|
| 1 | +""" |
| 2 | +Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. |
| 3 | +Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl. |
| 4 | +""" |
| 5 | +from java.io import File |
| 6 | +from wlsdeploy.aliases.model_constants import APPEND |
| 7 | +from wlsdeploy.aliases.model_constants import EXPRESSION |
| 8 | +from wlsdeploy.aliases.model_constants import PREPEND |
| 9 | +from wlsdeploy.aliases.model_constants import REPLACE |
| 10 | +from wlsdeploy.aliases.model_constants import UPDATE_MODE |
| 11 | +from wlsdeploy.aliases.model_constants import WLS_ROLES |
| 12 | +from wlsdeploy.util import dictionary_utils |
| 13 | +from wlsdeploy.util import string_utils |
| 14 | +from wlsdeploy.util.weblogic_roles_helper import WebLogicRolesHelper |
| 15 | + |
| 16 | +WLS_GLOBAL_ROLES = { |
| 17 | + 'Admin': '?weblogic.entitlement.rules.AdministrativeGroup(Administrators)', |
| 18 | + 'Deployer': '?weblogic.entitlement.rules.AdministrativeGroup(Deployers)', |
| 19 | + 'Operator': '?weblogic.entitlement.rules.AdministrativeGroup(Operators)', |
| 20 | + 'Monitor': '?weblogic.entitlement.rules.AdministrativeGroup(Monitors)', |
| 21 | + 'Anonymous': 'Grp(everyone)', |
| 22 | + 'AppTester': '?weblogic.entitlement.rules.OwnerIDDGroup(AppTesters)', |
| 23 | + 'CrossDomainConnector': '?weblogic.entitlement.rules.OwnerIDDGroup(CrossDomainConnectors)', |
| 24 | + 'AdminChannelUser': '?weblogic.entitlement.rules.OwnerIDDGroup(AdminChannelUsers)' |
| 25 | +} |
| 26 | +WLS_ROLE_UPDATE_OPERAND = '|' |
| 27 | + |
| 28 | +class WLSRoles(object): |
| 29 | + """ |
| 30 | + Handle the WLSRoles section from the model domainInfo |
| 31 | + """ |
| 32 | + __class_name = 'WLSRoles' |
| 33 | + |
| 34 | + def __init__(self, domain_info, domain_home, wls_helper, exception_type, logger, validation_roles_map = None): |
| 35 | + self.logger = logger |
| 36 | + self._wls_helper = wls_helper |
| 37 | + self._wls_roles_map = None |
| 38 | + self._domain_security_folder = None |
| 39 | + self._validation_roles_map = validation_roles_map |
| 40 | + |
| 41 | + if domain_info is not None: |
| 42 | + if not dictionary_utils.is_empty_dictionary_element(domain_info, WLS_ROLES): |
| 43 | + self._wls_roles_map = domain_info[WLS_ROLES] |
| 44 | + self._domain_security_folder = File(domain_home, 'security').getPath() |
| 45 | + self._weblogic_roles_helper = WebLogicRolesHelper(logger, exception_type, self._domain_security_folder) |
| 46 | + return |
| 47 | + |
| 48 | + def process_roles(self): |
| 49 | + """ |
| 50 | + Process the WebLogic roles contained in the domainInfo section of the model when specified |
| 51 | + Support for the WebLogic roles handling is when using WebLogic Server 12.2.1 or greater |
| 52 | + """ |
| 53 | + _method_name = 'process_roles' |
| 54 | + self.logger.entering(self._domain_security_folder, self._wls_roles_map, class_name=self.__class_name, method_name=_method_name) |
| 55 | + if self._wls_roles_map is not None: |
| 56 | + # Process the WLSRoles section after checking for proper version support |
| 57 | + if self._wls_helper is not None and not self._wls_helper.is_weblogic_version_or_above('12.2.1'): |
| 58 | + self.logger.warning('WLSDPLY-12504', self._wls_helper.get_actual_weblogic_version(), class_name=self.__class_name, method_name=_method_name) |
| 59 | + else: |
| 60 | + role_expressions = self._process_roles_map(self._wls_roles_map, None) |
| 61 | + if role_expressions is not None and len(role_expressions) > 0: |
| 62 | + self.logger.info('WLSDPLY-12500', role_expressions.keys(), class_name=self.__class_name, method_name=_method_name) |
| 63 | + self._update_xacml_role_mapper(role_expressions) |
| 64 | + self.logger.exiting(class_name=self.__class_name, method_name=_method_name) |
| 65 | + return |
| 66 | + |
| 67 | + def validate_roles(self, validation_result): |
| 68 | + """ |
| 69 | + Validate WLSRoles section of the domainInfo independent of any domain home location |
| 70 | + """ |
| 71 | + _method_name = 'validate_roles' |
| 72 | + self.logger.entering(self._validation_roles_map, class_name=self.__class_name, method_name=_method_name) |
| 73 | + if self._validation_roles_map is not None and len(self._validation_roles_map) > 0: |
| 74 | + self._validate_update_mode(self._validation_roles_map, validation_result) |
| 75 | + self._process_roles_map(self._validation_roles_map, validation_result) |
| 76 | + self.logger.exiting(class_name=self.__class_name, method_name=_method_name) |
| 77 | + return validation_result |
| 78 | + |
| 79 | + def _process_roles_map(self, roles_map, validation_result): |
| 80 | + """ |
| 81 | + Loop through the WebLogic roles listed in the domainInfo and create a map of the role to the expression |
| 82 | + """ |
| 83 | + _method_name = '_process_roles_map' |
| 84 | + self.logger.entering(class_name=self.__class_name, method_name=_method_name) |
| 85 | + result = {} |
| 86 | + for role in roles_map.keys(): |
| 87 | + # Get the role expression and if the role should be an update to the default set of roles |
