bug4754: started changing admin console permission checking

Change-Id: Id9b1bd290ec1cf46cfd26aada3f2db614bc6fc71

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java

@@ -101,7 +101,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
                 getWidget().fillEvents();
                 fillLeaderboardGroups();
             }
-        }, getStringMessages().events(), Permission.MANAGE_EVENTS);
+        }, getStringMessages().events()); // no permissions required; we show those events the user may read
         leaderboardGroupsDisplayers.add(eventManagementPanel);
         
         /* REGATTAS */
@@ -114,7 +114,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 fillRegattas();
             }
-        }, getStringMessages().regattas(), Permission.MANAGE_REGATTAS);
+        }, getStringMessages().regattas()); // no permissions required; we show those regattas the user may read
         regattasDisplayers.add(regattaManagementPanel);
         
         /* LEADERBOARDS */
@@ -128,7 +128,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 fillLeaderboards();
             }
-        }, getStringMessages().leaderboards(), Permission.MANAGE_LEADERBOARDS);
+        }, getStringMessages().leaderboards()); // no permissions required; we show those leaderboard the user may read
         regattasDisplayers.add(leaderboardConfigPanel);
         leaderboardsDisplayers.add(leaderboardConfigPanel);
 
@@ -147,7 +147,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
                 refreshAfterBecomingVisible(); //Refresh to sure that actual data is provided
                 setupLeaderboardGroups(leaderboardGroupConfigPanel, params);
             }
-        }, getStringMessages().leaderboardGroups(), Permission.MANAGE_LEADERBOARD_GROUPS);
+        }, getStringMessages().leaderboardGroups()); // no permissions required; we show those leaderboard groups the user may read
         regattasDisplayers.add(leaderboardGroupConfigPanel);
         leaderboardGroupsDisplayers.add(leaderboardGroupConfigPanel);
         leaderboardsDisplayers.add(leaderboardGroupConfigPanel);
@@ -165,7 +165,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 fillRegattas();
             }
-        }, getStringMessages().trackedRaces(), Permission.MANAGE_TRACKED_RACES);
+        }, getStringMessages().trackedRaces()); // no permissions required; we show those races the user may read
         regattasDisplayers.add(trackedRacesManagementPanel);
 
         final CompetitorPanel competitorPanel = new CompetitorPanel(getSailingService(), getStringMessages(), this);
@@ -175,7 +175,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 getWidget().refreshCompetitorList();
             }
-        }, getStringMessages().competitors(), Permission.MANAGE_ALL_COMPETITORS);
+        }, getStringMessages().competitors()); // no permissions required; we show those competitors the user may read
 
         final BoatPanel boatPanel = new BoatPanel(getSailingService(), getStringMessages(), this);
         boatPanel.ensureDebugId("BoatPanel");
@@ -184,17 +184,16 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 getWidget().refreshBoatList();
             }
-        }, getStringMessages().boats(), Permission.MANAGE_ALL_BOATS);
+        }, getStringMessages().boats()); // no permissions required; we show those boats the user may read
 
         RaceCourseManagementPanel raceCourseManagementPanel = new RaceCourseManagementPanel(getSailingService(), this, this, getStringMessages());
-        panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel<RaceCourseManagementPanel>(raceCourseManagementPanel), getStringMessages().courseLayout(), Permission.MANAGE_COURSE_LAYOUT);
+        panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel<RaceCourseManagementPanel>(raceCourseManagementPanel), getStringMessages().courseLayout());
         regattasDisplayers.add(raceCourseManagementPanel);
 
         final AsyncActionsExecutor asyncActionsExecutor = new AsyncActionsExecutor();
 
         WindPanel windPanel = new WindPanel(getSailingService(), asyncActionsExecutor, this, this, getStringMessages());
-        panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel<WindPanel>(windPanel), getStringMessages().wind(),
-                Permission.MANAGE_WIND);
+        panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel<WindPanel>(windPanel), getStringMessages().wind()); // no permissions required; we show those wind the user may read
         regattasDisplayers.add(windPanel);
 
         final MediaPanel mediaPanel = new MediaPanel(regattasDisplayers, getSailingService(), this, mediaService, this, getStringMessages());
@@ -203,7 +202,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 getWidget().onShow();
             }
-        }, getStringMessages().mediaPanel(), Permission.MANAGE_MEDIA);
+        }, getStringMessages().mediaPanel()); // no permissions required; we show those media the user may read
 
