Mon, June13, 2005 uPortal Conference, Baltimore, MD Dan Ellentuck, Columbia University Configuring...

Mon, June13, 2005uPortal Conference, Baltimore, MD

Dan Ellentuck, Columbia University

Configuring uPortal Groups and Permissions


Agenda

• Rationale and functions• Service structure• Composite Group Service configuration• Group service components configuration• Common services configuration• Permission service configuration• GAP Managers


Overview

Configuration for

uPortal 2.4+ Possible to backport to uPortal 2.1+

Not applicable:

uPortal 3

Also note significant changes for uPortal 2.6


Requirements

• Need for authorization• Role-based• Use widely-dispersed information• Model complex organization• Granular permissions


AuthZ Functions in uPortal

3 Flavors:

• Framework• Individual Channels• Portlets



Framework

Protect portal functions and content:

Access to publishing.

Right to subscribe/render a channel.



Individual Channels

Protect functions and content private to the channel:

Must be an org.jasig.portal.IChannel.

Announcements Channel: Create Topic and Delete Announcement. Groups Manager Channel: Create, Delete, Select a specific group.



Portlets

Protect functions and content via isUserInRole()

See: org.jasig.portal.container.servlet.ServletRequestImpl

.isUserInRole(String role)

Translates role and role-reference group key


Group Functions in uPortal

Separation of concerns:• Group membership• Authorization

Current Responsibilities:• Supply user roles for authorization• Categorize portal entities (channel categories)• Customize content (AL, DL)


Agenda

• Rationale and functions• Service structure• Common services configuration• Composite Group Service

configuration• Group service components

configuration• Permission service configuration• GAP Managers


GAP Service Dependencies

uPortal services

Entity TypesGAP common

services

Properties

JDK + supporting libs

XML libsCommonsJDK etc…

RDBM Sequence etc…

Caching Locking

GAP servicesGroups

Permissions


Group Service facade

Service api (simplified):

{

public IEntityGroup findGroup(String key);

public IEntity getEntity(String key, Class type);

public IEntityGroup newGroup(Class type, String serviceName);

public EntityIdentifier[] searchForEntities(String query, int method, Class type);

public EntityIdentifier[] searchForGroups(String query, int method, Class leaftype);

}


Authorization service façade

3 separate façades:

• AuthorizationPrincipal• PermissionsManager• UpdatingPermissionsManager



IAuthorizationPrincipal• Represents a user or group• Service api (simplified):

{

public IPermission[] getAllPermissions();

public IPermission[] getPermissions();

public boolean hasPermission(String owner, String activity, String target);

public boolean hasPermission(String owner, String activity,

String target, IPermissionPolicy policy);

}



IPermissionManager• Represents a read-only application • Service api (simplified):

{

public IPermission[] getAllPermissions(IAuthorizationPrincipal principal,

String activity, String target);

public IAuthorizationPrincipal[] getAuthorizedPrincipals(String activity,

String target);

public IPermission[] getPermissions(String activity, String target);

public IPermission[] getPermissions(IAuthorizationPrincipal principal,

String activity, String target);

}



IUpdatingPermissionManager

• Represents an updating application• Extends IPermissionManager• Service api (simplified):

{

public void addPermissions(IPermission[] permissions);

public IPermission newPermission(IAuthorizationPrincipal principal);

public void removePermissions(IPermission[] permissions);

public void updatePermissions(IPermission[] permissions);

}


Agenda

• Rationale and functions• Service structure• Composite Group Service

configuration• Common services configuration• Group service components

configuration• Permission service configuration• GAP Managers


Composite Group Service

uPortal

Person Directory


component “local”

Group 0 {local.1, dan, ben}

Group 1 {local.n, pags.1, ben}

…

Group n {…}

component “pags”

Group 0 {pags.1, pags.n}

Group 1 {…}

..

Group n {…}

component “other”

Group A {other.B, other.C}

Group B {don, pete}

Group C {…}

Group Service clients

GAP common services

other source

uPortal db



compositeGroupServices.xml…

<servicelist

defaultService="local

"compositeFactory="org.jasig.portal…">

<service>

<name>local</name>

<service_factory>org.jasig...etc</service_factory>

<entity_store_factory>org.jasig...etc</entity_store_factory>

<group_store_factory>org.jasig...etc</group_store_factory>

<entity_searcher_factory>org.jasig...etc</entity_searcher_factory>

<internally_managed>true</internally_managed>

<caching_enabled>true</caching_enabled>

</service>

<service>

<name>pags</name>

<service_factory>org.jasig...etc</service_factory>

<entity_store_factory>org.jasig...etc</entity_store_factory>

<group_store_factory>org.jasig...etc</group_store_factory>

<entity_searcher_factory>org.jasig...etc</entity_searcher_factory>

<internally_managed>false</internally_managed>

<caching_enabled>true</caching_enabled>

</service>

...

