added LSL2 stored procedures
This commit is contained in:
Infineon\StieberD
380
LSL2/STPROC/SECURITY_SERVICES.txt
Normal file
380
LSL2/STPROC/SECURITY_SERVICES.txt
Normal file
@ -0,0 +1,380 @@
|
||||
Function Security_Services(@Service, @Params)
|
||||
/***********************************************************************************************************************
|
||||
|
||||
This program is proprietary and is not to be used by or disclosed to others, nor is it to be copied without written
|
||||
permission from SRP Computer Solutions, Inc.
|
||||
|
||||
Name : Security_Services
|
||||
|
||||
Description : Handler program for all module related services.
|
||||
|
||||
Notes : The generic parameters should contain all the necessary information to process the services. Often
|
||||
this will be information like the data Record and Key ID.
|
||||
|
||||
Parameters :
|
||||
Service [in] -- Name of the service being requested
|
||||
Param1-10 [in/out] -- Additional request parameter holders
|
||||
Response [out] -- Response to be sent back to the Controller (MCP) or requesting procedure
|
||||
|
||||
Metadata :
|
||||
@@REGISTER_SERVICES_MODULE(Security)
|
||||
|
||||
History : (Date, Initials, Notes)
|
||||
05/18/17 dmb Original programmer. - [EPIOI-8]
|
||||
02/13/18 dmb Added GetAccessLevel service.
|
||||
02/13/18 dmb Added ValidateAuthenticationRequests service.
|
||||
|
||||
***********************************************************************************************************************/
|
||||
|
||||
#pragma precomp SRP_PreCompiler
|
||||
|
||||
$insert LOGICAL
|
||||
$insert SERVICE_SETUP
|
||||
$insert DICT_EQUATES
|
||||
$insert FILE.SYSTEM.EQUATES
|
||||
$insert RLIST_EQUATES
|
||||
$insert AD_GROUP_VALIDATION_REQUESTS_EQUATES
|
||||
$insert Logon32_Equates
|
||||
$insert MSG_EQUATES
|
||||
|
||||
Declare subroutine Memory_Services, Database_Services, SRP_Stopwatch, Error_Services, RTP57, Set_Status, WinYield
|
||||
Declare subroutine Sleepery, Yield, Messaging_Services
|
||||
Declare function Memory_Services, Database_Services, Security_Services, SRP_Sort_Array, obj_Tables, Error_Services
|
||||
Declare function GetTickCount, MemberOf, SRP_LogonUser, RTI_LDAP_Groups_for_User, SRPLogonAPI_ValidateUser
|
||||
Declare function SRP_Logon, Dialog_Box, Msg, Active_Directory_Services
|
||||
|
||||
GoToService else
|
||||
Error_Services('Set', Service : ' is not a valid service request within the ' : ServiceModule : ' services module.')
|
||||
end
|
||||
|
||||
Return Response else ''
|
||||
|
||||
|
||||
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
// Services
|
||||
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// AuthenticateLSLCredentials
|
||||
//
|
||||
// Authenticates an LSL username and password (not SSO/AD credentials).
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service AuthenticateLSLCredentials(LSLUsername, LSLPassword)
|
||||
|
||||
Response = False$
|
||||
If ( (LSLUsername NE '') and (LSLPassword NE '') ) then
|
||||
Convert @Lower_Case to @Upper.Case in LSLUsername
|
||||
If RowExists('LSL_USERS', LSLUsername) then
|
||||
Password = Xlate('LSL_USERS', LSLUsername, 'PASSWORD', 'X')
|
||||
If LSLPassword EQ Password then
|
||||
Response = True$
|
||||
end else
|
||||
Error_Services('Add', 'Incorrect password entered for LSL username: ':LSLUsername:'.')
|
||||
end
|
||||
end else
|
||||
Error_Services('Add', 'Invalid LSL username ':LSLUsername:'.')
|
||||
end
|
||||
end else
|
||||
Error_Services('Add', 'LSLUSername or LSLPassword not supplied in service ':Service:'.')
