Examples with PermissionDeniedException com.cloud.exception.PermissionDeniedException used on opensource projects

Example 11 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class CreateSnapshotCmd method getEntityOwnerId.

@Override
public long getEntityOwnerId() {
    Volume volume = _entityMgr.findById(Volume.class, getVolumeId());
    if (volume == null) {
        throw new InvalidParameterValueException("Unable to find volume by id=" + volumeId);
    }
    Account account = _accountService.getAccount(volume.getAccountId());
    //Can create templates for enabled projects/accounts only
    if (account.getType() == Account.ACCOUNT_TYPE_PROJECT) {
        Project project = _projectService.findByProjectAccountId(volume.getAccountId());
        if (project.getState() != Project.State.Active) {
            throw new PermissionDeniedException("Can't add resources to the project id=" + project.getId() + " in state=" + project.getState() + " as it's no longer active");
        }
    } else if (account.getState() == Account.State.disabled) {
        throw new PermissionDeniedException("The owner of template is disabled: " + account);
    }
    return volume.getAccountId();
}

Example 12 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class QueryManagerImpl method searchForDiskOfferingsInternal.

private Pair<List<DiskOfferingJoinVO>, Integer> searchForDiskOfferingsInternal(ListDiskOfferingsCmd cmd) {
    // Note
    // The list method for offerings is being modified in accordance with
    // discussion with Will/Kevin
    // For now, we will be listing the following based on the usertype
    // 1. For root, we will list all offerings
    // 2. For domainAdmin and regular users, we will list everything in
    // their domains+parent domains ... all the way
    // till
    // root
    Boolean isAscending = Boolean.parseBoolean(_configDao.getValue("sortkey.algorithm"));
    isAscending = (isAscending == null ? true : isAscending);
    Filter searchFilter = new Filter(DiskOfferingJoinVO.class, "sortKey", isAscending, cmd.getStartIndex(), cmd.getPageSizeVal());
    SearchCriteria<DiskOfferingJoinVO> sc = _diskOfferingJoinDao.createSearchCriteria();
    sc.addAnd("type", Op.EQ, DiskOfferingVO.Type.Disk);
    Account account = CallContext.current().getCallingAccount();
    Object name = cmd.getDiskOfferingName();
    Object id = cmd.getId();
    Object keyword = cmd.getKeyword();
    Long domainId = cmd.getDomainId();
    Boolean isRootAdmin = _accountMgr.isRootAdmin(account.getAccountId());
    Boolean isRecursive = cmd.isRecursive();
    // associated with this domain
    if (domainId != null) {
        if (_accountMgr.isRootAdmin(account.getId()) || isPermissible(account.getDomainId(), domainId)) {
            // check if the user's domain == do's domain || user's domain is
            // a child of so's domain for non-root users
            sc.addAnd("domainId", SearchCriteria.Op.EQ, domainId);
            if (!isRootAdmin) {
                sc.addAnd("displayOffering", SearchCriteria.Op.EQ, 1);
            }
            return _diskOfferingJoinDao.searchAndCount(sc, searchFilter);
        } else {
            throw new PermissionDeniedException("The account:" + account.getAccountName() + " does not fall in the same domain hierarchy as the disk offering");
        }
    }
    List<Long> domainIds = null;
    // and everything above till root
    if ((_accountMgr.isNormalUser(account.getId()) || _accountMgr.isDomainAdmin(account.getId())) || account.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN) {
        if (isRecursive) {
            // domain + all sub-domains
            if (account.getType() == Account.ACCOUNT_TYPE_NORMAL)
                throw new InvalidParameterValueException("Only ROOT admins and Domain admins can list disk offerings with isrecursive=true");
            DomainVO domainRecord = _domainDao.findById(account.getDomainId());
            sc.addAnd("domainPath", SearchCriteria.Op.LIKE, domainRecord.getPath() + "%");
        } else {
            // domain + all ancestors
            // find all domain Id up to root domain for this account
            domainIds = new ArrayList<Long>();
            DomainVO domainRecord = _domainDao.findById(account.getDomainId());
            if (domainRecord == null) {
                s_logger.error("Could not find the domainId for account:" + account.getAccountName());
                throw new CloudAuthenticationException("Could not find the domainId for account:" + account.getAccountName());
            }
            domainIds.add(domainRecord.getId());
            while (domainRecord.getParent() != null) {
                domainRecord = _domainDao.findById(domainRecord.getParent());
                domainIds.add(domainRecord.getId());
            }
            SearchCriteria<DiskOfferingJoinVO> spc = _diskOfferingJoinDao.createSearchCriteria();
            spc.addOr("domainId", SearchCriteria.Op.IN, domainIds.toArray());
            // include public offering as where
            spc.addOr("domainId", SearchCriteria.Op.NULL);
            sc.addAnd("domainId", SearchCriteria.Op.SC, spc);
            // non-root users should not see system offering at all
            sc.addAnd("systemUse", SearchCriteria.Op.EQ, false);
        }
    }
    if (keyword != null) {
        SearchCriteria<DiskOfferingJoinVO> ssc = _diskOfferingJoinDao.createSearchCriteria();
        ssc.addOr("displayText", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("name", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        sc.addAnd("name", SearchCriteria.Op.SC, ssc);
    }
    if (id != null) {
        sc.addAnd("id", SearchCriteria.Op.EQ, id);
    }
    if (name != null) {
        sc.addAnd("name", SearchCriteria.Op.EQ, name);
    }
    return _diskOfferingJoinDao.searchAndCount(sc, searchFilter);
}