</servicelist>


component “local”

Group 0 {local.1, dan, ben}

Group 1 {local.n, pags.1, ben}

…

Group n {…}

component “pags”

Group 0 {pags.1, pags.n}

Group 1 {…}

..

Group n {…}

component “other”

Group A {other.B, other.C}

Group B {don, pete}

Group C {…}



Component Service Descriptor

<service>

<name>local</name>

<service_factory> org.jasig.portal.groups.ReferenceIndividualGroupServiceFactory </service_factory>

<entity_store_factory> org.jasig.portal.groups.ReferenceEntityStoreFactory </entity_store_factory>

<group_store_factory> org.jasig.portal.groups.ReferenceEntityGroupStoreFactory </group_store_factory>

<entity_searcher_factory> org.jasig.portal.groups.ReferenceEntitySearcherFactory </entity_searcher_factory>

<internally_managed>true</internally_managed> <caching_enabled>true</caching_enabled>

</service>



Interface for IEntityGroupStore

{

public boolean contains(IEntityGroup group, IGroupMember member);

public void delete(IEntityGroup group);

public IEntityGroup find(String key);

public Iterator findContainingGroups(IGroupMember gm);

public Iterator findEntitiesForGroup(IEntityGroup group);

public ILockableEntityGroup findLockable(String key);

public String[] findMemberGroupKeys(IEntityGroup group);

public Iterator findMemberGroups(IEntityGroup group);

public IEntityGroup newInstance(Class entityType);

public EntityIdentifier[] searchForGroups

(String query, int method, Class leaftype);

public void update(IEntityGroup group);

public void updateMembers(IEntityGroup group);

}



Component Service Descriptor

<service>

<name>local</name>

<service_factory> org.jasig.portal.groups.ReferenceIndividualGroupServiceFactory </service_factory>

<entity_store_factory> org.jasig.portal.groups.ReferenceEntityStoreFactory </entity_store_factory>

<group_store_factory> org.jasig.portal.groups.ReferenceEntityGroupStoreFactory </group_store_factory>

<entity_searcher_factory> org.jasig.portal.groups.ReferenceEntitySearcherFactory </entity_searcher_factory>

<internally_managed>true</internally_managed> <caching_enabled>true</caching_enabled>

</service>



Interface for READ-ONLY IEntityGroupStore

{

public boolean contains(IEntityGroup group, IGroupMember member);

public IEntityGroup find(String key);

public Iterator findContainingGroups(IGroupMember gm);

public Iterator findEntitiesForGroup(IEntityGroup group);

public String[] findMemberGroupKeys(IEntityGroup group);

public Iterator findMemberGroups(IEntityGroup group);

public EntityIdentifier[] searchForGroups

(String query, int method, Class leaftype);

}


Agenda

• Rationale and functions• Service structure• CompositeGroupService


configuration• Common services configuration• Permission service configuration• GAP Managers


Group components configuration

Available in baseline uPortal:• Local• PAGS• Filesystem• LDAP

Locally developed:• JitLDAP (University of Calgary, Matthew Ling)• SQL (Columbia University)



Common Conventions:• Config files in properties/groups• Xml document w/ <group-store> and <group> elements• <group> element contains membership rules• Except for local, READ-ONLY



“local” group service• In portal db• No configuration required• Supports read-write access



Person Attribute Group Service (“PAGS”)• Client of Person Directory• Tests value of IPerson attributes• Testers include String, regex comparisons• Tests can be combined with operators AND, OR• Read-Only (but will be updatable in 2.6)



Person Attribute Group Service (“PAGS”) <group> <group-key>2</group-key> <group-name>Short First Names</group-name> <group-description> Portal users whose first names are between 1 and 5 characters long </group-description> <selection-test> <test-group> <test> <attribute-name>givenName</attribute-name> <tester-class>org.jasig.portal.groups.pags.testers.RegexTester</tester-class> <test-value>^.{1,5}$</test-value> </test> </test-group> </selection-test> <members> <member-key>3</member-key> </members> </group>



Filesystem Group Service• Groups are files and directories• Read-only• Files contain lists of member keys• Component Service descriptor:

<service groupsRoot="C:/groups">

<name>filesystem</name>

<service_factory>...</service_factory>

<entity_store_factory>...</entity_store_factory>

<group_store_factory>...</group_store_factory>

<entity_searcher_factory>...</entity_searcher_factory>

<internally_managed>false</internally_managed>

<caching_enabled>false</caching_enabled>

</service>



Entity-testing vs. Group-testingGroup-testing (filesystem)

Tom

Paul

Mary

/mydir/.../myGroup

filesystem.myGroup.getMembers()

returns {Tom, Paul, Mary}



Entity-testing vs. Group-testing

Entity-testing (PAGS)

<group> <group-key>myGroup</group-key> <group-name>PAGS Test Users</group-name> <group-description> Users whose user names equal Tom, Paul or Mary </group-description> <selection-test> <test-group> <test> <attribute-name>uid</attribute-name> <tester-class> org.jasig.portal.groups.pags.testers.RegexTester </tester-class> <test-value>Tom|Paul|Mary</test-value> </test> </test-group> </selection-test> </group>

PAGS.myGroup.getMembers()

returns {}


Agenda





Common Service configuration

Concurrency properties:

portal.properties

. . .

