SecurityVerifier (stSoftware API)

java.lang.Object
- com.ecyrd.jspwiki.auth.SecurityVerifier

```
public final class SecurityVerifier
extends java.lang.Object
```
Helper class for verifying JSPWiki's security configuration. Invoked by admin/SecurityConfig.jsp.

Since:

2.4

Author:

Andrew Jaquith

Field Summary

Fields
Modifier and Type	Field and Description
`static java.lang.String`	`ERROR` Message prefix for errors.
`static java.lang.String`	`ERROR_DB` Message topic for user database errors.
`static java.lang.String`	`ERROR_GROUPS` Message topic for group database errors.
`static java.lang.String`	`ERROR_JAAS` Message topic for JAAS errors.
`static java.lang.String`	`ERROR_POLICY` Message topic for policy errors.
`static java.lang.String`	`ERROR_ROLES` Message topic for role-checking errors.
`static java.lang.String`	`INFO` Message prefix for information messages.
`static java.lang.String`	`INFO_DB` Message topic for user database information messages.
`static java.lang.String`	`INFO_GROUPS` Message topic for group database information messages.
`static java.lang.String`	`INFO_JAAS` Message topic for JAAS information messages.
`static java.lang.String`	`INFO_POLICY` Message topic for policy information messages.
`static java.lang.String`	`INFO_ROLES` Message topic for role-checking information messages.
`static java.lang.String`	`WARNING` Message prefix for warnings.
`static java.lang.String`	`WARNING_DB` Message topic for user database warnings.
`static java.lang.String`	`WARNING_GROUPS` Message topic for group database warnings.
`static java.lang.String`	`WARNING_JAAS` Message topic for JAAS warnings.
`static java.lang.String`	`WARNING_POLICY` Message topic for policy warnings.

Constructor Summary

Constructors
Constructor and Description
`SecurityVerifier(WikiEngine engine, WikiSession session)` Constructs a new SecurityVerifier for a supplied WikiEngine and WikiSession.

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`java.lang.String`	`containerRoleTable()` Formats and returns an HTML table containing the roles the web container is aware of, and whether each role maps to particular JSPs.
`protected java.io.File`	`getFileFromProperty(java.lang.String property)` Looks up a file name based on a JRE system property and returns the associated File object if it exists.
`boolean`	`isSecurityPolicyConfigured()` Returns `true` if the Java security policy is configured correctly, and it verifies as valid.
`java.security.Principal[]`	`policyPrincipals()` Returns an array of unique Principals from the JSPWIki security policy file.
`java.lang.String`	`policyRoleTable()` Formats and returns an HTML table containing sample permissions and what roles are allowed to have them.
`protected void`	`verifyGroupDatabase()` Verifies that the group datbase was initialized properly, and that user add and delete operations work as they should.
`protected void`	`verifyJaas()` Verfies the JAAS configuration.
`protected void`	`verifyPolicy()` Verfies the Java security policy configuration.
`protected void`	`verifyPolicyAndContainerRoles()` Verifies that the roles given in the security policy are reflected by the container `web.xml` file.
`protected boolean`	`verifyStaticPermission(java.security.Principal principal, java.security.Permission permission)` Verifies that a particular Principal possesses a Permission, as defined in the security policy file.
`protected void`	`verifyUserDatabase()` Verifies that the user datbase was initialized properly, and that user add and delete operations work as they should.
`java.security.Principal[]`	`webContainerRoles()` If the active Authorizer is the WebContainerAuthorizer, returns the roles it knows about; otherwise, a zero-length array.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - ERROR
```
public static final java.lang.String ERROR
```
    Message prefix for errors.
    
    See Also:
    
    Constant Field Values
  - WARNING
```
public static final java.lang.String WARNING
```
    Message prefix for warnings.
    
    See Also:
    
    Constant Field Values
  - INFO
```
public static final java.lang.String INFO
```
    Message prefix for information messages.
    
    See Also:
    
    Constant Field Values
  - ERROR_POLICY
```
public static final java.lang.String ERROR_POLICY
```
    Message topic for policy errors.
    
    See Also:
    
    Constant Field Values
  - WARNING_POLICY
```
public static final java.lang.String WARNING_POLICY
```
    Message topic for policy warnings.
    
    See Also:
    
    Constant Field Values
  - INFO_POLICY
```
public static final java.lang.String INFO_POLICY
```
    Message topic for policy information messages.
    
    See Also:
    
    Constant Field Values
  - ERROR_JAAS
```
public static final java.lang.String ERROR_JAAS
```
    Message topic for JAAS errors.
    
    See Also:
    
    Constant Field Values
  - WARNING_JAAS
```
public static final java.lang.String WARNING_JAAS
```
    Message topic for JAAS warnings.
    
    See Also:
    
    Constant Field Values
  - ERROR_ROLES
```
public static final java.lang.String ERROR_ROLES
```
    Message topic for role-checking errors.
    
    See Also:
    
    Constant Field Values
  - INFO_ROLES
```
public static final java.lang.String INFO_ROLES
```
    Message topic for role-checking information messages.
    
    See Also:
    
    Constant Field Values
  - ERROR_DB
```
public static final java.lang.String ERROR_DB
```
    Message topic for user database errors.
    
    See Also:
    
    Constant Field Values
  - WARNING_DB
```
public static final java.lang.String WARNING_DB
```
    Message topic for user database warnings.
    
