eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-25 06:58:39 +00:00
Code Activity

Secured user management service and removed unnecessary classes

Browse Source
This commit is contained in:
Jonas Dann
2017-11-30 17:06:54 +01:00
parent 655d356dda
commit d5eef9170a
11 changed files with 244 additions and 267 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/Roles.java
View File
java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SailingPermissionsForRoleProvider.java
-72
View File
@@ -1,72 +0,0 @@
package com.sap.sailing.domain.common.security;
import java.util.ArrayList;
import java.util.Collections;
import com.sap.sse.security.shared.AbstractRoles;
import com.sap.sse.security.shared.AdminRole;
import com.sap.sse.security.shared.PermissionsForRoleProvider;
import com.sap.sse.security.shared.RolePermissionModel;
public class SailingPermissionsForRoleProvider implements PermissionsForRoleProvider {
public static final SailingPermissionsForRoleProvider INSTANCE = new SailingPermissionsForRoleProvider();
@Override
public Iterable<String> getPermissions(String role, RolePermissionModel rolePermissionModel) {
final Iterable<String> result;
if (rolePermissionModel == null) {
if (AdminRole.getInstance().getName().equals(role)) {
ArrayList<String> permissions = new ArrayList<>();
permissions.add("*");
result = permissions;
} else if (AbstractRoles.eventmanager.getDisplayName().equals(role)) {
result = asList(
// RaceBoard:
Permission.MANAGE_MEDIA,
Permission.MANAGE_MARK_PASSINGS,
Permission.MANAGE_MARK_POSITIONS,
// AdminConsole:
Permission.MANAGE_ALL_COMPETITORS,
Permission.MANAGE_COURSE_LAYOUT,
Permission.MANAGE_DEVICE_CONFIGURATION,
Permission.MANAGE_EVENTS,
Permission.MANAGE_IGTIMI_ACCOUNTS,
Permission.MANAGE_LEADERBOARD_GROUPS,
Permission.MANAGE_LEADERBOARDS,
Permission.MANAGE_LEADERBOARD_RESULTS,
Permission.MANAGE_MEDIA,
Permission.MANAGE_RACELOG_TRACKING,
Permission.MANAGE_REGATTAS,
Permission.MANAGE_RESULT_IMPORT_URLS,
Permission.MANAGE_STRUCTURE_IMPORT_URLS,
Permission.MANAGE_TRACKED_RACES,
Permission.MANAGE_WIND,
// back-end:
Permission.EVENT,
Permission.REGATTA,
Permission.LEADERBOARD,
Permission.LEADERBOARD_GROUP
);
} else if (AbstractRoles.mediaeditor.getDisplayName().equals(role)) {
result = asList(Permission.MANAGE_MEDIA);
} else if (AbstractRoles.moderator.getDisplayName().equals(role)) {
result = asList(Permission.CAN_REPLAY_DURING_LIVE_RACES);
} else {
result = Collections.emptyList();
}
} else {
result = null; // TODO
}
return result;
}
private Iterable<String> asList(Permission... permissions) {
ArrayList<String> list = new ArrayList<String>(permissions.length);
for (Permission permission : permissions) {
list.add(permission.getStringPermission());
}
return list;
}
}
java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java
+2 -3
View File
@@ -14,7 +14,6 @@ import com.google.gwt.user.client.ui.HeaderPanel;
import com.google.gwt.user.client.ui.RootLayoutPanel;
import com.google.gwt.user.client.ui.Widget;
import com.sap.sailing.domain.common.security.Permission;
import com.sap.sailing.domain.common.security.SailingPermissionsForRoleProvider;
import com.sap.sailing.gwt.common.authentication.FixedSailingAuthentication;
import com.sap.sailing.gwt.common.authentication.SAPSailingHeaderWithAuthentication;
import com.sap.sailing.gwt.ui.client.AbstractSailingEntryPoint;
@@ -87,7 +86,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
}
private Widget createAdminConsolePanel() {
AdminConsolePanel panel = new AdminConsolePanel(getUserService(), SailingPermissionsForRoleProvider.INSTANCE,
AdminConsolePanel panel = new AdminConsolePanel(getUserService(),
sailingService, getStringMessages().releaseNotes(), "/release_notes_admin.html", /* error reporter */ this, SecurityStylesheetResources.INSTANCE.css(), getStringMessages());
panel.addStyleName("adminConsolePanel");
@@ -297,7 +296,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
roles.add(role);
}
final UserManagementPanel userManagementPanel = new UserManagementPanel(getUserService(), StringMessages.INSTANCE,
SailingPermissionsForRoleProvider.INSTANCE, roles, Arrays.<com.sap.sse.security.shared.Permission>asList(Permission.values()));
roles, Arrays.<com.sap.sse.security.shared.Permission>asList(Permission.values()));
panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<UserManagementPanel>(userManagementPanel),
getStringMessages().userManagement(), Permission.MANAGE_USERS);
java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
+2 -6
View File
@@ -26,7 +26,6 @@ import com.sap.sse.gwt.client.panels.AbstractTabLayoutPanel;
