pva.setPermissionId(accPermId);
permValues.put(pva.getResourceName(), pva);
- String rc = "collectionobjects";
- String coPermId = createPermission(rc, EffectType.DENY);
- PermissionValue pvc = new PermissionValue();
- pvc.setResourceName(rc);
- pvc.setPermissionId(coPermId);
- permValues.put(pvc.getResourceName(), pvc);
-
- String ri = "intakes";
- String iPermId = createPermission(ri, EffectType.DENY);
- PermissionValue pvi = new PermissionValue();
- pvi.setResourceName(ri);
- pvi.setPermissionId(iPermId);
- permValues.put(pvi.getResourceName(), pvi);
+// String rc = "collectionobjects";
+// String coPermId = createPermission(rc, EffectType.DENY);
+// PermissionValue pvc = new PermissionValue();
+// pvc.setResourceName(rc);
+// pvc.setPermissionId(coPermId);
+// permValues.put(pvc.getResourceName(), pvc);
+//
+// String ri = "intakes";
+// String iPermId = createPermission(ri, EffectType.DENY);
+// PermissionValue pvi = new PermissionValue();
+// pvi.setResourceName(ri);
+// pvi.setPermissionId(iPermId);
+// permValues.put(pvi.getResourceName(), pvi);
String rn1 = "ROLE_CO1";
String r1RoleId = createRole(rn1);
*/
@Override
protected CollectionSpaceClient getClientInstance() {
- return new PermissionRoleClient();
+ return new PermissionRoleClient();
}
-
+
/* (non-Javadoc)
* @see org.collectionspace.services.client.test.BaseServiceTest#getAbstractCommonList(org.jboss.resteasy.client.ClientResponse)
*/
@Override
- protected AbstractCommonList getAbstractCommonList(
-
ClientResponse<AbstractCommonList> response) {
- //FIXME: http://issues.collectionspace.org/browse/CSPACE-1697
- throw new UnsupportedOperationException();
+ protected AbstractCommonList getAbstractCommonList(
+ ClientResponse<AbstractCommonList> response) {
+ //FIXME: http://issues.collectionspace.org/browse/CSPACE-1697
+ throw new UnsupportedOperationException();
}
-
- @Test(dataProvider = "testName")
- @Override
+
+ @Test(dataProvider = "testName")
+ @Override
public void readPaginatedList(String testName) throws Exception {
- //FIXME: http://issues.collectionspace.org/browse/CSPACE-1697
- }
+ //FIXME: http://issues.collectionspace.org/browse/CSPACE-1697
+ }
// ---------------------------------------------------------------
// CRUD tests : CREATE tests
// ---------------------------------------------------------------
// Success outcomes
+
@Override
@Test(dataProvider = "testName", dataProviderClass = AbstractServiceTestImpl.class)
public void create(String testName) throws Exception {
@AfterClass(alwaysRun = true)
public void cleanUp() {
- setupDelete("delete");
+ setupDelete("cleanup");
String noTest = System.getProperty("noTestCleanup");
- if(Boolean.TRUE.toString().equalsIgnoreCase(noTest)) {
+ if (Boolean.TRUE.toString().equalsIgnoreCase(noTest)) {
if (logger.isDebugEnabled()) {
logger.debug("Skipping Cleanup phase ...");
}
return;
- }
+ }
if (logger.isDebugEnabled()) {
logger.debug("Cleaning up temporary resources created for testing ...");
}
- PermissionRoleClient client = new PermissionRoleClient();
- for (String resourceId : allResourceIdsCreated) {
-
- ClientResponse<Response> res = client.delete(resourceId, "123");
- int statusCode = res.getStatus();
- if (logger.isDebugEnabled()) {
- logger.debug("cleanup: delete relationships for permission id="
- + resourceId + " status=" + statusCode);
- }
- Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
- invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
- Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
- }
-
for (PermissionValue pv : permValues.values()) {
deletePermission(pv.getPermissionId());
}
-
for (RoleValue rv : roleValues.values()) {
deleteRole(rv.getRoleId());
}
import org.collectionspace.services.authorization.Permission;
import org.collectionspace.services.authorization.PermissionAction;
