Package edu.internet2.middleware.grouper.app.interfolio

Class InterfolioExternalSystem

java.lang.Object
edu.internet2.middleware.grouper.app.config.GrouperConfigurationModuleBase
edu.internet2.middleware.grouper.app.externalSystem.GrouperExternalSystem
edu.internet2.middleware.grouper.app.interfolio.InterfolioExternalSystem
All Implemented Interfaces:
OptionValueDriver
public class InterfolioExternalSystem extends GrouperExternalSystem
External system for the Interfolio faculty information system. Interfolio exposes a few distinct API surfaces, all authenticated with the same HMAC-SHA1 "INTF" scheme but living on different hosts: - IAM API (iamUrl, e.g. https://iam-api.interfolio.com) - user identity: create / update users. - byc/core API (bycUrl, e.g. https://logic.interfolio.com) - search users and grant/remove access to the products RPT (byc-tenure) and FS (byc-search) via subscribe/unsubscribe. (Interfolio also has a Faculty180/FAR API on faculty180.interfolio.com, but it is a separate auth realm that our credentials are not authorized for, so it is intentionally not modeled here.) The HMAC signature string is: VERB + "\n\n\n" + timestamp + "\n" + requestString, HMAC-SHA1'd with the private key, base64-encoded, and sent as "Authorization: INTF {publicKey}:{signature}" along with a "TimeStamp" header. The requestString is everything after the host (path + query), and the query string - if any - must be signed verbatim. Config (in grouper-loader.properties), prefix grouper.interfolio.{configId}. : publicKey - the INTF public key privateKey - the INTF private key (secret) databaseId - the Interfolio tenant id (used in the URL path) bycUrl - base url for the byc/core API (search, subscribe, unsubscribe) iamUrl - base url for the IAM API (create, update)

  • Constructor Details

    • InterfolioExternalSystem

      public InterfolioExternalSystem()

  • Method Details

    • getConfigFileName

      public ConfigFileName getConfigFileName()
      Description copied from class: GrouperConfigurationModuleBase
      config file name to check for properties and metadata
      Specified by:
      getConfigFileName in class GrouperConfigurationModuleBase
      Returns:

    • getConfigItemPrefix

      public String getConfigItemPrefix()
      Description copied from class: GrouperConfigurationModuleBase
      prefix for the properties eg: provisioner.someConfigId.
      Specified by:
      getConfigItemPrefix in class GrouperConfigurationModuleBase
      Returns:
      the prefix

    • getConfigIdRegex

      public String getConfigIdRegex()
      Description copied from class: GrouperConfigurationModuleBase
      config id regeg eg: ^(provisioner)\\.([^.]+)\\.(.*)$
      Specified by:
      getConfigIdRegex in class GrouperConfigurationModuleBase
      Returns:

    • getConfigIdThatIdentifiesThisConfig

      public String getConfigIdThatIdentifiesThisConfig()
      Description copied from class: GrouperConfigurationModuleBase
      config id that identified this config. either suffix and value or getConfigIdThatIdentifiesThisConfig is required, not both. eg: personLdap
      Overrides:
      getConfigIdThatIdentifiesThisConfig in class GrouperConfigurationModuleBase
      Returns:

    • test

      public List<String> test() throws UnsupportedOperationException
      Validate the configuration: the required properties are present, and (if they are) a lightweight search call authenticates against Interfolio.
      Overrides:
      test in class GrouperExternalSystem
      Returns:
      Throws:
      UnsupportedOperationException

    • retrieveConfigValue

      public static String retrieveConfigValue(String configId, String suffix)
      Read a config value for this external system's configId.
      Parameters:
      configId - external system config id
      suffix - the property suffix after grouper.interfolio.{configId}.
      Returns:
      the value (required - throws if missing)

    • attachInterfolioHmacHeaders

      public static void attachInterfolioHmacHeaders(String configId, GrouperHttpClient grouperHttpClient, String requestVerb, String requestString)
      Attach the Interfolio HMAC authorization headers to an http client. Signs VERB + "\n\n\n" + timestamp + "\n" + requestString with HMAC-SHA1 using the private key, base64-encodes it, and sets: TimeStamp: {timestamp} Authorization: INTF {publicKey}:{signature} IMPORTANT: requestString must be exactly the path (plus query string, if any) that follows the host in the URL, and must match what is actually sent on the wire, or the signature will fail.
      Parameters:
      configId - external system config id (to look up the public/private key)
      grouperHttpClient - the http client to add headers to
      requestVerb - HTTP verb (GET, POST, PUT, ...)
      requestString - the path + query that follows the host, signed verbatim