diff --git framework/security/config/security.properties framework/security/config/security.properties index 030ac41635..fdc7bb49ef 100644 --- framework/security/config/security.properties +++ framework/security/config/security.properties @@ -75,6 +75,11 @@ store.login.history=true store.login.history.on.service.auth=false store.login.history.incorrect.password=true +# -- disable impersonation +security.disable.impersonation=true +# -- if you want that an user cannot operate during an administrator impersonate his account. If true, it can be helpful for QA and dev site +security.login.authorised.during.impersonate=false + # -- should we encrypt (SHA Hash) the password? -- password.encrypt=true diff --git framework/security/data/SecurityGroupDemoData.xml framework/security/data/SecurityGroupDemoData.xml index a2605e8997..bd903bcf73 100644 --- framework/security/data/SecurityGroupDemoData.xml +++ framework/security/data/SecurityGroupDemoData.xml @@ -25,7 +25,8 @@ under the License. - + + diff --git framework/security/entitydef/entitymodel.xml framework/security/entitydef/entitymodel.xml index 1a056e868a..e13bc2f4d3 100644 --- framework/security/entitydef/entitymodel.xml +++ framework/security/entitydef/entitymodel.xml @@ -106,11 +106,15 @@ under the License. +

+ + + + + + + + + + + + + + + + + + + diff --git framework/security/src/doc/asciidoc/_include/security-impersonation.adoc framework/security/src/doc/asciidoc/_include/security-impersonation.adoc new file mode 100644 index 0000000000..13751d414c --- /dev/null +++ framework/security/src/doc/asciidoc/_include/security-impersonation.adoc @@ -0,0 +1,127 @@ +//// +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +//// + += Impersonation +== What is Impersonation in Apache OFBiz +The Apache OFBiz Project +Release 17.12 + +:imagesdir: ../../themes/common-theme/webapp/images/img/ +ifdef::backend-pdf[] +:title-logo-image: image::OFBiz-Logo.svg[Apache OFBiz Logo, pdfwidth=4.25in, align=center] +:source-highlighter: rouge +endif::[] + +=== Introduction to User impersonation + +User Impersonation is a feature that offer a way to select a user login and impersonate it, i.e. see what the user could +see navigating through the application in his name. + +=== How do this work ? + +An authorized user _(see <> and <> section for configuration)_, can select a user +that will be impersonated. + +The impersonation start, if everything is well configured, in current application (partymgr for the demo). +Everything appears like if we were logged in with the userLoginId and the valid password (though we know nothing about it) + +The only thing showing that we currently are impersonating a user is the little bottom-right image : + +image::impersonate-ico.png[Impersonate icon, pdfwidth=0.5in, align=right] + +This icon indicates, when clicking on it, the user impersonated, and offer a way to depersonate. + +The impersonate period is stored for audit purpose, and if the impersonator forgot to depersonate, the period +is terminated _one hour_ after impersonation start. + +=== Security + +This feature can draw some concerns about security aspect. This paragraph will introduce every controls and properties +that have been implemented around the impersonation feature. + +[CAUTION] +These configuration steps are not to be neglected for a *production environment* since this feature offer a way to act + in place of another user. + +==== Properties + +The _security.properties_ file introduce two properties that control impersonation feature : + + +[source] +security.disable.impersonation = true + +This property, set by default to *true*, controls the activation of impersonation feature. If no configuration is done +any user trying to use impersonation will face an error message, indicating that the feature is disabled. + +To enable impersonation this property need to be set to *false* + + +[source] +security.login.authorised.during.impersonate = false + +This property controls the way impersonation occurred to the impersonated user : + +In default configuration, the impersonated user see nothing and can use the application without knowing that he is +currently impersonated. Several authorized user can impersonate a same