diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java index 5615d2152fd..07e29893c93 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java @@ -101,7 +101,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements getWidget().fillEvents(); fillLeaderboardGroups(); } - }, getStringMessages().events(), Permission.MANAGE_EVENTS); + }, getStringMessages().events()); // no permissions required; we show those events the user may read leaderboardGroupsDisplayers.add(eventManagementPanel); /* REGATTAS */ @@ -114,7 +114,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { fillRegattas(); } - }, getStringMessages().regattas(), Permission.MANAGE_REGATTAS); + }, getStringMessages().regattas()); // no permissions required; we show those regattas the user may read regattasDisplayers.add(regattaManagementPanel); /* LEADERBOARDS */ @@ -128,7 +128,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { fillLeaderboards(); } - }, getStringMessages().leaderboards(), Permission.MANAGE_LEADERBOARDS); + }, getStringMessages().leaderboards()); // no permissions required; we show those leaderboard the user may read regattasDisplayers.add(leaderboardConfigPanel); leaderboardsDisplayers.add(leaderboardConfigPanel); @@ -147,7 +147,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements refreshAfterBecomingVisible(); //Refresh to sure that actual data is provided setupLeaderboardGroups(leaderboardGroupConfigPanel, params); } - }, getStringMessages().leaderboardGroups(), Permission.MANAGE_LEADERBOARD_GROUPS); + }, getStringMessages().leaderboardGroups()); // no permissions required; we show those leaderboard groups the user may read regattasDisplayers.add(leaderboardGroupConfigPanel); leaderboardGroupsDisplayers.add(leaderboardGroupConfigPanel); leaderboardsDisplayers.add(leaderboardGroupConfigPanel); @@ -165,7 +165,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { fillRegattas(); } - }, getStringMessages().trackedRaces(), Permission.MANAGE_TRACKED_RACES); + }, getStringMessages().trackedRaces()); // no permissions required; we show those races the user may read regattasDisplayers.add(trackedRacesManagementPanel); final CompetitorPanel competitorPanel = new CompetitorPanel(getSailingService(), getStringMessages(), this); @@ -175,7 +175,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { getWidget().refreshCompetitorList(); } - }, getStringMessages().competitors(), Permission.MANAGE_ALL_COMPETITORS); + }, getStringMessages().competitors()); // no permissions required; we show those competitors the user may read final BoatPanel boatPanel = new BoatPanel(getSailingService(), getStringMessages(), this); boatPanel.ensureDebugId("BoatPanel"); @@ -184,17 +184,16 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { getWidget().refreshBoatList(); } - }, getStringMessages().boats(), Permission.MANAGE_ALL_BOATS); + }, getStringMessages().boats()); // no permissions required; we show those boats the user may read RaceCourseManagementPanel raceCourseManagementPanel = new RaceCourseManagementPanel(getSailingService(), this, this, getStringMessages()); - panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel(raceCourseManagementPanel), getStringMessages().courseLayout(), Permission.MANAGE_COURSE_LAYOUT); + panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel(raceCourseManagementPanel), getStringMessages().courseLayout()); regattasDisplayers.add(raceCourseManagementPanel); final AsyncActionsExecutor asyncActionsExecutor = new AsyncActionsExecutor(); WindPanel windPanel = new WindPanel(getSailingService(), asyncActionsExecutor, this, this, getStringMessages()); - panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel(windPanel), getStringMessages().wind(), - Permission.MANAGE_WIND); + panel.addToTabPanel(racesTabPanel, new DefaultRefreshableAdminConsolePanel(windPanel), getStringMessages().wind()); // no permissions required; we show those wind the user may read regattasDisplayers.add(windPanel); final MediaPanel mediaPanel = new MediaPanel(regattasDisplayers, getSailingService(), this, mediaService, this, getStringMessages()); @@ -203,7 +202,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { getWidget().onShow(); } - }, getStringMessages().mediaPanel(), Permission.MANAGE_MEDIA); + }, getStringMessages().mediaPanel()); // no permissions required; we show those media the user may read /* RACE COMMITTEE APP */ @@ -211,7 +210,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements final DeviceConfigurationUserPanel deviceConfigurationUserPanel = new DeviceConfigurationUserPanel(getSailingService(), getUserService(), getStringMessages(), this); panel.addToTabPanel(raceCommitteeTabPanel, new DefaultRefreshableAdminConsolePanel(deviceConfigurationUserPanel), - getStringMessages().deviceConfiguration(), Permission.MANAGE_DEVICE_CONFIGURATION); + getStringMessages().deviceConfiguration()); // no permissions required; we show those device configurations the user may read /* CONNECTORS */ @@ -220,19 +219,19 