import com.sap.sse.gwt.client.panels.HorizontalTabLayoutPanel;
import com.sap.sse.gwt.client.panels.VerticalTabLayoutPanel;
import com.sap.sse.security.shared.Permission;
import com.sap.sse.security.shared.PermissionsForRoleProvider;
import com.sap.sse.security.shared.WildcardPermission;
import com.sap.sse.security.ui.client.UserService;
import com.sap.sse.security.ui.client.UserStatusEventHandler;
@@ -96,8 +95,6 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
*/
private final Map<Widget, RefreshableAdminConsolePanel> panelsByWidget;
private final PermissionsForRoleProvider permissionsForRoleProvider;
/**
* Generic selection handler that forwards selected tabs to a refresher that ensures that data gets reloaded. If
* you add a new tab then make sure to have a look at #refreshDataFor(Widget widget) to ensure that upon
@@ -150,10 +147,9 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
return target;
}
public AdminConsolePanel(UserService userService, PermissionsForRoleProvider permissionsForRoleProvider,
public AdminConsolePanel(UserService userService,
ServerInfoRetriever buildVersionRetriever, String releaseNotesAnchorLabel,
String releaseNotesURL, ErrorReporter errorReporter, LoginPanelCss loginPanelCss, StringMessages stringMessages) {
this.permissionsForRoleProvider = permissionsForRoleProvider;
this.permissionsAnyOfWhichIsRequiredToSeeWidget = new HashMap<>();
this.userService = userService;
roleSpecificTabs = new LinkedHashSet<>();
@@ -446,7 +442,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
private boolean userHasPermissionsToSeeWidget(UserDTO user, Widget widget) {
for (Permission requiredStringPermission : permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget)) {
WildcardPermission requiredPermission = new WildcardPermission(requiredStringPermission.getStringPermission());
for (WildcardPermission userPermission : user.getAllPermissions(permissionsForRoleProvider)) {
for (WildcardPermission userPermission : user.getAllPermissions()) {
if (requiredPermission.implies(userPermission) || userPermission.implies(requiredPermission)) {
return true;
}
java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java
+20 -20
View File
@@ -20,35 +20,35 @@ import com.sap.sse.security.ui.shared.UserDTO;
import com.sap.sse.security.ui.shared.UserGroupDTO;
public interface UserManagementService extends RemoteService {
Collection<AccessControlListDTO> getAccessControlListList();
Collection<AccessControlListDTO> getAccessControlListList() throws UnauthorizedException;
AccessControlListDTO getAccessControlList(String idAsString);
AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings);
AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings) throws UnauthorizedException;
AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission);
AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException;
AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission);
AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException;
Collection<TenantDTO> getTenantList();
Collection<TenantDTO> getTenantList() throws UnauthorizedException;
TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException;
TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException, UnauthorizedException;
UserGroupDTO addUserToTenant(String idAsString, String user) throws UnauthorizedException;
UserGroupDTO removeUserFromTenant(String idAsString, String user) throws UnauthorizedException;
SuccessInfo deleteTenant(String idAsString);
SuccessInfo deleteTenant(String idAsString) throws UnauthorizedException;
Collection<UserDTO> getUserList();
Collection<UserDTO> getUserList() throws UnauthorizedException;
Collection<UserDTO> getFilteredSortedUserList(String filter);
Collection<UserDTO> getFilteredSortedUserList(String filter) throws UnauthorizedException;
UserDTO getCurrentUser();
UserDTO getCurrentUser() throws UnauthorizedException;
SuccessInfo login(String username, String password);
UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException;
UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException, UnauthorizedException;
/**
* Either <code>oldPassword</code> or <code>passwordResetSecret</code> need to be provided, or the current user needs to have
@@ -64,13 +64,13 @@ public interface UserManagementService extends RemoteService {
boolean validateEmail(String username, String validationSecret) throws UserManagementException;
SuccessInfo deleteUser(String username);
SuccessInfo deleteUser(String username) throws UnauthorizedException;
SuccessInfo logout();
SuccessInfo setRolesForUser(String username, Iterable<UUID> roles);