         /* RACE COMMITTEE APP */
 
@@ -211,7 +210,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
         final DeviceConfigurationUserPanel deviceConfigurationUserPanel = new DeviceConfigurationUserPanel(getSailingService(),
                 getUserService(), getStringMessages(), this);
         panel.addToTabPanel(raceCommitteeTabPanel, new DefaultRefreshableAdminConsolePanel<DeviceConfigurationUserPanel>(deviceConfigurationUserPanel),
-                getStringMessages().deviceConfiguration(), Permission.MANAGE_DEVICE_CONFIGURATION);
+                getStringMessages().deviceConfiguration()); // no permissions required; we show those device configurations the user may read
         
         /* CONNECTORS */
         
@@ -220,19 +219,19 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
                 this, this, getStringMessages());
         tractracEventManagementPanel.ensureDebugId("TracTracEventManagement");
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<TracTracEventManagementPanel>(tractracEventManagementPanel),
-                getStringMessages().tracTracEvents(), Permission.MANAGE_TRACKED_RACES);
+                getStringMessages().tracTracEvents()); // no permissions required; we show those TracTrac connector stuff the user may read
         regattasDisplayers.add(tractracEventManagementPanel);
         
         SwissTimingReplayConnectorPanel swissTimingReplayConnectorPanel = new SwissTimingReplayConnectorPanel(
                 getSailingService(), this, this, getStringMessages());
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<SwissTimingReplayConnectorPanel>(swissTimingReplayConnectorPanel),
-                getStringMessages().swissTimingArchiveConnector(), Permission.MANAGE_TRACKED_RACES);
+                getStringMessages().swissTimingArchiveConnector()); // no permissions required; we show those SwissTiming connector stuff the user may read
         regattasDisplayers.add(swissTimingReplayConnectorPanel);
 
         SwissTimingEventManagementPanel swisstimingEventManagementPanel = new SwissTimingEventManagementPanel(
                 getSailingService(), this, this, getStringMessages());
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<SwissTimingEventManagementPanel>(swisstimingEventManagementPanel),
-                getStringMessages().swissTimingEvents(), Permission.MANAGE_TRACKED_RACES);
+                getStringMessages().swissTimingEvents()); // no permissions required; we show those SwissTiming connector stuff the user may read
         regattasDisplayers.add(swisstimingEventManagementPanel);
 
         final SmartphoneTrackingEventManagementPanel raceLogTrackingEventManagementPanel = new SmartphoneTrackingEventManagementPanel(
@@ -243,7 +242,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 fillLeaderboards();
             }
-        }, getStringMessages().smartphoneTracking(), Permission.MANAGE_TRACKED_RACES);
+        }, getStringMessages().smartphoneTracking()); // no permissions required; we show those Smartphone connector stuff the user may read
         regattasDisplayers.add(raceLogTrackingEventManagementPanel);
         leaderboardsDisplayers.add(raceLogTrackingEventManagementPanel);
 
@@ -259,7 +258,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 expeditionDeviceConfigurationsPanel.refresh();
             }
-        }, getStringMessages().expeditionDeviceConfigurations(), Permission.MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS);
+        }, getStringMessages().expeditionDeviceConfigurations(), Permission.MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS); // TODO bug4754 use server name as type-relative object identifier
 
         ResultImportUrlsManagementPanel resultImportUrlsManagementPanel = new ResultImportUrlsManagementPanel(getSailingService(), this, getStringMessages());
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<ResultImportUrlsManagementPanel>(resultImportUrlsManagementPanel),
@@ -267,7 +266,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
         
         StructureImportManagementPanel structureImportUrlsManagementPanel = new StructureImportManagementPanel(getSailingService(), this, getStringMessages(), this, eventManagementPanel);
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<StructureImportManagementPanel>(structureImportUrlsManagementPanel),
-                getStringMessages().manage2Sail() + " " + getStringMessages().regattaStructureImport(), Permission.MANAGE_STRUCTURE_IMPORT_URLS);
+                getStringMessages().manage2Sail() + " " + getStringMessages().regattaStructureImport(), Permission.MANAGE_STRUCTURE_IMPORT_URLS); // TODO bug4754 use server name as type-relative object identifier
 
