From: Olivier Lamy Date: Mon, 7 Jan 2013 16:23:14 +0000 (+0000) Subject: move this module in the correct place X-Git-Tag: redback-2.1~139 X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=2ab87f190776ece15838b3cc87bef553d8b58d81;p=archiva.git move this module in the correct place git-svn-id: https://svn.apache.org/repos/asf/archiva/redback/redback-core/trunk@1429879 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/redback-authorization/redback-authorization-providers/pom.xml b/redback-authorization/redback-authorization-providers/pom.xml index 6ca72844e..30752876c 100644 --- a/redback-authorization/redback-authorization-providers/pom.xml +++ b/redback-authorization/redback-authorization-providers/pom.xml @@ -28,6 +28,7 @@ Redback :: Authorization Providers pom + redback-authorization-rbac redback-authorization-open redback-authorization-ldap diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/pom.xml b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/pom.xml new file mode 100644 index 000000000..b2eed3651 --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/pom.xml @@ -0,0 +1,90 @@ + + + + + 4.0.0 + + + org.apache.archiva.redback + redback-authorization-providers + 2.1-SNAPSHOT + + + redback-authorization-rbac + bundle + Redback :: Authorization Provider :: RBAC + + + + org.apache.archiva.redback + redback-users-api + + + org.apache.archiva.redback + redback-authorization-api + + + org.apache.archiva.redback + redback-rbac-cached + + + org.apache.archiva.redback + redback-rbac-memory + test + + + org.apache.archiva.redback + redback-users-configurable + runtime + + + org.apache.archiva.redback + redback-users-memory + test + + + org.apache.archiva.redback + redback-rbac-model + + + org.springframework + spring-context-support + + + javax.annotation + jsr250-api + + + org.slf4j + slf4j-simple + test + + + + + + + org.apache.felix + maven-bundle-plugin + + + + + diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/RbacAuthorizer.java b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/RbacAuthorizer.java new file mode 100644 index 000000000..2ce17b4c8 --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/RbacAuthorizer.java @@ -0,0 +1,199 @@ +package org.apache.archiva.redback.authorization.rbac; + +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import org.apache.archiva.redback.authorization.AuthorizationDataSource; +import org.apache.archiva.redback.authorization.AuthorizationException; +import org.apache.archiva.redback.authorization.AuthorizationResult; +import org.apache.archiva.redback.authorization.Authorizer; +import org.apache.archiva.redback.authorization.NotAuthorizedException; +import org.apache.archiva.redback.authorization.rbac.evaluator.PermissionEvaluationException; +import org.apache.archiva.redback.authorization.rbac.evaluator.PermissionEvaluator; +import org.apache.archiva.redback.rbac.Permission; +import org.apache.archiva.redback.rbac.RBACManager; +import org.apache.archiva.redback.rbac.RbacManagerException; +import org.apache.archiva.redback.rbac.RbacObjectNotFoundException; +import org.apache.archiva.redback.users.User; +import org.apache.archiva.redback.users.UserManager; +import org.apache.archiva.redback.users.UserManagerException; +import org.apache.archiva.redback.users.UserNotFoundException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.stereotype.Service; + +import javax.inject.Inject; +import javax.inject.Named; +import java.util.List; +import java.util.Map; + +/** + * RbacAuthorizer: + * + * @author Jesse McConnell + */ +@Service("authorizer#rbac") +public class RbacAuthorizer + implements Authorizer +{ + private Logger log = LoggerFactory.getLogger( getClass() ); + + @Inject + @Named(value = "rbacManager#cached") + private RBACManager manager; + + @Inject + @Named(value = "userManager#configurable") + private UserManager userManager; + + @Inject + private PermissionEvaluator evaluator; + + public String getId() + { + return "rbac"; + } + + /** + * @param source + * @return + * @throws AuthorizationException + */ + public AuthorizationResult isAuthorized( AuthorizationDataSource source ) + throws AuthorizationException + { + String principal = source.getPrincipal(); + String operation = source.getPermission(); + String resource = source.getResource(); + + try + { + if ( principal != null ) + { + // Set permissions = manager.getAssignedPermissions( principal.toString(), operation ); + Map> permissionMap = manager.getAssignedPermissionMap( principal ); + + if ( permissionMap.keySet().contains( operation ) ) + { + for ( Permission permission : permissionMap.get( operation ) ) + { + + log.debug( "checking permission {} for operation {} resource {}", + ( permission != null ? permission.getName() : "null" ), operation, resource ); + + if ( evaluator.evaluate( permission, operation, resource, principal ) ) + { + return new AuthorizationResult( true, permission, null ); + } + } + + log.debug( "no permission found for operation {} resource {}", operation, resource ); + } + else + { + log.debug( "permission map does not contain operation: {}", operation ); + } + } + // check if guest user is enabled, if so check the global permissions + User guest = userManager.getGuestUser(); + + if ( !guest.isLocked() ) + { + // Set permissions = manager.getAssignedPermissions( principal.toString(), operation ); + Map> permissionMap = manager.getAssignedPermissionMap( guest.getUsername() ); + + if ( permissionMap.keySet().contains( operation ) ) + { + for ( Permission permission : permissionMap.get( operation ) ) + { + log.debug( "checking permission {}", permission.getName() ); + + if ( evaluator.evaluate( permission, operation, resource, guest.getUsername() ) ) + { + return new AuthorizationResult( true, permission, null ); + } + } + } + } + + return new AuthorizationResult( false, null, new NotAuthorizedException( "no matching permissions" ) ); + } + catch ( PermissionEvaluationException pe ) + { + return new AuthorizationResult( false, null, pe ); + } + catch ( RbacObjectNotFoundException nfe ) + { + return new AuthorizationResult( false, null, nfe ); + } + catch ( UserNotFoundException ne ) + { + return new AuthorizationResult( false, null, + new NotAuthorizedException( "no matching permissions, guest not found" ) ); + } + catch ( RbacManagerException rme ) + { + return new AuthorizationResult( false, null, rme ); + } + catch ( UserManagerException e ) + { + return new AuthorizationResult( false, null, e ); + } + } + + public RBACManager getManager() + { + return manager; + } + + public void setManager( RBACManager manager ) + { + this.manager = manager; + } + + public UserManager getUserManager() + { + return userManager; + } + + public void setUserManager( UserManager userManager ) + { + this.userManager = userManager; + } + + public PermissionEvaluator getEvaluator() + { + return evaluator; + } + + public void setEvaluator( PermissionEvaluator evaluator ) + { + this.evaluator = evaluator; + } + + public boolean isFinalImplementation() + { + return true; + } + + public String getDescriptionKey() + { + return "archiva.redback.authorizer.rbac"; + } +} diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/DefaultPermissionEvaluator.java b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/DefaultPermissionEvaluator.java new file mode 100644 index 000000000..c3d033d83 --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/DefaultPermissionEvaluator.java @@ -0,0 +1,110 @@ +package org.apache.archiva.redback.authorization.rbac.evaluator; + +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import org.apache.archiva.redback.rbac.Resource; +import org.apache.archiva.redback.users.UserManager; +import org.apache.archiva.redback.users.UserManagerException; +import org.apache.archiva.redback.users.UserNotFoundException; +import org.apache.archiva.redback.rbac.Permission; +import org.springframework.stereotype.Service; + +import javax.inject.Inject; +import javax.inject.Named; + +/** + * DefaultPermissionEvaluator: + *

+ * Currently only one expression is available for evaluation, ${username} will be replaced with the username + * of the person making the authorization check + * + * @author Jesse McConnell + */ +@Service("permissionEvaluator") +public class DefaultPermissionEvaluator + implements PermissionEvaluator +{ + @Inject + @Named(value = "userManager#configurable") + private UserManager userManager; + + public boolean evaluate( Permission permission, String operation, String resource, String principal ) + throws PermissionEvaluationException + { + String permissionResource = permission.getResource().getIdentifier(); + + // expression evaluation checking + if ( permissionResource.startsWith( "${" ) ) + { + String tempStr = permissionResource.substring( 2, permissionResource.indexOf( '}' ) ); + + if ( "username".equals( tempStr ) ) + { + try + { + permissionResource = userManager.findUser( principal ).getUsername(); + } + catch ( UserNotFoundException e ) + { + throw new PermissionEvaluationException( "unable to locate user to retrieve username", e ); + } + catch ( UserManagerException e ) + { + throw new PermissionEvaluationException( "trouble finding user: " + e.getMessage(), e ); + } + } + } + + // check if this permission applies to the operation at all + if ( permission.getOperation().getName().equals( operation ) ) + { + // check if it is a global resource, if it is then since the operations match we return true + if ( Resource.GLOBAL.equals( permission.getResource().getIdentifier() ) ) + { + return true; + } + + // if we are not checking a specific