|
||||
end
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// HasIPData
|
||||
//
|
||||
// Table - Database table name. - [Required]
|
||||
// KeyID - Key ID of the row being examined. - [Required]
|
||||
//
|
||||
// Returns a boolean flag indicating whether the indicated table and Key ID has IP data that is governed by Export
|
||||
// Control.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service HasIPData(Table, KeyID)
|
||||
|
||||
ServiceKeyID := '*' : Table : '*' : KeyID
|
||||
IPData = Memory_Services('GetValue', ServiceKeyID, True$, 3600)
|
||||
|
||||
If IPData EQ '' then
|
||||
If Table NE '' AND KeyID NE '' then
|
||||
FileError = @File_Error
|
||||
Memory_Services('SetValue', 'SuspendAuthentication', True$)
|
||||
IPData = Xlate(Table, KeyID, 'EXPORT_CONTROL', 'X')
|
||||
Memory_Services('SetValue', 'SuspendAuthentication', False$)
|
||||
@File_Error = FileError
|
||||
end else
|
||||
Error_Services('Add', 'Table or KeyID argument is missing in the ' : Service : ' service.')
|
||||
end
|
||||
If IPData EQ '' then IPData = False$
|
||||
end
|
||||
|
||||
Response = IPData
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// UserHasECPrivilege
|
||||
//
|
||||
// UserName - Name of the user being checked. - [Required]
|
||||
//
|
||||
// Returns a boolean flag indicating whether the indicated user has the privelege to access export control data.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service UserHasECPrivilege(UserName)
|
||||
|
||||
ServiceKeyID := '*' : UserName
|
||||
HasECPrivilege = Memory_Services('GetValue', ServiceKeyID, True$, 3600)
|
||||
|
||||
If HasECPrivilege EQ '' then
|
||||
If UserName NE '' then
|
||||
FileError = @File_Error
|
||||
if (MemberOf(UserName, 'NON_EC')) then
|
||||
HasECPrivilege = False$
|
||||
end else
|
||||
HasECPrivilege = True$
|
||||
end
|
||||
Memory_Services('SetValue', ServiceKeyID, HasECPrivilege)
|
||||
@File_Error = FileError
|
||||
end else
|
||||
Error_Services('Add', 'UserName argument is missing in the ' : Service : ' service.')
|
||||
end
|
||||
If HasECPrivilege EQ '' then HasECPrivilege = True$
|
||||
end
|
||||
|
||||
Response = HasECPrivilege
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// DataAccessAllowed
|
||||
//
|
||||
// Table - Database table name. - [Required]
|
||||
// KeyID - Key ID of the row being examined. - [Required]
|
||||
// UserName - Name of the user being checked. - [Required]
|
||||
//
|
||||
// Returns a boolean flag indicating whether the indicated user has access to the table and KeyID.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service DataAccessAllowed(Table, KeyID, UserName)
|
||||
|
||||
ServiceKeyID := '*' : Table : '*' : KeyID : '*' : UserName
|
||||
SuspendAuth = Memory_Services('GetValue', 'SuspendAuthentication')
|
||||
AccessAllowed = Memory_Services('GetValue', ServiceKeyID, True$, 3600)
|
||||
|
||||
If (SuspendAuth EQ False$) OR (SuspendAuth EQ '') then
|
||||
If AccessAllowed EQ '' then
|
||||
If Table NE '' AND KeyID NE '' AND UserName NE '' then
|
||||
FileError = @File_Error
|
||||
HasIPData = Security_Services('HasIPData', Table, KeyID)
|
||||
If HasIPData then
|
||||
AccessAllowed = Security_Services('UserHasECPrivilege', UserName)
|
||||
end else
|
||||
AccessAllowed = True$
|
||||
end
|
||||
Memory_Services('SetValue', ServiceKeyID, AccessAllowed)
|
||||
@File_Error = FileError
|
||||
end else
|
||||
Error_Services('Add', 'Table, KeyID, or UserName argument is missing in the ' : Service : ' service.')
|
||||
end
|
||||
If AccessAllowed EQ '' then AccessAllowed = True$
|
||||
end
|
||||
end else
|
||||
AccessAllowed = True$
|
||||
end
|
||||
|
||||
Response = AccessAllowed
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// GetAccessLevel
|
||||
//
|
||||
// Username - Plain text user name. This can be formatted as just the user name or in UPN format (e.g., User@Domain)
|
||||
// Password - Plain text password.
|
||||
// Domain - Domain to authenticate the username against. If empty then a chain of default domains will be used.
