Examples with AclEntry com.hortonworks.streamline.streams.security.catalog.AclEntry used on opensource projects

Example 1 with AclEntry

use of com.hortonworks.streamline.streams.security.catalog.AclEntry in project streamline by hortonworks.

the class SecurityCatalogResource method filter.

private Collection<AclEntry> filter(Collection<AclEntry> aclEntries, SecurityContext securityContext) {
    User currentUser = getCurrentUser(securityContext);
    Set<Role> currentUserRoles = catalogService.getAllUserRoles(currentUser);
    boolean isSecurityAdmin = SecurityUtil.hasRole(authorizer, securityContext, ROLE_SECURITY_ADMIN);
    return aclEntries.stream().filter(aclEntry -> isSecurityAdmin || matches(aclEntry, currentUser, currentUserRoles)).collect(Collectors.toSet());
}

Example 2 with AclEntry

use of com.hortonworks.streamline.streams.security.catalog.AclEntry in project streamline by hortonworks.

the class SecurityCatalogResource method getAcl.

@GET
@Path("/acls/{id}")
@Timed
public Response getAcl(@PathParam("id") Long aclId, @Context SecurityContext securityContext) {
    AclEntry aclEntry = catalogService.getAcl(aclId);
    checkAclOp(aclEntry, securityContext, this::shouldAllowAclGet);
    if (aclEntry != null) {
        return WSUtils.respondEntity(aclEntry, OK);
    }
    throw EntityNotFoundException.byId(aclId.toString());
}

Example 3 with AclEntry

use of com.hortonworks.streamline.streams.security.catalog.AclEntry in project streamline by hortonworks.

the class SecurityCatalogResource method deleteAcl.

@DELETE
@Path("/acls/{id}")
@Timed
public Response deleteAcl(@PathParam("id") Long aclId, @Context SecurityContext securityContext) {
    AclEntry aclEntry = catalogService.getAcl(aclId);
    if (aclEntry != null) {
        checkAclOp(aclEntry, securityContext, this::shouldAllowAclDelete);
        AclEntry removedAcl = catalogService.removeAcl(aclId);
        if (removedAcl != null) {
            return WSUtils.respondEntity(aclEntry, OK);
        }
    }
    throw EntityNotFoundException.byId(aclId.toString());
}

Example 4 with AclEntry

use of com.hortonworks.streamline.streams.security.catalog.AclEntry in project streamline by hortonworks.

the class SecurityCatalogService method removeAcl.

public AclEntry removeAcl(Long id) {
    AclEntry aclEntry = new AclEntry();
    aclEntry.setId(id);
    return dao.remove(new StorableKey(AclEntry.NAMESPACE, aclEntry.getPrimaryKey()));
}

Example 5 with AclEntry

use of com.hortonworks.streamline.streams.security.catalog.AclEntry in project streamline by hortonworks.

the class SecurityCatalogService method checkUserPermissions.

public boolean checkUserPermissions(String objectNamespace, Long objectId, Long userId, EnumSet<Permission> required) {
    User user = getUser(userId);
    if (user == null) {
        return false;
    }
    EnumSet<Permission> remaining = EnumSet.copyOf(required);
    // try direct user acl entry first
    List<QueryParam> qps = QueryParam.params(AclEntry.OBJECT_NAMESPACE, objectNamespace, AclEntry.OBJECT_ID, String.valueOf(objectId), AclEntry.SID_TYPE, USER.toString(), AclEntry.SID_ID, String.valueOf(userId));
    Collection<AclEntry> acls = listAcls(qps);
    if (acls.size() > 1) {
        throw new IllegalStateException("More than one ACL entry for " + qps);
    } else if (acls.size() == 1) {
        AclEntry aclEntry = acls.iterator().next();
        remaining.removeAll(aclEntry.getPermissions());
    }
    // try role based permissions next
    if (!remaining.isEmpty() && user.getRoles() != null) {
        qps = QueryParam.params(AclEntry.OBJECT_NAMESPACE, objectNamespace, AclEntry.OBJECT_ID, String.valueOf(objectId), AclEntry.SID_TYPE, AclEntry.SidType.ROLE.toString());
        acls = listAcls(qps);
        Set<Role> userRoles = getAllUserRoles(user);
        Iterator<AclEntry> it = acls.iterator();
        while (!remaining.isEmpty() && it.hasNext()) {
            AclEntry roleEntry = it.next();
            if (userRoles.contains(getRole(roleEntry.getSidId()))) {
                remaining.removeAll(roleEntry.getPermissions());
            }
        }
    }
    return remaining.isEmpty();
}