org.apache.jackrabbit.core.security.user
Class UserManagerImpl

java.lang.Object
  extended by org.apache.jackrabbit.core.ProtectedItemModifier
      extended by org.apache.jackrabbit.core.security.user.UserManagerImpl
All Implemented Interfaces:
org.apache.jackrabbit.api.security.user.UserManager, SessionListener
Direct Known Subclasses:
UserPerWorkspaceUserManager

public class UserManagerImpl
extends ProtectedItemModifier
implements org.apache.jackrabbit.api.security.user.UserManager, SessionListener

Default implementation of the UserManager interface with the following characteristics:

The built-in logic applies the following rules: Examples: Creating an non-existing user with ID 'aSmith' without specifying an intermediate path would result in the following structure:
 + rep:security            [nt:unstructured]
   + rep:authorizables     [rep:AuthorizableFolder]
     + rep:users           [rep:AuthorizableFolder]
       + a                 [rep:AuthorizableFolder]
         + aS              [rep:AuthorizableFolder]
           + aSmith        [rep:User]
 
Creating a non-existing user with ID 'aSmith' specifying an intermediate path 'some/tree' would result in the following structure:
 + rep:security            [nt:unstructured]
   + rep:authorizables     [rep:AuthorizableFolder]
     + rep:users           [rep:AuthorizableFolder]
       + some              [rep:AuthorizableFolder]
         + tree            [rep:AuthorizableFolder]
           + aSmith        [rep:User]
 
This UserManager is able to handle the following configuration options:


Field Summary
static String AUTHORIZABLES_PATH
           
static String GROUP_ADMIN_GROUP_NAME
          Configuration key and default value for the the name of the 'GroupAdmin' group-principal
static String GROUPS_PATH
           
static org.apache.jackrabbit.spi.Name MIX_REP_IMPERSONATABLE
           
static org.apache.jackrabbit.spi.Name N_MEMBERS
           
static org.apache.jackrabbit.spi.NameFactory NF
           
static org.apache.jackrabbit.spi.Name NT_REP_AUTHORIZABLE
           
static org.apache.jackrabbit.spi.Name NT_REP_AUTHORIZABLE_FOLDER
           
static org.apache.jackrabbit.spi.Name NT_REP_GROUP
           
static org.apache.jackrabbit.spi.Name NT_REP_MEMBERS
           
static org.apache.jackrabbit.spi.Name NT_REP_USER
           
static org.apache.jackrabbit.spi.Name P_DISABLED
           
static org.apache.jackrabbit.spi.Name P_GROUPS
          Deprecated. As of 2.0 group membership is stored with the group node.
static org.apache.jackrabbit.spi.Name P_IMPERSONATORS
          Name of the user property containing the principal names of those allowed to impersonate.
static org.apache.jackrabbit.spi.Name P_MEMBERS
           
static org.apache.jackrabbit.spi.Name P_PASSWORD
           
static org.apache.jackrabbit.spi.Name P_PRINCIPAL_NAME
           
static org.apache.jackrabbit.spi.Name P_USERID
          Deprecated. As of 2.0 the id-hash is stored with the jcr:uuid making the rep:userId property redundant. It has been removed from the node type definition.
static String PARAM_AUTO_EXPAND_SIZE
          This parameter only takes effect if PARAM_AUTO_EXPAND_TREE is enabled.
The default value is 1000.
static String PARAM_AUTO_EXPAND_TREE
          If this parameter is present and its value is true, the trees containing user and group nodes will automatically created additional hierarchy levels if the number of nodes on a given level exceeds the maximal allowed size.
static String PARAM_COMPATIBILE_JR16
          Deprecated. Use PARAM_COMPATIBLE_JR16 instead.
static String PARAM_COMPATIBLE_JR16
          Flag to enable a minimal backwards compatibility with Jackrabbit < v2.0
If the param is present and its value is true looking up authorizables by ID will use the NodeResolver if not found otherwise.
If the parameter is missing (or false) users and groups created with a Jackrabbit repository < v2.0 will not be found any more.
By default this option is disabled.
static String PARAM_DEFAULT_DEPTH
          Parameter used to change the number of levels that are used by default store authorizable nodes.
The default number of levels is 2.
static String PARAM_GROUP_MEMBERSHIP_SPLIT_SIZE
          If this parameter is present group memberships are collected in a node structure below UserConstants.N_MEMBERS instead of the default multi valued property UserConstants.P_MEMBERS.
static String PARAM_GROUPS_PATH
          Configuration option to change the default path for creating groups.
static String PARAM_USERS_PATH
          Configuration option to change the default path for creating users.
static String SECURITY_ROOT_PATH
          root-path to security related content e.g.
static String USER_ADMIN_GROUP_NAME
          Configuration key and default value for the the name of the 'UserAdmin' group-principal.
static String USERS_PATH
           
