org.apache.jackrabbit.core.security.user
Class UserManagerImpl

java.lang.Object
  org.apache.jackrabbit.core.ProtectedItemModifier
      org.apache.jackrabbit.core.security.user.UserManagerImpl

All Implemented Interfaces:

UserManager, SessionListener

Direct Known Subclasses:

UserPerWorkspaceUserManager

public class UserManagerImpl
extends ProtectedItemModifier
implements UserManager, SessionListener

Default implementation of the UserManager interface with the following characteristics:

• Users and Groups are stored in the repository as JCR nodes.
• Users are created below UserConstants.USERS_PATH,
  Groups are created below UserConstants.GROUPS_PATH (unless otherwise configured).
• The Id of an authorizable is stored in the jcr:uuid property (md5 hash).
• In order to structure the users and groups tree and avoid creating a flat hierarchy, additional hierarchy nodes of type "rep:AuthorizableFolder" are introduced using
  • the specified intermediate path passed to the create methods
  • or some built-in logic if the intermediate path is missing.

The built-in logic applies the following rules:

• The names of the hierarchy folders is determined from ID of the authorizable to be created, consisting of the leading N chars where N is the relative depth starting from the node at getUsersPath() or getGroupsPath().
• By default 2 levels (depth == 2) are created.
• Parent nodes are expected to consist of folder structure only.
• If the ID contains invalid JCR chars that would prevent the creation of a Node with that name, the names of authorizable node and the intermediate hierarchy nodes are escaped.

Examples: Creating an non-existing user with ID 'aSmith' without specifying an intermediate path would result in the following structure:

 + rep:security            [nt:unstructured]
   + rep:authorizables     [rep:AuthorizableFolder]
     + rep:users           [rep:AuthorizableFolder]
       + a                 [rep:AuthorizableFolder]
         + aS              [rep:AuthorizableFolder]
           + aSmith        [rep:User]
 

Creating a non-existing user with ID 'aSmith' specifying an intermediate path 'some/tree' would result in the following structure:

 + rep:security            [nt:unstructured]
   + rep:authorizables     [rep:AuthorizableFolder]
     + rep:users           [rep:AuthorizableFolder]
       + some              [rep:AuthorizableFolder]
         + tree            [rep:AuthorizableFolder]
           + aSmith        [rep:User]
 

This UserManager is able to handle the following configuration options:

• PARAM_USERS_PATH: Defines where user nodes are created. If missing set to USERS_PATH.
• PARAM_GROUPS_PATH. Defines where group nodes are created. If missing set to GROUPS_PATH.
• PARAM_COMPATIBILE_JR16: If the param is present and its value is true looking up authorizables by ID will use the NodeResolver if not found otherwise.
  If the parameter is missing (or false) users and groups created with a Jackrabbit repository < v2.0 will not be found any more.
  By default this option is disabled.
• PARAM_DEFAULT_DEPTH: Parameter used to change the number of levels that are used by default to store authorizable nodes.
  The value is expected to be a positive integer greater than zero. The default number of levels is 2.
• PARAM_AUTO_EXPAND_TREE: If this parameter is present and its value is true, the trees containing user and group nodes will automatically created additional hierarchy levels if the number of nodes on a given level exceeds the maximal allowed size.
  By default this option is disabled.
• PARAM_AUTO_EXPAND_SIZE: This parameter only takes effect if PARAM_AUTO_EXPAND_TREE is enabled.
  The value is expected to be a positive long greater than zero. The default value is 1000.

