Extended security DTO model to include RoleDefinitions associated to

groups. These will be needed by permission checks.

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/AbstractOwnership.java

@@ -2,7 +2,7 @@ package com.sap.sse.security.shared;
 
 import java.io.Serializable;
 
-public abstract class AbstractOwnership<G extends SecurityUserGroup, U extends UserReference>
+public abstract class AbstractOwnership<G extends SecurityUserGroup<?>, U extends UserReference>
         implements Serializable {
     private static final long serialVersionUID = 1L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/AbstractRole.java

@@ -12,7 +12,7 @@ import com.sap.sse.common.Util.Triple;
  * 
  * @author Axel Uhl (D043530)
  */
-public abstract class AbstractRole<RD extends RoleDefinition, G extends SecurityUserGroup, U extends UserReference>
+public abstract class AbstractRole<RD extends RoleDefinition, G extends SecurityUserGroup<?>, U extends UserReference>
         implements Named {
     private static final String QUALIFIER_SEPARATOR = WildcardPermission.PART_DIVIDER_TOKEN;
     private static final long serialVersionUID = 1243342091492822614L;

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/AbstractUserGroupImpl.java

@@ -8,17 +8,15 @@ import java.util.UUID;
  * A group of users; equality and hash code are based solely on the {@link #getId() ID}.
  */
 public abstract class AbstractUserGroupImpl<U extends UserReference, RD extends RoleDefinition>
-        extends SecurityUserGroupImpl {
+        extends SecurityUserGroupImpl<RD> {
 
     private static final long serialVersionUID = 5449819084645794859L;
 
     private Set<U> users;
-    protected Map<RD, Boolean> roleDefinitionMap;
 
     protected AbstractUserGroupImpl(UUID id, String name, Set<U> users, Map<RD, Boolean> roleDefinitionMap) {
-        super(id, name);
+        super(id, name, roleDefinitionMap);
         this.users = users;
-        this.roleDefinitionMap = roleDefinitionMap;
     }
 
     public Iterable<U> getUsers() {

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java

@@ -61,7 +61,7 @@ public class PermissionChecker {
      * @param acl
      *            may be {@code null} in which case no ACL-specific checks are performed
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isPermitted(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean isPermitted(
             WildcardPermission permission, U user, U allUser,
             O ownership, A acl) {
         return isPermitted(permission, user, (Iterable<G>) (user == null ? null : user.getUserGroups()), allUser,
@@ -80,7 +80,7 @@ public class PermissionChecker {
      * @param acl
      *            may be {@code null} in which case no ACL-specific checks are performed
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isPermitted(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean isPermitted(
             WildcardPermission permission, U user,
             Iterable<G> groupsOfWhichUserIsMember, U allUser,
             Iterable<G> allUserGroupsOfWhichUserIsMember, O ownership, A acl) {
@@ -126,7 +126,7 @@ public class PermissionChecker {
     /**
      * Checks if a user has a specific role either for a given ownership or globally if no ownership exists.
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean ownsUserASpecificRole(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean ownsUserASpecificRole(
             U user, U allUser, O ownership,
             String requiredRoleName) {
         assert requiredRoleName != null;
@@ -135,7 +135,7 @@ public class PermissionChecker {
 
     }
 
-    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean ownsUserASpecificRole(
+    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean ownsUserASpecificRole(
             U user, O ownership, String requiredRoleName) {
         if (user == null) {
             return false;
@@ -180,7 +180,7 @@ public class PermissionChecker {
      * complete list for the running system. Otherwise we potentially do not check for all required types if the given
      * {@link WildcardPermission} has a wildcard as type part.
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean checkMetaPermission(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean checkMetaPermission(
             WildcardPermission permission,
             Iterable<HasPermissions> allPermissionTypes, U user, U allUser, O ownership) {
         assert permission != null;
@@ -275,7 +275,7 @@ public class PermissionChecker {
      * because only users that have an unqualified version of a permission would pass that permission check. This means
      * we need to check the permission for any possibly existing object ID.
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean hasUserAnyPermission(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean hasUserAnyPermission(
             WildcardPermission permission,
             Iterable<HasPermissions> allPermissionTypes, U user, U allUser, O ownership) {
         assert permission != null;
@@ -293,7 +293,7 @@ public class PermissionChecker {
         return false;
     }
     
