From: Sanjay Dalal Date: Fri, 4 Jun 2010 21:32:32 +0000 (+0000) Subject: CSPACE-2003, CSPACE-1969 ImportAuthZ now inserts default roles, permissions and permi... X-Git-Url: https://git.aero2k.de/?a=commitdiff_plain;h=5ba90535d6fe672d6e2645193e66908b6070ef68;p=tmp%2Fjakarta-migration.git CSPACE-2003, CSPACE-1969 ImportAuthZ now inserts default roles, permissions and permission-roles into the database in addtion to inserting ACLs in Spring. These could be retrieved using the respective authz services. CSPACE-2004, CSPACE-1926 ImportAuthZ now creates a ROLE_TENANT_ADMINISTRATOR for each tenant that has all privileges to all services used by that tenant. It also creates a ROLE_TENANT_READER. This role has only READ, SEARCH privileges for all services used by the tenant test: ant import, mvn test (service level) --- diff --git a/services/authorization-mgt/client/src/test/java/org/collectionspace/services/authorization/client/test/PermissionServiceTest.java b/services/authorization-mgt/client/src/test/java/org/collectionspace/services/authorization/client/test/PermissionServiceTest.java index e70def7c7..167e5d41f 100644 --- a/services/authorization-mgt/client/src/test/java/org/collectionspace/services/authorization/client/test/PermissionServiceTest.java +++ b/services/authorization-mgt/client/src/test/java/org/collectionspace/services/authorization/client/test/PermissionServiceTest.java @@ -413,7 +413,7 @@ public class PermissionServiceTest extends AbstractServiceTestImpl { Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode), invalidStatusCodeMessage(REQUEST_TYPE, statusCode)); Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE); - int EXPECTED_ITEMS = 1; + int EXPECTED_ITEMS = 5; //seeded permissions if (logger.isDebugEnabled()) { logger.debug(testName + ": received = " + list.getPermissions().size() + " expected=" + EXPECTED_ITEMS); diff --git a/services/authorization-mgt/import/build.xml b/services/authorization-mgt/import/build.xml index 00a232e9e..c4919c1bc 100644 --- a/services/authorization-mgt/import/build.xml +++ b/services/authorization-mgt/import/build.xml @@ -112,7 +112,7 @@ - + @@ -121,7 +121,7 @@ - + @@ -134,6 +134,19 @@ + + + + + + + + + + + + + diff --git a/services/authorization-mgt/import/pom.xml b/services/authorization-mgt/import/pom.xml index 186aae227..1e38c7a9a 100644 --- a/services/authorization-mgt/import/pom.xml +++ b/services/authorization-mgt/import/pom.xml @@ -43,6 +43,12 @@ ${project.version} provided + + org.collectionspace.services + org.collectionspace.services.authorization-mgt.service + ${project.version} + provided + org.testng testng @@ -141,8 +147,6 @@ test -b ${basedir}/../../common/src/main/config/services/tenant-bindings.xml - -idir - ${basedir}/src/main/resources/import-data/ -edir ${basedir}/src/main/resources/import-data/ diff --git a/services/authorization-mgt/import/src/main/java/org/collectionspace/ImportAuthz.java b/services/authorization-mgt/import/src/main/java/org/collectionspace/ImportAuthz.java index 39358525d..9f7730b39 100644 --- a/services/authorization-mgt/import/src/main/java/org/collectionspace/ImportAuthz.java +++ b/services/authorization-mgt/import/src/main/java/org/collectionspace/ImportAuthz.java @@ -40,6 +40,13 @@ import org.collectionspace.services.authorization.driver.AuthorizationSeedDriver */ public class ImportAuthz { + final private static String OPTIONS_USERNAME = "username"; + final private static String OPTIONS_PASSWORD = "password"; + final private static String OPTIONS_TENANT_BINDING = "tenant binding file"; + final private static String OPTIONS_IMPORT_DIR = "importdir"; + final private static String OPTIONS_EXPORT_DIR = "exportdir"; + final private static String OPTIONS_HELP = "help"; + public static void main(String[] args) { Options options = createOptions(); @@ -48,33 +55,50 @@ public class ImportAuthz { try { // parse the command line arguments CommandLine line = parser.parse(options, args); + if (line.hasOption("h")) { + printUsage(); + System.exit(1); + } String user = line.getOptionValue("u"); String password = line.getOptionValue("p"); String tenantBinding = line.getOptionValue("b"); - String importDir = line.getOptionValue("idir"); String exportDir = line.getOptionValue("edir"); System.out.println("user=" + user + " password=" + password + " tenantBinding=" + tenantBinding - + " importDir=" + importDir + " exportDir=" + exportDir); AuthorizationSeedDriver driver = new AuthorizationSeedDriver( - user, password, tenantBinding, importDir, exportDir); - driver.seedData(); + user, password, tenantBinding, exportDir); + driver.generate(); + driver.seed(); } catch (ParseException exp) { // oops, something went wrong System.err.println("Parsing failed. Reason: " + exp.getMessage()); + } catch (Exception e) { + System.out.println("Error : " + e.getMessage()); + printUsage(); } } private static Options createOptions() { Options options = new Options(); - options.addOption("u", true, "username"); - options.addOption("p", true, "password"); - options.addOption("b", true, "tenant binding file"); - options.addOption("idir", true, "import dir"); - options.addOption("edir", true, "export dir"); + options.addOption("u", true, OPTIONS_USERNAME); + options.addOption("p", true, OPTIONS_PASSWORD); + options.addOption("b", true, OPTIONS_TENANT_BINDING); + options.addOption("edir", true, OPTIONS_EXPORT_DIR); + options.addOption("h", true, OPTIONS_HELP); return options; } + + private static void printUsage() { + StringBuilder sb = new StringBuilder(); + sb.append("\nUsage : java -cp " + ImportAuthz.class.getName() + " "); + sb.append("\nOptions :"); + sb.append("\n -u <" + OPTIONS_USERNAME + "> cspace username"); + sb.append("\n -p <" + OPTIONS_PASSWORD + "> password"); + sb.append("\n -b <" + OPTIONS_TENANT_BINDING + "> tenant binding file (fully qualified path)"); + sb.append("\n -edir <" + OPTIONS_EXPORT_DIR + "> directory to export authz data into"); + System.out.println(sb.toString()); + } } diff --git a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java index 34cac1756..1102943bd 100644 --- a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java +++ b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java @@ -24,10 +24,19 @@ package org.collectionspace.services.authorization.driver; import java.io.File; +import java.util.ArrayList; import java.util.HashSet; +import java.util.List; import org.collectionspace.services.authorization.AuthZ; +import org.collectionspace.services.authorization.Permission; +import org.collectionspace.services.authorization.PermissionRole; +import org.collectionspace.services.authorization.PermissionRoleRel; +import org.collectionspace.services.authorization.Role; +import org.collectionspace.services.authorization.SubjectType; import org.collectionspace.services.authorization.importer.AuthorizationGen; import org.collectionspace.services.authorization.importer.AuthorizationSeed; +import org.collectionspace.services.authorization.importer.AuthorizationStore; +import org.collectionspace.services.authorization.storage.PermissionRoleUtil; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.context.support.ClassPathXmlApplicationContext; @@ -48,13 +57,14 @@ public class AuthorizationSeedDriver { final Logger logger = LoggerFactory.getLogger(AuthorizationSeedDriver.class); final static private String SPRING_SECURITY_METADATA = "applicationContext-authorization-test.xml"; + final static private String ROLE_FILE = "import-roles.xml"; final static private String PERMISSION_FILE = "import-permissions.xml"; final static private String PERMISSION_ROLE_FILE = "import-permissions-roles.xml"; - private String user = "test"; - private String password = "test"; + private String user; + private String password; private String tenantBindingFile; - private String importDir; private String exportDir; + private AuthorizationGen authzGen; private org.springframework.jdbc.datasource.DataSourceTransactionManager txManager; /** @@ -68,49 +78,61 @@ public class AuthorizationSeedDriver { */ public AuthorizationSeedDriver(String user, String password, String tenantBindingFile, - String importDir, String exportDir) { + String exportDir) { if (user == null || user.isEmpty()) { - this.user = user; + throw new IllegalArgumentException("username required."); } + this.user = user; + if (password == null || password.isEmpty()) { - this.password = password; + throw new