General Purpose Functions
[Access Control library]

Variables

global string g_fwAccessControl_systemDomainName
global string g_fwAccessControl_systemDomainGenericName = "SYSTEM"
global string g_fwAccessControl_systemDomainFullName = "local system"

General-Purpose functions

see also the module General-Purpose functions



void fwAccessControl_displayException (dyn_string &exceptionInfo)
void fwAccessControl_displayMessage (string message)
void fwAccessControl_raiseException (dyn_string &exceptionInfo, string title, string detail, string extraInfo="")
void fwAccessControl_logout () synchronized(_fwAccessControl_mutex)
void fwAccessControl_login ()
bool _fwAccessControl_isUI ()
bool _fwAccessControl_integratedMode ()
void fwAccessControl_setupPanel (string callbackFunctionName, dyn_string &exceptionInfo) synchronized(_fwAccessControl_mutex)
void fwAccessControl_getUserName (string &userName)
void fwAccessControl_getCurrentRole (string &currentRole)
void fwAccessControl_setRole (string role, dyn_string &exceptionInfo)
void fwAccessControl_getDisplayInfo (int manId, string &hostName, string &ip, int &manNum, time &startTime, dyn_string &exceptionInfo)
void fwAccessControl_getMyDisplay (string &hostName, string &ip, int &manNum, time &startTime, dyn_string &exceptionInfo)
void fwAccessControl_getConfiguration (dyn_mixed &configuration, dyn_string &exceptionInfo, string sysName="")
void fwAccessControl_setConfiguration (dyn_mixed configuration, dyn_string &exceptionInfo, string sysName="")
bool fwAccessControl_checkAddDomain (string domainName, dyn_string privileges, dyn_string &exceptionInfo, string domainFullName="", string domainComment="")
bool fwAccessControl_checkAddGroup (string groupName, dyn_string privileges, dyn_string &exceptionInfo, string groupFullName="", string groupComment="")
bool fwAccessControl_checkAddUser (string userName, dyn_string groups, dyn_string &exceptionInfo, string userFullName="", string userComment="", string userPassword="", bool enabled=TRUE, int userId=-1, bool passwordAlreadyCrypted=FALSE, bool localAccount=FALSE)
bool fwAccessControl_setUsers (dyn_string userNames, dyn_dyn_string userGroups, dyn_string userFullNames, dyn_string userComments, dyn_string userPasswords, dyn_bool usersEnabled, dyn_int &userIds, dyn_bool pwdsCrypted, dyn_bool localAccounts, int resetMode, dyn_string &exceptionInfo) synchronized(_fwAccessControl_mutex)
bool fwAccessControl_checkPassword (string userName, string password, dyn_string &exceptionInfo)
bool fwAccessControl_changePassword (string userName, string currentPassword, string newPassword, dyn_string &exceptionInfo) synchronized(_fwAccessControl_mutex)
void fwAccessControl_getActiveUsers (dyn_string &users, dyn_string &uis, dyn_string &uiHosts, dyn_string &loginTimes, dyn_string &exceptionInfo, string sysName="")
void fwAccessControl_selectPrivileges (dyn_string &privileges, string text="", bool showSystemDomain=FALSE)
bool _fwAccessControl_exportToPostInstall (string fileName)
void fwAccessControl_help (string what)
void _fwAccessControl_sudo (string function, mixed &params, dyn_string &exceptionInfo)
mixed _fwAccessControl_initializeHookWrapper (mixed dummyParams)
mixed _fwAccessControl_dpSetSudoWrapper (mixed params)
string _fwAccessControl_getManagerTypeName (char mantype)
string _fwAccessControl_generateRandomPassword ()

Function Documentation

void fwAccessControl_displayException ( dyn_string &  exceptionInfo  ) 

Displays the message box with exception information

Parameters:
exceptionInfo the details of the exception to be displayed
void fwAccessControl_displayMessage ( string  message  ) 

Displays the message box with message

The message box is "blocking", i.e. it will stop execution until "Close" is pressed.

