From 5b1e7258499fb2c644c42110cdd482785a0bd064 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Mon, 24 Nov 2014 12:05:42 +0100 Subject: [PATCH] enabled more SecurityService operations for replication; added serialization test for fields declared of non-serializable type --- .../domain/test/OfflineSerializationTest.java | 19 +++++++ .../impl/ReplicableSecurityService.java | 15 ++++++ .../security/impl/SecurityServiceImpl.java | 50 +++++++++++++++++-- 3 files changed, 79 insertions(+), 5 deletions(-) diff --git a/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/OfflineSerializationTest.java b/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/OfflineSerializationTest.java index 17b2d5e048e..9acb982d192 100755 --- a/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/OfflineSerializationTest.java +++ b/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/OfflineSerializationTest.java @@ -6,9 +6,11 @@ import static org.junit.Assert.assertSame; import static org.junit.Assert.assertTrue; import static org.junit.Assert.fail; +import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.NotSerializableException; +import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.io.Serializable; import java.util.Arrays; @@ -232,4 +234,21 @@ public class OfflineSerializationTest extends AbstractSerializationTest { logger.info("Caught expected exception "+nse); } } + + private static class NonSerializableFieldDeclaration implements Serializable { + private static final long serialVersionUID = 1806419236999145531L; + public Object nonSerializable; + } + @Test + public void testSerializingSerializableFieldValueOfNonSerializableDeclaredType() throws IOException, ClassNotFoundException { + final NonSerializableFieldDeclaration o = new NonSerializableFieldDeclaration(); + o.nonSerializable = "A serializable String object"; + final ByteArrayOutputStream bos = new ByteArrayOutputStream(); + final ObjectOutputStream oos = new ObjectOutputStream(bos); + oos.writeObject(o); + oos.close(); + final ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bos.toByteArray())); + NonSerializableFieldDeclaration o2 = (NonSerializableFieldDeclaration) ois.readObject(); + assertEquals(o.nonSerializable, o2.nonSerializable); + } } diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/ReplicableSecurityService.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/ReplicableSecurityService.java index 4419c8a703c..d49acb0eb31 100755 --- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/ReplicableSecurityService.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/ReplicableSecurityService.java @@ -2,6 +2,7 @@ package com.sap.sse.security.impl; import com.sap.sse.security.SecurityService; import com.sap.sse.security.User; +import com.sap.sse.security.shared.UserManagementException; /** * Publishes those methods of {@link SecurityServiceImpl} that are required by operations implemented as lambda @@ -14,4 +15,18 @@ import com.sap.sse.security.User; */ public interface ReplicableSecurityService extends SecurityService { Void internalStoreUser(User user); + + Void internalSetPreference(String username, String key, String value); + + Void internalUnsetPreference(String username, String key); + + Boolean internalSetSetting(String key, Object setting); + + Void internalAddSetting(String key, Class clazz); + + Void internalAddRoleForUser(String username, String role) throws UserManagementException; + + Void internalRemoveRoleFromUser(String username, String role) throws UserManagementException; + + Void internalDeleteUser(String username) throws UserManagementException; } diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java index 0483b79beec..b7986d655a1 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java @@ -443,21 +443,44 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica @Override public void addRoleForUser(String username, String role) throws UserManagementException { + apply(s->s.internalAddRoleForUser(username, role)); + } + + @Override + public Void internalAddRoleForUser(String username, String role) throws UserManagementException { store.addRoleForUser(username, role); + return null; } @Override public void removeRoleFromUser(String username, String role) throws UserManagementException { + apply(s->s.internalRemoveRoleFromUser(username, role)); + } + + @Override + public Void internalRemoveRoleFromUser(String username, String role) throws UserManagementException { store.removeRoleFromUser(username, role); + return null; } @Override public void deleteUser(String username) throws UserManagementException { + apply(s->s.internalDeleteUser(username)); + } + + @Override + public Void internalDeleteUser(String username) throws UserManagementException { store.deleteUser(username); + return null; } @Override public boolean setSetting(String key, Object setting) { + return apply(s->s.internalSetSetting(key, setting)); + } + + @Override + public Boolean internalSetSetting(String key, Object setting) { return store.setSetting(key, setting); } @@ -567,7 +590,6 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica logger.info("Getting Authorization url..."); try { authorizationUrl = service.getAuthorizationUrl(requestToken); - // Facebook has optional state var to protect against CSFR. // We'll use it if (authProvider == ClientUtils.FACEBOOK || authProvider == ClientUtils.GITHUB @@ -716,7 +738,13 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica if (!isValidSettingsKey(key)) { throw new UserManagementException("Invalid key!"); } + apply(s->s.internalAddSetting(key, clazz)); + } + + @Override + public Void internalAddSetting(String key, Class clazz) { store.addSetting(key, clazz); + return null; } public static boolean isValidSettingsKey(String key) { @@ -760,27 +788,39 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica } @Override - public void setPreference(String username, String key, String value) { - Subject subject = SecurityUtils.getSubject(); + public void setPreference(final String username, final String key, final String value) { + final Subject subject = SecurityUtils.getSubject(); if (subject.hasRole(DefaultRoles.ADMIN.name()) || username.equals(SessionUtils.loadUsername())) { - store.setPreference(username, key, value); + apply(s->s.internalSetPreference(username, key, value)); } else { throw new SecurityException("User " + SessionUtils.loadUsername() + " does not have permission to set preference for user " + username); } } + + @Override + public Void internalSetPreference(final String username, final String key, final String value) { + store.setPreference(username, key, value); + return null; + } @Override public void unsetPreference(String username, String key) { Subject subject = SecurityUtils.getSubject(); if (subject.hasRole(DefaultRoles.ADMIN.name()) || username.equals(SessionUtils.loadUsername())) { - store.unsetPreference(username, key); + apply(s->s.internalUnsetPreference(username, key)); } else { throw new SecurityException("User " + SessionUtils.loadUsername() + " does not have permission to unset preference for user " + username); } } + @Override + public Void internalUnsetPreference(String username, String key) { + store.unsetPreference(username, key); + return null; + } + @Override public String getPreference(String username, String key) { Subject subject = SecurityUtils.getSubject();