From d21bff91443ee019f2463b60903bec137fbc899a Mon Sep 17 00:00:00 2001
From: Usman Ali
Date: Mon, 6 Jan 2020 00:32:21 +0500
Subject: [PATCH 01/19] ownership change api
---
java/com.sap.sse.security/resources/shiro.ini | 1 +
.../exceptions/OwnershipException.java | 28 +++++++++
.../handler/OwnershipExceptionHandler.java | 28 +++++++++
.../security/jaxrs/api/OwnershipResource.java | 63 +++++++++++++++++++
.../jaxrs/api/RestApiApplication.java | 4 +-
.../sse/security/model/GeneralResponse.java | 43 +++++++++++++
6 files changed, 166 insertions(+), 1 deletion(-)
create mode 100644 java/com.sap.sse.security/src/com/sap/sse/security/exceptions/OwnershipException.java
create mode 100644 java/com.sap.sse.security/src/com/sap/sse/security/exceptions/handler/OwnershipExceptionHandler.java
create mode 100644 java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java
create mode 100644 java/com.sap.sse.security/src/com/sap/sse/security/model/GeneralResponse.java
diff --git a/java/com.sap.sse.security/resources/shiro.ini b/java/com.sap.sse.security/resources/shiro.ini
index e609445da71..7379336928c 100644
--- a/java/com.sap.sse.security/resources/shiro.ini
+++ b/java/com.sap.sse.security/resources/shiro.ini
@@ -76,3 +76,4 @@ bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter
/api/restsecurity/usergroup = bearerToken
/api/restsecurity/role = bearerToken
/api/restsecurity/role/** = bearerToken
+/api/restsecurity/ownership/** = bearerToken
\ No newline at end of file
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/exceptions/OwnershipException.java b/java/com.sap.sse.security/src/com/sap/sse/security/exceptions/OwnershipException.java
new file mode 100644
index 00000000000..a7100729bc2
--- /dev/null
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/exceptions/OwnershipException.java
@@ -0,0 +1,28 @@
+package com.sap.sse.security.exceptions;
+
+import javax.ws.rs.core.Response.Status;
+import com.sap.sse.security.jaxrs.api.OwnershipResource;
+
+/***
+ * OwnershipException is used for {@link OwnershipResource} class to handle any exception in ownership Api's.
+ * @author Usman Ali
+ *
+ */
+public class OwnershipException extends Exception{
+
+ private static final long serialVersionUID = 1L;
+
+ private Status status;
+
+ public OwnershipException(String message, Status status) {
+ super(message);
+ this.status = status;
+ }
+
+ public Status getStatus() {
+ return status;
+ }
+
+
+
+}
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/exceptions/handler/OwnershipExceptionHandler.java b/java/com.sap.sse.security/src/com/sap/sse/security/exceptions/handler/OwnershipExceptionHandler.java
new file mode 100644
index 00000000000..986012b0be6
--- /dev/null
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/exceptions/handler/OwnershipExceptionHandler.java
@@ -0,0 +1,28 @@
+package com.sap.sse.security.exceptions.handler;
+
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import javax.ws.rs.core.Response;
+import javax.ws.rs.ext.ExceptionMapper;
+import javax.ws.rs.ext.Provider;
+
+import com.sap.sse.security.exceptions.OwnershipException;
+import com.sap.sse.security.jaxrs.ShiroAuthorizationExceptionTo401ResponseMapper;
+import com.sap.sse.security.model.GeneralResponse;
+
+
+/***
+ * This class is used to handle {@link OwnershipException} thrown from any API of project.