Example 13 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class QueryManagerImpl method listProjectAccountsInternal.

public Pair<List<ProjectAccountJoinVO>, Integer> listProjectAccountsInternal(ListProjectAccountsCmd cmd) {
    long projectId = cmd.getProjectId();
    String accountName = cmd.getAccountName();
    String role = cmd.getRole();
    Long startIndex = cmd.getStartIndex();
    Long pageSizeVal = cmd.getPageSizeVal();
    // long projectId, String accountName, String role, Long startIndex,
    // Long pageSizeVal) {
    Account caller = CallContext.current().getCallingAccount();
    // check that the project exists
    Project project = _projectDao.findById(projectId);
    if (project == null) {
        throw new InvalidParameterValueException("Unable to find the project id=" + projectId);
    }
    // project's account
    if (!_accountMgr.isAdmin(caller.getId()) && _projectAccountDao.findByProjectIdAccountId(projectId, caller.getAccountId()) == null) {
        throw new PermissionDeniedException("Account " + caller + " is not authorized to list users of the project id=" + projectId);
    }
    Filter searchFilter = new Filter(ProjectAccountJoinVO.class, "id", false, startIndex, pageSizeVal);
    SearchBuilder<ProjectAccountJoinVO> sb = _projectAccountJoinDao.createSearchBuilder();
    sb.and("accountRole", sb.entity().getAccountRole(), Op.EQ);
    sb.and("projectId", sb.entity().getProjectId(), Op.EQ);
    if (accountName != null) {
        sb.and("accountName", sb.entity().getAccountName(), Op.EQ);
    }
    SearchCriteria<ProjectAccountJoinVO> sc = sb.create();
    sc.setParameters("projectId", projectId);
    if (role != null) {
        sc.setParameters("accountRole", role);
    }
    if (accountName != null) {
        sc.setParameters("accountName", accountName);
    }
    return _projectAccountJoinDao.searchAndCount(sc, searchFilter);
}

Example 14 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class QueryManagerImpl method searchForUsersInternal.

