use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.
the class WriteTest method testNotItemBasedPrincipal.
/**
* Test for bug JCR-2621
*
* @throws Exception
*/
public void testNotItemBasedPrincipal() throws Exception {
try {
Principal everyone = ((JackrabbitSession) superuser).getPrincipalManager().getEveryone();
JackrabbitAccessControlList acl = getPolicy(acMgr, path, everyone);
acl.addEntry(everyone, privilegesFromName(Privilege.JCR_READ), true, getRestrictions(superuser, path));
acMgr.setPolicy(acl.getPath(), acl);
AccessControlPolicy[] plcs = acMgr.getPolicies(acl.getPath());
assertEquals(1, plcs.length);
acl = (JackrabbitAccessControlList) plcs[0];
acl.addEntry(everyone, privilegesFromName(Privilege.JCR_WRITE), true, getRestrictions(superuser, path));
acMgr.setPolicy(acl.getPath(), acl);
} finally {
// revert all kind of transient modifications
superuser.refresh(false);
}
}
use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.
the class WriteTest method testReorderGroupPermissions.
public void testReorderGroupPermissions() throws NotExecutableException, RepositoryException {
Group testGroup = getTestGroup();
/* create a second group the test user is member of */
Principal principal = new TestPrincipal("testGroup" + UUID.randomUUID());
UserManager umgr = getUserManager(superuser);
Group group2 = umgr.createGroup(principal);
try {
group2.addMember(testUser);
if (!umgr.isAutoSave() && superuser.hasPendingChanges()) {
superuser.save();
}
/* add privileges for the Group the test-user is member of */
Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);
withdrawPrivileges(path, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));
givePrivileges(path, group2.getPrincipal(), privileges, getRestrictions(superuser, path));
/*
testuser must get the permissions/privileges inherited from
the group it is member of.
granting permissions for group2 must be effective
*/
String actions = javax.jcr.Session.ACTION_SET_PROPERTY + "," + javax.jcr.Session.ACTION_READ;
AccessControlManager testAcMgr = getTestACManager();
assertTrue(getTestSession().hasPermission(path, actions));
Privilege[] privs = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);
assertTrue(testAcMgr.hasPrivileges(path, privs));
// reorder the ACEs
AccessControlEntry srcEntry = null;
AccessControlEntry destEntry = null;
JackrabbitAccessControlList acl = (JackrabbitAccessControlList) acMgr.getPolicies(path)[0];
for (AccessControlEntry entry : acl.getAccessControlEntries()) {
Principal princ = entry.getPrincipal();
if (testGroup.getPrincipal().equals(princ)) {
destEntry = entry;
} else if (group2.getPrincipal().equals(princ)) {
srcEntry = entry;
}
}
acl.orderBefore(srcEntry, destEntry);
acMgr.setPolicy(path, acl);
superuser.save();
/* after reordering the permissions must be denied */
assertFalse(getTestSession().hasPermission(path, actions));
assertFalse(testAcMgr.hasPrivileges(path, privs));
} finally {
group2.remove();
}
}
use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.
the class WriteTest method givePrivileges.
private JackrabbitAccessControlList givePrivileges(String nPath, Principal principal, Privilege[] privileges, Map<String, Value> restrictions, boolean nodeBased) throws NotExecutableException, RepositoryException {
if (nodeBased) {
return givePrivileges(nPath, principal, privileges, getRestrictions(superuser, nPath));
} else {
JackrabbitAccessControlList tmpl = getPrincipalBasedPolicy(acMgr, nPath, principal);
tmpl.addEntry(principal, privileges, true, restrictions);
acMgr.setPolicy(tmpl.getPath(), tmpl);
superuser.save();
return tmpl;
}
}
use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.
the class WriteTest method withdrawPrivileges.
private JackrabbitAccessControlList withdrawPrivileges(String nPath, Principal principal, Privilege[] privileges, Map<String, Value> restrictions, boolean nodeBased) throws NotExecutableException, RepositoryException {
if (nodeBased) {
return withdrawPrivileges(nPath, principal, privileges, getRestrictions(superuser, nPath));
} else {
JackrabbitAccessControlList tmpl = getPrincipalBasedPolicy(acMgr, nPath, principal);
tmpl.addEntry(principal, privileges, false, restrictions);
acMgr.setPolicy(tmpl.getPath(), tmpl);
superuser.save();
return tmpl;
}
}
use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.
the class ACLTemplateTest method testGetRestrictionTypes.
public void testGetRestrictionTypes() throws RepositoryException {
JackrabbitAccessControlList acl = createEmptyTemplate(getTestPath());
NameResolver resolver = (NameResolver) superuser;
assertEquals(PropertyType.PATH, acl.getRestrictionType(resolver.getJCRName(ACLTemplate.P_NODE_PATH)));
assertEquals(PropertyType.STRING, acl.getRestrictionType(resolver.getJCRName(ACLTemplate.P_GLOB)));
}
Aggregations