IllegalArgumentException("password required."); } + this.password = password; + if (tenantBindingFile == null || tenantBindingFile.isEmpty()) { - throw new IllegalStateException("tenantbindings are required."); + throw new IllegalArgumentException("tenantbinding file are required."); } this.tenantBindingFile = tenantBindingFile; if (exportDir == null || exportDir.isEmpty()) { - throw new IllegalStateException("exportdir required."); + throw new IllegalArgumentException("exportdir required."); } this.exportDir = exportDir; - if (importDir == null || importDir.isEmpty()) { - importDir = exportDir; - } else { - this.importDir = importDir; - } } - public void seedData() { - setup(); - TransactionStatus status = null; + public void generate() { try { - AuthorizationGen authzGen = new AuthorizationGen(); + authzGen = new AuthorizationGen(); authzGen.initialize(tenantBindingFile); - authzGen.createDefaultServicePermissions(); - //create default role(s) for the tenant and assign permissions - authzGen.createDefaultPermissionsRoles(); - authzGen.exportPermissions(exportDir + File.separator + PERMISSION_FILE); - authzGen.exportPermissionRoles(exportDir + File.separator + PERMISSION_ROLE_FILE); + authzGen.createDefaultRoles(); + authzGen.createDefaultPermissions(); + authzGen.associateDefaultPermissionsRoles(); + authzGen.exportDefaultRoles(exportDir + File.separator + ROLE_FILE); + authzGen.exportDefaultPermissions(exportDir + File.separator + PERMISSION_FILE); + authzGen.exportDefaultPermissionRoles(exportDir + File.separator + PERMISSION_ROLE_FILE); if (logger.isDebugEnabled()) { logger.debug("authroization generation completed "); } + } catch (Exception ex) { + if (logger.isDebugEnabled()) { + ex.printStackTrace(); + } + throw new RuntimeException(ex); + } + } + + public void seed() { + TransactionStatus status = null; + try { + store(); + + setupSpring(); status = beginTransaction("seedData"); AuthorizationSeed authzSeed = new AuthorizationSeed(); - authzSeed.seedPermissions(importDir + File.separator + PERMISSION_FILE, - importDir + File.separator + PERMISSION_ROLE_FILE); + authzSeed.seedPermissions(exportDir + File.separator + PERMISSION_FILE, + exportDir + File.separator + PERMISSION_ROLE_FILE); if (logger.isDebugEnabled()) { - logger.debug("authroization seeding completed "); + logger.debug("authorization seeding completed "); } } catch (Exception ex) { if (status != null) { @@ -128,7 +150,7 @@ public class AuthorizationSeedDriver { } } - private void setup() { + private void setupSpring() { ClassPathXmlApplicationContext appContext = new ClassPathXmlApplicationContext( new String[]{SPRING_SECURITY_METADATA}); @@ -136,6 +158,9 @@ public class AuthorizationSeedDriver { System.setProperty("spring-beans-config", SPRING_SECURITY_METADATA); AuthZ authZ = AuthZ.get(); txManager = (org.springframework.jdbc.datasource.DataSourceTransactionManager) appContext.getBean("transactionManager"); + if (logger.isDebugEnabled()) { + logger.debug("spring setup complete"); + } } private void login() { @@ -144,10 +169,40 @@ public class AuthorizationSeedDriver { gauths.add(gauth); Authentication authRequest = new UsernamePasswordAuthenticationToken(user, password, gauths); SecurityContextHolder.getContext().setAuthentication(authRequest); + if (logger.isDebugEnabled()) { + logger.debug("login successful for user=" + user); + } } private void logout() { SecurityContextHolder.getContext().setAuthentication(null); + if (logger.isDebugEnabled()) { + logger.debug("logged out user=" + user); + } + } + + private void store() throws Exception { + AuthorizationStore authzStore = new AuthorizationStore(); + for (Role role : authzGen.getDefaultRoles()) { + authzStore.store(role); + } + + for (Permission perm : authzGen.getDefaultPermissions()) { + authzStore.store(perm); + } + + List permRoleRels = new ArrayList(); + for (PermissionRole pr : authzGen.getDefaultPermissionRoles()) { + PermissionRoleUtil.buildPermissionRoleRel(pr, SubjectType.ROLE, permRoleRels); + } + for (PermissionRoleRel permRoleRel : permRoleRels) { + authzStore.store(permRoleRel); + } + + if (logger.isDebugEnabled()) { + logger.debug("authroization storage completed "); + } + } private TransactionStatus beginTransaction(String name) { diff --git a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationGen.java b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationGen.java index 4b3164421..e73f9b913 100644 --- a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationGen.java +++ b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationGen.java @@ -27,12 +27,12 @@ import java.io.File; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.util.ArrayList; +import java.util.Date; import java.util.Hashtable; import java.util.List; import java.util.UUID; import javax.xml.bind.JAXBContext; import javax.xml.bind.Marshaller; -import org.collectionspace.services.authorization.AccountRole; import org.collectionspace.services.authorization.ActionType; import org.collectionspace.services.authorization.Permission; import org.collectionspace.services.authorization.EffectType; @@ -43,6 +43,7 @@ import org.collectionspace.services.authorization.PermissionsList; import org.collectionspace.services.authorization.PermissionsRolesList; import org.collectionspace.services.authorization.Role; import org.collectionspace.services.authorization.RoleValue; +import org.collectionspace.services.authorization.RolesList; import org.collectionspace.services.authorization.SubjectType; import org.collectionspace.services.common.config.TenantBindingConfigReaderImpl; import org.collectionspace.services.common.service.ServiceBindingType; @@ -55,44 +56,69 @@ import org.collectionspace.services.common.tenant.TenantBindingType; */ public class AuthorizationGen { + final public static String ROLE_ADMINISTRATOR = "ROLE_ADMINISTRATOR"; + final public static String ROLE_TENANT_ADMINISTRATOR = "ROLE_TENANT_ADMINISTRATOR"; + final public static String ROLE_TENANT_READER = "ROLE_TENANT_READER"; + final public static String ROLE_ADMINISTRATOR_ID = "0"; final Logger logger = LoggerFactory.getLogger(AuthorizationGen.class); - private List permList = new ArrayList(); - private List permRoleList = new ArrayList(); + private List adminPermList = new ArrayList(); + private List adminPermRoleList = new ArrayList(); + private List readerPermList = new ArrayList(); + private List readerPermRoleList = new ArrayList(); + private List adminRoles = new ArrayList(); + private List readerRoles = new ArrayList(); + private Role cspaceAdminRole; private Hashtable tenantBindings = new Hashtable(); - final public static String ROLE_ADMINISTRATOR = "ROLE_ADMINISTRATOR"; public void initialize(String tenantBindingFileName) throws Exception { TenantBindingConfigReaderImpl tenantBindingConfigReader = new TenantBindingConfigReaderImpl(null); tenantBindingConfigReader.read(tenantBindingFileName); tenantBindings = tenantBindingConfigReader.getTenantBindings(); + cspaceAdminRole = buildCSpaceAdminRole(); + if (logger.isDebugEnabled()) { logger.debug("initialized with tenant bindings from " + tenantBindingFileName); } } - public void createDefaultServicePermissions() { + /** + * createDefaultPermissions creates default admin and reader permissions + * for each tenant found in the given tenant binding file + * @see initialize + * @return + */ + public void createDefaultPermissions() { for (String tenantId : tenantBindings.keySet()) { - List perms = createDefaultServicePermissions(tenantId); - permList.addAll(perms); + List adminPerms = createDefaultAdminPermissions(tenantId); + adminPermList.addAll(adminPerms); + + List readerPerms = createDefaultReaderPermissions(tenantId); + readerPermList.addAll(readerPerms); } } - public List createDefaultServicePermissions(String tenantId) { + /** + * createDefaultAdminPermissions creates default admin permissions for all services + * used by the given tenant + * @param tenantId + * @return + */ + public List createDefaultAdminPermissions(String tenantId) { ArrayList apcList = new ArrayList(); TenantBindingType tbinding = tenantBindings.get(tenantId); for (ServiceBindingType sbinding : tbinding.getServiceBindings()) { //add permissions for the main path - Permission perm = buildCommonPermission(tbinding.getId(), + Permission perm = buildAdminPermission(tbinding.getId(), sbinding.getName().toLowerCase()); apcList.add(perm); //add permissions