import org.collectionspace.services.authorization.PermissionException;
+import org.collectionspace.services.authorization.PermissionNotFoundException;
import org.collectionspace.services.authorization.PermissionRole;
import org.collectionspace.services.authorization.PermissionValue;
import org.collectionspace.services.authorization.RoleValue;
import org.slf4j.LoggerFactory;
/**
- * AuthorizationDelegate delegates permissions management to the authorization
- * service from the RESTful service
+ * AuthorizationDelegate delegates permissions management to the underlying authorization
+ * service from the RESTful service layer. The authorization service for example
+ * might manage permissions with the help of a provider (e.g. Spring Security ACL)
* @author
*/
public class AuthorizationDelegate {
- private final Logger logger = LoggerFactory.getLogger(AuthorizationDelegate.class);
+ private static final Logger logger = LoggerFactory.getLogger(AuthorizationDelegate.class);
+ /**
+ * addPermissions add permissions represented given PermissionRole
+ * @param ctx
+ * @param pr permission role
+ * @throws Exception
+ * @see PermissionRole
+ */
static void addPermissions(ServiceContext ctx, PermissionRole pr) throws Exception {
SubjectType subject = PermissionRoleUtil.getRelationSubject(ctx, pr);
AuthZ authz = AuthZ.get();
if (subject.equals(SubjectType.ROLE)) {
PermissionValue pv = pr.getPermissions().get(0);
- CSpaceResource[] resources = getResources(pv);
+ CSpaceResource[] resources = getResources(pv.getPermissionId());
String[] roles = getRoles(pr.getRoles());
for (CSpaceResource res : resources) {
authz.addPermissions(res, roles);
RoleValue rv = pr.getRoles().get(0);
String[] roles = {rv.getRoleName()};
for (PermissionValue pv : pr.getPermissions()) {
- CSpaceResource[] resources = getResources(pv);
+ CSpaceResource[] resources = getResources(pv.getPermissionId());
for (CSpaceResource res : resources) {
authz.addPermissions(res, roles);
}
}
}
+ /**
+ * deletePermissions delete all permissions associated with given permission role
+ * @param ctx
+ * @param pr permissionrole
+ * @throws Exception
+ */
static void deletePermissions(ServiceContext ctx, PermissionRole pr)
throws Exception {
PermissionValue pv = pr.getPermissions().get(0);
deletePermissions(pv);
}
+ /**
+ * deletePermissions delete permissions associated with given PermissionValue
+ * @param pv permission value
+ * @throws Exception
+ * @see PermissionValue
+ */
static void deletePermissions(PermissionValue pv)
throws Exception {
- CSpaceResource[] resources = getResources(pv);
+ deletePermissions(pv.getPermissionId());
+ }
+
+ /**
+ * deletePermissions delete permissions associated with given permission id
+ * @param permCsid
+ * @throws Exception
+ */
+ static public void deletePermissions(String permCsid) throws Exception {
+ CSpaceResource[] resources = getResources(permCsid);
AuthZ authz = AuthZ.get();
+
for (CSpaceResource res : resources) {
- authz.deletePermissions(res);
+ try {
+ authz.deletePermissions(res);
+ } catch (PermissionException pe) {
+ //perms are created downthere only if roles are related to the permissions
+ logger.info("no permissions found in authz service provider for " +
+ "permCsid=" + permCsid + " res=" + res.getId());
+ }
}
}
-
/**
* addPermissionsForUri add permissions from given permission configuration
* with assumption that resource is of type URI
/**
* getResources from given PermissionValue
- * @param pv permission value
+ * @param permisison csid
* @return array of CSpaceResource
* @see PermissionValue
* @see CSpaceResource
*/
- private static CSpaceResource[] getResources(PermissionValue pv) {
+ private static CSpaceResource[] getResources(String permCsid) {