login without any issue. + +[NOTE] +This configuration is intended for testing/QA environment allowing any authorized user to impersonate a login +to validate its configuration, test the application etc. + +Set to *true*, this configuration improve the control of the data generated by the impersonated user. Indeed, Only one +authorized user can impersonate a login at the same time, and during the impersonation process, the impersonated user +is unable to act within the application. + +Since the impersonation period is stored in database, the actions done by the +authorized user can be identified if there is the need to do so. +[NOTE] +This configuration is intended for production environment + + +==== Controls + +The permission:: + +First, to be able to use impersonation, a user need to possess _IMPERSONATE_ADMIN_ permissions. Demo data offer +_IMPERSONATION_ security group for this purpose. + +In demo data, _FULLADMIN_ security group also possess the permission. + + +Permission based user restriction:: + +An authorized user cannot impersonate any user. There are two main controls that will restrict the impersonation feature. + +Cannot impersonate Admin user::: + +It is impossible to impersonate a user that is granted any of the admin permission : + + "IMPERSONATE_ADMIN" + "ARTIFACT_INFO_VIEW" + "SERVICE_MAINT" + "ENTITY_MAINT" + "UTIL_CACHE_VIEW" + "UTIL_DEBUG_VIEW" + +Cannot impersonate more privileged user::: + +It is impossible to impersonate a user that has more permission than your user. Even if the missing persmission is +a minor one. + + diff --git framework/security/src/main/java/org/apache/ofbiz/security/SecurityUtil.java framework/security/src/main/java/org/apache/ofbiz/security/SecurityUtil.java new file mode 100644 index 0000000000..2e7c7fee70 --- /dev/null +++ framework/security/src/main/java/org/apache/ofbiz/security/SecurityUtil.java @@ -0,0 +1,122 @@ +/******************************************************************************* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + *******************************************************************************/ +package org.apache.ofbiz.security; + + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; +import java.util.stream.Collectors; +import org.apache.ofbiz.base.util.Debug; +import org.apache.ofbiz.base.util.StringUtil; +import org.apache.ofbiz.base.util.UtilMisc; +import org.apache.ofbiz.base.util.UtilValidate; +import org.apache.ofbiz.entity.Delegator; +import org.apache.ofbiz.entity.GenericEntityException; +import org.apache.ofbiz.entity.condition.EntityCondition; +import org.apache.ofbiz.entity.condition.EntityOperator; +import org.apache.ofbiz.entity.util.EntityQuery; +import org.apache.ofbiz.entity.util.EntityUtil; + +/** + * A Security util. + */ +public final class SecurityUtil { + + public static final String module = SecurityUtil.class.getName(); + private static final List adminPermissions = UtilMisc.toList( + "IMPERSONATE_ADMIN", + "ARTIFACT_INFO_VIEW", + "SERVICE_MAINT", + "ENTITY_MAINT", + "UTIL_CACHE_VIEW", + "UTIL_DEBUG_VIEW"); + + /** + * Return true if given userLogin possess at least one of the adminPermission + * + * @param delegator + * @param userLoginId + * @return + */ + public static boolean hasUserLoginAdminPermission(Delegator delegator, String userLoginId) { + if (UtilValidate.isEmpty(userLoginId)) return false; + try { + return EntityQuery.use(delegator) + .from("UserLoginAndPermission") + .where(EntityCondition.makeCondition( + EntityCondition.makeCondition("userLoginId", userLoginId), + EntityCondition.makeCondition("permissionId", EntityOperator.IN, adminPermissions))) + .filterByDate("fromDate", "thruDate", "permissionFromDate", "permissionThruDate") + .queryCount() != 0; + } catch (GenericEntityException e) { + Debug.logError("Failed to resolve user permissions", module); + } + return false; + } + + /** + * Return the list of missing permission, if toUserLoginId has more permission thant userLoginId, emptyList either. + * + * @param delegator + * @param userLoginId + * @param toUserLoginId + * @return + */ + public static List hasUserLoginMorePermissionThan(Delegator delegator, String userLoginId, String toUserLoginId) { + ArrayList returnList = new ArrayList<>(); + if (UtilValidate.isEmpty(userLoginId) || UtilValidate.isEmpty(toUserLoginId)) return returnList; + List userLoginPermissionIds; + List toUserLoginPermissionIds; + try { + userLoginPermissionIds = EntityUtil.getFieldListFromEntityList( + EntityQuery.use(delegator) + .from("UserLoginAndPermission") + .where("userLoginId", userLoginId) + .filterByDate("fromDate", "thruDate", "permissionFromDate", "permissionThruDate") + .queryList(), "permissionId", true); + toUserLoginPermissionIds = EntityUtil.getFieldListFromEntityList( + EntityQuery.use(delegator) + .from("UserLoginAndPermission") + .filterByDate("fromDate", "thruDate", "permissionFromDate", "permissionThruDate") + .where("userLoginId", toUserLoginId) + .queryList(), "permissionId", true); + } catch (GenericEntityException e) { + Debug.logError("Failed to resolve user permissions", module); + return returnList; + } + + if (UtilValidate.isEmpty(userLoginPermissionIds)) return toUserLoginPermissionIds; + if (UtilValidate.isEmpty(toUserLoginPermissionIds)) return returnList; + + //Resolve all ADMIN permissions associated with the origin user + List adminPermissions = userLoginPermissionIds.stream() + .filter(perm -> perm.endsWith("_ADMIN")) + .map(perm -> StringUtil.replaceString(perm, "_ADMIN", "")) + .collect(Collectors.toList()); + + //if toUserLoginPermissionIds contains at least one permission that is not in admin permission or userLoginPermissionIds + // return the list of missing permission + return toUserLoginPermissionIds.stream() + .filter(perm -> + !userLoginPermissionIds.contains(perm) + && !adminPermissions.contains(perm.substring(0, perm.lastIndexOf("_")))) + .collect(Collectors.toList()); + } +} \ No newline at end of file diff --git framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java index ca3515cfe7..0a8088eb0b 100644 --- framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java +++ framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java @@ -26,8 +26,10 @@ import java.sql.Timestamp; import java.util.ArrayList; import java.util.Arrays; import java.util.Collection; +import java.util.HashMap; import java.util.LinkedList; import java.util.List; +import java.util.Locale; import java.util.Map; import java.util.ServiceLoader; import java.util.regex.Matcher; @@ -59,6 +61,7 @@ import org.apache.ofbiz.base.util.UtilValidate; import org.apache.ofbiz.entity.Delegator; import org.apache.ofbiz.entity.DelegatorFactory; import org.apache.ofbiz.entity.EntityCryptoException; +import org.apache.ofbiz.entity.GenericEntity; import org.apache.ofbiz.entity.GenericEntityException; import org.apache.ofbiz.entity.GenericValue; import org.apache.ofbiz.entity.condition.EntityCondition; @@ -215,6 +218,52 @@ public class LoginWorker { return userLogin; } + /** + * Return the active {@link GenericValue} of a current impersonation UserLoginHistory of current userLogin session, + * only if not the impersonator himself. + * + * @param request The HTTP request object for the current JSP or Servlet request. + * @param response The HTTP response object for the current JSP or Servlet request. + * @return GenericValue + */ + public static GenericValue checkImpersonationInProcess(HttpServletRequest request, HttpServletResponse response) { + HttpSession session = request.getSession(); + GenericValue userLogin = (GenericValue) session.getAttribute("userLogin"); + GenericValue originUserLogin = (GenericValue) session.getAttribute("originUserLogin"); + + //if originUserLogin is present, it's the impersonator session + if (originUserLogin != null) { + return null; + } + + //Check if a visit in enable with a impersonation + GenericValue userLoginHistory = null; + if (userLogin != null) { + try { + userLoginHistory = EntityQuery.use(userLogin.getDelegator()) + .from("UserLoginHistory") + .where(EntityCondition.makeCondition("userLoginId", userLogin.get("userLoginId")), + EntityCondition.makeCondition("originUserLoginId", EntityOperator.NOT_EQUAL, null)) + .filterByDate() + .queryFirst(); + } catch (GenericEntityException e) { + Debug.logError(e, "impossible to resolve userLogin history", module); + } + } + if (userLoginHistory != null) { + List

${uiLabelMap.CommonImpersonateTitle}