for alternate paths List uriPaths = sbinding.getUriPath(); for (String uriPath : uriPaths) { - perm = buildCommonPermission(tbinding.getId(), + perm = buildAdminPermission(tbinding.getId(), uriPath.toLowerCase()); apcList.add(perm); } @@ -102,10 +128,12 @@ public class AuthorizationGen { } - private Permission buildCommonPermission(String tenantId, String resourceName) { + private Permission buildAdminPermission(String tenantId, String resourceName) { String id = UUID.randomUUID().toString(); Permission perm = new Permission(); perm.setCsid(id); + perm.setDescription("generated admin permission"); + perm.setCreatedAtItem(new Date()); perm.setResourceName(resourceName.toLowerCase()); perm.setEffect(EffectType.PERMIT); perm.setTenantId(tenantId); @@ -130,75 +158,209 @@ public class AuthorizationGen { return perm; } - public List getDefaultServicePermissions() { - return permList; + /** + * createDefaultReaderPermissions creates read only permissions for all services + * used by the given tenant + * @param tenantId + * @return + */ + public List createDefaultReaderPermissions(String tenantId) { + ArrayList apcList = new ArrayList(); + TenantBindingType tbinding = tenantBindings.get(tenantId); + for (ServiceBindingType sbinding : tbinding.getServiceBindings()) { + + //add permissions for the main path + Permission perm = buildReaderPermission(tbinding.getId(), + sbinding.getName().toLowerCase()); + apcList.add(perm); + + //add permissions for alternate paths + List uriPaths = sbinding.getUriPath(); + for (String uriPath : uriPaths) { + perm = buildReaderPermission(tbinding.getId(), + uriPath.toLowerCase()); + apcList.add(perm); + } + + } + return apcList; + + } + + private Permission buildReaderPermission(String tenantId, String resourceName) { + String id = UUID.randomUUID().toString(); + Permission perm = new Permission(); + perm.setCsid(id); + perm.setCreatedAtItem(new Date()); + perm.setDescription("generated readonly permission"); + perm.setResourceName(resourceName.toLowerCase()); + perm.setEffect(EffectType.PERMIT); + perm.setTenantId(tenantId); + ArrayList pas = new ArrayList(); + perm.setActions(pas); + + PermissionAction pa1 = new PermissionAction(); + pa1.setName(ActionType.READ); + pas.add(pa1); + + PermissionAction pa4 = new PermissionAction(); + pa4.setName(ActionType.SEARCH); + pas.add(pa4); + return perm; + } + + public List getDefaultPermissions() { + List allPermList = new ArrayList(); + allPermList.addAll(adminPermList); + allPermList.addAll(readerPermList); + return allPermList; + } + + public List getDefaultAdminPermissions() { + return adminPermList; + } + + public List getDefaultReaderPermissions() { + return readerPermList; + } + + /** + * createDefaultRoles creates default admin and reader roles + * for each tenant found in the given tenant binding file + */ + public void createDefaultRoles() { + for (String tenantId : tenantBindings.keySet()) { + + Role arole = buildTenantAdminRole(tenantId); + adminRoles.add(arole); + + Role rrole = buildTenantReaderRole(tenantId); + readerRoles.add(rrole); + + } + } + + private Role buildTenantAdminRole(String tenantId) { + Role role = new Role(); + role.setCreatedAtItem(new Date()); + role.setRoleName(ROLE_TENANT_ADMINISTRATOR); + String id = UUID.randomUUID().toString(); + role.setCsid(id); + role.setDescription("generated tenant admin role"); + role.setTenantId(tenantId); + return role; + } + + private Role buildTenantReaderRole(String tenantId) { + Role role = new Role(); + role.setCreatedAtItem(new Date()); + role.setRoleName(ROLE_TENANT_READER); + String id = UUID.randomUUID().toString(); + role.setCsid(id); + role.setDescription("generated tenant read only role"); + role.setTenantId(tenantId); + return role; } - public void createDefaultPermissionsRoles() { - for (Permission p : permList) { - TenantBindingType tbinding = tenantBindings.get(p.getTenantId()); -// String tenantAdminRole = getTenantAdminRole(tbinding.getName()); -// PermissionRole permRole = buildCommonPermissionRoles(p.getTenantId(), p.getCsid(), -// p.getResourceName(), tenantAdminRole, "999"); -// permRoleList.add(permRole); + public List getDefaultRoles() { + List allRoleList = new ArrayList(); + allRoleList.addAll(adminRoles); + allRoleList.addAll(readerRoles); + return allRoleList; + } + + public void associateDefaultPermissionsRoles() { + List roles = new ArrayList(); + roles.add(cspaceAdminRole); + for (Permission p : adminPermList) { + PermissionRole permAdmRole = associatePermissionRoles(p, adminRoles); + adminPermRoleList.add(permAdmRole); //CSpace Administrator has all access - PermissionRole permAdmRole = buildCommonPermissionRoles(p.getTenantId(), p.getCsid(), - p.getResourceName(), ROLE_ADMINISTRATOR, "1"); - permRoleList.add(permAdmRole); + PermissionRole permCAdmRole = associatePermissionRoles(p, roles); + adminPermRoleList.add(permCAdmRole); + } + + for (Permission p : readerPermList) { + PermissionRole permRdrRole = associatePermissionRoles(p, readerRoles); + readerPermRoleList.add(permRdrRole); } } - public List createPermissionsRoles(List perms, String roleName, String roleId) { + public List associatePermissionsRoles(List perms, List roles) { List permRoles = new ArrayList(); - for (Permission p : perms) { - PermissionRole permRole = buildCommonPermissionRoles(p.getTenantId(), p.getCsid(), - p.getResourceName(), roleName, roleId); + for (Permission perm : perms) { + PermissionRole permRole = associatePermissionRoles(perm, roles); permRoles.add(permRole); } return permRoles; } - private PermissionRole buildCommonPermissionRoles(String tenantId, String permId, - String resName, String roleName, String roleId) { + private PermissionRole associatePermissionRoles(Permission perm, + List roles) { PermissionRole pr = new PermissionRole(); pr.setSubject(SubjectType.ROLE); List permValues = new ArrayList(); pr.setPermissions(permValues); PermissionValue permValue = new PermissionValue(); - permValue.setPermissionId(permId); - permValue.setResourceName(resName.toLowerCase()); + permValue.setPermissionId(perm.getCsid()); + permValue.setResourceName(perm.getResourceName().toLowerCase()); permValues.add(permValue); List roleValues = new ArrayList(); - RoleValue radmin = new RoleValue(); - radmin.setRoleName(roleName.toUpperCase()); - radmin.setRoleId(roleId); - roleValues.add(radmin); + for (Role role : roles) { + RoleValue rv = new RoleValue(); + rv.setRoleName(role.getRoleName().toUpperCase()); + rv.setRoleId(role.getCsid()); + roleValues.add(rv); + } pr.setRoles(roleValues); return pr; } - /** - * getTenantAdminRole generates role for tenant administrator - * @param tenantName - * @return - */ - private String getTenantAdminRole(String tenantName) { - tenantName = tenantName.toUpperCase(); - tenantName = tenantName.replace(' ', '_'); - return ROLE_ADMINISTRATOR + "_" + tenantName; + public List getDefaultPermissionRoles() { + List allPermRoleList = new ArrayList(); + allPermRoleList.addAll(adminPermRoleList); + allPermRoleList.addAll(readerPermRoleList); + return allPermRoleList; + } + + public List getDefaultAdminPermissionRoles() { + return adminPermRoleList; + } + + public List getDefaultReaderPermissionRoles() { + return readerPermRoleList; } - public List getDefaultServicePermissionRoles() { - return permRoleList; + private Role buildCSpaceAdminRole() { + Role role = new Role(); + role.setRoleName(ROLE_ADMINISTRATOR); + role.setCsid(ROLE_ADMINISTRATOR_ID); + return role; + } + + public void exportDefaultRoles(String fileName) { + RolesList rList = new RolesList(); + List allRoleList = new ArrayList(); + allRoleList.addAll(adminRoles); + allRoleList.addAll(readerRoles); + rList.setRoles(allRoleList); + toFile(rList, RolesList.class, + fileName); + if (logger.isDebugEnabled()) { + logger.debug("exported roles to " + fileName); + } } - public void exportPermissions(String fileName) { + public void exportDefaultPermissions(String fileName) { PermissionsList pcList = new PermissionsList(); - pcList.setPermissions(permList); + List allPermList = new ArrayList(); + allPermList.addAll(adminPermList); + allPermList.addAll(readerPermList); + pcList.setPermissions(allPermList); toFile(pcList, PermissionsList.class, fileName); if (logger.isDebugEnabled()) { @@ -206,9 +368,12 @@ public class AuthorizationGen { } } - public void exportPermissionRoles(String fileName) { + public void exportDefaultPermissionRoles(String