Access Control component
|
Variables | |
global string | g_fwAccessControl_systemDomainName |
global string | g_fwAccessControl_systemDomainGenericName ="SYSTEM" |
global string | g_fwAccessControl_systemDomainFullName ="local system" |
General-Purpose functions | |
see also the module General-Purpose functions | |
void | fwAccessControl_displayException (dyn_string &exceptionInfo) |
void | fwAccessControl_displayMessage (string message) |
void | fwAccessControl_raiseException (dyn_string &exceptionInfo, string title, string detail, string extraInfo="") |
void | fwAccessControl_logout () synchronized(_fwAccessControl_mutex) |
void | fwAccessControl_login () |
bool | _fwAccessControl_isUI () |
bool | _fwAccessControl_integratedMode () |
void | fwAccessControl_setupPanel (string callbackFunctionName, dyn_string &exceptionInfo) synchronized(_fwAccessControl_mutex) |
void | fwAccessControl_getUserName (string &userName) |
void | fwAccessControl_getCurrentRole (string ¤tRole) |
void | fwAccessControl_setRole (string role, dyn_string &exceptionInfo) |
void | fwAccessControl_getDisplayInfo (int manId, string &hostName, string &ip, int &manNum, time &startTime, dyn_string &exceptionInfo) |
void | fwAccessControl_getMyDisplay (string &hostName, string &ip, int &manNum, time &startTime, dyn_string &exceptionInfo) |
void | fwAccessControl_getConfiguration (dyn_mixed &configuration, dyn_string &exceptionInfo, string sysName="") |
void | fwAccessControl_setConfiguration (dyn_mixed configuration, dyn_string &exceptionInfo, string sysName="") |
bool | fwAccessControl_checkAddDomain (string domainName, dyn_string privileges, dyn_string &exceptionInfo, string domainFullName="", string domainComment="") |
bool | fwAccessControl_checkAddGroup (string groupName, dyn_string privileges, dyn_string &exceptionInfo, string groupFullName="", string groupComment="") |
bool | fwAccessControl_checkAddUser (string userName, dyn_string groups, dyn_string &exceptionInfo, string userFullName="", string userComment="", string userPassword="", bool enabled=TRUE, int userId=-1, bool passwordAlreadyCrypted=FALSE, bool localAccount=FALSE) |
bool | fwAccessControl_setUsers (dyn_string userNames, dyn_dyn_string userGroups, dyn_string userFullNames, dyn_string userComments, dyn_string userPasswords, dyn_bool usersEnabled, dyn_int &userIds, dyn_bool pwdsCrypted, dyn_bool localAccounts, int resetMode, dyn_string &exceptionInfo) synchronized(_fwAccessControl_mutex) |
bool | fwAccessControl_checkPassword (string userName, string password, dyn_string &exceptionInfo) |
bool | fwAccessControl_changePassword (string userName, string currentPassword, string newPassword, dyn_string &exceptionInfo) synchronized(_fwAccessControl_mutex) |
void | fwAccessControl_getActiveUsers (dyn_string &users, dyn_string &uis, dyn_string &uiHosts, dyn_string &loginTimes, dyn_string &exceptionInfo, string sysName="") |
void | fwAccessControl_selectPrivileges (dyn_string &privileges, string text="", bool showSystemDomain=FALSE) |
bool | _fwAccessControl_exportToPostInstall (string fileName) |
void | fwAccessControl_help (string what) |
void | _fwAccessControl_sudo (string function, mixed ¶ms, dyn_string &exceptionInfo) |
mixed | _fwAccessControl_initializeHookWrapper (mixed dummyParams) |
mixed | _fwAccessControl_dpSetSudoWrapper (mixed params) |
mixed | _fwAccessControl_rebuildSystemPrivilegesSudo (mixed params) |
mixed | _fwAccessControl_dpCreateSudoWrapper (mixed params) |
string | _fwAccessControl_getManagerTypeName (char mantype) |
string | _fwAccessControl_generateRandomPassword () |
void fwAccessControl_displayException | ( | dyn_string & | exceptionInfo | ) |
Displays the message box with exception information
exceptionInfo | the details of the exception to be displayed |
void fwAccessControl_displayMessage | ( | string | message | ) |
Displays the message box with message
The message box is "blocking", i.e. it will stop execution until "Close" is pressed.