# Concurrency Services settings:## multiServer (true/false) indicates if the portal will run in multiple jvms.## clockTolerance (in milliseconds) sets a fudge factor to account for system clocks# on different hosts. Only used when org.jasig.portal.concurrency.multiServer=true.## Defaults: multiServer=false# clockTolerance=5000#org.jasig.portal.concurrency.multiServer=falseorg.jasig.portal.concurrency.clockTolerance=5000



Multi-Server=true/false

• Entity locks in memory/in db• Cache invalidations



Locking properties:

portal.properties

. . .

# Entity Lock Service settings:

#

# * defaultLockDuration sets the default lock duration in seconds. Locks can also be

# requested for specific durations.

#

# Defaults: defaultLockDuration=300

#

org.jasig.portal.concurrency.IEntityLockServiceFactory=org.jasig.portal.concurrency.

locking.ReferenceEntityLockServiceFactory

org.jasig.portal.concurrency.IEntityLockService.defaultLockDuration=300



Caching properties:

portal.properties

. . .

# Entity Caching Service settings:

#

# * defaultMaxCacheSize - the default value for maximum number of entries in a

# cache.

# * defaultSweepInterval - the default value in seconds for the interval between

# cache sweeps.

# * defaultMaxIdleTime - the default value in seconds for the time after which a

# cache entry may be purged if it has not been accessed.

#

#

org.jasig.portal.concurrency.IEntityCachingService.defaultMaxCacheSize=1000

org.jasig.portal.concurrency.IEntityCachingService.defaultSweepInterval=60

org.jasig.portal.concurrency.IEntityCachingService.defaultMaxIdleTime=1800


Agenda





Permission service configuration

2 ways to configure:

• Custom permissions policy• Permissions store


Permission Service Configuration

Service configuration:

portal.properties

. . .

# Authorization Service settings:

#

# * IPermissionStore.implementation is the permission store.

# * IPermissionPolicy.defaultImplementation is the permission policy used when not

# overridden at runtime (see IAuthorizationPrincipal.hasPermission()).

# * IAuthorizationService.cachePermissions sets if permissions will be cached by

# the entity caching service. (Default=true).

#

org.jasig.portal.security.IPermissionStore.implementation=

org.jasig.portal.security.provider.RDBMPermissionImplorg.jasig.portal.security.IPermissionPolicy.defaultImplementation=

org.jasig.portal.security.provider.DefaultPermissionPolicy

org.jasig.portal.security.IAuthorizationService.cachePermissions=true


Permission Service Configuration

IPermissionPolicy interface

• Alternate default permission policy• Overloaded IAuthorizationPrincipal.hasPermission()

{

public boolean doesPrincipalHavePermission

(IAuthorizationService service,

IAuthorizationPrincipal principal,

String owner,

String activity,

String target)

}


Agenda





Manager Channels

• Manager Channels are service clients

• Transactional state in service

• Alternate managers


Manager Channels

Groups Manager channel


Manager Channels

Groups Manager configuration:

portal.properties

. . .

# Retrieval limits for Groups Manager.

# Limit the number of group members that should be enumerated when the Groups Manager

# generates an XML representation of the groups hierarchy

#

org.jasig.portal.channels.groupsmanager.wrappers.GroupWrapper.limitRetrievals=true

org.jasig.portal.channels.groupsmanager.wrappers.GroupWrapper.retrievalLimit=25


GAP Resources

Groups and Permissions wiki:http://jasigch.princeton.edu:9000/display/GAP/Home

uPortal mailing lists:• [email protected]

– Discuss anything related to uPortal• [email protected]

– Membership restricted to uPortal framework developers– Coordination of development work


Speaker: Dan Ellentuck

Presentation Title: Configuring Groups and Permissions

Date: 6/13/2005

Time: 2:00 PM – 3:00 PM

Speaker Info:

The End

Questions ?

Date post:	15-Jan-2016
Category:	Documents
View:	213 times
Download:	0 times

Mon, June13, 2005 uPortal Conference, Baltimore, MD Dan Ellentuck, Columbia University Configuring...

Documents