From 34af95cf7a0330db4d234b156476cede0ef87c4b Mon Sep 17 00:00:00 2001 From: Sanjay Dalal Date: Wed, 24 Mar 2010 23:46:37 +0000 Subject: [PATCH] CSPACE-1050 merged authz prototype from sanjay's sandbox to trunk. requires the following: ant clean undeploy deploy at the trunk level may require nuking org/collectionspace, org/jvnet, com/sun packages from local maven repository before building ant create_db at the trunk level test: mvn test at the trunk level note: authorization is disabled at runtime as permissions database is not yet populated with permissions for the test user (role admin) _M trunk A + trunk/services/authentication/service/src/main/java/org/collectionspace/authentication/AuthN.java A + trunk/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/SpringSecurityContextUtils.java M trunk/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceUserDetailsService.java M trunk/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceAuthorityGranter.java M trunk/services/authentication/service/src/main/java/org/collectionspace/authentication/CSpaceTenant.java A + trunk/services/authentication/service/src/main/java/org/collectionspace/authentication/SecurityContextUtils.java _M trunk/services/authentication/service/src/main/resources/config/web-security-config.xml M trunk/services/authentication/service/pom.xml M trunk/services/authentication/jaxb/src/test/resources/META-INF/persistence.xml D trunk/services/authentication/jaxb/src/test/resources/log4j.properties M trunk/services/authentication/jaxb/src/main/resources/authentication_identity_provider.xsd M trunk/services/authentication/pom.xml M trunk/services/authentication/pstore/src/test/resources/META-INF/persistence.xml D trunk/services/authentication/pstore/src/test/resources/log4j.properties M trunk/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql M trunk/services/authentication/pstore/src/main/resources/db/mysql/test_authentication.sql M trunk/services/authentication/pstore/src/main/resources/db/mysql/authentication.sql M trunk/services/authentication/pstore/pom.xml _M trunk/services/collectionobject/service/src _M trunk/services/collectionobject/service/pom.xml _M trunk/services/collectionobject/jaxb/src/main/resources/collectionobjects_common.xsd _M trunk/services/JaxRsServiceProvider M trunk/services/JaxRsServiceProvider/nb-configuration.xml MM trunk/services/JaxRsServiceProvider/src/main/java/org/collectionspace/services/jaxrs/CollectionSpaceJaxRsApplication.java M trunk/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml A + trunk/services/JaxRsServiceProvider/src/main/resources/urls.properties M trunk/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml M trunk/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml M trunk/services/JaxRsServiceProvider/pom.xml A + trunk/services/common/lib/spring/aopalliance-1.0.jar A + trunk/services/common/lib/spring/org.springframework.transaction-3.0.0.RELEASE.jar D trunk/services/common/lib/spring/spring-security-core-3.0.1.RELEASE.jar A + trunk/services/common/lib/spring/spring-security-core-3.0.2.RELEASE.jar D trunk/services/common/lib/spring/spring-security-acl-3.0.1.RELEASE.jar A + trunk/services/common/lib/spring/spring-security-acl-3.0.2.RELEASE.jar A + trunk/services/common/lib/spring/ehcache-1.6.2.jar A + trunk/services/common/lib/spring/org.springframework.context.support-3.0.0.BUILD-20100208195804.jar D trunk/services/common/lib/spring/spring-security-config-3.0.1.RELEASE.jar A + trunk/services/common/lib/spring/spring-security-config-3.0.2.RELEASE.jar D trunk/services/common/lib/spring/spring-security-web-3.0.1.RELEASE.jar A + trunk/services/common/lib/spring/spring-security-web-3.0.2.RELEASE.jar M trunk/services/common/src/main/java/org/collectionspace/services/common/context/AbstractServiceContextImpl.java A + trunk/services/common/src/main/java/org/collectionspace/services/common/security/SecurityInterceptor.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/DocumentUtils.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/DocumentWrapper.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/AbstractDocumentHandlerImpl.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/DocumentFilter.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/DocumentNotFoundException.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/DocumentHandler.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/DocumentException.java _M trunk/services/common/src/main/java/org/collectionspace/services/common/document/BadRequestException.java M trunk/services/common/src/main/config/log/jboss-log4j-release.xml M trunk/services/common/src/main/config/log/jboss-log4j.xml _M trunk/services/common/src/main/resources/service-config.xsd M trunk/services/common/pom.xml M trunk/services/common/build.xml M trunk/services/pom.xml _M trunk/services/id _M trunk/services/id/service/src/test/java/org/collectionspace/services/id/test/StringIDGeneratorPartTest.java _M trunk/services/id/service/src/test/java/org/collectionspace/services/id/test/AlphabeticIDGeneratorPartTest.java _M trunk/services/id/service/src/test/java/org/collectionspace/services/id/test/SettableIDGeneratorTest.java _M trunk/services/id/service/src/test/java/org/collectionspace/services/id/test/YearIDGeneratorPartTest.java _M trunk/services/id/service/src/test/java/org/collectionspace/services/id/test/NumericIDGeneratorPartTest.java _M trunk/services/id/service/src/test/java/org/collectionspace/services/id/test/BaseIDGeneratorTest.java _M trunk/services/id/service/src/main/java/org/collectionspace/services/id/AlphabeticIDGeneratorPart.java _M trunk/services/id/service/src/main/java/org/collectionspace/services/id/YearIDGeneratorPart.java _M trunk/services/id/service/src/main/java/org/collectionspace/services/id/NumericIDGeneratorPart.java _M trunk/services/id/service/src/main/java/org/collectionspace/services/id/StringIDGeneratorPart.java _M trunk/services/id/service/src/main/java/org/collectionspace/services/id/IDGeneratorPart.java _M trunk/services/id/service/src/main/java/org/collectionspace/services/id/BaseIDGenerator.java M trunk/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java M trunk/services/account/service/pom.xml M trunk/services/build.xml A + trunk/services/authorization AM + trunk/services/authorization/service A + trunk/services/authorization/service/src A + trunk/services/authorization/service/src/test A + trunk/services/authorization/service/src/test/java A + trunk/services/authorization/service/src/test/java/org A + trunk/services/authorization/service/src/test/java/org/collectionspace A + trunk/services/authorization/service/src/test/java/org/collectionspace/services A + trunk/services/authorization/service/src/test/java/org/collectionspace/services/authorization A + trunk/services/authorization/service/src/test/java/org/collectionspace/services/authorization/test A + trunk/services/authorization/service/src/test/java/org/collectionspace/services/authorization/test/AuthorizationSeedTest.java A + trunk/services/authorization/service/src/test/resources A + trunk/services/authorization/service/src/test/resources/applicationContext-authorization-test.xml A + trunk/services/authorization/service/src/test/resources/test-data A + trunk/services/authorization/service/src/test/resources/test-data/test-permissions.xml A + trunk/services/authorization/service/src/test/resources/log4j.properties A + trunk/services/authorization/service/src/main A + trunk/services/authorization/service/src/main/java A + trunk/services/authorization/service/src/main/java/org A + trunk/services/authorization/service/src/main/java/org/collectionspace A + trunk/services/authorization/service/src/main/java/org/collectionspace/services A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionManager.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/CSpaceSecurityMetadataSource.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringAuthorizationProvider.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionEvaluator.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResource.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResourceImpl.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/URIResourceImpl.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionManager.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpaceAuthorizationProvider.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionEvaluator.java A + trunk/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceAction.java A + trunk/services/authorization/service/src/main/resources A + trunk/services/authorization/service/src/main/resources/applicationContext-authorization.xml A + trunk/services/authorization/service/pom.xml A + trunk/services/authorization/service/build.xml AM + trunk/services/authorization/jaxb A + trunk/services/authorization/jaxb/.classpath A + trunk/services/authorization/jaxb/.project A + trunk/services/authorization/jaxb/src A + trunk/services/authorization/jaxb/src/test A + trunk/services/authorization/jaxb/src/test/resources A + trunk/services/authorization/jaxb/src/test/resources/META-INF A + trunk/services/authorization/jaxb/src/test/resources/META-INF/persistence.xml A + trunk/services/authorization/jaxb/src/test/resources/log4j.properties A + trunk/services/authorization/jaxb/src/test/resources/hibernate.cfg.xml A + trunk/services/authorization/jaxb/src/main A + trunk/services/authorization/jaxb/src/main/resources A + trunk/services/authorization/jaxb/src/main/resources/authorization_provider.xsd A + trunk/services/authorization/jaxb/pom.xml A + trunk/services/authorization/jaxb/.settings A + trunk/services/authorization/jaxb/.settings/org.eclipse.jdt.core.prefs A + trunk/services/authorization/jaxb/.settings/org.maven.ide.eclipse.prefs A + trunk/services/authorization/pom.xml AM + trunk/services/authorization/pstore A + trunk/services/authorization/pstore/.classpath A + trunk/services/authorization/pstore/.project A + trunk/services/authorization/pstore/src A + trunk/services/authorization/pstore/src/test A + trunk/services/authorization/pstore/src/test/resources A + trunk/services/authorization/pstore/src/test/resources/META-INF A + trunk/services/authorization/pstore/src/test/resources/META-INF/persistence.xml A + trunk/services/authorization/pstore/src/test/resources/hibernate.cfg.xml A + trunk/services/authorization/pstore/src/main A + trunk/services/authorization/pstore/src/main/resources A + trunk/services/authorization/pstore/src/main/resources/db A + trunk/services/authorization/pstore/src/main/resources/db/mysql A + trunk/services/authorization/pstore/src/main/resources/db/mysql/authorization_index.sql A + trunk/services/authorization/pstore/src/main/resources/db/mysql/acl.sql A + trunk/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql A + trunk/services/authorization/pstore/src/main/resources/db/mysql/authorization.sql A + trunk/services/authorization/pstore/pom.xml A + trunk/services/authorization/pstore/build.xml A + trunk/services/authorization/build.xml M trunk/services/client/src/test/java/org/collectionspace/services/client/test/ServiceLayerTest.java _M trunk/services/client/src/main/java/org/collectionspace/services/client/test/ServiceTest.java _M trunk/services/client/src/main/java/org/collectionspace/services/client/AbstractServiceClientImpl.java _M trunk/services/client/src/main/java/org/collectionspace/services/client/CollectionSpaceClient.java _M trunk/src/site _M trunk/docs/allteam-061409-toronto _M trunk/docs/allteam-061409-toronto/Toronto_BehindTheScenes.pptx _M trunk/HelloWorld _M trunk/HelloWorld/HelloWorldJaxb/src/main/resources/hello.xsd _M trunk/HelloWorld/HelloWorldNuxeoService _M trunk/HelloWorld/HelloWorldNuxeoService/src/main/java/org/collectionspace/hello/services/HelloworldNuxeoApplication.java --- .../JaxRsServiceProvider/nb-configuration.xml | 21 +- services/JaxRsServiceProvider/pom.xml | 53 +++- .../CollectionSpaceJaxRsApplication.java | 2 + .../main/resources/META-INF/persistence.xml | 4 +- .../src/main/resources/urls.properties | 3 + .../WEB-INF/applicationContext-security.xml | 97 +++++- .../src/main/webapp/WEB-INF/web.xml | 26 -- services/account/service/pom.xml | 17 ++ .../services/account/AccountResource.java | 4 +- .../authentication_identity_provider.xsd | 107 +------ .../test/resources/META-INF/persistence.xml | 2 - services/authentication/pom.xml | 2 +- services/authentication/pstore/pom.xml | 2 +- .../resources/db/mysql/authentication.sql | 4 - .../db/mysql/authentication_index.sql | 5 +- .../db/mysql/test_authentication.sql | 7 - .../test/resources/META-INF/persistence.xml | 2 - services/authentication/service/pom.xml | 12 +- .../collectionspace/authentication/AuthN.java | 100 +++++++ .../authentication/CSpaceTenant.java | 2 +- .../authentication/SecurityContextUtils.java | 70 +++++ .../spring/CSpaceAuthorityGranter.java | 24 +- .../spring/CSpaceUserDetailsService.java | 6 +- .../spring/SpringSecurityContextUtils.java | 125 ++++++++ services/authorization/build.xml | 138 +++++++++ services/authorization/jaxb/.classpath | 11 + services/authorization/jaxb/.project | 23 ++ .../jaxb/.settings/org.eclipse.jdt.core.prefs | 5 + .../.settings/org.maven.ide.eclipse.prefs | 9 + services/authorization/jaxb/pom.xml | 97 ++++++ .../main/resources/authorization_provider.xsd | 206 +++++++++++++ .../test/resources/META-INF/persistence.xml | 18 ++ .../jaxb/src/test/resources/hibernate.cfg.xml | 24 ++ .../jaxb/src/test/resources/log4j.properties | 0 services/authorization/pom.xml | 23 ++ services/authorization/pstore/.classpath | 7 + services/authorization/pstore/.project | 23 ++ services/authorization/pstore/build.xml | 221 ++++++++++++++ services/authorization/pstore/pom.xml | 153 ++++++++++ .../src/main/resources/db/mysql/acl.sql | 106 +++++++ .../main/resources/db/mysql/authorization.sql | 4 + .../db/mysql/authorization_index.sql | 9 + .../resources/db/mysql/test_authorization.sql | 18 ++ .../test/resources/META-INF/persistence.xml | 18 ++ .../src/test/resources/hibernate.cfg.xml | 24 ++ services/authorization/service/build.xml | 132 +++++++++ services/authorization/service/pom.xml | 186 ++++++++++++ .../services/authorization/AuthZ.java | 186 ++++++++++++ .../services/authorization/CSpaceAction.java | 96 ++++++ .../authorization/CSpaceResource.java | 72 +++++ .../authorization/CSpaceResourceImpl.java | 84 ++++++ .../authorization/URIResourceImpl.java | 171 +++++++++++ .../spi/CSpaceAuthorizationProvider.java | 45 +++ .../spi/CSpacePermissionEvaluator.java | 60 ++++ .../spi/CSpacePermissionManager.java | 40 +++ .../spring/CSpaceSecurityMetadataSource.java | 127 ++++++++ .../spring/SpringAuthorizationProvider.java | 159 ++++++++++ .../spring/SpringPermissionEvaluator.java | 57 ++++ .../spring/SpringPermissionManager.java | 104 +++++++ .../applicationContext-authorization.xml | 88 ++++++ .../test/AuthorizationSeedTest.java | 205 +++++++++++++ .../applicationContext-authorization-test.xml | 92 ++++++ .../src/test/resources/log4j.properties | 2 +- .../resources/test-data/test-permissions.xml | 22 ++ services/build.xml | 8 + .../client/test/ServiceLayerTest.java | 2 +- services/common/build.xml | 10 + .../common/lib/spring/aopalliance-1.0.jar | Bin 0 -> 4467 bytes services/common/lib/spring/ehcache-1.6.2.jar | Bin 0 -> 203035 bytes ...ext.support-3.0.0.BUILD-20100208195804.jar | Bin 0 -> 101219 bytes ...ingframework.transaction-3.0.0.RELEASE.jar | Bin 0 -> 231660 bytes ... => spring-security-acl-3.0.2.RELEASE.jar} | Bin 78072 -> 78074 bytes ... spring-security-config-3.0.2.RELEASE.jar} | Bin 160234 -> 160358 bytes ...=> spring-security-core-3.0.2.RELEASE.jar} | Bin 304938 -> 305489 bytes ... => spring-security-web-3.0.2.RELEASE.jar} | Bin 229830 -> 235464 bytes services/common/pom.xml | 22 ++ .../main/config/log/jboss-log4j-release.xml | 233 ++++++++------- .../src/main/config/log/jboss-log4j.xml | 277 +++++++++--------- .../context/AbstractServiceContextImpl.java | 69 ++--- .../common/security/SecurityInterceptor.java | 102 +++++++ services/pom.xml | 11 +- 81 files changed, 3988 insertions(+), 508 deletions(-) create mode 100644 services/JaxRsServiceProvider/src/main/resources/urls.properties create mode 100644 services/authentication/service/src/main/java/org/collectionspace/authentication/AuthN.java create mode 100644 services/authentication/service/src/main/java/org/collectionspace/authentication/SecurityContextUtils.java create mode 100644 services/authentication/service/src/main/java/org/collectionspace/authentication/spring/SpringSecurityContextUtils.java create mode 100644 services/authorization/build.xml create mode 100644 services/authorization/jaxb/.classpath create mode 100644 services/authorization/jaxb/.project create mode 100644 services/authorization/jaxb/.settings/org.eclipse.jdt.core.prefs create mode 100644 services/authorization/jaxb/.settings/org.maven.ide.eclipse.prefs create mode 100644 services/authorization/jaxb/pom.xml create mode 100644 services/authorization/jaxb/src/main/resources/authorization_provider.xsd create mode 100644 services/authorization/jaxb/src/test/resources/META-INF/persistence.xml create mode 100644 services/authorization/jaxb/src/test/resources/hibernate.cfg.xml rename services/{authentication => authorization}/jaxb/src/test/resources/log4j.properties (100%) create mode 100644 services/authorization/pom.xml create mode 100644 services/authorization/pstore/.classpath create mode 100644 services/authorization/pstore/.project create mode 100644 services/authorization/pstore/build.xml create mode 100644 services/authorization/pstore/pom.xml create mode 100644 services/authorization/pstore/src/main/resources/db/mysql/acl.sql create mode 100644 services/authorization/pstore/src/main/resources/db/mysql/authorization.sql create mode 100644 services/authorization/pstore/src/main/resources/db/mysql/authorization_index.sql create mode 100644 services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql create mode 100644 services/authorization/pstore/src/test/resources/META-INF/persistence.xml create mode 100644 services/authorization/pstore/src/test/resources/hibernate.cfg.xml create mode 100644 services/authorization/service/build.xml create mode 100644 services/authorization/service/pom.xml create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceAction.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResource.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResourceImpl.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/URIResourceImpl.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpaceAuthorizationProvider.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionEvaluator.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionManager.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/CSpaceSecurityMetadataSource.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringAuthorizationProvider.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionEvaluator.java create mode 100644 services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionManager.java create mode 100644 services/authorization/service/src/main/resources/applicationContext-authorization.xml create mode 100644 services/authorization/service/src/test/java/org/collectionspace/services/authorization/test/AuthorizationSeedTest.java create mode 100644 services/authorization/service/src/test/resources/applicationContext-authorization-test.xml rename services/{authentication/pstore => authorization/service}/src/test/resources/log4j.properties (92%) create mode 100644 services/authorization/service/src/test/resources/test-data/test-permissions.xml create mode 100644 services/common/lib/spring/aopalliance-1.0.jar create mode 100644 services/common/lib/spring/ehcache-1.6.2.jar create mode 100644 services/common/lib/spring/org.springframework.context.support-3.0.0.BUILD-20100208195804.jar create mode 100644 services/common/lib/spring/org.springframework.transaction-3.0.0.RELEASE.jar rename services/common/lib/spring/{spring-security-acl-3.0.1.RELEASE.jar => spring-security-acl-3.0.2.RELEASE.jar} (80%) rename services/common/lib/spring/{spring-security-config-3.0.1.RELEASE.jar => spring-security-config-3.0.2.RELEASE.jar} (78%) rename services/common/lib/spring/{spring-security-core-3.0.1.RELEASE.jar => spring-security-core-3.0.2.RELEASE.jar} (77%) rename services/common/lib/spring/{spring-security-web-3.0.1.RELEASE.jar => spring-security-web-3.0.2.RELEASE.jar} (67%) create mode 100644 services/common/src/main/java/org/collectionspace/services/common/security/SecurityInterceptor.java diff --git a/services/JaxRsServiceProvider/nb-configuration.xml b/services/JaxRsServiceProvider/nb-configuration.xml index 3e5cd988f..bcf0a33c9 100644 --- a/services/JaxRsServiceProvider/nb-configuration.xml +++ b/services/JaxRsServiceProvider/nb-configuration.xml @@ -1,21 +1,20 @@ - - + + - +--> + - default - 8 - 80 - false - - +--> + default + 8 + 80 + + diff --git a/services/JaxRsServiceProvider/pom.xml b/services/JaxRsServiceProvider/pom.xml index 1a8e115ca..0225c15cb 100644 --- a/services/JaxRsServiceProvider/pom.xml +++ b/services/JaxRsServiceProvider/pom.xml @@ -16,7 +16,7 @@ 0.5 3.0.0.RELEASE - 3.0.1.RELEASE + 3.0.2.RELEASE @@ -28,6 +28,20 @@ org.slf4j slf4j-log4j12 + + + org.slf4j + slf4j-simple + 1.5.8 + test + + + org.slf4j + jcl-over-slf4j + 1.5.8 + test + + log4j log4j @@ -35,6 +49,12 @@ provided + + org.collectionspace.services + org.collectionspace.services.authorization.service + ${project.version} + provided + org.collectionspace.services org.collectionspace.services.common @@ -155,14 +175,14 @@ provided - org.springframework.security - spring-security-acl - ${spring.security.version} + org.springframework + spring-context + ${spring.version} provided org.springframework - spring-context + spring-context-support ${spring.version} provided @@ -172,18 +192,37 @@ ${spring.version} provided + + diff --git a/services/JaxRsServiceProvider/src/main/java/org/collectionspace/services/jaxrs/CollectionSpaceJaxRsApplication.java b/services/JaxRsServiceProvider/src/main/java/org/collectionspace/services/jaxrs/CollectionSpaceJaxRsApplication.java index 0e6aefe92..ba0591be5 100644 --- a/services/JaxRsServiceProvider/src/main/java/org/collectionspace/services/jaxrs/CollectionSpaceJaxRsApplication.java +++ b/services/JaxRsServiceProvider/src/main/java/org/collectionspace/services/jaxrs/CollectionSpaceJaxRsApplication.java @@ -41,6 +41,7 @@ import org.collectionspace.services.person.PersonAuthorityResource; import javax.ws.rs.core.Application; import java.util.HashSet; import java.util.Set; +import org.collectionspace.services.common.security.SecurityInterceptor; /** * CollectionSpaceJaxRsApplication, the root application @@ -57,6 +58,7 @@ public class CollectionSpaceJaxRsApplication extends Application { private Set> empty = new HashSet>(); public CollectionSpaceJaxRsApplication() { + singletons.add(new SecurityInterceptor()); singletons.add(new AccountResource()); singletons.add(new CollectionObjectResource()); singletons.add(new IDResource()); diff --git a/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml b/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml index 7aa4f4b04..5cc85d50d 100644 --- a/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml +++ b/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml @@ -10,8 +10,8 @@ org.collectionspace.services.account.AccountTenant org.collectionspace.services.account.Status org.collectionspace.services.authentication.User - org.collectionspace.services.authentication.Role - org.collectionspace.services.authentication.UserRole + org.collectionspace.services.authorization.Role + org.collectionspace.services.authorization.UserRole diff --git a/services/JaxRsServiceProvider/src/main/resources/urls.properties b/services/JaxRsServiceProvider/src/main/resources/urls.properties new file mode 100644 index 000000000..c2353ae6b --- /dev/null +++ b/services/JaxRsServiceProvider/src/main/resources/urls.properties @@ -0,0 +1,3 @@ +# To change this template, choose Tools | Templates +# and open the template in the editor. +/accounts/**=ROLE_ADMINISTRATOR \ No newline at end of file diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml index 71be7d13c..45d75fbd0 100644 --- a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml +++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml @@ -7,20 +7,64 @@ spring security namespace for CS service layer --> - - - - - - - - - - + http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd + http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -45,4 +89,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml index 65512963b..3ed461b9a 100644 --- a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml +++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/web.xml @@ -95,30 +95,4 @@ /* - - diff --git a/services/account/service/pom.xml b/services/account/service/pom.xml index 7fb025b62..d5d52de3c 100644 --- a/services/account/service/pom.xml +++ b/services/account/service/pom.xml @@ -12,6 +12,9 @@ services.account.service jar + + 3.0.2.RELEASE + org.slf4j @@ -32,6 +35,11 @@ org.collectionspace.services.authentication.jaxb ${project.version} + + org.collectionspace.services + org.collectionspace.services.authorization.jaxb + ${project.version} + org.collectionspace.services org.collectionspace.services.account.jaxb @@ -96,6 +104,15 @@ 1.1.GA + + + + + org.springframework.security + spring-security-core + ${spring.security.version} + provided + diff --git a/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java b/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java index 3c55b483a..801cded51 100644 --- a/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java +++ b/services/account/service/src/main/java/org/collectionspace/services/account/AccountResource.java @@ -51,6 +51,7 @@ import org.collectionspace.services.common.storage.StorageClient; import org.jboss.resteasy.util.HttpResponseCodes; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.security.access.prepost.PreAuthorize; @Path("/accounts") @Consumes("application/xml") @@ -96,6 +97,7 @@ public class AccountResource } @POST + @PreAuthorize("hasPermission('account', 'account', 'create')") public Response createAccount(AccountsCommon input) { try { ServiceContext ctx = createServiceContext(input); @@ -184,7 +186,7 @@ public class AccountResource MultivaluedMap queryParams = ui.getQueryParameters(); DocumentFilter myFilter = handler.createDocumentFilter(); myFilter.setPagination(queryParams); - myFilter.setQueryParams(queryParams); + myFilter.setQueryParams(queryParams); handler.setDocumentFilter(myFilter); getStorageClient(ctx).getFiltered(ctx, handler); accountList = (AccountsCommonList) handler.getCommonPartList(); diff --git a/services/authentication/jaxb/src/main/resources/authentication_identity_provider.xsd b/services/authentication/jaxb/src/main/resources/authentication_identity_provider.xsd index 8b668b8f7..4743a4c39 100644 --- a/services/authentication/jaxb/src/main/resources/authentication_identity_provider.xsd +++ b/services/authentication/jaxb/src/main/resources/authentication_identity_provider.xsd @@ -3,7 +3,7 @@ - username - rolename - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/services/authentication/jaxb/src/test/resources/META-INF/persistence.xml b/services/authentication/jaxb/src/test/resources/META-INF/persistence.xml index a2eeadba1..c46723c6b 100644 --- a/services/authentication/jaxb/src/test/resources/META-INF/persistence.xml +++ b/services/authentication/jaxb/src/test/resources/META-INF/persistence.xml @@ -3,8 +3,6 @@ http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:orm="http://java.sun.com/xml/ns/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> org.collectionspace.services.authentication.User - org.collectionspace.services.authentication.Role - org.collectionspace.services.authentication.UserRole diff --git a/services/authentication/pom.xml b/services/authentication/pom.xml index 8a68881dc..5937c8fb7 100644 --- a/services/authentication/pom.xml +++ b/services/authentication/pom.xml @@ -11,7 +11,7 @@ org.collectionspace.services.authentication services.authentication pom - + http://www.collectionspace.org diff --git a/services/authentication/pstore/pom.xml b/services/authentication/pstore/pom.xml index 5a3d258f2..2453e9900 100644 --- a/services/authentication/pstore/pom.xml +++ b/services/authentication/pstore/pom.xml @@ -50,7 +50,7 @@ - cspace-services-authentication-client + cspace-services-authentication-pstore maven-antrun-plugin diff --git a/services/authentication/pstore/src/main/resources/db/mysql/authentication.sql b/services/authentication/pstore/src/main/resources/db/mysql/authentication.sql index 2062f9b84..558f1f36e 100644 --- a/services/authentication/pstore/src/main/resources/db/mysql/authentication.sql +++ b/services/authentication/pstore/src/main/resources/db/mysql/authentication.sql @@ -1,6 +1,2 @@ -drop table if exists roles; drop table if exists users; -drop table if exists users_roles; -create table roles (rolename varchar(200) not null, created_at datetime not null, rolegroup varchar(255) not null, updated_at datetime, primary key (rolename)); create table users (username varchar(128) not null, created_at datetime not null, passwd varchar(128) not null, updated_at datetime, primary key (username)); -create table users_roles (HJID bigint not null auto_increment, created_at datetime not null, rolename varchar(200) not null, updated_at datetime, username varchar(128) not null, primary key (HJID), unique (username, rolename)); diff --git a/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql b/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql index 4f93e3225..be7089011 100644 --- a/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql +++ b/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql @@ -4,6 +4,5 @@ -- You may not use this file except in compliance with this License. -- use cspace; -CREATE INDEX index_rolename ON roles (rolegroup); -CREATE INDEX index_username ON users_roles (username); -CREATE INDEX index_rolename ON users_roles (rolename); + + diff --git a/services/authentication/pstore/src/main/resources/db/mysql/test_authentication.sql b/services/authentication/pstore/src/main/resources/db/mysql/test_authentication.sql index 441a0a412..1a3979bdc 100644 --- a/services/authentication/pstore/src/main/resources/db/mysql/test_authentication.sql +++ b/services/authentication/pstore/src/main/resources/db/mysql/test_authentication.sql @@ -6,10 +6,3 @@ use cspace; insert into `users` (`username`,`passwd`, `created_at`) VALUES ('test','n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=', '2010-02-17 16:31:48'); - -insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('kernel', 'kernel', '2010-02-17 16:31:48'); -insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('collections_manager', 'collections', '2010-02-17 16:31:48'); -insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('collections_registrar', 'collections', '2010-02-17 16:31:48'); - -insert into `users_roles`(`username`, `rolename`, `created_at`) values ('test', 'collections_manager', '2010-02-17 16:31:48'); -insert into `users_roles`(`username`, `rolename`, `created_at`) values('admin', 'collections_registrar', '2010-02-17 16:31:48'); \ No newline at end of file diff --git a/services/authentication/pstore/src/test/resources/META-INF/persistence.xml b/services/authentication/pstore/src/test/resources/META-INF/persistence.xml index 97d00a01d..05b2b43df 100644 --- a/services/authentication/pstore/src/test/resources/META-INF/persistence.xml +++ b/services/authentication/pstore/src/test/resources/META-INF/persistence.xml @@ -3,8 +3,6 @@ http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:orm="http://java.sun.com/xml/ns/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> org.collectionspace.services.authentication.User - org.collectionspace.services.authentication.Role - org.collectionspace.services.authentication.UserRole diff --git a/services/authentication/service/pom.xml b/services/authentication/service/pom.xml index 3b376aeb6..6893b7069 100644 --- a/services/authentication/service/pom.xml +++ b/services/authentication/service/pom.xml @@ -16,11 +16,12 @@ - 3.0.1.RELEASE + 3.0.2.RELEASE - + + org.slf4j slf4j-api @@ -36,6 +37,13 @@ commons-logging 1.1.1 + + log4j + log4j + 1.2.14 + provided + + junit junit diff --git a/services/authentication/service/src/main/java/org/collectionspace/authentication/AuthN.java b/services/authentication/service/src/main/java/org/collectionspace/authentication/AuthN.java new file mode 100644 index 000000000..e259e2f02 --- /dev/null +++ b/services/authentication/service/src/main/java/org/collectionspace/authentication/AuthN.java @@ -0,0 +1,100 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ + +package org.collectionspace.authentication; + +import org.collectionspace.authentication.spring.SpringSecurityContextUtils; + +/** + * AuthN is a singleton to access various authentication related utilities + * accessed by services runtime + * @author + */ +public class AuthN { + /** + * volatile is used here to assume about ordering (post JDK 1.5) + */ + private static volatile AuthN self = new AuthN(); + private SecurityContextUtils securityContextUtils; + + private AuthN() { + //hardcoded initialization of a provider + //FIXME initialize with the help of configuration meta data + securityContextUtils = new SpringSecurityContextUtils(); + } + + public final static AuthN get() { + return self; + } + + /** + * getAuthn returns authentication utilities + * @return + */ + public SecurityContextUtils getSecurityContextUtils() { + return securityContextUtils; + } + + /** + * getUserId returns authenticated user's id (principal name) + * @return + */ + public String getUserId() { + return securityContextUtils.getUserId(); + } + /** + * getTenantIds returns a list of tenant ids the user is associated with + * @return + */ + public String[] getTenantIds() { + return securityContextUtils.getTenantIds(); + } + +} diff --git a/services/authentication/service/src/main/java/org/collectionspace/authentication/CSpaceTenant.java b/services/authentication/service/src/main/java/org/collectionspace/authentication/CSpaceTenant.java index 5b4565e1f..656c61500 100644 --- a/services/authentication/service/src/main/java/org/collectionspace/authentication/CSpaceTenant.java +++ b/services/authentication/service/src/main/java/org/collectionspace/authentication/CSpaceTenant.java @@ -42,7 +42,7 @@ public class CSpaceTenant implements Group, Cloneable { private static final long serialVersionUID = 1L; private String name; private String id; - private HashMap members = new HashMap(3); + private HashMap members = new HashMap(); public CSpaceTenant(String name, String id) { if(name == null || id == null) { diff --git a/services/authentication/service/src/main/java/org/collectionspace/authentication/SecurityContextUtils.java b/services/authentication/service/src/main/java/org/collectionspace/authentication/SecurityContextUtils.java new file mode 100644 index 000000000..720fe926c --- /dev/null +++ b/services/authentication/service/src/main/java/org/collectionspace/authentication/SecurityContextUtils.java @@ -0,0 +1,70 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ + +package org.collectionspace.authentication; + +/** + * Utilities to be used by Services runtime to interface with authentication service + * @author + */ +public abstract class SecurityContextUtils { + + /** + * getUserId returns authenticated user id + * @return + */ + public abstract String getUserId(); + + /** + * get tenant ids associated with the security context + * @return + */ + public abstract String[] getTenantIds(); +} diff --git a/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceAuthorityGranter.java b/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceAuthorityGranter.java index b228d1074..66355bf78 100644 --- a/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceAuthorityGranter.java +++ b/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceAuthorityGranter.java @@ -47,23 +47,33 @@ * To change this template, choose Tools | Templates * and open the template in the editor. */ - package org.collectionspace.authentication.spring; + import java.security.Principal; +import java.security.acl.Group; +import java.util.Enumeration; import java.util.HashSet; import java.util.Set; import org.springframework.security.authentication.jaas.AuthorityGranter; /** - * + * CSpaceAuthorityGranter maps a given prinicpal to role names * @author */ public class CSpaceAuthorityGranter implements AuthorityGranter { - - public Set grant(Principal principal) { - Set rtnSet = new HashSet(); - - return rtnSet; + public Set grant(Principal principal) { + Set authorities = new HashSet(); + if (principal instanceof Group) { + Group g = (Group) principal; + Enumeration members = g.members(); + while (members.hasMoreElements()) { + Principal p = (Principal) members.nextElement(); + authorities.add(p.getName()); + } + } else { + authorities.add(principal.getName()); + } + return authorities; } } diff --git a/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceUserDetailsService.java b/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceUserDetailsService.java index 92bf5c4ad..469aed77f 100644 --- a/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceUserDetailsService.java +++ b/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/CSpaceUserDetailsService.java @@ -63,6 +63,7 @@ import org.springframework.security.core.userdetails.UsernameNotFoundException; /** * A CollectionSpace UserDetailsService for spring + * mockup code to cheat spring config reader...not used by Spring JaasAuthenticationProvider */ //FIXME remove test/mockup code public class CSpaceUserDetailsService implements UserDetailsService { @@ -72,11 +73,6 @@ public class CSpaceUserDetailsService implements UserDetailsService { public CSpaceUserDetailsService() { users.put("test", new User("test", "", true, true, true, true, auths)); - users.put("valid", new