Examples with JackrabbitAccessControlList org.apache.jackrabbit.api.security.JackrabbitAccessControlList used on opensource projects

Example 66 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlImporterTest method testImportPolicyExists.

/**
     * Imports a resource-based ACL containing a single entry for a policy that
     * already exists: expected outcome its that the existing ACE is replaced.
     */
public void testImportPolicyExists() throws Exception {
    try {
        Node target = createImportTargetWithPolicy(EveryonePrincipal.getInstance());
        doImport(target.getPath(), XML_POLICY_TREE_2);
        AccessControlManager acMgr = superuser.getAccessControlManager();
        AccessControlPolicy[] policies = acMgr.getPolicies(target.getPath());
        assertEquals(1, policies.length);
        assertTrue(policies[0] instanceof JackrabbitAccessControlList);
        AccessControlEntry[] entries = ((JackrabbitAccessControlList) policies[0]).getAccessControlEntries();
        assertEquals(1, entries.length);
        AccessControlEntry entry = entries[0];
        assertEquals(EveryonePrincipal.getInstance(), entry.getPrincipal());
        List<Privilege> privs = Arrays.asList(entry.getPrivileges());
        assertEquals(1, privs.size());
        assertEquals(acMgr.privilegeFromName(Privilege.JCR_WRITE), entry.getPrivileges()[0]);
        if (entry instanceof JackrabbitAccessControlEntry) {
            assertTrue(((JackrabbitAccessControlEntry) entry).isAllow());
        }
    } finally {
        superuser.refresh(false);
    }
}

Example 67 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlManagementTest method testReadAccessControlWithoutPrivilege.

@Test
public void testReadAccessControlWithoutPrivilege() throws Exception {
    // re-grant READ in order to have an ACL-node
    Privilege[] privileges = privilegesFromName(Privilege.JCR_READ);
    JackrabbitAccessControlList tmpl = allow(path, privileges);
    String policyPath = tmpl.getPath() + "/rep:policy";
    // make sure the 'rep:policy' node has been created.
    assertTrue(superuser.itemExists(policyPath));
    /*
         Testuser must still have READ-only access only and must not be
         allowed to view the acl-node nor any item in the subtree that
         has been created.
        */
    assertFalse(testAcMgr.hasPrivileges(path, privilegesFromName(Privilege.JCR_READ_ACCESS_CONTROL)));
    assertFalse(testSession.itemExists(policyPath));
    assertFalse(testSession.nodeExists(policyPath));
    try {
        testSession.getNode(policyPath);
        fail("Accessing the rep:policy node must throw PathNotFoundException.");
    } catch (PathNotFoundException e) {
    // ok.
    }
    try {
        testAcMgr.getPolicies(tmpl.getPath());
        fail("test user must not have READ_AC privilege.");
    } catch (AccessDeniedException e) {
    // success
    }
    try {
        testAcMgr.getEffectivePolicies(tmpl.getPath());
        fail("test user must not have READ_AC privilege.");
    } catch (AccessDeniedException e) {
    // success
    }
    for (NodeIterator aceNodes = superuser.getNode(policyPath).getNodes(); aceNodes.hasNext(); ) {
        Node aceNode = aceNodes.nextNode();
        String aceNodePath = aceNode.getPath();
        assertFalse(testSession.nodeExists(aceNodePath));
        for (PropertyIterator it = aceNode.getProperties(); it.hasNext(); ) {
            assertFalse(testSession.propertyExists(it.nextProperty().getPath()));
        }
    }
}

Example 68 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlManagementTest method testAclReferingToRemovedPrincipal.

@Test
public void testAclReferingToRemovedPrincipal() throws Exception {
    JackrabbitAccessControlList acl = allow(path, repWritePrivileges);
    String acPath = acl.getPath();
    // remove the test user
    testUser.remove();
    superuser.save();
    testUser = null;
    // try to retrieve the acl again
    Session s = getHelper().getSuperuserSession();
    try {
        AccessControlManager acMgr = getAccessControlManager(s);
        acMgr.getPolicies(acPath);
    } finally {
        s.logout();
    }
}

Example 69 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlManagementTest method testRetrievePrivilegesOnAcNodes.

@Test
public void testRetrievePrivilegesOnAcNodes() throws Exception {
    // give 'testUser' jcr:readAccessControl privileges at 'path'
    Privilege[] privileges = privilegesFromName(Privilege.JCR_READ_ACCESS_CONTROL);
    allow(path, privileges);
    /*
         testuser must be allowed to read ac-content at target node.
        */
    assertTrue(testAcMgr.hasPrivileges(path, privileges));
    AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
    assertEquals(1, policies.length);
    assertTrue(policies[0] instanceof JackrabbitAccessControlList);
    String aclNodePath = null;
    Node n = superuser.getNode(path);
    for (NodeIterator itr = n.getNodes(); itr.hasNext(); ) {
        Node child = itr.nextNode();
        if (child.isNodeType("rep:Policy")) {
            aclNodePath = child.getPath();
        }
    }
    if (aclNodePath == null) {
        fail("Expected node at " + path + " to have an ACL child node.");
    }
    assertTrue(testAcMgr.hasPrivileges(aclNodePath, privileges));
    assertTrue(testSession.hasPermission(aclNodePath, Session.ACTION_READ));
    for (NodeIterator aceNodes = superuser.getNode(aclNodePath).getNodes(); aceNodes.hasNext(); ) {
        String aceNodePath = aceNodes.nextNode().getPath();
        assertTrue(testAcMgr.hasPrivileges(aceNodePath, privileges));
        assertTrue(testSession.hasPermission(aceNodePath, Session.ACTION_READ));
    }
}

Example 70 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlManagementTest method testAccessControlModificationWithoutPrivilege.

@Test
public void testAccessControlModificationWithoutPrivilege() throws Exception {
    // give 'testUser' ADD_CHILD_NODES|MODIFY_PROPERTIES| REMOVE_CHILD_NODES privileges at 'path'
    Privilege[] privileges = privilegesFromNames(new String[] { Privilege.JCR_ADD_CHILD_NODES, Privilege.JCR_REMOVE_CHILD_NODES, Privilege.JCR_MODIFY_PROPERTIES });
    JackrabbitAccessControlList tmpl = allow(path, privileges);
    String policyPath = tmpl.getPath() + "/rep:policy";
    // make sure the 'rep:policy' node has been created.
    assertTrue(superuser.itemExists(policyPath));
    /*
         testuser must not have
         - permission to modify AC items
        */
    try {
        testAcMgr.setPolicy(tmpl.getPath(), tmpl);
        fail("test user must not have MODIFY_AC privilege.");
    } catch (AccessDeniedException e) {
    // success
    }
    try {
        testAcMgr.removePolicy(tmpl.getPath(), tmpl);
        fail("test user must not have MODIFY_AC privilege.");
    } catch (AccessDeniedException e) {
    // success
    }
}