         /* ADVANCED */
         
@@ -279,21 +278,21 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 replicationPanel.updateReplicaList();
             }
-        }, getStringMessages().replication(), Permission.MANAGE_REPLICATION);
+        }, getStringMessages().replication(), Permission.MANAGE_REPLICATION); // TODO bug4754 use server name as type-relative object identifier
 
         final MasterDataImportPanel masterDataImportPanel = new MasterDataImportPanel(getStringMessages(), getSailingService(),
                 this, eventManagementPanel, this, this, mediaPanel);
         masterDataImportPanel.ensureDebugId("MasterDataImport");
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<MasterDataImportPanel>(masterDataImportPanel),
-                getStringMessages().masterDataImportPanel(), Permission.MANAGE_MASTERDATA_IMPORT);
+                getStringMessages().masterDataImportPanel(), Permission.MANAGE_MASTERDATA_IMPORT); // TODO bug4754 use server name as type-relative object identifier
 
         RemoteServerInstancesManagementPanel remoteServerInstancesManagementPanel = new RemoteServerInstancesManagementPanel(getSailingService(), this, getStringMessages());
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<RemoteServerInstancesManagementPanel>(remoteServerInstancesManagementPanel),
-                getStringMessages().remoteServerInstances(), Permission.MANAGE_SAILING_SERVER_INSTANCES);
+                getStringMessages().remoteServerInstances(), Permission.MANAGE_SAILING_SERVER_INSTANCES); // TODO bug4754 use server name as type-relative object identifier
 
         LocalServerManagementPanel localServerInstancesManagementPanel = new LocalServerManagementPanel(getSailingService(), this, getStringMessages());
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<LocalServerManagementPanel>(localServerInstancesManagementPanel),
-                getStringMessages().localServer(), Permission.MANAGE_LOCAL_SERVER_INSTANCE);
+                getStringMessages().localServer(), Permission.MANAGE_LOCAL_SERVER_INSTANCE); // TODO bug4754 use server name as type-relative object identifier
 
         final UserManagementPanel<AdminConsoleTableResources> userManagementPanel = new UserManagementPanel<>(getUserService(), StringMessages.INSTANCE,
                 Arrays.<com.sap.sse.security.shared.HasPermissions>asList(Permission.values()), this, tableResources);
@@ -303,7 +302,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
                     public void refreshAfterBecomingVisible() {
                         userManagementPanel.updateUsersAndACLs();
                     }
-                }, getStringMessages().userManagement(), Permission.MANAGE_USERS);
+                }, getStringMessages().userManagement()); // no permissions required; we show those users the user may read
 
         final RoleDefinitionsPanel roleManagementPanel = new RoleDefinitionsPanel(StringMessages.INSTANCE, getUserService().getUserManagementService(), 
                 tableResources, this);
@@ -313,7 +312,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
                     public void refreshAfterBecomingVisible() {
                         roleManagementPanel.updateRoleDefinitions();
                     }
-                }, getStringMessages().roles(), Permission.MANAGE_ROLES);
+                }, getStringMessages().roles()); // no permissions required; we show those roles the user may read
 
         final UserGroupManagementPanel userGroupManagementPanel = new UserGroupManagementPanel(getUserService(), StringMessages.INSTANCE);
         panel.addToTabPanel(advancedTabPanel,
@@ -322,17 +321,15 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
                     public void refreshAfterBecomingVisible() {
                         userGroupManagementPanel.updateUserGroupsAndUsers();
                     }
-                }, getStringMessages().userGroupManagement(), Permission.MANAGE_USERS);
+                }, getStringMessages().userGroupManagement()); // no permissions required; we show those user groups the user may read
 
         final FileStoragePanel fileStoragePanel = new FileStoragePanel(getSailingService(), this);
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<FileStoragePanel>(fileStoragePanel),
-                getStringMessages().fileStorage(), Permission.MANAGE_FILE_STORAGE);
-
+                getStringMessages().fileStorage(), Permission.MANAGE_FILE_STORAGE); // TODO bug4754 use server name as type-relative object identifier
         panel.initUI();
         fillRegattas();
         fillLeaderboardGroups();
         fillLeaderboards();
-        
         return panel;
     }
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java