User("valid", "", true, true, true, true, auths)); - users.put("locked", new User("locked", "", true, true, true, false, auths)); - users.put("disabled", new User("disabled", "", false, true, true, true, auths)); - users.put("credentialsExpired", new User("credentialsExpired", "", true, true, false, true, auths)); - users.put("expired", new User("expired", "", true, false, true, true, auths)); } public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException { diff --git a/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/SpringSecurityContextUtils.java b/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/SpringSecurityContextUtils.java new file mode 100644 index 000000000..a95878891 --- /dev/null +++ b/services/authentication/service/src/main/java/org/collectionspace/authentication/spring/SpringSecurityContextUtils.java @@ -0,0 +1,125 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.authentication.spring; + +import java.security.acl.Group; +import java.util.ArrayList; +import java.util.Enumeration; +import java.util.Set; +import javax.security.auth.Subject; +import org.collectionspace.authentication.SecurityContextUtils; +import org.collectionspace.authentication.CSpaceTenant; +import org.springframework.security.authentication.jaas.JaasAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; + +/** + * SpringSecurityContextUtils provides utilities to CSpace services runtime + * @author + */ +final public class SpringSecurityContextUtils extends SecurityContextUtils { + //private static final String SUBJECT_CONTEXT_KEY = "javax.security.auth.Subject.container"; + + public String getUserId() { + Authentication authToken = SecurityContextHolder.getContext().getAuthentication(); + return authToken.getName(); + } + + /** + * retrieve tenant ids from Jaas LoginContext + * @return + */ + @Override + public String[] getTenantIds() { + + ArrayList tenants = new ArrayList(); + Subject caller = null; + Authentication authToken = SecurityContextHolder.getContext().getAuthentication(); + JaasAuthenticationToken jaasToken = null; + if (authToken instanceof JaasAuthenticationToken) { + jaasToken = (JaasAuthenticationToken) authToken; + caller = (Subject) jaasToken.getLoginContext().getSubject(); + } + //caller = (Subject) PolicyContext.getContext(SUBJECT_CONTEXT_KEY); + if (caller == null) { + String msg = "security not enabled!"; + //TODO: find out why subject is not null + //FIXME: if logger is loaded when authn comes up, use it + //logger.warn(msg); + System.err.println(msg); + return tenants.toArray(new String[0]); + } + Set groups = null; + groups = caller.getPrincipals(Group.class); + if (groups != null && groups.size() == 0) { + String msg = "no role(s)/tenant(s) found!"; + //TODO: find out why no roles / tenants found + //FIXME: if logger is loaded when authn comes up, use it + //logger.warn(msg); + System.err.println(msg); + return tenants.toArray(new String[0]); + } + for (Group g : groups) { + if ("Tenants".equals(g.getName())) { + Enumeration members = g.members(); + while (members.hasMoreElements()) { + CSpaceTenant tenant = (CSpaceTenant) members.nextElement(); + tenants.add(tenant.getId()); + //FIXME: if logger is loaded when authn comes up, use it +// if (logger.isDebugEnabled()) { +// logger.debug("found tenant id=" + tenant.getId() +// + " name=" + tenant.getName()); +// } + } + } + } + return tenants.toArray(new String[0]); + } +} diff --git a/services/authorization/build.xml b/services/authorization/build.xml new file mode 100644 index 000000000..add2af1df --- /dev/null +++ b/services/authorization/build.xml @@ -0,0 +1,138 @@ + + + + authorization service + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/services/authorization/jaxb/.classpath b/services/authorization/jaxb/.classpath new file mode 100644 index 000000000..1707f3e6f --- /dev/null +++ b/services/authorization/jaxb/.classpath @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/services/authorization/jaxb/.project b/services/authorization/jaxb/.project new file mode 100644 index 000000000..677b488f8 --- /dev/null +++ b/services/authorization/jaxb/.project @@ -0,0 +1,23 @@ + + + org.collectionspace.services.authorization.jaxb + + + + + + org.eclipse.jdt.core.javabuilder + + + + + org.maven.ide.eclipse.maven2Builder + + + + + + org.eclipse.jdt.core.javanature + org.maven.ide.eclipse.maven2Nature + + diff --git a/services/authorization/jaxb/.settings/org.eclipse.jdt.core.prefs b/services/authorization/jaxb/.settings/org.eclipse.jdt.core.prefs new file mode 100644 index 000000000..034764ae2 --- /dev/null +++ b/services/authorization/jaxb/.settings/org.eclipse.jdt.core.prefs @@ -0,0 +1,5 @@ +#Mon Nov 23 11:54:01 PST 2009 +eclipse.preferences.version=1 +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6 +org.eclipse.jdt.core.compiler.compliance=1.6 +org.eclipse.jdt.core.compiler.source=1.6 diff --git a/services/authorization/jaxb/.settings/org.maven.ide.eclipse.prefs b/services/authorization/jaxb/.settings/org.maven.ide.eclipse.prefs new file mode 100644 index 000000000..10222cb7b --- /dev/null +++ b/services/authorization/jaxb/.settings/org.maven.ide.eclipse.prefs @@ -0,0 +1,9 @@ +#Mon Nov 23 11:53:49 PST 2009 +activeProfiles= +eclipse.preferences.version=1 +fullBuildGoals=process-test-resources +includeModules=false +resolveWorkspaceProjects=true +resourceFilterGoals=process-resources resources\:testResources +skipCompilerPlugin=true +version=1 diff --git a/services/authorization/jaxb/pom.xml b/services/authorization/jaxb/pom.xml new file mode 100644 index 000000000..b02da048c --- /dev/null +++ b/services/authorization/jaxb/pom.xml @@ -0,0 +1,97 @@ + + + + + org.collectionspace.services.authorization + org.collectionspace.services + 0.6-SNAPSHOT + + + 4.0.0 + org.collectionspace.services + org.collectionspace.services.authorization.jaxb + services.authorization.jaxb + + + + + + org.slf4j + slf4j-api + test + + + org.slf4j + slf4j-log4j12 + test + + + com.sun.xml.bind + jaxb-impl + + + org.jvnet.jaxb2-commons + property-listener-injector + + + org.jvnet.jaxb2_commons + runtime + + + + mysql + mysql-connector-java + + + + javax.persistence + persistence-api + + + org.hibernate + hibernate-entitymanager + + + org.jvnet.hyperjaxb3 + hyperjaxb3-ejb-runtime + + + org.testng + testng + 5.6 + + + + + collectionspace-services-authorization-jaxb + install + + + + org.jvnet.hyperjaxb3 + maven-hyperjaxb3-plugin + + + + generate + + + + + true + true + false + + + + maven-compiler-plugin + + 1.6 + 1.6 + + + + + + + diff --git a/services/authorization/jaxb/src/main/resources/authorization_provider.xsd b/services/authorization/jaxb/src/main/resources/authorization_provider.xsd new file mode 100644 index 000000000..8a9b1d643 --- /dev/null +++ b/services/authorization/jaxb/src/main/resources/authorization_provider.xsd @@ -0,0 +1,206 @@ + + + + + + + + + + + + Role definition in CollectionSpace + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + UserRole defines association between user and role in CollectionSpace + + + + + + username + rolename + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + permission configuration list + + + + + + + + + + CspacePermissionConfig describes permission in CollectionSpace + + + + + + + + resourceName could be a servicename or a servicename#attribute + + + + + + + + + + + + + + Action describes the actions that coudl be taken + + + + + + + + + + + + + + + + + EffectType describes the effect of access control + + + + + + + + + diff --git a/services/authorization/jaxb/src/test/resources/META-INF/persistence.xml b/services/authorization/jaxb/src/test/resources/META-INF/persistence.xml new file mode 100644 index 000000000..a922bf945 --- /dev/null +++ b/services/authorization/jaxb/src/test/resources/META-INF/persistence.xml @@ -0,0 +1,18 @@ + + + + org.collectionspace.services.authorization.Role + org.collectionspace.services.authorization.UserRole + + + + + + + diff --git a/services/authorization/jaxb/src/test/resources/hibernate.cfg.xml b/services/authorization/jaxb/src/test/resources/hibernate.cfg.xml new file mode 100644 index 000000000..c7c600995 --- /dev/null +++ b/services/authorization/jaxb/src/test/resources/hibernate.cfg.xml @@ -0,0 +1,24 @@ + + + + + + + jdbc:mysql://localhost:3306/cspace + com.mysql.jdbc.Driver + test + test + org.hibernate.dialect.MySQLDialect + org.hibernate.transaction.JDBCTransactionFactory + thread + true + + diff --git a/services/authentication/jaxb/src/test/resources/log4j.properties b/services/authorization/jaxb/src/test/resources/log4j.properties similarity index 100% rename from services/authentication/jaxb/src/test/resources/log4j.properties rename to services/authorization/jaxb/src/test/resources/log4j.properties diff --git a/services/authorization/pom.xml b/services/authorization/pom.xml new file mode 100644 index 000000000..c0dbf2059 --- /dev/null +++ b/services/authorization/pom.xml @@ -0,0 +1,23 @@ + + + 4.0.0 + + org.collectionspace.services.main + org.collectionspace.services + 0.6-SNAPSHOT + + org.collectionspace.services + org.collectionspace.services.authorization + services.authorization + pom + http://www.collectionspace.org + + + + + + jaxb + pstore + service + + diff --git a/services/authorization/pstore/.classpath b/services/authorization/pstore/.classpath new file mode 100644 index 000000000..c9485d73a --- /dev/null +++ b/services/authorization/pstore/.classpath @@ -0,0 +1,7 @@ + + + + + + + diff --git a/services/authorization/pstore/.project b/services/authorization/pstore/.project new file mode 100644 index 000000000..6f4ff8683 --- /dev/null +++ b/services/authorization/pstore/.project @@ -0,0 +1,23 @@ + + + org.collectionspace.services.authorization.pstore + + + + + + org.eclipse.jdt.core.javabuilder + + + + + org.maven.ide.eclipse.maven2Builder + + + + + + org.eclipse.jdt.core.javanature + org.maven.ide.eclipse.maven2Nature + + diff --git a/services/authorization/pstore/build.xml b/services/authorization/pstore/build.xml new file mode 100644 index 000000000..be9641b7a --- /dev/null +++ b/services/authorization/pstore/build.xml @@ -0,0 +1,221 @@ + + + + collectionspace authorization service + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/services/authorization/pstore/pom.xml b/services/authorization/pstore/pom.xml new file mode 100644 index 000000000..195998cfb --- /dev/null +++ b/services/authorization/pstore/pom.xml @@ -0,0 +1,153 @@ + + + + + org.collectionspace.services.authorization + org.collectionspace.services + 0.6-SNAPSHOT + + + 4.0.0 + org.collectionspace.services + org.collectionspace.services.authorization.pstore + services.authorization.pstore + + authorization.sql + ${basedir}/src/main/resources/db/mysql + + + + + org.slf4j + slf4j-api + test + + + org.slf4j + slf4j-log4j12 + test + + + org.collectionspace.services + org.collectionspace.services.authorization.jaxb + ${project.version} + + + org.testng + testng + 5.6 + + + mysql + mysql-connector-java + + + + + cspace-services-authorization-pstore + + + maven-antrun-plugin + + + subs-hibernate-config + generate-test-resources + + run + + + + + + + + + + + + org.apache.maven.plugins + maven-surefire-plugin + + + + log4j.configuration + file:target/test-classes/log4j.properties + + + + + + maven-compiler-plugin + 2.0.2 + + 1.6 + 1.6 + + + + + + + + ddl + + + + org.codehaus.mojo + hibernate3-maven-plugin + 2.2 + + + process-test-resources + + hbm2ddl + + + + + + + hbm2ddl + + + + ${sql.file} + jpaconfiguration + true + true + true + true + false + org.collectionspace.services.authorization + + + + + mysql + mysql-connector-java + 5.1.5 + + + + + maven-antrun-plugin + + + process-test-resources + + + + + + + run + + + + + + + + + + diff --git a/services/authorization/pstore/src/main/resources/db/mysql/acl.sql b/services/authorization/pstore/src/main/resources/db/mysql/acl.sql new file mode 100644 index 000000000..a3a07cd16 --- /dev/null +++ b/services/authorization/pstore/src/main/resources/db/mysql/acl.sql @@ -0,0 +1,106 @@ +-- +-- Copyright 2010 University of California at Berkeley +-- Licensed under the Educational Community License (ECL), Version 2.0. +-- You may not use this file except in compliance with this License. +-- + +use cspace; +drop table if exists `acl_entry`; +drop table if exists `acl_object_identity`; +drop table if exists `acl_sid`; +drop table if exists `acl_class`; + +-- +-- Table structure for table `acl_class` +-- + +CREATE TABLE IF NOT EXISTS `acl_class` ( + `id` bigint(20) NOT NULL auto_increment, + `class` varchar(100) NOT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `unique_uk_2` (`class`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ; + +-- +-- Dumping data for table `acl_class` +-- + + +-- +-- Table structure for table `acl_sid` +-- + +CREATE TABLE IF NOT EXISTS `acl_sid` ( + `id` bigint(20) NOT NULL auto_increment, + `principal` tinyint(1) NOT NULL, + `sid` varchar(100) NOT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `unique_uk_1` (`principal`,`sid`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8; + +-- +-- Dumping data for table `acl_sid` +-- + +-- +-- Table structure for table `acl_entry` +-- + +CREATE TABLE IF NOT EXISTS `acl_entry` ( + `id` bigint(20) NOT NULL auto_increment, + `acl_object_identity` bigint(20) NOT NULL, + `ace_order` int(11) NOT NULL, + `sid` bigint(20) NOT NULL, + `mask` int(11) NOT NULL, + `granting` tinyint(1) NOT NULL, + `audit_success` tinyint(1) NOT NULL, + `audit_failure` tinyint(1) NOT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `unique_uk_4` (`acl_object_identity`,`ace_order`), + KEY `sid` (`sid`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ; + + + +-- +-- Dumping data for table `acl_entry` +-- + + +-- +-- Table structure for table `acl_object_identity` +-- + +CREATE TABLE IF NOT EXISTS `acl_object_identity` ( + `id` bigint(20) NOT NULL auto_increment, + `object_id_class` bigint(20) NOT NULL, + `object_id_identity` bigint(20) NOT NULL, + `parent_object` bigint(20) default NULL, + `owner_sid` bigint(20) default NULL, + `entries_inheriting` tinyint(1) NOT NULL, + PRIMARY KEY (`id`), + UNIQUE KEY `unique_uk_3` (`object_id_class`,`object_id_identity`), + KEY `owner_sid` (`owner_sid`), + KEY `parent_object` (`parent_object`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ; + + +-- +-- Dumping data for table `acl_object_identity` +-- + +-- +-- Constraints for table `acl_entry` +-- +ALTER TABLE `acl_entry` + ADD CONSTRAINT `acl_entry_ibfk_1` FOREIGN KEY (`sid`) REFERENCES `acl_sid` (`id`), + ADD CONSTRAINT `acl_entry_ibfk_2` FOREIGN KEY (`acl_object_identity`) REFERENCES `acl_object_identity` (`id`); + + +-- +-- Constraints for table `acl_object_identity` +-- +ALTER TABLE `acl_object_identity` + ADD CONSTRAINT `acl_object_identity_ibfk_1` FOREIGN KEY (`owner_sid`) REFERENCES `acl_sid` (`id`), + ADD CONSTRAINT `acl_object_identity_ibfk_2` FOREIGN KEY (`object_id_class`) REFERENCES `acl_class` (`id`), + ADD CONSTRAINT `acl_object_identity_ibfk_3` FOREIGN KEY (`parent_object`) REFERENCES `acl_object_identity` (`id`); diff --git a/services/authorization/pstore/src/main/resources/db/mysql/authorization.sql b/services/authorization/pstore/src/main/resources/db/mysql/authorization.sql new file mode 100644 index 000000000..3a5b1e58c --- /dev/null +++ b/services/authorization/pstore/src/main/resources/db/mysql/authorization.sql @@ -0,0 +1,4 @@ +drop table if exists roles; +drop table if exists users_roles; +create table roles (rolename varchar(200) not null, created_at datetime not null, rolegroup varchar(255) not null, updated_at datetime, primary key (rolename)); +create table users_roles (HJID bigint not null auto_increment, created_at datetime not null, rolename varchar(200) not null, updated_at datetime, username varchar(128) not null, primary key (HJID), unique (username, rolename)); diff --git a/services/authorization/pstore/src/main/resources/db/mysql/authorization_index.sql b/services/authorization/pstore/src/main/resources/db/mysql/authorization_index.sql new file mode 100644 index 000000000..4f93e3225 --- /dev/null +++ b/services/authorization/pstore/src/main/resources/db/mysql/authorization_index.sql @@ -0,0 +1,9 @@ +-- +-- Copyright 20010 University of California at Berkeley +-- Licensed under the Educational Community License (ECL), Version 2.0. +-- You may not use this file except in compliance with this License. +-- +use cspace; +CREATE INDEX index_rolename ON roles (rolegroup); +CREATE INDEX index_username ON users_roles (username); +CREATE INDEX index_rolename ON users_roles (rolename); diff --git a/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql b/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql new file mode 100644 index 000000000..dfd0524a4 --- /dev/null +++ b/services/authorization/pstore/src/main/resources/db/mysql/test_authorization.sql @@ -0,0 +1,18 @@ +-- +-- Copyright 2009 University of California at Berkeley +-- Licensed under the Educational Community License (ECL), Version 2.0. +-- You may not use this file except in compliance with this License. +-- +use cspace; + +insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('ROLE_KERNEL', 'kernel', '2010-02-17 16:31:48'); +insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('ROLE_USERS', 'collections', '2010-02-17 16:31:48'); +insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('ROLE_COLLECTIONS_MANAGER', 'collections', '2010-02-17 16:31:48'); +insert into `roles` (`rolename`, `rolegroup`, `created_at`) values ('ROLE_COLLECTIONS_REGISTRAR', 'collections', '2010-02-17 16:31:48'); + +insert into `users_roles`(`username`, `rolename`, `created_at`) values ('test', 'ROLE_ADMINISTRATOR', '2010-02-17 16:31:48'); +insert into `users_roles`(`username`, `rolename`, `created_at`) values ('test', 'ROLE_USERS', '2010-02-17 16:31:48'); +insert into `users_roles`(`username`, `rolename`, `created_at`) values ('test', 'ROLE_COLLECTIONS_MANAGER', '2010-02-17 16:31:48'); + +insert into `users_roles`(`username`, `rolename`, `created_at`) values ('barney', 'ROLE_USERS', '2010-02-17 16:31:48'); +insert into `users_roles`(`username`, `rolename`, `created_at`) values ('barney', 'ROLE_COLLECTIONS_MANAGER', '2010-02-17 16:31:48'); diff --git a/services/authorization/pstore/src/test/resources/META-INF/persistence.xml b/services/authorization/pstore/src/test/resources/META-INF/persistence.xml new file mode 100644 index 000000000..403959633 --- /dev/null +++ b/services/authorization/pstore/src/test/resources/META-INF/persistence.xml @@ -0,0 +1,18 @@ + + + + org.collectionspace.services.authorization.Role + org.collectionspace.services.authorization.UserRole + + + + + + + diff --git a/services/authorization/pstore/src/test/resources/hibernate.cfg.xml b/services/authorization/pstore/src/test/resources/hibernate.cfg.xml new file mode 100644 index 000000000..8296399cf --- /dev/null +++ b/services/authorization/pstore/src/test/resources/hibernate.cfg.xml @@ -0,0 +1,24 @@ + + + + + + + @DB_URL@ + @DB_DRIVER_CLASS@ + @DB_USER@ + @DB_PASSWORD@ + @DB_DIALECT@ + org.hibernate.transaction.JDBCTransactionFactory + thread + true + + diff --git a/services/authorization/service/build.xml b/services/authorization/service/build.xml new file mode 100644 index 000000000..834a97ffd --- /dev/null +++ b/services/authorization/service/build.xml @@ -0,0 +1,132 @@ + + + + collectionspace authorization service + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/services/authorization/service/pom.xml b/services/authorization/service/pom.xml new file mode 100644 index 000000000..e1a895797 --- /dev/null +++ b/services/authorization/service/pom.xml @@ -0,0 +1,186 @@ + + + 4.0.0 + + org.collectionspace.services.authorization + org.collectionspace.services + 0.6-SNAPSHOT + + org.collectionspace.services + org.collectionspace.services.authorization.service + jar + services.authorization.service + http://www.collectionspace.org + + + 4.2.3.GA + 3.0 + UTF-8 + 3.0.0.RELEASE + 3.0.2.RELEASE + + + + + + + + + commons-logging + commons-logging + 1.1.1 + + + log4j + log4j + 1.2.14 + provided + + + + + org.slf4j + slf4j-api + test + + + org.slf4j + slf4j-log4j12 + test + + + junit + junit + 4.1 + test + + + org.testng + testng + 5.6 + test + + + + javax.security + jaas + 1.0.01 + provided + + + + + org.jboss.logging + jboss-logging-log4j + 2.1.0.GA + + + jboss + jbosssx + 4.2.3.GA + + + + org.springframework.security + spring-security-core + ${spring.security.version} + provided + + + org.springframework.security + spring-security-config + ${spring.security.version} + provided + + + org.springframework.security + spring-security-acl + ${spring.security.version} + provided + + + org.springframework.security + spring-security-web + ${spring.security.version} + provided + + + org.springframework + spring-context + ${spring.version} + provided + + + org.springframework + spring-context-support + ${spring.version} + provided + + + org.springframework + spring-aop + ${spring.version} + provided + + + aopalliance + aopalliance + 1.0 + provided + + + + net.sf.ehcache + ehcache + 1.6.2 + true + + + mysql + mysql-connector-java + test + + + + org.collectionspace.services + org.collectionspace.services.authorization.jaxb + ${project.version} + + + + + + cspace-services-authz + + + org.apache.maven.plugins + maven-surefire-plugin + + + + log4j.configuration + file:target/test-classes/log4j.properties + + + spring-beans-config + applicationContext-authorization-test.xml + + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 1.6 + 1.6 + + + + + diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java new file mode 100644 index 000000000..ebea99fa9 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java @@ -0,0 +1,186 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization; + +import java.util.List; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.collectionspace.services.authorization.spi.CSpaceAuthorizationProvider; +import org.springframework.context.support.ClassPathXmlApplicationContext; + +/** + * AuthZ is the authorization service singleton used by the services runtime + * @author + */ +public class AuthZ { + + /** + * volatile is used here to assume about ordering (post JDK 1.5) + */ + private static volatile AuthZ self = new AuthZ(); + private CSpaceAuthorizationProvider provider; + final Log log = LogFactory.getLog(AuthZ.class); + + private AuthZ() { + setupProvider(); + } + + /** + * + * @return + */ + public final static AuthZ get() { + return self; + } + + private void setupProvider() { + String beanConfig = "applicationContext-authorization.xml"; + //system property is only set in test environment + String beanConfigProp = System.getProperty("spring-beans-config"); + if (beanConfigProp != null && !beanConfigProp.isEmpty()) { + beanConfig = beanConfigProp; + } + if (log.isDebugEnabled()) { + log.debug("reading beanConfig=" + beanConfig); + } + ClassPathXmlApplicationContext appContext = new ClassPathXmlApplicationContext( + new String[]{beanConfig}); + provider = (CSpaceAuthorizationProvider) appContext.getBean("cspaceAuthorizationProvider"); + if (log.isDebugEnabled()) { + log.debug("initialized the authz provider"); + } + } + + /** + * addPermissions add permissions from given permission configuration + * @param permission configuration + */ + public void addPermissions(PermissionConfig pConfig) { + List principals = pConfig.getRole(); + List users = pConfig.getUser(); + principals.addAll(users); + List actions = pConfig.getAction(); + for (ActionType action : actions) { + URIResourceImpl uriRes = new URIResourceImpl(pConfig.getResourceName(), + action); + addPermission(uriRes, principals.toArray(new String[0])); + } + } + + /** + * addPermission for given principals to access given resource + * -permission is retrieved from the resource + * @param res + * @param principals + */ + public void addPermission(CSpaceResource res, String[] principals) { + CSpaceAction action = res.getAction(); + addPermission(res, principals, action); + } + + /** + * addPermission add given permission for given principals to access given resource + * @param res + * @param principals + * @param perm + */ + public void addPermission(CSpaceResource res, String[] principals, CSpaceAction action) { + provider.getPermissionManager().addPermission(res, principals, action); + if (log.isDebugEnabled()) { + log.debug("added permission resource=" + res.getId() + " action=" + action.name()); + } + } + + /** + * deletePermission for given principals for given resource + * permission is retrieve from the resource + * @param res + * @param principals + */ + public void deletePermission(CSpaceResource res, String[] principals) { + CSpaceAction action = res.getAction(); + deletePermission(res, principals, action); + } + + /** + * deletePermission given permission for given principals for given resource + * @param res + * @param principals + * @param perm + */ + public void deletePermission(CSpaceResource res, String[] principals, CSpaceAction action) { + provider.getPermissionManager().deletePermission(res, principals, action); + if (log.isDebugEnabled()) { + log.debug("removed permission resource=" + res.getId() + " action=" + action.name()); + } + } + + /** + * isAccessAllowed check if authenticated principal is allowed to access + * given resource, permission is retrieved from the resource + * @param res + * @return + */ + public boolean isAccessAllowed(CSpaceResource res) { + CSpaceAction action = res.getAction(); + return isAccessAllowed(res, action); + } + + /** + * isAccessAllowed check if authenticated principal is allowed to access + * given resource per given permission + * @param res + * @param perm + * @return + */ + public boolean isAccessAllowed(CSpaceResource res, CSpaceAction action) { + return provider.getPermissionEvaluator().hasPermission(res, action); + } +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceAction.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceAction.java new file mode 100644 index 000000000..5e800c48c --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceAction.java @@ -0,0 +1,96 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization; + +/** + * CollectionSpace permission for a resource. A resource could be an entity, a + * procedure/activity, an attribute or an action + * @author + */ +public enum CSpaceAction { + + /** + * permission to create a collectionspace resource + */ + CREATE, + /** + * permission to retrieve a collectionspace resource + */ + READ, + /** + * permission to update a collectionspace resource + */ + UPDATE, + /** + * to delete a collectionspace resource + */ + DELETE, + /** + * permission to search a collectionspace service resource + */ + SEARCH, + /** + * permission to execute/run a collectionspace service resource + */ + RUN, + /** + * permission to start a collectionspace service activity/procedure + */ + START, + /** + * permission to stop a collectionspace service activity/procedure + */ + STOP, + /** + * permission to administer any collectionspace service resource, involves + * all the permissions described above + */ + ADMIN +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResource.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResource.java new file mode 100644 index 000000000..ab06c7cd8 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResource.java @@ -0,0 +1,72 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + +package org.collectionspace.services.authorization; + +/** + * CSpaceResource represents the resource to secure + * @author + */ +public interface CSpaceResource { + + public enum TYPE { + URI, + CLASS, + OBJECT, + ATTRIBUTE + } + public String getId(); + + public TYPE getType(); + + /** + * getAction is a conveneniece method to get corresponding action to be invoked + * on the resource for which permission is sought + * @return + */ + public CSpaceAction getAction(); +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResourceImpl.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResourceImpl.java new file mode 100644 index 000000000..0058a984a --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/CSpaceResourceImpl.java @@ -0,0 +1,84 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization; + +/** + * CSpaceResourceImpl abstract resource implementation + * @author + */ +public abstract class CSpaceResourceImpl implements CSpaceResource { + + private String id; + private TYPE type; + + public CSpaceResourceImpl() { + } + + public CSpaceResourceImpl(String id, TYPE type) { + if (id == null || id.isEmpty() || type == null) { + throw new IllegalArgumentException("id and/or type cannot be null or empty"); + } + this.id = id; + this.type = type; + } + + @Override + public String getId() { + return id; + } + + @Override + public TYPE getType() { + return type; + } + + @Override + public abstract CSpaceAction getAction(); +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/URIResourceImpl.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/URIResourceImpl.java new file mode 100644 index 000000000..cc4c12679 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/URIResourceImpl.java @@ -0,0 +1,171 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.collectionspace.services.authorization; + +import java.util.StringTokenizer; + +/** + * A security resource that represents URI and method invoked on it + * @author + */ +public class URIResourceImpl extends CSpaceResourceImpl { + + private String uri; + private String method; + private CSpaceAction action; + + /** + * constructor that is usually called from service runtime + * @param uri + * @param method an http method + */ + public URIResourceImpl(String uri, String method) { + super(getParent(uri) + "#" + getAction(method).toString(), TYPE.URI); + action = getAction(method); + this.uri = uri; + this.method = method; + } + + /** + * constructor that is usually called from administrative interface + * @param resourceName + * @param actionType + */ + public URIResourceImpl(String resourceName, ActionType actionType) { + //FIXME more validation might be needed + super(resourceName + "#" + getAction(actionType).toString(), TYPE.URI); + action = getAction(actionType); + } + + /** + * @return the uri + */ + public String getUri() { + return uri; + } + + /** + * @param uri the uri to set + */ + public void setUri(String uri) { + this.uri = uri; + } + + /** + * @return the method + */ + public String getMethod() { + return method; + } + + /** + * @param method the method to set + */ + public void setMethod(String method) { + this.method = method; + } + + /** + * getAction a convenience method to get action invoked on the resource + */ + @Override + public CSpaceAction getAction() { + return action; + } + + private static String getParent(String uri) { + StringTokenizer stz = new StringTokenizer(uri, "/"); + //FIXME the following ignores sub resources as well as object instances + return stz.nextToken(); + } + + /** + * getAction is a conveneniece method to get action + * for given HTTP method invoked on the resource + * @param method http method + * @return + */ + public static CSpaceAction getAction(String method) { + + if ("POST".equalsIgnoreCase(method)) { + return CSpaceAction.CREATE; + } else if ("GET".equalsIgnoreCase(method)) { + return CSpaceAction.READ; + } else if ("PUT".equalsIgnoreCase(method)) { + return CSpaceAction.UPDATE; + } else if ("DELETE".equalsIgnoreCase(method)) { + return CSpaceAction.DELETE; + } + throw new IllegalStateException("no method found!"); + } + + /** + * getAction is a convenience method to get corresponding action for + * given ActionType + * @param action + * @return + */ + public static CSpaceAction getAction(ActionType action) { + if (ActionType.CREATE.equals(action)) { + return CSpaceAction.CREATE; + } else if (ActionType.READ.equals(action)) { + return CSpaceAction.READ; + } else if (ActionType.UPDATE.equals(action)) { + return CSpaceAction.UPDATE; + } else if (ActionType.DELETE.equals(action)) { + return CSpaceAction.DELETE; + } else if (ActionType.SEARCH.equals(action)) { + return CSpaceAction.SEARCH; + } else if (ActionType.ADMIN.equals(action)) { + return CSpaceAction.ADMIN; + } else if (ActionType.START.equals(action)) { + return CSpaceAction.START; + } else if (ActionType.STOP.equals(action)) { + return CSpaceAction.STOP; + } + throw new IllegalArgumentException("action = " + action.toString()); + } +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpaceAuthorizationProvider.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpaceAuthorizationProvider.java new file mode 100644 index 000000000..9ea216eb2 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpaceAuthorizationProvider.java @@ -0,0 +1,45 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ + +package org.collectionspace.services.authorization.spi; + +/** + * CSpaceAuthorizationProvider acts as a main interface to access the provider + * specific information + * @author + */ +public interface CSpaceAuthorizationProvider { + + public String getName(); + + public String getVersion(); + + public CSpacePermissionEvaluator getPermissionEvaluator(); + + public CSpacePermissionManager getPermissionManager(); +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionEvaluator.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionEvaluator.java new file mode 100644 index 000000000..dc483c859 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionEvaluator.java @@ -0,0 +1,60 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + +package org.collectionspace.services.authorization.spi; + +import org.collectionspace.services.authorization.CSpaceResource; +import org.collectionspace.services.authorization.CSpaceAction; + +/** + * Permission evaluation interface for CSpace services + * @author + */ +public interface CSpacePermissionEvaluator { + + public boolean hasPermission(CSpaceResource res, CSpaceAction perm); +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionManager.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionManager.java new file mode 100644 index 000000000..2487b94bc --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spi/CSpacePermissionManager.java @@ -0,0 +1,40 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + +package org.collectionspace.services.authorization.spi; + +import org.collectionspace.services.authorization.CSpaceResource; +import org.collectionspace.services.authorization.CSpaceAction; + +/** + * Permission management interface for CSpace services + * @author + */ +public interface CSpacePermissionManager { + + public void addPermission(CSpaceResource res, String[] principals, CSpaceAction perm); + + public void deletePermission(CSpaceResource res, String[] principals, CSpaceAction perm); +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/CSpaceSecurityMetadataSource.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/CSpaceSecurityMetadataSource.java new file mode 100644 index 000000000..3812e536c --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/CSpaceSecurityMetadataSource.java @@ -0,0 +1,127 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization.spring; + +import java.util.Collection; +import java.util.Properties; +import org.springframework.security.access.ConfigAttribute; +import org.springframework.security.access.SecurityConfig; +import org.springframework.security.web.FilterInvocation; +import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource; + +/** + * + * @author + */ +public class CSpaceSecurityMetadataSource implements FilterInvocationSecurityMetadataSource { + + private Properties urlProperties; + + public Collection getAllConfigAttributes() { + return null; + } + + public Collection getAttributes(Object filter) + throws IllegalArgumentException { + FilterInvocation filterInvocation = (FilterInvocation) filter; + String url = filterInvocation.getRequestUrl(); + + //get the roles for requested page from the property file + String urlPropsValue = urlProperties.getProperty(url); + StringBuilder rolesStringBuilder = new StringBuilder(); + if (urlPropsValue != null) { + rolesStringBuilder.append(urlPropsValue).append(","); + } + + if (!url.endsWith("/")) { + int lastSlashIndex = url.lastIndexOf("/"); + url = url.substring(0, lastSlashIndex + 1); + } + + + String[] urlParts = url.split("/"); + + StringBuilder urlBuilder = new StringBuilder(); + for (String urlPart : urlParts) { + if (urlPart.trim().length() == 0) { + continue; + } + urlBuilder.append("/").append(urlPart); + urlPropsValue = urlProperties.getProperty(urlBuilder.toString() + "/**"); + + if (urlPropsValue != null) { + rolesStringBuilder.append(urlPropsValue).append(","); + } + } + + if (rolesStringBuilder.toString().endsWith(",")) { + rolesStringBuilder.deleteCharAt(rolesStringBuilder.length() - 1); + } + + + if (rolesStringBuilder.length() == 0) { + return null; + } + + return SecurityConfig.createListFromCommaDelimitedString(rolesStringBuilder.toString()); + } + + public boolean supports(Class arg0) { + return true; + } + + public void setUrlProperties(Properties urlProperties) { + this.urlProperties = urlProperties; + } + + public Properties getUrlProperties() { + return urlProperties; + } +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringAuthorizationProvider.