Examples with JackrabbitAccessControlList org.apache.jackrabbit.api.security.JackrabbitAccessControlList used on opensource projects

Example 71 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlManagementTest method testAccessControlModification.

@Test
public void testAccessControlModification() throws Exception {
    // give 'testUser' READ_AC|MODIFY_AC privileges at 'path'
    Privilege[] privileges = privilegesFromNames(new String[] { Privilege.JCR_READ_ACCESS_CONTROL, Privilege.JCR_MODIFY_ACCESS_CONTROL });
    JackrabbitAccessControlList tmpl = allow(path, privileges);
    /*
         testuser must
         - still have the inherited READ permission.
         - must have permission to view AC items at 'path' (and below)
         - must have permission to modify AC items at 'path'

         testuser must not have
         - permission to view AC items outside of the tree defined by path.
        */
    // make sure the 'rep:policy' node has been created.
    assertTrue(superuser.itemExists(tmpl.getPath() + "/rep:policy"));
    // test: MODIFY_AC granted at 'path'
    assertTrue(testAcMgr.hasPrivileges(path, privilegesFromName(Privilege.JCR_MODIFY_ACCESS_CONTROL)));
    // test if testuser can READ access control on the path and on the
    // entire subtree that gets the policy inherited.
    AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
    testAcMgr.getPolicies(childNPath);
    // test: READ_AC privilege does not apply outside of the tree.
    try {
        testAcMgr.getPolicies(siblingPath);
        fail("READ_AC privilege must not apply outside of the tree it has applied to.");
    } catch (AccessDeniedException e) {
    // success
    }
    // test: MODIFY_AC privilege does not apply outside of the tree.
    assertFalse(testAcMgr.hasPrivileges(siblingPath, privilegesFromName(Privilege.JCR_MODIFY_ACCESS_CONTROL)));
    // test if testuser can modify AC-items
    // 1) add an ac-entry
    AccessControlList acl = (AccessControlList) policies[0];
    acl.addAccessControlEntry(testUser.getPrincipal(), repWritePrivileges);
    testAcMgr.setPolicy(path, acl);
    testSession.save();
    assertTrue(testAcMgr.hasPrivileges(path, privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES)));
    // 2) remove the policy
    testAcMgr.removePolicy(path, policies[0]);
    testSession.save();
    // privileges must be gone again...
    try {
        testAcMgr.getEffectivePolicies(childNPath);
        fail("READ_AC privilege has been revoked -> must throw again.");
    } catch (AccessDeniedException e) {
    // success
    }
    // ... and since the ACE is stored with the policy all right except
    // READ must be gone.
    assertReadOnly(path);
}

Example 72 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class AccessControlImporterTest method testImportEmptyExistingPolicy.

/**
     * Imports an empty resource-based ACL for a policy that already exists.
     *
     * @throws Exception
     */
public void testImportEmptyExistingPolicy() throws Exception {
    try {
        Node target = createImportTargetWithPolicy(null);
        doImport(target.getPath(), XML_POLICY_ONLY);
        AccessControlPolicy[] policies = superuser.getAccessControlManager().getPolicies(target.getPath());
        assertEquals(1, policies.length);
        assertTrue(policies[0] instanceof JackrabbitAccessControlList);
        AccessControlEntry[] entries = ((JackrabbitAccessControlList) policies[0]).getAccessControlEntries();
        assertEquals(0, entries.length);
    } finally {
        superuser.refresh(false);
    }
}

Example 73 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class InheritanceTest method testReorderGroupPermissions.

@Test
public void testReorderGroupPermissions() throws Exception {
    /* add privileges for the Group the test-user is member of */
    deny(path, testGroup.getPrincipal(), modPropPrivileges);
    allow(path, group2.getPrincipal(), modPropPrivileges);
    /*
         testuser must get the permissions/privileges inherited from
         the group it is member of.
         granting permissions for group2 must be effective
        */
    String actions = getActions(Session.ACTION_SET_PROPERTY, Session.ACTION_READ);
    assertTrue(testSession.hasPermission(path, actions));
    Privilege[] privs = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);
    assertTrue(testAcMgr.hasPrivileges(path, privs));
    // reorder the ACEs
    AccessControlEntry srcEntry = null;
    AccessControlEntry destEntry = null;
    JackrabbitAccessControlList acl = (JackrabbitAccessControlList) acMgr.getPolicies(path)[0];
    for (AccessControlEntry entry : acl.getAccessControlEntries()) {
        Principal princ = entry.getPrincipal();
        if (testGroup.getPrincipal().equals(princ)) {
            destEntry = entry;
        } else if (group2.getPrincipal().equals(princ)) {
            srcEntry = entry;
        }
    }
    acl.orderBefore(srcEntry, destEntry);
    acMgr.setPolicy(path, acl);
    superuser.save();
    testSession.refresh(false);
    /* after reordering the permissions must be denied */
    assertFalse(testSession.hasPermission(path, actions));
    assertFalse(testAcMgr.hasPrivileges(path, privs));
}

Example 74 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class ReadVersionContentTest method tearDown.

@Override
@After
protected void tearDown() throws Exception {
    JackrabbitAccessControlList acl = AccessControlUtils.getAccessControlList(superuser, VersionConstants.VERSION_STORE_PATH);
    if (acl != null) {
        for (AccessControlEntry entry : acl.getAccessControlEntries()) {
            if (entry.getPrincipal().equals(testUser.getPrincipal())) {
                acl.removeAccessControlEntry(entry);
            }
        }
        acMgr.setPolicy(VersionConstants.VERSION_STORE_PATH, acl);
        superuser.save();
    }
}

Example 75 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class OpvIgnoreTest method addIgnoredChild.

private void addIgnoredChild(@Nonnull Node node) throws Exception {
    AccessControlManager acMgr = superuser.getAccessControlManager();
    JackrabbitAccessControlList acl = AccessControlUtils.getAccessControlList(acMgr, node.getPath());
    acl.addAccessControlEntry(EveryonePrincipal.getInstance(), AccessControlUtils.privilegesFromNames(acMgr, Privilege.JCR_READ));
    acMgr.setPolicy(acl.getPath(), acl);
    superuser.save();
    Node c = node.getNode(AccessControlConstants.REP_POLICY);
    assertEquals(OnParentVersionAction.IGNORE, c.getDefinition().getOnParentVersion());
}