1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package org.kuali.rice.kns.web.struts.action;
17
18 import org.apache.commons.lang.StringUtils;
19 import org.apache.struts.action.ActionForm;
20 import org.apache.struts.action.ActionForward;
21 import org.apache.struts.action.ActionMapping;
22 import org.kuali.rice.core.api.config.property.ConfigContext;
23 import org.kuali.rice.core.api.exception.RiceRuntimeException;
24 import org.kuali.rice.coreservice.framework.CoreFrameworkServiceLocator;
25 import org.kuali.rice.kew.api.KewApiConstants;
26 import org.kuali.rice.kim.api.KimConstants;
27 import org.kuali.rice.kim.api.permission.Permission;
28 import org.kuali.rice.kim.api.services.KimApiServiceLocator;
29 import org.kuali.rice.kns.web.struts.form.BackdoorForm;
30 import org.kuali.rice.krad.UserSession;
31 import org.kuali.rice.krad.util.GlobalVariables;
32 import org.kuali.rice.krad.util.KRADConstants;
33
34 import javax.servlet.http.HttpServletRequest;
35 import javax.servlet.http.HttpServletResponse;
36 import java.util.Collections;
37 import java.util.HashMap;
38 import java.util.List;
39 import java.util.Map;
40
41
42
43
44
45
46
47
48
49 @Deprecated
50 public class BackdoorAction extends KualiAction {
51
52 private static final org.apache.log4j.Logger LOG = org.apache.log4j.Logger.getLogger(BackdoorAction.class);
53 private List<Permission> perms;
54
55 @Override
56 public ActionForward execute(ActionMapping mapping, ActionForm form,
57 HttpServletRequest request, HttpServletResponse response)
58 throws Exception {
59 this.initForm(request, form);
60 return super.execute(mapping, form, request, response);
61 }
62
63 public ActionForward menu(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
64 LOG.debug("menu");
65 return mapping.findForward("basic");
66 }
67
68 @Override
69 public ActionForward refresh(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
70 return portal(mapping, form, request, response);
71 }
72
73 public ActionForward start(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
74 LOG.debug("start");
75 return portal(mapping, form, request, response);
76 }
77
78 public ActionForward portal(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception{
79 LOG.debug("portal started");
80 return mapping.findForward("viewPortal");
81 }
82
83 public ActionForward administration(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
84 LOG.debug("administration");
85 return mapping.findForward("administration");
86 }
87
88 public ActionForward logout(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
89 LOG.debug("logout");
90
91 String forward = "viewPortal";
92 UserSession uSession = getUserSession(request);
93
94 if (uSession.isBackdoorInUse()) {
95 uSession.clearBackdoorUser();
96 setFormGroupPermission((BackdoorForm)form, request);
97
98
99 org.kuali.rice.krad.UserSession KnsUserSession;
100 KnsUserSession = GlobalVariables.getUserSession();
101 KnsUserSession.clearBackdoorUser();
102 }
103 else {
104 forward = "logout";
105 }
106
107 return mapping.findForward(forward);
108 }
109
110 public ActionForward login(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
111 LOG.debug("login");
112 UserSession uSession = getUserSession(request);
113 BackdoorForm backdoorForm = (BackdoorForm) form;
114
115 uSession.clearObjectMap();
116
117 if (!isBackdoorAuthorized(uSession, request)) {
118 request.setAttribute("backdoorRestriction", "User " + uSession.getActualPerson().getPrincipalName()
119 + " not permitted to use backdoor functionality inside application: "
120 + ConfigContext.getCurrentContextConfig().getProperty("app.code") + ".");
121 return logout(mapping, form, request, response);
122 }
123
124
125 if (uSession.isBackdoorInUse() &&
126 (StringUtils.isEmpty(backdoorForm.getBackdoorId())
127 || uSession.getLoggedInUserPrincipalName().equals(backdoorForm.getBackdoorId()))) {
128 return logout(mapping, form, request, response);
129 }
130
131 try {
132 uSession.setBackdoorUser(backdoorForm.getBackdoorId());
133 } catch (RiceRuntimeException e) {
134 LOG.warn("invalid backdoor id " + backdoorForm.getBackdoorId(), e);
135
136
137 return mapping.findForward("invalid_backdoor_portal");
138 }
139
140 setFormGroupPermission(backdoorForm, request);
141
142 return mapping.findForward("portal");
143 }
144
145 private void setFormGroupPermission(BackdoorForm backdoorForm, HttpServletRequest request) {
146
147
148 Map<String, String> permissionDetails = new HashMap<String, String>();
149 permissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, KewApiConstants.KEW_NAMESPACE);
150 permissionDetails.put(KimConstants.AttributeConstants.ACTION_CLASS, "org.kuali.rice.kew.web.backdoor.AdministrationAction");
151 boolean isAdmin = KimApiServiceLocator.getPermissionService().isAuthorizedByTemplate(getUserSession(request)
152 .getPrincipalId(), KRADConstants.KNS_NAMESPACE, KimConstants.PermissionTemplateNames.USE_SCREEN,
153 permissionDetails, new HashMap<String, String>());
154 backdoorForm.setIsAdmin(isAdmin);
155 }
156
157 public void initForm(HttpServletRequest request, ActionForm form) throws Exception {
158 BackdoorForm backdoorForm = (BackdoorForm) form;
159
160 Boolean showBackdoorLogin = CoreFrameworkServiceLocator.getParameterService().getParameterValueAsBoolean(KewApiConstants.KEW_NAMESPACE, KRADConstants.DetailTypes.BACKDOOR_DETAIL_TYPE, KewApiConstants.SHOW_BACK_DOOR_LOGIN_IND);
161 backdoorForm.setShowBackdoorLogin(showBackdoorLogin);
162 setFormGroupPermission(backdoorForm, request);
163 if (backdoorForm.getGraphic() != null) {
164 request.getSession().setAttribute("showGraphic", backdoorForm.getGraphic());
165 }
166 }
167
168 public static UserSession getUserSession(HttpServletRequest request) {
169 return GlobalVariables.getUserSession();
170 }
171
172 public boolean isBackdoorAuthorized(UserSession uSession, HttpServletRequest request) {
173 boolean isAuthorized = true;
174
175
176 Map<String, String> permissionDetails = new HashMap<String, String>();
177 String requestAppCode = ConfigContext.getCurrentContextConfig().getProperty("app.code");
178 permissionDetails.put(KimConstants.AttributeConstants.APP_CODE, requestAppCode);
179 List<Permission> perms = KimApiServiceLocator.getPermissionService().findPermissionsByTemplate(
180 KRADConstants.KUALI_RICE_SYSTEM_NAMESPACE, KimConstants.PermissionTemplateNames.BACKDOOR_RESTRICTION);
181 for (Permission kpi : perms) {
182 if (kpi.getAttributes().values().contains(requestAppCode)) {
183
184 isAuthorized = KimApiServiceLocator.getPermissionService().isAuthorizedByTemplate(
185 uSession.getActualPerson().getPrincipalId(), KRADConstants.KUALI_RICE_SYSTEM_NAMESPACE,
186 KimConstants.PermissionTemplateNames.BACKDOOR_RESTRICTION, permissionDetails,
187 Collections.<String, String>emptyMap());
188 }
189 }
190 if (!isAuthorized) {
191 LOG.warn("Attempt to backdoor was made by user: "
192 + uSession.getPerson().getPrincipalId()
193 + " into application with app code: "
194 + requestAppCode
195 + " but they do not have appropriate permissions. Backdoor processing aborted.");
196 }
197 return isAuthorized;
198 }
199 }