cpp_admin_acl_addentry.cpp

/*****************************************************************************************
*
*  cpp_admin_acl_addentry.cpp
*
*  Note: See Tricryption Engine SDK for details on how to set the project environment.
*
******************************************************************************************/

#include<string>
#include<iostream>
#include<stdexcept>
#include "teagent.h"
#include "teconnection.h"
#include "teexception.h"
#include "teauthuserctx.h"
#include "teobject.h"
#include "teadmin.h"

using namespace ERUCES;
using namespace std;

string generateHiddenLink(string strServer, long nEncPort, string strUser, string strPswd);


int main()
{
    string strServer    = "localhost";
    long   nAdminPort   = 8888;
    long   nEncPort     = 8888;

    // ACL operations are performed by the KEY'S OWNER, not by an administrator: GET_ACL
    // and UPDATE_ACL belong to the Encryptor role, and the Administrator role does not
    // hold them. Connect as the user that created the key.
    string strOwnerUser = "ls";
    string strOwnerPswd = "password1A";

    // The principal the new ACL entry grants access to (any principal other than the owner).
    string strGranteeUser = "bob";

    try
    {
        // Set the hidden link for which the ACLInfo will be got.
        string strHL = generateHiddenLink(strServer, nEncPort, strOwnerUser, strOwnerPswd);

        // Connect to server
        auto_ptr<TEConnection> conn = TEConnection::createInstance(TEConnection::SecureConnection);

        auto_ptr<TEUserAuthenticationContext> ctx = TEUserAuthenticationContext::getInstance();
        ctx->setUser(strOwnerUser);
        ctx->setPasswd(strOwnerPswd);

        conn->open(strServer, nAdminPort, *ctx.operator->());
        cout << "Connected to " << strServer << " as " << strOwnerUser << endl;

        TEAdmin admin;
        admin.attachConnection(conn.operator->());

        TEACLInfo acl;
        admin.getACL(strHL, acl, true);

        cout << "ACLInfo: " << endl;
        cout << "\tACLID: "  << acl.getACLId() << endl;
        cout << "\tExpiration Flag: "  << acl.getKeyExpirationFlag() << endl;
        cout << "\tNumber of ACL entries: " << acl.EntryCount() << endl;

        uint32_t lSystemID; // for assignment late
        int i = 0;
        TEObjectContainer cont;
        acl.getEntries(cont);
        for (i=0; i < cont.size(); ++i)
        {
            TEACLEntry *ent = (TEACLEntry *)cont[i];
            cout << endl;
            cout << "\tACLID: "             << ent->getACLId() << endl;
            cout << "\tACLRight: "          << ent->getACLRight() << endl;
            cout << "\tCreationTimestamp: " << ent->getCreationTimestamp() << endl;
            cout << "\tEndTimestamp: "      << ent->getEndTimestamp() << endl;
            cout << "\tMaxUsage: "          << ent->getMaxUsage() << endl;
            cout << "\tPrincipalId: "       << ent->getPrincipalId() << endl;
            cout << "\tStartTimestamp: "    << ent->getStartTimestamp() << endl;
            cout << "\tSystemID: "          << ent->getSystemID() << endl;
            cout << "\tUserRight: "         << ent->getUserRight() << endl;
            if (i==0)
                lSystemID = ent->getSystemID();
        }

        // Resolve the grantee by NAME. Principal ids are assigned as principals are
        // created, so they must never be hardcoded; and the entry must name a principal
        // other than the key's owner (the owner already holds an entry -- adding it again
        // fails with "Cannot Add Owner's entry").
        TEUserAndPasswordInfo grantee;
        grantee.setUserName(strGranteeUser);
        if (!admin.getPrincipalByName(grantee))
            throw runtime_error("grantee principal not found: " + strGranteeUser);