Parameters:
message text to be displayed in the message box
void fwAccessControl_raiseException ( dyn_string &  exceptionInfo,
string  title,
string  detail,
string  extraInfo = "" 
)

Generates the error object compatible with the Framework

Parameters:
exceptionInfo the exception will be appended here
title gravity of the exception
detail description of the exception
extraInfo (optional) additional information
void fwAccessControl_logout (  ) 

Peforms user logout

This function performs the logout of the current user, assuring that the information about the fact is populated properly.

See also:
fwAccessControl_login
void fwAccessControl_login (  ) 

Opens the login dialog

This function opens the login dialog. PVSS function (with CERN logo).

See also:
fwAccessControl_logout
bool _fwAccessControl_isUI (  ) 

checks if this is a UI manager

Returns:
TRUE if the code is run in a UI manager.
bool _fwAccessControl_integratedMode (  ) 

checks if integrated mode (i.e. with AC Server) is activated

Returns:
TRUE if AC Server manages this system.
void fwAccessControl_setupPanel ( string  callbackFunctionName,
dyn_string &  exceptionInfo 
)

Sets-up access control in the panel

This function sets up the callback function that is called whenever privileges have changes

Parameters:
callbackFunctionName specifies callback function to be called
exceptionInfo standard exception handling variable
void fwAccessControl_getUserName ( string &  userName  ) 

Returns the current user name of the JCOP Framework access control

Parameters:
userName will contain the name of the current user of the current UI
void fwAccessControl_getCurrentRole ( string &  currentRole  ) 

Returns the currently selected role

Parameters:
currentRole will contain the name of selected role for the current UI
void fwAccessControl_setRole ( string  role,
dyn_string &  exceptionInfo 
)

Sets the role

Parameters:
role role to be activated
exceptionInfo standard exception handling routine
void fwAccessControl_getDisplayInfo ( int  manId,
string &  hostName,
string &  ip,
int &  manNum,
time &  startTime,
dyn_string &  exceptionInfo 
)

Returns the information about the display (UI Manager) in which a specified UI Manager, connected to specified system is running

Parameters:
[in] manId the identified of the UI manager to be queried, as returned, for instance, by myManId() or convManIdToInt()
[out] hostName will contain the host name
[out] ip will contain the IP address
[out] manNum will contain the UI manager number
[out] startTime will contain the time when the UI manager was started
[out] exceptionInfo standard error-handling variable

See also fwAccessControl_getMyDisplay

void fwAccessControl_getMyDisplay ( string &  hostName,
string &  ip,
int &  manNum,
time &  startTime,
dyn_string &  exceptionInfo 
)

Returns the information about the display (UI Manager) on which the panel is executed

Parameters:
[out] hostName will contain the host name
[out] ip will contain the IP address
[out] manNum will contain the UI manager number
[out] startTime will contain the time when the UI manager was started
[out] exceptionInfo standard error-handling variable

See also fwAccessControl_getDisplayInfo

void fwAccessControl_getConfiguration ( dyn_mixed &  configuration,
dyn_string &  exceptionInfo,
string  sysName = "" 
)

gets access control configuration

void fwAccessControl_setConfiguration ( dyn_mixed  configuration,
dyn_string &  exceptionInfo,
string  sysName = "" 
)

sets access control configuration

bool fwAccessControl_checkAddDomain ( string  domainName,
dyn_string  privileges,
dyn_string &  exceptionInfo,
string  domainFullName = "",
string  domainComment = "" 
)

Creates or updates a domain

Parameters:
domainName the name of domain
privileges the list of privilege names
exceptionInfo standard exception handling variable
domainFullName (optional) the full name for the domain; empty: leave as it is
domainComment (optional) the description of the domain; empty: leave as it is
Returns:
true if modification needed to be done, false if nothing was modified

When the domain specified in domainName already exists, and the optional parameters are not specified (or empty strings are passed), only the privileges of the domain will be modified.

