org.dataone.cn.rest.v1

Class IdentityController

java.lang.Object

org.dataone.cn.rest.AbstractServiceController

org.dataone.cn.rest.v1.IdentityController

All Implemented Interfaces:

org.springframework.beans.factory.Aware, org.springframework.web.context.ServletContextAware

@Controller(value="identityController")
public class IdentityController
extends AbstractServiceController
implements org.springframework.web.context.ServletContextAware

The controller for identity manager service

Author:

leinfelder

Field Summary

Fields inherited from class org.dataone.cn.rest.AbstractServiceController

FRAGMENT_REQUEST_PARAM_KEY, SCHEME_REQUEST_PARAM_KEY

Constructor Summary

Constructors

Constructor and Description
IdentityController()

Method Summary

Modifier and Type	Method and Description
void	confirmMapIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Confirms a previously initiated identity mapping.
org.springframework.web.servlet.ModelAndView	createGroup(org.springframework.web.multipart.MultipartHttpServletRequest request, javax.servlet.http.HttpServletResponse response) Create a group with the given name.
void	denyMapIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Denies a previously initiated identity mapping.
org.springframework.web.servlet.ModelAndView	getPendingMapIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Gets the SubjectInfo of a previously initiated identity mapping.
org.springframework.web.servlet.ModelAndView	getSubjectInfo(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Get the information about a Person (their equivalent identities, and the Groups to which they belong) or the Group (including members).
org.springframework.web.servlet.ModelAndView	listSubjects(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) List the subjects, including users, groups, and systems, that match search criteria.
void	mapIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Create a new mapping between the two identities, asserting that they represent the same subject.
org.springframework.web.servlet.ModelAndView	registerAccount(org.springframework.web.multipart.MultipartHttpServletRequest fileRequest, javax.servlet.http.HttpServletResponse response) Create a new subject in the DataONE system.
void	removeMapIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Removes a previously asserted identity mapping from the Subject in the Session to the Subject given by the parameter.
void	requestMapIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Request a new mapping between the authenticated identity in the session and the given identity, asserting that they represent the same subject.
void	setServletContext(javax.servlet.ServletContext sc)
org.springframework.web.servlet.ModelAndView	updateAccount(org.springframework.web.multipart.MultipartHttpServletRequest fileRequest, javax.servlet.http.HttpServletResponse response) Update an existing subject in the DataONE system.
void	updateGroup(org.springframework.web.multipart.MultipartHttpServletRequest fileRequest, javax.servlet.http.HttpServletResponse response) Add members to the named group.
void	verifyAccount(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Verify that the Person data associated with this Subject is a true representation of the real world person.

Methods inherited from class org.dataone.cn.rest.AbstractServiceController

debugRequest, extractPidFromRequestParam, extractPidFromRequestURI, extractSubjectFromRequestParam, extractValueFromRequestParam, handleBaseException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException, handleException

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

IdentityController

public IdentityController()

Method Detail

mapIdentity

@RequestMapping(value={"/v1/accounts/map","/v1/accounts/map/"},
                method=POST)
public void mapIdentity(javax.servlet.http.HttpServletRequest request,
                                                                                                                     javax.servlet.http.HttpServletResponse response)
                                                                                                              throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                     org.dataone.service.exceptions.InvalidToken,
                                                                                                                     org.dataone.service.exceptions.NotAuthorized,
                                                                                                                     org.dataone.service.exceptions.NotImplemented,
                                                                                                                     org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                                     org.dataone.service.exceptions.InvalidCredentials,
                                                                                                                     org.dataone.service.exceptions.InvalidRequest,
                                                                                                                     org.dataone.service.exceptions.NotFound

Create a new mapping between the two identities, asserting that they represent the same subject. Mapping identities with this method requires explicit authorization for the user given in the Session object. The caller must have made sure that the primary and secondary identities represent one and the same individual. Successful completion of the request is indicated by returning a HTTP status of 200. A failed request MUST be indicated by returning an appropriate exception and setting the response HTTP status accordingly. POST /accounts/map CNIdentity.mapIdentity(session, subject) -> boolean