| 88 | + expression = self._get_role_expression(role, roles_map) |
| 89 | + if string_utils.is_empty(expression): |
| 90 | + self.logger.finer('WLSDPLY-12501', role, class_name=self.__class_name, method_name=_method_name) |
| 91 | + if validation_result is not None: |
| 92 | + validation_result.add_warning('WLSDPLY-12501', role) |
| 93 | + continue |
| 94 | + update_role = self._is_role_update_mode(role, roles_map) |
| 95 | + if update_role and role not in WLS_GLOBAL_ROLES: |
| 96 | + self.logger.finer('WLSDPLY-12502', role, class_name=self.__class_name, method_name=_method_name) |
| 97 | + if validation_result is not None: |
| 98 | + validation_result.add_warning('WLSDPLY-12502', role) |
| 99 | + update_role = False |
| 100 | + # Add the role and expression to the map of roles to be processed |
| 101 | + if update_role: |
| 102 | + expression = self._update_role_epression(role, expression, roles_map) |
| 103 | + result[role] = expression |
| 104 | + |
| 105 | + self.logger.exiting(class_name=self.__class_name, method_name=_method_name) |
| 106 | + return result |
| 107 | + |
| 108 | + def _update_xacml_role_mapper(self, role_expression_map): |
| 109 | + """ |
| 110 | + Update the XACML role mapper based on the supplied map of WebLogic roles with expressions |
| 111 | + """ |
| 112 | + _method_name = '_update_xacml_role_mapper' |
| 113 | + self.logger.entering(role_expression_map, class_name=self.__class_name, method_name=_method_name) |
| 114 | + self._weblogic_roles_helper.update_xacml_role_mapper(role_expression_map) |
| 115 | + self.logger.exiting(class_name=self.__class_name, method_name=_method_name) |
| 116 | + return |
| 117 | + |
| 118 | + def _get_role_expression(self, role_name, roles_map): |
| 119 | + """ |
| 120 | + Determine if the role has an expression defined in the model |
| 121 | + :return: the expression if the model value is present |
| 122 | + """ |
| 123 | + result = None |
| 124 | + role_map = roles_map[role_name] |
| 125 | + if EXPRESSION in role_map: |
| 126 | + result = role_map[EXPRESSION] |
| 127 | + return result |
| 128 | + |
| 129 | + def _is_role_update_mode(self, role_name, roles_map): |
| 130 | + """ |
| 131 | + Determine if the role update mode indicates that a role update is specified |
| 132 | + :return: True if the update mode value is present and set to append or prepend mode |
| 133 | + """ |
| 134 | + result = False |
| 135 | + role_map = roles_map[role_name] |
| 136 | + if UPDATE_MODE in role_map: |
| 137 | + mode = role_map[UPDATE_MODE] |
| 138 | + if not string_utils.is_empty(mode): |
| 139 | + mode = mode.lower() |
| 140 | + if APPEND == mode or PREPEND == mode: |
| 141 | + result = True |
| 142 | + return result |
| 143 | + |
| 144 | + def _update_role_epression(self, role_name, expression_value, roles_map): |
| 145 | + """ |
| 146 | + Lookup the default role definition and logically OR the expression |
| 147 | + Based on the update mode the expression is appended or prepended |
| 148 | + :return: the updated role expression |
| 149 | + """ |
| 150 | + result = expression_value |
| 151 | + role_map = roles_map[role_name] |
| 152 | + if UPDATE_MODE in role_map: |
| 153 | + mode = role_map[UPDATE_MODE] |
| 154 | + if not string_utils.is_empty(mode): |
| 155 | + mode = mode.lower() |
| 156 | + if APPEND == mode: |
| 157 | + result = WLS_GLOBAL_ROLES[role_name] + WLS_ROLE_UPDATE_OPERAND + expression_value |
| 158 | + elif PREPEND == mode: |
| 159 | + result = expression_value + WLS_ROLE_UPDATE_OPERAND + WLS_GLOBAL_ROLES[role_name] |
| 160 | + return result |
| 161 | + |
| 162 | + def _validate_update_mode(self, roles_map, validation_result): |
| 163 | + """ |
| 164 | + Check that the UpdateMode value of a role is one of append, prepend or replace |
| 165 | + Provide a warning for other values as these will be treated as the default of replace |
| 166 | + """ |
| 167 | + _method_name = '_validate_update_mode' |
| 168 | + self.logger.entering(class_name=self.__class_name, method_name=_method_name) |
| 169 | + |
| 170 | + for role_name in roles_map.keys(): |
| 171 | + role_map = roles_map[role_name] |
| 172 | + if UPDATE_MODE in role_map: |
| 173 | + mode = role_map[UPDATE_MODE] |
| 174 | + if not string_utils.is_empty(mode): |
| 175 | + mode = mode.lower() |
| 176 | + if APPEND == mode or PREPEND == mode or REPLACE == mode: |
| 177 | + continue |
| 178 | + self.logger.finer('WLSDPLY-12503', role_name, class_name=self.__class_name, method_name=_method_name) |
| 179 | + if validation_result is not None: |
| 180 | + validation_result.add_warning('WLSDPLY-12503', role_name) |
| 181 | + |
| 182 | + self.logger.exiting(class_name=self.__class_name, method_name=_method_name) |
| 183 | + return |
| 184 | + |
| 185 | +def validator(roles_map, logger): |
| 186 | + """ |
| 187 | + Obtain a WLSRoles helper only for the validation of the WLSRoles section |
| 188 | + """ |
| 189 | + return WLSRoles(None, None, None, None, logger, validation_roles_map = roles_map) |
0 commit comments