Examples with IAMPolicy org.apache.cloudstack.iam.api.IAMPolicy used on opensource projects

Example 16 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class IAMServiceImpl method addIAMPermissionToIAMPolicy.

@DB
@Override
public IAMPolicy addIAMPermissionToIAMPolicy(long iamPolicyId, String entityType, String scope, Long scopeId, String action, String accessType, Permission perm, Boolean recursive) {
    // get the Acl Policy entity
    IAMPolicy policy = _aclPolicyDao.findById(iamPolicyId);
    if (policy == null) {
        throw new InvalidParameterValueException("Unable to find acl policy: " + iamPolicyId + "; failed to add permission to policy.");
    }
    // add entry in acl_policy_permission table
    IAMPolicyPermissionVO permit = _policyPermissionDao.findByPolicyAndEntity(iamPolicyId, entityType, scope, scopeId, action, perm, accessType);
    if (permit == null) {
        // not there already
        permit = new IAMPolicyPermissionVO(iamPolicyId, action, entityType, accessType, scope, scopeId, perm, recursive);
        _policyPermissionDao.persist(permit);
    }
    invalidateIAMCache();
    return policy;
}

Example 17 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class IAMServiceImpl method removeIAMPoliciesFromGroup.

@DB
@Override
public IAMGroup removeIAMPoliciesFromGroup(final List<Long> policyIds, final Long groupId) {
    // get the Acl Group entity
    IAMGroup group = _aclGroupDao.findById(groupId);
    if (group == null) {
        throw new InvalidParameterValueException("Unable to find acl group: " + groupId + "; failed to remove roles from acl group.");
    }
    Transaction.execute(new TransactionCallbackNoReturn() {

        @Override
        public void doInTransactionWithoutResult(TransactionStatus status) {
            // add entries in acl_group_role_map table
            for (Long policyId : policyIds) {
                IAMPolicy policy = _aclPolicyDao.findById(policyId);
                if (policy == null) {
                    throw new InvalidParameterValueException("Unable to find acl policy: " + policyId + "; failed to add policies to acl group.");
                }
                IAMGroupPolicyMapVO grMap = _aclGroupPolicyMapDao.findByGroupAndPolicy(groupId, policyId);
                if (grMap != null) {
                    // not removed yet
                    _aclGroupPolicyMapDao.remove(grMap.getId());
                }
            }
        }
    });
    invalidateIAMCache();
    return group;
}

Example 18 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class IAMServiceImpl method createIAMPolicy.

@DB
@Override
public IAMPolicy createIAMPolicy(final String iamPolicyName, final String description, final Long parentPolicyId, final String path) {
    // check if the policy is already existing
    IAMPolicy ro = _aclPolicyDao.findByName(iamPolicyName);
    if (ro != null) {
        throw new InvalidParameterValueException("Unable to create acl policy with name " + iamPolicyName + " already exists");
    }
    IAMPolicy role = Transaction.execute(new TransactionCallback<IAMPolicy>() {

        @Override
        public IAMPolicy doInTransaction(TransactionStatus status) {
            IAMPolicyVO rvo = new IAMPolicyVO(iamPolicyName, description);
            rvo.setPath(path);
            IAMPolicy role = _aclPolicyDao.persist(rvo);
            if (parentPolicyId != null) {
                // copy parent role permissions
                List<IAMPolicyPermissionVO> perms = _policyPermissionDao.listByPolicy(parentPolicyId);
                if (perms != null) {
                    for (IAMPolicyPermissionVO perm : perms) {
                        perm.setAclPolicyId(role.getId());
                        _policyPermissionDao.persist(perm);
                    }
                }
            }
            return role;
        }
    });
    return role;
}

Example 19 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class IAMServiceImpl method isActionAllowedForPolicies.

@Override
public boolean isActionAllowedForPolicies(String action, List<IAMPolicy> policies) {
    boolean allowed = false;
    if (policies == null || policies.size() == 0) {
        return allowed;
    }
    List<Long> policyIds = new ArrayList<Long>();
    for (IAMPolicy policy : policies) {
        policyIds.add(policy.getId());
    }
    SearchBuilder<IAMPolicyPermissionVO> sb = _policyPermissionDao.createSearchBuilder();
    sb.and("action", sb.entity().getAction(), Op.EQ);
    sb.and("policyId", sb.entity().getAclPolicyId(), Op.IN);
    SearchCriteria<IAMPolicyPermissionVO> sc = sb.create();
    sc.setParameters("policyId", policyIds.toArray(new Object[policyIds.size()]));
    sc.setParameters("action", action);
    List<IAMPolicyPermissionVO> permissions = _policyPermissionDao.customSearch(sc, null);
    if (permissions != null && !permissions.isEmpty()) {
        allowed = true;
    }
    return allowed;
}

Example 20 with IAMPolicy

use of org.apache.cloudstack.iam.api.IAMPolicy in project cloudstack by apache.

the class RoleBasedEntityQuerySelector method getAuthorizedAccounts.

@Override
public List<Long> getAuthorizedAccounts(Account caller, String action, AccessType accessType) {
    long accountId = caller.getAccountId();
    if (accessType == null) {
        // default always show resources authorized to use
        accessType = AccessType.UseEntry;
    }
    // Get the static Policies of the Caller
    List<IAMPolicy> policies = _iamService.listIAMPolicies(accountId);
    // for each policy, find granted permission with Account scope
    List<Long> accountIds = new ArrayList<Long>();
    for (IAMPolicy policy : policies) {
        List<IAMPolicyPermission> pp = new ArrayList<IAMPolicyPermission>();
        pp.addAll(_iamService.listPolicyPermissionsByScope(policy.getId(), action, PermissionScope.ACCOUNT.toString(), accessType.toString()));
        if (pp != null) {
            for (IAMPolicyPermission p : pp) {
                if (p.getScopeId() != null) {
                    if (p.getScopeId().longValue() == -1) {
                        accountIds.add(caller.getId());
                    } else {
                        accountIds.add(p.getScopeId());
                    }
                }
            }
        }
    }
    return accountIds;
}