fileName) { PermissionsRolesList psrsl = new PermissionsRolesList(); - psrsl.setPermissionRoles(permRoleList); + List allPermRoleList = new ArrayList(); + allPermRoleList.addAll(adminPermRoleList); + allPermRoleList.addAll(readerPermRoleList); + psrsl.setPermissionRoles(allPermRoleList); toFile(psrsl, PermissionsRolesList.class, fileName); if (logger.isDebugEnabled()) { diff --git a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationStore.java b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationStore.java new file mode 100644 index 000000000..c6c79bf6f --- /dev/null +++ b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/importer/AuthorizationStore.java @@ -0,0 +1,88 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2010 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization.importer; + +import java.util.Date; +import javax.persistence.EntityManager; +import javax.persistence.EntityManagerFactory; +import org.collectionspace.services.common.document.JaxbUtils; +import org.collectionspace.services.common.storage.jpa.JpaStorageUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * AuthorizationStore stores persistent entities during import + * @author + */ +public class AuthorizationStore { + + private final Logger logger = LoggerFactory.getLogger(AuthorizationStore.class); + private final static String PERSISTENCE_UNIT = "org.collectionspace.services.authorization"; + + /** + * store the given entity + * @param entity + * @return csid of the entity + * @throws Exception + */ + public String store(Object entity) throws Exception { + EntityManagerFactory emf = null; + EntityManager em = null; + try { + emf = JpaStorageUtils.getEntityManagerFactory(PERSISTENCE_UNIT); + em = emf.createEntityManager(); + //FIXME: more efficient would be to participate in transaction already started + //by the caller + em.getTransaction().begin(); + if (JaxbUtils.getValue(entity, "getCreatedAt") == null) { + JaxbUtils.setValue(entity, "setCreatedAtItem", Date.class, new Date()); + } + em.persist(entity); + em.getTransaction().commit(); + String id = null; + try{ + id = (String) JaxbUtils.getValue(entity, "getCsid"); + } catch(NoSuchMethodException nsme) { + //do nothing ok, relationship does not have csid + } + return id; + } catch (Exception e) { + if (em != null && em.getTransaction().isActive()) { + em.getTransaction().rollback(); + } + if (logger.isDebugEnabled()) { + logger.debug("Caught exception ", e); + } + throw e; + } finally { + if (em != null) { + JpaStorageUtils.releaseEntityManagerFactory(emf); + } + } + } +} diff --git a/services/authorization-mgt/import/src/main/resources/META-INF/persistence.xml b/services/authorization-mgt/import/src/main/resources/META-INF/persistence.xml new file mode 100644 index 000000000..ec517f79d --- /dev/null +++ b/services/authorization-mgt/import/src/main/resources/META-INF/persistence.xml @@ -0,0 +1,21 @@ + + + + org.collectionspace.services.authorization.Permission + org.collectionspace.services.authorization.PermissionAction + org.collectionspace.services.authorization.PermissionRoleRel + org.collectionspace.services.authorization.Role + org.collectionspace.services.authorization.AccountRoleRel + + + + + + + diff --git a/services/authorization-mgt/import/src/main/resources/hibernate.cfg.xml b/services/authorization-mgt/import/src/main/resources/hibernate.cfg.xml new file mode 100644 index 000000000..8296399cf --- /dev/null +++ b/services/authorization-mgt/import/src/main/resources/hibernate.cfg.xml @@ -0,0 +1,24 @@ + + + + + + + @DB_URL@ + @DB_DRIVER_CLASS@ + @DB_USER@ + @DB_PASSWORD@ + @DB_DIALECT@ + org.hibernate.transaction.JDBCTransactionFactory + thread + true + + diff --git a/services/authorization-mgt/import/src/main/resources/import-data/import-permissions-roles.xml b/services/authorization-mgt/import/src/main/resources/import-data/import-permissions-roles.xml index edf8aef0f..5f10e8ba1 100644 --- a/services/authorization-mgt/import/src/main/resources/import-data/import-permissions-roles.xml +++ b/services/authorization-mgt/import/src/main/resources/import-data/import-permissions-roles.xml @@ -3,560 +3,1678 @@ ROLE - 68eea582-e5b0-4aab-a01b-e45126ce1924 + de3657a1-99f8-46b6-b4bb-2e28f9def87f idgenerators - 1 + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + de3657a1-99f8-46b6-b4bb-2e28f9def87f + idgenerators + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + b6644980-aeef-4d8f-a048-338057f9d973 + id + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + b6644980-aeef-4d8f-a048-338057f9d973 + id + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + ddcdcc15-7f5a-49d8-8354-82c2e52d4727 + + /idgenerators/*/ids + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + ddcdcc15-7f5a-49d8-8354-82c2e52d4727 + + /idgenerators/*/ids + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + b203fb49-56c3-4662-b4bd-4008a6462364 + collectionobjects + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + b203fb49-56c3-4662-b4bd-4008a6462364 + collectionobjects + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 2dde10d0-2ce9-471b-9c66-c67a6e7c511f + + /collectionobjects/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 2dde10d0-2ce9-471b-9c66-c67a6e7c511f + + /collectionobjects/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + b8323642-cd0a-491f-a952-cf36d2b32134 + intakes + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + b8323642-cd0a-491f-a952-cf36d2b32134 + intakes + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 3c3e7ff6-7ecd-4643-b662-3fcb54e62abe + + /intakes/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 3c3e7ff6-7ecd-4643-b662-3fcb54e62abe + + /intakes/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + e248b5af-6eb3-4063-8816-6c2b0c55537c + loansin + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + e248b5af-6eb3-4063-8816-6c2b0c55537c + loansin + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 6529cf6d-34ae-4bab-a6e2-ab19973620fb + + /loansin/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 6529cf6d-34ae-4bab-a6e2-ab19973620fb + + /loansin/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 1145d28d-269a-41fd-806f-b0d6511cf273 + loansout + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 1145d28d-269a-41fd-806f-b0d6511cf273 + loansout + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 8773ed3b-9432-44e8-900e-1bc3908e7911 + + /loansout/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 8773ed3b-9432-44e8-900e-1bc3908e7911 + + /loansout/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 21786a64-02e0-4359-9c61-47cf821f2362 + movements + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 21786a64-02e0-4359-9c61-47cf821f2362 + movements + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + d501423e-9425-4c99-bf6f-478a2a9f971e + + /movements/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + d501423e-9425-4c99-bf6f-478a2a9f971e + + /movements/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 88075c4c-d5ed-420a-a767-1ab662066feb + vocabularies + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 88075c4c-d5ed-420a-a767-1ab662066feb + vocabularies + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 2444d28d-883f-4566-a378-f03b95d100b9 + vocabularyitems + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 2444d28d-883f-4566-a378-f03b95d100b9 + vocabularyitems + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 80a57584-6438-4df3-95df-bba1d7d9a275 + + /vocabularies/*/items/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 80a57584-6438-4df3-95df-bba1d7d9a275 + + /vocabularies/*/items/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 812a71ed-0dfe-4371-a390-4776ab5519f2 + orgauthorities + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 812a71ed-0dfe-4371-a390-4776ab5519f2 + orgauthorities + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + a9aeff96-179f-4b1d-8e74-25358185fdae + + /orgauthorities/*/items/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + a9aeff96-179f-4b1d-8e74-25358185fdae + + /orgauthorities/*/items/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 23897bf4-c727-4737-a70c-dc446519e1d5 + organizations + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 23897bf4-c727-4737-a70c-dc446519e1d5 + organizations + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 64f48448-c5ed-4096-acc8-17daebf2924f + + /orgauthorities/*/items/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 