diff --git a/.java-version b/.java-version new file mode 100644 index 0000000..d80b188 --- /dev/null +++ b/.java-version @@ -0,0 +1 @@ +1.8.0.301 diff --git a/pom.xml b/pom.xml index 6f099d3..3c88c0f 100644 --- a/pom.xml +++ b/pom.xml @@ -3,31 +3,33 @@ org.fcrepo fcrepo-parent - 4.7.5 + 4.7.6-umd-1.0 edu.umd.lib umd-fcrepo-webapp UMD Fedora Repository Deployable Web Application The Fedora web application - 2.7.3 + 2.8.0 war - - - 5.15.16 + 4.7.6-umd-1.0 + ${project.artifactId}-${project.version} + 1.7 - 4.7.5-umd-1.1 - 1.1.7 - 9.4.1211 - 4.3.20.RELEASE - 4.2.19.RELEASE - 2.24 3.6.0 - ${project.artifactId}-${project.version} + 3.1.0 + 2.25.1 + 1.2 4.13.1 0.11.2 + 1.2.4 + 1.2.3 + 9.4.1211 + 5.3.16 + 5.8.8 + 1.0.0 @@ -68,6 +70,19 @@ + + + + + org.springframework + spring-framework-bom + ${spring.version} + pom + import + + + + ch.qos.logback @@ -99,6 +114,11 @@ fcrepo-module-auth-webac ${fcrepo.version} + + edu.umd.lib + umd-fcrepo-auth-utils + ${umd.fcrepo.auth.utils.version} + org.glassfish.jersey.ext jersey-spring3 @@ -114,12 +134,10 @@ org.springframework spring-core - ${spring.version} org.springframework spring-web - ${spring.version} org.springframework.security @@ -134,15 +152,15 @@ javax.servlet javax.servlet-api - 3.1.0 + ${javax.servlet.version} compile - org.ldaptive - ldaptive - 1.2.4 + org.ldaptive + ldaptive + ${ldaptive.version} - + commons-validator commons-validator @@ -175,52 +193,13 @@ runtime --> - jstl jstl - 1.2 - - - - - - org.apache.activemq - activemq-spring - ${activemq.version} - - - commons-logging - commons-logging - - - - - - org.apache.activemq - activemq-kahadb-store - ${activemq.version} - - - commons-logging - commons-logging - - - - - - org.apache.activemq - activemq-stomp - ${activemq.version} - - - commons-logging - commons-logging - - + ${jstl.version} - + junit junit @@ -240,6 +219,7 @@ + org.apache.maven.plugins maven-war-plugin 3.0.0 diff --git a/src/main/java/edu/umd/lib/fcrepo/AuthTokenService.java b/src/main/java/edu/umd/lib/fcrepo/AuthTokenService.java deleted file mode 100644 index 79e7ade..0000000 --- a/src/main/java/edu/umd/lib/fcrepo/AuthTokenService.java +++ /dev/null @@ -1,48 +0,0 @@ -package edu.umd.lib.fcrepo; - -import io.jsonwebtoken.Jwts; -import io.jsonwebtoken.SignatureAlgorithm; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -import javax.crypto.spec.SecretKeySpec; -import java.security.Key; -import java.util.Base64; -import java.util.Date; - -import static java.time.Instant.now; - -public class AuthTokenService { - private static final Logger logger = LoggerFactory.getLogger(AuthTokenService.class); - - private String secret; - - public AuthTokenService() {} - - public String getSecret() { - return secret; - } - - public void setSecret(String secret) { - this.secret = secret; - } - - public Key getSecretKey() { - return new SecretKeySpec(Base64.getDecoder().decode(secret), SignatureAlgorithm.HS256.getJcaName()); - } - - public String createToken(final String subject, final String issuer, final Date expirationDate, final String role) { - logger.info("Creating token with subject: {}", subject); - logger.info("Issuer: {}", issuer); - logger.info("Expiration date: {}", expirationDate); - logger.info("Role: {}", role); - - return Jwts.builder() - .setSubject(subject) - .setIssuer(issuer) - .setExpiration(expirationDate) - .claim("role", role) - .signWith(getSecretKey()) - .compact(); - } -} diff --git a/src/main/java/edu/umd/lib/fcrepo/LdapRoleLookupService.java b/src/main/java/edu/umd/lib/fcrepo/LdapRoleLookupService.java deleted file mode 100644 index cd144e5..0000000 --- a/src/main/java/edu/umd/lib/fcrepo/LdapRoleLookupService.java +++ /dev/null @@ -1,183 +0,0 @@ -package