List<CSpaceResource> rl = new ArrayList<CSpaceResource>();
- Permission p = (Permission) JpaStorageUtils.getEntity(pv.getPermissionId(),
+ Permission p = (Permission) JpaStorageUtils.getEntity(permCsid,
Permission.class);
if (p != null) {
for (PermissionAction pa : p.getActions()) {
- CSpaceResource res = new URIResourceImpl(pv.getResourceName(),
+ CSpaceResource res = new URIResourceImpl(p.getResourceName(),
getAction(pa.getName()));
rl.add(res);
}
return rl.toArray(new CSpaceResource[0]);
}
-
/**
* getAction is a convenience method to get corresponding action for
* given ActionType
}
throw new IllegalArgumentException("action = " + action.toString());
}
-
}
*/
package org.collectionspace.services.authorization.spring;
+import java.util.ArrayList;
+import java.util.Iterator;
import java.util.List;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.collectionspace.services.authorization.CSpaceResource;
import org.collectionspace.services.authorization.PermissionException;
import org.collectionspace.services.authorization.PermissionNotFoundException;
-import org.springframework.jdbc.datasource.DataSourceTransactionManager;
import org.springframework.security.acls.model.AccessControlEntry;
+import org.springframework.security.acls.model.AclDataAccessException;
+import org.springframework.security.acls.model.AlreadyExistsException;
import org.springframework.security.acls.model.MutableAcl;
import org.springframework.security.acls.model.NotFoundException;
import org.springframework.security.acls.model.ObjectIdentity;
import org.springframework.security.acls.model.Permission;
import org.springframework.security.acls.model.Sid;
-import org.springframework.transaction.TransactionDefinition;
import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.DefaultTransactionDefinition;
/**
* Manages permissions in Spring Security
throws PermissionException {
ObjectIdentity oid = SpringAuthorizationProvider.mapResource(res);
Sid[] sids = SpringAuthorizationProvider.mapPrincipal(principals);
- Permission p = SpringAuthorizationProvider.mapPermssion(action);
+ Permission p = SpringAuthorizationProvider.mapPermission(action);
TransactionStatus status = provider.beginTransaction("addPermssions");
- try {
- for (Sid sid : sids) {
+
+ //add permission for each sid
+ for (Sid sid : sids) {
+ try {
addPermission(oid, p, sid);
if (log.isDebugEnabled()) {
- log.debug("added permission "
+ log.debug("addpermissions(res,action,prin[]), success for "
+ " res=" + res.toString()
+ " action=" + action.toString()
+ " oid=" + oid.toString()
+ " perm=" + p.toString()
- + " sid=" + sids.toString());
+ + " sid=" + sid.toString());
}
+
+ } catch (AlreadyExistsException aex) {
+ if (log.isWarnEnabled()) {
+ log.warn("addpermissions(res,action,prin[]) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString(), aex);
+ }
+ //keep going
+ } catch (Exception ex) {
+ String msg = "addpermissions(res,action,prin[]) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString();
+ if (log.isDebugEnabled()) {
+ log.debug(msg, ex);
+ }
+ //don't know what might be wrong...stop
+ provider.rollbackTransaction(status);
+ if (ex instanceof PermissionException) {
+ throw (PermissionException) ex;
+ }
+ throw new PermissionException(msg, ex);
}
- } catch (Exception ex) {
- provider.rollbackTransaction(status);
- if (log.isDebugEnabled()) {
- ex.printStackTrace();
- }
- throw new PermissionException(ex);
- }
+ }//rof
provider.commitTransaction(status);
-
+ if (log.isDebugEnabled()) {
+ log.debug("addpermissions(res,action,prin[]), success for "
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString()
+ + " sids=" + sids.toString());
+ }
}
@Override
throws PermissionNotFoundException, PermissionException {
ObjectIdentity oid = SpringAuthorizationProvider.mapResource(res);