|
||||
//
|
||||
// Attempts to get the access level for the indicated username: -1 = No access; 0 = User; 1 = Administrator; 2 = System
|
||||
// Administrator. This relies upon the ValidateAuthenticationRequests service.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service GetAccessLevel(Username, Password, Domain)
|
||||
|
||||
AccessLevel = -1 ; // Assume no access for now.
|
||||
If ( (Username NE '') and (Password NE '') ) then
|
||||
// Validate the username and password against one of the approved non-EC domains.
|
||||
ValidUser = False$ ; // Assume not valid for now.
|
||||
If Domain NE '' then
|
||||
// User has specified their domain with their username. Parse this out and use this domain only.
|
||||
Domains = Domain
|
||||
end else
|
||||
Domains = 'MESSR001.infineon.com,MESSR002.infineon.com,na.infineon.com,na,infineon.com'
|
||||
end
|
||||
For Each Domain in Domains using ','
|
||||
ValidUser = Active_Directory_Services('AuthenticateUser', Username, Password, Domain)
|
||||
If ValidUser EQ True$ then AccessLevel = 2
|
||||
Until ValidUser EQ True$
|
||||
Next Domain
|
||||
end
|
||||
Response = AccessLevel
|
||||
|
||||
return
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// GetADGroups
|
||||
//
|
||||
// Returns an @VM delimited list of AD (active directory) groups that the indicated user belongs to.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service GetADGroups(Username, Domain)
|
||||
|
||||
ADGroups = ''
|
||||
|
||||
If (Username NE '') AND (Domain NE '') then
|
||||
ADGroups = SRP_Logon('GetADGroups', Username, Domain)
|
||||
end else
|
||||
Error_Services('Add', 'Username or Domain arguments was missing in the ' : Service : ' service.')
|
||||
end
|
||||
|
||||
Response = ADGroups
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// ValidateAuthenticationRequests
|
||||
//
|
||||
// Service that attempts to validate all authentication requests. These requests are queued in the
|
||||
// AD_GROUP_VALIDATION_REQUESTS table.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service ValidateAuthenticationRequests()
|
||||
|
||||
hValidationRequests = Database_Services('GetTableHandle', 'AD_GROUP_VALIDATION_REQUESTS')
|
||||
If Error_Services('NoError') then
|
||||
Sentence = 'SELECT AD_GROUP_VALIDATION_REQUESTS WITH VALIDATION_DATE EQ "" BY REQUEST_DATE BY REQUEST_TIME'
|
||||
Set_Status(0)
|
||||
RList(Sentence, TARGET_ACTIVELIST$, '', '', '')
|
||||
EOF = False$
|
||||
Loop
|
||||
ReadNext RequestKeyID else EOF = True$
|
||||
Until EOF
|
||||
Lock hValidationRequests, RequestKeyID then
|
||||
AccessLevel = -1
|
||||
RequestRow = Database_Services('ReadDataRow', 'AD_GROUP_VALIDATION_REQUESTS', RequestKeyID)
|
||||
Username = Field(RequestKeyID, '*', 3, 1)
|
||||
Password = RequestRow<AD_GROUP_VALIDATION_REQUESTS.PASSWORD$>
|
||||
Domain = RequestRow<AD_GROUP_VALIDATION_REQUESTS.DOMAIN$>
|
||||
// Validate the username and password against one of the approved non-EC domains.
|
||||
ValidUser = False$ ; // Assume not valid for now.
|
||||
If Domain NE '' then
|
||||
// User has specified their domain with their username. Parse this out and use this domain only.
|
||||
Domains = Domain
|
||||
end else
|
||||
Domains = 'MESSR001.infineon.com,MESSR002.infineon.com,na.infineon.com,na,infineon.com'
|
||||
end
|
||||
For Each Domain in Domains using ','
|
||||
ValidUser = Active_Directory_Services('AuthenticateUser', Username, Password, Domain)
|
||||
If ValidUser EQ True$ then AccessLevel = 2
|
||||
Until ValidUser EQ True$
|
||||
Sleepery(10)
|
||||
WinYield()
|
||||
Yield();Yield();Yield();Yield();Yield();Yield();Yield();Yield()
|
||||
Next Domain
|
||||
RequestRow<AD_GROUP_VALIDATION_REQUESTS.ACCESS_LEVEL$> = AccessLevel
|
||||
RequestRow<AD_GROUP_VALIDATION_REQUESTS.VALIDATION_DATE$> = Date()
|
||||
RequestRow<AD_GROUP_VALIDATION_REQUESTS.VALIDATION_TIME$> = Time()
|
||||
Database_Services('WriteDataRow', 'AD_GROUP_VALIDATION_REQUESTS', RequestKeyID, RequestRow, True$)
|
||||
Unlock hValidationRequests, RequestKeyID else Null
|
||||
end
|
||||
Repeat
|
||||
end
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// GetLSLUser
|
||||
//
|
||||
// Returns the LSL user associated to the indicated AD username.