        // Create an ACL entry to add
        TEACLEntry ent2add;
        ent2add.setACLId( acl.getACLId() );
        // Read + write. Do NOT set the owner bit (RIGHT_OWNER): a key has exactly one
        // owner and the server rejects a second owner entry with "Cannot Add Owner's entry".
        ent2add.setACLRight(RIGHT_READ | RIGHT_WRITE);
        ent2add.setEndTimestamp(0);
        ent2add.setMaxUsage((int32_t)0);
        ent2add.setPrincipalId( grantee.getPrincipalId() );
        ent2add.setStartTimestamp(0);
        ent2add.setSystemID(lSystemID);
        ent2add.setUserRight(1);

        TEACLInfo acl2;
        acl2.setACLId( acl.getACLId() );
        // The @TTAGDEF is REQUIRED on the TEACLInfo passed to updateACL -- it is how the
        // server identifies the key whose ACL is being changed. Without it updateACL
        // fails with the opaque "Add ACL Entry Failed". The second argument mirrors the
        // getACL call above: true = the string is base64-encoded and must be decoded.
        acl2.setHiddenLink( strHL, true );
        acl2.addEntry( ent2add );

        // Update the server, the ACL entry will be added.
        admin.updateACL(ACLENTRY_ADD, acl2);

        cout << endl;
        cout << "ACLInfo was updated. " << endl;

        // Get the updated info.
        admin.getACL(strHL, acl, true);
        cout << "ACLInfo: " << endl;
        cout << "\tACLID: "  << acl.getACLId() << endl;
        cout << "\tExpiration Flag: "  << acl.getKeyExpirationFlag() << endl;
        cout << "\tNumber of ACL entries: " << acl.EntryCount() << endl;
        acl.getEntries(cont);
        for (i=0; i < cont.size(); ++i)
        {
            TEACLEntry *ent = (TEACLEntry *)cont[i];
            cout << endl;
            cout << "\tACLID: "             << ent->getACLId() << endl;
            cout << "\tACLRight: "          << ent->getACLRight() << endl;
            cout << "\tCreationTimestamp: " << ent->getCreationTimestamp() << endl;
            cout << "\tEndTimestamp: "      << ent->getEndTimestamp() << endl;
            cout << "\tMaxUsage: "          << ent->getMaxUsage() << endl;
            cout << "\tPrincipalId: "       << ent->getPrincipalId() << endl;
            cout << "\tStartTimestamp: "    << ent->getStartTimestamp() << endl;
            cout << "\tSystemID: "          << ent->getSystemID() << endl;
            cout << "\tUserRight: "         << ent->getUserRight() << endl;
        }

        admin.detachConnection();

        // Disconnect from server
        conn->close();
        cout << "Disconnected from " << strServer << endl;
    }
    catch (TEException &e)
    {
        cout << e.getAllMessages().c_str() << endl;
    }
    catch (exception &e)
    {
        cout << e.what() << endl;
    }
    catch (...)
    {
        cout << "Unexpected error" << endl;
    }

    return 0;
}


string generateHiddenLink(string strServer, long nEncPort, string strUser, string strPswd)
{
    string strHiddenLink = "";

    auto_ptr<TEConnection> conn = TEConnection::createInstance(TEConnection::SecureConnection);

    // Open connection to the server
    conn->open(strServer, nEncPort, strUser, strPswd);

    cout << "Connected to " << strServer << " at " << nEncPort
        << " as " << strUser << "\n" << endl;

    // Create TEAgentMatrix object
    TEAgentMatrix matrix;

    // Set matrix for encryption
    matrix.setElement(1, 1, "dummy data for creating hiddenlink");  // set element (1, 1)

    // Encrypt matrix
    matrix.attachConnection(conn.operator->());  // Attach connection
    matrix.encrypt();
    matrix.detachConnection();  // Detach connection

    // Get hiddenlink
    matrix.setEncodeMode(true);

    matrix.getHiddenLink(1, strHiddenLink);  // hiddenlink for first row

    cout << "HiddenLink: " << strHiddenLink << endl;

    // Close conneciton
    conn->close();
    cout << "Disconnected from " << strServer << endl;

    return strHiddenLink;
}