Examples with StorageOSUser com.emc.storageos.security.authentication.StorageOSUser used on opensource projects

Example 81 with StorageOSUser

use of com.emc.storageos.security.authentication.StorageOSUser in project coprhd-controller by CoprHD.

the class FilePolicyService method canAccessFilePolicy.

private boolean canAccessFilePolicy(FilePolicy filePolicy) {
    StringSet tenants = filePolicy.getTenantOrg();
    if (tenants == null || tenants.isEmpty()) {
        return true;
    }
    if (isSystemAdmin()) {
        return true;
    }
    StorageOSUser user = getUserFromContext();
    String userTenantId = user.getTenantId();
    return tenants.contains(userTenantId);
}

Example 82 with StorageOSUser

use of com.emc.storageos.security.authentication.StorageOSUser in project coprhd-controller by CoprHD.

the class FilePolicyService method getFilePoliciesForGivenUser.

protected FilePolicyListRestRep getFilePoliciesForGivenUser() {
    FilePolicyListRestRep filePolicyList = new FilePolicyListRestRep();
    List<URI> ids = _dbClient.queryByType(FilePolicy.class, true);
    List<FilePolicy> filePolicies = _dbClient.queryObject(FilePolicy.class, ids);
    StorageOSUser user = getUserFromContext();
    // else only return the list, which input tenant has access.
    if (_permissionsHelper.userHasGivenRole(user, null, Role.SYSTEM_ADMIN, Role.SYSTEM_MONITOR)) {
        for (FilePolicy filePolicy : filePolicies) {
            filePolicyList.add(toNamedRelatedResource(filePolicy, filePolicy.getFilePolicyName()));
        }
    } else {
        // otherwise, filter by only authorized to use
        URI tenant = null;
        tenant = URI.create(user.getTenantId());
        Set<FilePolicy> policySet = new HashSet<FilePolicy>();
        for (FilePolicy filePolicy : filePolicies) {
            if (_permissionsHelper.tenantHasUsageACL(tenant, filePolicy)) {
                policySet.add(filePolicy);
            }
        }
        // Also adding vpools which sub-tenants of the user have access to.
        List<URI> subtenants = _permissionsHelper.getSubtenantsWithRoles(user);
        for (FilePolicy filePolicy : filePolicies) {
            if (_permissionsHelper.tenantHasUsageACL(subtenants, filePolicy)) {
                policySet.add(filePolicy);
            }
        }
        for (FilePolicy filePolicy : policySet) {
            filePolicyList.add(toNamedRelatedResource(filePolicy, filePolicy.getFilePolicyName()));
        }
    }
    return filePolicyList;
}

Example 83 with StorageOSUser

use of com.emc.storageos.security.authentication.StorageOSUser in project coprhd-controller by CoprHD.

the class FilePolicyService method unassignFilePolicy.