message | text to be displayed in the message box |
void fwAccessControl_raiseException | ( | dyn_string & | exceptionInfo, |
string | title, | ||
string | detail, | ||
string | extraInfo = "" |
||
) |
Generates the error object compatible with the Framework
exceptionInfo | the exception will be appended here |
title | gravity of the exception |
detail | description of the exception |
extraInfo | (optional) additional information |
void fwAccessControl_logout | ( | ) |
Peforms user logout
This function performs the logout of the current user, assuring that the information about the fact is populated properly.
void fwAccessControl_login | ( | ) |
Opens the login dialog
This function opens the login dialog. PVSS function (with CERN logo).
bool _fwAccessControl_isUI | ( | ) |
checks if this is a UI manager
bool _fwAccessControl_integratedMode | ( | ) |
checks if integrated mode (i.e. with AC Server) is activated
void fwAccessControl_setupPanel | ( | string | callbackFunctionName, |
dyn_string & | exceptionInfo | ||
) |
Sets-up access control in the panel
This function sets up the callback function that is called whenever privileges have changes
callbackFunctionName | specifies callback function to be called |
exceptionInfo | standard exception handling variable |
void fwAccessControl_getUserName | ( | string & | userName | ) |
Returns the current user name of the JCOP Framework access control
userName | will contain the name of the current user of the current UI |
void fwAccessControl_getCurrentRole | ( | string & | currentRole | ) |
Returns the currently selected role
currentRole | will contain the name of selected role for the current UI |
void fwAccessControl_setRole | ( | string | role, |
dyn_string & | exceptionInfo | ||
) |
Sets the role
role | role to be activated |
exceptionInfo | standard exception handling routine |
void fwAccessControl_getDisplayInfo | ( | int | manId, |
string & | hostName, | ||
string & | ip, | ||
int & | manNum, | ||
time & | startTime, | ||
dyn_string & | exceptionInfo | ||
) |
Returns the information about the display (UI Manager) in which a specified UI Manager, connected to specified system is running
[in] | manId | the identified of the UI manager to be queried, as returned, for instance, by myManId() or convManIdToInt() |
[out] | hostName | will contain the host name |
[out] | ip | will contain the IP address |
[out] | manNum | will contain the UI manager number |
[out] | startTime | will contain the time when the UI manager was started |
[out] | exceptionInfo | standard error-handling variable |
See also fwAccessControl_getMyDisplay
void fwAccessControl_getMyDisplay | ( | string & | hostName, |
string & | ip, | ||
int & | manNum, | ||
time & | startTime, | ||
dyn_string & | exceptionInfo | ||
) |
Returns the information about the display (UI Manager) on which the panel is executed
[out] | hostName | will contain the host name |
[out] | ip | will contain the IP address |
[out] | manNum | will contain the UI manager number |
[out] | startTime | will contain the time when the UI manager was started |
[out] | exceptionInfo | standard error-handling variable |
See also fwAccessControl_getDisplayInfo
void fwAccessControl_getConfiguration | ( | dyn_mixed & | configuration, |
dyn_string & | exceptionInfo, | ||
string | sysName = "" |
||
) |
gets access control configuration
void fwAccessControl_setConfiguration | ( | dyn_mixed | configuration, |
dyn_string & | exceptionInfo, | ||
string | sysName = "" |
||
) |
sets access control configuration
bool fwAccessControl_checkAddDomain | ( | string | domainName, |
dyn_string | privileges, | ||
dyn_string & | exceptionInfo, | ||
string | domainFullName = "" , |
||
string | domainComment = "" |
||
) |
Creates or updates a domain
domainName | the name of domain |
privileges | the list of privilege names |
exceptionInfo | standard exception handling variable |
domainFullName | (optional) the full name for the domain; empty: leave as it is |
domainComment | (optional) the description of the domain; empty: leave as it is |
When the domain specified in domainName already exists, and the optional parameters are not specified (or empty strings are passed), only the privileges of the domain will be modified.
