Package edu.internet2.middleware.grouper.ws.mcp

Class GrouperMcpAuthUser

java.lang.Object
edu.internet2.middleware.grouper.ws.mcp.GrouperMcpAuthUser
public class GrouperMcpAuthUser extends Object
holds the authenticated MCP user identity, regardless of whether they authenticated via OAuth JWT or via normal WS authentication (HTTP Basic, container auth, etc.).

When the user authenticated via OAuth JWT, the consent scope booleans reflect what the user approved on the consent page. When the user authenticated via normal WS auth (HTTP Basic, container, etc.), the consent scope booleans are all false and isOAuthAuthenticated() returns false, meaning consent scopes are not applicable and only group membership is used for authorization.

  • Constructor Details

    • GrouperMcpAuthUser

      public GrouperMcpAuthUser(Subject subject)
      constructor
      Parameters:
      subject - the resolved Grouper subject

  • Method Details

    • getSubject

      public Subject getSubject()
      the resolved Grouper subject for the authenticated user
      Returns:
      the subject

    • getMemberInternalId

      public long getMemberInternalId()
      member internal id from grouper_members for the authenticated user
      Returns:
      the member internal id

    • setMemberInternalId

      public void setMemberInternalId(long memberInternalId1)
      set the member internal id
      Parameters:
      memberInternalId1 -

    • isOAuthAuthenticated

      public boolean isOAuthAuthenticated()
      whether this user authenticated via OAuth JWT
      Returns:
      true if OAuth JWT authenticated

    • setOAuthAuthenticated

      public void setOAuthAuthenticated(boolean oAuthAuthenticated1)
      set whether this user authenticated via OAuth JWT
      Parameters:
      oAuthAuthenticated1 -

    • isConsentScopeReadonly

      public boolean isConsentScopeReadonly()
      whether the user consented to the readonly scope
      Returns:
      true if readonly was consented

    • setConsentScopeReadonly

      public void setConsentScopeReadonly(boolean consentScopeReadonly1)
      set whether the user consented to the readonly scope
      Parameters:
      consentScopeReadonly1 -

    • isConsentScopeReadwrite

      public boolean isConsentScopeReadwrite()
      whether the user consented to the readwrite scope
      Returns:
      true if readwrite was consented

    • setConsentScopeReadwrite

      public void setConsentScopeReadwrite(boolean consentScopeReadwrite1)
      set whether the user consented to the readwrite scope
      Parameters:
      consentScopeReadwrite1 -

    • isConsentScopeSqlReadonly

      public boolean isConsentScopeSqlReadonly()
      whether the user consented to the sqlReadonly scope
      Returns:
      true if sqlReadonly was consented

    • setConsentScopeSqlReadonly

      public void setConsentScopeSqlReadonly(boolean consentScopeSqlReadonly1)
      set whether the user consented to the sqlReadonly scope
      Parameters:
      consentScopeSqlReadonly1 -

    • isConsentScopeAdminReadonly

      public boolean isConsentScopeAdminReadonly()
      whether the user consented to the adminReadonly scope
      Returns:
      true if adminReadonly was consented

    • setConsentScopeAdminReadonly

      public void setConsentScopeAdminReadonly(boolean consentScopeAdminReadonly1)
      set whether the user consented to the adminReadonly scope
      Parameters:
      consentScopeAdminReadonly1 -

    • isConsentScopeAdminReadwrite

      public boolean isConsentScopeAdminReadwrite()
      whether the user consented to the adminReadwrite scope
      Returns:
      true if adminReadwrite was consented

    • setConsentScopeAdminReadwrite

      public void setConsentScopeAdminReadwrite(boolean consentScopeAdminReadwrite1)
      set whether the user consented to the adminReadwrite scope
      Parameters:
      consentScopeAdminReadwrite1 -

    • getOauthClientInternalId

      public Long getOauthClientInternalId()
      internal id of the OAuth client, or null if not OAuth authenticated
      Returns:
      the oauth client internal id

    • setOauthClientInternalId

      public void setOauthClientInternalId(Long oauthClientInternalId1)
      set the oauth client internal id
      Parameters:
      oauthClientInternalId1 -

    • getConsentReadwriteFolders

      public List<String> getConsentReadwriteFolders()
      readwrite scope restriction: folder paths the user consented to. null or empty means no folder restriction, unless consentReadwriteScopeRestricted is true (then empty means nothing allowed).
      Returns:
      the folder paths

    • setConsentReadwriteFolders

      public void setConsentReadwriteFolders(List<String> consentReadwriteFolders1)
      set the readwrite folder scope restriction
      Parameters:
      consentReadwriteFolders1 -

    • getConsentReadwriteGroups

      public List<String> getConsentReadwriteGroups()
      readwrite scope restriction: group paths the user consented to. null or empty means no group restriction, unless consentReadwriteScopeRestricted is true (then empty means nothing allowed).
      Returns:
      the group paths

    • setConsentReadwriteGroups

      public void setConsentReadwriteGroups(List<String> consentReadwriteGroups1)
      set the readwrite group scope restriction
      Parameters:
      consentReadwriteGroups1 -

    • getConsentReadwriteSubjects

      public List<String> getConsentReadwriteSubjects()
      readwrite scope restriction: subject IDs/identifiers the user consented to. null or empty means no subject restriction, unless consentReadwriteScopeRestricted is true (then empty means nothing allowed).
      Returns:
      the subject IDs

    • setConsentReadwriteSubjects

      public void setConsentReadwriteSubjects(List<String> consentReadwriteSubjects1)
      set the readwrite subject scope restriction
      Parameters:
      consentReadwriteSubjects1 -

