Examples with JackrabbitAccessControlList org.apache.jackrabbit.api.security.JackrabbitAccessControlList used on opensource projects

Example 91 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit-oak by apache.

the class UserManagementTest method testCreateWithIntermediateReadDeny2.

@Test
public void testCreateWithIntermediateReadDeny2() throws Exception {
    String path = UserConstants.DEFAULT_GROUP_PATH + "/a";
    JcrUtils.getOrCreateByPath(path, UserConstants.NT_REP_AUTHORIZABLE_FOLDER, superuser);
    superuser.save();
    try {
        deny(UserConstants.DEFAULT_GROUP_PATH, privilegesFromName(Privilege.JCR_READ));
        Privilege[] privs = privilegesFromNames(new String[] { Privilege.JCR_READ, PrivilegeConstants.REP_USER_MANAGEMENT, PrivilegeConstants.REP_WRITE });
        allow(path, privs);
        Group gr = getUserManager(testSession).createGroup(groupId, new PrincipalImpl(groupId), "a/b/c");
        testSession.save();
    } finally {
        superuser.refresh(false);
        superuser.getNode(UserConstants.DEFAULT_GROUP_PATH + "/a").remove();
        JackrabbitAccessControlList acl = AccessControlUtils.getAccessControlList(acMgr, UserConstants.DEFAULT_GROUP_PATH);
        if (acl != null) {
            acMgr.removePolicy(UserConstants.DEFAULT_GROUP_PATH, acl);
        }
        superuser.save();
    }
}

Example 92 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project sling by apache.

the class AccessControlUtil method reorderAccessControlEntries.

/**
	 * Move the ACE(s) for the specified principal to the position specified by the 'order'
	 * parameter.
	 *
	 * @param acl the acl of the node containing the ACE to position
	 * @param principal the user or group of the ACE to position
     * @param order where the access control entry should go in the list.
     *         Value should be one of these:
     *         <table>
     * 			<tr><td>first</td><td>Place the target ACE as the first amongst its siblings</td></tr>
	 *			<tr><td>last</td><td>Place the target ACE as the last amongst its siblings</td></tr>
	 * 			<tr><td>before xyz</td><td>Place the target ACE immediately before the sibling whose name is xyz</td></tr>
	 * 			<tr><td>after xyz</td><td>Place the target ACE immediately after the sibling whose name is xyz</td></tr>
	 * 			<tr><td>numeric</td><td>Place the target ACE at the specified index</td></tr>
	 *         </table>
	 * @throws RepositoryException
	 * @throws UnsupportedRepositoryOperationException
	 * @throws AccessControlException
	 */
private static void reorderAccessControlEntries(AccessControlList acl, Principal principal, String order) throws RepositoryException {
    if (order == null || order.length() == 0) {
        //nothing to do
        return;
    }
    if (acl instanceof JackrabbitAccessControlList) {
        JackrabbitAccessControlList jacl = (JackrabbitAccessControlList) acl;
        AccessControlEntry[] accessControlEntries = jacl.getAccessControlEntries();
        if (accessControlEntries.length <= 1) {
            //only one ACE, so nothing to reorder.
            return;
        }
        AccessControlEntry beforeEntry = null;
        if ("first".equals(order)) {
            beforeEntry = accessControlEntries[0];
        } else if ("last".equals(order)) {
            beforeEntry = null;
        } else if (order.startsWith("before ")) {
            String beforePrincipalName = order.substring(7);
            //find the index of the ACE of the 'before' principal
            for (int i = 0; i < accessControlEntries.length; i++) {
                if (beforePrincipalName.equals(accessControlEntries[i].getPrincipal().getName())) {
                    //found it!
                    beforeEntry = accessControlEntries[i];
                    break;
                }
            }
            if (beforeEntry == null) {
                //didn't find an ACE that matched the 'before' principal
                throw new IllegalArgumentException("No ACE was found for the specified principal: " + beforePrincipalName);
            }
        } else if (order.startsWith("after ")) {
            String afterPrincipalName = order.substring(6);
            //find the index of the ACE of the 'after' principal
            for (int i = accessControlEntries.length - 1; i >= 0; i--) {
                if (afterPrincipalName.equals(accessControlEntries[i].getPrincipal().getName())) {
                    // the 'before' ACE is the next one after the 'after' ACE
                    if (i >= accessControlEntries.length - 1) {
                        //the after is the last one in the list
                        beforeEntry = null;
                    } else {
                        beforeEntry = accessControlEntries[i + 1];
                    }
                    break;
                }
            }
            if (beforeEntry == null) {
                //didn't find an ACE that matched the 'after' principal
                throw new IllegalArgumentException("No ACE was found for the specified principal: " + afterPrincipalName);
            }
        } else {
            try {
                int index = Integer.parseInt(order);
                if (index > accessControlEntries.length) {
                    //invalid index
                    throw new IndexOutOfBoundsException("Index value is too large: " + index);
                }
                if (index == 0) {
                    beforeEntry = accessControlEntries[0];
                } else {
                    //the index value is the index of the principal.  A principal may have more
                    // than one ACEs (deny + grant), so we need to compensate.
                    Set<Principal> processedPrincipals = new HashSet<Principal>();
                    for (int i = 0; i < accessControlEntries.length; i++) {
                        Principal principal2 = accessControlEntries[i].getPrincipal();
                        if (processedPrincipals.size() == index && !processedPrincipals.contains(principal2)) {
                            //we are now at the correct position in the list
                            beforeEntry = accessControlEntries[i];
                            break;
                        }
                        processedPrincipals.add(principal2);
                    }
                }
            } catch (NumberFormatException nfe) {
                //not a number.
                throw new IllegalArgumentException("Illegal value for the order parameter: " + order);
            }
        }
        // position.
        for (int i = accessControlEntries.length - 1; i >= 0; i--) {
            AccessControlEntry ace = accessControlEntries[i];
            if (principal.equals(ace.getPrincipal())) {
                //this ACE is for the specified principal.
                jacl.orderBefore(ace, beforeEntry);
            }
        }
    } else {
        throw new IllegalArgumentException("The acl must be an instance of JackrabbitAccessControlList");
    }
}