resource, the operation is enough + if ( resource == null ) + { + return true; + } + + // check if the resource identifier of the permission matches the resource we are checking against + // if it does then return true + if ( permissionResource.equals( resource ) ) + { + return true; + } + } + + return false; + } + + public UserManager getUserManager() + { + return userManager; + } + + public void setUserManager( UserManager userManager ) + { + this.userManager = userManager; + } +} diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluationException.java b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluationException.java new file mode 100644 index 000000000..15d4c8361 --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluationException.java @@ -0,0 +1,41 @@ +package org.apache.archiva.redback.authorization.rbac.evaluator; + +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +/** + * PermissionEvaluationException: + * + * @author Jesse McConnell + * + */ +public class PermissionEvaluationException + extends Exception +{ + public PermissionEvaluationException( String string ) + { + super( string ); + } + + public PermissionEvaluationException( String string, Throwable throwable ) + { + super( string, throwable ); + } + +} diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluator.java b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluator.java new file mode 100644 index 000000000..8dc0014a5 --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluator.java @@ -0,0 +1,35 @@ +package org.apache.archiva.redback.authorization.rbac.evaluator; + +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import org.apache.archiva.redback.rbac.Permission; + + +/** + * PermissionEvaluator: + * + * @author Jesse McConnell + * + */ +public interface PermissionEvaluator +{ + boolean evaluate( Permission permission, String operation, String resource, String principal ) + throws PermissionEvaluationException; +} diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/resources/META-INF/spring-context.xml b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/resources/META-INF/spring-context.xml new file mode 100644 index 000000000..9a306403a --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/main/resources/META-INF/spring-context.xml @@ -0,0 +1,34 @@ + + + + + + + + + \ No newline at end of file diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/test/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluatorTest.java b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/test/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluatorTest.java new file mode 100644 index 000000000..fdff955c9 --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/test/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluatorTest.java @@ -0,0 +1,66 @@ +package org.apache.archiva.redback.authorization.rbac.evaluator; + +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import junit.framework.TestCase; +import org.apache.archiva.redback.rbac.Permission; +import org.apache.archiva.redback.rbac.Operation; +import org.apache.archiva.redback.rbac.Resource; +import org.apache.archiva.redback.rbac.memory.MemoryOperation; +import org.apache.archiva.redback.rbac.memory.MemoryPermission; +import org.apache.archiva.redback.rbac.memory.MemoryResource; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.springframework.test.context.ContextConfiguration; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; + +import javax.inject.Inject; + +@RunWith( SpringJUnit4ClassRunner.class ) +@ContextConfiguration( locations = { "classpath*:/META-INF/spring-context.xml", "classpath*:/spring-context.xml" } ) +public class PermissionEvaluatorTest + extends TestCase +{ + + @Inject + PermissionEvaluator permissionEvaluator; + + @Test + public void testNullResource() + throws PermissionEvaluationException + { + // null resources should be considered as matching if any resource is obtained. + // we do this instead of using "global" as that is the inverse - you are allocated global rights, + // which is right to everything. null is the right to anything. + + Resource resource = new MemoryResource(); + resource.setIdentifier( "Resource" ); + + Operation operation = new MemoryOperation(); + operation.setName( "Operation" ); + + Permission permission = new MemoryPermission(); + permission.setName( "Permission" ); + permission.setOperation( operation ); + permission.setResource( resource ); + + assertTrue( permissionEvaluator.evaluate( permission, "Operation", null, "brett" ) ); + } +} diff --git a/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/test/resources/spring-context.xml b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/test/resources/spring-context.xml new file mode 100644 index 000000000..926b77aaa --- /dev/null +++ b/redback-authorization/redback-authorization-providers/redback-authorization-rbac/src/test/resources/spring-context.xml @@ -0,0 +1,47 @@ + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/redback-rbac/pom.xml b/redback-rbac/pom.xml index f22411d19..08e0bd670 100644 --- a/redback-rbac/pom.xml +++ b/redback-rbac/pom.xml @@ -32,6 +32,5 @@ redback-rbac-providers redback-rbac-role-manager redback-rbac-tests - redback-authorization-rbac diff --git a/redback-rbac/redback-authorization-rbac/pom.xml b/redback-rbac/redback-authorization-rbac/pom.xml deleted file mode 100644 index 7dab09593..000000000 --- a/redback-rbac/redback-authorization-rbac/pom.xml +++ /dev/null @@ -1,91 +0,0 @@ - - - - - 4.0.0 - - - org.apache.archiva.redback - redback-authorization-providers - 2.1-SNAPSHOT - ../../redback-authorization/redback-authorization-providers/pom.xml - - - redback-authorization-rbac - bundle - Redback :: Authorization Provider :: RBAC - - - - org.apache.archiva.redback - redback-users-api - - - org.apache.archiva.redback - redback-authorization-api - - - org.apache.archiva.redback - redback-rbac-cached - - - org.apache.archiva.redback - redback-rbac-memory - test - - - org.apache.archiva.redback - redback-users-configurable - runtime - - - org.apache.archiva.redback - redback-users-memory - test - - - org.apache.archiva.redback - redback-rbac-model - - - org.springframework - spring-context-support - - - javax.annotation - jsr250-api - - - org.slf4j - slf4j-simple - test - - - - - - - org.apache.felix - maven-bundle-plugin - - - - - diff --git a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/RbacAuthorizer.java b/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/RbacAuthorizer.java deleted file mode 100644 index 2ce17b4c8..000000000 --- a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/RbacAuthorizer.java +++ /dev/null @@ -1,199 +0,0 @@ -package org.apache.archiva.redback.authorization.rbac; - -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import org.apache.archiva.redback.authorization.AuthorizationDataSource; -import org.apache.archiva.redback.authorization.AuthorizationException; -import org.apache.archiva.redback.authorization.AuthorizationResult; -import org.apache.archiva.redback.authorization.Authorizer; -import org.apache.archiva.redback.authorization.NotAuthorizedException; -import org.apache.archiva.redback.authorization.rbac.evaluator.PermissionEvaluationException; -import org.apache.archiva.redback.authorization.rbac.evaluator.PermissionEvaluator; -import org.apache.archiva.redback.rbac.Permission; -import org.apache.archiva.redback.rbac.RBACManager; -import org.apache.archiva.redback.rbac.RbacManagerException; -import org.apache.archiva.redback.rbac.RbacObjectNotFoundException; -import org.apache.archiva.redback.users.User; -import org.apache.archiva.redback.users.UserManager; -import org.apache.archiva.redback.users.UserManagerException; -import org.apache.archiva.redback.users.UserNotFoundException; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.stereotype.Service; - -import javax.inject.Inject; -import javax.inject.Named; -import java.util.List; -import java.util.Map; - -/** - * RbacAuthorizer: - * - * @author Jesse McConnell - */ -@Service("authorizer#rbac") -public class RbacAuthorizer - implements Authorizer -{ - private Logger log = LoggerFactory.getLogger( getClass() ); - - @Inject - @Named(value = "rbacManager#cached") - private RBACManager manager; - - @Inject - @Named(value = "userManager#configurable") - private UserManager userManager; - - @Inject - private PermissionEvaluator evaluator; - - public String getId() - { - return "rbac"; - } - - /** - * @param source - * @return - * @throws AuthorizationException - */ - public AuthorizationResult isAuthorized( AuthorizationDataSource source ) - throws AuthorizationException - { - String principal = source.getPrincipal(); - String operation = source.getPermission(); - String resource = source.getResource(); - - try - { - if ( principal != null ) - { - // Set permissions = manager.getAssignedPermissions( principal.toString(), operation ); - Map> permissionMap = manager.getAssignedPermissionMap( principal ); - - if ( permissionMap.keySet().contains( operation ) ) - { - for ( Permission permission : permissionMap.get( operation ) ) - { - - log.debug( "checking permission {} for operation {} resource {}", - ( permission != null ? permission.getName() : "null" ), operation, resource ); - - if ( evaluator.evaluate( permission, operation, resource, principal ) ) - { - return new AuthorizationResult( true, permission, null ); - } - } - - log.debug( "no permission found for operation {} resource {}", operation, resource ); - } - else - { - log.debug( "permission map does not contain operation: {}", operation ); - } - } - // check if