    See Also:
    
    Constant Field Values
  - INFO_DB
```
public static final java.lang.String INFO_DB
```
    Message topic for user database information messages.
    
    See Also:
    
    Constant Field Values
  - ERROR_GROUPS
```
public static final java.lang.String ERROR_GROUPS
```
    Message topic for group database errors.
    
    See Also:
    
    Constant Field Values
  - WARNING_GROUPS
```
public static final java.lang.String WARNING_GROUPS
```
    Message topic for group database warnings.
    
    See Also:
    
    Constant Field Values
  - INFO_GROUPS
```
public static final java.lang.String INFO_GROUPS
```
    Message topic for group database information messages.
    
    See Also:
    
    Constant Field Values
  - INFO_JAAS
```
public static final java.lang.String INFO_JAAS
```
    Message topic for JAAS information messages.
    
    See Also:
    
    Constant Field Values
- Constructor Detail
  - SecurityVerifier
```
public SecurityVerifier(WikiEngine engine,
                        WikiSession session)
```
    Constructs a new SecurityVerifier for a supplied WikiEngine and WikiSession.
    
    Parameters:
    
    engine - the wiki engine
    
    session - the wiki session (typically, that of an administrator)
- Method Detail
  - policyPrincipals
```
public final java.security.Principal[] policyPrincipals()
```
    Returns an array of unique Principals from the JSPWIki security policy file. This array will be zero-length if the policy file was not successfully located, or if the file did not specify any Principals in the policy.
    
    Returns:
    
    the array of principals
  - policyRoleTable
```
public final java.lang.String policyRoleTable()
```
    Formats and returns an HTML table containing sample permissions and what roles are allowed to have them. This method will throw an IllegalStateException if the authorizer is not of type WebContainerAuthorizer
    
    Returns:
    
    the formatted HTML table containing the result of the tests
  - containerRoleTable
```
public final java.lang.String containerRoleTable()
                                          throws WikiException
```
    Formats and returns an HTML table containing the roles the web container is aware of, and whether each role maps to particular JSPs. This method throws an IllegalStateException if the authorizer is not of type WebContainerAuthorizer
    
    Returns:
    
    the formatted HTML table containing the result of the tests
    
    Throws:
    
    WikiException - if tests fail for unexpected reasons
  - isSecurityPolicyConfigured
```
public final boolean isSecurityPolicyConfigured()
```
    Returns true if the Java security policy is configured correctly, and it verifies as valid.
    
    Returns:
    
    the result of the configuration check
  - webContainerRoles
```
public final java.security.Principal[] webContainerRoles()
                                                  throws WikiException
```
    If the active Authorizer is the WebContainerAuthorizer, returns the roles it knows about; otherwise, a zero-length array.
    
    Returns:
    
    the roles parsed from web.xml, or a zero-length array
    
    Throws:
    
    WikiException - if the web authorizer cannot obtain the list of roles
  - verifyPolicyAndContainerRoles
```
protected final void verifyPolicyAndContainerRoles()
                                            throws WikiException
```
    Verifies that the roles given in the security policy are reflected by the container web.xml file.
    
    Throws:
    
    WikiException - if the web authorizer cannot verify the roles
  - verifyGroupDatabase
```
protected final void verifyGroupDatabase()
```
    Verifies that the group datbase was initialized properly, and that user add and delete operations work as they should.
  - verifyJaas
```
protected final void verifyJaas()
```
    Verfies the JAAS configuration. The configuration is valid if value of the jspwiki.properties property "jspwiki.loginModule.class" resolves to a valid class on the classpath.
  getFileFromProperty protected final java.io.File getFileFromProperty(java.lang.String property) Looks up a file name based on a JRE system property and returns the associated File object if it exists. This method adds messages with the topic prefix ERROR and INFO as appropriate, with the suffix matching the supplied property. Parameters: property - the system property to look up Returns: the file object, or null if not found verifyPolicy protected final void verifyPolicy() Verfies the Java security policy configuration. The configuration is valid if value of the local policy (at WEB-INF/jspwiki.policy resolves to an existing file, and the policy file contained therein represents a valid policy. verifyStaticPermission protected final boolean verifyStaticPermission(java.security.Principal principal, java.security.Permission permission) Verifies that a particular Principal possesses a Permission, as defined in the security policy file. Parameters: principal - the principal permission - the permission Returns: the result, based on consultation with the active Java security policy verifyUserDatabase protected final void verifyUserDatabase() Verifies that the user datbase was initialized properly, and that user add and delete operations work as they should.

Class SecurityVerifier

Field Summary

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

ERROR

WARNING

INFO

ERROR_POLICY

WARNING_POLICY

INFO_POLICY

ERROR_JAAS

WARNING_JAAS

ERROR_ROLES

INFO_ROLES

ERROR_DB

WARNING_DB

INFO_DB

ERROR_GROUPS

WARNING_GROUPS

INFO_GROUPS

INFO_JAAS

Constructor Detail

SecurityVerifier

Method Detail

policyPrincipals

policyRoleTable

containerRoleTable

isSecurityPolicyConfigured

webContainerRoles

verifyPolicyAndContainerRoles

verifyGroupDatabase

verifyJaas

getFileFromProperty

verifyPolicy

verifyStaticPermission

verifyUserDatabase