 
Fields inherited from interface org.apache.jackrabbit.api.security.user.UserManager
SEARCH_TYPE_AUTHORIZABLE, SEARCH_TYPE_GROUP, SEARCH_TYPE_USER
 
Constructor Summary
UserManagerImpl(SessionImpl session, String adminId)
          Create a new UserManager with the default configuration.
UserManagerImpl(SessionImpl session, String adminId, Properties config)
          Create a new UserManager
UserManagerImpl(SessionImpl session, String adminId, Properties config, MembershipCache mCache)
          Create a new UserManager for the given session.
 
Method Summary
 void autoSave(boolean enable)
          Always throws unsupportedRepositoryOperationException as modification of the autosave behavior is not supported.
 org.apache.jackrabbit.api.security.user.Group createGroup(Principal principal)
          Same as createGroup(java.security.Principal, String) where the intermediate path is null.
 org.apache.jackrabbit.api.security.user.Group createGroup(Principal principal, String intermediatePath)
          Same as createGroup(String, Principal, String) where a groupID is generated from the principal name.
 org.apache.jackrabbit.api.security.user.Group createGroup(String groupID)
           
 org.apache.jackrabbit.api.security.user.Group createGroup(String groupID, Principal principal, String intermediatePath)
          Create a new Group from the given groupID and principal.
 org.apache.jackrabbit.api.security.user.User createUser(String userID, String password)
           
 org.apache.jackrabbit.api.security.user.User createUser(String userID, String password, Principal principal, String intermediatePath)
           
protected  org.apache.jackrabbit.api.security.user.Group doCreateGroup(NodeImpl node)
          Build the group object from the given group node.
protected  org.apache.jackrabbit.api.security.user.User doCreateUser(NodeImpl node)
          Build the user object from the given user node.
 Iterator<org.apache.jackrabbit.api.security.user.Authorizable> findAuthorizables(org.apache.jackrabbit.api.security.user.Query query)
           
 Iterator<org.apache.jackrabbit.api.security.user.Authorizable> findAuthorizables(String relPath, String value)
           
 Iterator<org.apache.jackrabbit.api.security.user.Authorizable> findAuthorizables(String relPath, String value, int searchType)
           
 org.apache.jackrabbit.api.security.user.Authorizable getAuthorizable(Principal principal)
           
 org.apache.jackrabbit.api.security.user.Authorizable getAuthorizable(String id)
           
 org.apache.jackrabbit.api.security.user.Authorizable getAuthorizableByPath(String path)
          Always throws UnsupportedRepositoryOperationException since this implementation of the user management API does not allow to retrieve the path of an authorizable.
 int getGroupMembershipSplitSize()
          Maximum number of properties on the group membership node structure under UserConstants.N_MEMBERS until additional intermediate nodes are inserted.
 String getGroupsPath()
          Implementation specific methods revealing where groups are created within the content.
 MembershipCache getMembershipCache()
           
 String getUsersPath()
          Implementation specific methods revealing where users are created within the content.
 boolean isAutoSave()
          Always returns true as by default the autoSave behavior cannot be altered (see also autoSave(boolean).
 void loggedOut(SessionImpl session)
          Called when a Session has been 'closed' by calling Session.logout()
 void loggingOut(SessionImpl session)
          Called when a Session is about to be 'closed' by calling Session.logout()
 void setAuthorizableActions(AuthorizableAction[] authorizableActions)
          Set the authorizable actions that will be invoked upon authorizable creation and removal.
 
Methods inherited from class org.apache.jackrabbit.core.ProtectedItemModifier
addNode, addNode, markModified, performProtected, removeItem, setProperty, setProperty, setProperty, setProperty
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

PARAM_USERS_PATH

public static final String PARAM_USERS_PATH
Configuration option to change the default path for creating users.

See Also:
Constant Field Values

PARAM_GROUPS_PATH

public static final String PARAM_GROUPS_PATH
Configuration option to change the default path for creating groups.

See Also:
Constant Field Values

PARAM_COMPATIBILE_JR16

public static final String PARAM_COMPATIBILE_JR16
Deprecated. Use PARAM_COMPATIBLE_JR16 instead.
See Also:
Constant Field Values

PARAM_COMPATIBLE_JR16

public static final String PARAM_COMPATIBLE_JR16
Flag to enable a minimal backwards compatibility with Jackrabbit < v2.0
If the param is present and its value is true looking up authorizables by ID will use the NodeResolver if not found otherwise.
If the parameter is missing (or false) users and groups created with a Jackrabbit repository < v2.0 will not be found any more.
By default this option is disabled.

