Examples with IAMPolicy org.apache.cloudstack.iam.api.IAMPolicy used on opensource projects

Example 11 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class RoleBasedEntityAccessChecker method checkAccess.

@Override
public boolean checkAccess(Account caller, ControlledEntity entity, AccessType accessType, String action) throws PermissionDeniedException {
    if (caller == null) {
        throw new InvalidParameterValueException("Caller cannot be passed as NULL to IAM!");
    }
    if (entity == null && action == null) {
        throw new InvalidParameterValueException("Entity and action cannot be both NULL in checkAccess!");
    }
    // check IAM cache first
    String accessKey = buildAccessCacheKey(caller, entity, accessType, action);
    CheckAccessResult allowDeny = (CheckAccessResult) _iamSrv.getFromIAMCache(accessKey);
    if (allowDeny != null) {
        s_logger.debug("IAM access check for " + accessKey + " from cache: " + allowDeny.isAllow());
        if (allowDeny.isAllow()) {
            return true;
        } else {
            if (allowDeny.getDenyMsg() != null) {
                throw new PermissionDeniedException(allowDeny.getDenyMsg());
            } else {
                return false;
            }
        }
    }
    if (entity == null && action != null) {
        // check if caller can do this action
        List<IAMPolicy> policies = _iamSrv.listIAMPolicies(caller.getAccountId());
        boolean isAllowed = _iamSrv.isActionAllowedForPolicies(action, policies);
        if (!isAllowed) {
            String msg = "The action '" + action + "' not allowed for account " + caller;
            _iamSrv.addToIAMCache(accessKey, new CheckAccessResult(msg));
            throw new PermissionDeniedException(msg);
        }
        _iamSrv.addToIAMCache(accessKey, new CheckAccessResult(true));
        return true;
    }
    // if a Project entity, skip
    Account entityAccount = _accountService.getAccount(entity.getAccountId());
    if (entityAccount != null && entityAccount.getType() == Account.ACCOUNT_TYPE_PROJECT) {
        _iamSrv.addToIAMCache(accessKey, new CheckAccessResult(false));
        return false;
    }
    String entityType = null;
    if (entity.getEntityType() != null) {
        entityType = entity.getEntityType().getSimpleName();
    }
    if (accessType == null) {
        accessType = AccessType.UseEntry;
    }
    // get all Policies of this caller by considering recursive domain group policy
    List<IAMPolicy> policies = getEffectivePolicies(caller);
    HashMap<IAMPolicy, Boolean> policyPermissionMap = new HashMap<IAMPolicy, Boolean>();
    for (IAMPolicy policy : policies) {
        List<IAMPolicyPermission> permissions = new ArrayList<IAMPolicyPermission>();
        if (action != null) {
            permissions = _iamSrv.listPolicyPermissionByActionAndEntity(policy.getId(), action, entityType);
            if (permissions.isEmpty()) {
                if (accessType != null) {
                    for (AccessType type : AccessType.values()) {
                        if (type.ordinal() >= accessType.ordinal()) {
                            permissions.addAll(_iamSrv.listPolicyPermissionByAccessAndEntity(policy.getId(), type.toString(), entityType));
                        }
                    }
                }
            }
        } else {
            if (accessType != null) {
                for (AccessType type : AccessType.values()) {
                    if (type.ordinal() >= accessType.ordinal()) {
                        permissions.addAll(_iamSrv.listPolicyPermissionByAccessAndEntity(policy.getId(), type.toString(), entityType));
                    }
                }
            }
        }
        for (IAMPolicyPermission permission : permissions) {
            if (checkPermissionScope(caller, permission.getScope(), permission.getScopeId(), entity)) {
                if (permission.getEntityType().equals(entityType)) {
                    policyPermissionMap.put(policy, permission.getPermission().isGranted());
                    break;
                } else if (permission.getEntityType().equals("*")) {
                    policyPermissionMap.put(policy, permission.getPermission().isGranted());
                }
            }
        }
        if (policyPermissionMap.containsKey(policy) && policyPermissionMap.get(policy)) {
            _iamSrv.addToIAMCache(accessKey, new CheckAccessResult(true));
            return true;
        }
    }
    if (!policies.isEmpty()) {
        // Since we reach this point, none of the
        // roles granted access
        String msg = "Account " + caller + " does not have permission to access resource " + entity + " for access type: " + accessType;
        if (s_logger.isDebugEnabled()) {
            s_logger.debug(msg);
        }
        _iamSrv.addToIAMCache(accessKey, new CheckAccessResult(msg));
        throw new PermissionDeniedException(msg);
    }
    _iamSrv.addToIAMCache(accessKey, new CheckAccessResult(false));
    return false;
}

Example 12 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class RoleBasedEntityQuerySelector method getAuthorizedResources.