private Pair<List<UserAccountJoinVO>, Integer> searchForUsersInternal(ListUsersCmd cmd) throws PermissionDeniedException {
    Account caller = CallContext.current().getCallingAccount();
    List<Long> permittedAccounts = new ArrayList<Long>();
    boolean listAll = cmd.listAll();
    Long id = cmd.getId();
    if (caller.getType() == Account.ACCOUNT_TYPE_NORMAL) {
        long currentId = CallContext.current().getCallingUser().getId();
        if (id != null && currentId != id.longValue()) {
            throw new PermissionDeniedException("Calling user is not authorized to see the user requested by id");
        }
        id = currentId;
    }
    Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(cmd.getDomainId(), cmd.isRecursive(), null);
    _accountMgr.buildACLSearchParameters(caller, id, cmd.getAccountName(), null, permittedAccounts, domainIdRecursiveListProject, listAll, false);
    Long domainId = domainIdRecursiveListProject.first();
    Boolean isRecursive = domainIdRecursiveListProject.second();
    ListProjectResourcesCriteria listProjectResourcesCriteria = domainIdRecursiveListProject.third();
    Filter searchFilter = new Filter(UserAccountJoinVO.class, "id", true, cmd.getStartIndex(), cmd.getPageSizeVal());
    Object username = cmd.getUsername();
    Object type = cmd.getAccountType();
    Object accountName = cmd.getAccountName();
    Object state = cmd.getState();
    Object keyword = cmd.getKeyword();
    SearchBuilder<UserAccountJoinVO> sb = _userAccountJoinDao.createSearchBuilder();
    _accountMgr.buildACLViewSearchBuilder(sb, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
    sb.and("username", sb.entity().getUsername(), SearchCriteria.Op.LIKE);
    if (id != null && id == 1) {
        // system user should NOT be searchable
        List<UserAccountJoinVO> emptyList = new ArrayList<UserAccountJoinVO>();
        return new Pair<List<UserAccountJoinVO>, Integer>(emptyList, 0);
    } else if (id != null) {
        sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
    } else {
        // this condition is used to exclude system user from the search
        // results
        sb.and("id", sb.entity().getId(), SearchCriteria.Op.NEQ);
    }
    sb.and("type", sb.entity().getAccountType(), SearchCriteria.Op.EQ);
    sb.and("domainId", sb.entity().getDomainId(), SearchCriteria.Op.EQ);
    sb.and("accountName", sb.entity().getAccountName(), SearchCriteria.Op.EQ);
    sb.and("state", sb.entity().getState(), SearchCriteria.Op.EQ);
    if ((accountName == null) && (domainId != null)) {
        sb.and("domainPath", sb.entity().getDomainPath(), SearchCriteria.Op.LIKE);
    }
    SearchCriteria<UserAccountJoinVO> sc = sb.create();
    // building ACL condition
    _accountMgr.buildACLViewSearchCriteria(sc, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
    if (keyword != null) {
        SearchCriteria<UserAccountJoinVO> ssc = _userAccountJoinDao.createSearchCriteria();
        ssc.addOr("username", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("firstname", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("lastname", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("email", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("state", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("accountName", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        ssc.addOr("accountType", SearchCriteria.Op.LIKE, "%" + keyword + "%");
        sc.addAnd("username", SearchCriteria.Op.SC, ssc);
    }
    if (username != null) {
        sc.setParameters("username", username);
    }
    if (id != null) {
        sc.setParameters("id", id);
    } else {
        // Don't return system user, search builder with NEQ
        sc.setParameters("id", 1);
    }
    if (type != null) {
        sc.setParameters("type", type);
    }
    if (accountName != null) {
        sc.setParameters("accountName", accountName);
        if (domainId != null) {
            sc.setParameters("domainId", domainId);
        }
    } else if (domainId != null) {
        DomainVO domainVO = _domainDao.findById(domainId);
        sc.setParameters("domainPath", domainVO.getPath() + "%");
    }
    if (state != null) {
        sc.setParameters("state", state);
    }
    return _userAccountJoinDao.searchAndCount(sc, searchFilter);
}

Example 15 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class LoadBalancingRulesManagerImpl method assignToLoadBalancer.

