1+ """
2+ Copyright (c) 2021, Oracle Corporation and/or its affiliates.
3+ Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
4+ """
5+ import com .bea .common .security .utils .encoders .BASE64Encoder as BASE64Encoder
6+ import com .bea .security .xacml .cache .resource .ResourcePolicyIdUtil as ResourcePolicyIdUtil
7+ from java .io import File
8+ from java .lang import String
9+
10+ import oracle .weblogic .deploy .aliases .TypeUtils as TypeUtils
11+
12+ from wlsdeploy .aliases .model_constants import DESCRIPTION
13+ from wlsdeploy .aliases .model_constants import GROUP
14+ from wlsdeploy .aliases .model_constants import GROUP_MEMBER_OF
15+ from wlsdeploy .aliases .model_constants import PASSWORD
16+ from wlsdeploy .aliases .model_constants import USER
17+ from wlsdeploy .exception import exception_helper
18+ from wlsdeploy .logging .platform_logger import PlatformLogger
19+ from wlsdeploy .tool .util .targets import file_template_helper
20+ from wlsdeploy .util import dictionary_utils
21+ from wlsdeploy .util .weblogic_helper import WebLogicHelper
22+
23+ TEMPLATE_PATH = 'oracle/weblogic/deploy/security'
24+ DEFAULT_AUTH_INIT_FILE = 'DefaultAuthenticatorInit.ldift'
25+ SECURITY_SUBDIR = 'security'
26+ GROUP_MAPPINGS = 'group'
27+ USER_MAPPINGS = 'user'
28+
29+ # template hash constants
30+ HASH_NAME = 'name'
31+ HASH_DESCRIPTION = 'description'
32+ HASH_GROUPS = 'groups'
33+ HASH_GROUP = 'groupMemberOf'
34+ HASH_USER_PASSWORD = 'password'
35+
36+
37+ class DefaultAuthenticatorHelper (object ):
38+ """
39+ This class is used to write the Security Group and User data into the ldift file. The reason is
40+ that there are several issues that are broken in offline, while they work in online. This works
41+ around these problems.
42+ """
43+ _class_name = 'DefaultAuthenticatorHelper'
44+
45+ def __init__ (self , model_context , exception_type ):
46+ self ._model_context = model_context
47+ self ._exception_type = exception_type
48+ self ._logger = PlatformLogger ('wlsdeploy.tool.util' )
49+ self ._weblogic_helper = WebLogicHelper (self ._logger )
50+ self ._resource_escaper = ResourcePolicyIdUtil .getEscaper ()
51+ self ._b64_encoder = BASE64Encoder ()
52+
53+ def create_default_init_file (self , security_mapping_nodes ):
54+ """
55+ Use the security information to write user/groups to the DefaultAuthenticatorInit.ldift file.
56+ This file must exist before writing the data. Build a hash map from the model data and
57+ append to the file using the template file for structure.
58+ :param security_mapping_nodes: the Security elements from the model
59+ """
60+ _method_name = 'create_default_init_file'
61+
62+ template_hash = self ._build_default_template_hash (security_mapping_nodes )
63+ template_path = TEMPLATE_PATH + '/' + DEFAULT_AUTH_INIT_FILE
64+
65+ output_dir = File (self ._model_context .get_domain_home (), SECURITY_SUBDIR )
66+ output_file = File (output_dir , DEFAULT_AUTH_INIT_FILE )
67+
68+ self ._logger .info ('WLSDPLY-01900' , output_file , class_name = self ._class_name , method_name = _method_name )
69+
70+ file_template_helper .append_file_from_resource (template_path , template_hash , output_file , self ._exception_type )
71+
72+ def _build_default_template_hash (self , mapping_section_nodes ):
73+ """
74+ Create a dictionary of substitution values to apply to the default authenticator template.
