/// <summary>Checks whether this role is owned by the given parent role.</summary>
public bool IsA(BplRole parentRole) {
if (parentRole == null) return false;
for (var role = this; role != null; role = role.Parent as BplRole) {
if (role == parentRole) return true;
}
return false;
}
internal static bool SetClientRole(string loginName, BplRole role) {
var result = false;
try {
using (var context = new PrincipalContext(ContextType.Domain, ADServer, ADUserContainer, ADUsername, ADPassword)) {
var user = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, loginName);
if (user != null) {
var gpRole = GroupPrincipal.FindByIdentity(context, IdentityType.SamAccountName, (string)role.Id.LocalId);
if (gpRole != null) {
var grp = (DirectoryEntry)gpRole.GetUnderlyingObject();
grp.Properties["member"].Add(user.DistinguishedName);
grp.CommitChanges();
grp.Close();
result = true;
} else {
Log.Warn("Auth: Group for role {0} was not found.", role.Id);
}
} else {
Log.Warn("Auth: User {0} was not found.", loginName);
}
}
} catch (Exception e) {
Log.Exception(e, "Auth: Unable to set roles to user '{0}'", loginName);
}
return result;
}
/// <summary>Checks whether the permissions match the given role.</summary>
public bool Match(BplRole role) {
switch (_kind) {
case PatternKind.Role:
if (_role == null) {
_role = BplRole.Get(_pattern);
}
return _role != null && role != null && (_role.IsA(role) || role.IsA(_role));
case PatternKind.None:
return false;
case PatternKind.All:
return true;
case PatternKind.Union:
return _subPatterns[0].Match(role) || _subPatterns[1].Match(role);
case PatternKind.Except:
return _subPatterns[0].Match(role) && !_subPatterns[1].Match(role);
case PatternKind.Unspecified:
default:
return true;
}
}
private void _tryLoginDriver(string loginName, BplRole role, RegistrationResult status, Action<LoginResult> onFinish) {
if (status == RegistrationResult.Success && (role!=null && AuthServices.SetClientRole(loginName, role)) || role == null) {
//user is ok here so, login status is Success and no new session
_processLogin(loginName, LoginStatus.Success, onFinish);
} else {
Log.Warn("Driver registration: Unable to auto-login user {0} due to {1} upon registration", loginName, status != RegistrationResult.Success ? "invalid role ".Append(role.Description) : "status {0}".Substitute(status));
onFinish(new LoginResult { Status = LoginStatus.SessionBlocked });
}
}