64f48448-c5ed-4096-acc8-17daebf2924f + + /orgauthorities/*/items/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 90bea796-bf38-46a6-8a9e-fc9a1eed157d + + /orgauthorities/*/items/*/refobjs + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 90bea796-bf38-46a6-8a9e-fc9a1eed157d + + /orgauthorities/*/items/*/refobjs + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + e61b8b12-3db0-499a-b074-79afec3f141a + personauthorities + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + e61b8b12-3db0-499a-b074-79afec3f141a + personauthorities + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + ce34076c-83b0-409c-b2b8-2d3805af9056 + + /personauthorities/*/items/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + ce34076c-83b0-409c-b2b8-2d3805af9056 + + /personauthorities/*/items/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + acac0886-627b-43e6-810c-f62c928b99bf + + /personauthorities/*/items/*/refobjs + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + acac0886-627b-43e6-810c-f62c928b99bf + + /personauthorities/*/items/*/refobjs + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 1aa13e33-4b21-4e6f-b670-2fc13f8fd2b4 + persons + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 1aa13e33-4b21-4e6f-b670-2fc13f8fd2b4 + persons + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + cbb98b91-25ed-4e8b-af4d-48f11e981e19 + + /personauthorities/*/items/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + cbb98b91-25ed-4e8b-af4d-48f11e981e19 + + /personauthorities/*/items/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 7c9e5c9a-8eb7-4579-ad94-e6d4f90c9ae8 + locationauthorities + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 7c9e5c9a-8eb7-4579-ad94-e6d4f90c9ae8 + locationauthorities + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + ce653183-2722-46c9-8f19-2e719c9cb06c + + /locationauthorities/*/items/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + ce653183-2722-46c9-8f19-2e719c9cb06c + + /locationauthorities/*/items/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 59b8de3a-9b1d-4e82-9aa5-0d28dd5a46ac + locations + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 59b8de3a-9b1d-4e82-9aa5-0d28dd5a46ac + locations + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 37e00906-0fa5-4d20-be21-739f66bcac52 + acquisitions + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 37e00906-0fa5-4d20-be21-739f66bcac52 + acquisitions + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 1ebea466-ab70-4368-8965-aa9305661d50 + + /acquisitions/*/authorityrefs/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 1ebea466-ab70-4368-8965-aa9305661d50 + + /acquisitions/*/authorityrefs/ + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + c48e8d4a-7972-469f-a2bc-1bca201cd772 + relations + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + c48e8d4a-7972-469f-a2bc-1bca201cd772 + relations + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + b2f182cb-61d7-4016-a2e2-075c13afefd0 + + relations/subject/*/type/*/object/* + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + b2f182cb-61d7-4016-a2e2-075c13afefd0 + + relations/subject/*/type/*/object/* + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 6ba014c0-80e1-456f-9c3c-de339391d254 + accounts + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 6ba014c0-80e1-456f-9c3c-de339391d254 + accounts + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + ee04f607-8e32-46dd-b5c9-b7657cdd290c + dimensions + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + ee04f607-8e32-46dd-b5c9-b7657cdd290c + dimensions + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 828327fc-7b3d-4bde-b6d6-e48c74c3f4fd + contacts + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 828327fc-7b3d-4bde-b6d6-e48c74c3f4fd + contacts + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 2d48d7a3-faba-4e8d-93a3-0863de7d92da + + /personauthorities/*/items/*/contacts + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 2d48d7a3-faba-4e8d-93a3-0863de7d92da + + /personauthorities/*/items/*/contacts + + + + 0 ROLE_ADMINISTRATOR ROLE - 150c809f-ffd6-4b23-b86b-a6533feeda29 - id + 7d8f835d-d9c0-4508-b279-eef890db247a + + /orgauthorities/*/items/*/contacts + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 7d8f835d-d9c0-4508-b279-eef890db247a + + /orgauthorities/*/items/*/contacts + + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + ab92d994-29eb-4d64-bd49-b3cafd8f0a5b + notes + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + ab92d994-29eb-4d64-bd49-b3cafd8f0a5b + notes + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + db65825c-50c3-49a8-af5f-68115f16537b + authorization/roles + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + db65825c-50c3-49a8-af5f-68115f16537b + authorization/roles - 1 + 0 ROLE_ADMINISTRATOR ROLE - 30f13249-56c6-428e-9f9b-be092520ca30 + f7f41db6-f85f-4cd3-a2d6-d9185b6dd8e9 + authorization/permissions + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + f7f41db6-f85f-4cd3-a2d6-d9185b6dd8e9 + authorization/permissions + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 074e7f98-2580-48d3-969d-4043f156eaa2 + authorization/permissions/permroles + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 074e7f98-2580-48d3-969d-4043f156eaa2 + authorization/permissions/permroles + + + 0 + ROLE_ADMINISTRATOR + + + + ROLE + + 0cdd6f4e-58b6-4c11-bbbd-0984c30d6dbd - /idgenerators/*/ids + /authorization/permissions/*/permroles/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 0cdd6f4e-58b6-4c11-bbbd-0984c30d6dbd + + /authorization/permissions/*/permroles/ - 1 + 0 ROLE_ADMINISTRATOR ROLE - e5005679-b03a-4911-9081-741dced66508 - collectionobjects + 361c4bed-bd81-4f22-82df-f462111663a9 + accounts/accountroles - 1 + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 361c4bed-bd81-4f22-82df-f462111663a9 + accounts/accountroles + + + 0 ROLE_ADMINISTRATOR ROLE - 676a2ce3-f65a-445e-bc0f-cce5dc056eac + e272da20-719c-49d1-9584-c21cedcd3a65 - /collectionobjects/*/authorityrefs/ + /accounts/*/accountroles/ + + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + e272da20-719c-49d1-9584-c21cedcd3a65 + + /accounts/*/accountroles/ - 1 + 0 ROLE_ADMINISTRATOR ROLE - 200f1961-8910-4170-8f7b-32fcf7eef047 - intakes + d7618a4f-d8be-45f6-b0f3-2816ecdca341 + authorization/roles/permroles + + + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + d7618a4f-d8be-45f6-b0f3-2816ecdca341 + authorization/roles/permroles - 1 + 0 ROLE_ADMINISTRATOR ROLE - aa534e0f-6979-4c52-873c-d58bd0151f9c + 3b6b0755-9044-46ee-8a85-4e44ac68dd0a - /intakes/*/authorityrefs/ + /authorization/roles/*/permroles/ - 1 + ad3a2b4c-ef74-47f0-bdb0-f6a906acd370 + ROLE_TENANT_ADMINISTRATOR + + + + ROLE + + 3b6b0755-9044-46ee-8a85-4e44ac68dd0a + + /authorization/roles/*/permroles/ + + + + 0 ROLE_ADMINISTRATOR ROLE - 0a3692cd-94f6-44dd-854a-1fb0b19fe71d + da5253a4-471f-4ada-9d7d-8f1a9a747647 + idgenerators + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + 4d524373-a5df-45e2-aec6-2e214f08431e + id + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + c757f1c4-3282-4055-b0e1-2c818fec709b + + /idgenerators/*/ids + + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + e383a971-0335-41da-88e6-f7625303f186 + collectionobjects + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + b2c49fb3-fb34-4425-86c7-73c48873a983 + + /collectionobjects/*/authorityrefs/ + + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + 2ac4ace4-20f8-4a5f-b984-4753e5452a87 + intakes + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + 64af5fcc-a57d-4fa6-820c-4ab857a46590 + + /intakes/*/authorityrefs/ + + + + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER + + + + ROLE + + 0258eabe-02d3-494c-b405-30e3463a2feb loansin - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - f56deb15-81a5-47ad-89c7-ea4738451b8c + ae5f5fab-7205-4b92-932f-857b68c5d4b5 /loansin/*/authorityrefs/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 1628fe32-a657-4577-a6cd-87bcf942d56d + 9e8b0907-e262-42f9-a4da-6e0bf6493e5a loansout - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - d38171bb-62b2-402b-a8e9-329433f7092c + b46b29bc-1795-4e3e-a247-59e23742b705 /loansout/*/authorityrefs/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - bf39f493-8e5b-4ca1-baaf-67dd8283b299 + f90c5454-58e9-4b32-a8e4-03b80ed6f58e movements - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 30130f70-6122-478c-9425-428815c0006c + e7c31362-9bb7-48a4-a324-63e84401df30 /movements/*/authorityrefs/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 61dc8d8b-8d2e-4d0b-a76f-87d5be9a583c + 90f3a12c-0ac1-417b-942e-88f2b11383b7 vocabularies - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - cdff0a6a-ca8a-4651-a291-d7e4e9e531ba + c961fc05-1a2c-4890-88b4-42757378e323 vocabularyitems - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 2bbbbe30-9562-4686-8237-00422e24e1d6 + 4d13ef59-1443-40ee-8e45-9892c83ec9a1 /vocabularies/*/items/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 60e310d8-8d49-4ced-bdff-d1bc82d8cabd + 6caa049b-25cc-486c-935f-bf215d550bcd orgauthorities - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 0562b8c3-1883-4491-b77f-d8437c1433d6 + 08c36f8b-2432-44c4-a1dd-cba8c8ea53e5 /orgauthorities/*/items/*/authorityrefs/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 44cba976-171b-408e-b3ed-3bd5b18e95e1 + c0149cbb-a984-4e32-8302-c045a3e82bf2 organizations - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - c8e68564-bd16-462d-b191-a4fb4ad6d93a + b2e0c247-9e3b-4bf3-a956-8b98a8505263 /orgauthorities/*/items/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - faf6fdb6-654e-44a3-b7de-e98eb3105e3f + 35cb8d8b-4309-4177-9c1c-157dbeb36f5d /orgauthorities/*/items/*/refobjs - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - fc3845e7-122b-44c6-b46f-756421291994 + c890f437-7356-4bcd-b5b1-0e36b13e6358 personauthorities - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 44b6f2f5-2ae5-4f9f-aaf6-21361e38992e + 778904e1-8b67-4ace-af24-8b756385ce80 /personauthorities/*/items/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - f488f02a-0107-4991-847f-db811fa843f5 + d531417d-b61b-471c-90ff-f21969f00e4c /personauthorities/*/items/*/refobjs - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - b1236cf3-c8e3-462a-b189-e5bcebdd382e + 46581f00-1338-417d-9ff5-1250a8eb5e3c persons - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 7e329610-aa02-4d66-9a44-f7f5302c2ea4 + b707073a-6c2f-4bc5-b8b2-800be7cc17ec /personauthorities/*/items/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - abee33c0-e304-44e1-ae27-0e518e0ee55b + 88832e9b-0f62-406e-8a64-ea61d53153ed locationauthorities - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 1924cf31-7025-4f43-896e-e6d7a7352788 + 5b8c3d7d-f027-4675-9edf-1f7733ce360d /locationauthorities/*/items/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 273e7918-f911-4f54-bc86-122aa539e813 + a73bebb8-d109-4fbd-aa29-f71766eac61a locations - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 934a970c-221e-41b5-92be-6ba22276bd7a + 7d6dcff6-167f-4634-a35d-ec635e34fc60 acquisitions - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 61a10a62-4f23-4427-b262-f978a3b03806 + 2007cc99-7208-4238-9792-bceb5df78733 /acquisitions/*/authorityrefs/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 463dc11d-8324-4fb9-9d07-7c134c68eb47 + 94594f80-9ae2-4f51-b1f1-21e49bca2f5e relations - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 3c536b47-b851-4dca-bbd2-12d0fc20f713 + e75b9dd6-737a-43cd-b847-c8effa3d6055 relations/subject/*/type/*/object/* - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 87c457d9-3bf4-40d4-a3e1-7a9aae90c5c9 + da6da169-41d0-4f7f-a246-e7a9c96967de accounts - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 5762278c-fceb-4d67-908d-af389ac309ba + 8b1fc4c6-1610-490d-8972-17ac113b36d9 dimensions - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - bd9104e1-1931-4d0e-aff4-d06ec78f069f + 97455f0e-2064-4667-9bfe-540a05b571ae contacts - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - aa3c23d7-7d42-43f0-899a-3b8bc0c03c3a + 10655b0e-d168-4ac5-96fc-5ff88621aaee /personauthorities/*/items/*/contacts - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - a0f846e4-343c-4479-831e-04cc40e51902 + 1209a058-b37e-438d-906a-03bc49a4928c /orgauthorities/*/items/*/contacts - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - b975509e-d1bd-42a2-98d4-bfde50a342c3 + eb97ccdf-daaa-436e-bd40-f86e3d7dc8d0 notes - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - c9524c19-4819-4aea-aab3-341887d83b3f + 655fb068-d229-47e0-b636-48e53217d070 authorization/roles - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - eec11401-da9e-4a33-b68d-b3d4906c3329 + 556204b7-df13-40fe-8185-ac4e9924a033 authorization/permissions - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 975a8e80-8a30-426c-9d5b-aa32f6813f6d + 3d5ecccd-37a5-4185-88b3-66aa1def43b5 authorization/permissions/permroles - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 76ae1b26-9c42-4011-8130-178d90ff4c3b + 049d792a-f1c7-42de-8d88-c09a1143340f /authorization/permissions/*/permroles/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 662f9c6c-f8f1-4a78-922e-9c4250237b36 + b85355db-2c33-4469-bb27-bf4fb1ac4039 accounts/accountroles - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - e8cca9fb-a6cc-4944-a441-857d661280a9 + ce37cf6c-a550-49de-9bdf-0ede7cafb617 /accounts/*/accountroles/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - f771df0b-98c8-4f84-aaf3-ae62c113d4cb + e1af00a3-a7c9-441f-a48c-f9698f47298a authorization/roles/permroles - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER ROLE - 937a7ab0-6c26-497b-a901-49f550987320 + 8fc74578-d253-4eb7-a0e3-43bc70a88a62 /authorization/roles/*/permroles/ - 1 - ROLE_ADMINISTRATOR + 25f537c9-a213-41de-97f0-18524d5f4eb2 + ROLE_TENANT_READER diff --git a/services/authorization-mgt/import/src/main/resources/import-data/import-permissions.xml b/services/authorization-mgt/import/src/main/resources/import-data/import-permissions.xml index 7ff06ee01..29cf9465a 100644 --- a/services/authorization-mgt/import/src/main/resources/import-data/import-permissions.xml +++ b/services/authorization-mgt/import/src/main/resources/import-data/import-permissions.xml @@ -1,6 +1,7 @@ - + + generated admin permission idgenerators CREATE @@ -19,8 +20,10 @@ PERMIT 1 + 2010-06-04T14:14:37.388 - + + generated admin permission id CREATE @@ -39,8 +42,10 @@ PERMIT 1 + 2010-06-04T14:14:37.390 - + + generated admin permission /idgenerators/*/ids @@ -61,8 +66,10 @@ PERMIT 1 + 2010-06-04T14:14:37.390 - + + generated admin permission collectionobjects CREATE @@ -81,8 +88,10 @@ PERMIT 1 + 2010-06-04T14:14:37.391 - + + generated admin permission /collectionobjects/*/authorityrefs/ @@ -103,8 +112,10 @@ PERMIT 1 + 2010-06-04T14:14:37.391 - + + generated admin permission intakes CREATE @@ -123,8 +134,10 @@ PERMIT 1 + 2010-06-04T14:14:37.391 - + + generated admin permission /intakes/*/authorityrefs/ @@ -145,8 +158,10 @@ PERMIT 1 + 2010-06-04T14:14:37.392 - + + generated admin permission loansin CREATE @@ -165,8 +180,10 @@ PERMIT 1 + 2010-06-04T14:14:37.392 - + + generated admin permission /loansin/*/authorityrefs/ @@ -187,8 +204,10 @@ PERMIT 1 + 2010-06-04T14:14:37.393 - + + generated admin permission loansout CREATE @@ -207,8 +226,10 @@ PERMIT 1 + 2010-06-04T14:14:37.393 - + + generated admin permission /loansout/*/authorityrefs/ @@ -229,8 +250,10 @@ PERMIT 1 + 2010-06-04T14:14:37.393 - + + generated admin permission movements CREATE @@ -249,8 +272,10 @@ PERMIT 1 + 2010-06-04T14:14:37.394 - + + generated admin permission /movements/*/authorityrefs/ @@ -271,8 +296,10 @@ PERMIT 1 + 2010-06-04T14:14:37.394 - + + generated admin permission vocabularies CREATE @@ -291,8 +318,10 @@ PERMIT 1 + 2010-06-04T14:14:37.395 - + + generated admin permission vocabularyitems CREATE @@ -311,8 +340,10 @@ PERMIT 1 + 2010-06-04T14:14:37.395 - + + generated admin permission /vocabularies/*/items/ @@ -333,8 +364,10 @@ PERMIT 1 + 2010-06-04T14:14:37.396 - + + generated admin permission orgauthorities CREATE @@ -353,8 +386,10 @@ PERMIT 1 + 2010-06-04T14:14:37.396 - + + generated admin permission /orgauthorities/*/items/*/authorityrefs/ @@ -375,8 +410,10 @@ PERMIT 1 + 2010-06-04T14:14:37.397 - + + generated admin permission organizations CREATE @@ -395,8 +432,10 @@ PERMIT 1 + 2010-06-04T14:14:37.397 - + + generated admin permission /orgauthorities/*/items/ @@ -417,8 +456,10 @@ PERMIT 1 + 2010-06-04T14:14:37.397 - + + generated admin permission /orgauthorities/*/items/*/refobjs @@ -439,8 +480,10 @@ PERMIT 1 + 2010-06-04T14:14:37.398 - + + generated admin permission personauthorities CREATE @@ -459,8 +502,10 @@ PERMIT 1 + 2010-06-04T14:14:37.398 - + + generated admin permission /personauthorities/*/items/ @@ -481,8 +526,10 @@ PERMIT 1 + 