org.cyclos.security.access

Class TokenServiceSecurity

java.lang.Object

org.cyclos.impl.AbstractServerComponent

org.cyclos.impl.AbstractNetworkedServerComponent

org.cyclos.security.BaseServiceSecurity

org.cyclos.security.CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

org.cyclos.security.access.TokenServiceSecurity

All Implemented Interfaces:

TokenService, CRUDService<TokenDTO,TokenData,TokenDataParams>, CRUDWithConfirmationPasswordService<TokenDTO,TokenData,TokenDataParams>, Service

@Security
public class TokenServiceSecurity
extends CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>
implements TokenService

Security for TokenService

Author:

jcomas

Field Summary

Fields inherited from class org.cyclos.security.CRUDServiceSecurity

entityClass

Constructor Summary

Constructors

Constructor and Description
TokenServiceSecurity()

Method Summary

Modifier and Type	Method and Description
void	activatePending(java.lang.Long tokenId) Activates the given token.
void	assign(TokenActionDTO dto) Assigns and activates an unassigned token with the given type and value for the logged user.
void	block(java.lang.Long tokenId) Blocks the given token
void	cancel(java.lang.Long tokenId) Cancels the given token
void	cancelNFCToken(TokenActionDTO dto) Cancels the given NFC token.
protected void	checkCreateNew(TokenDataParams params) Checks whether creating new entities with the given context parameters is allowed, throwing PermissionDeniedException if not
protected void	customizeData(TokenData data) Can be overridden in order to process the returned data object for the given entity
protected boolean	doHasManageAccess(Token entity) Should be implemented in order to return whether the caller is allowed to manage the given entity, for the given operation
boolean	doHasViewAccess(Token entity) Should be implemented in order to return whether the caller is allowed to view the given entity.
SerializableInputStream	exportToCSV(TokenQuery query) Returns a CSV version of all returned tokens
protected CRUDServiceLocal<Token,TokenDTO,TokenData,TokenDataParams>	getImplementation() Should be implemented in order to return the actual implementation of the service
InitializeNFCTagData	getInitializeNFCTagData() Returns data with the token types available to initialize a blank NFC tag. The available tokens to personalize the tag are returned too to allow initialization and personalization at the same time.
TokensListData	getListData(TokenPrincipalTypeVO tokenType, UserLocatorVO locator) Returns data for listing tokens of a given type and user
PersonalizeNFCTagData	getPersonalizeNFCTagData(TokenPrincipalTypeVO tokenTypeVO, UserLocatorVO locator) Returns data needed to personalize a NFC tag for the specified type and user. The PersonalizeNFCTagData.CONFIRMATION_PASSWORD_INPUT will be null if the logged user manages the given user.
TokenSearchData	getSearchData(TokenPrincipalTypeVO tokenType) Returns data for searching tokens
InitializeNFCTagResult	initializeNFCTag(NFCTagInitializeDTO dto) Initializes and optionally personalize a NFC tag with the given data.
boolean	isAccessible(SessionData sessionData, Token entity) Must be implemented in order to determine whether the given entity is accessible for the given session data.
protected void	onBeforeSave(TokenDTO dto, Token entity)
void	personalizeNFCTag(NFCTagPersonalizeDTO dto) Personalizes a NFC tag for the given user.
ExternalNFCTagAuthenticateData	requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO dto) This method must be invoked to start a mutual authentication process between the server and the NFC tag (e.g.
void	requestNewOTPForPersonalizeNFCTag(UserLocatorVO locator, TokenPrincipalTypeVO tokenTypeVO, OTPSendMedium medium) Generates a new OTP (removing any previous password, if any) and sends it to the user by the specified medium using the confirmation password type set for the BuiltInChannel.POS channel for the specified user. It has the same security controls as for TokenService.personalizeNFCTag(NFCTagPersonalizeDTO), that is the logged user must be allowed to personalize a NFC Tag for the specified user.
Page<TokenVO>	search(TokenQuery query) Searches for tokens
void	unblock(java.lang.Long tokenId) Unblocks the given token

Methods inherited from class org.cyclos.security.CRUDServiceSecurity

canPerformOperation, canViewHistoryLog, checkManageAccess, checkOperation, checkViewAccess, find, getConfirmationPasswordInputForRemove, getData, getDataForNew, getEntityClass, hasManageAccess, hasViewAccess, load, remove, removeAll, removeAllWithConfirmationPassword, removeWithConfirmationPassword, resolveEntityCheck, save, saveWithConfirmationPassword

Methods inherited from class org.cyclos.security.BaseServiceSecurity

checkGuest, checkId, checkIds, checkInternalName, checkLoggedIn, checkManagesUser, checkRelatesToUser, checkVO, checkVOs, doInitialize, getEntityCheckRegistry, getUser, initialize

