Examples with GrantsOnTarget com.zimbra.cs.account.accesscontrol.SearchGrants.GrantsOnTarget used on opensource projects

Example 1 with GrantsOnTarget

use of com.zimbra.cs.account.accesscontrol.SearchGrants.GrantsOnTarget in project zm-mailbox by Zimbra.

the class CollectAllEffectiveRights method collect.

private void collect() throws ServiceException {
    if (mRightBearer instanceof GlobalAdmin) {
        for (TargetType tt : TargetType.values()) {
            EffectiveRights er = new EffectiveRights(tt.getCode(), null, null, mRightBearer.getId(), mRightBearer.getName());
            Entry target;
            if (TargetType.config == tt) {
                target = mProv.getConfig();
            } else if (TargetType.global == tt) {
                target = mProv.getGlobalGrant();
            } else {
                target = PseudoTarget.createPseudoTarget(mProv, tt, null, null, true, null, null, null);
            }
            CollectEffectiveRights.getEffectiveRights(mRightBearer, target, tt, mExpandSetAttrs, mExpandGetAttrs, er);
            mResult.setAll(tt, er);
        }
        return;
    }
    // we want all target types
    Set<TargetType> targetTypesToSearch = new HashSet<TargetType>(Arrays.asList(TargetType.values()));
    // get the set of zimbraId of the grantees to search for
    Set<String> granteeIdsToSearch = mGrantee.getIdAndGroupIds();
    // add external group grants that *may* apply
    if (mGrantee.isAccount()) {
        Domain domain = mProv.getDomain(mGrantee.getAccount());
        granteeIdsToSearch.add(ZimbraACE.ExternalGroupInfo.encode(domain.getId(), ""));
    }
    SearchGrants searchGrants = new SearchGrants(mProv, targetTypesToSearch, granteeIdsToSearch);
    Set<GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults(true);
    // staging for group grants
    Set<Group> groupsWithGrants = new HashSet<Group>();
    //
    for (GrantsOnTarget grantsOnTarget : grantsOnTargets) {
        Entry grantedOnEntry = grantsOnTarget.getTargetEntry();
        ZimbraACL acl = grantsOnTarget.getAcl();
        TargetType targetType = TargetType.getTargetType(grantedOnEntry);
        if (targetType == TargetType.global) {
            computeRightsInheritedFromGlobalGrant();
        } else if (targetType == TargetType.domain) {
            computeRightsInheritedFromDomain((Domain) grantedOnEntry);
            computeSubDomainRightsInheritedFromDomain(acl, (Domain) grantedOnEntry);
        } else if (targetType == TargetType.dl) {
            groupsWithGrants.add((DistributionList) grantedOnEntry);
        } else if (targetType == TargetType.group) {
            groupsWithGrants.add((DynamicGroup) grantedOnEntry);
        }
    }
    //
    // Stage 2
    //
    // process group grants
    //
    // first, shape all members in all groups with grants into "shapes"
    //
    // e.g. if the grant search returned three groups: A, B, C
    //      group A contains members m1, m2, m3
    //      group B contains members m2, m3, m4
    //      group C contains members m5
    //
    //      (assuming all m{X} are accounts)
    //
    //      After "shaping", the accountShapes Set will contain 4 shapes:
    //      shape A  - m1
    //      shape AB - m2, m3
    //      shape B  - m4
    //      shape C  - m5
    //
    /*
         * because of bug 68820, we have to also take into accounts all sub groups
         * of groupsWithGrants when we build shapes - even if the sub groups don't
         * have any grants.
         *
         * Prior to bug 68820, we didn't have to do this(i.e. add in sub groups
         * that don't have any grants when shapes are computed), because sub groups
         * dont't have grants would never affect how grants are inherited - all grants
         * get inherited to sub groups and their member accounts/crs.
         *
         * But bug 68820 introduced a new right modifier - DISINHERIT_SUB_GROUPS,
         * that controls whether a grant on a group can be inherited by sub groups and
         * their account/cr members.
         *
         * Now the input groups for calculating shapes are:
         * union of (groups have grants and all their sub groups)
         *
         * This will result in more shares than before if non ofthe sub groups has grants,
         * but if spawned shapes actually have the same effective rights, they will be
         * merged by RightsByTargetType.addAggregation(), in that it checks if ther are
         * already an aggregation with the exact the same right.  If there are, then just
         * add the targets to the existing aggregation, instead of adding new ones.
         */
    Set<String> processedGroups = new HashSet<String>();
    Set<GroupShape> accountShapes = new HashSet<GroupShape>();
    Set<GroupShape> calendarResourceShapes = new HashSet<GroupShape>();
    Set<GroupShape> distributionListShapes = new HashSet<GroupShape>();
    for (Group group : groupsWithGrants) {
        String groupName = group.getName().toLowerCase();
        if (processedGroups.contains(groupName)) {
            continue;
        } else {
            processedGroups.add(groupName);
        }
        AllGroupMembers allMembers = getAllGroupMembers(group);
        GroupShape.shapeMembers(TargetType.account, accountShapes, allMembers);
        GroupShape.shapeMembers(TargetType.calresource, calendarResourceShapes, allMembers);
        GroupShape.shapeMembers(TargetType.dl, distributionListShapes, allMembers);
        // no need to get TargetType.group members of the group, because
        // dynamic group cannot be a member of a Distribution list or another
        // dynamic group
        processedGroups.add(group.getId());
        /*
             * handle sub groups.  allMembers already contains a flat set of all members
             * of group that is a DistributionList, just go through the flat set and compute
             * shares for each.  If group is a dynamic group, we should never get into
             * the following loop, because there should be no nested groups member of
             * dynamic group.
             */
        for (String nestedGoupMember : allMembers.getMembers(TargetType.dl)) {
            String nestedGoupMemberName = nestedGoupMember.toLowerCase();
            if (processedGroups.contains(nestedGoupMemberName)) {
                continue;
            } else {
                processedGroups.add(nestedGoupMemberName);
            }
            DistributionList subDl = mProv.get(DistributionListBy.name, nestedGoupMemberName);
            // sanity check, shout not be null
            if (subDl != null) {
                AllGroupMembers allMembersOfSubDl = getAllGroupMembers(subDl);
                GroupShape.shapeMembers(TargetType.account, accountShapes, allMembersOfSubDl);
                GroupShape.shapeMembers(TargetType.calresource, calendarResourceShapes, allMembersOfSubDl);
                GroupShape.shapeMembers(TargetType.dl, distributionListShapes, allMembersOfSubDl);
            }
        }
    }
    if (ZimbraLog.acl.isDebugEnabled()) {
        GroupShape.debug("accountShapes", accountShapes);
        GroupShape.debug("calendarResourceShapes", calendarResourceShapes);
        GroupShape.debug("distributionListShapes", distributionListShapes);
    }
    // then, for each group shape, generate a RightAggregation and record in the AllEffectiveRights.
    // if any of the entries in a shape also have grants as an individual, the effective rigths for
    // those entries will be replaced in stage 3.
    Set<String> entryIdsHasGrants = new HashSet<String>();
    for (GrantsOnTarget grantsOnTarget : grantsOnTargets) {
        Entry grantedOnEntry = grantsOnTarget.getTargetEntry();
        if (grantedOnEntry instanceof NamedEntry) {
            entryIdsHasGrants.add(((NamedEntry) grantedOnEntry).getId());
        }
    }
    computeRightsOnGroupShape(TargetType.account, accountShapes, entryIdsHasGrants);
    computeRightsOnGroupShape(TargetType.calresource, calendarResourceShapes, entryIdsHasGrants);
    computeRightsOnGroupShape(TargetType.dl, distributionListShapes, entryIdsHasGrants);
    //
    for (GrantsOnTarget grantsOnTarget : grantsOnTargets) {
        Entry grantedOnEntry = grantsOnTarget.getTargetEntry();
        ZimbraACL acl = grantsOnTarget.getAcl();
        TargetType targetType = TargetType.getTargetType(grantedOnEntry);
        if (targetType != TargetType.global) {
            computeRightsOnEntry(targetType, grantedOnEntry);
        }
    }
}