Parameters:

request -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

removeMapIdentity

@RequestMapping(value="/v1/accounts/map/*",
                method=DELETE)
public void removeMapIdentity(javax.servlet.http.HttpServletRequest request,
                                                                                                         javax.servlet.http.HttpServletResponse response)
                                                                                                  throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                         org.dataone.service.exceptions.InvalidToken,
                                                                                                         org.dataone.service.exceptions.NotAuthorized,
                                                                                                         org.dataone.service.exceptions.NotImplemented,
                                                                                                         org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                         org.dataone.service.exceptions.InvalidCredentials,
                                                                                                         org.dataone.service.exceptions.InvalidRequest,
                                                                                                         org.dataone.service.exceptions.NotFound

Removes a previously asserted identity mapping from the Subject in the Session to the Subject given by the parameter. The reciprocal mapping entry is also removed. DELETE /accounts/map/{subject} CNIdentity.removeMapIdentity(session, subject) -> boolean

Parameters:

request -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

getPendingMapIdentity

@RequestMapping(value="/v1/accounts/pendingmap/*",
                method=GET)
public org.springframework.web.servlet.ModelAndView getPendingMapIdentity(javax.servlet.http.HttpServletRequest request,
                                                                                                                                                         javax.servlet.http.HttpServletResponse response)
                                                                                                                                                  throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                                         org.dataone.service.exceptions.InvalidToken,
                                                                                                                                                         org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                                         org.dataone.service.exceptions.NotImplemented,
                                                                                                                                                         org.dataone.service.exceptions.InvalidRequest,
                                                                                                                                                         org.dataone.service.exceptions.NotFound

Gets the SubjectInfo of a previously initiated identity mapping. GET /accounts/pendingmap/{subject} CNIdentity.getPendingMapIdentity(session, subject) -> subjectInfo

Parameters:

request -

response -

Returns:

SubjectInfo

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.NotFound

org.dataone.service.exceptions.InvalidRequest

requestMapIdentity

@RequestMapping(value={"/v1/accounts/pendingmap","/v1/accounts/pendingmap/"},
                method=POST)
public void requestMapIdentity(javax.servlet.http.HttpServletRequest request,
                                                                                                                                          javax.servlet.http.HttpServletResponse response)
                                                                                                                                   throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                          org.dataone.service.exceptions.InvalidToken,
                                                                                                                                          org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                          org.dataone.service.exceptions.NotImplemented,
                                                                                                                                          org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                                                          org.dataone.service.exceptions.InvalidCredentials,
                                                                                                                                          org.dataone.service.exceptions.InvalidRequest,
                                                                                                                                          org.dataone.service.exceptions.NotFound

Request a new mapping between the authenticated identity in the session and the given identity, asserting that they represent the same subject. Mapping identities is a two-step process wherein a map request is made by a primary Subject and a subsequent (confirmation) map request is made by the secondary Subject. This ensures that mappings are performed only by those that have authority to do so. POST /accounts/pendingmap CNIdentity.requestMapIdentity(session, subject) -> boolean

Parameters:

request -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.NotFound

confirmMapIdentity

@RequestMapping(value="/v1/accounts/pendingmap/*",
                method=PUT)
public void confirmMapIdentity(javax.servlet.http.HttpServletRequest request,
                                                                                                              javax.servlet.http.HttpServletResponse response)
                                                                                                       throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                              org.dataone.service.exceptions.InvalidToken,
                                                                                                              org.dataone.service.exceptions.NotAuthorized,
                                                                                                              org.dataone.service.exceptions.NotImplemented,
                                                                                                              org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                              org.dataone.service.exceptions.InvalidCredentials,
                                                                                                              org.dataone.service.exceptions.InvalidRequest,
                                                                                                              org.dataone.service.exceptions.NotFound

Confirms a previously initiated identity mapping. If subject A asserts that B is the same identity through CNIdentity.requestMapIdentity(), then this method is called by B to confirm that assertion. PUT /accounts/pendingmap/{subject} CNIdentity.confirmMapIdentity(session, subject) -> boolean