-    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> PermissionState checkUserPermissions(
+    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> PermissionState checkUserPermissions(
             WildcardPermission permission, U user,
             O ownership, WildcardPermissionChecker permissionChecker,
             boolean matchOnlyNonQualifiedRolesIfNoOwnershipIsGiven) {
@@ -336,7 +336,7 @@ public class PermissionChecker {
      * @param ownership
      *            Ownership of the data object for which the {@code permission} is requested
      */
-    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean implies(
+    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup<RD>, A extends SecurityAccessControlList<G>> boolean implies(
             R role, WildcardPermission permission, O ownership,
             WildcardPermissionChecker permissionChecker,
            boolean matchOnlyNonQualifiedRolesIfNoOwnershipIsGiven) {

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityAccessControlList.java

@@ -31,7 +31,7 @@ import com.sap.sse.security.shared.impl.UserGroupImpl;
  * @author Axel Uhl (d043530)
  *
  */
-public interface SecurityAccessControlList<G extends SecurityUserGroup> extends Serializable {
+public interface SecurityAccessControlList<G extends SecurityUserGroup<?>> extends Serializable {
     /**
      * Checks whether this access control list grants the {@code user} the permission to execute {@code action} on the
      * object to which this ACL pertains.

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUser.java

@@ -11,7 +11,7 @@ import com.sap.sse.common.WithID;
  * @author Axel Uhl (d043530)
  *
  */
-public interface SecurityUser<RD extends RoleDefinition, R extends AbstractRole<RD, G, ?>, G extends SecurityUserGroup>
+public interface SecurityUser<RD extends RoleDefinition, R extends AbstractRole<RD, G, ?>, G extends SecurityUserGroup<?>>
         extends UserReference, WithQualifiedObjectIdentifier {
     /**
      * Returns the "raw" permissions explicitly set for this user. This does not include permissions

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUserGroup.java

@@ -1,11 +1,14 @@
 package com.sap.sse.security.shared;
 
+import java.util.Map;
 import java.util.UUID;
 
-public interface SecurityUserGroup {
+public interface SecurityUserGroup<RD extends RoleDefinition> {
 
     String getName();
 
     UUID getId();
 
+    Map<RD, Boolean> getRoleDefinitionMap();
+
 }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUserGroupImpl.java

@@ -1,5 +1,7 @@
 package com.sap.sse.security.shared;
 
+import java.util.Collections;
+import java.util.Map;
 import java.util.UUID;
 
 import com.sap.sse.common.NamedWithID;
@@ -12,16 +14,18 @@ import com.sap.sse.security.shared.impl.UserGroupImpl;
  * @author Axel Uhl (d043530)
  *
  */
-public abstract class SecurityUserGroupImpl implements NamedWithID, WithQualifiedObjectIdentifier, SecurityUserGroup {
+public abstract class SecurityUserGroupImpl<RD extends RoleDefinition> implements NamedWithID, WithQualifiedObjectIdentifier, SecurityUserGroup<RD> {
     private static final long serialVersionUID = 1L;
 
     private UUID id;
     private String name;
+    protected Map<RD, Boolean> roleDefinitionMap;
 
-    public SecurityUserGroupImpl(UUID id, String name) {
+    public SecurityUserGroupImpl(UUID id, String name, Map<RD, Boolean> roleDefinitionMap) {
         super();
         this.id = id;
         this.name = name;
+        this.roleDefinitionMap = roleDefinitionMap;
     }
 
     /* (non-Javadoc)
@@ -40,6 +44,11 @@ public abstract class SecurityUserGroupImpl implements NamedWithID, WithQualifie
         return id;
     }
 
