xref: /OpenGrok/plugins/README.md (revision 8b3ac4df72e407d256a36d1ae269b89de8cc4f14)

# Authorization plugins

This directory contains various authorization plugins:

  - FalsePlugin - denies everything
  - TruePlugin - allows everything
  - HttpBasicAuthorizationPlugin -
  - SampleAuthorizationPlugin -
  - LdapPlugin
  - UserPlugin

## Example configuration

The following snippet configures global authorization stack with 2 REQUISITE
plugins and a sub-stack with 1 SUFFICIENT and 1 REQUIRED plugin.

There is a config file `ldap-plugin-config.xml` specified globally that will be
used by LdapPlugin. See LdapPlugin directory for sample of this config file.


```xml
   <!-- Authorization config begin -->

   <void property="pluginStack">
        <!-- The setup will be inherited to all sub-stacks -->
        <void property="setup">
            <void method="put">
                <string>configuration</string>
                <string>/opengrok/auth/config/ldap-plugin-config.xml</string>
            </void>
        </void>

        <!-- get user cred from HTTP headers -->
        <void method="add">
            <object class="org.opensolaris.opengrok.authorization.AuthorizationPlugin">
                <void property="name">
                    <string>opengrok.auth.plugin.UserPlugin</string>
                </void>
                <void property="flag">
                    <string>REQUISITE</string>
                </void>
            </object>
        </void>

        <!-- get email, ou and uid -->
        <void method="add">
            <object class="org.opensolaris.opengrok.authorization.AuthorizationPlugin">
                <void property="name">
                    <string>opengrok.auth.plugin.LdapUserPlugin</string>
                </void>
                <void property="flag">
                    <string>REQUISITE</string>
                </void>
            </object>
        </void>

        <!-- Authorization stacks follow -->

        <void method="add">
            <object class="org.opensolaris.opengrok.authorization.AuthorizationStack">
                <void property="forProjects">
                    <void method="add">
                        <string>foo</string>
                    </void>
                </void>
                <void property="forGroups">
                    <void method="add">
                        <string>mygroup</string>
                    </void>
                </void>
                <void property="name">
                    <string>substack for some source code</string>
                </void>
                <void property="flag">
                    <string>REQUIRED</string>
                </void>
                <void method="add">
                    <object class="org.opensolaris.opengrok.authorization.AuthorizationPlugin">
                        <void property="name">
                            <string>opengrok.auth.plugin.LdapAttr</string>
                        </void>
                        <void property="flag">
                            <string>SUFFICIENT</string>
                        </void>
                        <void property="setup">
                            <void method="put">
                                <string>attribute</string>
                                <string>mail</string>
                            </void>
                            <void method="put">
                                <string>file</string>
                                <string>/opengrok/auth/config/whitelists/mycode-whitelist-mail.txt</string>
                            </void>
                        </void>
                    </object>
                </void>
                <void method="add">
                    <object class="org.opensolaris.opengrok.authorization.AuthorizationPlugin">
                        <void property="name">
                            <string>opengrok.auth.plugin.LdapFilter</string>
                        </void>
                        <void property="flag">
                            <string>REQUIRED</string>
                        </void>
                        <void property="setup">
                            <void method="put">
                                <string>filter</string>
                                <string>(&amp;(objectclass=posixGroup)(cn=my_src*)(memberUid=%uid%))</string>
                            </void>
                        </void>
                    </object>
                </void>
            </object>
        </void>

   <!-- Authorization config end -->
   </object>
```