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringAuthorizationProvider.java new file mode 100644 index 000000000..b986bd686 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringAuthorizationProvider.java @@ -0,0 +1,159 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization.spring; + +import java.util.ArrayList; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.collectionspace.services.authorization.CSpaceAction; +import org.collectionspace.services.authorization.CSpaceResource; +import org.collectionspace.services.authorization.spi.CSpaceAuthorizationProvider; +import org.collectionspace.services.authorization.spi.CSpacePermissionEvaluator; +import org.collectionspace.services.authorization.spi.CSpacePermissionManager; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.access.PermissionEvaluator; +import org.springframework.security.acls.domain.BasePermission; +import org.springframework.security.acls.domain.GrantedAuthoritySid; +import org.springframework.security.acls.domain.ObjectIdentityImpl; +import org.springframework.security.acls.model.MutableAclService; +import org.springframework.security.acls.model.ObjectIdentity; +import org.springframework.security.acls.model.Permission; +import org.springframework.security.acls.model.Sid; + +/** + * SpringAuthorizationProvider Spring Security provider + * @author + */ +public class SpringAuthorizationProvider implements CSpaceAuthorizationProvider { + + final Log log = LogFactory.getLog(SpringPermissionEvaluator.class); + @Autowired + private MutableAclService providerAclService; + @Autowired + private PermissionEvaluator providerPermissionEvaluator; + private SpringPermissionEvaluator permissionEvaluator; + private SpringPermissionManager permissionManager; + private String version = "1.0"; + + public SpringAuthorizationProvider() { + permissionManager = new SpringPermissionManager(this); + permissionEvaluator = new SpringPermissionEvaluator(this); + } + + MutableAclService getProviderAclService() { + return providerAclService; + } + + public void setProviderAclService(MutableAclService mutableAclService) { + this.providerAclService = mutableAclService; + if (log.isDebugEnabled()) { + log.debug("mutableAclService set"); + } + } + + @Override + public String getName() { + return this.getClass().getSimpleName(); + } + + @Override + public String getVersion() { + return version; + } + + PermissionEvaluator getProviderPermissionEvaluator() { + return providerPermissionEvaluator; + } + + public void setProviderPermissionEvaluator(PermissionEvaluator permEval) { + this.providerPermissionEvaluator = permEval; + if (log.isDebugEnabled()) { + log.debug("permission evaluator set"); + } + } + + @Override + public CSpacePermissionEvaluator getPermissionEvaluator() { + return permissionEvaluator; + } + + @Override + public CSpacePermissionManager getPermissionManager() { + return permissionManager; + } + + static ObjectIdentity mapResource(CSpaceResource res) { + return new ObjectIdentityImpl(res.getType().toString(), Long.valueOf(res.getId().hashCode())); + } + + static Sid[] mapPrincipal(String[] principals) { + ArrayList sids = new ArrayList(); + for (String principal : principals) { + sids.add(new GrantedAuthoritySid(principal)); + } + return sids.toArray(new Sid[0]); + } + + static Permission mapPermssion(CSpaceAction perm) { + switch (perm) { + case ADMIN: + return BasePermission.ADMINISTRATION; + case CREATE: + return BasePermission.CREATE; + case READ: + return BasePermission.READ; + case UPDATE: + return BasePermission.WRITE; + case DELETE: + return BasePermission.DELETE; + } + return null; + } +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionEvaluator.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionEvaluator.java new file mode 100644 index 000000000..2f5b6d030 --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionEvaluator.java @@ -0,0 +1,57 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.collectionspace.services.authorization.spring; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.collectionspace.services.authorization.CSpaceAction; +import org.collectionspace.services.authorization.spi.CSpacePermissionEvaluator; + +import org.collectionspace.services.authorization.CSpaceResource; +import org.springframework.security.access.PermissionEvaluator; +import org.springframework.security.acls.model.Permission; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; + +/** + * SpringPermissionEvaluator evaluates permissions in Spring Security + * @author + */ +public class SpringPermissionEvaluator implements CSpacePermissionEvaluator { + + final Log log = LogFactory.getLog(SpringPermissionEvaluator.class); + private SpringAuthorizationProvider provider; + + SpringPermissionEvaluator(SpringAuthorizationProvider provider) { + this.provider = provider; + } + + @Override + public boolean hasPermission(CSpaceResource res, CSpaceAction perm) { + PermissionEvaluator eval = provider.getProviderPermissionEvaluator(); + Permission p = SpringAuthorizationProvider.mapPermssion(perm); + Authentication authToken = SecurityContextHolder.getContext().getAuthentication(); + return eval.hasPermission(authToken, Long.valueOf(res.getId().hashCode()), res.getType().toString(), p); + } +} diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionManager.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionManager.java new file mode 100644 index 000000000..b6ed8494c --- /dev/null +++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/spring/SpringPermissionManager.java @@ -0,0 +1,104 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.collectionspace.services.authorization.spring; + +import java.util.List; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.collectionspace.services.authorization.CSpaceAction; +import org.collectionspace.services.authorization.spi.CSpacePermissionManager; +import org.collectionspace.services.authorization.CSpaceResource; +import org.springframework.security.acls.model.AccessControlEntry; +import org.springframework.security.acls.model.MutableAcl; +import org.springframework.security.acls.model.MutableAclService; +import org.springframework.security.acls.model.NotFoundException; +import org.springframework.security.acls.model.ObjectIdentity; +import org.springframework.security.acls.model.Permission; +import org.springframework.security.acls.model.Sid; + +/** + * Manages permissions in Spring Security + * @author + */ +public class SpringPermissionManager implements CSpacePermissionManager { + + final Log log = LogFactory.getLog(SpringPermissionEvaluator.class); + private SpringAuthorizationProvider provider; + + SpringPermissionManager(SpringAuthorizationProvider provider) { + this.provider = provider; + } + + @Override + public void addPermission(CSpaceResource res, String[] principals, CSpaceAction perm) { + ObjectIdentity oid = SpringAuthorizationProvider.mapResource(res); + Sid[] sids = SpringAuthorizationProvider.mapPrincipal(principals); + Permission p = SpringAuthorizationProvider.mapPermssion(perm); + for (Sid sid : sids) { + addPermission(oid, sid, p); + } + } + + private void addPermission(ObjectIdentity oid, Sid recipient, Permission permission) { + MutableAcl acl; + MutableAclService mutableAclService = provider.getProviderAclService(); + try { + acl = (MutableAcl) mutableAclService.readAclById(oid); + } catch (NotFoundException nfe) { + acl = mutableAclService.createAcl(oid); + } + + acl.insertAce(acl.getEntries().size(), permission, recipient, true); + mutableAclService.updateAcl(acl); + + } + + @Override + public void deletePermission(CSpaceResource res, String[] principals, CSpaceAction perm) { + ObjectIdentity oid = SpringAuthorizationProvider.mapResource(res); + Sid[] sids = SpringAuthorizationProvider.mapPrincipal(principals); + Permission p = SpringAuthorizationProvider.mapPermssion(perm); + for (Sid sid : sids) { + deletePermission(oid, sid, p); + } + } + + private void deletePermission(ObjectIdentity oid, Sid recipient, Permission permission) { + + MutableAclService mutableAclService = provider.getProviderAclService(); + MutableAcl acl = (MutableAcl) mutableAclService.readAclById(oid); + + // Remove all permissions associated with this particular recipient (string equality to KISS) + List entries = acl.getEntries(); + + for (int i = 0; i < entries.size(); i++) { + if (entries.get(i).getSid().equals(recipient) + && entries.get(i).getPermission().equals(permission)) { + acl.deleteAce(i); + } + } + mutableAclService.updateAcl(acl); + } +} diff --git a/services/authorization/service/src/main/resources/applicationContext-authorization.xml b/services/authorization/service/src/main/resources/applicationContext-authorization.xml new file mode 100644 index 000000000..cd22bcda6 --- /dev/null +++ b/services/authorization/service/src/main/resources/applicationContext-authorization.xml @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/services/authorization/service/src/test/java/org/collectionspace/services/authorization/test/AuthorizationSeedTest.java b/services/authorization/service/src/test/java/org/collectionspace/services/authorization/test/AuthorizationSeedTest.java new file mode 100644 index 000000000..06e9be7c7 --- /dev/null +++ b/services/authorization/service/src/test/java/org/collectionspace/services/authorization/test/AuthorizationSeedTest.java @@ -0,0 +1,205 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.authorization.test; + +import java.io.File; +import java.io.InputStream; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import java.lang.reflect.Method; +import java.util.ArrayList; +import java.util.HashSet; +import javax.xml.bind.JAXBContext; +import javax.xml.bind.Marshaller; +import javax.xml.bind.Unmarshaller; +import org.collectionspace.services.authorization.ActionType; +import org.collectionspace.services.authorization.AuthZ; +import org.collectionspace.services.authorization.PermissionConfig; +import org.collectionspace.services.authorization.EffectType; +import org.collectionspace.services.authorization.PermissionConfigList; +import org.springframework.context.support.ClassPathXmlApplicationContext; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.authority.GrantedAuthorityImpl; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.transaction.TransactionDefinition; +import org.springframework.transaction.TransactionStatus; +import org.springframework.transaction.support.DefaultTransactionDefinition; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.DataProvider; +import org.testng.annotations.Test; + +/** + * + * @author + */ +public class AuthorizationSeedTest { + + final Logger logger = LoggerFactory.getLogger(AuthorizationSeedTest.class); + + /** + * Returns the name of the currently running test. + * + * Note: although the return type is listed as Object[][], + * this method instead returns a String. + * + * @param m The currently running test method. + * + * @return The name of the currently running test method. + */ + @DataProvider(name = "testName") + public static Object[][] testName(Method m) { + return new Object[][]{ + new Object[]{m.getName()} + }; + } + + @BeforeClass(alwaysRun = true) + public void seedData() { + ClassPathXmlApplicationContext appContext = new ClassPathXmlApplicationContext( + new String[]{"applicationContext-authorization-test.xml"}); + GrantedAuthority gauth = new GrantedAuthorityImpl("ROLE_ADMINISTRATOR"); + HashSet gauths = new HashSet(); + gauths.add(gauth); + Authentication authRequest = new UsernamePasswordAuthenticationToken("test", "test", gauths); + + SecurityContextHolder.getContext().setAuthentication(authRequest); + AuthZ authZ = AuthZ.get(); + + org.springframework.jdbc.datasource.DataSourceTransactionManager txManager = + (org.springframework.jdbc.datasource.DataSourceTransactionManager) appContext.getBean("transactionManager"); + DefaultTransactionDefinition def = new DefaultTransactionDefinition(); + // explicitly setting the transaction name is something that can only be done programmatically + def.setName("seedData"); + def.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRED); + + TransactionStatus status = txManager.getTransaction(def); + try { + seedRoles(); + seedPermissions(); + } catch (Exception ex) { + txManager.rollback(status); + ex.printStackTrace(); + throw new RuntimeException(ex); + } + txManager.commit(status); + + } + + public void seedRoles() throws Exception { + } + + public void seedPermissions() throws Exception { + + PermissionConfigList pcList = + (PermissionConfigList) fromFile(PermissionConfigList.class, + "./test-data/test-permissions.xml"); + AuthZ authZ = AuthZ.get(); + for (PermissionConfig pc : pcList.getPermission()) { + if(logger.isDebugEnabled()) { + logger.debug("adding permission for res=" + pc.getResourceName()); + } + authZ.addPermissions(pc); + } + } + + private void genPermissions() { + PermissionConfigList pcList = new PermissionConfigList(); + ArrayList apcList = new ArrayList(); + pcList.setPermission(apcList); + PermissionConfig pc = new PermissionConfig(); + pc.setResourceName("accounts"); + pc.setEffect(EffectType.PERMIT); + ArrayList roles = new ArrayList(); + roles.add("ROLE_USERS"); + roles.add("ROLE_ADMINISTRATOR"); + pc.setRole(roles); + ArrayList actions = new ArrayList(); + actions.add(ActionType.CREATE); + actions.add(ActionType.READ); + actions.add(ActionType.UPDATE); + actions.add(ActionType.DELETE); + pc.setAction(actions); + apcList.add(pc); + toFile(pcList, PermissionConfigList.class, "./target/test-permissions.xml"); + + } + + private void toFile(Object o, Class jaxbClass, String fileName) { + File f = new File(fileName); + try { + JAXBContext jc = JAXBContext.newInstance(jaxbClass); + Marshaller m = jc.createMarshaller(); + m.