pegasus/src/Pegasus/Security/UserManager/AuthorizationHandler.cpp - diff

Return to AuthorizationHandler.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Security / UserManager

Diff for /pegasus/src/Pegasus/Security/UserManager/AuthorizationHandler.cpp between version 1.21 and 1.31

version 1.21, 2006/08/18 17:58:49

version 1.31, 2008/12/01 17:51:14

Line 1

//%2006////////////////////////////////////////////////////////////////////////

//%LICENSE////////////////////////////////////////////////////////////////

// Licensed to The Open Group (TOG) under one or more contributor license

// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.

// agreements. Refer to the OpenPegasusNOTICE.txt file distributed with

// this work for additional information regarding copyright ownership.

// IBM Corp.; EMC Corporation, The Open Group.

// Each contributor licenses this file to you under the OpenPegasus Open

// Source License; you may not use this file except in compliance with the

// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.

// License.

// EMC Corporation; VERITAS Software Corporation; The Open Group.

// Permission is hereby granted, free of charge, to any person obtaining a

// copy of this software and associated documentation files (the "Software"),

// EMC Corporation; Symantec Corporation; The Open Group.

// to deal in the Software without restriction, including without limitation

// the rights to use, copy, modify, merge, publish, distribute, sublicense,

// Permission is hereby granted, free of charge, to any person obtaining a copy

// and/or sell copies of the Software, and to permit persons to whom the

// of this software and associated documentation files (the "Software"), to

// Software is furnished to do so, subject to the following conditions:

// deal in the Software without restriction, including without limitation the

// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or

// The above copyright notice and this permission notice shall be included

// sell copies of the Software, and to permit persons to whom the Software is

// in all copies or substantial portions of the Software.

// furnished to do so, subject to the following conditions:

// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

// THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN

// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

// ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED

// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

// "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT

// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY

// LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT

// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION

// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

//////////////////////////////////////////////////////////////////////////

//==============================================================================

// Author: Sushma Fernandes (sushma_fernandes@hp.com)

// Modified By: Nag Boranna, Hewlett Packard Company (nagaraja_boranna@hp.com)

// Carol Ann Krug Graves, Hewlett-Packard Company

// (carolann_graves@hp.com)

// Josephine Eskaline Joyce, IBM (jojustin@in.ibm.com) for PEP#101

// David Dillard, VERITAS Software Corp.

// (david.dillard@veritas.com)

//%////////////////////////////////////////////////////////////////////////////

Line 55

Line 44

#include <Pegasus/Common/CIMInstance.h>

#include <Pegasus/Common/Constants.h>

#include <Pegasus/Common/XmlWriter.h>

#include <Pegasus/Common/CIMNameCast.h>

#ifdef PEGASUS_OS_PASE

# include <ILEWrapper/qumemultiutil.h>

# include <ILEWrapper/ILEUtilities2.h>

#endif

#include "AuthorizationHandler.h"

#include "UserExceptions.h"

#ifdef PEGASUS_OS_OS400

#include "qycmutiltyUtility.H"

#include "OS400ConvertChar.h"

#endif

PEGASUS_USING_STD;

PEGASUS_NAMESPACE_BEGIN

Line 72

Line 62

// This constant represents the User name property in the schema

static const CIMName PROPERTY_NAME_USERNAME = CIMName ("Username");

static const CIMName PROPERTY_NAME_USERNAME = CIMNameCast("Username");

// This constant represents the Namespace property in the schema

static const CIMName PROPERTY_NAME_NAMESPACE = CIMName ("Namespace");

static const CIMName PROPERTY_NAME_NAMESPACE = CIMNameCast("Namespace");

// This constant represents the Authorizations property in the schema

static const CIMName PROPERTY_NAME_AUTHORIZATION = CIMName ("Authorization");

static const CIMName PROPERTY_NAME_AUTHORIZATION = CIMNameCast("Authorization");