+    @Override
+    public Map<RD, Boolean> getRoleDefinitionMap() {
+        return Collections.unmodifiableMap(roleDefinitionMap);
+    }
+
     @Override
     public HasPermissions getType() {
         return SecuredSecurityTypes.USER_GROUP;
@@ -71,7 +80,7 @@ public abstract class SecurityUserGroupImpl implements NamedWithID, WithQualifie
             return false;
         if (getClass() != obj.getClass())
             return false;
-        SecurityUserGroupImpl other = (SecurityUserGroupImpl) obj;
+        SecurityUserGroupImpl<?> other = (SecurityUserGroupImpl<?>) obj;
         if (id == null) {
             if (other.id != null)
                 return false;

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/RoleDTO.java

@@ -2,19 +2,19 @@ package com.sap.sse.security.shared.dto;
 
 import com.sap.sse.security.shared.AbstractRole;
 
-public class RoleDTO extends AbstractRole<RoleDefinitionDTO, StrippedUserGroupDTO, StrippedUserDTO> {
+public class RoleDTO extends AbstractRole<StrippedRoleDefinitionDTO, StrippedUserGroupDTO, StrippedUserDTO> {
     private static final long serialVersionUID = 1L;
 
     @Deprecated // gwt serialisation only
     RoleDTO() {
     }
 
-    public RoleDTO(RoleDefinitionDTO roleDefinition, StrippedUserGroupDTO qualifiedForTenant,
+    public RoleDTO(StrippedRoleDefinitionDTO roleDefinition, StrippedUserGroupDTO qualifiedForTenant,
             StrippedUserDTO qualifiedForUser) {
         super(roleDefinition, qualifiedForTenant, qualifiedForUser);
     }
 
-    public RoleDTO(RoleDefinitionDTO roleDefinition) {
+    public RoleDTO(StrippedRoleDefinitionDTO roleDefinition) {
         super(roleDefinition);
     }
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/StrippedRoleDefinitionDTO.java

@@ -0,0 +1,18 @@
+package com.sap.sse.security.shared.dto;
+
+import java.util.UUID;
+
+import com.sap.sse.security.shared.RoleDefinitionImpl;
+import com.sap.sse.security.shared.WildcardPermission;
+
+public class StrippedRoleDefinitionDTO extends RoleDefinitionImpl {
+    
+    private static final long serialVersionUID = -3340211553071045099L;
+
+    @Deprecated
+    StrippedRoleDefinitionDTO() {} // for GWT serialization only
+    
+    public StrippedRoleDefinitionDTO(UUID id, String name, Iterable<WildcardPermission> permissions) {
+        super(id, name, permissions);
+    }
+}

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/StrippedUserGroupDTO.java

@@ -1,20 +1,26 @@
 package com.sap.sse.security.shared.dto;
 
+import java.util.HashMap;
+import java.util.Map;
 import java.util.UUID;
 
 import com.sap.sse.security.shared.SecurityUserGroupImpl;
 
-public class StrippedUserGroupDTO extends SecurityUserGroupImpl {
+public class StrippedUserGroupDTO extends SecurityUserGroupImpl<StrippedRoleDefinitionDTO> {
     private static final long serialVersionUID = 1L;
 
     @Deprecated
     // GWT serializer only
     StrippedUserGroupDTO() {
-        super(null, null);
+        super(null, null, new HashMap<StrippedRoleDefinitionDTO, Boolean>());
+    }
+    
+    public StrippedUserGroupDTO(UUID id, String name) {
+        this(id, name, new HashMap<StrippedRoleDefinitionDTO, Boolean>());
     }
 
-    public StrippedUserGroupDTO(UUID id, String name) {
-        super(id, name);
+    public StrippedUserGroupDTO(UUID id, String name, Map<StrippedRoleDefinitionDTO, Boolean> roleDefinitionMap) {
+        super(id, name, roleDefinitionMap);
     }
 
 }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java

@@ -13,7 +13,7 @@ import com.sap.sse.security.shared.WildcardPermission;
 import com.sap.sse.security.shared.impl.Ownership;
 import com.sap.sse.security.shared.impl.SecurityUserImpl;
 