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, + Boolean.TRUE); + m.marshal(o, f); + } catch (Exception e) { + e.printStackTrace(); + } + } + + private Object fromFile(Class jaxbClass, String fileName) throws Exception { + ClassLoader tccl = Thread.currentThread().getContextClassLoader(); + InputStream is = tccl.getResourceAsStream(fileName); + JAXBContext context = JAXBContext.newInstance(jaxbClass); + Unmarshaller unmarshaller = context.createUnmarshaller(); + //note: setting schema to null will turn validator off + unmarshaller.setSchema(null); + return jaxbClass.cast(unmarshaller.unmarshal(is)); + } + + @Test(dataProvider = "testName", dataProviderClass = AuthorizationSeedTest.class) + public void test(String testName) { + if (logger.isDebugEnabled()) { + logger.debug(testName); + } + } +} diff --git a/services/authorization/service/src/test/resources/applicationContext-authorization-test.xml b/services/authorization/service/src/test/resources/applicationContext-authorization-test.xml new file mode 100644 index 000000000..d9f03ee47 --- /dev/null +++ b/services/authorization/service/src/test/resources/applicationContext-authorization-test.xml @@ -0,0 +1,92 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/services/authentication/pstore/src/test/resources/log4j.properties b/services/authorization/service/src/test/resources/log4j.properties similarity index 92% rename from services/authentication/pstore/src/test/resources/log4j.properties rename to services/authorization/service/src/test/resources/log4j.properties index 5d288d87d..18c510350 100644 --- a/services/authentication/pstore/src/test/resources/log4j.properties +++ b/services/authorization/service/src/test/resources/log4j.properties @@ -20,4 +20,4 @@ log4j.appender.R.layout.ConversionPattern=%d %-5p [%t] [%c:%L] %m%n log4j.logger.org.collectionspace=DEBUG log4j.logger.org.apache=INFO log4j.logger.httpclient=INFO -log4j.logger.org.jboss.resteasy=WARN +log4j.logger.org.jboss.resteasy=INFO diff --git a/services/authorization/service/src/test/resources/test-data/test-permissions.xml b/services/authorization/service/src/test/resources/test-data/test-permissions.xml new file mode 100644 index 000000000..3ff219af0 --- /dev/null +++ b/services/authorization/service/src/test/resources/test-data/test-permissions.xml @@ -0,0 +1,22 @@ + + + + accounts + CREATE + READ + UPDATE + DELETE + ROLE_ADMINISTRATOR + PERMIT + + + collectionobjects + CREATE + READ + UPDATE + DELETE + ROLE_USERS + ROLE_ADMINISTRATOR + PERMIT + + diff --git a/services/build.xml b/services/build.xml index a5d3717d2..4b2377044 100644 --- a/services/build.xml +++ b/services/build.xml @@ -128,12 +128,14 @@ + + @@ -142,6 +144,7 @@ + @@ -173,6 +176,7 @@ + @@ -185,6 +189,8 @@ + + @@ -213,7 +219,9 @@ org.collectionspace.services @@ -31,7 +32,15 @@ ${project.version} provided + + org.collectionspace.services + org.collectionspace.services.authorization.service + ${project.version} + provided + + + junit junit @@ -46,6 +55,19 @@ org.slf4j slf4j-log4j12 + + log4j + log4j + 1.2.14 + provided + + + junit + junit + 4.1 + test + + javax.servlet diff --git a/services/common/src/main/config/log/jboss-log4j-release.xml b/services/common/src/main/config/log/jboss-log4j-release.xml index 8fb037eb1..ee2fea60d 100644 --- a/services/common/src/main/config/log/jboss-log4j-release.xml +++ b/services/common/src/main/config/log/jboss-log4j-release.xml @@ -1,28 +1,28 @@ +--> - + - - - - - - - - - - - - - @@ -40,18 +40,18 @@ - - - - + + + + - - - - - - - + + + + + + + @@ -124,10 +124,10 @@ - - - - - - - - - - - + - - + + + - + - - - - + + + + + - + - + @@ -200,46 +205,46 @@ - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + - - - - - + + + + + - + - - - - - - + + + - - - - - + + + + + diff --git a/services/common/src/main/config/log/jboss-log4j.xml b/services/common/src/main/config/log/jboss-log4j.xml index bac4f2224..bbad4e883 100644 --- a/services/common/src/main/config/log/jboss-log4j.xml +++ b/services/common/src/main/config/log/jboss-log4j.xml @@ -1,14 +1,14 @@ - - - - - - - + --> + + + + + + + @@ -19,9 +19,9 @@ - + + - - - - - - - - - - - - - - - - - - - - - + --> + + + + + + + + + + + + + + + + + + + + - + --> + - + --> + - + --> + - + --> + - + --> + + --> - + @@ -152,105 +152,110 @@ - - - - - - - - + + + + + + + + + + + + + + --> - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - + --> + + + + + + - + --> + - + --> + - + --> + - - + --> + + + --> @@ -354,15 +359,15 @@ - - - - - - - - - - - + + + + + + + + + + + diff --git a/services/common/src/main/java/org/collectionspace/services/common/context/AbstractServiceContextImpl.java b/services/common/src/main/java/org/collectionspace/services/common/context/AbstractServiceContextImpl.java index 448a0cf19..9542d9012 100644 --- a/services/common/src/main/java/org/collectionspace/services/common/context/AbstractServiceContextImpl.java +++ b/services/common/src/main/java/org/collectionspace/services/common/context/AbstractServiceContextImpl.java @@ -33,6 +33,7 @@ import java.util.Set; import javax.security.auth.Subject; import javax.security.jacc.PolicyContext; import javax.security.jacc.PolicyContextException; +import org.collectionspace.authentication.AuthN; import org.collectionspace.authentication.CSpaceTenant; import org.collectionspace.services.common.ClientType; @@ -124,14 +125,14 @@ public abstract class AbstractServiceContextImpl ServiceBindingUtils.getPartsMetadata(getServiceBinding(), objectPartMap); return objectPartMap; } - + public List getPropertiesForPart(String partLabel) { - Map partMap = getPartsMetadata(); - ObjectPartType part = partMap.get(partLabel); - if(part==null) { - throw new RuntimeException("No such part found: "+partLabel); - } - return part.getProperties(); + Map partMap = getPartsMetadata(); + ObjectPartType part = partMap.get(partLabel); + if (part == null) { + throw new RuntimeException("No such part found: " + partLabel); + } + return part.getProperties(); } public List getPropertyValuesForPart(String partLabel, String propName) { @@ -144,11 +145,11 @@ public abstract class AbstractServiceContextImpl } public List getCommonPartProperties() { - return getPropertiesForPart(getCommonPartLabel()); + return getPropertiesForPart(getCommonPartLabel()); } public List getCommonPartPropertyValues(String propName) { - return getPropertyValuesForPart(getCommonPartLabel(), propName); + return getPropertyValuesForPart(getCommonPartLabel(), propName); } @Override @@ -248,53 +249,19 @@ public abstract class AbstractServiceContextImpl public void setProperty(String name, Object o) { properties.put(name, o); } - private static final String SUBJECT_CONTEXT_KEY = "javax.security.auth.Subject.container"; + private String retrieveTenantId() throws UnauthorizedException { - String tenantId = null; - Subject caller = null; - Set groups = null; - try { - caller = (Subject) PolicyContext.getContext(SUBJECT_CONTEXT_KEY); - if (caller == null) { - //logger.warn("security not enabled..."); - return tenantId; - } - groups = caller.getPrincipals(Group.class); - if (groups != null && groups.size() == 0) { - //TODO: find out why subject is not null - if (logger.isDebugEnabled()) { - logger.debug("no tenant(s) found!"); - } - return tenantId; - } - } catch (PolicyContextException pce) { - String msg = "Could not retrieve principal information"; - logger.error(msg, pce); - throw new UnauthorizedException(msg); - } - for (Group g : groups) { - if ("Tenants".equals(g.getName())) { - Enumeration members = g.members(); - while (members.hasMoreElements()) { - CSpaceTenant tenant = (CSpaceTenant) members.nextElement(); - tenantId = tenant.getId(); - if (logger.isDebugEnabled()) { - logger.debug("found tenant id=" + tenant.getId() - + " name=" + tenant.getName()); - } - } - } - } - //TODO: if a user is associated with more than one tenants, the tenant - //id should be matched with sent over the wire - if (tenantId == null) { + String[] tenantIds = AuthN.get().getTenantIds(); + if (tenantIds.length == 0) { String msg = "Could not find tenant context"; logger.error(msg); throw new UnauthorizedException(msg); } - return tenantId; + //TODO: if a user is associated with more than one tenants, the tenant + //id should be matched with the one sent over the wire + return tenantIds[0]; } @Override @@ -307,8 +274,8 @@ public abstract class AbstractServiceContextImpl if (DocumentHandler.class.isAssignableFrom(c)) { docHandler = (DocumentHandler) c.newInstance(); } else { - throw new IllegalArgumentException("Not of type " + - DocumentHandler.class.getCanonicalName()); + throw new IllegalArgumentException("Not of type " + + DocumentHandler.class.getCanonicalName()); } docHandler.setServiceContext(this); return docHandler; diff --git a/services/common/src/main/java/org/collectionspace/services/common/security/SecurityInterceptor.java b/services/common/src/main/java/org/collectionspace/services/common/security/SecurityInterceptor.java new file mode 100644 index 000000000..2cd6428e3 --- /dev/null +++ b/services/common/src/main/java/org/collectionspace/services/common/security/SecurityInterceptor.java @@ -0,0 +1,102 @@ +/** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + *//** + * This document is a part of the source code and related artifacts + * for CollectionSpace, an open source collections management system + * for museums and related institutions: + + * http://www.collectionspace.org + * http://wiki.collectionspace.org + + * Copyright 2009 University of California at Berkeley + + * Licensed under the Educational Community License (ECL), Version 2.0. + * You may not use this file except in compliance with this License. + + * You may obtain a copy of the ECL 2.0 License at + + * https://source.collectionspace.org/collection-space/LICENSE.txt + + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * To change this template, choose Tools | Templates + * and open the template in the editor. + */ +package org.collectionspace.services.common.security; + +import org.jboss.resteasy.core.ResourceMethod; +import org.jboss.resteasy.core.ServerResponse; +import org.jboss.resteasy.spi.interception.PreProcessInterceptor; +import org.jboss.resteasy.annotations.interception.SecurityPrecedence; +import org.jboss.resteasy.annotations.interception.ServerInterceptor; +import org.jboss.resteasy.spi.Failure; +import org.jboss.resteasy.spi.HttpRequest; + +import javax.ws.rs.WebApplicationException; +import javax.ws.rs.core.Response; +import org.collectionspace.authentication.AuthN; +import org.collectionspace.services.authorization.AuthZ; +import org.collectionspace.services.authorization.CSpaceResource; +import org.collectionspace.services.authorization.URIResourceImpl; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * RESTeasy interceptor for access control + * @version $Revision: 1 $ + */ +@SecurityPrecedence +@ServerInterceptor +public class SecurityInterceptor implements PreProcessInterceptor { + + private static final Logger logger = LoggerFactory.getLogger(SecurityInterceptor.class); + + @Override + public ServerResponse preProcess(HttpRequest request, ResourceMethod method) + throws Failure, WebApplicationException { + String httpMethod = request.getHttpMethod(); + String uriPath = request.getUri().getPath(); + if (logger.isDebugEnabled()) { + logger.debug("received " + httpMethod + " on " + uriPath); + } + AuthZ authZ = AuthZ.get(); + CSpaceResource res = new URIResourceImpl(uriPath, httpMethod); +// if (!authZ.isAccessAllowed(res)) { +// logger.error("Access to " + res.getId() + " is NOT allowed to " + +// " user=" + AuthN.get().getUserId()); +// Response response = Response.status( +// Response.Status.FORBIDDEN).entity(uriPath + " " + httpMethod).type("text/plain").build(); +// throw new WebApplicationException(response); +// } + if(logger.isDebugEnabled()) { + logger.debug("Access to " + res.getId() + " is allowed to " + + " user=" + AuthN.get().getUserId()); + } + return null; + } +} diff --git a/services/pom.xml b/services/pom.xml index 9ef82fb67..cefff9c0f 100644 --- a/services/pom.xml +++ b/services/pom.xml @@ -15,6 +15,7 @@ jaxb authentication + authorization common client account @@ -30,7 +31,7 @@ dimension contact JaxRsServiceProvider - sdk + IntegrationTests PerformanceTests security @@ -52,19 +53,19 @@ ${jboss.dir} - + org.jvnet.hyperjaxb3 maven-hyperjaxb3-plugin 0.5.4 - + org.jvnet.jaxb2.maven2 maven-jaxb2-plugin 0.7.2 - + org.apache.maven.plugins maven-compiler-plugin @@ -271,4 +272,4 @@ - + \ No newline at end of file -- 2.47.3