Example 2 with GrantsOnTarget

use of com.zimbra.cs.account.accesscontrol.SearchGrants.GrantsOnTarget in project zm-mailbox by Zimbra.

the class ParticallyDenied method checkPartiallyDenied.

/**
     * Returns if rightToGrant is (partically) denied to grantor(or groups it belongs)
     * on sub-targets of targetToGrant.
     *
     * @param grantor              the "grantor" of the granting attempt
     * @param targetTypeToGrant    the target type of the granting attempt
     * @param targetToGrant        the target of the granting attempt
     * @param rightToGrant  the right of the granting attremp
     * @throws ServiceException
     */
static void checkPartiallyDenied(Account grantor, TargetType targetTypeToGrant, Entry targetToGrant, Right rightToGrant) throws ServiceException {
    if (AccessControlUtil.isGlobalAdmin(grantor, true))
        return;
    Provisioning prov = Provisioning.getInstance();
    // set of sub target types
    Set<TargetType> subTargetTypes = targetTypeToGrant.subTargetTypes();
    // set of target types any sub-right can be granted
    Set<TargetType> subRightsGrantableOnTargetTypes = new HashSet<TargetType>();
    getAllGrantableTargetTypes(rightToGrant, subRightsGrantableOnTargetTypes);
    // get the interset of the two, that would be the target types to search for
    Set<TargetType> targetTypesToSearch = SetUtil.intersect(subTargetTypes, subRightsGrantableOnTargetTypes);
    // if the intersect is empty, no need to search
    if (targetTypesToSearch.isEmpty())
        return;
    // get the set of zimbraId of the grantees to search for
    Grantee grantee = Grantee.getGrantee(grantor);
    Set<String> granteeIdsToSearch = grantee.getIdAndGroupIds();
    SearchGrants searchGrants = new SearchGrants(prov, targetTypesToSearch, granteeIdsToSearch);
    Set<GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults();
    // check grants granted to the grantor
    checkDenied(prov, targetToGrant, rightToGrant, grantsOnTargets, grantor.getId(), null);
    // check grants granted to any groups of the grantor
    checkDenied(prov, targetToGrant, rightToGrant, grantsOnTargets, null, granteeIdsToSearch);
// all is well, or else PERM_DENIED would've been thrown in one of the checkDenied calls
// yes, you can grant the rightToGrant on targetToGrant.
}

Example 3 with GrantsOnTarget

use of com.zimbra.cs.account.accesscontrol.SearchGrants.GrantsOnTarget in project zm-mailbox by Zimbra.

the class RightCommand method revokeAllRights.