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service GetLSLUser(Username)
|
||||
|
||||
LSLUser = ''
|
||||
|
||||
ADtoLSLUserMap = Database_Services('ReadDataRow', 'APP_INFO', 'AD_TO_LSL_USER_MAP')
|
||||
If Error_Services('NoError') then
|
||||
ADUsernames = ADtoLSLUserMap<1>
|
||||
Convert @Upper_Case to @Lower_Case in ADUsernames
|
||||
Convert @Upper_Case to @Lower_Case in Username
|
||||
Locate Username in ADUsernames using @VM setting vPos then
|
||||
LSLUser = ADtoLSLUserMap<2, vPos>
|
||||
end
|
||||
end
|
||||
|
||||
Response = LSLUser
|
||||
|
||||
end service
|
||||
|
||||
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
// VerifyUserSessions
|
||||
//
|
||||
//
|
||||
//----------------------------------------------------------------------------------------------------------------------
|
||||
Service VerifyUserSessions()
|
||||
|
||||
// Use MESSENGER as the recipient. It will process callback procedures.
|
||||
Messaging_Services('SendMessage', 'GetLoggedInUsers', 'Request', 'MESSENGER', 'All', '', 'Procedure', 'Security_Services,UserSessionsListener,@MESSAGE,@ARGUMENTS')
|
||||
|
||||
end service
|
||||
|
||||
|
||||
Service UserSessionsListener()
|
||||
|
||||
// Process message
|
||||
// If user is running an old version of LSL, then send them a popup asking them to restart their session.
|
||||
Transfer Param2 to SessionInfo
|
||||
Station = SessionInfo<1, 2>
|
||||
OIUserName = SessionInfo<2, 2>
|
||||
SSOUserName = SessionInfo<3, 2>
|
||||
ProcessID = SessionInfo<4, 2>
|
||||
LSL2Version = SessionInfo<5, 2>
|
||||
OCXVersion = SessionInfo<6, 2>
|
||||
|
||||
CurrLSL2Version = Database_Services('ReadDataRow', 'APP_INFO', 'LSL2_VERSION')
|
||||
If ((LSL2Version NE '') and (LSL2Version NE CurrLSL2Version)) then
|
||||
// Send a message to the user
|
||||
Message = 'You are running an outdated version of LSL. Restart your application ASAP to pickup the latest code.'
|
||||
Messaging_Services('SendMessage', 'SetPopupMessage', 'Request', '', Station, Message)
|
||||
* If OIUserName EQ 'DANIEL_ST' then
|
||||
* Messaging_Services('SendMessage', 'RunProcedure', 'Request', '', Station, 'SECURITY_SERVICES,REQUIREREAUTHENTICATION', '', '', '')
|
||||
* end
|
||||
end
|
||||
|
||||
end service
|
||||
|
||||
|
||||
Service RequireReauthentication()
|
||||
|
||||
Authenticated = False$
|
||||
|
||||
If MemberOf(@USER4, 'OI_ADMIN') then
|
||||
ParentForm = 'NDW_MAIN'
|
||||
end else
|
||||
ParentForm = 'LSL_MAIN2'
|
||||
end
|
||||
Loop
|
||||
|
||||
Response = Dialog_Box('NDW_VERIFY_USER', ParentForm, @USER4)
|
||||
Authenticated = Response<1>
|
||||
If Not(Authenticated) then
|
||||
ErrorMessage = 'You must reauthenticate to continue running your old version of OpenInsight.'
|
||||
rv = Msg('', '', 'OK', '', 'Authentication Required':@FM:ErrorMessage)
|
||||
end
|
||||
Until Authenticated
|
||||
Repeat
|
||||
|
||||
end service
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user