replaced UserRoles.adminitsrator by DefaultRoles.ADMIN

java/com.sap.sailing.gwt.ui/META-INF/MANIFEST.MF

@@ -45,7 +45,8 @@ Require-Bundle: com.sap.sailing.domain,
  com.sap.sse.operationaltransformation,
  com.sap.sse,
  com.sap.sse.security.common,
- com.sap.sse.filestorage
+ com.sap.sse.filestorage,
+ org.apache.shiro.core;bundle-version="1.2.2"
 Bundle-Activator: com.sap.sailing.gwt.ui.server.Activator
 Bundle-ActivationPolicy: lazy
 Import-Package: com.sap.sailing.polars,

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/SailingAdminConsoleFeatures.java

@@ -2,26 +2,27 @@ package com.sap.sailing.gwt.ui.adminconsole;
 
 import com.sap.sailing.gwt.ui.usermanagement.UserRoles;
 import com.sap.sse.gwt.adminconsole.AdminConsoleFeatures;
+import com.sap.sse.security.shared.DefaultRoles;
 
 public interface SailingAdminConsoleFeatures {
-    final AdminConsoleFeatures MANAGE_EVENTS = new AdminConsoleFeatures("MANAGE_EVENTS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_REGATTAS = new AdminConsoleFeatures("MANAGE_REGATTAS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_TRACKED_RACES = new AdminConsoleFeatures("MANAGE_TRACKED_RACES", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures SHOW_TRACKED_RACES = new AdminConsoleFeatures("SHOW_TRACKED_RACES", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_RACELOG_TRACKING = new AdminConsoleFeatures("MANAGE_RACELOG_TRACKING", UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_ALL_COMPETITORS = new AdminConsoleFeatures("MANAGE_ALL_COMPETITORS", UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_COURSE_LAYOUT = new AdminConsoleFeatures("MANAGE_COURSE_LAYOUT", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_WIND = new AdminConsoleFeatures("MANAGE_WIND", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_IGTIMI_ACCOUNTS = new AdminConsoleFeatures("MANAGE_IGTIMI_ACCOUNTS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_LEADERBOARDS = new AdminConsoleFeatures("MANAGE_LEADERBOARDS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_LEADERBOARD_GROUPS = new AdminConsoleFeatures("MANAGE_LEADERBOARD_GROUPS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_RESULT_IMPORT_URLS = new AdminConsoleFeatures("MANAGE_RESULT_IMPORT_URLS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_STRUCTURE_IMPORT_URLS = new AdminConsoleFeatures("MANAGE_STRUCTURE_IMPORT_URLS", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_MEDIA = new AdminConsoleFeatures("MANAGE_MEDIA", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_SAILING_SERVER_INSTANCES = new AdminConsoleFeatures("MANAGE_SAILING_SERVER_INSTANCES", UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_REPLICATION = new AdminConsoleFeatures("MANAGE_REPLICATION", UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_MASTERDATA_IMPORT = new AdminConsoleFeatures("MANAGE_MASTERDATA_IMPORT", UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_DEVICE_CONFIGURATION = new AdminConsoleFeatures("MANAGE_DEVICE_CONFIGURATION", UserRoles.eventmanager.getRolename(), UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_USERS = new AdminConsoleFeatures("MANAGE_USERS", UserRoles.administrator.getRolename());
-    final AdminConsoleFeatures MANAGE_FILE_STORAGE = new AdminConsoleFeatures("MANAGE_FILE_STORAGE", UserRoles.administrator.getRolename());
+    final AdminConsoleFeatures MANAGE_EVENTS = new AdminConsoleFeatures("MANAGE_EVENTS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_REGATTAS = new AdminConsoleFeatures("MANAGE_REGATTAS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_TRACKED_RACES = new AdminConsoleFeatures("MANAGE_TRACKED_RACES", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures SHOW_TRACKED_RACES = new AdminConsoleFeatures("SHOW_TRACKED_RACES", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_RACELOG_TRACKING = new AdminConsoleFeatures("MANAGE_RACELOG_TRACKING", DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_ALL_COMPETITORS = new AdminConsoleFeatures("MANAGE_ALL_COMPETITORS", DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_COURSE_LAYOUT = new AdminConsoleFeatures("MANAGE_COURSE_LAYOUT", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_WIND = new AdminConsoleFeatures("MANAGE_WIND", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_IGTIMI_ACCOUNTS = new AdminConsoleFeatures("MANAGE_IGTIMI_ACCOUNTS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_LEADERBOARDS = new AdminConsoleFeatures("MANAGE_LEADERBOARDS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_LEADERBOARD_GROUPS = new AdminConsoleFeatures("MANAGE_LEADERBOARD_GROUPS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_RESULT_IMPORT_URLS = new AdminConsoleFeatures("MANAGE_RESULT_IMPORT_URLS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_STRUCTURE_IMPORT_URLS = new AdminConsoleFeatures("MANAGE_STRUCTURE_IMPORT_URLS", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_MEDIA = new AdminConsoleFeatures("MANAGE_MEDIA", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_SAILING_SERVER_INSTANCES = new AdminConsoleFeatures("MANAGE_SAILING_SERVER_INSTANCES", DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_REPLICATION = new AdminConsoleFeatures("MANAGE_REPLICATION", DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_MASTERDATA_IMPORT = new AdminConsoleFeatures("MANAGE_MASTERDATA_IMPORT", DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_DEVICE_CONFIGURATION = new AdminConsoleFeatures("MANAGE_DEVICE_CONFIGURATION", UserRoles.eventmanager.getRolename(), DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_USERS = new AdminConsoleFeatures("MANAGE_USERS", DefaultRoles.ADMIN.getRolename());
+    final AdminConsoleFeatures MANAGE_FILE_STORAGE = new AdminConsoleFeatures("MANAGE_FILE_STORAGE", DefaultRoles.ADMIN.getRolename());
 }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManagerComponent.java