SuccessInfo setRolesForUser(String username, Iterable<UUID> roles) throws UnauthorizedException;
SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions);
SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions) throws UnauthorizedException;
Map<String, String> getSettings();
@@ -88,24 +88,24 @@ public interface UserManagementService extends RemoteService {
* @param value must not be <code>null</code>
* @throws UserManagementException
*/
void setPreference(String username, String key, String value) throws UserManagementException;
void setPreference(String username, String key, String value) throws UserManagementException, UnauthorizedException;
void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException;
void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException, UnauthorizedException;
/**
* Permitted only for users with role {@link DefaultRoles#ADMIN} or when the subject's user name matches
* <code>username</code>.
*/
void unsetPreference(String username, String key) throws UserManagementException;
void unsetPreference(String username, String key) throws UserManagementException, UnauthorizedException;
/**
* @return <code>null</code> if no preference for the user identified by <code>username</code> is found
*/
String getPreference(String username, String key) throws UserManagementException;
String getPreference(String username, String key) throws UserManagementException, UnauthorizedException;
Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException;
Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException, UnauthorizedException;
Map<String, String> getAllPreferences(String username) throws UserManagementException;
Map<String, String> getAllPreferences(String username) throws UserManagementException, UnauthorizedException;
String getAccessToken(String username);
java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserDetailsView.java
+2 -6
View File
@@ -30,7 +30,6 @@ import com.sap.sse.gwt.client.controls.listedit.StringListEditorComposite;
import com.sap.sse.gwt.client.dialog.DataEntryDialog;
import com.sap.sse.security.shared.DefaultPermissions;
import com.sap.sse.security.shared.Permission;
import com.sap.sse.security.shared.PermissionsForRoleProvider;
import com.sap.sse.security.shared.Role;
import com.sap.sse.security.shared.UserManagementException;
import com.sap.sse.security.shared.WildcardPermission;
@@ -59,14 +58,11 @@ public class UserDetailsView extends FlowPanel {
private final ListBox allPermissionsList;
private UserDTO user;
private final PermissionsForRoleProvider permissionForRoleProvider;
public UserDetailsView(final UserService userService, UserDTO user, final StringMessages stringMessages,
final UserListDataProvider userListDataProvider, PermissionsForRoleProvider permissionsForRoleProvider,
final UserListDataProvider userListDataProvider,
Iterable<Role> additionalRoles, Iterable<Permission> additionalPermissions) {
final UserManagementServiceAsync userManagementService = userService.getUserManagementService();
this.stringMessages = stringMessages;
this.permissionForRoleProvider = permissionsForRoleProvider;
this.user = user;
addStyleName("userDetailsView");
List<String> defaultRoleNames = new ArrayList<>(); // TODO: add dynamic roles here
@@ -265,7 +261,7 @@ public class UserDetailsView extends FlowPanel {
rolesEditor.setValue(user.getStringRoles(), /* fireEvents */ false);
permissionsEditor.setValue(user.getStringPermissions(), /* fireEvents */ false);
allPermissionsList.clear();
for (WildcardPermission permission : user.getAllPermissions(permissionForRoleProvider)) {
for (WildcardPermission permission : user.getAllPermissions()) {
allPermissionsList.addItem(permission.toString());
}
}
java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserManagementPanel.java
+4 -6
View File
@@ -28,7 +28,6 @@ import com.google.gwt.view.client.SelectionChangeEvent.Handler;
import com.google.gwt.view.client.SingleSelectionModel;
import com.sap.sse.security.shared.Role;
import com.sap.sse.security.shared.Permission;
import com.sap.sse.security.shared.PermissionsForRoleProvider;
import com.sap.sse.security.ui.client.UserChangeEventHandler;
import com.sap.sse.security.ui.client.UserManagementServiceAsync;
import com.sap.sse.security.ui.client.UserService;
@@ -50,11 +49,11 @@ public class UserManagementPanel extends DockPanel {
private UserListDataProvider userListDataProvider;
public UserManagementPanel(final UserService userService, final StringMessages stringMessages, PermissionsForRoleProvider permissionsForRoleProvider) {