Field Summary

static String	AUTHORIZABLES_PATH
static String	GROUP_ADMIN_GROUP_NAME Configuration key and default value for the the name of the 'GroupAdmin' group-principal
static String	GROUPS_PATH
static Name	MIX_REP_IMPERSONATABLE
static NameFactory	NF
static Name	NT_REP_AUTHORIZABLE
static Name	NT_REP_AUTHORIZABLE_FOLDER
static Name	NT_REP_GROUP
static Name	NT_REP_USER
static Name	P_GROUPS Deprecated. As of 2.0 group membership is stored with the group node.
static Name	P_IMPERSONATORS Name of the user property containing the principal names of those allowed to impersonate.
static Name	P_MEMBERS
static Name	P_PASSWORD
static Name	P_PRINCIPAL_NAME
static Name	P_USERID Deprecated. As of 2.0 the id-hash is stored with the jcr:uuid making the rep:userId property redundant. It has been removed from the node type definition.
static String	PARAM_AUTO_EXPAND_SIZE This parameter only takes effect if PARAM_AUTO_EXPAND_TREE is enabled. The default value is 1000.
static String	PARAM_AUTO_EXPAND_TREE If this parameter is present and its value is true, the trees containing user and group nodes will automatically created additional hierarchy levels if the number of nodes on a given level exceeds the maximal allowed size.
static String	PARAM_COMPATIBILE_JR16 Flag to enable a minimal backwards compatibility with Jackrabbit < v2.0 If the param is present and its value is true looking up authorizables by ID will use the NodeResolver if not found otherwise. If the parameter is missing (or false) users and groups created with a Jackrabbit repository < v2.0 will not be found any more. By default this option is disabled.
static String	PARAM_DEFAULT_DEPTH Parameter used to change the number of levels that are used by default store authorizable nodes. The default number of levels is 2.
static String	PARAM_GROUPS_PATH Configuration option to change the default path for creating groups.
static String	PARAM_USERS_PATH Configuration option to change the default path for creating users.
static String	SECURITY_ROOT_PATH root-path to security related content e.g.
static String	USER_ADMIN_GROUP_NAME Configuration key and default value for the the name of the 'UserAdmin' group-principal.
static String	USERS_PATH

Fields inherited from interface org.apache.jackrabbit.api.security.user.UserManager

SEARCH_TYPE_AUTHORIZABLE, SEARCH_TYPE_GROUP, SEARCH_TYPE_USER

Constructor Summary

UserManagerImpl(SessionImpl session, String adminId)
Create a new UserManager with the default configuration.

UserManagerImpl(SessionImpl session, String adminId, Properties config)
Create a new UserManager for the given session.

Method Summary

void	autoSave(boolean enable) Always throws unsupportedRepositoryOperationException as modification of the autosave behavior is not supported.
Group	createGroup(Principal principal) Same as createGroup(java.security.Principal, String ) where the intermediate path is null.
Group	createGroup(Principal principal, String intermediatePath) Create a new Group from the given principal.
User	createUser(String userID, String password)
User	createUser(String userID, String password, Principal principal, String intermediatePath)
protected Group	doCreateGroup(NodeImpl node) Build the group object from the given group node.
protected User	doCreateUser(NodeImpl node) Build the user object from the given user node.
Iterator<Authorizable>	findAuthorizables(String propertyName, String value)
Iterator<Authorizable>	findAuthorizables(String propertyName, String value, int searchType)
Authorizable	getAuthorizable(Principal principal)
Authorizable	getAuthorizable(String id)
String	getGroupsPath() Implementation specific methods releaving where groups are created within the content.
String	getUsersPath() Implementation specific methods releaving where users are created within the content.
boolean	isAutoSave() Always returns true as by default the autoSave behavior cannot be altered (see also autoSave(boolean).
void	loggedOut(SessionImpl session) Called when a Session has been 'closed' by calling Session.logout()
void	loggingOut(SessionImpl session) Called when a Session is about to be 'closed' by calling Session.logout()

Methods inherited from class org.apache.jackrabbit.core.ProtectedItemModifier

addNode, addNode, markModified, removeItem, setProperty, setProperty, setProperty, setProperty

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PARAM_USERS_PATH

public static final String PARAM_USERS_PATH

Configuration option to change the default path for creating users.

See Also:

Constant Field Values

PARAM_GROUPS_PATH

public static final String PARAM_GROUPS_PATH

Configuration option to change the default path for creating groups.

See Also:

Constant Field Values

PARAM_COMPATIBILE_JR16

public static final String PARAM_COMPATIBILE_JR16

Flag to enable a minimal backwards compatibility with Jackrabbit < v2.0
If the param is present and its value is true looking up authorizables by ID will use the NodeResolver if not found otherwise.
If the parameter is missing (or false) users and groups created with a Jackrabbit repository < v2.0 will not be found any more.
By default this option is disabled.

See Also:

Constant Field Values

PARAM_DEFAULT_DEPTH

public static final String PARAM_DEFAULT_DEPTH

Parameter used to change the number of levels that are used by default store authorizable nodes.
The default number of levels is 2.

NOTE: Changing the default depth once users and groups have been created in the repository will cause inconsistencies, due to the fact that the resolution of ID to an authorizable relies on the structure defined by the default depth.
It is recommended to remove all authorizable nodes that will not be reachable any more, before this config option is changed.

