com.sibvisions.rad.server.security
Class DBSecurityManager

java.lang.Object
  com.sibvisions.rad.server.security.AbstractSecurityManager
      com.sibvisions.rad.server.security.AbstractDBSecurityManager
          com.sibvisions.rad.server.security.DBSecurityManager

All Implemented Interfaces:

ISecurityManager, IPasswordValidator

Direct Known Subclasses:

NtlmDBSecurityManager

public class DBSecurityManager
extends AbstractDBSecurityManager

The DBSecurityManager uses a database to validate/authenticate users. It requires the following information to establish a database connection:

• driver (jdbc driver classname)
• url (jdbc connect url)
• username (database username)
• database (database password)

To use automatic login the session property: IConnectionConstants.PREFIX_CLIENT + "login.auto" should be set to true when the user logs on. After a successful logon the property: IConnectionConstants.PREFIX_CLIENT + "login.key" will be set to a unique login key. The client should store the key in its local registry. When the property IConnectionConstants.PREFIX_CLIENT + "login.key" is set before opening the connection, then the user will be logged in if the login is possible!

Field Summary

protected static java.lang.String	TABLE_AUTOLOGIN the name of the autologin table.
protected static java.lang.String	TABLE_USERS the name of the users table.
protected static java.lang.String	VIEW_ACCESSRULES the name of the accessrules table.

Constructor Summary

DBSecurityManager()

Method Summary

void	changePassword(ISession pSession) Changes the password for a user.
protected void	closeStatements() Close all registered statements.
IAccessController	getAccessController(ISession pSession) Gets the access controller for a session.
protected java.lang.String	getAliveQuery() Gets the query which should be use for connection check.
static java.lang.String	getSimpleEnvironmentName(ISession pSession) Gets the name of the environment from the given session, without additional information.
protected void	initStatements(java.sql.Connection pConnection) Initializes all statements after opening a database connection.
protected boolean	isActive(ISession pSession, java.lang.String pActive) Checks if a user is active.
protected boolean	isChangePassword(ISession pSession, java.lang.String pChangePassword) Checks if the change password flag is set.
protected boolean	isPasswordValid(ISession pSession, java.lang.String pPassword) Checks if the user password is valid.
protected boolean	isValid(ISession pSession, java.sql.Timestamp pFrom, java.sql.Timestamp pTo) Checks if a user is valid.
void	logout(ISession pSession) Performs a manual or automatic logout.
protected void	postAuthentication(ISession pSession, java.math.BigDecimal pUserId) Allows additional checks after user was validated.
protected void	preAuthentication(ISession pSession) Allows additional checks before user will be validated.
protected void	updateConfiguration(IConfiguration pConfig) Updates relevant information after configuration was changed.
void	validateAuthentication(ISession pSession) Validates if a session has valid credentials to access an application.

Methods inherited from class com.sibvisions.rad.server.security.AbstractDBSecurityManager

close, closeConnection, createAccessController, finalize, getConnection, getConnection, getCredentials, getCredentials, isConnectionAlive, openConnection, prepareCall, prepareStatement, register, release, unregister

Methods inherited from class com.sibvisions.rad.server.security.AbstractSecurityManager

addHiddenPackage, checkPassword, comparePassword, createSecurityManager, createSecurityManager, createSecurityManager, debug, error, getEncryptedPassword, getPasswordValidator, info, isAllowEncryptedUserPassword, isHiddenPackage, isPasswordEncrypted, isPasswordEncryptionEnabled, prepareException, prepareException, removeHiddenPackage, setAllowEncryptedUserPassword, validatePassword

Methods inherited from class java.lang.Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

TABLE_USERS

protected static final java.lang.String TABLE_USERS

the name of the users table.

See Also:

Constant Field Values

TABLE_AUTOLOGIN

protected static final java.lang.String TABLE_AUTOLOGIN

the name of the autologin table.

See Also:

Constant Field Values

VIEW_ACCESSRULES

protected static final java.lang.String VIEW_ACCESSRULES

the name of the accessrules table.

See Also:

Constant Field Values

Constructor Detail

DBSecurityManager

public DBSecurityManager()

Method Detail

validateAuthentication

public void validateAuthentication(ISession pSession)
                            throws java.lang.Exception

Validates if a session has valid credentials to access an application.

