Examples with RoleClosureIterator org.apache.derby.iapi.sql.dictionary.RoleClosureIterator used on opensource projects

Example 1 with RoleClosureIterator

use of org.apache.derby.iapi.sql.dictionary.RoleClosureIterator in project derby by apache.

the class RevokeRoleConstantAction method executeConstantAction.

// INTERFACE METHODS
/**
 * This is the guts of the Execution-time logic for REVOKE role.
 *
 * @see org.apache.derby.iapi.sql.execute.ConstantAction#executeConstantAction
 */
public void executeConstantAction(Activation activation) throws StandardException {
    LanguageConnectionContext lcc = activation.getLanguageConnectionContext();
    DataDictionary dd = lcc.getDataDictionary();
    TransactionController tc = lcc.getTransactionExecute();
    final String grantor = lcc.getCurrentUserId(activation);
    dd.startWriting(lcc);
    for (Iterator rIter = roleNames.iterator(); rIter.hasNext(); ) {
        String role = (String) rIter.next();
        if (role.equals(Authorizer.PUBLIC_AUTHORIZATION_ID)) {
            throw StandardException.newException(SQLState.AUTH_PUBLIC_ILLEGAL_AUTHORIZATION_ID);
        }
        for (Iterator gIter = grantees.iterator(); gIter.hasNext(); ) {
            String grantee = (String) gIter.next();
            // check that role exists
            RoleGrantDescriptor rdDef = dd.getRoleDefinitionDescriptor(role);
            if (rdDef == null) {
                throw StandardException.newException(SQLState.ROLE_INVALID_SPECIFICATION, role);
            }
            // :
            if (grantor.equals(lcc.getDataDictionary().getAuthorizationDatabaseOwner())) {
                // All ok, we are database owner
                if (SanityManager.DEBUG) {
                    SanityManager.ASSERT(rdDef.getGrantee().equals(grantor), "expected database owner in role grant descriptor");
                    SanityManager.ASSERT(rdDef.isWithAdminOption(), "expected role definition to have ADMIN OPTION");
                }
            } else {
                throw StandardException.newException(SQLState.AUTH_ROLE_DBO_ONLY, "REVOKE role");
            }
            RoleGrantDescriptor rd = dd.getRoleGrantDescriptor(role, grantee, grantor);
            if (rd != null && withAdminOption) {
                if (SanityManager.DEBUG) {
                    SanityManager.NOTREACHED();
                }
                // 
                if (rd.isWithAdminOption()) {
                // Invalidate and remove old descriptor and add a new
                // one without admin option.
                // 
                // RoleClosureIterator rci =
                // dd.createRoleClosureIterator
                // (activation.getTransactionController(),
                // role, false);
                // 
                // String r;
                // while ((r = rci.next()) != null) {
                // rdDef = dd.getRoleDefinitionDescriptor(r);
                // 
                // dd.getDependencyManager().invalidateFor
                // (rdDef, DependencyManager.REVOKE_ROLE, lcc);
                // }
                // 
                // rd.drop(lcc);
                // rd.setWithAdminOption(false);
                // dd.addDescriptor(rd,
                // null,  // parent
                // DataDictionary.SYSROLES_CATALOG_NUM,
                // false, // no duplicatesAllowed
                // tc);
                } else {
                    activation.addWarning(StandardException.newWarning(SQLState.LANG_WITH_ADMIN_OPTION_NOT_REVOKED, role, grantee));
                }
            } else if (rd != null) {
                // Normal revoke of role from grantee.
                // 
                // When a role is revoked, for every role in its grantee
                // closure, we call the REVOKE_ROLE action. It is used to
                // invalidate dependent objects (constraints, triggers and
                // views).  Note that until DERBY-1632 is fixed, we risk
                // dropping objects not really dependent on this role, but
                // one some other role just because it inherits from this
                // one. See also DropRoleConstantAction.
                RoleClosureIterator rci = dd.createRoleClosureIterator(activation.getTransactionController(), role, false);
                String r;
                while ((r = rci.next()) != null) {
                    rdDef = dd.getRoleDefinitionDescriptor(r);
                    dd.getDependencyManager().invalidateFor(rdDef, DependencyManager.REVOKE_ROLE, lcc);
                }
                rd.drop(lcc);
            } else {
                activation.addWarning(StandardException.newWarning(SQLState.LANG_ROLE_NOT_REVOKED, role, grantee));
            }
        }
    }
}

Example 2 with RoleClosureIterator

use of org.apache.derby.iapi.sql.dictionary.RoleClosureIterator in project derby by apache.

the class DDLConstantAction method findRoleUsage.