The privileges are modified on the "best effort" basis: the new privilege names that do not match with existing ones will replace the "generic" privilege names "PRIV5", "PRIV6", "PRIV7", if there is enough space for them.
bool fwAccessControl_checkAddGroup | ( | string | groupName, |
dyn_string | privileges, | ||
dyn_string & | exceptionInfo, | ||
string | groupFullName = "" , |
||
string | groupComment = "" |
||
) |
Creates or updates a group
groupName | the name of group |
privileges | the list of privileges granted to the group |
exceptionInfo | standard exception handling variable |
groupFullName | (optional) the full name for the group |
groupComment | (optional) the description of the group |
When the group specified in groupName already exists, and the optional parameters are not specified (or empty strings are passed), only the access rights of the group will be modified: the access rights specified in privileges variable will be appended to the ones already granted to the group.
bool fwAccessControl_checkAddUser | ( | string | userName, |
dyn_string | groups, | ||
dyn_string & | exceptionInfo, | ||
string | userFullName = "" , |
||
string | userComment = "" , |
||
string | userPassword = "" , |
||
bool | enabled = TRUE , |
||
int | userId = -1 , |
||
bool | passwordAlreadyCrypted = FALSE , |
||
bool | localAccount = FALSE |
||
) |
Creates or updates a user
userName | the name of user |
groups | the list of groups the user will belong to |
exceptionInfo | standard exception handling variable |
userFullName | (optional) the full name for the user; empty: leave as it is |
userComment | (optional) the description of the user; empty: leave as it is |
userPassword | (optional) the passsword for the user; empty: leave as it is |
enabled | (optional) taken into account only for account creation: TRUE: new account is enabled, FALSE: new account is disabled; the state of existing accounts is not changed! |
userId | (optional) when user account is created, this ID will preferrentially be used, |
passwordAlreadyCrypted | (optional) TRUE means that the string contained in userPassword was already encrypted using crypt() function (i.e. it is not passed as a plain-text); by default this is FALSE. |
localAccount | (optional) TRUE means that the authentication for this user will always be done locally, regardless of how it is setup in the system; this allows for mixing of local-only (e.g. generic) accounts, with NICE accounts; by default this is set to FALSE; |
When the user specified in userName already exists, and the optional parameters are not specified (or empty strings are passed), only the group membership of the user will be updated: the user will become a member of the groups specified by parameter groups, while retaining the membership in all groups it had so far.
bool fwAccessControl_setUsers | ( | dyn_string | userNames, |
dyn_dyn_string | userGroups, | ||
dyn_string | userFullNames, | ||
dyn_string | userComments, | ||
dyn_string | userPasswords, | ||
dyn_bool | usersEnabled, | ||
dyn_int & | userIds, | ||
dyn_bool | pwdsCrypted, | ||
dyn_bool | localAccounts, | ||
int | resetMode, | ||
dyn_string & | exceptionInfo | ||
) |
Creates or updates a number of user accounts (bulk)
userNames | list with the name of user |
userGroups | for i'th user the list of group names the user will belong to |
exceptionInfo | standard exception handling variable |
userFullNames | the full name for the user; empty: leave as it is |
userComments | the description of the user; empty: leave as it is |
userPasswords | the passsword for the user; empty: leave as it is |
usersEnabled | TRUE:account is enabled, FALSE: account is disabled; NOTE: unlike the fwAccessControl_checkAddUser , this function changes the state of existing accounts! |
userIds | when user account is created, this ID will preferrentially be used, |
pwdsCrypted | TRUE means that the string contained in userPassword was already encrypted using crypt() function (i.e. it is not passed as a plain-text); by default this is FALSE. |
localAccounts | TRUE means that the authentication for this user will always be done locally, regardless of how it is setup in the system; this allows for mixing of local-only (e.g. generic) accounts, with NICE accounts; by default this is set to FALSE; |
resetMode | : specify what to do with the existing definition of user roles and accounts
|
bool fwAccessControl_checkPassword | ( | string | userName, |
string | password, | ||
dyn_string & | exceptionInfo | ||
) |
Checks user's password
userName | user name |
password | user's password |
exceptionInfo | standard exception handling variable |
bool fwAccessControl_changePassword | ( | string | userName, |
string | currentPassword, | ||
string | newPassword, | ||
dyn_string & | exceptionInfo | ||
) |
Changes user's password
userName | the user name for which password is changed |
currentPassword | user's current password; note that the users who have System Administration privileges (e.g. root) does not need to provide this password - they are authorized to change any user's password. |
newPassword | the new password for the user |
exceptionInfo | standard exception handling variable |
void fwAccessControl_getActiveUsers | ( | dyn_string & | users, |
dyn_string & | uis, | ||
dyn_string & | uiHosts, | ||
dyn_string & | loginTimes, | ||
dyn_string & | exceptionInfo, | ||
string | sysName = "" |
||
) |
Returns the list of all users logged in to the system,
users | on return contains the list of user names |
uis | on return contains the UserInterface datapoints, to which the users are logged in |
uiHosts | on return contains the host names, from which the users started their UIs |
loginTimes | on return contains the user login time |
sysName | optional, system name, being queried, by default: all systems |
exceptionInfo | standard exception handling variable |
void fwAccessControl_selectPrivileges | ( | dyn_string & | privileges, |
string | text = "" , |
||
bool | showSystemDomain = FALSE |
||
) |
Displays the privilege selection panel
In the current version of the panel only one privilege may be selected.
