diff --git a/java/com.sap.sailing.gwt.ui/src/main/resources/shiro.ini b/java/com.sap.sailing.gwt.ui/src/main/resources/shiro.ini index 235e49630ca..a91946ef7c0 100755 --- a/java/com.sap.sailing.gwt.ui/src/main/resources/shiro.ini +++ b/java/com.sap.sailing.gwt.ui/src/main/resources/shiro.ini @@ -4,6 +4,8 @@ shiro.loginUrl = /security/ui/Login.html shiro.successUrl = /UserManagement.html # Use Built-in Chache Manager +anyofroles = com.sap.sse.security.AnyOfRolesFilter +anyofroles.loginUrl = ../security/ui/Login.html credentialsMatcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher # base64 encoding, not hex in this example: @@ -23,9 +25,11 @@ securityManager.sessionManager = $sessionManager #securityManager.sessionManager.sessionIdCookie = $globalCookie authc = com.sap.sse.security.CustomFilter -authc.loginUrl = /security/ui/Login.html +authc.loginUrl = ../security/ui/Login.html authc.successUrl = /security/ui/UserManagement.html +roles.loginUrl = ../security/ui/Login.html + sessionDAO = org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO securityManager.sessionManager.sessionDAO = $sessionDAO @@ -41,5 +45,5 @@ securityManager.cacheManager = $cacheManager # shiro.loginUrl above. /security/ui/UserManagement.html = roles[admin] -/LeaderboardEditing.html = roles[admin],roles[eventmanager] -/AdminConsole.html = roles[admin],roles[eventmanager] +/LeaderboardEditing.html = anyofroles[admin,eventmanager] +/AdminConsole.html = anyofroles[admin,eventmanager] diff --git a/java/com.sap.sse.common/.classpath b/java/com.sap.sse.common/.classpath index e538d99c426..d0c701c89d6 100644 --- a/java/com.sap.sse.common/.classpath +++ b/java/com.sap.sse.common/.classpath @@ -1,8 +1,8 @@ - + diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/AnyOfRolesFilter.java b/java/com.sap.sse.security/src/com/sap/sse/security/AnyOfRolesFilter.java new file mode 100644 index 00000000000..2e9e7e37e90 --- /dev/null +++ b/java/com.sap.sse.security/src/com/sap/sse/security/AnyOfRolesFilter.java @@ -0,0 +1,46 @@ +package com.sap.sse.security; + +import java.io.IOException; + +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; + +import org.apache.shiro.subject.Subject; +import org.apache.shiro.web.filter.authz.RolesAuthorizationFilter; + +/** + * Allows access if current user has at least one role of the specified list. + *
+ * Basically, it's the same as {@link RolesAuthorizationFilter} but using {@literal OR} instead + * of {@literal AND} on the specified roles.

+ * + * This class has been copied from the stackoverflow post + * + * http://stackoverflow.com/questions/14980703/apache-shiro-allowing-multiple-roles-to-access-a-url-not-working. + * + * @see RolesAuthorizationFilter + * @author Andy Belsky + */ +public class AnyOfRolesFilter extends RolesAuthorizationFilter { + + @Override + public boolean isAccessAllowed(ServletRequest request, ServletResponse response, + Object mappedValue) throws IOException { + + final Subject subject = getSubject(request, response); + final String[] rolesArray = (String[]) mappedValue; + + if (rolesArray == null || rolesArray.length == 0) { + //no roles specified, so nothing to check - allow access. + return true; + } + + for (String roleName : rolesArray) { + if (subject.hasRole(roleName)) { + return true; + } + } + + return false; + } +} \ No newline at end of file diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityServiceImpl.java index 61622e03958..66ece3fb0c7 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityServiceImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityServiceImpl.java @@ -102,7 +102,6 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Securit logger.info("No users found, creating default user \"admin\" with password \"admin\""); createSimpleUser("admin", "nobody@sapsailing.com", "admin", /* validationBaseURL */ null); addRoleForUser("admin", DefaultRoles.ADMIN.getRolename()); - addRoleForUser("admin", "moderator"); } catch (UserManagementException | MailException e) { logger.log(Level.SEVERE, "Exception while creating default admin user", e); } diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java index 5d1c93d8851..b2098d2d620 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java @@ -25,14 +25,14 @@ public class SecurityResource extends AbstractSecurityResource { @GET @Path("/hello") @Produces("application/json;charset=UTF-8") - public Response sayHello(){ + public Response sayHello() { return Response.ok("Hello!", MediaType.TEXT_PLAIN).build(); } @POST @Path("/login") @Produces("application/json;charset=UTF-8") - public Response login(@FormParam("username") String username, @FormParam("password") String password){ + public Response login(@FormParam("username") String username, @FormParam("password") String password) { try { getService().login(username, password); logger.info("Successfully logged in " + username + " with password");