Package org.apache.jackrabbit.api.jsr283.security

Examples of org.apache.jackrabbit.api.jsr283.security.AccessControlManager

792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
        assertFalse(getTestSession().hasPermission(path, actions));
        assertFalse(testAcMgr.hasPrivileges(path, privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES)));
    }

    public void testNewNodes() throws RepositoryException, NotExecutableException {
        AccessControlManager testAcMgr = getTestACManager();
        /*
         precondition:
         testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);

        /* create some new nodes below 'path' */
        Node n = ((SessionImpl) superuser).getNode(path);
        for (int i = 0; i < 5; i++) {
            n = n.addNode(nodeName2, testNodeType);
        }
        superuser.save();

        /* make sure the same privileges/permissions are granted as at path. */
        String childPath = n.getPath();
        Privilege[] privs = testAcMgr.getPrivileges(childPath);
        assertEquals(PrivilegeRegistry.getBits(privilegesFromName(Privilege.JCR_READ)),
                PrivilegeRegistry.getBits(privs));
        getTestSession().checkPermission(childPath, org.apache.jackrabbit.api.jsr283.Session.ACTION_READ);
    }
View Full Code Here
915
916
917
918
919
920
921
922
923
924
925
        testUser = null;

        // try to retrieve the acl again
        Session s = helper.getSuperuserSession();
        try {
            AccessControlManager acMgr = getAccessControlManager(s);
            acMgr.getPolicies(acPath);
        } finally {
            s.logout();
        }
    }
View Full Code Here
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
        // make sure the 'rep:policy' node has been created.
        assertTrue(superuser.itemExists(tmpl.getPath() + "/rep:policy"));

        SessionImpl testSession = getTestSession();
        AccessControlManager testAcMgr = getTestACManager();
        // test: MODIFY_AC granted at 'path'
        assertTrue(testAcMgr.hasPrivileges(path, privilegesFromName(Privilege.JCR_MODIFY_ACCESS_CONTROL)));

        // test if testuser can READ access control on the path and on the
        // entire subtree that gets the policy inherited.
        AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
        testAcMgr.getEffectivePolicies(path);
        testAcMgr.getEffectivePolicies(childNPath);

        // test: READ_AC privilege does not apply outside of the tree.
        try {
            testAcMgr.getPolicies(siblingPath);
            fail("READ_AC privilege must not apply outside of the tree it has applied to.");
        } catch (AccessDeniedException e) {
            // success
        }

        // test: MODIFY_AC privilege does not apply outside of the tree.
        try {
            testAcMgr.setPolicy(siblingPath, policies[0]);
            fail("MODIFY_AC privilege must not apply outside of the tree it has applied to.");
        } catch (AccessDeniedException e) {
            // success
        }

        // test if testuser can modify AC-items
        // 1) add an ac-entry
        ACLTemplate acl = (ACLTemplate) policies[0];
        acl.addAccessControlEntry(getTestUser().getPrincipal(), privilegesFromName(PrivilegeRegistry.REP_WRITE));
        testAcMgr.setPolicy(path, acl);
        testSession.save();

        assertTrue(testAcMgr.hasPrivileges(path,
                privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES)));

        // 2) remove the policy
        testAcMgr.removePolicy(path, policies[0]);
        testSession.save();

        // Finally: testuser removed the policy that granted him permission
        // to modify the AC content. Since testuser removed the policy, it's
        // privileges must be gone again...
        try {
            testAcMgr.getEffectivePolicies(childNPath);
            fail("READ_AC privilege has been revoked -> must throw again.");
        } catch (AccessDeniedException e) {
            // success
        }
        // ... and since the ACE is stored with the policy all right except
View Full Code Here
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
        // READ must be gone.
        checkReadOnly(path);
    }

    public void testRemovePermission9() throws NotExecutableException, RepositoryException {
        AccessControlManager testAcMgr = getTestACManager();
        /*
          precondition:
          testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);
        checkReadOnly(childNPath);

        Privilege[] rmChildNodes = privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES);
        Privilege[] rmNode = privilegesFromName(Privilege.JCR_REMOVE_NODE);