Sid[] sids = SpringAuthorizationProvider.mapPrincipal(principals);
- Permission p = SpringAuthorizationProvider.mapPermssion(action);
+ Permission p = SpringAuthorizationProvider.mapPermission(action);
TransactionStatus status = provider.beginTransaction("deletePermssions");
- try {
- for (Sid sid : sids) {
+ //delete permission for each sid
+ for (Sid sid : sids) {
+ try {
deletePermissions(oid, p, sid);
if (log.isDebugEnabled()) {
- log.debug("deleted permission "
+ log.debug("deletedpermissions(res,action,prin[]), success for "
+ " res=" + res.toString()
+ " action=" + action.toString()
+ " oid=" + oid.toString()
+ " perm=" + p.toString()
- + " sid=" + sids.toString());
+ + " sid=" + sid.toString());
}
+ } catch (AclDataAccessException aex) {
+ if (log.isWarnEnabled()) {
+ log.debug("deletepermissions(res,action,prin[]) failed, "
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString(), aex);
+ }
+ //keep going
+ } catch (Exception ex) {
+ String msg = "deletepermissions(res,action,prin[]) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString();
+ if (log.isDebugEnabled()) {
+ log.debug(msg, ex);
+ }
+ //don't know what might be wrong...stop
+ provider.rollbackTransaction(status);
+ if (ex instanceof PermissionException) {
+ throw (PermissionException) ex;
+ }
+ throw new PermissionException(msg, ex);
}
- } catch (Exception ex) {
- provider.rollbackTransaction(status);
- if (log.isDebugEnabled()) {
- ex.printStackTrace();
- }
- throw new PermissionException(ex);
}
provider.commitTransaction(status);
-
+ if (log.isDebugEnabled()) {
+ log.debug("deletedpermissions(res,action,prin[]), success for "
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString()
+ + " sids=" + sids.toString());
+ }
}
@Override
public void deletePermissions(CSpaceResource res, CSpaceAction action)
throws PermissionNotFoundException, PermissionException {
ObjectIdentity oid = SpringAuthorizationProvider.mapResource(res);
- Permission p = SpringAuthorizationProvider.mapPermssion(action);
+ Permission p = SpringAuthorizationProvider.mapPermission(action);
TransactionStatus status = provider.beginTransaction("deletePermssions");
try {
deletePermissions(oid, p, null);
- if (log.isDebugEnabled()) {
- log.debug("deleted permissions "
- + " res=" + res.toString()
- + " action=" + action.toString()
- + " oid=" + oid.toString()
- + " perm=" + p.toString());
- }
+ } catch (AclDataAccessException aex) {
+ provider.rollbackTransaction(status);
+ log.debug("deletepermissions(res,action) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString(), aex);
+ throw new PermissionException(aex);
} catch (Exception ex) {
provider.rollbackTransaction(status);
+ String msg = "deletepermissions(res,action,prin[]) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString();
if (log.isDebugEnabled()) {
- ex.printStackTrace();
+ log.debug(msg, ex);
+ }
+ if (ex instanceof PermissionException) {
+ throw (PermissionException) ex;
}
- throw new PermissionException(ex);
+ throw new PermissionException(msg, ex);
}
provider.commitTransaction(status);
-
+ if (log.isDebugEnabled()) {
+ log.debug("deletepermissions(res,action) success, "
+ + " res=" + res.toString()
+ + " action=" + action.toString()
+ + " oid=" + oid.toString()
+ + " perm=" + p.toString());
+ }
}
TransactionStatus status = provider.beginTransaction("addPermssion");
try {
provider.getProviderAclService().deleteAcl(oid, true);
+ } catch (AclDataAccessException aex) {
+ provider.rollbackTransaction(status);
+ log.debug("deletepermissions(res) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " oid=" + oid.toString(), aex);
+ throw new PermissionException(aex);
} catch (Exception ex) {
provider.rollbackTransaction(status);
+ String msg = "deletepermissions(res) failed,"
+ + " oid=" + oid.toString()