this(userService, stringMessages, permissionsForRoleProvider, Collections.<Role>emptySet(), Collections.<Permission>emptySet());
public UserManagementPanel(final UserService userService, final StringMessages stringMessages) {
this(userService, stringMessages, Collections.<Role>emptySet(), Collections.<Permission>emptySet());
}
public UserManagementPanel(final UserService userService, final StringMessages stringMessages, PermissionsForRoleProvider permissionsForRoleProvider,
public UserManagementPanel(final UserService userService, final StringMessages stringMessages,
Iterable<Role> additionalRoles, Iterable<Permission> additionalPermissions) {
final UserManagementServiceAsync userManagementService = userService.getUserManagementService();
VerticalPanel west = new VerticalPanel();
@@ -139,8 +138,7 @@ public class UserManagementPanel extends DockPanel {
TextBox filterBox = new TextBox();
userListDataProvider = new UserListDataProvider(userManagementService, filterBox);
final UserDetailsView userDetailsView = new UserDetailsView(userService,
singleSelectionModel.getSelectedObject(), stringMessages, userListDataProvider,
permissionsForRoleProvider, additionalRoles, additionalPermissions);
singleSelectionModel.getSelectedObject(), stringMessages, userListDataProvider, additionalRoles, additionalPermissions);
add(userDetailsView, DockPanel.CENTER);
userDetailsView.addUserChangeEventHandler(new UserChangeEventHandler() {
@Override
java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java
+211 -151
View File
@@ -25,13 +25,11 @@ import javax.servlet.http.HttpSession;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.permission.WildcardPermission;
import org.apache.shiro.subject.Subject;
import org.osgi.framework.BundleContext;
import org.osgi.util.tracker.ServiceTracker;
import com.google.gwt.user.server.rpc.RemoteServiceServlet;
import com.sap.sailing.domain.common.security.Permission;
import com.sap.sse.common.Util;
import com.sap.sse.common.mail.MailException;
import com.sap.sse.common.util.NaturalComparator;
@@ -44,7 +42,6 @@ import com.sap.sse.security.shared.AccessControlList;
import com.sap.sse.security.shared.Account;
import com.sap.sse.security.shared.Account.AccountType;
import com.sap.sse.security.shared.Owner;
import com.sap.sse.security.shared.Permission.DefaultModes;
import com.sap.sse.security.shared.Role;
import com.sap.sse.security.shared.SocialUserAccount;
import com.sap.sse.security.shared.TenantManagementException;
@@ -145,13 +142,17 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public Collection<AccessControlListDTO> getAccessControlListList() {
List<AccessControlListDTO> acls = new ArrayList<>();
for (AccessControlList acl : getSecurityService().getAccessControlListList()) {
AccessControlListDTO aclDTO = createAclDTOFromAcl(acl);
acls.add(aclDTO);
public Collection<AccessControlListDTO> getAccessControlListList() throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("manage_access_control")) {
List<AccessControlListDTO> acls = new ArrayList<>();
for (AccessControlList acl : getSecurityService().getAccessControlListList()) {
AccessControlListDTO aclDTO = createAclDTOFromAcl(acl);
acls.add(aclDTO);
}
return acls;
} else {
throw new UnauthorizedException("Not permitted to manage access control");
}
return acls;
}
@Override
@@ -160,61 +161,81 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings) {
Map<UserGroup, Set<String>> permissionMap = new HashMap<>();
for (String group : permissionStrings.keySet()) {
permissionMap.put(getSecurityService().getUserGroupByName(group), permissionStrings.get(group));
public AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("tenant:grant_permission,revoke_permission")) {
Map<UserGroup, Set<String>> permissionMap = new HashMap<>();
for (String group : permissionStrings.keySet()) {
permissionMap.put(getSecurityService().getUserGroupByName(group), permissionStrings.get(group));
}
return createAclDTOFromAcl(getSecurityService().updateACL(idAsString, permissionMap));
} else {
throw new UnauthorizedException("Not permitted to grant and revoke permissions for user");
}
return createAclDTOFromAcl(getSecurityService().updateACL(idAsString, permissionMap));
}
@Override
public AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission) {
UUID tenantId = UUID.fromString(tenantIdAsString);
return createAclDTOFromAcl(getSecurityService().addToACL(idAsString, tenantId, permission));
}
@Override
public AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission) {
UUID tenantId = UUID.fromString(tenantIdAsString);
return createAclDTOFromAcl(getSecurityService().removeFromACL(idAsString, tenantId, permission));
}