privileges | on return contains a dyn_string with the selected privilege in "DomainName:PrivilegeName" form; on input it may contain pre-selected privilege(s), to be displayed in the panel. Empty string is returned if the panel was cancelled. |
text | (optional) the text that is displayed in selection dialog; specifying an empty string (default) will display "Select domain and privilege" text. |
showSystemDomain | (optional) determines if PVSS System Domain should be included in selection list; default=FALSE |
bool _fwAccessControl_exportToPostInstall | ( | string | fileName | ) |
Exports Access Control data to a file suitable for postInsall script.
The function opens the panel that allows to select Domains, Groups and Users to be exported, then exports selected data as a file containing the CTRL statements, that would recreate/update the Access Control. Such CTRL file may be used directly as a "postInstall" script for the Framework installation tool.
fileName | the path and the name of the file to which the script will be exported. |
void fwAccessControl_help | ( | string | what | ) |
Brings up the help window
void _fwAccessControl_sudo | ( | string | function, |
mixed & | params, | ||
dyn_string & | exceptionInfo | ||
) |
Executes a CTRL code fragment with root identity
Only certain permitted functions (hardcoded here), and called from permitted places are allowed. The function executed by sudo must have one parameter of type mixed (it may though be eg a dyn_string casted to mixed), and should return a value of type mixed;
on return the params
will contain the return value
mixed _fwAccessControl_initializeHookWrapper | ( | mixed | dummyParams | ) |
Private
wrapper function for the initializeHook, adjusting function signature, so that it could be executed via sudo
mixed _fwAccessControl_dpSetSudoWrapper | ( | mixed | params | ) |
Private
Performs a specifed dpSet through sudo.
params[1]: dpe+config to be set (may be a dyn_* array if params[3] set to TRUE) params[2]: the value to be set (may be a dyn_* array if params[2] set to TRUE) params[3]: optional, if set to true then the dpSet is done on list of DPEs
on return: result of getLastError() (ie. dyn_errClass)
mixed _fwAccessControl_rebuildSystemPrivilegesSudo | ( | mixed | params | ) |
mixed _fwAccessControl_dpCreateSudoWrapper | ( | mixed | params | ) |
Private
dpCreate through sudo.
params[1]: DP Name params[2]: DP Type
on return: result of getLastError() (ie. dyn_errClass)
string _fwAccessControl_getManagerTypeName | ( | char | mantype | ) |
Should use the native function or something from fwManager lib There is some duplication inside _fwAccessControl_getManNameFromId(int manid)
string _fwAccessControl_generateRandomPassword | ( | ) |
Generates a random 8-character string, suitable for a password
global string g_fwAccessControl_systemDomainName |
The identifier given to the system domain - equal to system name
global string g_fwAccessControl_systemDomainGenericName ="SYSTEM" |
The identifier given to the system domain - generic name: "SYSTEM"
global string g_fwAccessControl_systemDomainFullName ="local system" |
The name assigned to system domain