@Override
public List<Long> getAuthorizedResources(Account caller, String action, AccessType accessType) {
    long accountId = caller.getAccountId();
    if (accessType == null) {
        // default always show resources authorized to use
        accessType = AccessType.UseEntry;
    }
    // Get the static Policies of the Caller
    List<IAMPolicy> policies = _iamService.listIAMPolicies(accountId);
    // add the policies that grant recursive access
    List<IAMGroup> groups = _iamService.listIAMGroups(caller.getId());
    for (IAMGroup group : groups) {
        // for each group find the grand parent groups.
        List<IAMGroup> parentGroups = _iamService.listParentIAMGroups(group.getId());
        for (IAMGroup parentGroup : parentGroups) {
            policies.addAll(_iamService.listRecursiveIAMPoliciesByGroup(parentGroup.getId()));
        }
    }
    // for each policy, find granted permission with Resource scope
    List<Long> entityIds = new ArrayList<Long>();
    for (IAMPolicy policy : policies) {
        List<IAMPolicyPermission> pp = new ArrayList<IAMPolicyPermission>();
        pp.addAll(_iamService.listPolicyPermissionsByScope(policy.getId(), action, PermissionScope.RESOURCE.toString(), accessType.toString()));
        if (pp != null) {
            for (IAMPolicyPermission p : pp) {
                if (p.getScopeId() != null) {
                    entityIds.add(p.getScopeId());
                }
            }
        }
    }
    return entityIds;
}

Example 13 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class IAMApiServiceTest method listIAMPolicyTest.

@Test
public void listIAMPolicyTest() {
    IAMPolicy policy = new IAMPolicyVO("policy1", "tester policy1");
    List<IAMPolicy> policies = new ArrayList<IAMPolicy>();
    policies.add(policy);
    when(_iamSrv.listIAMPolicies(callerId)).thenReturn(policies);
    List<IAMPolicy> polys = _aclSrv.listIAMPolicies(callerId);
    assertTrue(polys != null && polys.size() == 1);
    IAMPolicy p = polys.get(0);
    assertEquals("Error to retrieve group", "policy1", p.getName());
}

Example 14 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class IAMServiceImpl method attachIAMPoliciesToGroup.

@DB
@Override
public IAMGroup attachIAMPoliciesToGroup(final List<Long> policyIds, final Long groupId) {
    // get the Acl Group entity
    IAMGroup group = _aclGroupDao.findById(groupId);
    if (group == null) {
        throw new InvalidParameterValueException("Unable to find acl group: " + groupId + "; failed to add roles to acl group.");
    }
    Transaction.execute(new TransactionCallbackNoReturn() {

        @Override
        public void doInTransactionWithoutResult(TransactionStatus status) {
            // add entries in acl_group_policy_map table
            for (Long policyId : policyIds) {
                IAMPolicy policy = _aclPolicyDao.findById(policyId);
                if (policy == null) {
                    throw new InvalidParameterValueException("Unable to find acl policy: " + policyId + "; failed to add policies to acl group.");
                }
                IAMGroupPolicyMapVO grMap = _aclGroupPolicyMapDao.findByGroupAndPolicy(groupId, policyId);
                if (grMap == null) {
                    // not there already
                    grMap = new IAMGroupPolicyMapVO(groupId, policyId);
                    _aclGroupPolicyMapDao.persist(grMap);
                }
            }
        }
    });
    invalidateIAMCache();
    return group;
}

Example 15 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class CreateIAMPolicyCmd method execute.

@Override
public void execute() {
    IAMPolicy policy = _entityMgr.findById(IAMPolicy.class, getEntityId());
    if (policy != null) {
        IAMPolicyResponse response = _iamApiSrv.createIAMPolicyResponse(policy);
        response.setResponseName(getCommandName());
        setResponseObject(response);
    } else {
        throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create iam policy:" + name);
    }
}