-public class UserDTO extends SecurityUserImpl<RoleDefinitionDTO, RoleDTO, StrippedUserGroupDTO>
+public class UserDTO extends SecurityUserImpl<StrippedRoleDefinitionDTO, RoleDTO, StrippedUserGroupDTO>
         implements Named, Serializable, SecuredDTO {
 
     private static final long serialVersionUID = 7556217539893146187L;

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserGroupDTO.java

@@ -12,7 +12,7 @@ import com.sap.sse.security.shared.HasPermissions;
 import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
 import com.sap.sse.security.shared.impl.SecuredSecurityTypes;
 
-public class UserGroupDTO extends AbstractUserGroupImpl<StrippedUserDTO, RoleDefinitionDTO> implements SecuredDTO {
+public class UserGroupDTO extends AbstractUserGroupImpl<StrippedUserDTO, StrippedRoleDefinitionDTO> implements SecuredDTO {
 
     private static final long serialVersionUID = -2217611212963521760L;
 
@@ -25,7 +25,7 @@ public class UserGroupDTO extends AbstractUserGroupImpl<StrippedUserDTO, RoleDef
     }
 
     public UserGroupDTO(UUID id, String name, Set<StrippedUserDTO> users,
-            Map<RoleDefinitionDTO, Boolean> roleDefinitionMap) {
+            Map<StrippedRoleDefinitionDTO, Boolean> roleDefinitionMap) {
         super(id, name, users, roleDefinitionMap);
     }
 
@@ -59,10 +59,10 @@ public class UserGroupDTO extends AbstractUserGroupImpl<StrippedUserDTO, RoleDef
         return SecuredSecurityTypes.USER_GROUP;
     }
 
-    public Iterable<Pair<RoleDefinitionDTO, Boolean>> getRoleDefinitions() {
-        final Set<Pair<RoleDefinitionDTO, Boolean>> result = new HashSet<>();
-        for (Entry<RoleDefinitionDTO, Boolean> entry : roleDefinitionMap.entrySet()) {
-            result.add(new Pair<RoleDefinitionDTO, Boolean>(entry.getKey(), entry.getValue()));
+    public Iterable<Pair<StrippedRoleDefinitionDTO, Boolean>> getRoleDefinitions() {
+        final Set<Pair<StrippedRoleDefinitionDTO, Boolean>> result = new HashSet<>();
+        for (Entry<StrippedRoleDefinitionDTO, Boolean> entry : roleDefinitionMap.entrySet()) {
+            result.add(new Pair<>(entry.getKey(), entry.getValue()));
         }
         return result;
     }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/AbstractAccessControlList.java

@@ -12,7 +12,7 @@ import com.sap.sse.security.shared.SecurityAccessControlList;
 import com.sap.sse.security.shared.SecurityUserGroup;
 import com.sap.sse.security.shared.WildcardPermission;
 
-public abstract class AbstractAccessControlList<G extends SecurityUserGroup>
+public abstract class AbstractAccessControlList<G extends SecurityUserGroup<?>>
         implements SecurityAccessControlList<G> {
     private static final long serialVersionUID = -8587238587604749862L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecurityUserImpl.java

@@ -13,7 +13,7 @@ import com.sap.sse.security.shared.SecurityUserGroup;
 import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
 import com.sap.sse.security.shared.WildcardPermission;
 
-public abstract class SecurityUserImpl<RD extends RoleDefinition, R extends AbstractRole<RD, G, ?>, G extends SecurityUserGroup>
+public abstract class SecurityUserImpl<RD extends RoleDefinition, R extends AbstractRole<RD, G, ?>, G extends SecurityUserGroup<?>>
         extends AbstractUserReference implements SecurityUser<RD, R, G> {
     private static final long serialVersionUID = -3639860207453072248L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/UserGroup.java

@@ -6,7 +6,7 @@ import com.sap.sse.security.shared.RoleDefinition;
 import com.sap.sse.security.shared.SecurityUserGroup;
 import com.sap.sse.security.shared.WithQualifiedObjectIdentifier;
 
