Function Security_Services(@Service, @Params)
/***********************************************************************************************************************

    This program is proprietary and is not to be used by or disclosed to others, nor is it to be copied without written
    permission from SRP Computer Solutions, Inc.

    Name        :   Security_Services

    Description :   Handler program for all module related services.

    Notes       :   The generic parameters should contain all the necessary information to process the services. Often
                    this will be information like the data Record and Key ID.

    Parameters  :
        Service         [in] -- Name of the service being requested
        Param1-10   [in/out] -- Additional request parameter holders
        Response       [out] -- Response to be sent back to the Controller (MCP) or requesting procedure

    Metadata    :
        @@REGISTER_SERVICES_MODULE(Security)

    History     :   (Date, Initials, Notes)
        05/18/17    dmb     Original programmer. - [EPIOI-8]
        02/13/18    dmb     Added GetAccessLevel service.
        02/13/18    dmb     Added ValidateAuthenticationRequests service.

***********************************************************************************************************************/

#pragma precomp SRP_PreCompiler

$insert LOGICAL
$insert SERVICE_SETUP
$insert DICT_EQUATES
$insert FILE.SYSTEM.EQUATES
$insert RLIST_EQUATES
$insert AD_GROUP_VALIDATION_REQUESTS_EQUATES
$insert MSG_EQUATES

Declare subroutine  Memory_Services, Database_Services, SRP_Stopwatch, Error_Services, RTP57, Set_Status, WinYield
Declare subroutine  Sleepery, Yield, Messaging_Services
Declare function    Memory_Services, Database_Services, Security_Services, SRP_Sort_Array, obj_Tables, Error_Services
Declare function    GetTickCount, MemberOf, Active_Directory_Services, Dialog_Box, Msg, SRP_Logon, Rti_Ldap_Groups_For_User

GoToService else
    Error_Services('Set', Service : ' is not a valid service request within the ' : ServiceModule : ' services module.')
end

Return Response else ''


////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Services
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////


//----------------------------------------------------------------------------------------------------------------------
// AuthenticateLSLCredentials
//
// Authenticates an LSL username and password (not SSO/AD credentials).
//----------------------------------------------------------------------------------------------------------------------
Service AuthenticateLSLCredentials(LSLUsername, LSLPassword)

    Response = False$
    If ( (LSLUsername NE '') and (LSLPassword NE '') ) then
        Convert @Lower_Case to @Upper.Case in LSLUsername
        If RowExists('LSL_USERS', LSLUsername) then
            Password = Xlate('LSL_USERS', LSLUsername, 'PASSWORD', 'X')
            If LSLPassword EQ Password then
                Response = True$
            end else
                Error_Services('Add', 'Incorrect password entered for LSL username: ':LSLUsername:'.')
            end
        end else
            Error_Services('Add', 'Invalid LSL username ':LSLUsername:'.')
        end
    end else
        Error_Services('Add', 'LSLUSername or LSLPassword not supplied in service ':Service:'.') 
    end

end service


//----------------------------------------------------------------------------------------------------------------------
// HasIPData
//
// Table    - Database table name. - [Required]
// KeyID    - Key ID of the row being examined. - [Required]
//
// Returns a boolean flag indicating whether the indicated table and Key ID has IP data that is governed by Export
// Control.
//----------------------------------------------------------------------------------------------------------------------
Service HasIPData(Table, KeyID)

    ServiceKeyID   := '*' : Table : '*' : KeyID
    IPData          = Memory_Services('GetValue', ServiceKeyID, True$, 3600)

    If IPData EQ '' then
        If Table NE '' AND KeyID NE '' then
            FileError   = @File_Error
            Memory_Services('SetValue', 'SuspendAuthentication', True$)
            IPData      = Xlate(Table, KeyID, 'EXPORT_CONTROL', 'X')
            Memory_Services('SetValue', 'SuspendAuthentication', False$)
            @File_Error = FileError
        end else
            Error_Services('Add', 'Table or KeyID argument is missing in the ' : Service : ' service.')
        end
        If IPData EQ '' then IPData = False$
    end

    Response    = IPData

end service


//----------------------------------------------------------------------------------------------------------------------
// UserHasECPrivilege
//
// UserName - Name of the user being checked. - [Required]
//
// Returns a boolean flag indicating whether the indicated user has the privelege to access export control data.
//----------------------------------------------------------------------------------------------------------------------
Service UserHasECPrivilege(UserName)

    ServiceKeyID   := '*' : UserName
    HasECPrivilege  = Memory_Services('GetValue', ServiceKeyID, True$, 3600)

    If HasECPrivilege EQ '' then
        If UserName NE '' then
            FileError   = @File_Error
            if (MemberOf(UserName, 'NON_EC')) then
                HasECPrivilege   = False$
            end else
                HasECPrivilege   = True$
            end
            Memory_Services('SetValue', ServiceKeyID, HasECPrivilege)
            @File_Error = FileError
        end else
            Error_Services('Add', 'UserName argument is missing in the ' : Service : ' service.')
        end
        If HasECPrivilege EQ '' then HasECPrivilege = True$
    end