@Override
public Collection<TenantDTO> getTenantList() {
List<TenantDTO> tenants = new ArrayList<>();
for (Tenant t : getSecurityService().getTenantList()) {
TenantDTO tenantDTO = createTenantDTOFromTenant(t);
tenants.add(tenantDTO);
public AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("tenant:grant_permission:" + tenantIdAsString)) {
UUID tenantId = UUID.fromString(tenantIdAsString);
return createAclDTOFromAcl(getSecurityService().addToACL(idAsString, tenantId, permission));
} else {
throw new UnauthorizedException("Not permitted to grant permission for user");
}
return tenants;
}
@Override
public TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException {
UUID id = UUID.randomUUID();
Tenant tenant;
try {
tenant = getSecurityService().createTenant(id, name);
} catch (UserGroupManagementException e) {
throw new TenantManagementException(e.getMessage());
public AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("tenant:revoke_permission:" + tenantIdAsString)) {
UUID tenantId = UUID.fromString(tenantIdAsString);
return createAclDTOFromAcl(getSecurityService().removeFromACL(idAsString, tenantId, permission));
} else {
throw new UnauthorizedException("Not permitted to revoke permission for user");
}
}
@Override
public Collection<TenantDTO> getTenantList() throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("manage_tenants")) {
List<TenantDTO> tenants = new ArrayList<>();
for (Tenant t : getSecurityService().getTenantList()) {
TenantDTO tenantDTO = createTenantDTOFromTenant(t);
tenants.add(tenantDTO);
}
return tenants;
} else {
throw new UnauthorizedException("Not permitted to manage tenants");
}
}
@Override
public TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("tenant:create")) {
UUID id = UUID.randomUUID();
Tenant tenant;
try {
tenant = getSecurityService().createTenant(id, name);
} catch (UserGroupManagementException e) {
throw new TenantManagementException(e.getMessage());
}
getSecurityService().createOwnership(id.toString(), (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId(), name);
return createTenantDTOFromTenant(tenant);
} else {
throw new UnauthorizedException("Not permitted to create tenants");
}
getSecurityService().createOwnership(id.toString(), (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId(), name);
return createTenantDTOFromTenant(tenant);
}
@Override
public UserGroupDTO addUserToTenant(String idAsString, String user) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("usergroup:add_user:" + idAsString + ":" + user)) {
if (SecurityUtils.getSubject().isPermitted("tenant:add_user:" + idAsString)) {
return createUserGroupDTOFromUserGroup(getSecurityService().addUserToUserGroup(UUID.fromString(idAsString), user));
} else {
throw new UnauthorizedException("Not permitted to add user from tenant");
throw new UnauthorizedException("Not permitted to add user to tenant");
}
}
@Override
public UserGroupDTO removeUserFromTenant(String idAsString, String user) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted(new WildcardPermission(UserGroup.class.getName() + ":remove-user:" + user, true))) {
if (SecurityUtils.getSubject().isPermitted("tenant:remove_user:" + idAsString)) {
return createUserGroupDTOFromUserGroup(getSecurityService().removeUserFromUserGroup(UUID.fromString(idAsString), user));
} else {
throw new UnauthorizedException("Not permitted to remove user from tenant");
@@ -222,36 +243,48 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public SuccessInfo deleteTenant(String idAsString) {
try {
UUID id = UUID.fromString(idAsString);
getSecurityService().deleteTenant(id);
getSecurityService().deleteACL(id.toString());
getSecurityService().deleteOwnership(id.toString());
return new SuccessInfo(true, "Deleted tenant: " + idAsString + ".", /* redirectURL */ null, null);
} catch (UserGroupManagementException e) {
return new SuccessInfo(false, "Could not delete tenant.", /* redirectURL */ null, null);
public SuccessInfo deleteTenant(String idAsString) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("tenant:delete:" + idAsString)) {
try {
UUID id = UUID.fromString(idAsString);
getSecurityService().deleteTenant(id);
getSecurityService().deleteACL(id.toString());
getSecurityService().deleteOwnership(id.toString());
return new SuccessInfo(true, "Deleted tenant: " + idAsString + ".", /* redirectURL */ null, null);
} catch (UserGroupManagementException e) {
return new SuccessInfo(false, "Could not delete tenant.", /* redirectURL */ null, null);
}
} else {
throw new UnauthorizedException("Not permitted to delete tenant");
}
}
@Override
public Collection<UserDTO> getUserList() {