See Also:
Constant Field Values

PARAM_DEFAULT_DEPTH

public static final String PARAM_DEFAULT_DEPTH
Parameter used to change the number of levels that are used by default store authorizable nodes.
The default number of levels is 2.

NOTE: Changing the default depth once users and groups have been created in the repository will cause inconsistencies, due to the fact that the resolution of ID to an authorizable relies on the structure defined by the default depth.
It is recommended to remove all authorizable nodes that will not be reachable any more, before this config option is changed.

See Also:
Constant Field Values

PARAM_AUTO_EXPAND_TREE

public static final String PARAM_AUTO_EXPAND_TREE
If this parameter is present and its value is true, the trees containing user and group nodes will automatically created additional hierarchy levels if the number of nodes on a given level exceeds the maximal allowed size.
By default this option is disabled.

See Also:
Constant Field Values

PARAM_AUTO_EXPAND_SIZE

public static final String PARAM_AUTO_EXPAND_SIZE
This parameter only takes effect if PARAM_AUTO_EXPAND_TREE is enabled.
The default value is 1000.

See Also:
Constant Field Values

PARAM_GROUP_MEMBERSHIP_SPLIT_SIZE

public static final String PARAM_GROUP_MEMBERSHIP_SPLIT_SIZE
If this parameter is present group memberships are collected in a node structure below UserConstants.N_MEMBERS instead of the default multi valued property UserConstants.P_MEMBERS. Its value determines the maximum number of member properties until additional intermediate nodes are inserted. Valid values are integers > 4.

See Also:
Constant Field Values

NF

public static final org.apache.jackrabbit.spi.NameFactory NF

SECURITY_ROOT_PATH

public static final String SECURITY_ROOT_PATH
root-path to security related content e.g. principals

See Also:
Constant Field Values

AUTHORIZABLES_PATH

public static final String AUTHORIZABLES_PATH
See Also:
Constant Field Values

USERS_PATH

public static final String USERS_PATH
See Also:
Constant Field Values

GROUPS_PATH

public static final String GROUPS_PATH
See Also:
Constant Field Values

USER_ADMIN_GROUP_NAME

public static final String USER_ADMIN_GROUP_NAME
Configuration key and default value for the the name of the 'UserAdmin' group-principal.

See Also:
Constant Field Values

GROUP_ADMIN_GROUP_NAME

public static final String GROUP_ADMIN_GROUP_NAME
Configuration key and default value for the the name of the 'GroupAdmin' group-principal

See Also:
Constant Field Values

P_PRINCIPAL_NAME

public static final org.apache.jackrabbit.spi.Name P_PRINCIPAL_NAME

P_USERID

public static final org.apache.jackrabbit.spi.Name P_USERID
Deprecated. As of 2.0 the id-hash is stored with the jcr:uuid making the rep:userId property redundant. It has been removed from the node type definition.

P_PASSWORD

public static final org.apache.jackrabbit.spi.Name P_PASSWORD

P_DISABLED

public static final org.apache.jackrabbit.spi.Name P_DISABLED

P_GROUPS

public static final org.apache.jackrabbit.spi.Name P_GROUPS
Deprecated. As of 2.0 group membership is stored with the group node.
See Also:
P_MEMBERS

P_MEMBERS

public static final org.apache.jackrabbit.spi.Name P_MEMBERS

N_MEMBERS

public static final org.apache.jackrabbit.spi.Name N_MEMBERS

P_IMPERSONATORS

public static final org.apache.jackrabbit.spi.Name P_IMPERSONATORS
Name of the user property containing the principal names of those allowed to impersonate.


NT_REP_AUTHORIZABLE

public static final org.apache.jackrabbit.spi.Name NT_REP_AUTHORIZABLE

NT_REP_AUTHORIZABLE_FOLDER

public static final org.apache.jackrabbit.spi.Name NT_REP_AUTHORIZABLE_FOLDER

NT_REP_USER

public static final org.apache.jackrabbit.spi.Name NT_REP_USER

NT_REP_GROUP

public static final org.apache.jackrabbit.spi.Name NT_REP_GROUP

NT_REP_MEMBERS

public static final org.apache.jackrabbit.spi.Name NT_REP_MEMBERS

MIX_REP_IMPERSONATABLE

public static final org.apache.jackrabbit.spi.Name MIX_REP_IMPERSONATABLE
Constructor Detail

UserManagerImpl

public UserManagerImpl(SessionImpl session,
                       String adminId)
                throws RepositoryException
Create a new UserManager with the default configuration.