@@ -63,6 +63,7 @@ import javax.servlet.http.HttpServletRequest;
 
 import org.apache.http.client.ClientProtocolException;
 import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authz.AuthorizationException;
 import org.apache.shiro.authz.UnauthorizedException;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.InvalidSyntaxException;
@@ -578,8 +579,8 @@ import com.sap.sse.replication.impl.ReplicaDescriptor;
 import com.sap.sse.security.SecurityService;
 import com.sap.sse.security.SessionUtils;
 import com.sap.sse.security.shared.AccessControlListAnnotation;
-import com.sap.sse.security.shared.OwnershipAnnotation;
 import com.sap.sse.security.shared.HasPermissions.DefaultModes;
+import com.sap.sse.security.shared.OwnershipAnnotation;
 import com.sap.sse.security.shared.SecurityUser;
 import com.sap.sse.security.shared.UserGroup;
 import com.sap.sse.security.ui.server.SecurityDTOFactory;
@@ -3950,26 +3951,31 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             Map<String, String> sailorsInfoWebsiteURLsByLocaleName, Iterable<ImageDTO> images, Iterable<VideoDTO> videos, 
             Iterable<UUID> leaderboardGroupIds, String tenantOwnerName)
             throws MalformedURLException, UnauthorizedException {
-        SecurityUtils.getSubject().checkPermission(Permission.EVENT.getStringPermission(DefaultModes.CREATE));
+        final EventDTO result;
         UUID eventUuid = UUID.randomUUID();
-        TimePoint startTimePoint = startDate != null ?  new MillisecondsTimePoint(startDate) : null;
-        TimePoint endTimePoint = endDate != null ?  new MillisecondsTimePoint(endDate) : null;
-        URL officialWebsiteURL = officialWebsiteURLAsString != null ? new URL(officialWebsiteURLAsString) : null;
-        URL baseURL = baseURLAsString != null ? new URL(baseURLAsString) : null;
-        Map<Locale, URL> sailorsInfoWebsiteURLs = convertToLocalesAndUrls(sailorsInfoWebsiteURLsByLocaleName);
-        
-        List<ImageDescriptor> eventImages = convertToImages(images);
-        List<VideoDescriptor> eventVideos = convertToVideos(videos);
-        getService().apply(
-                new CreateEvent(eventName, eventDescription, startTimePoint, endTimePoint, venue, isPublic, eventUuid,
-                        officialWebsiteURL, baseURL, sailorsInfoWebsiteURLs, eventImages, eventVideos, leaderboardGroupIds));
-        createCourseAreas(eventUuid, courseAreaNames.toArray(new String[courseAreaNames.size()]));
-        getSecurityService().createAccessControlList(Permission.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()), eventName);
         getSecurityService().createOwnership(Permission.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()),
                 getSecurityService().getUserByName((String) SecurityUtils.getSubject().getPrincipal()),
                 getSecurityService().getUserGroupByName(tenantOwnerName), eventName);
-        EventDTO result = getEventById(eventUuid, false);
-        return result;
+        try {
+            SecurityUtils.getSubject().checkPermission(Permission.EVENT.getStringPermissionForObjects(DefaultModes.CREATE, eventUuid.toString()));
+            TimePoint startTimePoint = startDate != null ?  new MillisecondsTimePoint(startDate) : null;
+            TimePoint endTimePoint = endDate != null ?  new MillisecondsTimePoint(endDate) : null;
+            URL officialWebsiteURL = officialWebsiteURLAsString != null ? new URL(officialWebsiteURLAsString) : null;
+            URL baseURL = baseURLAsString != null ? new URL(baseURLAsString) : null;
+            Map<Locale, URL> sailorsInfoWebsiteURLs = convertToLocalesAndUrls(sailorsInfoWebsiteURLsByLocaleName);
+            List<ImageDescriptor> eventImages = convertToImages(images);
+            List<VideoDescriptor> eventVideos = convertToVideos(videos);
+            getService().apply(
+                    new CreateEvent(eventName, eventDescription, startTimePoint, endTimePoint, venue, isPublic, eventUuid,
+                            officialWebsiteURL, baseURL, sailorsInfoWebsiteURLs, eventImages, eventVideos, leaderboardGroupIds));
+            createCourseAreas(eventUuid, courseAreaNames.toArray(new String[courseAreaNames.size()]));
+            result = getEventById(eventUuid, false);
+            return result;
+        } catch (AuthorizationException e) {
+            // revert ownership creation, then re-throw
+            getSecurityService().deleteOwnership(Permission.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()));
+            throw e;
+        }
     }
 