Parameters:

pSession - the session which needs access

Throws:

java.lang.Exception - if the access is denied (invalid username or password, password needs to be changed, ...)

changePassword

public void changePassword(ISession pSession)
                    throws java.lang.Exception

Changes the password for a user.

Parameters:

pSession - the session which wants to change the password

Throws:

java.lang.Exception - if it's not possible to change the password

logout

public void logout(ISession pSession)

Performs a manual or automatic logout.

Parameters:

pSession - the session which performs the logout

getAccessController

public IAccessController getAccessController(ISession pSession)
                                      throws java.lang.Exception

Gets the access controller for a session. The controller handles the access to server side objects.

Parameters:

pSession - the session for which the access controller is needed

Returns:

the access controller or null if no access controller should be used

Throws:

java.lang.Exception - if the access controller could not be created

updateConfiguration

protected void updateConfiguration(IConfiguration pConfig)
                            throws java.lang.Exception

Updates relevant information after configuration was changed.

Specified by:

updateConfiguration in class AbstractDBSecurityManager

Parameters:

pConfig - the session configuration

Throws:

java.lang.Exception - if an exception occurs during statement creation

closeStatements

protected void closeStatements()

Close all registered statements.

Overrides:

closeStatements in class AbstractDBSecurityManager

initStatements

protected void initStatements(java.sql.Connection pConnection)
                       throws java.lang.Exception

Initializes all statements after opening a database connection.

Specified by:

initStatements in class AbstractDBSecurityManager

Parameters:

pConnection - the connection to use

Throws:

java.lang.Exception - if an exception occurs during statement creation

getAliveQuery

protected java.lang.String getAliveQuery()

Gets the query which should be use for connection check. A simple query like select 1 from dual is enough.

Specified by:

getAliveQuery in class AbstractDBSecurityManager

Returns:

the alive check query

isActive

protected boolean isActive(ISession pSession,
                           java.lang.String pActive)
                    throws java.lang.Exception

Checks if a user is active.

Parameters:

pSession - the session which needs access

pActive - the active flag or null if the flag is not available

Returns:

true if the active flag is missing or the flag equals the yes value

Throws:

java.lang.Exception - if the configuration of the session is invalid

isValid

protected boolean isValid(ISession pSession,
                          java.sql.Timestamp pFrom,
                          java.sql.Timestamp pTo)

Checks if a user is valid.

Parameters:

pSession - the session which needs access

pFrom - the from date/time or null for undefined

pTo - the to date/time or null for undefined

Returns:

true if the from/to combination is possible, false otherwise

isPasswordValid

protected boolean isPasswordValid(ISession pSession,
                                  java.lang.String pPassword)
                           throws java.lang.Exception

Checks if the user password is valid.

Parameters:

pSession - the session which needs access

pPassword - the confirmation password (encrypted or plain text)

Returns:

true if the user password is valid

Throws:

java.lang.Exception - if the password validation failed (e.g. encryption problems)

isChangePassword

protected boolean isChangePassword(ISession pSession,
                                   java.lang.String pChangePassword)
                            throws java.lang.Exception

Checks if the change password flag is set.

Parameters:

pSession - the session which needs access

pChangePassword - the change password flag or null if the flag is not available

Returns:

true if the change password flag is set or false if the flag is null or is not set

Throws:

java.lang.Exception - if the configuration of the session is invalid

preAuthentication

protected void preAuthentication(ISession pSession)
                          throws java.lang.Exception

Allows additional checks before user will be validated. The database connection is open if this method is called.

Parameters:

pSession - the session

Throws:

java.lang.Exception - if a pre authentication error occurs

java.lang.SecurityException - if authentication should fail

postAuthentication

protected void postAuthentication(ISession pSession,
                                  java.math.BigDecimal pUserId)
                           throws java.lang.Exception

Allows additional checks after user was validated.

Parameters:

pSession - the session

pUserId - the user id

Throws:

java.lang.Exception - if a post authentication error occurs

java.lang.SecurityException - if authentication should fail

getSimpleEnvironmentName

public static java.lang.String getSimpleEnvironmentName(ISession pSession)

Gets the name of the environment from the given session, without additional information. Only the name part is important, e.g. NAME:PLATFORM -> NAME will be returned.

Parameters:

pSession - the session

Returns:

the environment name without additional information