dmlite  0.6
authn.h
Go to the documentation of this file.
1 /// @file include/dmlite/cpp/authn.h
2 /// @brief Authentication API. Any sort of security check is plugin-specific.
3 /// @author Alejandro Álvarez Ayllón <aalvarez@cern.ch>
4 #ifndef DMLITE_CPP_AUTHN_H
5 #define DMLITE_CPP_AUTHN_H
6 
7 #include "dmlite/common/config.h"
8 #include "base.h"
9 #include "exceptions.h"
10 #include "utils/extensible.h"
11 #include "utils/logger.h"
12 
13 #include <string>
14 #include <vector>
15 
16 namespace dmlite {
17 
18  // Forward declarations.
19  class PluginManager;
20  class StackInstance;
21 
22  /// Security credentials. To be filled by the front-end.
24  std::string mech;
25  std::string clientName;
26  std::string remoteAddress;
27  std::string sessionId;
28 
29  // These fields may come from openid-connect
30  std::string oidc_audience;
31  std::string oidc_issuer;
32  std::string oidc_scope;
33 
34  std::vector<std::string> fqans;
35 
36  bool operator == (const SecurityCredentials&) const;
37  bool operator != (const SecurityCredentials&) const;
38  bool operator < (const SecurityCredentials&) const;
39  bool operator > (const SecurityCredentials&) const;
40  };
41 
42  /// User information.
43  /// To be filled by the Authn plugin with whichever data
44  /// it is needed. (i.e. uid for LCGDM Adapter)
45  /// To be used by other plugins whenever they need it.
46  /// IMPORTANT: This means plugins must be compatible with the Authn
47  /// put in charge of security.
48  struct UserInfo: public Extensible {
49  std::string name;
50 
51  bool operator == (const UserInfo&) const;
52  bool operator != (const UserInfo&) const;
53  bool operator < (const UserInfo&) const;
54  bool operator > (const UserInfo&) const;
55  };
56 
57  /// Group information
58  /// See UserInfo
59  struct GroupInfo: public Extensible {
60  std::string name;
61 
62  bool operator == (const GroupInfo&) const;
63  bool operator != (const GroupInfo&) const;
64  bool operator < (const GroupInfo&) const;
65  bool operator > (const GroupInfo&) const;
66  };
67 
68 
69  /// Security context. To be created by the Authn.
70  struct SecurityContext {
72 
74  const UserInfo& u,
75  std::vector<GroupInfo>& g):
76  credentials(c), user(u), groups(g) {}
77 
79 
81  std::vector<GroupInfo> groups;
82 
83  const std::string prettystring() {
84  std::string r;
85  r += SSTR("user: " << user.name << "(" << user.getLong("uid") << "," << user.getLong("banned", 0) << ") groups: '");
86  for (std::vector<GroupInfo>::iterator i = groups.begin(); i != groups.end(); i++) {
87  if (r.length()) r.append(",");
88 
89  r.append( SSTR( i->name << "(" << i->getLong("gid", -1) << "," << i->getLong("banned", 0) << ")") );
90 
91  }
92 
93  r += "'";
94  return r;
95  }
96 
97  // We store here a sort of little log of the authorization phase
98  // This is supposed to describe why a user has been denied access (or granted)
99  // And it's supposed to be easy to pass around.
100  std::string AuthNprocessing_msg;
101 
102 
103  void AuthNprocessing_append(const char *str) {
104  std::string s(str);
105 
106  if (AuthNprocessing_msg.length() > 0)
107  AuthNprocessing_msg.append(" - ");
108 
109  AuthNprocessing_msg += s;
110  };
111 
112 
113  bool operator == (const SecurityContext&) const;
114  bool operator != (const SecurityContext&) const;
115  bool operator < (const SecurityContext&) const;
116  bool operator > (const SecurityContext&) const;
117  };
118 
119 
120 
121  /// User and group handling.
122  ///@note This is the only interface not inheriting from BaseInterface.
123  class Authn {
124  public:
125  /// Destructor
126  virtual ~Authn();
127 
128  /// String ID of the user DB implementation.
129  virtual std::string getImplId(void) const throw() = 0;
130 
131  /// Create a security context from the credentials.
132  /// @param cred The security credentials.
133  /// @return A newly created SecurityContext.
135 
136  /// Create a default security context.
137  /// @return A newly created SecurityContext.
138  virtual SecurityContext* createSecurityContext(void) ;
139 
140  /// Create a new group.
141  /// @param groupName The group name.
142  /// @return The new group.
143  virtual GroupInfo newGroup(const std::string& groupName) ;
144 
145  /// Get a specific group.
146  /// @param groupName The group name.
147  /// @return The group.
148  virtual GroupInfo getGroup(const std::string& groupName) ;
149 
150  /// Get a specific group using an alternative key.
151  /// @param key The key name.
152  /// @param value They value to search for.
153  /// @return The group.
154  /// @note The implementation will throw an exception if the field
155  /// can not be used as key.
156  virtual GroupInfo getGroup(const std::string& key,
157  const boost::any& value) ;
158 
159  /// Get the group list.
160  virtual std::vector<GroupInfo> getGroups(void) ;
161 
162  /// Update group info. 'name' identify uniquely the group.
163  /// @param group The group metadata to update.
164  virtual void updateGroup(const GroupInfo& group) ;
165 
166  /// Delete a group.
167  virtual void deleteGroup(const std::string& groupName) ;
168 
169  /// Create a new user.
170  /// @param userName The user name.
171  /// @return The new user.
172  virtual UserInfo newUser(const std::string& userName) ;
173 
174  /// Get a specific user.
175  /// @param userName The user name.