    Response    = HasECPrivilege

end service


//----------------------------------------------------------------------------------------------------------------------
// DataAccessAllowed
//
// Table    - Database table name. - [Required]
// KeyID    - Key ID of the row being examined. - [Required]
// UserName - Name of the user being checked. - [Required]
//
// Returns a boolean flag indicating whether the indicated user has access to the table and KeyID.
//----------------------------------------------------------------------------------------------------------------------
Service DataAccessAllowed(Table, KeyID, UserName)

    ServiceKeyID   := '*' : Table : '*' : KeyID : '*' : UserName
    SuspendAuth     = Memory_Services('GetValue', 'SuspendAuthentication')
    AccessAllowed   = Memory_Services('GetValue', ServiceKeyID, True$, 3600)

    If (SuspendAuth EQ False$) OR (SuspendAuth EQ '') then
        If AccessAllowed EQ '' then
            If Table NE '' AND KeyID NE '' AND UserName NE '' then
                FileError   = @File_Error
                HasIPData   = Security_Services('HasIPData', Table, KeyID)
                If HasIPData then
                    AccessAllowed   = Security_Services('UserHasECPrivilege', UserName)
                end else
                    AccessAllowed   = True$
                end
                Memory_Services('SetValue', ServiceKeyID, AccessAllowed)
                @File_Error = FileError
            end else
                Error_Services('Add', 'Table, KeyID, or UserName argument is missing in the ' : Service : ' service.')
            end
            If AccessAllowed EQ '' then AccessAllowed = True$
        end
    end else
        AccessAllowed = True$
    end

    Response    = AccessAllowed

end service


//----------------------------------------------------------------------------------------------------------------------
// GetAccessLevel
//
// Username - Plain text user name. This can be formatted as just the user name or in UPN format (e.g., User@Domain)
// Password - Plain text password.
// Domain   - Domain to authenticate the username against. If empty then a chain of default domains will be used.
//
// Attempts to get the access level for the indicated username: -1 = No access; 0 = User; 1 = Administrator; 2 = System
// Administrator. This relies upon the ValidateAuthenticationRequests service.
//----------------------------------------------------------------------------------------------------------------------
Service GetAccessLevel(Username, Password, Domain)

    AccessLevel     = -1    ; // Assume no access for now.
    If ( (Username NE '') and (Password NE '') ) then 
        // Validate the username and password against one of the approved non-EC domains.
        ValidUser  = False$    ; // Assume not valid for now.
        If Domain NE '' then
            // User has specified their domain with their username. Parse this out and use this domain only.
            Domains     = Domain
        end else
            Domains     = 'MESSR001.infineon.com,MESSR002.infineon.com,na.infineon.com,na,infineon.com'
        end
        For Each Domain in Domains using ','
            ValidUser = Active_Directory_Services('AuthenticateUser', Username, Password, Domain)
            If ValidUser EQ True$ then AccessLevel = 2
        Until ValidUser EQ True$
        Next Domain
    end
    Response = AccessLevel

return


//----------------------------------------------------------------------------------------------------------------------
// GetADGroups
//
// Returns an @FM delimited list of AD (active directory) groups that the indicated user belongs to.
//----------------------------------------------------------------------------------------------------------------------
Service GetADGroups(Username, Domain)

    ADGroups    = ''

    If (Username NE '') AND (Domain NE '') then
        ADGroups  = Active_Directory_Services('GetADGroups', Username, Domain)
    end else
        Error_Services('Add', 'Username or Domain arguments was missing in the ' : Service : ' service.')
    end

    Response    = ADGroups

end service


//----------------------------------------------------------------------------------------------------------------------
// ValidateAuthenticationRequests
//
// Service that attempts to validate all authentication requests. These requests are queued in the
// AD_GROUP_VALIDATION_REQUESTS table.
//----------------------------------------------------------------------------------------------------------------------
Service ValidateAuthenticationRequests()

