diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java index 7817bdc6a65..871674d24c3 100644 --- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java +++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java @@ -17,16 +17,14 @@ import com.sap.sse.security.shared.HasPermissions.Action; import com.sap.sse.security.shared.impl.AccessControlList; import com.sap.sse.security.shared.impl.Ownership; import com.sap.sse.security.shared.impl.Role; +import com.sap.sse.security.shared.impl.User; import com.sap.sse.security.shared.impl.UserGroup; /** - * The {@link PermissionChecker} is an implementation of the permission checking algorithm also described in Permission - * Concept Wiki article. It checks permissions in four stages where earlier stages overwrite later. - * - * 1. Firstly, the data object's ACL is checked if it grants or explicitly revokes the permission. 2. Thereafter, the - * permissions directly assigned to the user are checked. 3. Finally the permissions implied by roles the user has are - * checked. This includes roles qualified by the group/user ownerships of the objetcs to which they are applied. + * The {@link PermissionChecker} is an implementation of the permission checking algorithm also described in the + * Concept Wiki article. It checks + * permissions in four stages where earlier stages overwrite later. See also + * {@link #isPermitted(WildcardPermission, SecurityUser, Iterable, SecurityUser, Iterable, AbstractOwnership, SecurityAccessControlList)}. * * @author Jonas Dann, Axel Uhl (d043530) */ @@ -92,6 +90,11 @@ public class PermissionChecker { } /** + * Like + * {@link #isPermitted(WildcardPermission, SecurityUser, Iterable, SecurityUser, Iterable, AbstractOwnership, SecurityAccessControlList)}, + * determining the groups of the {@code user} and the {@code allUser} through {@link User#getUserGroups()}. See also + * {@link #getGroupsOfUser(SecurityUser)}. + * * @param permission * Permission of the form "data_object_type:action:instance_id". The instance id can be omitted when a * general permission for the data object type is asked after (e.g. "event:create"). If the action @@ -109,6 +112,25 @@ public class PermissionChecker { } /** + * The following checks are performed. If a step cannot decide authoritatively, the preliminary result remains as + * {@link PermissionState#NONE}, and the subsequent steps are performed to find the result. If a step computes a + * non-{@code NONE} result, it is returned. + *
    + *
  1. ACL check (see {@link #checkAcl(WildcardPermission, Iterable, Iterable, SecurityAccessControlList)}): If the + * object's {@code acl} passed to this method explicitly allows or denies access to the {@code user}'s group or to + * the {@code allUser}'s group then this is the result.
    2. + *
  2. User permissions (see {@link User#getPermissions()}): If any of the explicit permissions assigned to the + * {@code user} or the {@code allUser} passed to this method match or imply the {@code permission} requested, the + * result is {@link PermissionState#GRANTED}, leading to {@code true} being returned.
    3. + *
  3. If an {@code ownership} exists for the object being accessed and has a valid group ownership, that group's + * roles are evaluated; if any of those roles implies the {@code permission} requested to the users of that group + * and the {@code user} or the {@code allUser} belongs to that group, or if the role implies the {@code permission} + * requested to all users, the result is {@link PermissionState#GRANTED}, and {@code true} will be returned.
    4. + *
  4. If any of the roles assigned to the {@code user} or the {@code allUser}---considering their optional user/group + * qualificiations based on the {@code ownership}---implies the {@code permission} requested, the result is + * {@link PermissionState#GRANTED}, and {@code true} will be returned.
    5. + *
+ * * @param permission * Permission of the form "data_object_type:action:instance_id". The instance id can be omitted when a * general permission for the data object type is asked after (e.g. "event:create"). If the action @@ -461,16 +483,22 @@ public class PermissionChecker { } /** + * Like + * {@link #isPermitted(WildcardPermission, SecurityUser, Iterable, SecurityUser, Iterable, AbstractOwnership, SecurityAccessControlList)}, + * only without the ACL check. As a matter of fact, this method is being used by + * {@link #isPermitted(WildcardPermission, SecurityUser, Iterable, SecurityUser, Iterable, AbstractOwnership, SecurityAccessControlList)} + * for all but the ACL check. + * * @param permissionChecker * The permissionChecker is the one that checks if one permission implies another permission. This means, * it just calls {@link WildcardPermission#implies(WildcardPermission)} in most cases. In case of an any * check this needs to call {@link WildcardPermission#impliesAny(WildcardPermission)). * @param matchOnlyNonQualifiedRolesIfNoOwnershipIsGiven * If {@code false} and no ownership is given, all associated {@link Role Roles} of a user are checked. - * For a normal permission check, this needs to be {@code true}, because qualified {@link Role Roles} - * can not grant unqualified permissions. In case of an any check it is necessary to include all - * qualified roles of an user, because even a qualified {@link Role} may grant any of the included - * permissions. in this case, the parameter is intended to be {@code false}. + * For a normal permission check, this needs to be {@code true}, because qualified {@link Role Roles} can + * not grant unqualified permissions. In case of an any check it is necessary to include all qualified + * roles of an user, because even a qualified {@link Role} may grant any of the included permissions. in + * this case, the parameter is intended to be {@code false}. */ private static , O extends AbstractOwnership, UR extends UserReference, U extends SecurityUser, G extends SecurityUserGroup, A extends SecurityAccessControlList> PermissionState checkUserPermissions(