-public interface UserGroup extends SecurityUserGroup, WithQualifiedObjectIdentifier {
+public interface UserGroup extends SecurityUserGroup<RoleDefinition>, WithQualifiedObjectIdentifier {
 
     Iterable<User> getUsers();
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/UserGroupImpl.java

@@ -1,6 +1,5 @@
 package com.sap.sse.security.shared.impl;
 
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
@@ -34,9 +33,4 @@ public class UserGroupImpl extends AbstractUserGroupImpl<User, RoleDefinition> i
     public static String getTypeRelativeObjectIdentifierAsString(UserGroup userGroup) {
         return userGroup.getId().toString();
     }
-
-    @Override
-    public Map<RoleDefinition, Boolean> getRoleDefinitionMap() {
-        return Collections.unmodifiableMap(roleDefinitionMap);
-    }
 }

java/com.sap.sse.security.test/src/com/sap/sse/security/test/RolesTest.java

@@ -8,7 +8,7 @@ import java.util.UUID;
 import org.junit.Test;
 
 import com.sap.sse.security.shared.dto.RoleDTO;
-import com.sap.sse.security.shared.dto.RoleDefinitionDTO;
+import com.sap.sse.security.shared.dto.StrippedRoleDefinitionDTO;
 import com.sap.sse.security.shared.dto.StrippedUserDTO;
 import com.sap.sse.security.shared.dto.StrippedUserGroupDTO;
 import com.sap.sse.security.shared.impl.Role;
@@ -17,7 +17,7 @@ import com.sap.sse.security.shared.impl.UserGroupImpl;
 public class RolesTest {
     @Test
     public void testRoleToString() {
-        final RoleDefinitionDTO roleDefinition = new RoleDefinitionDTO(UUID.randomUUID(), "role", new ArrayList<>());
+        final StrippedRoleDefinitionDTO roleDefinition = new StrippedRoleDefinitionDTO(UUID.randomUUID(), "role", new ArrayList<>());
         final Role role = new Role(roleDefinition);
         final UserGroupImpl tenant = new UserGroupImpl(UUID.randomUUID(), "tenant");
         final StrippedUserGroupDTO tenantDTO = new StrippedUserGroupDTO(UUID.randomUUID(), "tenant");

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/SecurityDTOFactory.java

@@ -27,6 +27,7 @@ import com.sap.sse.security.shared.dto.OwnershipAnnotationDTO;
 import com.sap.sse.security.shared.dto.OwnershipDTO;
 import com.sap.sse.security.shared.dto.RoleDTO;
 import com.sap.sse.security.shared.dto.RoleDefinitionDTO;
+import com.sap.sse.security.shared.dto.StrippedRoleDefinitionDTO;
 import com.sap.sse.security.shared.dto.StrippedUserDTO;
 import com.sap.sse.security.shared.dto.StrippedUserGroupDTO;
 import com.sap.sse.security.shared.dto.UserDTO;
@@ -105,7 +106,7 @@ public class SecurityDTOFactory {
             Map<UserGroup, StrippedUserGroupDTO> fromOriginalToStrippedDownUserGroup,
             SecurityService securityService) {
         RoleDefinition rdef = role.getRoleDefinition();
-        RoleDefinitionDTO rdefDTO = createRoleDefinitionDTO(rdef, securityService, fromOriginalToStrippedDownUser,
+        StrippedRoleDefinitionDTO rdefDTO = createStrippedRoleDefinitionDTO(rdef,
                 fromOriginalToStrippedDownUserGroup);
         RoleDTO mappedRole = new RoleDTO(rdefDTO,
                 createStrippedUserGroupDTOFromUserGroup(role.getQualifiedForTenant(),
@@ -114,6 +115,12 @@ public class SecurityDTOFactory {
                         fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup));
         return mappedRole;
     }
+    
+    private StrippedRoleDefinitionDTO createStrippedRoleDefinitionDTO(final RoleDefinition roleDefinition,
+            final Map<UserGroup, StrippedUserGroupDTO> fromOriginalToStrippedDownUserGroup) {
+        return new StrippedRoleDefinitionDTO(roleDefinition.getId(), roleDefinition.getName(),
+                roleDefinition.getPermissions());
+    }
 
     private RoleDefinitionDTO createRoleDefinitionDTO(final RoleDefinition roleDefinition,
             final SecurityService securityService, final Map<User, StrippedUserDTO> fromOriginalToStrippedDownUser,
@@ -138,14 +145,13 @@ public class SecurityDTOFactory {
                 fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup));
     }
 
