com.sap.security.api

Interface IUserAccountFactory

All Superinterfaces:

IConfigurable

public interface IUserAccountFactory
extends IConfigurable

User account factory will handle authentication and retrieval of user account information from persistence storage.

NOTE: As this interface�can be extended, this interface can be freely used, but must not be implemented.

Method Summary

void	deleteUserAccount(String uniqueId) Delete this user account from persistence storage
IUserAccount	getAuthenticatedUserAccount(Map credentials) Authenticate the supplied credentials and returns user account object.
IUserAccount	getMutableUserAccount(String uniqueId) Gets an IUserAccount objects for a uniqueId of a user account.
IUserAccount	getUserAccount(Map credentials) Return UserAccount object based on the credentials supplied.
IUserAccount	getUserAccount(String uniqueId) Gets UserAccount object from the database for a given uid
IUserAccount	getUserAccount(String uniqueId, AttributeList populateAttributes) Gets the UserAccount object with the given unique ID and populates the attributes in populateAttributes
IUserAccount	getUserAccount(X509Certificate cert) Returns UserAccount to whom this certificate belongs. returns null if this certificate is not mapped to any user.
IUserAccount	getUserAccountByLogonId(String logonid) Gets UserAccount object from the database for a given uid
IUserAccount	getUserAccountByLogonId(String logonid, AttributeList populateAttributes) Gets UserAccount object from the database for a given uid
IUserAccount[]	getUserAccounts(String uniqueIdOfUser) Returns all user accounts of the given user
IUserAccount[]	getUserAccounts(String uniqueIdOfUser, AttributeList attributeList) Returns all user accounts of the given user
IUserAccountSearchFilter	getUserAccountSearchFilter() Returns an IUserAccountSearchFilter object to be used to specify query attributes IUserAccountSearchFilter only contains attributes which will be queried
void	invalidateCacheEntry(String uniqueid) removes the user account object which has the specified uniqueid from the factory's cache Note: Use this method carefully, because calling it too often may cause performance problems
void	invalidateCacheEntryByLogonId(String logonid) removes the user account object which has the specified logonid from the factory's cache Note: Use this method carefully, because calling it too often may cause performance problems
IUserAccount	newUserAccount(String logonid) Creates a new IUserAccount type object.
IUserAccount	newUserAccount(String logonid, String uniqueIdOfUser) Creates a new IUserAccount type object.
void	registerListener(UserAccountListener userAccountListener, int modifier) registerListener allows to subscribe to a predefined eventName UserAccountListener The caller has to provide a receiver object which implements UserAccountListener
void	registerListener(UserAccountListener userAccountListener, int modifier, boolean notifyAfterPhysicalCommitCompleted) registerListener allows to subscribe to a predefined eventName UserAccountListener The caller has to provide a receiver object which implements UserAccountListener
ISearchResult	search(IUserAccountSearchFilter filter) Search for user accounts in the persistence storage which match the criteria specified in the given search filter.
void	unregisterListener(UserAccountListener userAccountListener) unregisterListener unsubscribes a receiver from a previously subscribed event.

Methods inherited from interface com.sap.security.api.IConfigurable

initialize

Method Detail

newUserAccount

IUserAccount newUserAccount(String logonid,
                            String uniqueIdOfUser)
                            throws UMException

Creates a new IUserAccount type object. After setting the appropriate data via set-methods, the user account object must be commited to the persistence storage via IPrincipalMaint.commit().

Parameters:

logonid - logon user id

Note: The logonid has to be unique for ALL data stores

uniqueIdOfUser - - uniqueID of the user that should be assigned to this account

Returns:

Object of type IUserAccount

Throws:

UMException; - UserAccountAlreadyExistsException if an account with this logonid already exists

UMException

newUserAccount

IUserAccount newUserAccount(String logonid)
                            throws UMException

Creates a new IUserAccount type object. After setting the appropriate data via set-methods, the user account object must be commited to the persistence storage via IUserFactory.commitUser(IUserMaint, IUserAccount). Note: This object cannot be commited via IPrincipalMaint.commit()

Parameters:

logonid - logon user id

Note: The logonid has to be unique for ALL data stores

Returns:

Object of type IUserAccount

Throws:

UMException; - UserAccountAlreadyExistsException if an account with this logonid already exists

UMException

getUserAccountByLogonId

IUserAccount getUserAccountByLogonId(String logonid)
                                     throws UMException

Gets UserAccount object from the database for a given uid

Parameters:

logonid - Description of Parameter

Returns:

UserAccount object

Throws:

UMException - Exception will be thrown if there is an error.

getUserAccountByLogonId

IUserAccount getUserAccountByLogonId(String logonid,
                                     AttributeList populateAttributes)
                                     throws UMException

Gets UserAccount object from the database for a given uid

Parameters:

logonid - Description of Parameter

populateAttributes - The attributes that should be populated

Returns:

UserAccount object, or null if no user found for this logon uid

Throws:

UMException - Exception will be thrown if there is an error.

getUserAccount

IUserAccount getUserAccount(String uniqueId)
                            throws UMException

Gets UserAccount object from the database for a given uid

Parameters:

uniqueId - Description of Parameter

Returns:

UserAccount object, or null if no user found for this logon uid

Throws:

UMException - Exception will be thrown if there is an error.

getUserAccount

IUserAccount getUserAccount(String uniqueId,
                            AttributeList populateAttributes)
                            throws UMException

Gets the UserAccount object with the given unique ID and populates the attributes in populateAttributes

Parameters:

uniqueId - unique ID of the user account

populateAttributes - The attributes that should be populated

Note: in case only attribute ILoginConstants.LOGON_UID_ALIAS is specified the existence of the returned IUserAccount object may not be checked which may lead to following RuntimeException PrincipalNotAccessibleException if other attributes of this IUserAccount object are accessed.

Returns:

the user account

Throws:

UMException; - NoSuchUserAccountException if no userAccount with the given unique ID exists

UMException

getUserAccount

IUserAccount getUserAccount(X509Certificate cert)
                            throws CertificateException,
                                   UMException,
                                   TicketException

Returns UserAccount to whom this certificate belongs. returns null if this certificate is not mapped to any user.

Parameters:

cert - X509Certificate certificate

Returns:

UserAccount object

Throws:

CertificateException - if there is a problem with the input certificate

UMException - Exception will be throws if there is an error.

TicketException

NoSuchUserAccountException - if no userAccount is mapped to the certificate

getAuthenticatedUserAccount

IUserAccount getAuthenticatedUserAccount(Map credentials)
                                         throws UMException,
                                                AuthenticationFailedException,
                                                UserLockedException,
                                                TicketException,
                                                CertificateException

Authenticate the supplied credentials and returns user account object. The valid keys in the Map could be "j_user" for user id, "j_password" for password ,"javax.servlet.request.X509Certificate" for certificate. other values are allowed provided that there is an implementation to understand those.

Parameters:

credentials - Map containing user credential parameters

Returns:

UserAccount object, or null if no user is found for supplied credentials

Throws:

UMException - Exception will be throws if there is an error.

AuthenticationFailedException - Exception will be throws if credentials could not be verified. The message of the exception is the key for the error message.
Possible keys are

• SecurityPolicy.USER_AUTH_FAILED: general logon failure. Logon id or password wrong, logon id not existent etc.
• SecurityPolicy.CERT_AUTH_FAILED: the client certificate is not mapped to a user.
• SecurityPolicy.PASSWORD_EXPIRED: the user's password has expired.
• SecurityPolicy.SAPSTAR_ACTIVATED: the super user SAP* is activated and therefore no other user can logon.

UserLockedException - Exception will be throws if user is locked. The message of the exception is the key for the error message.
Possible keys are

• SecurityPolicy.ACCOUNT_LOCKED_LOGON: the user account is locked due to logon failures.
• SecurityPolicy.ACCOUNT_LOCKED_ADMIN: the user account is locked by administrator and can't logon.

TicketException

CertificateException - a problem with certificates.

getUserAccount

IUserAccount getUserAccount(Map credentials)
                            throws UMException,
                                   CertificateException

Return UserAccount object based on the credentials supplied. Credentials will not be authenticated.

Parameters:

credentials - user credentials

Returns:

UserAccount or null if the supplied user credentials do not match with any user.