Line 97

Line 87

// List of read only CIM Operations

static const CIMName READ_OPERATIONS [] = {

static const CIMName READ_OPERATIONS [] =

{

CIMName ("GetClass"),

CIMName ("GetInstance"),

CIMName ("EnumerateClassNames"),

Line 111

Line 102

CIMName ("EnumerateClasses"),

CIMName ("EnumerateInstances"),

CIMName ("ExecQuery"),

CIMName ("GetProperty") };

CIMName("GetProperty")

};

// List of write CIM Operations

static const CIMName WRITE_OPERATIONS [] = {

static const CIMName WRITE_OPERATIONS [] =

{

CIMName ("CreateClass"),

CIMName ("CreateInstance"),

CIMName ("DeleteQualifier"),

Line 129

Line 122

CIMName ("InvokeMethod"),

CIMName ("EnableIndicationSubscription"),

CIMName ("ModifyIndicationSubscription"),

CIMName ("DisableIndicationSubscription") };

CIMName("DisableIndicationSubscription")

};

Line 142

Line 136

_repository = repository;

try

{

_loadAllAuthorizations();

}

catch (Exception&)

{

//ATTN-NB-03-20020402: Should this exception be thrown or ignored ?

//throw e;

// cerr << PEGASUS_CLASSNAME_AUTHORIZATION << " class not loaded, ";

// cerr << "No authorizations configured." << endl;

}

PEG_METHOD_EXIT();

}

Line 225

Line 208

try

{

// call enumerateInstances of the repository

// call enumerateInstancesForClass of the repository

namedInstances = _repository->enumerateInstances(

namedInstances = _repository->enumerateInstancesForClass(

PEGASUS_NAMESPACENAME_AUTHORIZATION, PEGASUS_CLASSNAME_AUTHORIZATION);

PEGASUS_NAMESPACENAME_AUTHORIZATION,

PEGASUS_CLASSNAME_AUTHORIZATION);

// get all the user names, namespaces, and authorizations

Line 261

Line 245

// Add authorization to the table

_authTable.insert(userName + nameSpace, auth);

if (!_authTable.insert(userName + nameSpace, auth))

{

throw AuthorizationCacheError();

}

catch(const Exception&)

catch (const CIMException& e)

{

// Allow initialization to succeed with an empty repository

if (e.getCode() != CIM_ERR_INVALID_NAMESPACE)

{

PEG_METHOD_EXIT();

throw;

}

PEG_METHOD_EXIT();

}

Line 380

Line 371

}

#ifdef PEGASUS_OS_OS400

#ifdef PEGASUS_OS_PASE

if (readOperation || writeOperation)

{

// Use OS/400 Application Administration to do cim operation verification

// (note - need to convert to EBCDIC before calling ycm)

CString userCStr = userName.getCString();

const char * user = (const char *)userCStr;

AtoE((char *)user);

CString nsCStr = nameSpace.getString().getCString();

const char * ns = (const char *)nsCStr;

AtoE((char *)ns);

CString cimMethCStr = cimMethodName.getString().getCString();

const char * cimMeth = (const char *)cimMethCStr;

AtoE((char *)cimMeth);

int os400auth =

CString nameSpaceCStr = nameSpace.getString().getCString();

ycmVerifyFunctionAuthorization(user,

const char * nameSpChar = (const char *)nameSpaceCStr;

ns,

int PaseAuth =

umeVerifyFunctionAuthorization(user,

cimMeth);

if (os400auth == TRUE)

if (PaseAuth == TRUE)

authorized = true;

/* read operation needn't verify priviledUser */

if(authorized && writeOperation)

{

The Application Admin checks

we have now cover all class/qualifier

operations to all namespaces.

But maybe this is not enough protection

for the private Pegasus namespaces.

We should call isPrivilegedUser

in this case instead of App Admin

if (strcasecmp(nameSpChar,"root/PG_Internal") == 0

||strcasecmp(nameSpChar,"root/PG_InterOp") == 0

||strcasecmp(nameSpChar,"PG_Internal") == 0

||strcasecmp(nameSpChar,"PG_InterOp") == 0 )

{

if(!System::isPrivilegedUser(userName))

authorized = false;

}

#else

Legend:

Removed from v.1.21
changed lines
	Added in v.1.31

No CVS admin address has been configured