diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java index 8f6d3b9457..d71d16502d 100644 --- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java +++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/rm/local/LocalResourceController.java @@ -154,10 +154,7 @@ public class LocalResourceController implements RMController { if (credentialsProvider.hasPermission(DBWConstants.PERMISSION_ADMIN) || credentialsProvider.hasPermission(RMConstants.PERMISSION_RM_ADMIN)) { return new ArrayList<>(Arrays.asList(listAllSharedProjects())); } - var accessibleSharedProjects = smController.getAllAvailableObjectsPermissions( - userId, - SMObjects.PROJECT - ); + var accessibleSharedProjects = smController.getAllAvailableObjectsPermissions(SMObjects.PROJECT); return accessibleSharedProjects .stream() diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java index 7d203fb14b..87364c8bb4 100644 --- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java +++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java @@ -413,12 +413,10 @@ public class WebSession extends AbstractSessionPersistent @NotNull private Set readAccessibleConnectionIds() { WebUser user = getUser(); - String subjectId = user == null ? - application.getAppConfiguration().getAnonymousUserTeam() : user.getUserId(); try { return getSecurityController() - .getAllAvailableObjectsPermissions(subjectId, SMObjects.DATASOURCE) + .getAllAvailableObjectsPermissions(SMObjects.DATASOURCE) .stream() .map(SMObjectPermissions::getObjectId) .collect(Collectors.toSet()); @@ -536,7 +534,7 @@ public class WebSession extends AbstractSessionPersistent if (!application.isConfigurationMode()) { // Update record //TODO use generate id from SMController - getSecurityController().updateSession(this.userContext.getSmSessionId(), getUserId(), getSessionParameters()); + getSecurityController().updateSession(this.userContext.getSmSessionId(), getSessionParameters()); } } } catch (Exception e) { diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSessionAuthProcessor.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSessionAuthProcessor.java index d731b6bbdd..849b304422 100644 --- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSessionAuthProcessor.java +++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSessionAuthProcessor.java @@ -127,7 +127,7 @@ public class WebSessionAuthProcessor { if (authProviderExternal != null && !configMode && !alreadyLoggedIn) { // We may need to associate new credentials with active user if (linkWithActiveUser) { - securityController.setUserCredentials(userId, authProviderDescriptor.getId(), authAttrs); + securityController.setUserCredentials(authProviderDescriptor.getId(), authAttrs); } } @@ -164,7 +164,7 @@ public class WebSessionAuthProcessor { if (!configMode && securityController.getUserPermissions(userId).isEmpty()) { throw new DBWebException("Access denied (no permissions)"); } - if (!configMode && !securityController.getUserById(userId).isEnabled()) { + if (!configMode && !securityController.getCurrentUser().isEnabled()) { throw new DBWebException("User account is locked"); } diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebUserContext.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebUserContext.java index b47fdccf0c..e180d6c205 100644 --- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebUserContext.java +++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebUserContext.java @@ -90,7 +90,7 @@ public class WebUserContext implements SMCredentialsProvider { this.rmController = application.getResourceController(this, this.securityController); if (isSessionChanged) { this.smSessionId = smAuthInfo.getAuthPermissions().getSessionId(); - setUser(authPermissions.getUserId() == null ? null : new WebUser(securityController.getUserById(authPermissions.getUserId()))); + setUser(authPermissions.getUserId() == null ? null : new WebUser(securityController.getCurrentUser())); } return isSessionChanged; } @@ -168,7 +168,7 @@ public class WebUserContext implements SMCredentialsProvider { */ public synchronized void refreshPermissions() throws DBException { if (isAuthorizedInSecurityManager()) { - this.userPermissions = securityController.getTokenPermissions(smCredentials.getSmToken()).getPermissions(); + this.userPermissions = securityController.getTokenPermissions().getPermissions(); } else { this.userPermissions = getDefaultPermissions(); } diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminUserInfo.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminUserInfo.java index 15d68683fc..c143f3d84b 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminUserInfo.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/AdminUserInfo.java @@ -115,8 +115,10 @@ public class AdminUserInfo { if (userLinkedProviders != null) { return userLinkedProviders; } + try { - userLinkedProviders = session.getSecurityController().getUserLinkedProviders(user.getUserId()); + String userId = user.getUserId(); + userLinkedProviders = session.getAdminSecurityController().getUserLinkedProviders(userId); } catch (DBException e) { throw new DBWebException("Error reading user linked providers", e); } diff --git a/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/WebUserInfo.java b/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/WebUserInfo.java index 8f629cf86b..7a78e7d5e0 100644 --- a/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/WebUserInfo.java +++ b/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/WebUserInfo.java @@ -65,7 +65,7 @@ public class WebUserInfo { public List getLinkedAuthProviders() throws DBWebException { if (linkedProviders == null) { try { - linkedProviders = session.getSecurityController().getUserLinkedProviders(session.getUser().getUserId()); + linkedProviders = session.getSecurityController().getUserLinkedProviders(); } catch (DBException e) { throw new DBWebException("Error reading user linked providers", e); } @@ -81,7 +81,7 @@ public class WebUserInfo { @Property public Map getConfigurationParameters() throws DBWebException { try { - return session.getSecurityController().getUserParameters(user.getUserId()); + return session.getSecurityController().getUserParameters(); } catch (DBException e) { throw new DBWebException("Error reading user parameters", e); } diff --git a/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/impl/WebServiceAuthImpl.java b/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/impl/WebServiceAuthImpl.java index c764e472a5..121af7a056 100644 --- a/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/impl/WebServiceAuthImpl.java +++ b/server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/impl/WebServiceAuthImpl.java @@ -147,7 +147,7 @@ public class WebServiceAuthImpl implements DBWServiceAuth { } try { // Read user from security controller. It will also read meta parameters - SMUser userWithDetails = webSession.getSecurityController().getUserById(webSession.getUser().getUserId()); + SMUser userWithDetails = webSession.getSecurityController().getCurrentUser(); if (userWithDetails != null) { // USer not saved yet. This may happen in easy config mode var webUser = new WebUser(userWithDetails); @@ -201,13 +201,14 @@ public class WebServiceAuthImpl implements DBWServiceAuth { } @Override - public boolean setUserConfigurationParameter(@NotNull WebSession webSession, @NotNull String name, @Nullable String value) throws DBWebException { + public boolean setUserConfigurationParameter( + @NotNull WebSession webSession, + @NotNull String name, + @Nullable String value + ) throws DBWebException { webSession.addInfoMessage("Set user parameter - " + name); try { - webSession.getSecurityController().setUserParameter( - webSession.getUser().getUserId(), - name, - value); + webSession.getSecurityController().setUserParameter(name, value); return true; } catch (DBException e) { throw new DBWebException("Error setting user parameter", e); diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java index 40a6b19080..c42e0cf928 100644 --- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java +++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java @@ -115,7 +115,7 @@ public class LocalAuthProvider implements SMAuthProvider { //String newPasswordHash = WebAuthProviderPropertyEncryption.hash.encrypt(userName, newPassword); storedCredentials.put(CRED_PASSWORD, newPassword); - webSession.getSecurityController().setUserCredentials(userName, authProvider.getId(), storedCredentials); + webSession.getSecurityController().setUserCredentials(authProvider.getId(), storedCredentials); return true; } diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java index 9ad8f041b8..76d6ab1edb 100644 --- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java +++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java @@ -203,6 +203,12 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } } + @NotNull + @Override + public SMTeam[] getUserTeams() throws DBException { + return getUserTeams(getUserIdOrThrow()); + } + @Override public SMUser getUserById(String userId) throws DBException { try (Connection dbCon = database.openConnection()) { @@ -240,6 +246,12 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } } + @NotNull + @Override + public SMUser getCurrentUser() throws DBException { + return getUserById(getUserIdOrThrow()); + } + @NotNull @Override public SMUser[] findUsers(String userNameMask) throws DBCException { @@ -351,7 +363,8 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } @Override - public Map getUserParameters(String userId) throws DBCException { + public Map getUserParameters() throws DBCException { + String userId = getUserIdOrThrow(); try (Connection dbCon = database.openConnection()) { Map result = new LinkedHashMap<>(); // Read users @@ -372,7 +385,8 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } @Override - public void setUserParameter(String userId, String name, Object value) throws DBException { + public void setUserParameter(String name, Object value) throws DBException { + String userId = getUserIdOrThrow(); try (Connection dbCon = database.openConnection()) { try (JDBCTransaction txn = new JDBCTransaction(dbCon)) { if (value == null) { @@ -459,7 +473,20 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } @Override - public void setUserCredentials(@NotNull String userId, @NotNull String