/**
     * revoke all grants granted to the specified grantee, invoked from
     * LdapProvisioning.deleteAccount.
     *
     * note: no verification (things done in verifyGrant) is done in this method
     *       if the authed user can delete the account, it can delete all grants
     *       granted to the account.
     *
     */
public static void revokeAllRights(Provisioning prov, GranteeType granteeType, String granteeId) throws ServiceException {
    AdminConsoleCapable acc = verifyAdminConsoleCapable();
    //
    // search grants
    //
    Set<TargetType> targetTypesToSearch = acc.targetTypesForGrantSearch();
    // search for grants granted to this grantee
    Set<String> granteeIdsToSearch = new HashSet<String>();
    granteeIdsToSearch.add(granteeId);
    SearchGrants searchGrants = new SearchGrants(prov, targetTypesToSearch, granteeIdsToSearch);
    Set<GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults();
    for (GrantsOnTarget grantsOnTarget : grantsOnTargets) {
        Entry targetEntry = grantsOnTarget.getTargetEntry();
        Set<ZimbraACE> acesToRevoke = new HashSet<ZimbraACE>();
        for (ZimbraACE ace : grantsOnTarget.getAcl().getAllACEs()) {
            if (granteeId.equals(ace.getGrantee())) {
                acesToRevoke.add(ace);
            }
        }
        ACLUtil.revokeRight(prov, targetEntry, acesToRevoke);
    }
    // as a precaution in case a new account is created with same name
    RightBearer.Grantee.clearGranteeCache();
}

Example 4 with GrantsOnTarget

use of com.zimbra.cs.account.accesscontrol.SearchGrants.GrantsOnTarget in project zm-mailbox by Zimbra.

the class RightCommand method getGrants.

public static Grants getGrants(Provisioning prov, String targetType, TargetBy targetBy, String target, String granteeType, GranteeBy granteeBy, String grantee, boolean granteeIncludeGroupsGranteeBelongs) throws ServiceException {
    verifyAccessManager();
    if (targetType == null && granteeType == null) {
        throw ServiceException.INVALID_REQUEST("at least one of target or grantee must be specified", null);
    }
    // target
    TargetType tt = null;
    Entry targetEntry = null;
    if (targetType != null) {
        tt = TargetType.fromCode(targetType);
        targetEntry = TargetType.lookupTarget(prov, tt, targetBy, target);
    }
    // grantee
    GranteeType gt = null;
    NamedEntry granteeEntry = null;
    Set<String> granteeFilter = null;
    Boolean isGranteeAnAdmin = null;
    if (granteeType != null) {
        gt = GranteeType.fromCode(granteeType);
        granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
        isGranteeAnAdmin = RightBearer.isValidGranteeForAdminRights(gt, granteeEntry);
        if (granteeIncludeGroupsGranteeBelongs) {
            Grantee theGrantee = Grantee.getGrantee(granteeEntry, false);
            granteeFilter = theGrantee.getIdAndGroupIds();
        } else {
            granteeFilter = new HashSet<String>();
            granteeFilter.add(granteeEntry.getId());
        }
    }
    Grants grants = new Grants();
    if (targetEntry != null) {
        // get ACL from the target
        ZimbraACL zimbraAcl = ACLUtil.getACL(targetEntry);
        // then filter by grnatee if grantee is specified
        grants.addGrants(tt, targetEntry, zimbraAcl, granteeFilter, isGranteeAnAdmin);
    } else {
        /*
             * no specific target, search for grants granted to
             * the grantee (and optionally groups the specified
             * grantee belongs to)
             *
             * If we come to this path, grantee must have been
             * specified.
             */
        // we want all target types
        Set<TargetType> targetTypesToSearch = new HashSet<TargetType>(Arrays.asList(TargetType.values()));
        SearchGrants searchGrants = new SearchGrants(prov, targetTypesToSearch, granteeFilter);
        Set<GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults();
        for (GrantsOnTarget grantsOnTarget : grantsOnTargets) {
            Entry grantedOnEntry = grantsOnTarget.getTargetEntry();
            ZimbraACL acl = grantsOnTarget.getAcl();
            TargetType grantedOnTargetType = TargetType.getTargetType(grantedOnEntry);
            grants.addGrants(grantedOnTargetType, grantedOnEntry, acl, granteeFilter, isGranteeAnAdmin);
        }
    }
    return grants;
}