        // add 'remove_child_nodes' at 'path and allow 'remove_node' at childNPath
        givePrivileges(path, rmChildNodes, getRestrictions(superuser, path));
        givePrivileges(childNPath, rmNode, getRestrictions(superuser, childNPath));
        /*
         expected result:
         - rep:policy node can still not be remove for it is access-control
           content that requires jcr:modifyAccessControl privilege instead.
         */
        String policyPath = childNPath + "/rep:policy";
        assertFalse(getTestSession().hasPermission(policyPath, org.apache.jackrabbit.api.jsr283.Session.ACTION_REMOVE));
        assertTrue(testAcMgr.hasPrivileges(policyPath, new Privilege[] {rmChildNodes[0], rmNode[0]}));
    }
View Full Code Here
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
    }

    public void testCombinedPolicies() throws RepositoryException, NotExecutableException {
        Group testGroup = getTestGroup();
        SessionImpl testSession = getTestSession();
        AccessControlManager testAcMgr = getTestACManager();

        /*
          precondition:
          testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);

        Privilege[] readPrivs = privilegesFromName(Privilege.JCR_READ);
        // nodebased: remove READ privilege for 'testUser' at 'path'
        withdrawPrivileges(path, readPrivs, getRestrictions(superuser, path));
        // principalbased: add READ privilege for 'testGroup'
        givePrivileges(path, testGroup.getPrincipal(), readPrivs, getPrincipalBasedRestrictions(path), false);
        /*
         expected result:
         - nodebased wins over principalbased -> READ is denied
         */
        assertFalse(testSession.itemExists(path));
        assertFalse(testSession.hasPermission(path, org.apache.jackrabbit.api.jsr283.Session.ACTION_READ));
        assertFalse(testAcMgr.hasPrivileges(path, readPrivs));

        // remove the nodebased policy
        JackrabbitAccessControlList policy = getPolicy(acMgr, path, getTestUser().getPrincipal());
        acMgr.removePolicy(policy.getPath(), policy);
        superuser.save();

        /*
         expected result:
         - READ privilege is present again.
         */
        assertTrue(testSession.itemExists(path));
        assertTrue(testSession.hasPermission(path, org.apache.jackrabbit.api.jsr283.Session.ACTION_READ));
        assertTrue(testAcMgr.hasPrivileges(path, readPrivs));

        // nodebased: add WRITE privilege for 'testUser' at 'path'
        Privilege[] wrtPrivileges = privilegesFromName(PrivilegeRegistry.REP_WRITE);
        givePrivileges(path, wrtPrivileges, getRestrictions(superuser, path));
        // userbased: deny MODIFY_PROPERTIES privileges for 'testUser'
        Privilege[] modPropPrivs = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);
        withdrawPrivileges(path, getTestUser().getPrincipal(), modPropPrivs, getPrincipalBasedRestrictions(path), false);
        /*
         expected result:
         - MODIFY_PROPERTIES privilege still present
         */
        assertTrue(testSession.hasPermission(path+"/anyproperty", org.apache.jackrabbit.api.jsr283.Session.ACTION_SET_PROPERTY));
        assertTrue(testAcMgr.hasPrivileges(path, wrtPrivileges));

        // nodebased: deny MODIFY_PROPERTIES privileges for 'testUser'
        //            on a child node.
        withdrawPrivileges(childNPath, getTestUser().getPrincipal(), modPropPrivs, getRestrictions(superuser, childNPath));
        /*
         expected result:
         - MODIFY_PROPERTIES privilege still present at 'path'
         - no-MODIFY_PROPERTIES privilege at 'childNPath'
         */
        assertTrue(testSession.hasPermission(path+"/anyproperty", org.apache.jackrabbit.api.jsr283.Session.ACTION_SET_PROPERTY));
        assertTrue(testAcMgr.hasPrivileges(path, modPropPrivs));

        assertFalse(testSession.hasPermission(childNPath+"/anyproperty", org.apache.jackrabbit.api.jsr283.Session.ACTION_SET_PROPERTY));
        assertFalse(testAcMgr.hasPrivileges(childNPath, modPropPrivs));
    }
View Full Code Here
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
                Map restrictions = new HashMap();
                restrictions.put(session.getJCRName(ACLTemplate.P_NODE_PATH), vf.createValue(root.getPath(), PropertyType.PATH));
                restrictions.put(session.getJCRName(ACLTemplate.P_GLOB), vf.createValue(GlobPattern.WILDCARD_ALL));