• If default depth is increased:
  All authorizables on levels < default depth are not reachable any more.
• If default depth is decreased:
  All authorizables on levels > default depth aren't reachable any more unless the PARAM_AUTO_EXPAND_TREE flag is set to true.

See Also:

Constant Field Values

PARAM_AUTO_EXPAND_TREE

public static final String PARAM_AUTO_EXPAND_TREE

If this parameter is present and its value is true, the trees containing user and group nodes will automatically created additional hierarchy levels if the number of nodes on a given level exceeds the maximal allowed size.
By default this option is disabled.

See Also:

Constant Field Values

PARAM_AUTO_EXPAND_SIZE

public static final String PARAM_AUTO_EXPAND_SIZE

This parameter only takes effect if PARAM_AUTO_EXPAND_TREE is enabled.
The default value is 1000.

See Also:

Constant Field Values

NF

public static final NameFactory NF

SECURITY_ROOT_PATH

public static final String SECURITY_ROOT_PATH

root-path to security related content e.g. principals

See Also:

Constant Field Values

AUTHORIZABLES_PATH

public static final String AUTHORIZABLES_PATH

See Also:

Constant Field Values

USERS_PATH

public static final String USERS_PATH

See Also:

Constant Field Values

GROUPS_PATH

public static final String GROUPS_PATH

See Also:

Constant Field Values

USER_ADMIN_GROUP_NAME

public static final String USER_ADMIN_GROUP_NAME

Configuration key and default value for the the name of the 'UserAdmin' group-principal.

See Also:

Constant Field Values

GROUP_ADMIN_GROUP_NAME

public static final String GROUP_ADMIN_GROUP_NAME

Configuration key and default value for the the name of the 'GroupAdmin' group-principal

See Also:

Constant Field Values

P_PRINCIPAL_NAME

public static final Name P_PRINCIPAL_NAME

P_USERID

public static final Name P_USERID

Deprecated. As of 2.0 the id-hash is stored with the jcr:uuid making the rep:userId property redundant. It has been removed from the node type definition.

P_PASSWORD

public static final Name P_PASSWORD

P_GROUPS

public static final Name P_GROUPS

Deprecated. As of 2.0 group membership is stored with the group node.

See Also:

P_MEMBERS

P_MEMBERS

public static final Name P_MEMBERS

P_IMPERSONATORS

public static final Name P_IMPERSONATORS

Name of the user property containing the principal names of those allowed to impersonate.

NT_REP_AUTHORIZABLE

public static final Name NT_REP_AUTHORIZABLE

NT_REP_AUTHORIZABLE_FOLDER

public static final Name NT_REP_AUTHORIZABLE_FOLDER

NT_REP_USER

public static final Name NT_REP_USER

NT_REP_GROUP

public static final Name NT_REP_GROUP

MIX_REP_IMPERSONATABLE

public static final Name MIX_REP_IMPERSONATABLE

Constructor Detail

UserManagerImpl

public UserManagerImpl(SessionImpl session,
                       String adminId)
                throws RepositoryException

Create a new UserManager with the default configuration.

Parameters:

session - The editing/reading session.

adminId - The user ID of the administrator.

Throws:

RepositoryException - If an error occurs.

UserManagerImpl

public UserManagerImpl(SessionImpl session,
                       String adminId,
                       Properties config)
                throws RepositoryException

Create a new UserManager for the given session. Currently the following configuration options are respected:

• PARAM_USERS_PATH. If missing set to UserConstants.USERS_PATH.
• PARAM_GROUPS_PATH. If missing set to UserConstants.GROUPS_PATH.
• PARAM_DEFAULT_DEPTH. The default number of levels is 2.
• PARAM_AUTO_EXPAND_TREE. By default this option is disabled.
• PARAM_AUTO_EXPAND_SIZE. The default value is 1000.

See the overall introduction for details.

Parameters:

session - The editing/reading session.

adminId - The user ID of the administrator.

config - The configuration parameters.

Throws:

RepositoryException - If an error occurs.

Method Detail

getUsersPath

public String getUsersPath()

Implementation specific methods releaving where users are created within the content.

Returns:

root path for user content.

See Also:

For the corresponding configuration parameter.

getGroupsPath

public String getGroupsPath()

Implementation specific methods releaving where groups are created within the content.

Returns:

root path for group content.