@Override
@DB
@ActionEvent(eventType = EventTypes.EVENT_ASSIGN_TO_LOAD_BALANCER_RULE, eventDescription = "assigning to load balancer", async = true)
public boolean assignToLoadBalancer(long loadBalancerId, List<Long> instanceIds, Map<Long, List<String>> vmIdIpMap) {
    CallContext ctx = CallContext.current();
    Account caller = ctx.getCallingAccount();
    final LoadBalancerVO loadBalancer = _lbDao.findById(loadBalancerId);
    if (loadBalancer == null) {
        throw new InvalidParameterValueException("Failed to assign to load balancer " + loadBalancerId + ", the load balancer was not found.");
    }
    if (instanceIds == null && vmIdIpMap.isEmpty()) {
        throw new InvalidParameterValueException("Both instanceids and vmidipmap  can't be null");
    }
    // instanceIds and vmIdipmap is passed
    if (instanceIds != null && !vmIdIpMap.isEmpty()) {
        for (long instanceId : instanceIds) {
            if (!vmIdIpMap.containsKey(instanceId)) {
                vmIdIpMap.put(instanceId, null);
            }
        }
    }
    //only instanceids list passed
    if (instanceIds != null && vmIdIpMap.isEmpty()) {
        vmIdIpMap = new HashMap<Long, List<String>>();
        for (long instanceId : instanceIds) {
            vmIdIpMap.put(instanceId, null);
        }
    }
    List<LoadBalancerVMMapVO> mappedInstances = _lb2VmMapDao.listByLoadBalancerId(loadBalancerId, false);
    Set<Long> mappedInstanceIds = new HashSet<Long>();
    for (LoadBalancerVMMapVO mappedInstance : mappedInstances) {
        mappedInstanceIds.add(Long.valueOf(mappedInstance.getInstanceId()));
    }
    Map<Long, List<String>> existingVmIdIps = new HashMap<Long, List<String>>();
    // now get the ips of vm and add it to map
    for (LoadBalancerVMMapVO mappedInstance : mappedInstances) {
        List<String> ipsList = null;
        if (existingVmIdIps.containsKey(mappedInstance.getInstanceId())) {
            ipsList = existingVmIdIps.get(mappedInstance.getInstanceId());
        } else {
            ipsList = new ArrayList<String>();
        }
        ipsList.add(mappedInstance.getInstanceIp());
        existingVmIdIps.put(mappedInstance.getInstanceId(), ipsList);
    }
    final List<UserVm> vmsToAdd = new ArrayList<UserVm>();
    // check for conflict
    Set<Long> passedInstanceIds = vmIdIpMap.keySet();
    for (Long instanceId : passedInstanceIds) {
        UserVm vm = _vmDao.findById(instanceId);
        if (vm == null || vm.getState() == State.Destroyed || vm.getState() == State.Expunging) {
            InvalidParameterValueException ex = new InvalidParameterValueException("Invalid instance id specified");
            if (vm == null) {
                ex.addProxyObject(instanceId.toString(), "instanceId");
            } else {
                ex.addProxyObject(vm.getUuid(), "instanceId");
            }
            throw ex;
        }
        _rulesMgr.checkRuleAndUserVm(loadBalancer, vm, caller);
        if (vm.getAccountId() != loadBalancer.getAccountId()) {
            throw new PermissionDeniedException("Cannot add virtual machines that do not belong to the same owner.");
        }
        // Let's check to make sure the vm has a nic in the same network as
        // the load balancing rule.
        List<? extends Nic> nics = _networkModel.getNics(vm.getId());
        Nic nicInSameNetwork = null;
        for (Nic nic : nics) {
            if (nic.getNetworkId() == loadBalancer.getNetworkId()) {
                nicInSameNetwork = nic;
                break;
            }
        }
        if (nicInSameNetwork == null) {
            InvalidParameterValueException ex = new InvalidParameterValueException("VM with id specified cannot be added because it doesn't belong in the same network.");
            ex.addProxyObject(vm.getUuid(), "instanceId");
            throw ex;
        }
        String priIp = nicInSameNetwork.getIPv4Address();
        if (existingVmIdIps.containsKey(instanceId)) {
            // now check for ip address
            List<String> mappedIps = existingVmIdIps.get(instanceId);
            List<String> newIps = vmIdIpMap.get(instanceId);
            if (newIps == null) {
                newIps = new ArrayList<String>();
                newIps.add(priIp);
            }
            for (String newIp : newIps) {
                if (mappedIps.contains(newIp)) {
                    throw new InvalidParameterValueException("VM " + instanceId + " with " + newIp + " is already mapped to load balancer.");
                }
            }
        }
        List<String> vmIpsList = vmIdIpMap.get(instanceId);
        String vmLbIp = null;
        if (vmIpsList != null) {
            //check if the ips belongs to nic secondary ip
            for (String ip : vmIpsList) {
                // skip the primary ip from vm secondary ip comparisions
                if (ip.equals(priIp)) {
                    continue;
                }
                if (_nicSecondaryIpDao.findByIp4AddressAndNicId(ip, nicInSameNetwork.getId()) == null) {
                    throw new InvalidParameterValueException("VM ip " + ip + " specified does not belong to " + "nic in network " + nicInSameNetwork.getNetworkId());
                }
            }
        } else {
            vmIpsList = new ArrayList<String>();
            vmIpsList.add(priIp);
        }
        // assign for primary ip and ip passed in vmidipmap
        if (instanceIds != null) {
            if (instanceIds.contains(instanceId)) {
                vmIpsList.add(priIp);
            }
        }
        vmIdIpMap.put(instanceId, vmIpsList);
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Adding " + vm + " to the load balancer pool");
        }
        vmsToAdd.add(vm);
    }
    final Set<Long> vmIds = vmIdIpMap.keySet();
    final Map<Long, List<String>> newMap = vmIdIpMap;
    Transaction.execute(new TransactionCallbackNoReturn() {