authProviderId, @NotNull Map credentials) throws DBException { + public void setUserCredentials( + @NotNull String authProviderId, + @NotNull Map credentials + ) throws DBException { + String userId = getUserIdOrThrow(); + setUserCredentials(userId, authProviderId, credentials); + } + + @Override + public void setUserCredentials( + @NotNull String userId, + @NotNull String authProviderId, + @NotNull Map credentials + ) throws DBException { var existUserByCredentials = findUserByCredentials(getAuthProvider(authProviderId), credentials); if (existUserByCredentials != null && !existUserByCredentials.equals(userId)) { throw new DBException("Another user is already linked to the specified credentials"); @@ -483,9 +510,15 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } try (Connection dbCon = database.openConnection()) { try (JDBCTransaction txn = new JDBCTransaction(dbCon)) { - JDBCUtils.executeStatement(dbCon, "DELETE FROM CB_USER_CREDENTIALS WHERE USER_ID=? AND PROVIDER_ID=?", userId, authProvider.getId()); + JDBCUtils.executeStatement( + dbCon, + "DELETE FROM CB_USER_CREDENTIALS WHERE USER_ID=? AND PROVIDER_ID=?", + userId, + authProvider.getId() + ); if (!CommonUtils.isEmpty(credentials)) { - try (PreparedStatement dbStat = dbCon.prepareStatement("INSERT INTO CB_USER_CREDENTIALS(USER_ID,PROVIDER_ID,CRED_ID,CRED_VALUE) VALUES(?,?,?,?)")) { + try (PreparedStatement dbStat = dbCon.prepareStatement( + "INSERT INTO CB_USER_CREDENTIALS(USER_ID,PROVIDER_ID,CRED_ID,CRED_VALUE) VALUES(?,?,?,?)")) { for (String[] cred : transformedCredentials) { if (cred == null) { continue; @@ -599,6 +632,17 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } } + @NotNull + @Override + public Map getUserCredentials(@NotNull String authProviderId) throws DBException { + return getUserCredentials(getUserIdOrThrow(), authProviderId); + } + + @Override + public String[] getUserLinkedProviders() throws DBException { + return getUserLinkedProviders(getUserIdOrThrow()); + } + @Override public String[] getUserLinkedProviders(@NotNull String userId) throws DBException { try (Connection dbCon = database.openConnection()) { @@ -1670,12 +1714,21 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } @Override - public SMAuthPermissions getTokenPermissions(String token) throws DBException { + public SMAuthPermissions getTokenPermissions() throws DBException { + SMCredentials activeUserCredentials = credentialsProvider.getActiveUserCredentials(); + if (activeUserCredentials == null || activeUserCredentials.getSmToken() == null) { + throw new SMException("User not authenticated"); + } + return getTokenPermissions(activeUserCredentials.getSmToken()); + } + + private SMAuthPermissions getTokenPermissions(@NotNull String token) throws DBException { String userId; String sessionId; String authRole; try (Connection dbCon = database.openConnection(); - PreparedStatement dbStat = dbCon.prepareStatement("SELECT USER_ID, EXPIRATION_TIME, SESSION_ID, AUTH_ROLE FROM CB_AUTH_TOKEN WHERE TOKEN_ID=?"); + PreparedStatement dbStat = dbCon.prepareStatement( + "SELECT USER_ID, EXPIRATION_TIME, SESSION_ID, AUTH_ROLE FROM CB_AUTH_TOKEN WHERE TOKEN_ID=?"); ) { dbStat.setString(1, token); try (var dbResult = dbStat.executeQuery()) { @@ -1737,7 +1790,8 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } @Override - public void updateSession(@NotNull String sessionId, @Nullable String userId, @NotNull Map parameters) throws DBCException { + public void updateSession(@NotNull String sessionId, @NotNull Map parameters) throws DBCException { + String userId = getUserIdOrThrow(); try (Connection dbCon = database.openConnection()) { try (PreparedStatement dbStat = dbCon.prepareStatement( "UPDATE CB_SESSION SET USER_ID=?,LAST_ACCESS_TIME=?,LAST_ACCESS_REMOTE_ADDRESS=?,LAST_ACCESS_USER_AGENT=?,LAST_ACCESS_INSTANCE_ID=? WHERE SESSION_ID=?")) { @@ -1836,9 +1890,22 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen } } + @NotNull + private String getSubjectId() { + SMCredentials activeUserCredentials = credentialsProvider.getActiveUserCredentials(); + + if (activeUserCredentials == null || activeUserCredentials.getUserId() == null) { + return application.getAppConfiguration().getAnonymousUserTeam(); + } else { + return activeUserCredentials.getUserId(); + } + } + @NotNull @Override - public List getAllAvailableObjectsPermissions(@NotNull String subjectId, @NotNull SMObjectType objectType) throws DBException { + public List getAllAvailableObjectsPermissions(@NotNull SMObjectType objectType) throws DBException { + + String subjectId = getSubjectId(); Set allSubjects = getAllLinkedSubjects(subjectId); try (Connection dbCon = database.openConnection()) { { @@ -2077,4 +2144,12 @@ public class CBEmbeddedSecurityController implements SMAdminController, SMAuthen return originalLink + "?authId=" + authId; } + private String getUserIdOrThrow() throws SMException { + SMCredentials activeUserCredentials = credentialsProvider.getActiveUserCredentials(); + if (activeUserCredentials == null || activeUserCredentials.getUserId() == null) { + throw new SMException("User not authenticated"); + } + return activeUserCredentials.getUserId(); + } + }