                PrincipalManager pMgr = session.getPrincipalManager();
                AccessControlManager acMgr = session.getAccessControlManager();
                Principal administrators;
                String pName = SecurityConstants.ADMINISTRATORS_NAME;
                if (pMgr.hasPrincipal(pName)) {
                    administrators = pMgr.getPrincipal(pName);
                } else {
                    log.warn("Administrators principal group is missing.");
                    administrators = new PrincipalImpl(pName);
                }
                AccessControlPolicy[] acls = editor.editAccessControlPolicies(administrators);
                ACLTemplate acl = (ACLTemplate) acls[0];
                if (acl.isEmpty()) {
                    log.debug("... Privilege.ALL for administrators principal.");
                    acl.addEntry(administrators,
                            new Privilege[] {acMgr.privilegeFromName(Privilege.JCR_ALL)},
                            true, restrictions);
                    editor.setPolicy(acl.getPath(), acl);
                } else {
                    log.debug("... policy for administrators principal already present.");
                }

                Principal everyone = pMgr.getEveryone();
                acls = editor.editAccessControlPolicies(everyone);
                acl = (ACLTemplate) acls[0];
                if (acl.isEmpty()) {
                    log.debug("... Privilege.READ for everyone principal.");
                    acl.addEntry(everyone,
                            new Privilege[] {acMgr.privilegeFromName(Privilege.JCR_READ)},
                            true, restrictions);
                    editor.setPolicy(acl.getPath(), acl);
                } else {
                    log.debug("... policy for everyone principal already present.");
                }
View Full Code Here
89
90
91
92
93
94
95
96
97
98
99
      try {
        AccessControlManager accessControlManager = AccessControlUtil.getAccessControlManager(session);
        AccessControlList updatedAcl = null;
        AccessControlPolicyIterator applicablePolicies = accessControlManager.getApplicablePolicies(resourcePath);
        while (applicablePolicies.hasNext()) {
          AccessControlPolicy policy = applicablePolicies.nextAccessControlPolicy();
          if (policy instanceof AccessControlList) {
            updatedAcl = (AccessControlList)policy;
            break;
          }
        }
View Full Code Here
52
53
54
55
56
57
58
59
60
61
62
        SessionImpl s = (SessionImpl) n.getSession();
        JackrabbitAccessControlList acl = null;
        AccessControlManager acMgr = s.getAccessControlManager();
        AccessControlPolicyIterator it = acMgr.getApplicablePolicies(n.getPath());
        while (it.hasNext()) {
            AccessControlPolicy acp = it.nextAccessControlPolicy();
            if (acp instanceof JackrabbitAccessControlList) {
                acl = (JackrabbitAccessControlList) acp;
                break;
            }
        }
View Full Code Here
122
123
124
125
126
127
128
129
130
131
132
    try {
      AccessControlManager accessControlManager = AccessControlUtil.getAccessControlManager(session);
      AccessControlList updatedAcl = null;
      AccessControlPolicyIterator applicablePolicies = accessControlManager.getApplicablePolicies(resourcePath);
      while (applicablePolicies.hasNext()) {
        AccessControlPolicy policy = applicablePolicies.nextAccessControlPolicy();
        if (policy instanceof AccessControlList) {
          updatedAcl = (AccessControlList)policy;
          break;
        }
      }
View Full Code Here
193
194
195
196
197
198
199
200
201
202
203
204
        NodeImpl acNode = getAcNode(nodePath);
        if (acNode != null) {
            if (isAccessControlled(acNode)) {
                // build the template in order to have a return value
                AccessControlPolicy tmpl = createTemplate(acNode);
                if (tmpl.equals(policy)) {
                    removeSecurityItem(acNode.getNode(N_POLICY));
                    return;
                }
            }
        }
View Full Code Here
TOP

Related Classes of org.apache.jackrabbit.api.jsr283.security.AccessControlManager

  • junit.framework.TestSuite
  • org.apache.camel.component.jcr.JcrAuthTestBase
  • org.apache.jackrabbit.api.jsr283.version.simple.CopyTest
  • org.apache.jackrabbit.api.jsr283.version.simple.FrozenNodeTest
  • org.apache.jackrabbit.api.jsr283.version.Version
  • org.apache.jackrabbit.core.DefaultSecurityManager
  • org.apache.jackrabbit.core.lock.LockManagerImpl
  • org.apache.jackrabbit.core.NodeImpl
  • org.apache.jackrabbit.core.NodeImplTest
  • org.apache.jackrabbit.core.nodetype.NodeTypeManagerImpl
    • Copyright © 2018 www.massapicom. All rights reserved.
    All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.