The privileges are modified on the "best effort" basis: the new privilege names that do not match with existing ones will replace the "generic" privilege names "PRIV5", "PRIV6", "PRIV7", if there is enough space for them.

bool fwAccessControl_checkAddGroup ( string  groupName,
dyn_string  privileges,
dyn_string &  exceptionInfo,
string  groupFullName = "",
string  groupComment = "" 
)

Creates or updates a group

Parameters:
groupName the name of group
privileges the list of privileges granted to the group
exceptionInfo standard exception handling variable
groupFullName (optional) the full name for the group
groupComment (optional) the description of the group
Returns:
true if modification needed to be done, false if nothing was modified

When the group specified in groupName already exists, and the optional parameters are not specified (or empty strings are passed), only the access rights of the group will be modified: the access rights specified in privileges variable will be appended to the ones already granted to the group.

bool fwAccessControl_checkAddUser ( string  userName,
dyn_string  groups,
dyn_string &  exceptionInfo,
string  userFullName = "",
string  userComment = "",
string  userPassword = "",
bool  enabled = TRUE,
int  userId = -1,
bool  passwordAlreadyCrypted = FALSE,
bool  localAccount = FALSE 
)

Creates or updates a user

Parameters:
userName the name of user
groups the list of groups the user will belong to
exceptionInfo standard exception handling variable
userFullName (optional) the full name for the user; empty: leave as it is
userComment (optional) the description of the user; empty: leave as it is
userPassword (optional) the passsword for the user; empty: leave as it is
enabled (optional) taken into account only for account creation: TRUE: new account is enabled, FALSE: new account is disabled; the state of existing accounts is not changed!
userId (optional) when user account is created, this ID will preferrentially be used,
passwordAlreadyCrypted (optional) TRUE means that the string contained in userPassword was already encrypted using crypt() function (i.e. it is not passed as a plain-text); by default this is FALSE.
localAccount (optional) TRUE means that the authentication for this user will always be done locally, regardless of how it is setup in the system; this allows for mixing of local-only (e.g. generic) accounts, with NICE accounts; by default this is set to FALSE;
Returns:
true if modification needed to be done, false if nothing was modified

When the user specified in userName already exists, and the optional parameters are not specified (or empty strings are passed), only the group membership of the user will be updated: the user will become a member of the groups specified by parameter groups, while retaining the membership in all groups it had so far.

bool fwAccessControl_setUsers ( dyn_string  userNames,
dyn_dyn_string  userGroups,
dyn_string  userFullNames,
dyn_string  userComments,
dyn_string  userPasswords,
dyn_bool  usersEnabled,
dyn_int &  userIds,
dyn_bool  pwdsCrypted,
dyn_bool  localAccounts,
int  resetMode,
dyn_string &  exceptionInfo 
)

Creates or updates a number of user accounts (bulk)

Parameters:
userNames list with the name of user
userGroups for i'th user the list of group names the user will belong to
exceptionInfo standard exception handling variable
userFullNames the full name for the user; empty: leave as it is
userComments the description of the user; empty: leave as it is
userPasswords the passsword for the user; empty: leave as it is
usersEnabled TRUE:account is enabled, FALSE: account is disabled; NOTE: unlike the fwAccessControl_checkAddUser, this function changes the state of existing accounts!
userIds when user account is created, this ID will preferrentially be used,
pwdsCrypted TRUE means that the string contained in userPassword was already encrypted using crypt() function (i.e. it is not passed as a plain-text); by default this is FALSE.
localAccounts TRUE means that the authentication for this user will always be done locally, regardless of how it is setup in the system; this allows for mixing of local-only (e.g. generic) accounts, with NICE accounts; by default this is set to FALSE;
resetMode : specify what to do with the existing definition of user roles and accounts

  • 0 (or boolean FALSE) - leave them as they are, adding the new roles for the specified users to the ones that they already have
  • 1 (or boolean TRUE) - replaces all users' roles, i.e. the roles specified in the userGroups parameters replace the existing roles; for the existing user accounts that are not specified in the new list of users, the set of roles is set to empty, which effectively disables the accounts (this is except the special "root" and "para" accounts, that always stay unchanged), and the accounts marked as "local"
  • 2 (new as of version 3.2.15): "overwrite (or re-create) mode" - existing user accounts except for "root", "para" and all account with local authentication are deleted and replaced by the new ones. Note that in this mode the user IDs specified in the userIds parameter will always be used.
Returns:
true if there was any effective modification, else if nothing was modified
bool fwAccessControl_checkPassword ( string  userName,
string  password,
dyn_string &  exceptionInfo 
)