Example 93 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class AccessControlImporter method addACE.

private void addACE(NodeInfo childInfo, List<PropInfo> propInfos) throws RepositoryException, UnsupportedRepositoryOperationException {
    // node type may only be rep:GrantACE or rep:DenyACE
    Name ntName = childInfo.getNodeTypeName();
    if (!ACE_NODETYPES.contains(ntName)) {
        throw new ConstraintViolationException("Cannot handle childInfo " + childInfo + "; expected a valid, applicable rep:ACE node definition.");
    }
    checkIdMixins(childInfo);
    boolean isAllow = AccessControlConstants.NT_REP_GRANT_ACE.equals(ntName);
    Principal principal = null;
    Privilege[] privileges = null;
    Map<String, TextValue> restrictions = new HashMap<String, TextValue>();
    for (PropInfo pInfo : propInfos) {
        Name name = pInfo.getName();
        if (AccessControlConstants.P_PRINCIPAL_NAME.equals(name)) {
            Value[] values = pInfo.getValues(PropertyType.STRING, resolver);
            if (values == null || values.length != 1) {
                throw new ConstraintViolationException("");
            }
            String pName = values[0].getString();
            principal = session.getPrincipalManager().getPrincipal(pName);
            if (principal == null) {
                if (importBehavior == ImportBehavior.BEST_EFFORT) {
                    // create "fake" principal that is always accepted in ACLTemplate.checkValidEntry()
                    principal = new UnknownPrincipal(pName);
                } else {
                    // create "fake" principal. this is checked again in ACLTemplate.checkValidEntry()
                    principal = new PrincipalImpl(pName);
                }
            }
        } else if (AccessControlConstants.P_PRIVILEGES.equals(name)) {
            Value[] values = pInfo.getValues(PropertyType.NAME, resolver);
            privileges = new Privilege[values.length];
            for (int i = 0; i < values.length; i++) {
                privileges[i] = acMgr.privilegeFromName(values[i].getString());
            }
        } else {
            TextValue[] txtVls = pInfo.getTextValues();
            for (TextValue txtV : txtVls) {
                restrictions.put(resolver.getJCRName(name), txtV);
            }
        }
    }
    if (principalbased) {
        // try to access policies
        List<AccessControlPolicy> policies = new ArrayList<AccessControlPolicy>();
        if (acMgr instanceof JackrabbitAccessControlManager) {
            JackrabbitAccessControlManager jacMgr = (JackrabbitAccessControlManager) acMgr;
            policies.addAll(Arrays.asList(jacMgr.getPolicies(principal)));
            policies.addAll(Arrays.asList(jacMgr.getApplicablePolicies(principal)));
        }
        for (AccessControlPolicy policy : policies) {
            if (policy instanceof JackrabbitAccessControlList) {
                JackrabbitAccessControlList acl = (JackrabbitAccessControlList) policy;
                Map<String, Value> restr = new HashMap<String, Value>();
                for (String restName : acl.getRestrictionNames()) {
                    TextValue txtVal = restrictions.remove(restName);
                    if (txtVal != null) {
                        restr.put(restName, txtVal.getValue(acl.getRestrictionType(restName), resolver));
                    }
                }
                if (!restrictions.isEmpty()) {
                    throw new ConstraintViolationException("ACE childInfo contained restrictions that could not be applied.");
                }
                acl.addEntry(principal, privileges, isAllow, restr);
                acMgr.setPolicy(acl.getPath(), acl);
                return;
            }
        }
    } else {
        Map<String, Value> restr = new HashMap<String, Value>();
        for (String restName : acl.getRestrictionNames()) {
            TextValue txtVal = restrictions.remove(restName);
            if (txtVal != null) {
                restr.put(restName, txtVal.getValue(acl.getRestrictionType(restName), resolver));
            }
        }
        if (!restrictions.isEmpty()) {
            throw new ConstraintViolationException("ACE childInfo contained restrictions that could not be applied.");
        }
        acl.addEntry(principal, privileges, isAllow, restr);
        return;
    }
    // could not apply the ACE. No suitable ACL found.
    throw new ConstraintViolationException("Cannot handle childInfo " + childInfo + "; No policy found to apply the ACE.");
}