@@ -49,6 +49,7 @@ import com.sap.sse.gwt.client.player.Timer.PlayModes;
 import com.sap.sse.gwt.client.player.Timer.PlayStates;
 import com.sap.sse.gwt.client.useragent.UserAgentDetails;
 import com.sap.sse.gwt.client.useragent.UserAgentDetails.AgentTypes;
+import com.sap.sse.security.shared.DefaultRoles;
 import com.sap.sse.security.ui.client.UserService;
 import com.sap.sse.security.ui.shared.UserDTO;
 
@@ -478,7 +479,7 @@ public class MediaPlayerManagerComponent implements Component<Void>, PlayStateLi
         };
         final VideoSynchPlayer videoPlayer;
         final UserDTO currentUser = userService.getCurrentUser();
-        boolean showSynchControls = currentUser != null && (currentUser.hasRole(UserRoles.administrator.getRolename()) ||
+        boolean showSynchControls = currentUser != null && (currentUser.hasRole(DefaultRoles.ADMIN.getRolename()) ||
                 currentUser.hasRole(UserRoles.eventmanager.getRolename()) || currentUser.hasRole(UserRoles.mediaeditor.getRolename()));
         if (videoTrack.isYoutube()) {
             videoPlayer = new VideoYoutubePlayer(videoTrack, getRaceStartTime(), showSynchControls, raceTimer);

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/security/Permissions.java

@@ -0,0 +1,5 @@
+package com.sap.sailing.gwt.ui.server.security;
+
+public enum Permissions {
+
+}

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/security/Roles.java

@@ -0,0 +1,18 @@
+package com.sap.sailing.gwt.ui.server.security;
+
+import com.sap.sse.security.shared.Role;
+
+public enum Roles implements Role {
+    EVENT_MANAGER("event_manager");
+
+    private Roles(String rolename) {
+        this.rolename = rolename;
+    }
+    
+    @Override
+    public String getRolename() {
+        return rolename;
+    }
+    
+    private final String rolename;
+}

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/security/SailingPermissionsForRoleProvider.java

@@ -0,0 +1,23 @@
+package com.sap.sailing.gwt.ui.server.security;
+
+import java.util.Collections;
+
+import org.apache.shiro.authz.Permission;
+import org.apache.shiro.authz.permission.WildcardPermission;
+
+import com.sap.sse.security.PermissionsForRoleProvider;
+import com.sap.sse.security.shared.DefaultRoles;
+
+public class SailingPermissionsForRoleProvider implements PermissionsForRoleProvider {
+    @Override
+    public Iterable<Permission> getPermissions(String role) {
+        final Iterable<Permission> result;
+        if (DefaultRoles.ADMIN.getRolename().equals(role)) {
+            return Collections.<Permission>singletonList(new WildcardPermission("*"));
+        } else {
+            result = Collections.emptyList();
+        }
+        return result;
+    }
+
+}

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/usermanagement/UserRoles.java

@@ -1,9 +1,6 @@
 package com.sap.sailing.gwt.ui.usermanagement;
 
