Summary
Grouper manages permissions for actions used in Linux commands. The Grouper permissions are exported to a text file and kept in sync (batch and real time) via the grouperClient on the linux server.
Using
Add a user to the sudoers file. e.g. allow user mchyzer to restart tomcats (that are allowed in Grouper). Note, you pass in the user's name in the first command line arg so the command knows who is running it (since it is run as appadmin by sudo)
mchyzer ALL=(appadmin) /opt/appserv/binMgmt/clusterTomcatHelper.sh mchyzer *
sdf
Architecture
Diagram of permissions in use
Diagram of cron'ed updates
One-time setup on the server where the permissions are needed
Create a permission definition:
Add action inheritance so "all" implies the others
Create a role for an environment
Add permission names for each application, in this case prefix the real app name with "app_"
Assign permissions to a user in the role
Change log consumer
This is the part that is a jar installed in the Grouper loader and an edit in the grouper-loader.properties to send permissions to XMPP
/**
* @author mchyzer
* $Id: PcdChangeLogConsumer.java,v 1.1 2011/11/15 06:00:00 mchyzer Exp $
*/
package edu.upenn.isc.clusterLinuxClc;
import java.util.List;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import edu.internet2.middleware.grouper.app.loader.GrouperLoaderConfig;
import edu.internet2.middleware.grouper.changeLog.ChangeLogConsumerBase;
import edu.internet2.middleware.grouper.changeLog.ChangeLogEntry;
import edu.internet2.middleware.grouper.changeLog.ChangeLogLabels;
import edu.internet2.middleware.grouper.changeLog.ChangeLogProcessorMetadata;
import edu.internet2.middleware.grouper.changeLog.ChangeLogTypeBuiltin;
import edu.internet2.middleware.grouper.util.GrouperUtil;
import edu.internet2.middleware.grouper.xmpp.XmppConnectionBean;
/**
*
*/
public class ClusterLinuxChangeLogConsumer extends ChangeLogConsumerBase {
/** */
private static final Log LOG = GrouperUtil.getLog(ClusterLinuxChangeLogConsumer.class);
/**
* @see edu.internet2.middleware.grouper.changeLog.ChangeLogConsumerBase#processChangeLogEntries(java.util.List, edu.internet2.middleware.grouper.changeLog.ChangeLogProcessorMetadata)
*/
@Override
public long processChangeLogEntries(List<ChangeLogEntry> changeLogEntryList,
ChangeLogProcessorMetadata changeLogProcessorMetadata) {
long currentId = -1;
XmppConnectionBean xmppConnectionBean = null;
String recipient = null;
//identifies which config is running, multiple could be running
String consumerName = changeLogProcessorMetadata.getConsumerName();
String grouperFolderBase = null;
{
String grouperFolderBaseConfigName = "changeLog.consumer." + consumerName + ".clusterLinux.grouperFolderBase";
grouperFolderBase = GrouperLoaderConfig.getPropertyString(grouperFolderBaseConfigName, true);
}
for (ChangeLogEntry changeLogEntry : changeLogEntryList) {
//try catch so we can track that we made some progress
try {
currentId = changeLogEntry.getSequenceNumber();
boolean sendMessage = false;
//this might be a little aggressive, but basically if a permission or member changes in the clusterLinux folder of
//grouper then send a refresh message
if (changeLogEntry.equalsCategoryAndAction(ChangeLogTypeBuiltin.PERMISSION_ADD)
|| changeLogEntry.equalsCategoryAndAction(ChangeLogTypeBuiltin.PERMISSION_DELETE)) {
String permissionName = changeLogEntry.retrieveValueForLabel(ChangeLogLabels.PERMISSION_ADD.attributeDefNameName);
if (permissionName != null && permissionName.startsWith(grouperFolderBase)) {
sendMessage = true;
}
LOG.debug("Processing changeLog #" + currentId + ", permissionName: " + permissionName
+ ", grouperFolderBase: " + grouperFolderBase
+ ", message: "
+ changeLogEntry.getChangeLogType().getChangeLogCategory() + "."
+ changeLogEntry.getChangeLogType().getActionName() + ", sendMessage: " + sendMessage
);
} else if (changeLogEntry.equalsCategoryAndAction(ChangeLogTypeBuiltin.MEMBERSHIP_ADD)
|| changeLogEntry.equalsCategoryAndAction(ChangeLogTypeBuiltin.MEMBERSHIP_DELETE)
|| changeLogEntry.equalsCategoryAndAction(ChangeLogTypeBuiltin.MEMBERSHIP_UPDATE)) {
String roleName = changeLogEntry.retrieveValueForLabel(ChangeLogLabels.MEMBERSHIP_ADD.groupName);
if (roleName != null && roleName.startsWith(grouperFolderBase)) {
sendMessage = true;
}
LOG.debug("Processing changeLog #" + currentId + ", roleName: " + roleName
+ ", grouperFolderBase: " + grouperFolderBase
+ ", message: "
+ changeLogEntry.getChangeLogType().getChangeLogCategory() + "."