+ * @author Usman Ali
+ *
+ */
+@Provider
+public class OwnershipExceptionHandler implements ExceptionMapper {
+ private static final Logger logger = Logger.getLogger(ShiroAuthorizationExceptionTo401ResponseMapper.class.getName());
+ @Override
+ public Response toResponse(OwnershipException exception) {
+ logger.log(Level.WARNING, "OwnershipException occurred in REST call: " + exception.getMessage());
+ return Response.status(exception.getStatus()).entity(new GeneralResponse(false, exception.getMessage()).toString()).build();
+ }
+}
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java
new file mode 100644
index 00000000000..18a13827afe
--- /dev/null
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java
@@ -0,0 +1,63 @@
+package com.sap.sse.security.jaxrs.api;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.Status;
+
+import org.apache.shiro.SecurityUtils;
+import org.json.simple.JSONObject;
+import org.json.simple.JSONValue;
+
+import com.sap.sse.security.exceptions.OwnershipException;
+import com.sap.sse.security.jaxrs.AbstractSecurityResource;
+import com.sap.sse.security.model.GeneralResponse;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
+import com.sap.sse.security.shared.QualifiedObjectIdentifier;
+import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
+import com.sap.sse.security.shared.impl.QualifiedObjectIdentifierImpl;
+import com.sap.sse.security.shared.impl.User;
+import com.sap.sse.security.shared.impl.UserGroup;
+
+@Path("/restsecurity/ownership")
+public class OwnershipResource extends AbstractSecurityResource {
+ private static final String KEY_OBJECT_ID = "objectId";
+ private static final String KEY_OBJECT_TYPE = "objectType";
+ private static final String KEY_USERNAME = "username";
+ private static final String KEY_GROUP_ID="groupId";
+
+ @POST
+ @Consumes(MediaType.APPLICATION_JSON)
+ @Produces("application/json;charset=UTF-8")
+ public Response createUser(String jsonBody) throws OwnershipException {
+
+ final JSONObject json = (JSONObject) JSONValue.parse(jsonBody);
+ User user =getService().getUserByName((String)json.get(KEY_USERNAME));
+ if(user == null) {
+ throw new OwnershipException("User Not found",Status.BAD_REQUEST);
+ }
+ UserGroup userGroup =getService().getUserGroupByName((String)json.get(KEY_GROUP_ID));
+ if(userGroup == null) {
+ throw new OwnershipException("UserGroup Not found",Status.BAD_REQUEST);
+ }
+ QualifiedObjectIdentifier identifier = new QualifiedObjectIdentifierImpl(
+ (String)json.get(KEY_OBJECT_TYPE),
+ new TypeRelativeObjectIdentifier((String)json.get(KEY_OBJECT_ID))
+ );
+
+ try {
+ SecurityUtils.getSubject()
+ .checkPermission(identifier.getStringPermission(DefaultActions.CHANGE_OWNERSHIP));
+ }catch(Exception ex) {
+ throw new OwnershipException("Not permitted to change ownership.", Status.FORBIDDEN);
+ }
+
+ getService().setOwnership(identifier, user, userGroup);
+
+
+ return Response.ok(new GeneralResponse(true, "Ownership changed successfully").toString()).build();
+ }
+}
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/RestApiApplication.java b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/RestApiApplication.java
index 1289d310e70..5caf9ec1301 100644
--- a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/RestApiApplication.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/RestApiApplication.java
@@ -5,6 +5,7 @@ import java.util.Set;
import javax.ws.rs.core.Application;
+import com.sap.sse.security.exceptions.handler.OwnershipExceptionHandler;
import com.sap.sse.security.jaxrs.ShiroAuthorizationExceptionTo401ResponseMapper;
public class RestApiApplication extends Application {
@@ -13,9 +14,10 @@ public class RestApiApplication extends Application {
classes.add(SecurityResource.class);
classes.add(UserGroupResource.class);
classes.add(RoleResource.class);
-
+ classes.add(OwnershipResource.class);
// exception mapper
classes.add(ShiroAuthorizationExceptionTo401ResponseMapper.class);
+ classes.add(OwnershipExceptionHandler.class);
return classes;
}
}
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/model/GeneralResponse.java b/java/com.sap.sse.security/src/com/sap/sse/security/model/GeneralResponse.java
new file mode 100644
index 00000000000..d4027b8f7ec
--- /dev/null
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/model/GeneralResponse.java
@@ -0,0 +1,43 @@
+package com.sap.sse.security.model;
+
+import java.io.Serializable;
+
+/***
+ * This Class will be used to send general response in JSON format.