     @Override

java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java

@@ -351,10 +351,9 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * that panel
      * 
      * @param requiresAnyOfThesePermissions
-     *            zero or more permissions; if no permissions are provided, the user will never be able to see the
+     *            zero or more permissions; if no permissions are provided, the user will always be able to see the
      *            widget. Otherwise, if any of these permissions implies any of the permissions the user has, the user
-     *            will be shown the widget. In particular, a "*" wildcard permission will show the widget to all users,
-     *            regardless their actual permissions.
+     *            will be shown the widget.
      */
     private void remeberWidgetLocationAndPermissions(VerticalOrHorizontalTabLayoutPanel tabPanel, Widget widgetToAdd,
             String tabTitle, HasPermissions... requiresAnyOfThesePermissions) {
@@ -469,12 +468,20 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * is also implied.
      */
     private boolean userHasPermissionsToSeeWidget(UserDTO user, Widget widget) {
-        for (HasPermissions requiredStringPermission : permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget)) {
-            WildcardPermission requiredPermission = requiredStringPermission.getPermission();
-            if (PermissionChecker.isPermitted(requiredPermission, user, user.getUserGroups(), /* ownership */ null, /* acl */ null)) {
-                return true;
+        final Set<HasPermissions> permissionsRequired = permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget);
+        boolean hasPermission;
+        if (permissionsRequired.isEmpty()) {
+            hasPermission = true;
+        } else {
+            hasPermission = false;
+            for (HasPermissions requiredStringPermission : permissionsRequired) {
+                WildcardPermission requiredPermission = requiredStringPermission.getPermission();
+                if (PermissionChecker.isPermitted(requiredPermission, user, user.getUserGroups(), /* ownership */ null, /* acl */ null)) {
+                    hasPermission = true;
+                    break;
+                }
             }
         }
-        return false;
+        return hasPermission;
     }
 }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java

@@ -40,7 +40,7 @@ public interface UserManagementService extends RemoteService {
 
     AccessControlList removeFromACL(QualifiedObjectIdentifier idOfAccessControlledObject, String groupOrTenantIdAsString, String action) throws UnauthorizedException;
 
-    Collection<UserGroup> getUserGroups() throws UnauthorizedException;
+    Collection<UserGroup> getUserGroups();
 
     UserGroup getUserGroupByName(String userGroupName) throws UnauthorizedException;
 

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementServiceAsync.java

@@ -36,6 +36,9 @@ public interface UserManagementServiceAsync {
 
     void removeFromACL(QualifiedObjectIdentifier idOfAccessControlledObject, String permission, String name, AsyncCallback<AccessControlList> callback);
 
+    /**
+     * Returns those user groups the requesting user can read
+     */
     void getUserGroups(AsyncCallback<Collection<UserGroup>> callback);
     
     void getUserGroupByName(String userGroupName, AsyncCallback<UserGroup> callback);
@@ -48,6 +51,9 @@ public interface UserManagementServiceAsync {
 
     void removeUserFromUserGroup(String tenantIdAsString, String username, AsyncCallback<Void> asyncCallback);
 
+    /**
+     * Returns those users the requesting user can read
+     */
     void getUserList(AsyncCallback<Collection<UserDTO>> callback);
     
     void getUserByName(String username, AsyncCallback<UserDTO> callback);