Parameters:

request -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

denyMapIdentity

@RequestMapping(value="/v1/accounts/pendingmap/*",
                method=DELETE)
public void denyMapIdentity(javax.servlet.http.HttpServletRequest request,
                                                                                                              javax.servlet.http.HttpServletResponse response)
                                                                                                       throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                              org.dataone.service.exceptions.InvalidToken,
                                                                                                              org.dataone.service.exceptions.NotAuthorized,
                                                                                                              org.dataone.service.exceptions.NotImplemented,
                                                                                                              org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                              org.dataone.service.exceptions.InvalidCredentials,
                                                                                                              org.dataone.service.exceptions.InvalidRequest,
                                                                                                              org.dataone.service.exceptions.NotFound

Denies a previously initiated identity mapping. If subject A asserts that B is the same identity through CNIdentity.requestMapIdentity(), then this method is called by B to deny that assertion. DELETE /accounts/pendingmap/{subject} CNIdentity.denyMapIdentity(session, subject) -> boolean

Parameters:

request -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.NotFound

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidRequest

listSubjects

@RequestMapping(value={"/v1/accounts","/v1/accounts/"},
                method=GET)
public org.springframework.web.servlet.ModelAndView listSubjects(javax.servlet.http.HttpServletRequest request,
                                                                                                                                                     javax.servlet.http.HttpServletResponse response)
                                                                                                                                              throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                                     org.dataone.service.exceptions.InvalidToken,
                                                                                                                                                     org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                                     org.dataone.service.exceptions.NotImplemented,
                                                                                                                                                     org.dataone.service.exceptions.InvalidRequest

List the subjects, including users, groups, and systems, that match search criteria. The list can be restricted to subjects whose identifier matches certain substrings, and the size of the resultset can be paged through. GET /accounts?query={query}[&status={status}&start={start}&count={count}] CNIdentity.listSubjects(session, query, status, start, count) -> Types.SubjectList

Parameters:

request -

response -

Returns:

SubjectInfo

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotImplemented

getSubjectInfo

@RequestMapping(value="/v1/accounts/*",
                method=GET)
public org.springframework.web.servlet.ModelAndView getSubjectInfo(javax.servlet.http.HttpServletRequest request,
                                                                                                                                       javax.servlet.http.HttpServletResponse response)
                                                                                                                                throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                       org.dataone.service.exceptions.InvalidToken,
                                                                                                                                       org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                       org.dataone.service.exceptions.NotImplemented,
                                                                                                                                       org.dataone.service.exceptions.InvalidRequest,
                                                                                                                                       org.dataone.service.exceptions.NotFound

Get the information about a Person (their equivalent identities, and the Groups to which they belong) or the Group (including members). GET /accounts/{subject} CNIdentity.getSubjectInfo(session, subject) -> Types.SubjectList

Parameters:

request -

response -

Returns:

SubjectInfo

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

registerAccount

@RequestMapping(value={"/v1/accounts","/v1/accounts/"},
                method=POST)
public org.springframework.web.servlet.ModelAndView registerAccount(org.springframework.web.multipart.MultipartHttpServletRequest fileRequest,
                                                                                                                                                         javax.servlet.http.HttpServletResponse response)
                                                                                                                                                  throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                                         org.dataone.service.exceptions.InvalidToken,
                                                                                                                                                         org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                                         org.dataone.service.exceptions.NotImplemented,
                                                                                                                                                         org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                                                                         org.dataone.service.exceptions.InvalidCredentials,
                                                                                                                                                         org.dataone.service.exceptions.InvalidRequest

Create a new subject in the DataONE system. Note that there should probably be a lot more metadata captured about the new user, and there should be a mechanism for specifying the default access control rules for the new account. POST /accounts CNIdentity.registerAccount(session, person) -> Types.Subject

Parameters:

fileRequest -

response -

Returns:

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidRequest

updateAccount

@RequestMapping(value="/v1/accounts/**",
                method=PUT)
public org.springframework.web.servlet.ModelAndView updateAccount(org.springframework.web.multipart.MultipartHttpServletRequest fileRequest,
                                                                                                                                       javax.servlet.http.HttpServletResponse response)
                                                                                                                                throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                       org.dataone.service.exceptions.InvalidToken,
                                                                                                                                       org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                       org.dataone.service.exceptions.NotImplemented,
                                                                                                                                       org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                                                       org.dataone.service.exceptions.InvalidCredentials,
                                                                                                                                       org.dataone.service.exceptions.InvalidRequest,
                                                                                                                                       org.dataone.service.exceptions.NotFound