guest user is enabled, if so check the global permissions - User guest = userManager.getGuestUser(); - - if ( !guest.isLocked() ) - { - // Set permissions = manager.getAssignedPermissions( principal.toString(), operation ); - Map> permissionMap = manager.getAssignedPermissionMap( guest.getUsername() ); - - if ( permissionMap.keySet().contains( operation ) ) - { - for ( Permission permission : permissionMap.get( operation ) ) - { - log.debug( "checking permission {}", permission.getName() ); - - if ( evaluator.evaluate( permission, operation, resource, guest.getUsername() ) ) - { - return new AuthorizationResult( true, permission, null ); - } - } - } - } - - return new AuthorizationResult( false, null, new NotAuthorizedException( "no matching permissions" ) ); - } - catch ( PermissionEvaluationException pe ) - { - return new AuthorizationResult( false, null, pe ); - } - catch ( RbacObjectNotFoundException nfe ) - { - return new AuthorizationResult( false, null, nfe ); - } - catch ( UserNotFoundException ne ) - { - return new AuthorizationResult( false, null, - new NotAuthorizedException( "no matching permissions, guest not found" ) ); - } - catch ( RbacManagerException rme ) - { - return new AuthorizationResult( false, null, rme ); - } - catch ( UserManagerException e ) - { - return new AuthorizationResult( false, null, e ); - } - } - - public RBACManager getManager() - { - return manager; - } - - public void setManager( RBACManager manager ) - { - this.manager = manager; - } - - public UserManager getUserManager() - { - return userManager; - } - - public void setUserManager( UserManager userManager ) - { - this.userManager = userManager; - } - - public PermissionEvaluator getEvaluator() - { - return evaluator; - } - - public void setEvaluator( PermissionEvaluator evaluator ) - { - this.evaluator = evaluator; - } - - public boolean isFinalImplementation() - { - return true; - } - - public String getDescriptionKey() - { - return "archiva.redback.authorizer.rbac"; - } -} diff --git a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/DefaultPermissionEvaluator.java b/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/DefaultPermissionEvaluator.java deleted file mode 100644 index c3d033d83..000000000 --- a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/DefaultPermissionEvaluator.java +++ /dev/null @@ -1,110 +0,0 @@ -package org.apache.archiva.redback.authorization.rbac.evaluator; - -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import org.apache.archiva.redback.rbac.Resource; -import org.apache.archiva.redback.users.UserManager; -import org.apache.archiva.redback.users.UserManagerException; -import org.apache.archiva.redback.users.UserNotFoundException; -import org.apache.archiva.redback.rbac.Permission; -import org.springframework.stereotype.Service; - -import javax.inject.Inject; -import javax.inject.Named; - -/** - * DefaultPermissionEvaluator: - *

- * Currently only one expression is available for evaluation, ${username} will be replaced with the username - * of the person making the authorization check - * - * @author Jesse McConnell - */ -@Service("permissionEvaluator") -public class DefaultPermissionEvaluator - implements PermissionEvaluator -{ - @Inject - @Named(value = "userManager#configurable") - private UserManager userManager; - - public boolean evaluate( Permission permission, String operation, String resource, String principal ) - throws PermissionEvaluationException - { - String permissionResource = permission.getResource().getIdentifier(); - - // expression evaluation checking - if ( permissionResource.startsWith( "${" ) ) - { - String tempStr = permissionResource.substring( 2, permissionResource.indexOf( '}' ) ); - - if ( "username".equals( tempStr ) ) - { - try - { - permissionResource = userManager.findUser( principal ).getUsername(); - } - catch ( UserNotFoundException e ) - { - throw new PermissionEvaluationException( "unable to locate user to retrieve username", e ); - } - catch ( UserManagerException e ) - { - throw new PermissionEvaluationException( "trouble finding user: " + e.getMessage(), e ); - } - } - } - - // check if this permission applies to the operation at all - if ( permission.getOperation().getName().equals( operation ) ) - { - // check if it is a global resource, if it is then since the operations match we return true - if ( Resource.GLOBAL.equals( permission.getResource().getIdentifier() ) ) - { - return true; - } - - // if we are not checking a specific resource, the operation is enough - if ( resource == null ) - { - return true; - } - - // check if the resource identifier of the permission matches the resource we are checking against - // if it does then return true - if ( permissionResource.equals( resource ) ) - { - return true; - } - } - - return