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java

@@ -198,40 +198,38 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public Collection<UserGroup> getUserGroups() throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermission(DefaultModes.READ))) {
-            List<UserGroup> userGroups = new ArrayList<>();
-            final Map<SecurityUser, SecurityUser> fromOriginalToStrippedDownUser = new HashMap<>();
-            final Map<UserGroup, UserGroup> fromOriginalToStrippedDownUserGroup = new HashMap<>();
-            for (UserGroup g : getSecurityService().getUserGroupList()) {
+    public Collection<UserGroup> getUserGroups() {
+        List<UserGroup> userGroups = new ArrayList<>();
+        final Map<SecurityUser, SecurityUser> fromOriginalToStrippedDownUser = new HashMap<>();
+        final Map<UserGroup, UserGroup> fromOriginalToStrippedDownUserGroup = new HashMap<>();
+        for (UserGroup g : getSecurityService().getUserGroupList()) {
+            if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermissionForObjects(DefaultModes.READ, g.getId().toString()))) {
                 UserGroup userGroupDTO = securityDTOFactory.createUserGroupDTOFromUserGroup(g, fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup);
                 userGroups.add(userGroupDTO);
             }
-            return userGroups;
-        } else {
-            throw new UnauthorizedException("Not permitted to read user groups");
         }
+        return userGroups;
     }
 
     @Override
     public UserGroup getUserGroupByName(String userGroupName) throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermission(DefaultModes.READ))) {
-            final UserGroup userGroup = getSecurityService().getUserGroupByName(userGroupName);
+        final UserGroup userGroup = getSecurityService().getUserGroupByName(userGroupName);
+        if (userGroup == null || SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermissionForObjects(DefaultModes.READ, userGroup.getId().toString()))) {
             final Map<SecurityUser, SecurityUser> fromOriginalToStrippedDownUser = new HashMap<>();
             final Map<UserGroup, UserGroup> fromOriginalToStrippedDownUserGroup = new HashMap<>();
             return userGroup==null?null:securityDTOFactory.createUserGroupDTOFromUserGroup(userGroup, fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup);
         } else {
-            throw new UnauthorizedException("Not permitted to read user groups");
+            throw new UnauthorizedException("Not permitted to read user group "+userGroupName);
         }
     }
 
     @Override
     public UserDTO getUserByName(String username) throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermission(DefaultModes.READ))) {
-            final User user = getSecurityService().getUserByName(username);
+        final User user = getSecurityService().getUserByName(username);
+        if (user == null || SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermissionForObjects(DefaultModes.READ, user.getName()))) {
             return user==null?null:securityDTOFactory.createUserDTOFromUser(user, getSecurityService());
         } else {
-            throw new UnauthorizedException("Not permitted to read users");
+            throw new UnauthorizedException("Not permitted to read user "+username);
         }
     }
 
@@ -295,16 +293,14 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
 
     @Override
     public Collection<UserDTO> getUserList() throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermission(DefaultModes.READ))) {
-            List<UserDTO> users = new ArrayList<>();
-            for (User u : getSecurityService().getUserList()) {
+        List<UserDTO> users = new ArrayList<>();
+        for (User u : getSecurityService().getUserList()) {
+            if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermissionForObjects(DefaultModes.READ, u.getName()))) {
                 UserDTO userDTO = securityDTOFactory.createUserDTOFromUser(u, getSecurityService());
                 users.add(userDTO);
             }
-            return users;
-        } else {
-            throw new UnauthorizedException("Not permitted to manage users");
         }
+        return users;
     }
 
     @Override

java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java

@@ -88,7 +88,7 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
      * Same as {@link #createOwnership(String, UserImpl, Tenant, String)}, leaving the display name
      * of the object owned undefined.
      */
-    void createOwnership(QualifiedObjectIdentifier idOfOwnedObject, SecurityUser userOwner, UserGroup tenantOwner);
+    Ownership createOwnership(QualifiedObjectIdentifier idOfOwnedObject, SecurityUser userOwner, UserGroup tenantOwner);
 
     /**
      * @param idOfOwnedObject
@@ -104,7 +104,7 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
      *            as the object identified by {@link idOfOwnedObject} may change its name without notifying this
      *            store
      */
-    void createOwnership(QualifiedObjectIdentifier idOfOwnedObject, SecurityUser userOwner, UserGroup tenantOwner, String displayNameOfOwnedObject);
+    Ownership createOwnership(QualifiedObjectIdentifier idOfOwnedObject, SecurityUser userOwner, UserGroup tenantOwner, String displayNameOfOwnedObject);
 
     void deleteOwnership(QualifiedObjectIdentifier idOfOwnedObject);
 

java/com.sap.sse.security/src/com/sap/sse/security/impl/ReplicableSecurityService.java

