Examples with CollectionPermission ddf.security.permission.CollectionPermission used on opensource projects

Example 1 with CollectionPermission

use of ddf.security.permission.CollectionPermission in project ddf by codice.

the class AuthorizationFilter method doFilter.

@SuppressWarnings("PackageAccessibility")
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    HttpServletResponse httpResponse = (HttpServletResponse) response;
    Subject subject = null;
    if (request.getAttribute(ContextPolicy.NO_AUTH_POLICY) != null) {
        LOGGER.debug("NO_AUTH_POLICY header was found, skipping authorization filter.");
        chain.doFilter(request, response);
    } else {
        try {
            subject = SecurityUtils.getSubject();
        } catch (Exception e) {
            LOGGER.debug("Unable to retrieve user from request.", e);
        }
        boolean permitted = true;
        final String path = httpRequest.getRequestURI();
        ContextPolicy policy = contextPolicyManager.getContextPolicy(path);
        CollectionPermission permissions = null;
        if (policy != null && subject != null) {
            permissions = policy.getAllowedAttributePermissions();
            if (!permissions.isEmpty()) {
                permitted = subject.isPermitted(permissions);
            }
        } else {
            LOGGER.warn("Unable to determine policy for path {}. User is not permitted to continue. Check policy configuration!", path);
            permitted = false;
        }
        if (!permitted) {
            SecurityLogger.audit("Subject not authorized to view resource {}", path);
            LOGGER.debug("Subject not authorized.");
            returnNotAuthorized(httpResponse);
        } else {
            if (!permissions.isEmpty()) {
                SecurityLogger.audit("Subject is authorized to view resource {}", path);
            }
            LOGGER.debug("Subject is authorized!");
            chain.doFilter(request, response);
        }
    }
}

Example 2 with CollectionPermission

use of ddf.security.permission.CollectionPermission in project ddf by codice.

the class PolicyManagerTest method testSimpleAttributeMappings.

@Test
public void testSimpleAttributeMappings() {
    for (Map.Entry<String, List<ContextAttributeMapping>> entry : simpleAttributeMap.entrySet()) {
        ContextPolicy policy = manager.getContextPolicy(entry.getKey());
        CollectionPermission permission = policy.getAllowedAttributePermissions();
        assertThat(permission.implies(entry.getValue().get(0).getAttributePermission()), is(true));
    }
}

Example 3 with CollectionPermission

use of ddf.security.permission.CollectionPermission in project ddf by codice.

the class PolicyManagerTest method testComplexPaths.

@Test
public void testComplexPaths() {
    CollectionPermission rootPermissions = manager.getContextPolicy("/x").getAllowedAttributePermissions();
    CollectionPermission noPermissions = manager.getContextPolicy("/x/y").getAllowedAttributePermissions();
    CollectionPermission lastPermission = manager.getContextPolicy("/x/y/z").getAllowedAttributePermissions();
    assertThat(noPermissions.implies(rootPermissions), is(true));
    assertThat(rootPermissions.implies(lastPermission), is(false));
    assertThat(lastPermission.implies(noPermissions), is(false));
}

Example 4 with CollectionPermission

use of ddf.security.permission.CollectionPermission in project ddf by codice.

the class WorkspacePolicyExtensionTest method testShouldRemoveRolesAndEmailsWhenOverridden1.

@Test
public void testShouldRemoveRolesAndEmailsWhenOverridden1() {
    List<Permission> before = ImmutableList.of(RANDOM, ROLES, EMAILS);
    doReturn(before).when(match).getPermissionList();
    extension.setSystemUserAttribute(Constants.EMAIL_ADDRESS_CLAIM_URI);
    extension.setSystemUserAttributeValue("admin@localhost");
    CollectionPermission subject = subjectFrom(ADMIN_EMAIL);
    List<Permission> after = extension.isPermittedMatchAll(subject, match).getPermissionList();
    assertThat(after, is(ImmutableList.of(RANDOM)));
}

Example 5 with CollectionPermission

use of ddf.security.permission.CollectionPermission in project ddf by codice.

the class WorkspacePolicyExtensionTest method testShouldKeepAllWhenNoneImplied.

@Test
public void testShouldKeepAllWhenNoneImplied() {
    List<Permission> before = ImmutableList.of(RANDOM, ROLES, EMAILS);
    doReturn(before).when(match).getPermissionList();
    CollectionPermission subject = makeSubject((p) -> false);
    List<Permission> after = extension.isPermittedMatchAll(subject, match).getPermissionList();
    assertThat(after, is(before));
}