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements this, this, getStringMessages()); tractracEventManagementPanel.ensureDebugId("TracTracEventManagement"); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(tractracEventManagementPanel), - getStringMessages().tracTracEvents(), Permission.MANAGE_TRACKED_RACES); + getStringMessages().tracTracEvents()); // no permissions required; we show those TracTrac connector stuff the user may read regattasDisplayers.add(tractracEventManagementPanel); SwissTimingReplayConnectorPanel swissTimingReplayConnectorPanel = new SwissTimingReplayConnectorPanel( getSailingService(), this, this, getStringMessages()); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(swissTimingReplayConnectorPanel), - getStringMessages().swissTimingArchiveConnector(), Permission.MANAGE_TRACKED_RACES); + getStringMessages().swissTimingArchiveConnector()); // no permissions required; we show those SwissTiming connector stuff the user may read regattasDisplayers.add(swissTimingReplayConnectorPanel); SwissTimingEventManagementPanel swisstimingEventManagementPanel = new SwissTimingEventManagementPanel( getSailingService(), this, this, getStringMessages()); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(swisstimingEventManagementPanel), - getStringMessages().swissTimingEvents(), Permission.MANAGE_TRACKED_RACES); + getStringMessages().swissTimingEvents()); // no permissions required; we show those SwissTiming connector stuff the user may read regattasDisplayers.add(swisstimingEventManagementPanel); final SmartphoneTrackingEventManagementPanel raceLogTrackingEventManagementPanel = new SmartphoneTrackingEventManagementPanel( @@ -243,7 +242,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { fillLeaderboards(); } - }, getStringMessages().smartphoneTracking(), Permission.MANAGE_TRACKED_RACES); + }, getStringMessages().smartphoneTracking()); // no permissions required; we show those Smartphone connector stuff the user may read regattasDisplayers.add(raceLogTrackingEventManagementPanel); leaderboardsDisplayers.add(raceLogTrackingEventManagementPanel); @@ -259,7 +258,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { expeditionDeviceConfigurationsPanel.refresh(); } - }, getStringMessages().expeditionDeviceConfigurations(), Permission.MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS); + }, getStringMessages().expeditionDeviceConfigurations(), Permission.MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS); // TODO bug4754 use server name as type-relative object identifier ResultImportUrlsManagementPanel resultImportUrlsManagementPanel = new ResultImportUrlsManagementPanel(getSailingService(), this, getStringMessages()); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(resultImportUrlsManagementPanel), @@ -267,7 +266,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements StructureImportManagementPanel structureImportUrlsManagementPanel = new StructureImportManagementPanel(getSailingService(), this, getStringMessages(), this, eventManagementPanel); panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel(structureImportUrlsManagementPanel), - getStringMessages().manage2Sail() + " " + getStringMessages().regattaStructureImport(), Permission.MANAGE_STRUCTURE_IMPORT_URLS); + getStringMessages().manage2Sail() + " " + getStringMessages().regattaStructureImport(), Permission.MANAGE_STRUCTURE_IMPORT_URLS); // TODO bug4754 use server name as type-relative object identifier /* ADVANCED */ @@ -279,21 +278,21 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { replicationPanel.updateReplicaList(); } - }, getStringMessages().replication(), Permission.MANAGE_REPLICATION); + }, getStringMessages().replication(), Permission.MANAGE_REPLICATION); // TODO bug4754 use server name as type-relative object identifier final MasterDataImportPanel masterDataImportPanel = new MasterDataImportPanel(getStringMessages(), getSailingService(), this, eventManagementPanel, this, this, mediaPanel); masterDataImportPanel.ensureDebugId("MasterDataImport"); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(masterDataImportPanel), - getStringMessages().masterDataImportPanel(), Permission.MANAGE_MASTERDATA_IMPORT); + getStringMessages().masterDataImportPanel(), Permission.MANAGE_MASTERDATA_IMPORT); // TODO bug4754 use server name as type-relative object identifier RemoteServerInstancesManagementPanel remoteServerInstancesManagementPanel = new RemoteServerInstancesManagementPanel(getSailingService(), this, getStringMessages()); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(remoteServerInstancesManagementPanel), - getStringMessages().remoteServerInstances(), Permission.MANAGE_SAILING_SERVER_INSTANCES); + getStringMessages().remoteServerInstances(), Permission.MANAGE_SAILING_SERVER_INSTANCES); // TODO bug4754 use server name as type-relative object identifier LocalServerManagementPanel localServerInstancesManagementPanel = new