-    private Map<RoleDefinitionDTO, Boolean> createUserGroupRoleDefinitionDTOs(
-            final Map<RoleDefinition, Boolean> roleDefinitions, final SecurityService securityService,
-            final Map<User, StrippedUserDTO> fromOriginalToStrippedDownUser,
+    private Map<StrippedRoleDefinitionDTO, Boolean> createUserGroupRoleDefinitionDTOs(
+            final Map<RoleDefinition, Boolean> roleDefinitions,
             final Map<UserGroup, StrippedUserGroupDTO> fromOriginalToStrippedDownUserGroup) {
-        final Map<RoleDefinitionDTO, Boolean> roleDefinitionDTOs = new HashMap<>();
+        final Map<StrippedRoleDefinitionDTO, Boolean> roleDefinitionDTOs = new HashMap<>();
         for (Entry<RoleDefinition, Boolean> entry : roleDefinitions.entrySet()) {
-            roleDefinitionDTOs.put(createRoleDefinitionDTO(entry.getKey(), securityService,
-                    fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup), entry.getValue());
+            roleDefinitionDTOs.put(createStrippedRoleDefinitionDTO(entry.getKey(),
+                    fromOriginalToStrippedDownUserGroup), entry.getValue());
         }
         return roleDefinitionDTOs;
     }
@@ -198,8 +204,8 @@ public class SecurityDTOFactory {
             result = new UserGroupDTO(userGroup.getId(), userGroup.getName(),
                     createStrippedUsersFromUsers(userGroup.getUsers(), securityService, fromOriginalToStrippedDownUser,
                             fromOriginalToStrippedDownUserGroup),
-                    createUserGroupRoleDefinitionDTOs(userGroup.getRoleDefinitionMap(), securityService,
-                            fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup));
+                    createUserGroupRoleDefinitionDTOs(userGroup.getRoleDefinitionMap(),
+                            fromOriginalToStrippedDownUserGroup));
             SecurityDTOUtil.addSecurityInformation(this, securityService, result, userGroup.getIdentifier(),
                     fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup);
         }
@@ -207,10 +213,10 @@ public class SecurityDTOFactory {
     }
     
     public Iterable<StrippedUserGroupDTO> createStrippedUserGroupDTOFromUserGroups(Iterable<UserGroup> userGroups,
-            Map<UserGroup, StrippedUserGroupDTO> fromOriginalToStrippedDownUserGrou) {
+            Map<UserGroup, StrippedUserGroupDTO> fromOriginalToStrippedDownUserGroup) {
         Collection<StrippedUserGroupDTO> result = new ArrayList<>();
         for (UserGroup userGroup : userGroups) {
-            result.add(createStrippedUserGroupDTOFromUserGroup(userGroup, fromOriginalToStrippedDownUserGrou));
+            result.add(createStrippedUserGroupDTOFromUserGroup(userGroup, fromOriginalToStrippedDownUserGroup));
         }
         return result;
     }
@@ -224,7 +230,9 @@ public class SecurityDTOFactory {
             if (fromOriginalToStrippedDownUserGroup.containsKey(userGroup)) {
                 result = fromOriginalToStrippedDownUserGroup.get(userGroup);
             } else {
-                result = new StrippedUserGroupDTO(userGroup.getId(), userGroup.getName());
+                result = new StrippedUserGroupDTO(userGroup.getId(), userGroup.getName(),
+                        createUserGroupRoleDefinitionDTOs(userGroup.getRoleDefinitionMap(),
+                                fromOriginalToStrippedDownUserGroup));
                 fromOriginalToStrippedDownUserGroup.put(userGroup, result);
             }
         }