2010-06-04T14:14:37.398 - + + generated admin permission /personauthorities/*/items/*/refobjs @@ -503,8 +550,10 @@ PERMIT 1 + 2010-06-04T14:14:37.399 - + + generated admin permission persons CREATE @@ -523,8 +572,10 @@ PERMIT 1 + 2010-06-04T14:14:37.399 - + + generated admin permission /personauthorities/*/items/ @@ -545,8 +596,10 @@ PERMIT 1 + 2010-06-04T14:14:37.400 - + + generated admin permission locationauthorities CREATE @@ -565,8 +618,10 @@ PERMIT 1 + 2010-06-04T14:14:37.400 - + + generated admin permission /locationauthorities/*/items/ @@ -587,8 +642,10 @@ PERMIT 1 + 2010-06-04T14:14:37.401 - + + generated admin permission locations CREATE @@ -607,8 +664,10 @@ PERMIT 1 + 2010-06-04T14:14:37.401 - + + generated admin permission acquisitions CREATE @@ -627,8 +686,10 @@ PERMIT 1 + 2010-06-04T14:14:37.401 - + + generated admin permission /acquisitions/*/authorityrefs/ @@ -649,8 +710,10 @@ PERMIT 1 + 2010-06-04T14:14:37.402 - + + generated admin permission relations CREATE @@ -669,8 +732,10 @@ PERMIT 1 + 2010-06-04T14:14:37.402 - + + generated admin permission relations/subject/*/type/*/object/* @@ -691,8 +756,10 @@ PERMIT 1 + 2010-06-04T14:14:37.402 - + + generated admin permission accounts CREATE @@ -711,8 +778,10 @@ PERMIT 1 + 2010-06-04T14:14:37.403 - + + generated admin permission dimensions CREATE @@ -731,8 +800,10 @@ PERMIT 1 + 2010-06-04T14:14:37.403 - + + generated admin permission contacts CREATE @@ -751,8 +822,10 @@ PERMIT 1 + 2010-06-04T14:14:37.404 - + + generated admin permission /personauthorities/*/items/*/contacts @@ -773,8 +846,10 @@ PERMIT 1 + 2010-06-04T14:14:37.404 - + + generated admin permission /orgauthorities/*/items/*/contacts @@ -795,8 +870,10 @@ PERMIT 1 + 2010-06-04T14:14:37.404 - + + generated admin permission notes CREATE @@ -815,8 +892,10 @@ PERMIT 1 + 2010-06-04T14:14:37.405 - + + generated admin permission authorization/roles CREATE @@ -835,8 +914,10 @@ PERMIT 1 + 2010-06-04T14:14:37.405 - + + generated admin permission authorization/permissions CREATE @@ -855,8 +936,10 @@ PERMIT 1 + 2010-06-04T14:14:37.405 - + + generated admin permission authorization/permissions/permroles CREATE @@ -875,8 +958,10 @@ PERMIT 1 + 2010-06-04T14:14:37.406 - + + generated admin permission /authorization/permissions/*/permroles/ @@ -897,8 +982,10 @@ PERMIT 1 + 2010-06-04T14:14:37.406 - + + generated admin permission accounts/accountroles CREATE @@ -917,8 +1004,10 @@ PERMIT 1 + 2010-06-04T14:14:37.407 - + + generated admin permission /accounts/*/accountroles/ @@ -939,8 +1028,10 @@ PERMIT 1 + 2010-06-04T14:14:37.407 - + + generated admin permission authorization/roles/permroles CREATE @@ -959,8 +1050,10 @@ PERMIT 1 + 2010-06-04T14:14:37.407 - + + generated admin permission /authorization/roles/*/permroles/ @@ -981,5 +1074,659 @@ PERMIT 1 + 2010-06-04T14:14:37.408 + + + generated readonly permission + idgenerators + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.408 + + + generated readonly permission + id + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.408 + + + generated readonly permission + + /idgenerators/*/ids + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.409 + + + generated readonly permission + collectionobjects + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.409 + + + generated readonly permission + + /collectionobjects/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.410 + + + generated readonly permission + intakes + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.410 + + + generated readonly permission + + /intakes/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.410 + + + generated readonly permission + loansin + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.411 + + + generated readonly permission + + /loansin/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.411 + + + generated readonly permission + loansout + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.411 + + + generated readonly permission + + /loansout/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.412 + + + generated readonly permission + movements + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.412 + + + generated readonly permission + + /movements/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.412 + + + generated readonly permission + vocabularies + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.413 + + + generated readonly permission + vocabularyitems + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.413 + + + generated readonly permission + + /vocabularies/*/items/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.414 + + + generated readonly permission + orgauthorities + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.414 + + + generated readonly permission + + /orgauthorities/*/items/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.414 + + + generated readonly permission + organizations + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.415 + + + generated readonly permission + + /orgauthorities/*/items/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.415 + + + generated readonly permission + + /orgauthorities/*/items/*/refobjs + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.415 + + + generated readonly permission + personauthorities + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.416 + + + generated readonly permission + + /personauthorities/*/items/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.416 + + + generated readonly permission + + /personauthorities/*/items/*/refobjs + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.417 + + + generated readonly permission + persons + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.417 + + + generated readonly permission + + /personauthorities/*/items/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.417 + + + generated readonly permission + locationauthorities + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.418 + + + generated readonly permission + + /locationauthorities/*/items/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.418 + + + generated readonly permission + locations + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.418 + + + generated readonly permission + acquisitions + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.419 + + + generated readonly permission + + /acquisitions/*/authorityrefs/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.419 + + + generated readonly permission + relations + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.419 + + + generated readonly permission + + relations/subject/*/type/*/object/* + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.420 + + + generated readonly permission + accounts + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.420 + + + generated readonly permission + dimensions + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.421 + + + generated readonly permission + contacts + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.421 + + + generated readonly permission + + /personauthorities/*/items/*/contacts + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.421 + + + generated readonly permission + + /orgauthorities/*/items/*/contacts + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.422 + + + generated readonly permission + notes + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.422 + + + generated readonly permission + authorization/roles + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.422 + + + generated readonly permission + authorization/permissions + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.423 + + + generated readonly permission + authorization/permissions/permroles + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.423 + + + generated readonly permission + + /authorization/permissions/*/permroles/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.423 + + + generated readonly permission + accounts/accountroles + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.424 + + + generated readonly permission + + /accounts/*/accountroles/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.424 + + + generated readonly permission + authorization/roles/permroles + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.424 + + + generated readonly permission + + /authorization/roles/*/permroles/ + + + READ + + + SEARCH + + PERMIT + 1 + 2010-06-04T14:14:37.424 diff --git a/services/authorization-mgt/import/src/main/resources/import-data/import-roles.xml