176  /// @return The user.
177  virtual UserInfo getUser(const std::string& userName) ;
178 
179  /// Get a specific user using an alternative key.
180  /// @param key The key name.
181  /// @param value They value to search for.
182  /// @return The user.
183  /// @note The implementation will throw an exception if the field
184  /// can not be used as key.
185  virtual UserInfo getUser(const std::string& key,
186  const boost::any& value) ;
187 
188  /// Get the user list.
189  virtual std::vector<UserInfo> getUsers(void) ;
190 
191  /// Update user info. 'name' identify uniquely the user.
192  /// @param user The user metadata to update.
193  virtual void updateUser(const UserInfo& user) ;
194 
195  /// Delete a user.
196  virtual void deleteUser(const std::string& userName) ;
197 
198  /// Get the mapping of a user/group. Additionaly, new users and groups MAY
199  /// be created by the implementation.
200  /// @param userName The user name.
201  /// @param groupNames The different groups. Can be empty.
202  /// @param user Pointer to an UserInfo struct where to put the data.
203  /// @param groups Pointer to a vector where the group mapping will be put.
204  /// @note If groupNames is empty, grid mapfile will be used to retrieve the default group.
205  virtual void getIdMap(const std::string& userName,
206  const std::vector<std::string>& groupNames,
207  UserInfo* user,
208  std::vector<GroupInfo>* groups) ;
209  };
210 
211 
212  /// AuthnFactory
213  class AuthnFactory: public virtual BaseFactory {
214  public:
215  /// Destructor
216  virtual ~AuthnFactory();
217 
218  protected:
219  // Stack instance is allowed to instantiate Authn
220  friend class StackInstance;
221 
222  /// Children of AuthnFactory are allowed to instantiate too (decorator)
223  static Authn* createAuthn(AuthnFactory* factory,
224  PluginManager* pm) ;
225 
226  /// Instantiate a implementation of Authn
227  virtual Authn* createAuthn(PluginManager* pm) ;
228  };
229 
230 };
231 
232 #endif // DMLITE_CPP_AUTH_H
std::string remoteAddress
Definition: authn.h:26
virtual void updateUser(const UserInfo &user)
Definition: authn.h:48
bool operator<(const UserInfo &) const
bool operator<(const SecurityCredentials &) const
bool operator==(const UserInfo &) const
std::string name
Definition: authn.h:49
std::vector< std::string > fqans
Definition: authn.h:34
virtual GroupInfo getGroup(const std::string &groupName)
virtual std::string getImplId(void) const =0
String ID of the user DB implementation.
static Authn * createAuthn(AuthnFactory *factory, PluginManager *pm)
Children of AuthnFactory are allowed to instantiate too (decorator)
bool operator!=(const SecurityContext &) const
bool operator<(const SecurityContext &) const
std::string oidc_audience
Definition: authn.h:30
virtual ~AuthnFactory()
Destructor.
Definition: dmlite.h:161
bool operator!=(const SecurityCredentials &) const
SecurityContext()
Definition: authn.h:71
virtual void deleteGroup(const std::string &groupName)
Delete a group.
bool operator==(const SecurityCredentials &) const
Security context. To be created by the Authn.
Definition: authn.h:70
SecurityContext(const SecurityCredentials &c, const UserInfo &u, std::vector< GroupInfo > &g)
Definition: authn.h:73
std::string mech
Definition: authn.h:24
bool operator<(const GroupInfo &) const
CatalogInterface can only be instantiated through this class.
Definition: dmlite.h:42
bool operator>(const SecurityCredentials &) const
Definition: authn.h:123
std::string oidc_scope
Definition: authn.h:32
bool operator!=(const UserInfo &) const
bool operator==(const SecurityContext &) const
bool operator>(const GroupInfo &) const
virtual UserInfo getUser(const std::string &userName)
bool operator!=(const GroupInfo &) const
bool operator>(const UserInfo &) const
std::string oidc_issuer
Definition: authn.h:31
AuthnFactory.
Definition: authn.h:213
void AuthNprocessing_append(const char *str)
Definition: authn.h:103
virtual UserInfo newUser(const std::string &userName)
std::vector< GroupInfo > groups
Definition: authn.h:81
Exceptions used by the API.
UserInfo user
Definition: authn.h:80
Helpful typedef for KeyValue containers.
Definition: extensible.h:20
Base class for factories.
Definition: base.h:48
virtual ~Authn()
Destructor.
Definition: authn.h:59
std::string AuthNprocessing_msg
Definition: authn.h:100
bool operator==(const GroupInfo &) const
virtual void updateGroup(const GroupInfo &group)
SecurityCredentials credentials
Definition: authn.h:78
std::string clientName
Definition: authn.h:25
virtual void deleteUser(const std::string &userName)
Delete a user.
virtual std::vector< UserInfo > getUsers(void)
Get the user list.
Extensible types (hold metadata).
virtual std::vector< GroupInfo > getGroups(void)
Get the group list.
bool operator>(const SecurityContext &) const
Base interfaces.
std::string name
Definition: authn.h:60
virtual SecurityContext * createSecurityContext(void)
std::string sessionId
Definition: authn.h:27
long getLong(const std::string &key, long defaultValue=0) const
Gets an integer. May be able to perform some conversions.
Security credentials. To be filled by the front-end.
Definition: authn.h:23
const std::string prettystring()
Definition: authn.h:83
virtual GroupInfo newGroup(const std::string &groupName)
#define SSTR(message)
Definition: logger.h:51
virtual void getIdMap(const std::string &userName, const std::vector< std::string > &groupNames, UserInfo *user, std::vector< GroupInfo > *groups)