User management

User management

Because it can useful to have different rights for different users (guests, members, server master, etc), the server is able to manage users with a username and a password, giving a list of rights to bound the user access.

Login mechanism

When a request is received by the server, the Authentication Manager (abstract class HTTPAuthenticationManager) will try to get the current user from the HTTP socket.

• If an Authorization header exists, so the user will be created from that.
• If no Authorization header is detected, a default user (guest) will be used (with default rights)
• If an Authorization header exists but the information are not valid, the default user will be used.

Right mechanism

To compute the request received, the server check if the selected user (from the Authentication Manager) has the right corresponding to the action. Depending the request, many rights can be involved, requesting all of them to be authorized.

User creation

The user is created/provided by the class HTTPAuthenticationManager when the server needs to get information of a specific user (using a username, no password). The user has to be returned in the call of functions :

• getDefaultUser()
• getUser(String username)

Creation

The HTTPUser is just the interface between the server and the user database. It will be required to find the user with the username specified in parameters and get the password and/or the rights.

HTTPUser user1 = new HTTPUser(username, password, rights);
HTTPUser user2 = new HTTPUser(username, password); // with default rights (read only rights)

Give full rights to a user

It is possible to give full rights to a user regardless the rights given before and after this definition.

user.giveAllRights(true);

Rights table

Attribute name	Description	Type
webname::get	Give the right to get the name/webname of a resource	read
visible::get	Give the right to get the visible status of a resource	read
time::creation::get	Give the right to get the creation date of a resource	read
time::lastmodified::get	Give the right to get the last modified date of a resource	read
path::get	Give the right to get the path of a resource	read
type::get	Give the right to get the type of a resource (ResourceType)	read
lock::check	Give the right to check if a lock is taken on a resource	read
lock::get	Give the right to get information about taken locks of a resource	read
lock::set	Give the right to set a lock on a resource	write
lock::remove	Give the right to remove a lock on a resource	write
property::get	Give the right to get the value of a property of a resource	read
property::set	Give the right to set the value of a property of a resource	write
property::remove	Give the right to remove the value of a property of a resource	write
children::get	Give the right to get the children resource of a resource	read
content::get	Give the right to get the content of a resource	read
content::set	Give the right to set the content of a resource	read
size::get	Give the right to get the size of a resource	read
mimetype::get	Give the right to get the mimetype of a resource	read
file::create	Give the right to create a file resource	write
directory::create	Give the right to create a directory resource (also called collection)	write
link::create	Give the right to create a link resource	write
delete	Give the right to delete a resource	write
move	Give the right to move/rename a resource	write

Full rights

String[] rights = new String[]
{ // rights : full (read/write)
	"webname::get",
	"visible::get",
	"time::creation::get",
	"time::lastmodified::get",
	"path::get",
	"type::get",
	"lock::check",
	"lock::remove",
	"lock::set",
	"lock::get",
	"property::set",
	"property::get",
	"property::remove",
	"children::get",
	"content::set",
	"content::get",
	"size::get",
	"mimetype::get",

	"file::create",
	"directory::create",
	"link::create",

	"move",
	"delete"
}

Read only

String[] rights = new String[]
{ // rights : read only
	"webname::get",
	"visible::get",
	"time::creation::get",
	"time::lastmodified::get",
	"path::get",
	"type::get",
	"lock::check",
	"lock::get",
	"property::get",
	"children::get",
	"content::get",
	"size::get",
	"mimetype::get"
}

Example

public class HTTPDefaultAuthentication extends HTTPAuthenticationManager
{
    public HTTPDefaultAuthentication(String realm)
    {
        super(realm);
    }

    @Override
    protected HTTPUser getDefaultUser()
    {
        HTTPUser user = new HTTPUser("Guest", "");
        user.giveAllRights(true); // guest user has full rights
        return user;
    }

    @Override
    protected HTTPUser getUser(String username)
    {
        HTTPUser user = new HTTPUser(username, "");
        user.giveAllRights(true); // logged user has full rights
        return user;
    }
}