Throws:

UMException - Description of Exception

CertificateException

deleteUserAccount

void deleteUserAccount(String uniqueId)
                       throws UMException

Delete this user account from persistence storage

Parameters:

uniqueId - user account

Throws:

UMException - UMException is thrown is delete operation is failed for some reason

NoSuchUserAccountException - if the user account does not exist

search

ISearchResult search(IUserAccountSearchFilter filter)
                     throws UMException

Search for user accounts in the persistence storage which match the criteria specified in the given search filter. In order to get a user account search filter use getUserAccountSearchFilter(). You can define a search filter using methods of class IUserAccountSearchFilter.

Parameters:

filter - defined to search for user accounts

Returns:

ISearchResult result of the search operation ISearchResult

Throws:

UMException

getUserAccounts

IUserAccount[] getUserAccounts(String uniqueIdOfUser)
                               throws UMException

Returns all user accounts of the given user

Parameters:

uniqueIdOfUser - The user

Returns:

Array of user accounts

Throws:

UMException - Description of Exception

getUserAccounts

IUserAccount[] getUserAccounts(String uniqueIdOfUser,
                               AttributeList attributeList)
                               throws UMException

Returns all user accounts of the given user

Parameters:

uniqueIdOfUser - The user

attributeList - The attributes that should be populated

Returns:

Array of user accounts

Throws:

UMException - Description of Exception

getMutableUserAccount

IUserAccount getMutableUserAccount(String uniqueId)
                                   throws UMException

Gets an IUserAccount objects for a uniqueId of a user account.

Parameters:

uniqueId - - uniqueId of the user account

Returns:

a mutable IUserAccount object which can be modified.

Throws:

UMException; - NoSuchPrincipalException if the unique ID does not exist

UMException

getUserAccountSearchFilter

IUserAccountSearchFilter getUserAccountSearchFilter()
                                                    throws UMException

Returns an IUserAccountSearchFilter object to be used to specify query attributes

IUserAccountSearchFilter only contains attributes which will be queried

Returns:

IUserAccountSearchFilter

Throws:

UMException

FeatureNotAvailableException

registerListener

void registerListener(UserAccountListener userAccountListener,
                      int modifier)

registerListener allows to subscribe to a predefined eventName UserAccountListener The caller has to provide a receiver object which implements UserAccountListener

Parameters:

userAccountListener - object which implements interface UserAccountListener

modifier - constant defined in UserAccountListener

registerListener

void registerListener(UserAccountListener userAccountListener,
                      int modifier,
                      boolean notifyAfterPhysicalCommitCompleted)

registerListener allows to subscribe to a predefined eventName UserAccountListener The caller has to provide a receiver object which implements UserAccountListener

Parameters:

userAccountListener - object which implements interface UserAccountListener

modifier - constant defined in UserAccountListener

notifyAfterPhysicalCommitCompleted - Allows callers when set to false, to get a notification before the physical transaction is completed in order to include their actions into the same physical transaction.

unregisterListener

void unregisterListener(UserAccountListener userAccountListener)

unregisterListener unsubscribes a receiver from a previously subscribed event.

Parameters:

userAccountListener - object which implements interface UserAccountListener

invalidateCacheEntryByLogonId

void invalidateCacheEntryByLogonId(String logonid)
                                   throws UMException

removes the user account object which has the specified logonid from the factory's cache Note: Use this method carefully, because calling it too often may cause performance problems

Parameters:

logonid - the logonid of the user account

Throws:

UMException - if a error occurs

invalidateCacheEntry

void invalidateCacheEntry(String uniqueid)
                          throws UMException

removes the user account object which has the specified uniqueid from the factory's cache Note: Use this method carefully, because calling it too often may cause performance problems

Parameters:

uniqueid - the uniqueid of the user account

Throws:

UMException - if a error occurs

Access Rights

This class can be accessed from:

SC	DC
[sap.com] ENGINEAPI	[sap.com] com.sap.security.api.sda
[sap.com] ENGFACADE	[sap.com] tc/je/usermanagement/api
[sap.com] CORE-TOOLS	[sap.com] com.sap.engine.client.lib