+ changeLogEntry.getChangeLogType().getActionName() + ", sendMessage: " + sendMessage
);
} else if (StringUtils.equals("permission", changeLogEntry.getChangeLogType().getChangeLogCategory())
&& StringUtils.equals("permissionChangeOnRole", changeLogEntry.getChangeLogType().getActionName())) {
//note, this is 2.1+
String roleName = changeLogEntry.retrieveValueForLabel("roleName");
if (roleName != null && roleName.startsWith(grouperFolderBase)) {
sendMessage = true;
}
LOG.debug("Processing changeLog #" + currentId + ", roleName: " + roleName
+ ", grouperFolderBase: " + grouperFolderBase
+ ", message: "
+ changeLogEntry.getChangeLogType().getChangeLogCategory() + "."
+ changeLogEntry.getChangeLogType().getActionName() + ", sendMessage: " + sendMessage
);
} else {
LOG.debug("Processing changeLog #" + currentId + ", "
+ changeLogEntry.getChangeLogType().getChangeLogCategory() + "."
+ changeLogEntry.getChangeLogType().getActionName() + ", sendMessage: " + sendMessage
);
}
//is there something to send?
if (sendMessage) {
String message = "Update permissions";
if (xmppConnectionBean == null) {
recipient = GrouperLoaderConfig.getPropertyString("changeLog.consumer."
+ consumerName + ".publisher.recipient", "");
String xmppServer = GrouperLoaderConfig.getPropertyString("xmpp.server.host");
int port = GrouperLoaderConfig.getPropertyInt("xmpp.server.port", -1);
String username = GrouperLoaderConfig.getPropertyString("xmpp.user", "");
String password = GrouperLoaderConfig.getPropertyString("xmpp.pass", "");
String resource = GrouperLoaderConfig.getPropertyString("xmpp.resource", "");
xmppConnectionBean = new XmppConnectionBean(xmppServer, port, username, resource, password);
}
xmppConnectionBean.sendMessage(recipient, message);
}
} catch (Exception e) {
//we unsuccessfully processed this record... decide whether to wait, throw, ignore, log, etc...
LOG.error("problem with id: " + currentId, e);
changeLogProcessorMetadata.setHadProblem(true);
changeLogProcessorMetadata.setRecordException(e);
changeLogProcessorMetadata.setRecordExceptionSequence(currentId);
//stop here
return currentId;
//continue
}
}
return currentId;
}
}
Build that consumer into a jar:
<project name="clusterLinux" default="build" basedir=".">
<!-- declare the ant-contrib tasks -->
<taskdef resource="net/sf/antcontrib/antlib.xml" />
<!-- copy build.properties if not there already -->
<if><not><available file="build.properties" /></not>
<then><copy file="build.example.properties" tofile="build.properties" /></then>
</if>
<!-- Grouper Global Build Properties -->
<property file="${basedir}/build.properties"/>
<target name="build" description="full build" depends="init,clean,compile,jarPrepare,jar">
</target>
<target name="init">
<tstamp />
<property name="main.sourceChangeLogDir" value="../sourceChangeLogConsumer" />
<property name="main.lib" value="../lib" />
<property name="main.binChangeLogDir" value="../dist/binChangeLog" />
<property name="main.outputDir" value="../dist" />
<property name="main.appName" value="clusterLinux" />
<property name="main.jarFileChangeLog" value="${main.outputDir}/${main.appName}ChangeLog.jar" />
<path id="main.changeLogClasspath">
<fileset dir="${main.lib}">
<include name="**/*.jar" />
</fileset>
<fileset file="${grouper.jar.location}" />
</path>
</target>
<target name="clean" depends="init">
<mkdir dir="${main.binChangeLogDir}" />
<delete dir="${main.binChangeLogDir}" />
<mkdir dir="${main.binChangeLogDir}" />
</target>
<target name="compile">
<mkdir dir="${main.outputDir}" />
<mkdir dir="${main.binChangeLogDir}" />
<javac target="1.6"
srcdir="${main.sourceChangeLogDir}" destdir="${main.binChangeLogDir}" debug="true" >
<classpath refid="main.changeLogClasspath" />
</javac>
</target>
<target name="jarPrepare">
<mkdir dir="${main.binChangeLogDir}" />
<copy todir="${main.binChangeLogDir}">
<fileset dir="${main.sourceChangeLogDir}">
<include name="**/*.java"/> <!-- source -->
</fileset>
</copy>
<mkdir dir="${main.binChangeLogDir}/clusterLinux" />
<copy todir="${main.binChangeLogDir}/clusterLinux" file="build.xml" />
</target>
<target name="jar">
<tstamp>
<format property="the.timestamp" pattern="yyyy/MM/dd HH:mm:ss" />
</tstamp>
<jar jarfile="${main.jarFileChangeLog}" duplicate="fail">
<fileset dir="${main.binChangeLogDir}" />
<manifest>
<attribute name="Built-By" value="${user.name}"/>
<attribute name="Implementation-Vendor" value="Penn"/>
<attribute name="Implementation-Title" value="clusterLinuxChangeLog"/>
<attribute name="Build-Timestamp" value="${the.timestamp}"/>
</manifest>
</jar>
<echo message="Output is: ${main.jarFileChangeLog}" />
</target>
</project>
If you want to log the change log, add this to the log4j.properties:
log4j.logger.edu.upenn.isc.clusterLinuxClc.ClusterLinuxChangeLogConsumer = DEBUG
sdf