Examples with RolesAllowed javax.annotation.security.RolesAllowed used on opensource projects

Example 6 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jersey by jersey.

the class FlightsResource method updateStatus.

@POST
@Path("{id}/status")
@Consumes(APPLICATION_FORM_URLENCODED)
@Produces(TEXT_PLAIN)
@RolesAllowed("admin")
public String updateStatus(@ValidFlightId @PathParam("id") String flightId, @FormParam("status") String newStatus) {
    Flight.Status status;
    try {
        status = Flight.Status.valueOf(newStatus);
    } catch (IllegalArgumentException e) {
        throw new BadRequestException("Unknown status.");
    }
    final Flight flight = DataStore.selectFlight(flightId);
    flight.setStatus(status);
    return status.name();
}

Example 7 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jersey by jersey.

the class FlightsResource method create.

@POST
@Consumes(APPLICATION_FORM_URLENCODED)
@RolesAllowed("admin")
@Detail
public Flight create(@ValidAircraftId @FormParam("aircraftId") Integer aircraftId) {
    final Aircraft aircraft = DataStore.selectAircraft(aircraftId);
    if (!aircraft.marAssigned()) {
        throw new BadRequestException("Aircraft already assigned.");
    }
    Flight flight = new Flight(null, aircraft);
    if (!DataStore.addFlight(flight)) {
        aircraft.marAvailable();
        throw new BadRequestException("Flight already exists.");
    }
    return flight;
}

Example 8 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jersey by jersey.

the class FlightsResource method delete.

@DELETE
@Path("{id}")
@Produces(TEXT_PLAIN)
@RolesAllowed("admin")
public String delete(@ValidFlightId @PathParam("id") String flightId) {
    Flight flight = DataStore.removeFlight(flightId);
    flight.getAircraft().marAvailable();
    return flight.getId();
}

Example 9 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project spring-security by spring-projects.

the class Jsr250MethodSecurityMetadataSource method processAnnotations.

private List<ConfigAttribute> processAnnotations(Annotation[] annotations) {
    if (annotations == null || annotations.length == 0) {
        return null;
    }
    List<ConfigAttribute> attributes = new ArrayList<ConfigAttribute>();
    for (Annotation a : annotations) {
        if (a instanceof DenyAll) {
            attributes.add(Jsr250SecurityConfig.DENY_ALL_ATTRIBUTE);
            return attributes;
        }
        if (a instanceof PermitAll) {
            attributes.add(Jsr250SecurityConfig.PERMIT_ALL_ATTRIBUTE);
            return attributes;
        }
        if (a instanceof RolesAllowed) {
            RolesAllowed ra = (RolesAllowed) a;
            for (String allowed : ra.value()) {
                String defaultedAllowed = getRoleWithDefaultPrefix(allowed);
                attributes.add(new Jsr250SecurityConfig(defaultedAllowed));
            }
            return attributes;
        }
    }
    return null;
}

Example 10 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project aries by apache.

the class AuthorizationInterceptor method preCall.

public Object preCall(ComponentMetadata cm, Method m, Object... parameters) throws Throwable {
    Annotation ann = new SecurityAnotationParser().getEffectiveAnnotation(beanClass, m);
    if (ann instanceof PermitAll) {
        return null;
    }
    // Also applies for @DenyAll
    String[] rolesAr = new String[] {};
    if (ann instanceof RolesAllowed) {
        rolesAr = ((RolesAllowed) ann).value();
    }
    Set<String> roles = new HashSet<String>(Arrays.asList(rolesAr));
    AccessControlContext acc = AccessController.getContext();
    Subject subject = Subject.getSubject(acc);
    if (subject == null) {
        throw new AccessControlException("Method call " + m.getDeclaringClass() + "." + m.getName() + " denied. No JAAS login present");
    }
    Set<Principal> principals = subject.getPrincipals();
    for (Principal principal : principals) {
        if (roles.contains(principal.getName())) {
            LOGGER.debug("Granting access to Method: {} for {}.", m, principal);
            return null;
        }
    }
    String msg = String.format("Method call %s.%s denied. Roles allowed are %s. Your principals are %s.", m.getDeclaringClass(), m.getName(), roles, getNames(principals));
    throw new AccessControlException(msg);
}