List<UserDTO> users = new ArrayList<>();
for (User u : getSecurityService().getUserList()) {
UserDTO userDTO = createUserDTOFromUser(u);
users.add(userDTO);
public Collection<UserDTO> getUserList() throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("manage_users")) {
List<UserDTO> users = new ArrayList<>();
for (User u : getSecurityService().getUserList()) {
UserDTO userDTO = createUserDTOFromUser(u);
users.add(userDTO);
}
return users;
} else {
throw new UnauthorizedException("Not permitted to manage users");
}
return users;
}
@Override
public UserDTO getCurrentUser() {
public UserDTO getCurrentUser() throws UnauthorizedException {
logger.fine("Request: " + getThreadLocalRequest().getRequestURL());
User user = getSecurityService().getCurrentUser();
if (user == null) {
return null;
}
return createUserDTOFromUser(user);
if (SecurityUtils.getSubject().isPermitted("user:view:" + user.getName())) {
return createUserDTOFromUser(user);
} else {
throw new UnauthorizedException("Not permitted to view current user");
}
}
@Override
@@ -279,29 +312,31 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException {
User u = null;
try {
u = getSecurityService().createSimpleUser(name, email, password, fullName, company, getLocaleFromLocaleName(localeName), validationBaseURL);
getSecurityService().createOwnership(name, (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId());
} catch (UserManagementException | UserGroupManagementException e) {
logger.log(Level.SEVERE, "Error creating user "+name, e);
throw new UserManagementException(e.getMessage());
public UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:create")) {
User u = null;
try {
u = getSecurityService().createSimpleUser(name, email, password, fullName, company, getLocaleFromLocaleName(localeName), validationBaseURL);
getSecurityService().createOwnership(name, (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId());
} catch (UserManagementException | UserGroupManagementException e) {
logger.log(Level.SEVERE, "Error creating user "+name, e);
throw new UserManagementException(e.getMessage());
}
if (u == null) {
return null;
}
return createUserDTOFromUser(u);
} else {
throw new UnauthorizedException("Not permitted to create user");
}
if (u == null) {
return null;
}
return createUserDTOFromUser(u);
}
@Override
public void updateSimpleUserPassword(final String username, String oldPassword, String passwordResetSecret, String newPassword) throws UserManagementException {
// final Subject subject = SecurityUtils.getSubject();
// the signed-in subject has role ADMIN
// if (subject.hasRole(AdminRole.getInstance().getName()) ||
if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)
// someone knew a username and the correct password for that user
if ((oldPassword != null && getSecurityService().checkPassword(username, oldPassword))
|| (oldPassword != null && getSecurityService().checkPassword(username, oldPassword))
// someone provided the correct password reset secret for the correct username
|| (passwordResetSecret != null && getSecurityService().checkPasswordResetSecret(username, passwordResetSecret))) {
getSecurityService().updateSimpleUserPassword(username, newPassword);
@@ -321,9 +356,9 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
private void ensureThatUserInQuestionIsLoggedInOrCurrentUserIsAdmin(String username) throws UserManagementException {
final Subject subject = SecurityUtils.getSubject();
// the signed-in subject has role ADMIN or is changing own user
//if (!subject.hasRole(AdminRole.getInstance().getName()) &&
if ((subject.getPrincipal() == null
// the signed-in subject has all permissions or is changing own user
if (SecurityUtils.getSubject().isPermitted("*") &&
(subject.getPrincipal() == null
|| !username.equals(subject.getPrincipal().toString()))) {
throw new UserManagementException(UserManagementException.INVALID_CREDENTIALS);
}
@@ -365,31 +400,34 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public Collection<UserDTO> getFilteredSortedUserList(String filter) {
List<UserDTO> users = new ArrayList<>();
for (User u : getSecurityService().getUserList()) {
if (filter != null && !"".equals(filter)) {
if (u.getName().contains(filter)) {
public Collection<UserDTO> getFilteredSortedUserList(String filter) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("manage_users")) {
List<UserDTO> users = new ArrayList<>();
for (User u : getSecurityService().getUserList()) {
if (filter != null && !"".equals(filter)) {
if (u.getName().contains(filter)) {
users.add(createUserDTOFromUser(u));
}
} else {
users.add(createUserDTOFromUser(u));