/**
 * Unassign File Policy
 *
 * @param id
 *            of the file policy.
 * @param FilePolicyUnAssignParam
 * @brief Unassign file policy from vpool, project, file system
 * @return TaskResourceRep
 */
@POST
@Path("/{id}/unassign-policy")
@Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
@CheckPermission(roles = { Role.SYSTEM_ADMIN, Role.TENANT_ADMIN })
public TaskResourceRep unassignFilePolicy(@PathParam("id") URI id, FilePolicyUnAssignParam param) {
    _log.info("Unassign File Policy :{}  request received.", id);
    String task = UUID.randomUUID().toString();
    ArgValidator.checkFieldUriType(id, FilePolicy.class, "id");
    FilePolicy filepolicy = this._dbClient.queryObject(FilePolicy.class, id);
    ArgValidator.checkEntity(filepolicy, id, true);
    StringBuilder errorMsg = new StringBuilder();
    Operation op = _dbClient.createTaskOpStatus(FilePolicy.class, filepolicy.getId(), task, ResourceOperationTypeEnum.UNASSIGN_FILE_POLICY);
    op.setDescription("unassign File Policy from resources ");
    // As the action done by tenant/system admin
    // Set corresponding tenant uri as task's tenant!!!
    Task taskObj = op.getTask(filepolicy.getId());
    StorageOSUser user = getUserFromContext();
    URI userTenantUri = URI.create(user.getTenantId());
    FilePolicyServiceUtils.updateTaskTenant(_dbClient, filepolicy, "unassign", taskObj, userTenantUri);
    if (filepolicy.getAssignedResources() == null || filepolicy.getAssignedResources().isEmpty()) {
        _log.info("File Policy: " + id + " doesn't have any assigned resources.");
        _dbClient.ready(FilePolicy.class, filepolicy.getId(), task);
        return toTask(filepolicy, task, op);
    }
    ArgValidator.checkFieldNotNull(param.getUnassignfrom(), "unassign_from");
    Set<URI> unassignFrom = param.getUnassignfrom();
    if (unassignFrom != null) {
        for (URI uri : unassignFrom) {
            canUserUnAssignPolicyAtGivenLevel(filepolicy, uri);
            if (!filepolicy.getAssignedResources().contains(uri.toString())) {
                errorMsg.append("Provided resource URI is either being not assigned to the file policy:" + filepolicy.getId() + " or it is a invalid URI");
                _log.error(errorMsg.toString());
                throw APIException.badRequests.invalidFilePolicyUnAssignParam(filepolicy.getFilePolicyName(), errorMsg.toString());
            }
        }
    }
    FileOrchestrationController controller = getController(FileOrchestrationController.class, FileOrchestrationController.FILE_ORCHESTRATION_DEVICE);
    try {
        controller.unassignFilePolicy(filepolicy.getId(), unassignFrom, task);
        auditOp(OperationTypeEnum.UNASSIGN_FILE_POLICY, true, "BEGIN", filepolicy.getId().toString(), filepolicy.getLabel());
    } catch (BadRequestException e) {
        op = _dbClient.error(FilePolicy.class, filepolicy.getId(), task, e);
        _log.error("Error Unassigning File policy {}, {}", e.getMessage(), e);
        throw e;
    } catch (Exception e) {
        _log.error("Error Unassigning Files Policy {}, {}", e.getMessage(), e);
        throw APIException.badRequests.unableToProcessRequest(e.getMessage());
    }
    return toTask(filepolicy, task, op);
}

Example 84 with StorageOSUser

use of com.emc.storageos.security.authentication.StorageOSUser in project coprhd-controller by CoprHD.

the class SnapshotService method querySnapshotResource.

protected BlockObject querySnapshotResource(URI id) {
    StorageOSUser user = getUserFromContext();
    URI vipr_tenantId = URI.create(user.getTenantId());
    URIQueryResultList uris = new URIQueryResultList();
    _dbClient.queryByConstraint(PrefixConstraint.Factory.getTagsPrefixConstraint(BlockSnapshot.class, id.toString(), vipr_tenantId), uris);
    for (URI snapUri : uris) {
        BlockSnapshot snap = _dbClient.queryObject(BlockSnapshot.class, snapUri);
        if (snap != null && isAuthorized(snapUri))
            return snap;
    }
    return null;
}

Example 85 with StorageOSUser

use of com.emc.storageos.security.authentication.StorageOSUser in project coprhd-controller by CoprHD.

the class VolumeService method verifyUserCanModifyVolume.

protected void verifyUserCanModifyVolume(Volume vol) {
    StorageOSUser user = getUserFromContext();
    URI projectId = vol.getProject().getURI();
    if (!(_permissionsHelper.userHasGivenRole(user, vol.getTenant().getURI(), Role.TENANT_ADMIN) || _permissionsHelper.userHasGivenACL(user, projectId, ACL.OWN, ACL.ALL))) {
        throw APIException.forbidden.insufficientPermissionsForUser(user.getName());
    }
}