eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-13 22:15:26 +00:00
Code Activity

bug5239: moved AclResolver implementation from SecurityServiceImpl into separate class

Browse Source
This commit is contained in:
Axel Uhl committed 2020-07-31 17:05:21 +02:00
1 parent 5212794d0e
commit 027fb64b01
2 files changed
+59 -37
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceAclResolver.java
Executable
+56
View File
@@ -0,0 +1,56 @@
package com.sap.sse.security.impl;
import java.util.HashSet;
import java.util.Set;
import com.sap.sse.common.Util;
import com.sap.sse.security.interfaces.AccessControlStore;
import com.sap.sse.security.shared.AccessControlListAnnotation;
import com.sap.sse.security.shared.OwnershipAnnotation;
import com.sap.sse.security.shared.PermissionChecker.AclResolver;
import com.sap.sse.security.shared.impl.AccessControlList;
import com.sap.sse.security.shared.impl.Ownership;
import com.sap.sse.security.shared.impl.User;
import com.sap.sse.security.shared.impl.UserGroup;
// TODO Bug 5239: a more efficient implementation is possible using reverse mappings in AccessControlStore
public class SecurityServiceAclResolver implements AclResolver<AccessControlList, Ownership> {
private final AccessControlStore accessControlStore;
SecurityServiceAclResolver(AccessControlStore accessControlStore) {
this.accessControlStore = accessControlStore;
}
@Override
public Iterable<AccessControlList> resolveAcls(
Ownership ownership, String type, Iterable<String> objectIdentifiersAsString) {
final Set<AccessControlList> result = new HashSet<>();
for (AccessControlListAnnotation annotation : accessControlStore.getAccessControlLists()) {
// TODO bug5239: introduce shadow hash maps for ACLs that map by object type
if (!annotation.getIdOfAnnotatedObject().getTypeIdentifier().equals(type)) {
continue;
}
// TODO bug5239: if object IDs are provided, ACLs should be looked up straight from the combination of type and object ID through accessControlStore.getAccessControlList(QualifiedObjectIdentifier)
if (objectIdentifiersAsString != null && !Util.contains(objectIdentifiersAsString, annotation.getIdOfAnnotatedObject().getTypeRelativeObjectIdentifier().toString())) {
continue;
}
// If ownership is given, we can exclude objects not owned by the user or group
// TODO bug5239: introduce shadow hash maps for ACLs that map by ownership
if (ownership != null) {
final OwnershipAnnotation ownershipOfObject = accessControlStore.getOwnership(annotation.getIdOfAnnotatedObject());
if (ownershipOfObject != null) {
final User userOwner = ownership.getUserOwner();
final UserGroup tenantOwner = ownership.getTenantOwner();
if (!(userOwner != null && userOwner
.equals(ownershipOfObject.getAnnotation().getUserOwner()))
&& !(tenantOwner != null && tenantOwner.equals(
ownershipOfObject.getAnnotation().getTenantOwner()))) {
continue;
}
}
}
result.add(annotation.getAnnotation());
}
return result;
}
}
java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
+3 -37
View File
@@ -238,42 +238,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
private final transient Set<SecurityInitializationCustomizer> customizers = ConcurrentHashMap.newKeySet();
// TODO Bug 5239: a more efficient implementation is possible using reverse mappings in AccessControlStore
private AclResolver<AccessControlList, Ownership> aclResolver = new AclResolver<AccessControlList, Ownership>() {
@Override
public Iterable<AccessControlList> resolveAcls(
Ownership ownership, String type, Iterable<String> objectIdentifiersAsString) {
final Set<AccessControlList> result = new HashSet<>();
for (AccessControlListAnnotation annotation : accessControlStore.getAccessControlLists()) {
// TODO bug5239: introduce shadow hash maps for ACLs that map by object type
if (!annotation.getIdOfAnnotatedObject().getTypeIdentifier().equals(type)) {
continue;
}
// TODO bug5239: if object IDs are provided, ACLs should be looked up straight from the combination of type and object ID through accessControlStore.getAccessControlList(QualifiedObjectIdentifier)
if (objectIdentifiersAsString != null && !Util.contains(objectIdentifiersAsString, annotation.getIdOfAnnotatedObject().getTypeRelativeObjectIdentifier().toString())) {
continue;
}
// If ownership is given, we can exclude objects not owned by the user or group
// TODO bug5239: introduce shadow hash maps for ACLs that map by ownership
if (ownership != null) {
final OwnershipAnnotation ownershipOfObject = accessControlStore
.getOwnership(annotation.getIdOfAnnotatedObject());
if (ownershipOfObject != null) {
final User userOwner = ownership.getUserOwner();
final UserGroup tenantOwner = ownership.getTenantOwner();
if (!(userOwner != null && userOwner
.equals(ownershipOfObject.getAnnotation().getUserOwner()))
&& !(tenantOwner != null && tenantOwner.equals(
ownershipOfObject.getAnnotation().getTenantOwner()))) {
continue;
}
}
}
result.add(annotation.getAnnotation());
}
return result;
}
};
private final AclResolver<AccessControlList, Ownership> aclResolver;
static {
shiroConfiguration = new Ini();
@@ -349,8 +314,9 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
logger.info("Created: " + securityManager);
SecurityUtils.setSecurityManager(securityManager);
this.securityManager = securityManager;
aclResolver = new SecurityServiceAclResolver(accessControlStore);
}
private ReplicatingCacheManager loadReplicationCacheManagerContents() {
logger.info("Loading session cache manager contents");
int count = 0;