LocalServerManagementPanel(getSailingService(), this, getStringMessages()); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(localServerInstancesManagementPanel), - getStringMessages().localServer(), Permission.MANAGE_LOCAL_SERVER_INSTANCE); + getStringMessages().localServer(), Permission.MANAGE_LOCAL_SERVER_INSTANCE); // TODO bug4754 use server name as type-relative object identifier final UserManagementPanel userManagementPanel = new UserManagementPanel<>(getUserService(), StringMessages.INSTANCE, Arrays.asList(Permission.values()), this, tableResources); @@ -303,7 +302,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { userManagementPanel.updateUsersAndACLs(); } - }, getStringMessages().userManagement(), Permission.MANAGE_USERS); + }, getStringMessages().userManagement()); // no permissions required; we show those users the user may read final RoleDefinitionsPanel roleManagementPanel = new RoleDefinitionsPanel(StringMessages.INSTANCE, getUserService().getUserManagementService(), tableResources, this); @@ -313,7 +312,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { roleManagementPanel.updateRoleDefinitions(); } - }, getStringMessages().roles(), Permission.MANAGE_ROLES); + }, getStringMessages().roles()); // no permissions required; we show those roles the user may read final UserGroupManagementPanel userGroupManagementPanel = new UserGroupManagementPanel(getUserService(), StringMessages.INSTANCE); panel.addToTabPanel(advancedTabPanel, @@ -322,17 +321,15 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements public void refreshAfterBecomingVisible() { userGroupManagementPanel.updateUserGroupsAndUsers(); } - }, getStringMessages().userGroupManagement(), Permission.MANAGE_USERS); + }, getStringMessages().userGroupManagement()); // no permissions required; we show those user groups the user may read final FileStoragePanel fileStoragePanel = new FileStoragePanel(getSailingService(), this); panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel(fileStoragePanel), - getStringMessages().fileStorage(), Permission.MANAGE_FILE_STORAGE); - + getStringMessages().fileStorage(), Permission.MANAGE_FILE_STORAGE); // TODO bug4754 use server name as type-relative object identifier panel.initUI(); fillRegattas(); fillLeaderboardGroups(); fillLeaderboards(); - return panel; } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java index 5593a035975..f8478b3331c 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java @@ -63,6 +63,7 @@ import javax.servlet.http.HttpServletRequest; import org.apache.http.client.ClientProtocolException; import org.apache.shiro.SecurityUtils; +import org.apache.shiro.authz.AuthorizationException; import org.apache.shiro.authz.UnauthorizedException; import org.osgi.framework.BundleContext; import org.osgi.framework.InvalidSyntaxException; @@ -578,8 +579,8 @@ import com.sap.sse.replication.impl.ReplicaDescriptor; import com.sap.sse.security.SecurityService; import com.sap.sse.security.SessionUtils; import com.sap.sse.security.shared.AccessControlListAnnotation; -import com.sap.sse.security.shared.OwnershipAnnotation; import com.sap.sse.security.shared.HasPermissions.DefaultModes; +import com.sap.sse.security.shared.OwnershipAnnotation; import com.sap.sse.security.shared.SecurityUser; import com.sap.sse.security.shared.UserGroup; import com.sap.sse.security.ui.server.SecurityDTOFactory; @@ -3950,26 +3951,31 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S Map sailorsInfoWebsiteURLsByLocaleName, Iterable images, Iterable videos, Iterable leaderboardGroupIds, String tenantOwnerName) throws MalformedURLException, UnauthorizedException { - SecurityUtils.getSubject().checkPermission(Permission.EVENT.getStringPermission(DefaultModes.CREATE)); + final EventDTO result; UUID eventUuid = UUID.randomUUID(); - TimePoint startTimePoint = startDate != null ? new MillisecondsTimePoint(startDate) : null; - TimePoint endTimePoint = endDate != null ? new MillisecondsTimePoint(endDate) : null; - URL officialWebsiteURL = officialWebsiteURLAsString != null ? new URL(officialWebsiteURLAsString) : null; - URL baseURL = baseURLAsString != null ? new URL(baseURLAsString) : null; - Map sailorsInfoWebsiteURLs = convertToLocalesAndUrls(sailorsInfoWebsiteURLsByLocaleName); - - List eventImages = convertToImages(images); - List eventVideos = convertToVideos(videos); - getService().apply( - new CreateEvent(eventName, eventDescription, startTimePoint, endTimePoint, venue, isPublic, eventUuid, - officialWebsiteURL, baseURL, sailorsInfoWebsiteURLs, eventImages, eventVideos, leaderboardGroupIds)); - createCourseAreas(eventUuid, courseAreaNames.toArray(new String[courseAreaNames.size()])); - getSecurityService().createAccessControlList(Permission.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()), eventName); getSecurityService().createOwnership(Permission.