See Also:

For the corresponding configuration parameter.

getAuthorizable

public Authorizable getAuthorizable(String id)
                             throws RepositoryException

Specified by:

getAuthorizable in interface UserManager

Throws:

RepositoryException

See Also:

UserManager.getAuthorizable(String)

getAuthorizable

public Authorizable getAuthorizable(Principal principal)
                             throws RepositoryException

Specified by:

getAuthorizable in interface UserManager

Throws:

RepositoryException

See Also:

UserManager.getAuthorizable(Principal)

findAuthorizables

public Iterator<Authorizable> findAuthorizables(String propertyName,
                                                String value)
                                         throws RepositoryException

Specified by:

findAuthorizables in interface UserManager

Throws:

RepositoryException

See Also:

UserManager.findAuthorizables(String,String)

findAuthorizables

public Iterator<Authorizable> findAuthorizables(String propertyName,
                                                String value,
                                                int searchType)
                                         throws RepositoryException

Specified by:

findAuthorizables in interface UserManager

Throws:

RepositoryException

See Also:

UserManager.findAuthorizables(String,String, int)

createUser

public User createUser(String userID,
                       String password)
                throws RepositoryException

Specified by:

createUser in interface UserManager

Throws:

RepositoryException

See Also:

UserManager.createUser(String,String)

createUser

public User createUser(String userID,
                       String password,
                       Principal principal,
                       String intermediatePath)
                throws AuthorizableExistsException,
                       RepositoryException

Specified by:

createUser in interface UserManager

Throws:

AuthorizableExistsException

RepositoryException

See Also:

UserManager.createUser(String, String, java.security.Principal, String)

createGroup

public Group createGroup(Principal principal)
                  throws RepositoryException

Same as createGroup(java.security.Principal, String ) where the intermediate path is null.

Specified by:

createGroup in interface UserManager

Throws:

RepositoryException

See Also:

UserManager.createGroup(Principal)

createGroup

public Group createGroup(Principal principal,
                         String intermediatePath)
                  throws AuthorizableExistsException,
                         RepositoryException

Create a new Group from the given principal. It will be created below the defined group path.
Non-existant elements of the Path will be created as nodes of type rep:AuthorizableFolder. The group ID will be generated from the principal name. If the name conflicts with an existing authorizable ID (may happen in cases where principal name != ID) the principal name is expanded by a suffix; otherwise the resulting group ID equals the principal name.

Specified by:

createGroup in interface UserManager

Parameters:

principal - A principal that doesn't yet represent an existing user or group.

intermediatePath - Is always ignored.

Returns:

A new group.

Throws:

AuthorizableExistsException

RepositoryException

See Also:

UserManager.createGroup(java.security.Principal, String)

isAutoSave

public boolean isAutoSave()

Always returns true as by default the autoSave behavior cannot be altered (see also autoSave(boolean).

Specified by:

isAutoSave in interface UserManager

Returns:

Always true.

See Also:

UserManager.isAutoSave()

autoSave

public void autoSave(boolean enable)
              throws UnsupportedRepositoryOperationException,
                     RepositoryException

Always throws unsupportedRepositoryOperationException as modification of the autosave behavior is not supported.

Specified by:

autoSave in interface UserManager

Throws:

UnsupportedRepositoryOperationException

RepositoryException

See Also:

UserManager.autoSave(boolean)

doCreateUser

protected User doCreateUser(NodeImpl node)
                     throws RepositoryException

Build the user object from the given user node. May be overridden to return a custom implementation.

Parameters:

node - user node

Returns:

the user object

Throws:

RepositoryException - if an error occurs

doCreateGroup

protected Group doCreateGroup(NodeImpl node)
                       throws RepositoryException

Build the group object from the given group node. May be overridden to return a custom implementation.

Parameters:

node - group node

Returns:

A group

Throws:

RepositoryException - if an error occurs

loggingOut

public void loggingOut(SessionImpl session)

Description copied from interface: SessionListener

Called when a Session is about to be 'closed' by calling Session.logout()

Specified by:

loggingOut in interface SessionListener

Parameters:

session - the Session that is about to be 'closed'

See Also:

SessionListener.loggingOut(org.apache.jackrabbit.core.SessionImpl)

loggedOut

public void loggedOut(SessionImpl session)

Description copied from interface: SessionListener

Called when a Session has been 'closed' by calling Session.logout()

Specified by:

loggedOut in interface SessionListener

Parameters:

session - the Session that has been 'closed'

See Also:

SessionListener.loggedOut(org.apache.jackrabbit.core.SessionImpl)