+ * @author Usman Ali
+ *
+ */
+public class GeneralResponse implements Serializable{
+
+ private static final long serialVersionUID = 1L;
+
+ private boolean responseStatus;
+ private String responseMessage;
+
+ public GeneralResponse(boolean responseStatus, String responseMessage) {
+ super();
+ this.responseStatus = responseStatus;
+ this.responseMessage = responseMessage;
+ }
+
+ public boolean isResponseStatus() {
+ return responseStatus;
+ }
+ public void setResponseStatus(boolean responseStatus) {
+ this.responseStatus = responseStatus;
+ }
+ public String getResponseMessage() {
+ return responseMessage;
+ }
+ public void setResponseMessage(String responseMessage) {
+ this.responseMessage = responseMessage;
+ }
+
+ @Override
+ public String toString() {
+ return " {\"responseStatus\":\"" + responseStatus + "\", \"responseMessage\":\"" + responseMessage + "\"}";
+
+ }
+
+
+}
From 1b686fc5c5630c683557eb7fd957d51e9ddc195b Mon Sep 17 00:00:00 2001
From: Usman Ali
Date: Tue, 7 Jan 2020 01:44:27 +0500
Subject: [PATCH 02/19] adding ownership page into webservices/api folder
---
.../webservices/api/index.html | 4 ++
.../webservices/api/ownership.html | 51 +++++++++++++++++++
2 files changed, 55 insertions(+)
create mode 100644 java/com.sap.sse.security/webservices/api/ownership.html
diff --git a/java/com.sap.sse.security/webservices/api/index.html b/java/com.sap.sse.security/webservices/api/index.html
index 50901420d93..4fcd574b8ca 100755
--- a/java/com.sap.sse.security/webservices/api/index.html
+++ b/java/com.sap.sse.security/webservices/api/index.html
@@ -62,6 +62,10 @@ be http://sapsailing.com/security/api/restsecurity/login.
/api/restsecurity/remove_access_token |
Remove an existing access token, rendering it invalid for authenticating to the server |
+
+ | /api/restsecurity/ownership |
+ Change Object ownership |
+
+SAP Sponsorships Engine Security Webservices API
+URL: /api/restsecurity/onwership
+
+Description:
+The service changes the ownership of object.
+
+
+Change Ownership
+
+
+ | Request Method: |
+ POST |
+
+
+ | Output format: |
+ a JSON document of the following format
+ { "responseStatus": "true", "responseMessage": "Ownership changed successfully"}
+ |
+
+
+ | Parameter (JSON Body): |
+
+ objectId Unique Object id.
+ objectType Object type represents the type of object to change the ownership.
+ groupId GroupId to assign given group to ownership of object object.
+ username Username to search the user in order to attach it with given Object ownership.
+ |
+
+
+ | Example: |
+ curl -X POST -d '{
+ "objectId":"427ebd42-ac69-4f74-a171-376d9bea9457",
+ "objectType":"USER_GROUP",
+ "groupId":"admin-tenant",
+ "username":"admin"
+ }' "http://admin:admin@127.0.0.1:8888/security/api/restsecurity/ownership"
+ Will provide a JSON document as explained above. |
+
+
+
diff --git a/java/com.sap.sse.security/webservices/api/ownership.html b/java/com.sap.sse.security/webservices/api/ownership.html
new file mode 100644
index 00000000000..8cb51d0976d
--- /dev/null
+++ b/java/com.sap.sse.security/webservices/api/ownership.html
@@ -0,0 +1,51 @@
+
+
+