    • isConsentReadwriteScopeRestricted

      public boolean isConsentReadwriteScopeRestricted()
      whether readwrite data-scope restrictions are active. when true, empty restriction lists mean "nothing is allowed" for that category. when false, empty lists mean "no restriction" (all allowed).
      Returns:
      true if restrictions are active

    • setConsentReadwriteScopeRestricted

      public void setConsentReadwriteScopeRestricted(boolean consentReadwriteScopeRestricted1)
      set whether readwrite data-scope restrictions are active
      Parameters:
      consentReadwriteScopeRestricted1 -

    • isGroupInReadwriteScope

      public boolean isGroupInReadwriteScope(String groupName)
      Check if a group name is within the readwrite scope restriction. First checks the name directly against the scope lists. If no match is found, resolves the group to get its UUID and checks that as well. This allows the scope list to contain either group names or UUIDs.
      Parameters:
      groupName - the full group name (ID path)
      Returns:
      true if the group is in the readwrite scope

    • isGroupInReadwriteScope

      public boolean isGroupInReadwriteScope(String groupName, String groupUuid)
      Check if a group is within the readwrite scope restriction by checking both the group name and UUID against the scope lists. If no folder/group restrictions are set: when consentReadwriteScopeRestricted is false all groups are in scope; when true, groups are in scope only if at least one other dimension (subjects) has values (meaning this dimension is simply unscoped, not blocked). A group is in scope if its name or UUID matches a consented group entry, or if its name starts with a consented folder path followed by ":".
      Parameters:
      groupName - the full group name (ID path), may be null
      groupUuid - the group UUID, may be null
      Returns:
      true if the group is in the readwrite scope

    • isStemInReadwriteScope

      public boolean isStemInReadwriteScope(String stemName)
      Check if a stem (folder) name is within the readwrite scope restriction. First checks the name directly against the scope lists. If no match is found, resolves the stem to get its UUID and checks that as well. This allows the scope list to contain either stem names or UUIDs.
      Parameters:
      stemName - the full stem name (ID path)
      Returns:
      true if the stem is in the readwrite scope

    • isStemInReadwriteScope

      public boolean isStemInReadwriteScope(String stemName, String stemUuid)
      Check if a stem (folder) is within the readwrite scope restriction by checking both the stem name and UUID against the scope lists. If no folder restrictions are set: when consentReadwriteScopeRestricted is false all stems are in scope; when true, stems are in scope only if at least one other dimension has values (meaning this dimension is simply unscoped, not blocked). A stem is in scope if its name or UUID matches a consented folder entry, or if its name starts with a consented folder path followed by ":".
      Parameters:
      stemName - the full stem name (ID path), may be null
      stemUuid - the stem UUID, may be null
      Returns:
      true if the stem is in the readwrite scope

    • isSubjectInReadwriteScope

      public boolean isSubjectInReadwriteScope(String subjectIdOrIdentifier)
      Check if a subject ID or identifier is within the readwrite scope restriction. First checks the provided value directly. If no match is found, resolves the member record to get all identifiers (subjectId, subjectIdentifier0, subjectIdentifier1, subjectIdentifier2) and checks those as well. This allows the scope list to contain any form of subject identifier and still match regardless of which form the API caller uses.
      Parameters:
      subjectIdOrIdentifier - the subject ID or identifier to check
      Returns:
      true if the subject is in the readwrite scope

    • isSubjectInReadwriteScope

      public boolean isSubjectInReadwriteScope(List<String> subjectIdsAndIdentifiers)
      Check if any of the given subject identifiers (subjectId, subjectIdentifier0, subjectIdentifier1, subjectIdentifier2, etc.) are within the readwrite scope restriction. This allows the scope list to contain any form of subject identifier (ID, identifier0, identifier1, identifier2) and still match regardless of which form the API caller uses. If no subject restrictions are set: when consentReadwriteScopeRestricted is false all subjects are in scope; when true, subjects are in scope only if at least one other dimension has values (meaning this dimension is simply unscoped, not blocked).
      Parameters:
      subjectIdsAndIdentifiers - all known IDs and identifiers for the subject
      Returns:
      true if any of the identifiers matches the readwrite scope

    • getJwtIssuedAt

      public Date getJwtIssuedAt()
      when the JWT was issued (from the "iat" claim), or null if not OAuth authenticated
      Returns:
      the issued-at date

    • setJwtIssuedAt

      public void setJwtIssuedAt(Date jwtIssuedAt1)
      set when the JWT was issued
      Parameters:
      jwtIssuedAt1 -

    • buildReadwriteScopeDeniedError

      public String buildReadwriteScopeDeniedError(String entityType, String entityName)
      build a scope denial error message that includes when the JWT was issued, so the user can tell if they need to re-authenticate to get updated scopes.
      Parameters:
      entityType - e.g. "group", "stem", "subject"
      entityName - the name of the entity that was denied
      Returns:
      the error message string

    • hasGroupOrFolderReadwriteScope

      public boolean hasGroupOrFolderReadwriteScope()
      check if the user has any group or folder values in the readwrite scope. when scope is restricted and there are no group or folder scope values, returns false, meaning tools like group_save, group_delete, folder_delete should not be available. when scope is not restricted, always returns true.
      Returns:
      true if the user has group or folder scope or is not scope restricted

    • hasSubjectReadwriteScope

      public boolean hasSubjectReadwriteScope()
      check if the user has any subject values in the readwrite scope. when scope is restricted and there are no subject scope values, returns false, meaning subject-owner operations in attribute_assignment_save should be denied. when scope is not restricted, always returns true.
      Returns:
      true if the user has subject scope or is not scope restricted