IBM OmniFind Enterprise Editionによる検索システムの統合: 第2回 セキュア検索のためのカスタマイズ

// if there is an XML security context, add it here
if (aclConstraints != null && aclConstraints.length() > 0) {
  query.setACLConstraints("@SecurityContext::'" + aclConstraints + "'");
}

public static String getSecurityContext(
    IdentityManagementHelper[] imcHelpers, boolean encoded) {
  SecurityContext federatedContext = new SecurityContext();
  List identityList = new ArrayList();
  List nativeTokenList = new ArrayList();
      
  SecurityContext firstContext = imcHelpers[0].getSecurityContext();
  federatedContext.setUserID(firstContext.getUserID());
  federatedContext.setSSOToken(firstContext.getSSOToken());
      
  for (int i = 0 ; i < imcHelpers.length ; i++) {
    SecurityContext context = imcHelpers[i].getSecurityContext();
    Identity[] identities = context.getIdentities();
    String[] nativeTokens = context.getNativeTokens();
    for (int j = 0 ; j < identities.length ; j++) {
      identityList.add(identities[j]);
    }
    for (int j = 0 ; j < nativeTokens.length ; j++) {
      nativeTokenList.add(nativeTokens[j]);
    }
  }
  federatedContext.setIdentities(
    (Identity[])identityList.toArray(new Identity[identityList.size()]));
  federatedContext.setNativeTokens(
    (String[])nativeTokenList.toArray(new String[nativeTokenList.size()]));

  return federatedContext.serialize(encoded);
}

IdentityManagementHelper[] imcHelpers = (IdentityManagementHelper[])
    request.getSession().getAttribute("IdentityManagementHelpers");
if (imcHelpers == null) {
  Properties[] props = FederatedSearchHelper.getProperties(properties);
  imcHelpers = new IdentityManagementHelper[props.length];
  for (int i = 0 ; i < props.length ; i++) {
    imcHelpers[i] = new IdentityManagementHelper();
    imcHelpers[i].initialize(userName, ssoCookie, props[i]);
  }
  request.getSession().setAttribute("IdentityManagementHelpers", imcHelpers);
}

//check if the default OmniFind Identity Management component has been enabled
//in the OmniFind Administration UI
//For federated IMC, detect all disabled case only
boolean ssoPropertiesEnabled = false;
boolean imcEnabled = false;
for (int i = 0 ; i < imcHelpers.length ; i++) {
  Properties imcProperties = imcHelpers[i].getIdentityManagementProperties();
  if (imcProperties == null || imcProperties.isEmpty()) {
    if (logger.isLoggable(Level.INFO)) {
      logger.info("execute - sso.properties file is empty. #" + i);
    }
  } else {
    ssoPropertiesEnabled = true;
    String isEnabled = imcProperties.getProperty(IMC_ENABLED);
    if (isEnabled.equalsIgnoreCase("false")) {
      if (logger.isLoggable(Level.INFO)) {
        logger.info("execute - ldap.sso.enable is false");
      }
    } else {
      imcEnabled = true;
      if (imcHelpers[i].getSecurityContext().getIdentities().length == 0) {
        //if the user's information stored in the database has not been loaded
        //yet, then read it now
        if (logger.isLoggable(Level.INFO)) {
          logger.info("execute - reading from database");
        }
        imcHelpers[i].readSecurityContext();
      }
    }
  }
}
if (!ssoPropertiesEnabled) {
  if (command.equals("profileLink")) {
    //if they are going to the My Profile page then let them know
    //that the sso.properties file could not be retrieved
    errors.add("info", new ActionError("errors.imc.properties.empty"));
  }
} else if (!imcEnabled) {
  if (command.equals("profileLink")) {
    //if they are going to the My Profile page then let them know
    //that the identity management component was disabled by the Administrator
    errors.add("info", new ActionError("errors.imc.disabled"));
  }
}

//process the request
boolean writeToDB = true;
if (command != null && !command.equals("")) {
  if (command.equals("profile")) {
    loadProfile(request, form, errors);
  } else if (command.equals("profileLink")) {
    loadProfile(request, form, errors);
    writeToDB = false;
  } else if (command.equals("validateProfile")) {
    validateProfile(request, form, errors);
  }
} else {
  //no command specified, assume we should load the Profile information.
  loadProfile(request, form, errors);
}