75+ :param mapping_section_nodes: the security elements from the model
76+ :return: the template hash dictionary
77+ """
78+ template_hash = dict ()
79+
80+ group_mappings = []
81+ user_mappings = []
82+
83+ if GROUP in mapping_section_nodes .keys ():
84+ group_mapping_nodes = mapping_section_nodes [GROUP ]
85+ for name in group_mapping_nodes :
86+ mapping_hash = self ._build_group_mapping_hash (group_mapping_nodes [name ], name )
87+ group_mappings .append (mapping_hash )
88+ if USER in mapping_section_nodes .keys ():
89+ user_mapping_nodes = mapping_section_nodes [USER ]
90+ for name in user_mapping_nodes :
91+ mapping_hash = self ._build_user_mapping_hash (user_mapping_nodes [name ], name )
92+ user_mappings .append (mapping_hash )
93+
94+ template_hash [GROUP_MAPPINGS ] = group_mappings
95+ template_hash [USER_MAPPINGS ] = user_mappings
96+ print '****** template hash ' , template_hash
97+ return template_hash
98+
99+ def _build_group_mapping_hash (self , group_mapping_section , name ):
100+ """
101+ Build a template hash for the specified mapping element from the model.
102+ :param group_mapping_section: the security group entry from the model
103+ :param name: The name of the group
104+ :return: the template hash
105+ """
106+ hash_entry = dict ()
107+ hash_entry [HASH_NAME ] = name
108+ group_attributes = group_mapping_section
109+ description = dictionary_utils .get_element (group_attributes , DESCRIPTION )
110+ hash_entry [HASH_DESCRIPTION ] = description
111+ groups = dictionary_utils .get_element (group_attributes , GROUP_MEMBER_OF )
112+ group_list = []
113+ group_mappings = list ()
114+ if groups is not None :
115+ group_list = TypeUtils .convertToType ('list' , groups )
116+ for group in group_list :
117+ group_mappings .append ({HASH_GROUP : group })
118+ hash_entry [HASH_GROUPS ] = group_mappings
119+ else :
120+ hash_entry [HASH_GROUPS ] = group_list
121+
122+ return hash_entry
123+
124+ def _build_user_mapping_hash (self , user_mapping_section , name ):
125+ """
126+ Build a template hash map from the security user data from the model.
127+ This includes encoding the required password.
128+ :param user_mapping_section: The security user section from the model
129+ :param name: name of the user for the user section
130+ :return: template hash map
131+ """
132+ hash_entry = dict ()
133+ hash_entry [HASH_NAME ] = name
134+ group_attributes = user_mapping_section
135+ description = dictionary_utils .get_element (group_attributes , DESCRIPTION )
136+ hash_entry [HASH_DESCRIPTION ] = description
137+ groups = dictionary_utils .get_element (group_attributes , GROUP_MEMBER_OF )
138+ password = self ._get_required_attribute (user_mapping_section , PASSWORD , USER , name )
139+ encrypted = self ._weblogic_helper .encrypt (password , self ._model_context .get_domain_home ())
140+ password_encoded = self ._b64_encoder .encodeBuffer (String (encrypted ).getBytes ("UTF-8" ))
141+ hash_entry [HASH_USER_PASSWORD ] = password_encoded
142+ group_list = []
143+ group_mappings = list ()
144+ if groups is not None :
145+ group_list = TypeUtils .convertToType ('list' , groups )
146+ for group in group_list :
147+ group_mappings .append ({HASH_GROUP : group })
148+ hash_entry [HASH_GROUPS ] = group_mappings
149+ else :
150+ hash_entry [HASH_GROUPS ] = group_list
151+
152+ return hash_entry
153+
154+ def _get_required_attribute (self , dictionary , name , mapping_type , mapping_name ):
155+ """
156+ Return the value of the specified attribute from the specified dictionary.
157+ Log and throw an exception if the attribute is not found.
158+ :param dictionary: the dictionary to be checked
159+ :param name: the name of the attribute to find
160+ :param mapping_type: the type of the mapping, such as 'CrossDomain'
161+ :param mapping_name: the mapping name from the model, such as 'map1'
162+ :return: the value of the attribute
163+ :raises: Tool type exception: if an the attribute is not found
164+ """
165+ _method_name = '_get_required_attribute'
166+
167+ result = dictionary_utils .get_element (dictionary , name )
168+ if result is None :
169+ pwe = exception_helper .create_exception (self ._exception_type , '-01791' , name , mapping_type ,
170+ mapping_name )
171+ self ._logger .throwing (class_name = self ._class_name , method_name = _method_name , error = pwe )
172+ raise pwe
173+ return result
0 commit comments