Parameters:
session - The editing/reading session.
adminId - The user ID of the administrator.
Throws:
RepositoryException - If an error occurs.

UserManagerImpl

public UserManagerImpl(SessionImpl session,
                       String adminId,
                       Properties config)
                throws RepositoryException
Create a new UserManager

Parameters:
session - The editing/reading session.
adminId - The user ID of the administrator.
config - The configuration parameters.
Throws:
RepositoryException - If an error occurs.

UserManagerImpl

public UserManagerImpl(SessionImpl session,
                       String adminId,
                       Properties config,
                       MembershipCache mCache)
                throws RepositoryException
Create a new UserManager for the given session. Currently the following configuration options are respected: See the overall introduction for details.

Parameters:
session - The editing/reading session.
adminId - The user ID of the administrator.
config - The configuration parameters.
mCache - Shared membership cache.
Throws:
RepositoryException - If an error occurs.
Method Detail

getUsersPath

public String getUsersPath()
Implementation specific methods revealing where users are created within the content.

Returns:
root path for user content.
See Also:
For the corresponding configuration parameter.

getGroupsPath

public String getGroupsPath()
Implementation specific methods revealing where groups are created within the content.

Returns:
root path for group content.
See Also:
For the corresponding configuration parameter.

getMembershipCache

public MembershipCache getMembershipCache()
Returns:
The membership cache present with this user manager instance.

getGroupMembershipSplitSize

public int getGroupMembershipSplitSize()
Maximum number of properties on the group membership node structure under UserConstants.N_MEMBERS until additional intermediate nodes are inserted. If 0 (default), UserConstants.P_MEMBERS is used to record group memberships.

Returns:
The maximum number of group members before splitting up the structure.

setAuthorizableActions

public void setAuthorizableActions(AuthorizableAction[] authorizableActions)
Set the authorizable actions that will be invoked upon authorizable creation and removal.

Parameters:
authorizableActions - An array of authorizable actions.

getAuthorizable

public org.apache.jackrabbit.api.security.user.Authorizable getAuthorizable(String id)
                                                                     throws RepositoryException
Specified by:
getAuthorizable in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.getAuthorizable(String)

getAuthorizable

public org.apache.jackrabbit.api.security.user.Authorizable getAuthorizable(Principal principal)
                                                                     throws RepositoryException
Specified by:
getAuthorizable in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.getAuthorizable(Principal)

getAuthorizableByPath

public org.apache.jackrabbit.api.security.user.Authorizable getAuthorizableByPath(String path)
                                                                           throws UnsupportedRepositoryOperationException,
                                                                                  RepositoryException
Always throws UnsupportedRepositoryOperationException since this implementation of the user management API does not allow to retrieve the path of an authorizable.

Specified by:
getAuthorizableByPath in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
UnsupportedRepositoryOperationException
RepositoryException
See Also:
UserManager.getAuthorizableByPath(String)

findAuthorizables

public Iterator<org.apache.jackrabbit.api.security.user.Authorizable> findAuthorizables(String relPath,
                                                                                        String value)
                                                                                 throws RepositoryException
Specified by:
findAuthorizables in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.findAuthorizables(String,String)

findAuthorizables

public Iterator<org.apache.jackrabbit.api.security.user.Authorizable> findAuthorizables(String relPath,
                                                                                        String value,
                                                                                        int searchType)
                                                                                 throws RepositoryException
Specified by:
findAuthorizables in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.findAuthorizables(String,String, int)

findAuthorizables

public Iterator<org.apache.jackrabbit.api.security.user.Authorizable> findAuthorizables(org.apache.jackrabbit.api.security.user.Query query)
                                                                                 throws RepositoryException
Specified by:
findAuthorizables in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.findAuthorizables(Query)

createUser

public org.apache.jackrabbit.api.security.user.User createUser(String userID,
                                                               String password)
                                                        throws RepositoryException
Specified by:
createUser in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.createUser(String,String)

createUser

public org.apache.jackrabbit.api.security.user.User createUser(String userID,
                                                               String password,
                                                               Principal principal,
                                                               String intermediatePath)
                                                        throws org.apache.jackrabbit.api.security.user.AuthorizableExistsException,
                                                               RepositoryException
Specified by:
createUser in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
org.apache.jackrabbit.api.security.user.AuthorizableExistsException
RepositoryException
See Also:
UserManager.createUser(String, String, java.security.Principal, String)

createGroup

public org.apache.jackrabbit.api.security.user.Group createGroup(String groupID)
                                                          throws org.apache.jackrabbit.api.security.user.AuthorizableExistsException,
                                                                 RepositoryException
Specified by:
createGroup in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
org.apache.jackrabbit.api.security.user.AuthorizableExistsException
RepositoryException
See Also:
UserManager.createGroup(String)

createGroup

public org.apache.jackrabbit.api.security.user.Group createGroup(Principal principal)
                                                          throws RepositoryException
Same as createGroup(java.security.Principal, String) where the intermediate path is null.