-import com.sap.sse.security.shared.DefaultRoles;
-
 public enum UserRoles {
-    administrator(DefaultRoles.ADMIN.getRolename()),
     spectator("spectator"),
     moderator("moderator"),
     sailor("sailor"),

java/com.sap.sailing.gwt.ui/src/main/resources/shiro.ini

@@ -12,10 +12,14 @@ credentialsMatcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher
 credentialsMatcher.storedCredentialsHexEncoded = false
 credentialsMatcher.hashIterations = 1024
 
+permissionsForRoleProvider = com.sap.sailing.gwt.ui.server.security.SailingPermissionsForRoleProvider
 upRealm = com.sap.sse.security.UsernamePasswordRealm
 upRealm.credentialsMatcher = $credentialsMatcher
+upRealm.permissionsForRoleProvider = $permissionsForRoleProvider
 oauthRealm = com.sap.sse.security.OAuthRealm
+oauthRealm.permissionsForRoleProvider = $permissionsForRoleProvider
 accessTokenRealm = com.sap.sse.security.AccessTokenRealm
+accessTokenRealm.permissionsForRoleProvider = $permissionsForRoleProvider
 
 securityManager.realms = $upRealm, $oauthRealm, $accessTokenRealm
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/DefaultRoles.java

@@ -1,12 +1,13 @@
 package com.sap.sse.security.shared;
 
-public enum DefaultRoles {
+public enum DefaultRoles implements Role {
     ADMIN("admin");
     
     private DefaultRoles(String rolename) {
         this.rolename = rolename;
     }
     
+    @Override
     public String getRolename() {
         return rolename;
     }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/Role.java

@@ -0,0 +1,9 @@
+package com.sap.sse.security.shared;
+
+public interface Role {
+    String getRolename();
+
+    String name();
+
+    int ordinal();
+}

java/com.sap.sse.security/src/com/sap/sse/security/AbstractUserStoreBasedRealm.java

@@ -11,6 +11,7 @@ import java.util.logging.Logger;
 
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authz.AuthorizationInfo;
+import org.apache.shiro.authz.Permission;
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
@@ -24,6 +25,7 @@ import com.sap.sse.security.shared.UserManagementException;
 public abstract class AbstractUserStoreBasedRealm extends AuthorizingRealm {
     private static final Logger logger = Logger.getLogger(AbstractUserStoreBasedRealm.class.getName());
     private final Future<UserStore> userStore;
+    private PermissionsForRoleProvider permissionsForRoleProvider;
 
     /**
      * In a non-OSGi test environment, having Shiro instantiate this class with a default constructor makes it difficult
@@ -46,6 +48,10 @@ public abstract class AbstractUserStoreBasedRealm extends AuthorizingRealm {
             userStore = null;
         }
     }
+    
+    public void setPermissionsForRoleProvider(PermissionsForRoleProvider permissionsForRoleProvider) {
+        this.permissionsForRoleProvider = permissionsForRoleProvider;
+    }
 
     private Future<UserStore> createUserStoreFuture(BundleContext bundleContext) {
         final ServiceTracker<UserStore, UserStore> tracker = new ServiceTracker<>(bundleContext, UserStore.class, /* customizer */ null);
@@ -101,6 +107,13 @@ public abstract class AbstractUserStoreBasedRealm extends AuthorizingRealm {
             String username = r.toString();
             try {
                 Util.addAll(getUserStore().getRolesFromUser(username), roles);
+                if (permissionsForRoleProvider != null) {
+                    for (String role : roles) {
+                        for (Permission permission : permissionsForRoleProvider.getPermissions(role)) {
+                            ai.addObjectPermission(permission);
+                        }
+                    }
+                }
                 Util.addAll(getUserStore().getPermissionsFromUser(username), permissions);
             } catch (UserManagementException e) {
                throw new AuthenticationException(e.getMessage());

java/com.sap.sse.security/src/com/sap/sse/security/PermissionsForRoleProvider.java

@@ -0,0 +1,14 @@
+package com.sap.sse.security;
+
+import org.apache.shiro.authz.Permission;
+
+/**
+ * Roles can imply permissions. For example, an application may define that the role "admin" can do everything by
+ * returning a "*" permission from {@link #getPermissions(String)}.
+ * 
+ * @author Axel Uhl (D043530)
+ *
+ */
+public interface PermissionsForRoleProvider {
+    Iterable<Permission> getPermissions(String role);
+}