Skip to content

Commit

Permalink
Add a logout feature to ldap security manager
Browse files Browse the repository at this point in the history 
Need to provide an interface to log out a CLdapSecManager user,
which will be needed for gh-2174 ('ECLWatch should provide LOGOUT
feature')

Signed-off-by: William Whitehead <william.whitehead@lexisnexis.com>
  • Loading branch information
@RussWhitehead
RussWhitehead committed Apr 30, 2012
1 parent 3dac26b commit ac60cbe
Show file tree
Hide file tree
Showing 4 changed files with 18 additions and 1 deletion.
11 changes: 11 additions & 0 deletions system/security/LdapSecurity/ldapsecurity.cpp
View file
Expand Up @@ -746,6 +746,17 @@ int CLdapSecManager::authorizeEx(SecResourceType rtype, ISecUser & user, const c
return -1;
}

bool CLdapSecManager::logout(ISecUser& sec_user)
{
sec_user.setAuthenticateStatus(AS_UNKNOWN);
if (m_permissionsCache.isCacheEnabled())
{
m_permissionsCache.removePermissions(sec_user);
m_permissionsCache.removeFromUserCache(sec_user);
}
return true;
}

int CLdapSecManager::getAccessFlagsEx(SecResourceType rtype, ISecUser & user, const char * resourcename)
{
if(!resourcename || !*resourcename)
Expand Down
1 change: 1 addition & 0 deletions system/security/LdapSecurity/ldapsecurity.ipp
View file
Expand Up @@ -359,6 +359,7 @@ public:
bool authorize(ISecUser& sec_user, ISecResourceList * Resources);
bool authorizeEx(SecResourceType rtype, ISecUser& sec_user, ISecResourceList * Resources);
int authorizeEx(SecResourceType rtype, ISecUser& sec_user, const char* resourcename);
virtual bool logout(ISecUser& sec_user);
virtual int authorizeFileScope(ISecUser & user, const char * filescope);
virtual bool authorizeFileScope(ISecUser & user, ISecResourceList * resources);
virtual int authorizeWorkunitScope(ISecUser & user, const char * wuscope);
Expand Down
6 changes: 5 additions & 1 deletion system/security/shared/basesecurity.hpp
View file
Expand Up @@ -160,7 +160,11 @@ class CBaseSecurityManager : public CInterface,
return rlist->queryResource(0)->getAccessFlags();
else
return -1;
}
}
virtual bool logout(ISecUser& sec_user)
{
UNIMPLEMENTED;

This comment has been minimized.

Sign in to view

Copy link
@richardkchapman

richardkchapman May 1, 2012

If this is code that should never be reached, you should use throwUnexpected() rather than UNIMPLEMENTED;

If it's code that CAN be reached, you should really implement it before submitting the pull request (unless it's something we DO intend to implement sometime but NOT in the next release...

This comment has been minimized.

Sign in to view

Copy link
@RussWhitehead

RussWhitehead May 1, 2012

Author Owner

The reason I chose UNIMPLEMENTED was for consistency, since there are 13 other methods in this same class and file that use the same (I am guessing that you were not able to see them because the viewer by default only shows a few lines of code around the changes) . I suppose I could change them all to ThrowUnexpected, although it should be noted that both of these throw an exception

define throwUnexpected() throw MakeStringException(9999, "Internal Error at %s(%d)", FILE, LINE)

define UNIMPLEMENTED throw MakeStringException(-1, "UNIMPLEMENTED feature at %s(%d)", FILE, LINE)

This comment has been minimized.

Sign in to view

Copy link
@richardkchapman

richardkchapman May 1, 2012

I know they both throw an exception, but they imply different things. And I know we have in the past been a little sloppy about which one we use, on occasion. But I don't think that's a good reason for not correcting things when we spot that they are wrong.

If the others should also be considered as unexpected rather than unimplemented, then they should be changed too.
}
virtual int getAccessFlagsEx(SecResourceType rtype, ISecUser& sec_user, const char* resourcename)
{
UNIMPLEMENTED;
Expand Down
1 change: 1 addition & 0 deletions system/security/shared/seclib.hpp
View file
Expand Up @@ -269,6 +269,7 @@ interface ISecManager : extends IInterface
virtual bool authorize(ISecUser & user, ISecResourceList * resources) = 0;
virtual bool authorizeEx(SecResourceType rtype, ISecUser & user, ISecResourceList * resources) = 0;
virtual int authorizeEx(SecResourceType rtype, ISecUser & user, const char * resourcename) = 0;
virtual bool logout(ISecUser & user) = 0;
virtual int getAccessFlagsEx(SecResourceType rtype, ISecUser & user, const char * resourcename) = 0;
virtual int authorizeFileScope(ISecUser & user, const char * filescope) = 0;
virtual bool authorizeFileScope(ISecUser & user, ISecResourceList * resources) = 0;
Expand Down

2 comments on commit ac60cbe

@afishbeck
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is logout the right term for this functionality? Seems like its really just clearing the cache. The main reason I ask is because there may be a chance we would want to add real session type functionality to a security manager at some point.

@RussWhitehead
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, since you don't really "log in" it doesn't make sense to log out. Now accepting nominations for a better name....

Please sign in to comment.