+ + " res=" + res.toString()
+ + " oid=" + oid.toString();
if (log.isDebugEnabled()) {
- ex.printStackTrace();
+ log.debug(msg, ex);
}
- throw new PermissionException(ex);
+ if (ex instanceof PermissionException) {
+ throw (PermissionException) ex;
+ }
+ throw new PermissionException(msg, ex);
}
provider.commitTransaction(status);
if (log.isDebugEnabled()) {
- log.debug("deleted permissions "
+ log.debug("deletepermissions(res) success, "
+ " res=" + res.toString()
+ " oid=" + oid.toString());
}
}
private void addPermission(ObjectIdentity oid, Permission permission,
- Sid recipient) throws PermissionException {
+ Sid sid) throws PermissionException {
MutableAcl acl;
try {
acl = getAcl(oid);
- } catch (PermissionException pnfe) {
+ } catch (NotFoundException nfe) {
+ if (log.isDebugEnabled()) {
+ log.debug("addPermission: acl not found for oid=" + oid.toString()
+ + " perm=" + permission.toString()
+ + " sid=" + sid.toString()
+ + " adding...");
+ }
acl = provider.getProviderAclService().createAcl(oid);
}
- acl.insertAce(acl.getEntries().size(), permission, recipient, true);
+ acl.insertAce(acl.getEntries().size(), permission, sid, true);
provider.getProviderAclService().updateAcl(acl);
if (log.isDebugEnabled()) {
log.debug("addPermission: added acl for oid=" + oid.toString()
+ " perm=" + permission.toString()
- + " sid=" + recipient.toString());
+ + " sid=" + sid.toString());
}
}
- private void deletePermissions(ObjectIdentity oid, Permission permission, Sid recipient)
- throws PermissionException {
-
- int j = 0;
+ private void deletePermissions(ObjectIdentity oid, Permission permission, Sid sid) /** throws AclDataAccessException */
+ {
+ int i = 0;
MutableAcl acl = getAcl(oid);
- List<AccessControlEntry> entries = acl.getEntries();
+ List<AccessControlEntry> acel = acl.getEntries();
+ int aces = acel.size();
if (log.isDebugEnabled()) {
log.debug("deletePermissions: for acl oid=" + oid.toString()
- + " found " + entries.size() + " aces");
+ + " found " + aces + " aces");
}
-
- for (int i = 0; i < entries.size(); i++) {
- AccessControlEntry ace = entries.get(i);
- if (recipient != null) {
- if (ace.getSid().equals(recipient)
+ ArrayList<Integer> foundAces = new ArrayList<Integer>();
+ Iterator iter = acel.listIterator();
+ //not possible to delete while iterating
+ while(iter.hasNext()) {
+ AccessControlEntry ace = (AccessControlEntry)iter.next();
+ if (sid != null) {
+ if (ace.getSid().equals(sid)
&& ace.getPermission().equals(permission)) {
- acl.deleteAce(i);
- j++;
+ foundAces.add(i);
+ i++;
}
} else {
if (ace.getPermission().equals(permission)) {
- acl.deleteAce(i);
- j++;
+ foundAces.add(i);
+ i++;
}
}
}
+ for (int j = foundAces.size() - 1; j >= 0; j--) {
+ //the following operation does not work while iterating in the while loop
+ acl.deleteAce(foundAces.get(j)); //autobox
+ }
provider.getProviderAclService().updateAcl(acl);
if (log.isDebugEnabled()) {
log.debug("deletePermissions: for acl oid=" + oid.toString()
- + " deleted " + j + " aces");
+ + " deleted " + i + " aces");
}
}
- private MutableAcl getAcl(ObjectIdentity oid) throws PermissionNotFoundException {
+ private MutableAcl getAcl(ObjectIdentity oid) throws NotFoundException {
MutableAcl acl = null;
- try {
- acl = (MutableAcl) provider.getProviderAclService().readAclById(oid);
- if (log.isDebugEnabled()) {
- log.debug("found acl for oid=" + oid.toString());
- }
- } catch (NotFoundException nfe) {
- String msg = "Cound not find acl for oid=" + oid.toString();
- log.error(msg);
- throw new PermissionNotFoundException(msg);
+ acl = (MutableAcl) provider.getProviderAclService().readAclById(oid);
+ if (log.isDebugEnabled()) {
+ log.debug("found acl for oid=" + oid.toString());
}
return acl;
}
projects / tmp / jakarta-migration.git / commitdiff