Checks user's password

Parameters:
userName user name
password user's password
exceptionInfo standard exception handling variable
Returns:
TRUE if specified user may be authenticated by means of provided password.
FALSE is returned as a result, and exceptionInfo will be non-empty in case of error.
bool fwAccessControl_changePassword ( string  userName,
string  currentPassword,
string  newPassword,
dyn_string &  exceptionInfo 
)

Changes user's password

Parameters:
userName the user name for which password is changed
currentPassword user's current password; note that the users who have System Administration privileges (e.g. root) does not need to provide this password - they are authorized to change any user's password.
newPassword the new password for the user
exceptionInfo standard exception handling variable
Returns:
TRUE if password change was succesfull; otherwise (FALSE is returned) the exceptionInfo will contain the details of the error.
void fwAccessControl_getActiveUsers ( dyn_string &  users,
dyn_string &  uis,
dyn_string &  uiHosts,
dyn_string &  loginTimes,
dyn_string &  exceptionInfo,
string  sysName = "" 
)

Returns the list of all users logged in to the system,

Parameters:
users on return contains the list of user names
uis on return contains the UserInterface datapoints, to which the users are logged in
uiHosts on return contains the host names, from which the users started their UIs
loginTimes on return contains the user login time
sysName optional, system name, being queried, by default: all systems
exceptionInfo standard exception handling variable
void fwAccessControl_selectPrivileges ( dyn_string &  privileges,
string  text = "",
bool  showSystemDomain = FALSE 
)

Displays the privilege selection panel

In the current version of the panel only one privilege may be selected.

Parameters:
privileges on return contains a dyn_string with the selected privilege in "DomainName:PrivilegeName" form; on input it may contain pre-selected privilege(s), to be displayed in the panel. Empty string is returned if the panel was cancelled.
text (optional) the text that is displayed in selection dialog; specifying an empty string (default) will display "Select domain and privilege" text.
showSystemDomain (optional) determines if PVSS System Domain should be included in selection list; default=FALSE
bool _fwAccessControl_exportToPostInstall ( string  fileName  ) 

Exports Access Control data to a file suitable for postInsall script.

The function opens the panel that allows to select Domains, Groups and Users to be exported, then exports selected data as a file containing the CTRL statements, that would recreate/update the Access Control. Such CTRL file may be used directly as a "postInstall" script for the Framework installation tool.

Parameters:
fileName the path and the name of the file to which the script will be exported.
Returns:
TRUE if the file was exported succesfully.
void fwAccessControl_help ( string  what  ) 

Brings up the help window

void _fwAccessControl_sudo ( string  function,
mixed &  params,
dyn_string &  exceptionInfo 
)

Executes a CTRL code fragment with root identity

Only certain permitted functions (hardcoded here), and called from permitted places are allowed. The function executed by sudo must have one parameter of type mixed, and should return a value of type mixed;

on return the params will contain the return value

mixed _fwAccessControl_initializeHookWrapper ( mixed  dummyParams  ) 

Private

wrapper function for the initializeHook, adjusting function signature, so that it could be executed via sudo

mixed _fwAccessControl_dpSetSudoWrapper ( mixed  params  ) 

Private

Performs a specifed dpSet through sudo.

params[1]: dpe+config to be set params[2]: the value to be set

on return: result of getLastError() (ie. dyn_errClasS)

string _fwAccessControl_getManagerTypeName ( char  mantype  ) 

Should use the native function or something from fwManager lib There is some duplication inside _fwAccessControl_getManNameFromId(int manid)

string _fwAccessControl_generateRandomPassword (  ) 

Generates a random 8-character string, suitable for a password


Variable Documentation

The identifier given to the system domain - equal to system name

The identifier given to the system domain - generic name: "SYSTEM"

global string g_fwAccessControl_systemDomainFullName = "local system"

The name assigned to system domain


Generated on 14 Jan 2016 for Access Control component by  doxygen 1.6.1