/**
 * We have determined that the statement permission described by statPerm
 * is not granted to the current user nor to PUBLIC, so it must be granted
 * to the current role or one of the roles inherited by the current
 * role. Find the relevant permission descriptor and return it.
 *
 * @return the permission descriptor that yielded the privilege
 */
private static PermissionsDescriptor findRoleUsage(Activation activation, StatementPermission statPerm) throws StandardException {
    LanguageConnectionContext lcc = activation.getLanguageConnectionContext();
    DataDictionary dd = lcc.getDataDictionary();
    String role = lcc.getCurrentRoleId(activation);
    PermissionsDescriptor permDesc = null;
    if (SanityManager.DEBUG) {
        SanityManager.ASSERT(role != null, "Unexpected: current role is not set");
    }
    // If not found in current role, get transitive
    // closure of roles granted to current role and
    // iterate over it to see if permission has
    // been granted to any of the roles the current
    // role inherits.
    RoleClosureIterator rci = dd.createRoleClosureIterator(activation.getTransactionController(), role, true);
    String graphGrant;
    while (permDesc == null && (graphGrant = rci.next()) != null) {
        permDesc = statPerm.getPermissionDescriptor(graphGrant, dd);
    }
    if (SanityManager.DEBUG) {
        SanityManager.ASSERT(permDesc != null, "Unexpected: Permission needs to be found via role");
    }
    return permDesc;
}

Example 3 with RoleClosureIterator

use of org.apache.derby.iapi.sql.dictionary.RoleClosureIterator in project derby by apache.

the class DropRoleConstantAction method executeConstantAction.

// INTERFACE METHODS
/**
 * This is the guts of the Execution-time logic for DROP ROLE.
 *
 * @see org.apache.derby.iapi.sql.execute.ConstantAction#executeConstantAction
 */
public void executeConstantAction(Activation activation) throws StandardException {
    LanguageConnectionContext lcc = activation.getLanguageConnectionContext();
    DataDictionary dd = lcc.getDataDictionary();
    TransactionController tc = lcc.getTransactionExecute();
    /*
        ** Inform the data dictionary that we are about to write to it.
        ** There are several calls to data dictionary "get" methods here
        ** that might be done in "read" mode in the data dictionary, but
        ** it seemed safer to do this whole operation in "write" mode.
        **
        ** We tell the data dictionary we're done writing at the end of
        ** the transaction.
        */
    dd.startWriting(lcc);
    RoleGrantDescriptor rdDef = dd.getRoleDefinitionDescriptor(roleName);
    if (rdDef == null) {
        throw StandardException.newException(SQLState.ROLE_INVALID_SPECIFICATION, roleName);
    }
    // When a role is dropped, for every role in its grantee closure, we
    // call the REVOKE_ROLE action. It is used to invalidate dependent
    // objects (constraints, triggers and views).  Note that until
    // DERBY-1632 is fixed, we risk dropping objects not really dependent
    // on this role, but one some other role just because it inherits from
    // this one. See also RevokeRoleConstantAction.
    RoleClosureIterator rci = dd.createRoleClosureIterator(activation.getTransactionController(), roleName, false);
    String role;
    while ((role = rci.next()) != null) {
        RoleGrantDescriptor r = dd.getRoleDefinitionDescriptor(role);
        dd.getDependencyManager().invalidateFor(r, DependencyManager.REVOKE_ROLE, lcc);
    }
    rdDef.drop(lcc);
    /*
         * We dropped a role, now drop all dependents:
         * - role grants to this role
         * - grants of this role to other roles or users
         * - privilege grants to this role
         */
    dd.dropRoleGrantsByGrantee(roleName, tc);
    dd.dropRoleGrantsByName(roleName, tc);
    dd.dropAllPermsByGrantee(roleName, tc);
}

Example 4 with RoleClosureIterator

use of org.apache.derby.iapi.sql.dictionary.RoleClosureIterator in project derby by apache.

the class GrantRoleConstantAction method checkCircularity.

/**
 * Check that allowing this grant to go ahead does nto create a
 * circularity in the GRANT role relation graph, cf. Section 12.5,
 * Syntax rule 1 of ISO/IEC 9075-2 2003.
 *
 * @param role The role about to be granted
 * @param grantee The role to which {@code role} is to be granted
 * @param grantor Who does the granting
 * @throws StandardException normal error policy. Throws
 *                           AUTH_ROLE_GRANT_CIRCULARITY if a
 *                           circularity is detected.
 */
private void checkCircularity(String role, String grantee, String grantor, TransactionController tc, DataDictionary dd) throws StandardException {
    // The grantee is role, not a user id, so we need to check for
    // circularity. If there exists a grant back to the role being
    // granted now, from one of the roles in the grant closure of
    // grantee, there is a circularity.
    // Via grant closure of grantee
    RoleClosureIterator rci = dd.createRoleClosureIterator(tc, grantee, false);
    String r;
    while ((r = rci.next()) != null) {
        if (role.equals(r)) {
            throw StandardException.newException(SQLState.AUTH_ROLE_GRANT_CIRCULARITY, role, grantee);
        }
    }
}