}
} else {
users.add(createUserDTOFromUser(u));
}
Collections.sort(users, new Comparator<UserDTO>() {
private final NaturalComparator naturalComparator = new NaturalComparator(/* caseSensitive */ false);
@Override
public int compare(UserDTO u1, UserDTO u2) {
return naturalComparator.compare(u1.getName(), u2.getName());
}
});
return users;
} else {
throw new UnauthorizedException("Not permitted to manage users");
}
Collections.sort(users, new Comparator<UserDTO>() {
private final NaturalComparator naturalComparator = new NaturalComparator(/* caseSensitive */ false);
@Override
public int compare(UserDTO u1, UserDTO u2) {
return naturalComparator.compare(u1.getName(), u2.getName());
}
});
return users;
}
@Override
public SuccessInfo setRolesForUser(String username, Iterable<UUID> roles) {
// Subject currentSubject = SecurityUtils.getSubject();
// if (currentSubject.hasRole(AdminRole.getInstance().getName())) {
public SuccessInfo setRolesForUser(String username, Iterable<UUID> roles) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:grant_permission,revoke_permission:" + username)) {
User u = getSecurityService().getUserByName(username);
if (u == null) {
return new SuccessInfo(false, "User does not exist.", /* redirectURL */null, null);
@@ -408,16 +446,14 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
return new SuccessInfo(true, "Set roles " + roles + " for user " + username, /* redirectURL */null,
createUserDTOFromUser(u));
//} else {
// return new SuccessInfo(false, "You don't have the required permissions to add a role.", /* redirectURL */ null, null);
//}
} else {
throw new UnauthorizedException("Not permitted to grant permissions to user");
}
}
@Override
public SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions) {
Subject currentSubject = SecurityUtils.getSubject();
//if (SecurityUtils.getSubject().hasRole(AdminRole.getInstance().getName()) ||
if (currentSubject.isPermitted(Permission.MANAGE_USERS.getStringPermissionForObjects(DefaultModes.UPDATE, username))) {
public SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:grant_permission,revoke_permission:" + username)) {
User u = getSecurityService().getUserByName(username);
if (u == null) {
return new SuccessInfo(false, "User does not exist.", /* redirectURL */null, null);
@@ -437,12 +473,13 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
return new SuccessInfo(true, "Set roles " + permissions + " for user " + username, /* redirectURL */null,
createUserDTOFromUser(u));
} else {
return new SuccessInfo(false, "You don't have the required permissions to add a role.", /* redirectURL */ null, null);
throw new UnauthorizedException("Not permitted to grant or revoke permissions for user");
}
}
@Override
public SuccessInfo deleteUser(String username) {
public SuccessInfo deleteUser(String username) throws UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:delete:" + username)) {
try {
getSecurityService().deleteUser(username);
getSecurityService().deleteACL(username);
@@ -451,6 +488,9 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
} catch (UserManagementException e) {
return new SuccessInfo(false, "Could not delete user.", /* redirectURL */ null, null);
}
} else {
throw new UnauthorizedException("Not permitted to delete user");
}
}
private RoleDTO createRoleDTOFromRole(Role role) {
@@ -603,45 +643,61 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public void setPreference(String username, String key, String value) throws UserManagementException {
try {
getSecurityService().setPreference(username, key, value);
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
}
@Override
public void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException {
try {
for (Entry<String, String> entry : keyValuePairs.entrySet()) {
getSecurityService().setPreference(username, entry.getKey(), entry.getValue());
public void setPreference(String username, String key, String value) throws UserManagementException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)) {
try {
getSecurityService().setPreference(username, key, value);
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
}
@Override
public void unsetPreference(String username, String key) throws UserManagementException {
try {
getSecurityService().unsetPreference(username, key);
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
}
@Override
public String getPreference(String username, String key) throws UserManagementException {
try {
return getSecurityService().getPreference(username, key);
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
} else {