        @Override
        public void doInTransactionWithoutResult(TransactionStatus status) {
            for (Long vmId : vmIds) {
                final Set<String> lbVmIps = new HashSet<String>(newMap.get(vmId));
                for (String vmIp : lbVmIps) {
                    LoadBalancerVMMapVO map = new LoadBalancerVMMapVO(loadBalancer.getId(), vmId, vmIp, false);
                    map = _lb2VmMapDao.persist(map);
                }
            }
        }
    });
    if (_autoScaleVmGroupDao.isAutoScaleLoadBalancer(loadBalancerId)) {
        // We can consider the job done.
        return true;
    }
    boolean success = false;
    FirewallRule.State backupState = loadBalancer.getState();
    try {
        loadBalancer.setState(FirewallRule.State.Add);
        _lbDao.persist(loadBalancer);
        applyLoadBalancerConfig(loadBalancerId);
        success = true;
    } catch (ResourceUnavailableException e) {
        s_logger.warn("Unable to apply the load balancer config because resource is unavaliable.", e);
        success = false;
    } finally {
        if (!success) {
            final List<Long> vmInstanceIds = new ArrayList<Long>();
            Transaction.execute(new TransactionCallbackNoReturn() {

                @Override
                public void doInTransactionWithoutResult(TransactionStatus status) {
                    for (Long vmId : vmIds) {
                        vmInstanceIds.add(vmId);
                    }
                }
            });
            if (!vmInstanceIds.isEmpty()) {
                _lb2VmMapDao.remove(loadBalancer.getId(), vmInstanceIds, null);
                s_logger.debug("LB Rollback rule id: " + loadBalancer.getId() + "  while attaching VM: " + vmInstanceIds);
            }
            loadBalancer.setState(backupState);
            _lbDao.persist(loadBalancer);
            CloudRuntimeException ex = new CloudRuntimeException("Failed to add specified loadbalancerruleid for vms " + vmInstanceIds);
            ex.addProxyObject(loadBalancer.getUuid(), "loadBalancerId");
            // right VO object or table name.
            throw ex;
        }
    }
    return success;
}