Methods inherited from class org.cyclos.impl.AbstractNetworkedServerComponent

canManage, checkManagesUser, checkPermission, checkRelatesToUser, checkValue, clearAlreadyValidated, getAccountHandler, getAuthHandler, getBaseEntityManagerHandler, getChannelConfiguration, getConfiguration, getConversionHandler, getCustomFieldValueHandler, getEntityManagerHandler, getGroupsHandler, getLoggedBasicUser, getLoggedUser, getProducts, getProductsHandler, getReportHandler, getTranslatedName, getTranslatedValue, getUserLocatorHandler, getValidationResult, hasPermission, hasValue, inSameNetwork, inSameNetworkOrGlobal, isAdmin, isAlreadyValidated, isBroker, isGlobalAdmin, isGlobalAdminInNetwork, isGuest, isLoggedIn, isMember, isNetworkAdmin, isOperator, isRelatedToUser, isSystem, isUserManager, isUserManagerOf, message, message, permission, permission, permissionOptionalValue, permissionOptionalValue, toDate, toDateTime, validate

Methods inherited from class org.cyclos.impl.AbstractServerComponent

delete, detach, find, flush, from, getApplicationContext, getConfigurationHandler, getDataTranslationHandler, getFormatter, getFormatter, getFormatter, getLogger, getNotificationHandler, getProfileFieldHandler, getRemoteAddress, getSessionData, getTransactionHandler, getTranslationHandler, message, message, persist, processBatch, refresh, remove, subQuery, update

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.cyclos.services.CRUDService

getData, getDataForNew, load, remove, removeAll, save

Constructor Detail

TokenServiceSecurity

public TokenServiceSecurity()

Method Detail

activatePending

public void activatePending(java.lang.Long tokenId)

Description copied from interface: TokenService

Activates the given token. This operation can only be done by admins or brokers over tokens of managed users.

Specified by:

activatePending in interface TokenService

assign

public void assign(TokenActionDTO dto)

Description copied from interface: TokenService

Assigns and activates an unassigned token with the given type and value for the logged user.

Specified by:

assign in interface TokenService

block

public void block(java.lang.Long tokenId)

Description copied from interface: TokenService

Blocks the given token

Specified by:

block in interface TokenService

cancel

public void cancel(java.lang.Long tokenId)

Description copied from interface: TokenService

Cancels the given token

Specified by:

cancel in interface TokenService

cancelNFCToken

public void cancelNFCToken(TokenActionDTO dto)

Description copied from interface: TokenService

Cancels the given NFC token. Admins and brokers with permissions can cancel a NFC token of type TokenType.NFC_TAG.
In case of a NFC token of type TokenType.NFC_DEVICE only the logged user can cancel its own token.

Specified by:

cancelNFCToken in interface TokenService

doHasViewAccess

public boolean doHasViewAccess(Token entity)

Description copied from class: CRUDServiceSecurity

Should be implemented in order to return whether the caller is allowed to view the given entity.

Specified by:

doHasViewAccess in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

exportToCSV

public SerializableInputStream exportToCSV(TokenQuery query)
                                    throws FrameworkException

Description copied from interface: TokenService

Returns a CSV version of all returned tokens

Specified by:

exportToCSV in interface TokenService

Throws:

FrameworkException

getInitializeNFCTagData

public InitializeNFCTagData getInitializeNFCTagData()
                                             throws FrameworkException

Description copied from interface: TokenService

Returns data with the token types available to initialize a blank NFC tag.
The available tokens to personalize the tag are returned too to allow initialization and personalization at the same time. Only allowed for managers (Brokers & Administrators).

Specified by:

getInitializeNFCTagData in interface TokenService

Throws:

FrameworkException

See Also:

TokenService.initializeNFCTag(NFCTagInitializeDTO)

getListData

public TokensListData getListData(TokenPrincipalTypeVO tokenType,
                                  UserLocatorVO locator)
                           throws FrameworkException

Description copied from interface: TokenService

Returns data for listing tokens of a given type and user

Specified by:

getListData in interface TokenService

Throws:

FrameworkException

getPersonalizeNFCTagData

public PersonalizeNFCTagData getPersonalizeNFCTagData(TokenPrincipalTypeVO tokenTypeVO,
                                                      UserLocatorVO locator)
                                               throws FrameworkException

Description copied from interface: TokenService

Returns data needed to personalize a NFC tag for the specified type and user.
The PersonalizeNFCTagData.CONFIRMATION_PASSWORD_INPUT will be null if the logged user manages the given user. The PersonalizeNFCTagData.TOKEN_TYPE is the token principal type the tag was initialized for.

Specified by:

getPersonalizeNFCTagData in interface TokenService

Throws:

FrameworkException

getSearchData

public TokenSearchData getSearchData(TokenPrincipalTypeVO tokenType)
                              throws FrameworkException

Description copied from interface: TokenService

Returns data for searching tokens

Specified by:

getSearchData in interface TokenService

Throws:

FrameworkException

initializeNFCTag

public InitializeNFCTagResult initializeNFCTag(NFCTagInitializeDTO dto)
                                        throws FrameworkException

Description copied from interface: TokenService

Initializes and optionally personalize a NFC tag with the given data. If the NFCTagInitializeDTO.getUser() is not null then the token will be personalized for that user too. Returns the private keys (PICC Master Key (i.e. PMK), Application Master Key (i.e. AMK) and Operational key) to be stored into the tag.
Only allowed for managers (Brokers & Administrators).