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()), getSecurityService().getUserByName((String) SecurityUtils.getSubject().getPrincipal()), getSecurityService().getUserGroupByName(tenantOwnerName), eventName); - EventDTO result = getEventById(eventUuid, false); - return result; + try { + SecurityUtils.getSubject().checkPermission(Permission.EVENT.getStringPermissionForObjects(DefaultModes.CREATE, eventUuid.toString())); + TimePoint startTimePoint = startDate != null ? new MillisecondsTimePoint(startDate) : null; + TimePoint endTimePoint = endDate != null ? new MillisecondsTimePoint(endDate) : null; + URL officialWebsiteURL = officialWebsiteURLAsString != null ? new URL(officialWebsiteURLAsString) : null; + URL baseURL = baseURLAsString != null ? new URL(baseURLAsString) : null; + Map sailorsInfoWebsiteURLs = convertToLocalesAndUrls(sailorsInfoWebsiteURLsByLocaleName); + List eventImages = convertToImages(images); + List eventVideos = convertToVideos(videos); + getService().apply( + new CreateEvent(eventName, eventDescription, startTimePoint, endTimePoint, venue, isPublic, eventUuid, + officialWebsiteURL, baseURL, sailorsInfoWebsiteURLs, eventImages, eventVideos, leaderboardGroupIds)); + createCourseAreas(eventUuid, courseAreaNames.toArray(new String[courseAreaNames.size()])); + result = getEventById(eventUuid, false); + return result; + } catch (AuthorizationException e) { + // revert ownership creation, then re-throw + getSecurityService().deleteOwnership(Permission.EVENT.getQualifiedObjectIdentifier(eventUuid.toString())); + throw e; + } } @Override diff --git a/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java b/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java index 50d381362be..382c0878096 100755 --- a/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java +++ b/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java @@ -351,10 +351,9 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl * that panel * * @param requiresAnyOfThesePermissions - * zero or more permissions; if no permissions are provided, the user will never be able to see the + * zero or more permissions; if no permissions are provided, the user will always be able to see the * widget. Otherwise, if any of these permissions implies any of the permissions the user has, the user - * will be shown the widget. In particular, a "*" wildcard permission will show the widget to all users, - * regardless their actual permissions. + * will be shown the widget. */ private void remeberWidgetLocationAndPermissions(VerticalOrHorizontalTabLayoutPanel tabPanel, Widget widgetToAdd, String tabTitle, HasPermissions... requiresAnyOfThesePermissions) { @@ -469,12 +468,20 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl * is also implied. */ private boolean userHasPermissionsToSeeWidget(UserDTO user, Widget widget) { - for (HasPermissions requiredStringPermission : permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget)) { - WildcardPermission requiredPermission = requiredStringPermission.getPermission(); - if (PermissionChecker.isPermitted(requiredPermission, user, user.getUserGroups(), /* ownership */ null, /* acl */ null)) { - return true; + final Set permissionsRequired = permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget); + boolean hasPermission; + if (permissionsRequired.isEmpty()) { + hasPermission = true; + } else { + hasPermission = false; + for (HasPermissions requiredStringPermission : permissionsRequired) { + WildcardPermission requiredPermission = requiredStringPermission.getPermission(); + if (PermissionChecker.isPermitted(requiredPermission, user, user.getUserGroups(), /* ownership */ null, /* acl */ null)) { + hasPermission = true; + break; + } } } - return false; + return hasPermission; } } diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java index 54acf4143ab..6ea2982ea02 100755 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java @@ -40,7 +40,7 @@ public interface UserManagementService extends RemoteService { AccessControlList removeFromACL(QualifiedObjectIdentifier idOfAccessControlledObject, String groupOrTenantIdAsString, String action) throws UnauthorizedException; - Collection getUserGroups() throws UnauthorizedException; + Collection getUserGroups(); UserGroup getUserGroupByName(String userGroupName) throws UnauthorizedException; diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementServiceAsync.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementServiceAsync.java index 8eb9bf7558d..ab0908df0d0 100755 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementServiceAsync.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementServiceAsync.java @@ -36,6 +36,9 @@ public interface UserManagementServiceAsync { void removeFromACL(QualifiedObjectIdentifier idOfAccessControlledObject, String permission, String name, AsyncCallback callback); + /** + * Returns those user groups the requesting user can read + */ void getUserGroups(AsyncCallback> callback); void getUserGroupByName(String userGroupName, AsyncCallback callback); @@ -48,6 +51,9 @@ public interface UserManagementServiceAsync { void removeUserFromUserGroup(String tenantIdAsString, String username, AsyncCallback asyncCallback); + /** + * Returns those users the requesting user can read + */ void getUserList(AsyncCallback> callback); void getUserByName(String username, AsyncCallback callback); diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java index b062c403ee7..f44ae8f8de5 100755 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java @@ -198,40 +198,38 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U } @Override - public Collection getUserGroups() throws UnauthorizedException { - if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermission(DefaultModes.READ))) { - List userGroups = new ArrayList<>(); - final Map fromOriginalToStrippedDownUser = new HashMap<>(); - final Map fromOriginalToStrippedDownUserGroup = new HashMap<>(); - for (UserGroup g : getSecurityService().getUserGroupList()) { + public Collection getUserGroups() { + List userGroups = new ArrayList<>(); + final Map fromOriginalToStrippedDownUser = new HashMap<>(); + final Map fromOriginalToStrippedDownUserGroup = new HashMap<>(); + for (UserGroup g : getSecurityService().getUserGroupList()) { + if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermissionForObjects(DefaultModes.READ, g.getId().toString()))) { UserGroup userGroupDTO = securityDTOFactory.createUserGroupDTOFromUserGroup(g, fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup); userGroups.add(userGroupDTO); } - return userGroups; - } else { - throw new UnauthorizedException("Not permitted to read user groups"); } + return userGroups; } @Override public UserGroup getUserGroupByName(String userGroupName) throws UnauthorizedException { - if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermission(DefaultModes.READ))) { - final UserGroup userGroup = getSecurityService().getUserGroupByName(userGroupName); + final UserGroup userGroup = getSecurityService().getUserGroupByName(userGroupName); + if (userGroup == null || SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER_GROUP.getStringPermissionForObjects(DefaultModes.READ, userGroup.getId().toString()))) { final Map fromOriginalToStrippedDownUser = new HashMap<>(); final Map fromOriginalToStrippedDownUserGroup = new HashMap<>(); return userGroup==null?null:securityDTOFactory.createUserGroupDTOFromUserGroup(userGroup, fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup); } else { - throw new UnauthorizedException("Not permitted to read user groups"); + throw new UnauthorizedException("Not permitted to read user group "+userGroupName); } } @Override public UserDTO getUserByName(String username) throws UnauthorizedException { - if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermission(DefaultModes.READ))) { - final User user = getSecurityService().getUserByName(username); + final User user = getSecurityService().getUserByName(username); + if (user == null || SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermissionForObjects(DefaultModes.READ, user.getName()))) { return user==null?null:securityDTOFactory.createUserDTOFromUser(user, getSecurityService()); } else { - throw new UnauthorizedException("Not permitted to read users"); + throw new UnauthorizedException("Not permitted to read user "+username); } } @@ -295,16 +293,14 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U @Override public Collection getUserList() throws UnauthorizedException { - if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermission(DefaultModes.READ))) { - List users = new ArrayList<>(); - for (User u : getSecurityService().getUserList()) { + List users = new ArrayList<>(); + for (User u : getSecurityService().getUserList()) { + if (SecurityUtils.getSubject().isPermitted(DefaultPermissions.USER.getStringPermissionForObjects(DefaultModes.READ, u.getName()))) { UserDTO userDTO = securityDTOFactory.createUserDTOFromUser(u, getSecurityService()); users.add(userDTO); } - return users; - } else { - throw new UnauthorizedException("Not permitted to manage users"); } + return users; } @Override diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java index ad561793515..c4ebc556cb3 100755 --- a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java @@ -88,7 +88,7 @@ public interface SecurityService extends ReplicableWithObjectInputStreams.internalCreateOwnership(idOfOwnedObjectAsString, userOwnerName, tenantId, displayNameOfOwnedObject)); + return apply(s->s.internalCreateOwnership(idOfOwnedObjectAsString, userOwnerName, tenantId, displayNameOfOwnedObject)); } @Override - public Void internalCreateOwnership(QualifiedObjectIdentifier idAsString, String userOwnerName, UUID tenantOwnerId, String displayName) { - accessControlStore.createOwnership(idAsString, getUserByName(userOwnerName), getUserGroup(tenantOwnerId), displayName); - return null; + public Ownership internalCreateOwnership(QualifiedObjectIdentifier idAsString, String userOwnerName, UUID tenantOwnerId, String displayName) { + return accessControlStore.createOwnership(idAsString, getUserByName(userOwnerName), getUserGroup(tenantOwnerId), displayName).getAnnotation(); } @Override