false; - } - - public UserManager getUserManager() - { - return userManager; - } - - public void setUserManager( UserManager userManager ) - { - this.userManager = userManager; - } -} diff --git a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluationException.java b/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluationException.java deleted file mode 100644 index 15d4c8361..000000000 --- a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluationException.java +++ /dev/null @@ -1,41 +0,0 @@ -package org.apache.archiva.redback.authorization.rbac.evaluator; - -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -/** - * PermissionEvaluationException: - * - * @author Jesse McConnell - * - */ -public class PermissionEvaluationException - extends Exception -{ - public PermissionEvaluationException( String string ) - { - super( string ); - } - - public PermissionEvaluationException( String string, Throwable throwable ) - { - super( string, throwable ); - } - -} diff --git a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluator.java b/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluator.java deleted file mode 100644 index 8dc0014a5..000000000 --- a/redback-rbac/redback-authorization-rbac/src/main/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluator.java +++ /dev/null @@ -1,35 +0,0 @@ -package org.apache.archiva.redback.authorization.rbac.evaluator; - -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import org.apache.archiva.redback.rbac.Permission; - - -/** - * PermissionEvaluator: - * - * @author Jesse McConnell - * - */ -public interface PermissionEvaluator -{ - boolean evaluate( Permission permission, String operation, String resource, String principal ) - throws PermissionEvaluationException; -} diff --git a/redback-rbac/redback-authorization-rbac/src/main/resources/META-INF/spring-context.xml b/redback-rbac/redback-authorization-rbac/src/main/resources/META-INF/spring-context.xml deleted file mode 100644 index 9a306403a..000000000 --- a/redback-rbac/redback-authorization-rbac/src/main/resources/META-INF/spring-context.xml +++ /dev/null @@ -1,34 +0,0 @@ - - - - - - - - - \ No newline at end of file diff --git a/redback-rbac/redback-authorization-rbac/src/test/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluatorTest.java b/redback-rbac/redback-authorization-rbac/src/test/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluatorTest.java deleted file mode 100644 index fdff955c9..000000000 --- a/redback-rbac/redback-authorization-rbac/src/test/java/org/apache/archiva/redback/authorization/rbac/evaluator/PermissionEvaluatorTest.java +++ /dev/null @@ -1,66 +0,0 @@ -package org.apache.archiva.redback.authorization.rbac.evaluator; - -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import junit.framework.TestCase; -import org.apache.archiva.redback.rbac.Permission; -import org.apache.archiva.redback.rbac.Operation; -import org.apache.archiva.redback.rbac.Resource; -import org.apache.archiva.redback.rbac.memory.MemoryOperation; -import org.apache.archiva.redback.rbac.memory.MemoryPermission; -import org.apache.archiva.redback.rbac.memory.MemoryResource; -import org.junit.Test; -import org.junit.runner.RunWith; -import org.springframework.test.context.ContextConfiguration; -import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; - -import javax.inject.Inject; - -@RunWith( SpringJUnit4ClassRunner.class ) -@ContextConfiguration( locations = { "classpath*:/META-INF/spring-context.xml", "classpath*:/spring-context.xml" } ) -public class PermissionEvaluatorTest - extends TestCase -{ - - @Inject - PermissionEvaluator permissionEvaluator; - - @Test - public void testNullResource() - throws PermissionEvaluationException - { - // null resources should be considered as matching if any resource is obtained. - // we do this instead of using "global" as that is the inverse - you are allocated global rights, - // which is right to everything. null is the right to anything. - - Resource resource = new MemoryResource(); - resource.setIdentifier( "Resource" ); - - Operation operation = new MemoryOperation(); - operation.setName( "Operation" ); - - Permission permission = new MemoryPermission(); - permission.setName( "Permission" ); - permission.setOperation( operation ); - permission.setResource( resource ); - - assertTrue( permissionEvaluator.evaluate( permission, "Operation", null, "brett" ) ); - } -} diff --git a/redback-rbac/redback-authorization-rbac/src/test/resources/spring-context.xml b/redback-rbac/redback-authorization-rbac/src/test/resources/spring-context.xml deleted file mode 100644 index 926b77aaa..000000000 --- a/redback-rbac/redback-authorization-rbac/src/test/resources/spring-context.xml +++ /dev/null @@ -1,47 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file