@@ -4,6 +4,7 @@ import java.util.Set;
 import java.util.UUID;
 
 import com.sap.sse.security.SecurityService;
+import com.sap.sse.security.shared.Ownership;
 import com.sap.sse.security.shared.QualifiedObjectIdentifier;
 import com.sap.sse.security.shared.RoleDefinition;
 import com.sap.sse.security.shared.User;
@@ -31,7 +32,7 @@ public interface ReplicableSecurityService extends SecurityService {
     
     Void internalDeleteAcl(QualifiedObjectIdentifier idOfAccessControlledObject);
     
-    Void internalCreateOwnership(QualifiedObjectIdentifier idOfOwnedObject, String owningUsername, UUID tenantOwnerId, String displayNameOfOwnedObject);
+    Ownership internalCreateOwnership(QualifiedObjectIdentifier idOfOwnedObject, String owningUsername, UUID tenantOwnerId, String displayNameOfOwnedObject);
     
     Void internalDeleteOwnership(QualifiedObjectIdentifier idOfOwnedObject);
     

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -92,6 +92,7 @@ import com.sap.sse.security.shared.AccessControlList;
 import com.sap.sse.security.shared.AccessControlListAnnotation;
 import com.sap.sse.security.shared.Account.AccountType;
 import com.sap.sse.security.shared.AdminRole;
+import com.sap.sse.security.shared.Ownership;
 import com.sap.sse.security.shared.OwnershipAnnotation;
 import com.sap.sse.security.shared.QualifiedObjectIdentifier;
 import com.sap.sse.security.shared.Role;
@@ -442,12 +443,12 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
     }
 
     @Override
-    public void createOwnership(QualifiedObjectIdentifier idOfOwnedObjectAsString, SecurityUser userOwner, UserGroup tenantOwner) {
-        createOwnership(idOfOwnedObjectAsString, userOwner, tenantOwner, /* displayNameOfOwnedObject */ null);
+    public Ownership createOwnership(QualifiedObjectIdentifier idOfOwnedObjectAsString, SecurityUser userOwner, UserGroup tenantOwner) {
+        return createOwnership(idOfOwnedObjectAsString, userOwner, tenantOwner, /* displayNameOfOwnedObject */ null);
     }
 
     @Override
-    public void createOwnership(QualifiedObjectIdentifier idOfOwnedObjectAsString, SecurityUser userOwner, UserGroup tenantOwner, String displayNameOfOwnedObject) {
+    public Ownership createOwnership(QualifiedObjectIdentifier idOfOwnedObjectAsString, SecurityUser userOwner, UserGroup tenantOwner, String displayNameOfOwnedObject) {
         final UUID tenantId;
         if (tenantOwner == null || !tenantOwner.contains(userOwner)) {
             tenantId = userOwner == null || userOwner.getDefaultTenant() == null ? null : userOwner.getDefaultTenant().getId();
@@ -455,13 +456,12 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
             tenantId = tenantOwner.getId();
         }
         final String userOwnerName = userOwner == null ? null : userOwner.getName();
-        apply(s->s.internalCreateOwnership(idOfOwnedObjectAsString, userOwnerName, tenantId, displayNameOfOwnedObject));
+        return apply(s->s.internalCreateOwnership(idOfOwnedObjectAsString, userOwnerName, tenantId, displayNameOfOwnedObject));
     }
 
     @Override
-    public Void internalCreateOwnership(QualifiedObjectIdentifier idAsString, String userOwnerName, UUID tenantOwnerId, String displayName) {
-        accessControlStore.createOwnership(idAsString, getUserByName(userOwnerName), getUserGroup(tenantOwnerId), displayName);
-        return null;
+    public Ownership internalCreateOwnership(QualifiedObjectIdentifier idAsString, String userOwnerName, UUID tenantOwnerId, String displayName) {
+        return accessControlStore.createOwnership(idAsString, getUserByName(userOwnerName), getUserGroup(tenantOwnerId), displayName).getAnnotation();
     }
 
     @Override