Specified by:
createGroup in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
RepositoryException
See Also:
UserManager.createGroup(Principal)

createGroup

public org.apache.jackrabbit.api.security.user.Group createGroup(Principal principal,
                                                                 String intermediatePath)
                                                          throws org.apache.jackrabbit.api.security.user.AuthorizableExistsException,
                                                                 RepositoryException
Same as createGroup(String, Principal, String) where a groupID is generated from the principal name. If the name conflicts with an existing authorizable ID (may happen in cases where principal name != ID) the principal name is expanded by a suffix; otherwise the resulting group ID equals the principal name.

Specified by:
createGroup in interface org.apache.jackrabbit.api.security.user.UserManager
Parameters:
principal - A principal that doesn't yet represent an existing user or group.
intermediatePath - Is always ignored.
Returns:
A new group.
Throws:
org.apache.jackrabbit.api.security.user.AuthorizableExistsException
RepositoryException
See Also:
UserManager.createGroup(java.security.Principal, String)

createGroup

public org.apache.jackrabbit.api.security.user.Group createGroup(String groupID,
                                                                 Principal principal,
                                                                 String intermediatePath)
                                                          throws org.apache.jackrabbit.api.security.user.AuthorizableExistsException,
                                                                 RepositoryException
Create a new Group from the given groupID and principal. It will be created below the defined group path.
Non-existent elements of the Path will be created as nodes of type rep:AuthorizableFolder.

Specified by:
createGroup in interface org.apache.jackrabbit.api.security.user.UserManager
Parameters:
groupID - A groupID that hasn't been used before for another user or group.
principal - A principal that doesn't yet represent an existing user or group.
intermediatePath - Is always ignored.
Returns:
A new group.
Throws:
org.apache.jackrabbit.api.security.user.AuthorizableExistsException
RepositoryException
See Also:
UserManager.createGroup(String, java.security.Principal, String)

isAutoSave

public boolean isAutoSave()
Always returns true as by default the autoSave behavior cannot be altered (see also autoSave(boolean).

Specified by:
isAutoSave in interface org.apache.jackrabbit.api.security.user.UserManager
Returns:
Always true.
See Also:
UserManager.isAutoSave()

autoSave

public void autoSave(boolean enable)
              throws UnsupportedRepositoryOperationException,
                     RepositoryException
Always throws unsupportedRepositoryOperationException as modification of the autosave behavior is not supported.

Specified by:
autoSave in interface org.apache.jackrabbit.api.security.user.UserManager
Throws:
UnsupportedRepositoryOperationException
RepositoryException
See Also:
UserManager.autoSave(boolean)

doCreateUser

protected org.apache.jackrabbit.api.security.user.User doCreateUser(NodeImpl node)
                                                             throws RepositoryException
Build the user object from the given user node. May be overridden to return a custom implementation.

Parameters:
node - user node
Returns:
the user object
Throws:
RepositoryException - if an error occurs

doCreateGroup

protected org.apache.jackrabbit.api.security.user.Group doCreateGroup(NodeImpl node)
                                                               throws RepositoryException
Build the group object from the given group node. May be overridden to return a custom implementation.

Parameters:
node - group node
Returns:
A group
Throws:
RepositoryException - if an error occurs

loggingOut

public void loggingOut(SessionImpl session)
Description copied from interface: SessionListener
Called when a Session is about to be 'closed' by calling Session.logout()
Specified by:
loggingOut in interface SessionListener
Parameters:
session - the Session that is about to be 'closed'
See Also:
SessionListener.loggingOut(org.apache.jackrabbit.core.SessionImpl)

loggedOut

public void loggedOut(SessionImpl session)
Description copied from interface: SessionListener
Called when a Session has been 'closed' by calling Session.logout()
Specified by:
loggedOut in interface SessionListener
Parameters:
session - the Session that has been 'closed'
See Also:
SessionListener.loggedOut(org.apache.jackrabbit.core.SessionImpl)


Copyright © 2004-2012 The Apache Software Foundation. All Rights Reserved.