//write the information to the IMC database if we're supposed to
if (writeToDB) {
  if (logger.isLoggable(Level.INFO)) {
    logger.info("execute - writing to database");
  }
  for (int i = 0 ; i < imcHelpers.length ; i++) {
    imcHelpers[i].writeSecurityContext();
  }
}

//create the USC string and update the session
if (imcHelpers.length > 0) {
  String securityContext =
    FederatedSearchHelper.getSecurityContext(imcHelpers, true);
  String decodedSecurityContext =
    FederatedSearchHelper.getSecurityContext(imcHelpers, false);
  if (PortletApiUtils.getUtilsInstance() != null) {
    PortletRequest portletRequest = (PortletRequest) request;
    PortletSession session = portletRequest.getPortletSession();
    session.setAttribute("SecurityContext",
      securityContext, PortletSession.APPLICATION_SCOPE);
    session.setAttribute("DecodedSecurityContext", decodedSecurityContext,
    PortletSession.APPLICATION_SCOPE);
  }
  request.getSession().setAttribute("SecurityContext", securityContext);
  //this second string is used to display on the page if the
  //Administrator has set the extraQueryData.show property to true
  //the String value returned in this case will NOT be base64 encoded
  request.getSession().setAttribute("DecodedSecurityContext",
    decodedSecurityContext);
}

protected void loadProfile(
    HttpServletRequest request, ActionForm form, ActionErrors errors)
    throws Exception {
  if (logger.isLoggable(Level.FINE)) {
    logger.fine("loadProfile - entered");
  }
  DynaActionForm theForm = (DynaActionForm) form;
  IdentityManagementHelper[] imcHelpers = (IdentityManagementHelper[])
    request.getSession().getAttribute("IdentityManagementHelpers");
  // initialize the list of information to prompt for and verify
  UserPrompt[] prompts =
    (UserPrompt[]) request.getSession().getAttribute("userPrompts");
  if (prompts == null) {
    List promptList = new ArrayList();
    for (int i = 0 ; i < imcHelpers.length ; i++) {
      UserPrompt[] tempPrompts =
        imcHelpers[i].getSecuredDataSources(request);
      for (int j = 0 ; j < tempPrompts.length ; j++) {
        promptList.add(tempPrompts[j]);
      }
    }
    prompts =
      (UserPrompt[])promptList.toArray(new UserPrompt[promptList.size()]);
    request.getSession().setAttribute("userPrompts", prompts);
  }

  theForm.set("prompts", prompts);
  boolean areSecuredSourcesPresent = false;
  for (int i = 0 ; i < imcHelpers.length ; i++) {
    if (imcHelpers[i].areSecuredSourcesPresent()) {
      areSecuredSourcesPresent = true;
    }
  }
  if (!areSecuredSourcesPresent) {
    // there are NO secured sources to process
    request.getSession().setAttribute("securedSourcesPresent", "false");
  } else {
    // process the user information to determine if it's
    // already valid
    request.getSession().setAttribute("securedSourcesPresent", "true");
    processUserPrompts(request, form, errors, prompts, false);
  }
  if (logger.isLoggable(Level.FINE)) {
    logger.fine("loadProfile - returning");
  }
}

protected void processUserPrompts(
    HttpServletRequest request, ActionForm form, ActionErrors errors,
    UserPrompt[] prompts, boolean isApplied)
    throws Exception {
  if (logger.isLoggable(Level.FINE)) {
    logger.fine("processUserPrompts - entered");
  }
  IdentityManagementHelper[] imcHelpers = (IdentityManagementHelper[])
    request.getSession().getAttribute("IdentityManagementHelpers");
  if (prompts != null && prompts.length > 0) {
    for (int i = 0; i < prompts.length; ++i) {
      for (int j = 0 ; j < imcHelpers.length ; j++) {
        imcHelpers[j].updateIdentities(prompts[i], request.getLocale());
      }
    }
  }
}