b/services/authorization-mgt/import/src/main/resources/import-data/import-roles.xml new file mode 100644 index 000000000..6f91dec3c --- /dev/null +++ b/services/authorization-mgt/import/src/main/resources/import-data/import-roles.xml @@ -0,0 +1,15 @@ + + + + ROLE_TENANT_ADMINISTRATOR + generated tenant admin role + 1 + 2010-06-04T14:14:37.372 + + + ROLE_TENANT_READER + generated tenant read only role + 1 + 2010-06-04T14:14:37.386 + + diff --git a/services/authorization-mgt/import/src/main/resources/log4j.properties b/services/authorization-mgt/import/src/main/resources/log4j.properties index f7a8333e9..60709b206 100644 --- a/services/authorization-mgt/import/src/main/resources/log4j.properties +++ b/services/authorization-mgt/import/src/main/resources/log4j.properties @@ -21,6 +21,6 @@ log4j.logger.org.collectionspace=DEBUG log4j.logger.org.apache=INFO log4j.logger.httpclient=INFO log4j.logger.org.jboss.resteasy=INFO -log4j.logger.org.hibernate=INFO +log4j.logger.org.hibernate=WARN log4j.logger.org.hibernate.cfg=WARN log4j.logger.org.springframework=INFO diff --git a/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleDocumentHandler.java b/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleDocumentHandler.java index ae4303a80..c863d5449 100644 --- a/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleDocumentHandler.java +++ b/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleDocumentHandler.java @@ -141,21 +141,7 @@ public class PermissionRoleDocumentHandler } else { //subject mismatch should have been checked during validation } - if (subject.equals(SubjectType.ROLE)) { - //FIXME: potential index out of bounds exception...negative test needed - PermissionValue pv = pr.getPermissions().get(0); - for (RoleValue rv : pr.getRoles()) { - PermissionRoleRel prr = buildPermissonRoleRel(pv, rv); - prrl.add(prr); - } - } else if (SubjectType.PERMISSION.equals(subject)) { - //FIXME: potential index out of bounds exception...negative test needed - RoleValue rv = pr.getRoles().get(0); - for (PermissionValue pv : pr.getPermissions()) { - PermissionRoleRel prr = buildPermissonRoleRel(pv, rv); - prrl.add(prr); - } - } + PermissionRoleUtil.buildPermissionRoleRel(pr, subject, prrl); } @Override @@ -210,13 +196,4 @@ public class PermissionRoleDocumentHandler rv.setRoleName(prr.getRoleName()); return rv; } - - private PermissionRoleRel buildPermissonRoleRel(PermissionValue pv, RoleValue rv) { - PermissionRoleRel prr = new PermissionRoleRel(); - prr.setPermissionId(pv.getPermissionId()); - prr.setPermissionResource(pv.getResourceName()); - prr.setRoleId(rv.getRoleId()); - prr.setRoleName(rv.getRoleName()); - return prr; - } } diff --git a/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleUtil.java b/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleUtil.java index 77e702128..6af23e53c 100644 --- a/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleUtil.java +++ b/services/authorization-mgt/service/src/main/java/org/collectionspace/services/authorization/storage/PermissionRoleUtil.java @@ -23,7 +23,11 @@ */ package org.collectionspace.services.authorization.storage; +import java.util.List; import org.collectionspace.services.authorization.PermissionRole; +import org.collectionspace.services.authorization.PermissionRoleRel; +import org.collectionspace.services.authorization.PermissionValue; +import org.collectionspace.services.authorization.RoleValue; import org.collectionspace.services.authorization.SubjectType; import org.collectionspace.services.common.context.ServiceContext; import org.collectionspace.services.common.context.ServiceContextProperties; @@ -37,14 +41,13 @@ public class PermissionRoleUtil { static SubjectType getRelationSubject(ServiceContext ctx) { Object o = ctx.getProperty(ServiceContextProperties.SUBJECT); if (o == null) { - throw new IllegalArgumentException(ServiceContextProperties.SUBJECT + - " property is missing in context " + throw new IllegalArgumentException(ServiceContextProperties.SUBJECT + + " property is missing in context " + ctx.toString()); } return (SubjectType) o; } - static SubjectType getRelationSubject(ServiceContext ctx, PermissionRole pr) { SubjectType subject = pr.getSubject(); if (subject == null) { @@ -53,4 +56,39 @@ public class PermissionRoleUtil { } return subject; } + + /** + * buildPermissionRoleRel builds persistent relationship entities from given + * permissionrole + * @param pr permissionrole + * @param subject + * @param prrl persistent entities built are inserted into this list + */ + static public void buildPermissionRoleRel(PermissionRole pr, SubjectType subject, List prrl) { + + if (subject.equals(SubjectType.ROLE)) { + //FIXME: potential index out of bounds exception...negative test needed + PermissionValue pv = pr.getPermissions().get(0); + for (RoleValue rv : pr.getRoles()) { + PermissionRoleRel prr = buildPermissonRoleRel(pv, rv); + prrl.add(prr); + } + } else if (SubjectType.PERMISSION.equals(subject)) { + //FIXME: potential index out of bounds exception...negative test needed + RoleValue rv = pr.getRoles().get(0); + for (PermissionValue pv : pr.getPermissions()) { + PermissionRoleRel prr = buildPermissonRoleRel(pv, rv); + prrl.add(prr); + } + } + } + + static private PermissionRoleRel buildPermissonRoleRel(PermissionValue pv, RoleValue rv) { + PermissionRoleRel prr = new PermissionRoleRel(); + prr.setPermissionId(pv.getPermissionId()); + prr.setPermissionResource(pv.getResourceName()); + prr.setRoleId(rv.getRoleId()); + prr.setRoleName(rv.getRoleName()); + return prr; + } } diff --git a/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql b/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql index de65dd610..8648e1fd4 100644 --- a/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql +++ b/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql @@ -5,20 +5,15 @@ -- use cspace; -insert into `roles` (`csid`, `rolename`, `rolegroup`, `created_at`, `tenant_id`) values ('1', 'ROLE_ADMINISTRATOR', 'admin', '2010-02-17 16:31:48', '0'); -insert into `roles` (`csid`, `rolename`, `rolegroup`, `created_at`, `tenant_id`) values ('2', 'ROLE_USERS', 'collections', '2010-02-17 16:31:48', '1'); -insert into `roles` (`csid`, `rolename`, `rolegroup`, `created_at`, `tenant_id`) values ('3', 'ROLE_COLLECTIONS_MANAGER', 'collections', '2010-02-17 16:31:48', '1'); -insert into `roles` (`csid`, `rolename`, `rolegroup`, `created_at`, `tenant_id`) values ('4', 'ROLE_COLLECTIONS_REGISTRAR', 'collections', '2010-02-17 16:31:48', '1'); +insert into `roles` (`csid`, `rolename`, `rolegroup`, `created_at`, `tenant_id`) values ('1', 'ROLE_ADMINISTRATOR', 'CollectionSpace Administrator', '2010-02-17 16:31:48', '0'); +insert into `roles` (`csid`, `rolename`, `rolegroup`, `created_at`, `tenant_id`) values ('2', 'ROLE_USERS', 'a role for security testing', '2010-02-17 16:31:48', '1'); insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('eeca40d7-dc77-4cc5-b489-16a53c75525a', 'test', '1', 'ROLE_ADMINISTRATOR', '2010-02-17 16:31:48'); insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('eeca40d7-dc77-4cc5-b489-16a53c75525a', 'test', '2', 'ROLE_USERS', '2010-02-17 16:31:48'); -insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('eeca40d7-dc77-4cc5-b489-16a53c75525a', 'test', '3', 'ROLE_COLLECTIONS_MANAGER', '2010-02-17 16:31:48'); -- Additional account introduced during integration on release 0.6, and currently relied upon by the Application Layer. insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('251f98f3-0292-4f3e-aa95-455314050e1b', 'test@collectionspace.org', '1', 'ROLE_ADMINISTRATOR', '2010-05-03 12:35:00'); -insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('251f98f3-0292-4f3e-aa95-455314050e1b', 'test@collectionspace.org', '2', 'ROLE_USERS', '2010-05-03 12:35:00'); -insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('251f98f3-0292-4f3e-aa95-455314050e1b', 'test@collectionspace.org', '3', 'ROLE_COLLECTIONS_MANAGER', '2010-05-03 12:35:00'); -- todo: barney is created in security test but accountrole is not yet created there, so add fake account id insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('1', 'barney', '2', 'ROLE_USERS', '2010-02-17 16:31:48'); -insert into `accounts_roles`(`account_id`, `user_id`, `role_id`, `role_name`, `created_at`) values ('1', 'barney', '3', 'ROLE_COLLECTIONS_MANAGER', '2010-02-17 16:31:48'); +