("\n").each do |line|
      if check
        user = line.sub("userdetails.attribute.value=","") if line.include?("userdetails.attribute.value=")
        check = false
      end
      check = true if line.include?("userdetails.attribute.name=uid") 
    end
    return user
  rescue
    nil
  end
end

.is_token_valid(subjectid) ⇒ Boolean Also known as: token_valid?

Checks if a token is a valid token



100
101
102
103
104
105
106
107
108
 
# File 'lib/authorization.rb', line 100

def self.is_token_valid(subjectid)
  return true if !AA_SERVER
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/auth/isTokenValid")
    return true if resource.post(:tokenid => subjectid) == "boolean=true\n"
  rescue
    return false
  end
end

.list_groups(subjectid) ⇒ Array

Returns array of all possible LDAP-Groups



219
220
221
222
223
224
225
226
227
 
# File 'lib/authorization.rb', line 219

def self.list_groups(subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/opensso/identity/search")
    grps = resource.post(:admin => subjectid, :attributes_names => "objecttype", :attributes_values_objecttype => "group")
    grps.split("\n").collect{|x|  x.sub("string=","")}
  rescue
    []
  end
end

.list_policies(subjectid) ⇒ Array?

Returns array with all policies of the token owner



113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/authorization.rb', line 113

def self.list_policies(subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/pol")
    out = resource.get(:subjectid => subjectid)
    return out.split("\n")
  rescue RestClient::InternalServerError => e
    raise e.response  
  rescue
    return nil
  end
end

.list_policy(policy, subjectid) ⇒ String

Returns a policy in xml-format



128
129
130
131
132
133
134
135
 
# File 'lib/authorization.rb', line 128

def self.list_policy(policy, subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/pol")
    return resource.get(:subjectid => subjectid,:id => policy)
  rescue
    return nil
  end
end

.list_policy_uris(subjectid) ⇒ Hash

Lists policies alongside with affected uris



140
141
142
143
144
145
146
147
148
149
 
# File 'lib/authorization.rb', line 140

def self.list_policy_uris( subjectid )
  names = list_policies(subjectid)
  policies = {}
  names.each do |n|
    p = OpenTox::Policies.new
    p.load_xml( list_policy(n, subjectid) )
    policies[n] = p.uris
  end
  policies
end

.list_uri_policies(uri, subjectid) ⇒ Object

List all policynames for a URI. Requires URI and token. return [Array, nil] returns an Array of policy names or nil if request fails



175
176
177
178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/authorization.rb', line 175

def self.list_uri_policies(uri, subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/pol")
    out = resource.get(:uri => uri, :polnames => true, :subjectid => subjectid)        
    policies = []; notfirstline = false
    out.split("\n").each do |line|
      policies << line if notfirstline
      notfirstline = true    
    end
    return policies 
  rescue
    return nil
  end      
end

.list_user_groups(user, subjectid) ⇒ Array

Returns array of the LDAP-Groups of an user



232
233
234
235
236
237
238
239
240
241
242
243
244
 
# File 'lib/authorization.rb', line 232

def self.list_user_groups(user, subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/opensso/identity/read")
    out = resource.post(:name => user, :admin => subjectid, :attributes_names => "group")
    grps = []
    out.split("\n").each do |line|
      grps << line.sub("identitydetails.group=","") if line.include?("identitydetails.group=")    
    end
    return grps
  rescue
    []
  end
end

.logout(subjectid) ⇒ Boolean

Logout on opensso. Make token invalid. Requires token



74
75
76
77
78
79
80
81
82
 
# File 'lib/authorization.rb', line 74

def self.logout(subjectid)
  begin
    resource = RestClient::Resource.new("#{AA_SERVER}/auth/logout")
    resource.post(:subjectid => subjectid)
    return true 
  rescue
    return false
  end
end

.send_policy(uri, subjectid) ⇒ Object

Send default policy with Authorization::AA class



269
270
271
272
273
274
275
 
# File 'lib/authorization.rb', line 269

def self.send_policy(uri, subjectid)
  return true if !AA_SERVER
  aa  = Authorization::AA.new(subjectid)
  ret = aa.send(uri)
  LOGGER.debug "OpenTox::Authorization send policy for URI: #{uri} | subjectid: #{subjectid} - policy created: #{ret}"
  ret
end

.server ⇒ String?

Returns the open-sso server set in the config file .opentox/config/.yaml



53
54
55
 
# File 'lib/authorization.rb', line 53

def self.server
  return AA_SERVER
end

.uri_has_policy(uri, subjectid) ⇒ Object

Checks if a policy exists to a URI. Requires URI and token. return [Boolean]



166
167
168
169
170
 
# File 'lib/authorization.rb', line 166

def self.uri_has_policy(uri, subjectid)
  owner = get_uri_owner(uri, subjectid)
  return true if owner and owner != "null"
  false
end