edu.umd.lib.fcrepo; - -import org.ldaptive.BindConnectionInitializer; -import org.ldaptive.ConnectionConfig; -import org.ldaptive.ConnectionFactory; -import org.ldaptive.Credential; -import org.ldaptive.DefaultConnectionFactory; -import org.ldaptive.LdapAttribute; -import org.ldaptive.LdapEntry; -import org.ldaptive.LdapException; -import org.ldaptive.SearchExecutor; -import org.ldaptive.SearchResult; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -import javax.annotation.PostConstruct; -import java.util.Collection; -import java.util.Collections; -import java.util.stream.Collectors; - -public class LdapRoleLookupService { - private static final Logger logger = LoggerFactory.getLogger(LdapRoleLookupService.class); - - public static final String ADMIN_ROLE = "fedoraAdmin"; - - public static final String USER_ROLE = "fedoraUser"; - - private ConnectionFactory connectionFactory; - - private String ldapURL; - - private String bindDN; - - private String bindPassword; - - private String baseDN; - - private String memberAttribute; - - private String adminGroup; - - private String userGroup; - - private SearchExecutor searchExecutor; - - public LdapRoleLookupService() {} - - @PostConstruct - public void initialize() { - final ConnectionConfig connectionConfig = new ConnectionConfig(ldapURL); - connectionConfig.setUseStartTLS(true); - connectionConfig.setConnectionInitializer(new BindConnectionInitializer(bindDN, new Credential(bindPassword))); - connectionFactory = new DefaultConnectionFactory(connectionConfig); - searchExecutor = new SearchExecutor(); - searchExecutor.setBaseDn(baseDN); - - logger.info("Configured LDAP for user role lookup"); - logger.info("LDAP URL: {} Base DN: {} Bind DN: {}", ldapURL, baseDN, bindDN); - logger.debug("Group {} => Role {}", adminGroup, ADMIN_ROLE); - logger.debug("Group {} => Role {}", userGroup, USER_ROLE); - } - - /** - * Look up the given userName in the configured LDAP directory, and return the - * matching entry (if found). - * - * @param userName this should match a single uid in the directory - * @return matching entry or null - */ - public LdapEntry getUserEntry(final String userName) { - try { - final String uidFilter = "uid=" + userName; - final SearchResult result = searchExecutor.search(connectionFactory, uidFilter, memberAttribute).getResult(); - return result.getEntry(); - } catch (LdapException e) { - logger.error("LDAP Exception: " + e); - e.printStackTrace(); - return null; - } - } - - /** - * If the userEntry is a member of either the admin group or the user group, - * return the appropriate role string ("fedoraAdmin" or "fedoraUser", respectively). - * If the userEntry is null, or has neither membership relation, return null. - * The checks for membership are done case-insensitively. - * - * @param userEntry LDAP entry for a user - * @return role name string: "fedoraAdmin", "fedoraUser", or null - */ - public String getRole(final LdapEntry userEntry) { - final Collection memberships = getMemberships(userEntry).stream().map(String::toLowerCase).collect(Collectors.toSet()); - if (memberships.contains(adminGroup.toLowerCase())) { - return ADMIN_ROLE; - } else if (memberships.contains(userGroup.toLowerCase())){ - return USER_ROLE; - } - return null; - } - - public String getRole(final String userName) { - return getRole(getUserEntry(userName)); - } - - /** - * Get the set of values in the memberAttribute of the given userEntry, - * or the empty set if the userEntry is null. - * - * @param userEntry LDAP entry for a user - * @return collection of strings, or the empty set - */ - public Collection getMemberships(final LdapEntry userEntry) { - if (userEntry == null) { - return