Also propagated another bug fix in AuthorizationDelegate to a separate case. Made some comments to indicate some places where we need to have a more robust (tenant-specific) name for roles, to address CSPACE-3144.
List<RoleValue> roleValues = new ArrayList<RoleValue>();
for (Role role : roles) {
RoleValue rv = new RoleValue();
+ // This needs to use the qualified name, not the display name
rv.setRoleName(role.getRoleName().toUpperCase());
rv.setRoleId(role.getCsid());
roleValues.add(rv);
logger.error(msg);
throw new DocumentNotFoundException(msg);
}
- String[] roles = {r.getRoleName()}; //this ensures we're getting the "ROLE" prefix/qualified name
+ //using r not rv ensures we're getting the "ROLE" prefix/qualified name
+ // This needs to use the qualified name, not the display name
+ String[] roles = {r.getRoleName()};
for (PermissionValue pv : pr.getPermissions()) {
Permission p = getPermission(pv.getPermissionId());
if (p == null) {
logger.error(msg);
throw new DocumentNotFoundException(msg);
}
- String[] roles = {rv.getRoleName()};
+ //using r not rv ensures we're getting the "ROLE" prefix/qualified name
+ // This needs to use the qualified name, not the display name
+ String[] roles = {r.getRoleName()};
for (PermissionValue pv : pr.getPermissions()) {
Permission p = getPermission(pv.getPermissionId());
if (p == null) {
public void addPermissions(CSpaceResource res, CSpaceAction action, String[] principals, boolean grant)
throws PermissionException {
provider.getPermissionManager().addPermissions(res, action, principals, grant);
+ provider.clearAclCache();
}
/**
public void deletePermissions(CSpaceResource res, CSpaceAction action, String[] principals)
throws PermissionNotFoundException, PermissionException {
provider.getPermissionManager().deletePermissions(res, action, principals);
+ provider.clearAclCache();
}
/**
deletePermissions(res, action);
} else {
provider.getPermissionManager().deletePermissions(res);
+ provider.clearAclCache();
}
}
public void deletePermissions(CSpaceResource res, CSpaceAction action)
throws PermissionNotFoundException, PermissionException {
provider.getPermissionManager().deletePermissions(res, action);
+ provider.clearAclCache();
}
/**
public CSpacePermissionEvaluator getPermissionEvaluator();
public CSpacePermissionManager getPermissionManager();
+
+ public void clearAclCache();
}
import org.springframework.jdbc.datasource.DataSourceTransactionManager;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.acls.domain.BasePermission;
+import org.springframework.security.acls.domain.EhCacheBasedAclCache;
import org.springframework.security.acls.domain.GrantedAuthoritySid;
import org.springframework.security.acls.domain.ObjectIdentityImpl;
import org.springframework.security.acls.model.MutableAclService;
private PermissionEvaluator providerPermissionEvaluator;
@Autowired
private DataSourceTransactionManager txManager;
+ @Autowired
+ private EhCacheBasedAclCache providerAclCache;
private SpringPermissionEvaluator permissionEvaluator;
private SpringPermissionManager permissionManager;
private String version = "1.0";
this.txManager = txManager;
}
+ /**
+ * @return the providerAclCache
+ */
+ EhCacheBasedAclCache getProviderAclCache() {
+ return providerAclCache;
+ }
+
+ /**
+ * @param providerAclCache the providerAclCache to set
+ */
+ public void setProviderAclCache(EhCacheBasedAclCache providerAclCache) {
+ this.providerAclCache = providerAclCache;
+ }
+
+ /**
+ * clear the ACL Cache associated with the provider
+ */
+ public void clearAclCache() {
+ if(providerAclCache != null) {
+ providerAclCache.clearCache();
+ if (log.isDebugEnabled()) {
+ log.debug("Clearing providerAclCache.");
+ }
+ } else {
+ log.error("providerAclCache is NULL!");
+ }
+ }
+
TransactionStatus beginTransaction(String name) {
DefaultTransactionDefinition def = new DefaultTransactionDefinition();
// explicitly setting the transaction name is something that can only be done programmatically
<tx:annotation-driven transaction-manager="transactionManager" />
<bean id="cspaceAuthorizationProvider" class="org.collectionspace.services.authorization.spring.SpringAuthorizationProvider">
- <property name="providerAclService" ref="aclService"/>
- <property name="providerPermissionEvaluator" ref="permissionEvaluator"/>
- <property name="txManager" ref="transactionManager"/>
+ <property name="providerAclService" ref="aclService"/>
+ <property name="providerPermissionEvaluator" ref="permissionEvaluator"/>
+ <property name="txManager" ref="transactionManager"/>
+ <property name="providerAclCache" ref="aclCache"/>
</bean>
</beans>
throw new IllegalArgumentException("no service binding found for " + serviceName
+ " of tenant with id=" + tenantId);
}
- if (serviceBinding.getRepositoryDomain() == null) {
+ String repoDomain = serviceBinding.getRepositoryDomain();
+ if (repoDomain == null) {
+ /* This is excessive - every call to a JPA based service dumps this msg.
if (logger.isDebugEnabled()) {
logger.debug("No repository domain configured for " + serviceName
+ " of tenant with id=" + tenantId);
}
+ */
return null;
}
- return domains.get(serviceBinding.getRepositoryDomain().trim());
+ return domains.get(repoDomain.trim());
}
/**
projects / tmp / jakarta-migration.git / commitdiff