Specified by:

initializeNFCTag in interface TokenService

Throws:

FrameworkException

isAccessible

public boolean isAccessible(SessionData sessionData,
                            Token entity)

Description copied from class: CRUDServiceSecurity

Must be implemented in order to determine whether the given entity is accessible for the given session data. This method shouldn't check the same condition as CRUDServiceSecurity.hasViewAccess(BaseEntity). If the only condition for an entity is CRUDServiceSecurity.hasViewAccess(BaseEntity), this method should return false.

Specified by:

isAccessible in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

personalizeNFCTag

public void personalizeNFCTag(NFCTagPersonalizeDTO dto)
                       throws FrameworkException

Description copied from interface: TokenService

Personalizes a NFC tag for the given user. If the logged user doesn't manages the user then the confirmation password of that user is required. This method requires a successful previous external authentication ( TokenService.requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO))
The required NFCTagPersonalizeDTO.CYCLOS_CHALLENGE is the encrypted (hexadecimal string) challenge generated by the server (returned in the previous external authenticate) used to ensure the tag presence (internal authenticate)

Specified by:

personalizeNFCTag in interface TokenService

Throws:

FrameworkException

See Also:

TokenService.requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO)

requestForExternalAuthenticate

public ExternalNFCTagAuthenticateData requestForExternalAuthenticate(ExternalNFCTagAuthenticateDTO dto)
                                                              throws FrameworkException

Description copied from interface: TokenService

This method must be invoked to start a mutual authentication process between the server and the NFC tag (e.g. a card) to prove that both share the same secret key.
The authentication process is carried out in the following order:

• Validate the identity of the server: external authenticate
• Validate the identity of the NFc tag: internal authenticate

Specified by:

requestForExternalAuthenticate in interface TokenService

Parameters:

dto - contains the token type id (required), the token value (optional) and an encrypted challenge (required) generated by the tag in hexadecimal notation. If the token value is null then means the authentication process will be using the PICC Master Key (PMK).

Returns:

data containing the following:

• ExternalNFCTagAuthenticateData.CYCLOS_CHALLENGE: encrypted data (hexadecimal string) containing both: a new challenge generated by the server (used to validate the identity of the NFC tag, internal authenticate) and the original challenge generated by the tag processed according to the tag's authentication process. The (processed) original tag challenge will be used by the NFC tag to complete the server identity validation (external authenticate).
• ExternalNFCTagAuthenticateData.SESSION_KEY: A session key needed by the tag to allow send enciphered data to be written into the NFC tag

Throws:

FrameworkException

requestNewOTPForPersonalizeNFCTag

public void requestNewOTPForPersonalizeNFCTag(UserLocatorVO locator,
                                              TokenPrincipalTypeVO tokenTypeVO,
                                              OTPSendMedium medium)
                                       throws FrameworkException,
                                              SmsSendingException

Description copied from interface: TokenService

Generates a new OTP (removing any previous password, if any) and sends it to the user by the specified medium using the confirmation password type set for the BuiltInChannel.POS channel for the specified user.
It has the same security controls as for TokenService.personalizeNFCTag(NFCTagPersonalizeDTO), that is the logged user must be allowed to personalize a NFC Tag for the specified user.

Specified by:

requestNewOTPForPersonalizeNFCTag in interface TokenService

tokenTypeVO - the principal type used to personalize the card

medium - the medium used to send the OTP.

Throws:

SmsSendingException - only if medium is OTPSendMedium.BY_SMS and the OTP could not be sent to any enabled for sms phone.

FrameworkException

search

public Page<TokenVO> search(TokenQuery query)
                     throws FrameworkException,
                            QueryParseException

Description copied from interface: TokenService

Searches for tokens

Specified by:

search in interface TokenService

Throws:

FrameworkException

QueryParseException

unblock

public void unblock(java.lang.Long tokenId)

Description copied from interface: TokenService

Unblocks the given token

Specified by:

unblock in interface TokenService

checkCreateNew

protected void checkCreateNew(TokenDataParams params)

Description copied from class: CRUDServiceSecurity

Checks whether creating new entities with the given context parameters is allowed, throwing PermissionDeniedException if not

Specified by:

checkCreateNew in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

customizeData

protected void customizeData(TokenData data)

Description copied from class: CRUDServiceSecurity

Can be overridden in order to process the returned data object for the given entity

Overrides:

customizeData in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

doHasManageAccess

protected boolean doHasManageAccess(Token entity)

Description copied from class: CRUDServiceSecurity

Should be implemented in order to return whether the caller is allowed to manage the given entity, for the given operation

Specified by:

doHasManageAccess in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

getImplementation

protected CRUDServiceLocal<Token,TokenDTO,TokenData,TokenDataParams> getImplementation()

Description copied from class: CRUDServiceSecurity

Should be implemented in order to return the actual implementation of the service

Specified by:

getImplementation in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>

onBeforeSave

protected void onBeforeSave(TokenDTO dto,
                            Token entity)

Overrides:

onBeforeSave in class CRUDServiceSecurity<TokenDTO,Token,TokenData,TokenDataParams>