Collections.emptySet(); - } - final LdapAttribute memberOfAttr = userEntry.getAttribute(memberAttribute); - return memberOfAttr.getStringValues(); - } - - public String getLdapURL() { - return ldapURL; - } - - public void setLdapURL(String ldapURL) { - this.ldapURL = ldapURL; - } - - public String getBindDN() { - return bindDN; - } - - public void setBindDN(String bindDN) { - this.bindDN = bindDN; - } - - public String getBindPassword() { - return bindPassword; - } - - public void setBindPassword(String bindPassword) { - this.bindPassword = bindPassword; - } - - public String getBaseDN() { - return baseDN; - } - - public void setBaseDN(String baseDN) { - this.baseDN = baseDN; - } - - public String getMemberAttribute() { - return memberAttribute; - } - - public void setMemberAttribute(String memberAttribute) { - this.memberAttribute = memberAttribute; - } - - public String getAdminGroup() { - return adminGroup; - } - - public void setAdminGroup(String adminGroup) { - this.adminGroup = adminGroup; - } - - public String getUserGroup() { - return userGroup; - } - - public void setUserGroup(String userGroup) { - this.userGroup = userGroup; - } - - public SearchExecutor getSearchExecutor() { - return searchExecutor; - } - - public void setSearchExecutor(SearchExecutor searchExecutor) { - this.searchExecutor = searchExecutor; - } -} diff --git a/src/test/java/edu/umd/lib/fcrepo/LdapRoleLookupServiceTest.java b/src/test/java/edu/umd/lib/fcrepo/LdapRoleLookupServiceTest.java deleted file mode 100644 index 96a0319..0000000 --- a/src/test/java/edu/umd/lib/fcrepo/LdapRoleLookupServiceTest.java +++ /dev/null @@ -1,66 +0,0 @@ -package edu.umd.lib.fcrepo; - -import org.junit.Before; -import org.junit.Test; -import org.ldaptive.LdapAttribute; -import org.ldaptive.LdapEntry; - -import java.util.ArrayList; -import java.util.Arrays; -import java.util.Collection; -import java.util.Collections; - -import static org.junit.Assert.*; - -public class LdapRoleLookupServiceTest { - private LdapRoleLookupService ldapService = null; - - @Before - public void setUp() { - ldapService = new LdapRoleLookupService(); - ldapService.setMemberAttribute("memberOf"); - ldapService.setAdminGroup("ADMIN"); - ldapService.setUserGroup("USER"); - } - - @Test - public void testGetMembershipsNullUserEntry() { - final Collection memberships = ldapService.getMemberships(null); - assertTrue(memberships.isEmpty()); - } - - @Test - public void testGetMembershipsAdmin() { - final LdapEntry userEntry = new LdapEntry(); - userEntry.addAttribute(new LdapAttribute("memberOf", "ADMIN", "other")); - assertEquals(LdapRoleLookupService.ADMIN_ROLE, ldapService.getRole(userEntry)); - } - - @Test - public void testGetMembershipsUser() { - final LdapEntry userEntry = new LdapEntry(); - userEntry.addAttribute(new LdapAttribute("memberOf", "USER", "other")); - assertEquals(LdapRoleLookupService.USER_ROLE, ldapService.getRole(userEntry)); - } - - @Test - public void testGetMembershipsAdminCaseInsensitive() { - final LdapEntry userEntry = new LdapEntry(); - userEntry.addAttribute(new LdapAttribute("memberOf", "admin", "other")); - assertEquals(LdapRoleLookupService.ADMIN_ROLE, ldapService.getRole(userEntry)); - } - - @Test - public void testGetMembershipsUserCaseInsensitive() { - final LdapEntry userEntry = new LdapEntry(); - userEntry.addAttribute(new LdapAttribute("memberOf", "user", "other")); - assertEquals(LdapRoleLookupService.USER_ROLE, ldapService.getRole(userEntry)); - } - - @Test - public void testGetMembershipsNone() { - final LdapEntry userEntry = new LdapEntry(); - userEntry.addAttribute(new LdapAttribute("memberOf", "some", "other")); - assertNull(ldapService.getRole(userEntry)); - } -}