Update an existing subject in the DataONE system. The target subject is determined from the X509Certificate provided with the session. The user calling this method must have write access to the account details. Note that there should be a policy for verifying the details that change via this method. PUT /accounts CNIdentity.updateAccount(session, person) -> Types.Subject

Parameters:

fileRequest -

response -

Returns:

Subject

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

verifyAccount

@RequestMapping(value="/v1/accounts/verification/*",
                method=PUT)
public void verifyAccount(javax.servlet.http.HttpServletRequest request,
                                                                                                           javax.servlet.http.HttpServletResponse response)
                                                                                                    throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                           org.dataone.service.exceptions.InvalidToken,
                                                                                                           org.dataone.service.exceptions.NotAuthorized,
                                                                                                           org.dataone.service.exceptions.NotImplemented,
                                                                                                           org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                           org.dataone.service.exceptions.InvalidCredentials,
                                                                                                           org.dataone.service.exceptions.InvalidRequest,
                                                                                                           org.dataone.service.exceptions.NotFound

Verify that the Person data associated with this Subject is a true representation of the real world person. This service can only be called by users who have an administrative role for the domain of users in question. POST /accounts/{subject} CNIdentity.verifyAccount(session, subject) -> boolean

Parameters:

request -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

createGroup

@RequestMapping(value={"/v1/groups","/v1/groups/"},
                method=POST)
public org.springframework.web.servlet.ModelAndView createGroup(org.springframework.web.multipart.MultipartHttpServletRequest request,
                                                                                                                                                 javax.servlet.http.HttpServletResponse response)
                                                                                                                                          throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                                                                 org.dataone.service.exceptions.InvalidToken,
                                                                                                                                                 org.dataone.service.exceptions.NotAuthorized,
                                                                                                                                                 org.dataone.service.exceptions.NotImplemented,
                                                                                                                                                 org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                                                                 org.dataone.service.exceptions.InvalidCredentials,
                                                                                                                                                 org.dataone.service.exceptions.InvalidRequest,
                                                                                                                                                 org.dataone.service.exceptions.NotFound

Create a group with the given name. Groups are lists of subjects that allow all members of the group to be referenced by listing solely the subject name of the group. Group names must be unique within the DataONE system. Groups can only be modified by Subjects listed as rightsHolders. POST /groups CNIdentity.createGroup(session, group) -> Types.Subject

Parameters:

request -

response -

Returns:

Subject

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.NotFound

updateGroup

@RequestMapping(value={"/v1/groups","/v1/groups/"},
                method=PUT)
public void updateGroup(org.springframework.web.multipart.MultipartHttpServletRequest fileRequest,
                                                                                                        javax.servlet.http.HttpServletResponse response)
                                                                                                 throws org.dataone.service.exceptions.ServiceFailure,
                                                                                                        org.dataone.service.exceptions.InvalidToken,
                                                                                                        org.dataone.service.exceptions.NotAuthorized,
                                                                                                        org.dataone.service.exceptions.NotImplemented,
                                                                                                        org.dataone.service.exceptions.IdentifierNotUnique,
                                                                                                        org.dataone.service.exceptions.InvalidCredentials,
                                                                                                        org.dataone.service.exceptions.InvalidRequest,
                                                                                                        org.dataone.service.exceptions.NotFound

Add members to the named group. Group members can be added by the original creator of the group, otherwise a NotAuthorized exception is thrown. Group members are provided as a list of subjects to be added to the group. PUT /groups CNIdentity.updateGroup(session, group) -> boolean

Parameters:

fileRequest -

response -

Throws:

org.dataone.service.exceptions.ServiceFailure

org.dataone.service.exceptions.InvalidToken

org.dataone.service.exceptions.NotAuthorized

org.dataone.service.exceptions.NotImplemented

org.dataone.service.exceptions.IdentifierNotUnique

org.dataone.service.exceptions.InvalidRequest

org.dataone.service.exceptions.InvalidCredentials

org.dataone.service.exceptions.NotFound

setServletContext

public void setServletContext(javax.servlet.ServletContext sc)

Specified by:

setServletContext in interface org.springframework.web.context.ServletContextAware