    hValidationRequests = Database_Services('GetTableHandle', 'AD_GROUP_VALIDATION_REQUESTS')
    If Error_Services('NoError') then
        Sentence    = 'SELECT AD_GROUP_VALIDATION_REQUESTS WITH VALIDATION_DATE EQ "" BY REQUEST_DATE BY REQUEST_TIME'
        Set_Status(0)
        RList(Sentence, TARGET_ACTIVELIST$, '', '', '')
        EOF         = False$
        Loop
            ReadNext RequestKeyID else EOF = True$
        Until EOF
            Lock hValidationRequests, RequestKeyID then
                AccessLevel = -1
                RequestRow  = Database_Services('ReadDataRow', 'AD_GROUP_VALIDATION_REQUESTS', RequestKeyID)
                Username    = Field(RequestKeyID, '*', 3, 1)
                Password    = RequestRow<AD_GROUP_VALIDATION_REQUESTS.PASSWORD$>
                Domain      = RequestRow<AD_GROUP_VALIDATION_REQUESTS.DOMAIN$>
                // Validate the username and password against one of the approved non-EC domains.
                ValidUser   = False$    ; // Assume not valid for now.
                If Domain NE '' then
                    // User has specified their domain with their username. Parse this out and use this domain only.
                    Domains     = Domain
                end else
                    Domains     = 'MESSR001.infineon.com,MESSR002.infineon.com,na.infineon.com,na,infineon.com'
                end
                For Each Domain in Domains using ','
                    ValidUser = Active_Directory_Services('AuthenticateUser', Username, Password, Domain)
                    If ValidUser EQ True$ then AccessLevel = 2
                Until ValidUser EQ True$
                    Sleepery(10)
                    WinYield()
                    Yield();Yield();Yield();Yield();Yield();Yield();Yield();Yield()
                Next Domain
                RequestRow<AD_GROUP_VALIDATION_REQUESTS.ACCESS_LEVEL$>      = AccessLevel
                RequestRow<AD_GROUP_VALIDATION_REQUESTS.VALIDATION_DATE$>   = Date()
                RequestRow<AD_GROUP_VALIDATION_REQUESTS.VALIDATION_TIME$>   = Time()
                Database_Services('WriteDataRow', 'AD_GROUP_VALIDATION_REQUESTS', RequestKeyID, RequestRow, True$)
                Unlock hValidationRequests, RequestKeyID else Null
            end
        Repeat
    end

end service


//----------------------------------------------------------------------------------------------------------------------
// GetLSLUser
//
// Returns the LSL user associated to the indicated AD username.
//----------------------------------------------------------------------------------------------------------------------
Service GetLSLUser(Username)

    LSLUser         = ''

    ADtoLSLUserMap  = Database_Services('ReadDataRow', 'APP_INFO', 'AD_TO_LSL_USER_MAP')
    If Error_Services('NoError') then
        ADUsernames = ADtoLSLUserMap<1>
        Convert @Upper_Case to @Lower_Case in ADUsernames
        Convert @Upper_Case to @Lower_Case in Username
        Locate Username in ADUsernames using @VM setting vPos then
            LSLUser = ADtoLSLUserMap<2, vPos>
        end
    end

    Response    = LSLUser

end service


//----------------------------------------------------------------------------------------------------------------------
// VerifyUserSessions
//
// 
//----------------------------------------------------------------------------------------------------------------------
Service VerifyUserSessions()

    // Use MESSENGER as the recipient. It will process callback procedures.
    Messaging_Services('SendMessage', 'GetLoggedInUsers', 'Request', 'MESSENGER', 'All', '', 'Procedure', 'Security_Services,UserSessionsListener,@MESSAGE,@ARGUMENTS')

end service


Service UserSessionsListener()
    
    // Process message
    // If user is running an old version of LSL, then send them a popup asking them to restart their session.
    Transfer Param2 to SessionInfo
    Station     = SessionInfo<1, 2>
    OIUserName  = SessionInfo<2, 2>
    SSOUserName = SessionInfo<3, 2>
    ProcessID   = SessionInfo<4, 2>
    LSL2Version = SessionInfo<5, 2>
    OCXVersion  = SessionInfo<6, 2>
    
    CurrLSL2Version = Database_Services('ReadDataRow', 'APP_INFO', 'LSL2_VERSION')
    If ((LSL2Version NE '') and (LSL2Version NE CurrLSL2Version)) then
        // Send a message to the user
        Message = 'You are running an outdated version of LSL. Restart your application ASAP to pickup the latest code.'
        Messaging_Services('SendMessage', 'SetPopupMessage', 'Request', '', Station, Message)
*        If OIUserName EQ 'DANIEL_ST' then
*            Messaging_Services('SendMessage', 'RunProcedure', 'Request', '', Station, 'SECURITY_SERVICES,REQUIREREAUTHENTICATION', '', '', '')
*        end
    end
    
end service


Service RequireReauthentication()
    
    Authenticated = False$
    
    If MemberOf(@USER4, 'OI_ADMIN') then
        ParentForm = 'NDW_MAIN'
    end else
        ParentForm = 'LSL_MAIN2'
    end
    Loop
        
        Response      = Dialog_Box('NDW_VERIFY_USER', ParentForm, @USER4)
        Authenticated = Response<1>
        If Not(Authenticated) then
            ErrorMessage = 'You must reauthenticate to continue running your old version of OpenInsight.'
            rv           = Msg('', '', 'OK', '', 'Authentication Required':@FM:ErrorMessage)
        end
    Until Authenticated
    Repeat
    
end service