throw new UnauthorizedException("Not permitted to edit user");
}
}
@Override
public Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException {
public void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)) {
try {
for (Entry<String, String> entry : keyValuePairs.entrySet()) {
getSecurityService().setPreference(username, entry.getKey(), entry.getValue());
}
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
} else {
throw new UnauthorizedException("Not permitted to edit user");
}
}
@Override
public void unsetPreference(String username, String key) throws UserManagementException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)) {
try {
getSecurityService().unsetPreference(username, key);
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
} else {
throw new UnauthorizedException("Not permitted to edit user");
}
}
@Override
public String getPreference(String username, String key) throws UserManagementException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:view:" + username)) {
try {
return getSecurityService().getPreference(username, key);
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
} else {
throw new UnauthorizedException("Not permitted to view user");
}
}
@Override
public Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException, UnauthorizedException {
Map<String, String> requestedPreferences = new HashMap<>();
for (String key : keys) {
requestedPreferences.put(key, getPreference(username, key));
@@ -650,18 +706,22 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
}
@Override
public Map<String, String> getAllPreferences(String username) throws UserManagementException {
try {
final Map<String, String> allPreferences = getSecurityService().getAllPreferences(username);
final Map<String, String> result = new HashMap<>();
for (Map.Entry<String, String> entry : allPreferences.entrySet()) {
if(!entry.getKey().startsWith("_")) {
result.put(entry.getKey(), entry.getValue());
public Map<String, String> getAllPreferences(String username) throws UserManagementException, UnauthorizedException {
if (SecurityUtils.getSubject().isPermitted("user:view:" + username)) {
try {
final Map<String, String> allPreferences = getSecurityService().getAllPreferences(username);
final Map<String, String> result = new HashMap<>();
for (Map.Entry<String, String> entry : allPreferences.entrySet()) {
if(!entry.getKey().startsWith("_")) {
result.put(entry.getKey(), entry.getValue());
}
}
return result;
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
}
return result;
} catch (AuthorizationException e) {
throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
} else {
throw new UnauthorizedException("Not permitted to view user");
}
}
java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/shared/UserDTO.java
+1 -1
View File
@@ -119,7 +119,7 @@ public class UserDTO implements IsSerializable {
* @return a set of permissions with no duplicates, all in the format parsable by
* {@link WildcardPermission#WildcardPermission(String)}
*/
public Iterable<WildcardPermission> getAllPermissions(PermissionsForRoleProvider permissionsForRoleProvider) {
public Iterable<WildcardPermission> getAllPermissions() {
Set<WildcardPermission> result = new LinkedHashSet<>();
Util.addAll(permissions, result);
if (rolePermissionModel != null) {
java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/usermanagement/UserManagementEntryPoint.java
+1 -2
View File
@@ -26,8 +26,7 @@ public class UserManagementEntryPoint extends AbstractSecurityEntryPoint {
public void onUserStatusChange(UserDTO user, boolean preAuthenticated) {
}
});
UserManagementPanel userManagementPanel = new UserManagementPanel(getUserService(), getStringMessages(),
/* permissionsForRoleProvider is null in this generic entry point */ null);
UserManagementPanel userManagementPanel = new UserManagementPanel(getUserService(), getStringMessages());
center.add(new ScrollPanel(userManagementPanel), getStringMessages().users());
final SettingsPanel settingsPanel = new SettingsPanel(getUserManagementService(), getStringMessages());
center.add(new ScrollPanel(settingsPanel), getStringMessages().settings());
java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthrizingRealm.java
+1
View File
@@ -161,6 +161,7 @@ public abstract class AbstractCompositeAuthrizingRealm extends AuthorizingRealm
@Override
public boolean isPermitted(PrincipalCollection principals, Permission perm) {
//TODO check whether WildcardPermission functionality can be used here (perm instanceof)
String[] parts = perm.toString().replaceAll("\\[|\\]", "").split(":");
String user = (String) principals.getPrimaryPrincipal();