Example 94 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class AcReadWriteTest method testRetrievePrivilegesOnAcNodes.

public void testRetrievePrivilegesOnAcNodes() throws NotExecutableException, RepositoryException {
    /* precondition:
          testuser must have READ-only permission on test-node and below
        */
    checkReadOnly(path);
    // give 'testUser' jcr:readAccessControl privileges at 'path'
    Privilege[] privileges = privilegesFromNames(new String[] { Privilege.JCR_READ_ACCESS_CONTROL });
    JackrabbitAccessControlList tmpl = givePrivileges(path, privileges, getRestrictions(superuser, path));
    /*
         testuser must be allowed to read ac-content at target node.
        */
    Session testSession = getTestSession();
    AccessControlManager testAcMgr = getTestACManager();
    assertTrue(testAcMgr.hasPrivileges(path, privileges));
    AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
    assertEquals(1, policies.length);
    assertTrue(policies[0] instanceof JackrabbitAccessControlList);
    String aclNodePath = null;
    Node n = superuser.getNode(path);
    for (NodeIterator itr = n.getNodes(); itr.hasNext(); ) {
        Node child = itr.nextNode();
        if (child.isNodeType("rep:Policy")) {
            aclNodePath = child.getPath();
        }
    }
    if (aclNodePath == null) {
        fail("Expected node at " + path + " to have an ACL child node.");
    }
    assertTrue(testAcMgr.hasPrivileges(aclNodePath, privileges));
    assertTrue(testSession.hasPermission(aclNodePath, Session.ACTION_READ));
    for (NodeIterator aceNodes = superuser.getNode(aclNodePath).getNodes(); aceNodes.hasNext(); ) {
        String aceNodePath = aceNodes.nextNode().getPath();
        assertTrue(testAcMgr.hasPrivileges(aceNodePath, privileges));
        assertTrue(testSession.hasPermission(aceNodePath, Session.ACTION_READ));
    }
}

Example 95 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class EntryCollectorTest method testCache.

public void testCache() throws Exception {
    // --- test1 : add an ACE at path --------------------------------------
    modifyPrivileges(path, testGroup.getPrincipal(), privilegesFromName(Privilege.JCR_READ), true);
    AccessControlPolicy[] plcs = acMgr.getEffectivePolicies(path);
    AccessControlPolicy[] plcs2 = acMgr.getEffectivePolicies(childNPath);
    // effective policies must be the equal on path and childPath
    assertTrue(Arrays.equals(plcs, plcs2));
    // the policy at 'path' must contain a single ACE
    verifyACEs(plcs2, path, 1);
    // --- test2: modify the policy at 'path' ------------------------------
    modifyPrivileges(path, testGroup.getPrincipal(), privilegesFromName(Privilege.JCR_WRITE), false);
    plcs = acMgr.getEffectivePolicies(path);
    plcs2 = acMgr.getEffectivePolicies(childNPath);
    // effective policies must be the equal on path and childNPath
    assertTrue(Arrays.equals(plcs, plcs2));
    verifyACEs(plcs2, path, 2);
    // --- test3: add an policy at childNPath ------------------------------
    modifyPrivileges(childNPath, testGroup.getPrincipal(), privilegesFromName(Privilege.JCR_ADD_CHILD_NODES), true);
    plcs = acMgr.getEffectivePolicies(path);
    plcs2 = acMgr.getEffectivePolicies(childNPath);
    assertFalse(Arrays.equals(plcs, plcs2));
    verifyACEs(plcs2, path, 2);
    verifyACEs(plcs2, childNPath, 1);
    // --- test4: modify policy at childNPath ------------------------------
    modifyPrivileges(childNPath, testGroup.getPrincipal(), privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES), true);
    plcs = acMgr.getEffectivePolicies(path);
    plcs2 = acMgr.getEffectivePolicies(childNPath);
    assertFalse(Arrays.equals(plcs, plcs2));
    verifyACEs(plcs2, path, 2);
    // still a single ACE at childNPath. but privileges must be adjusted
    verifyACEs(plcs2, childNPath, 1);
    AccessControlList acl = null;
    for (AccessControlPolicy p : plcs2) {
        if (p instanceof JackrabbitAccessControlList && childNPath.equals(((JackrabbitAccessControlList) p).getPath())) {
            acl = (AccessControlList) p;
        }
    }
    Privilege[] privs = privilegesFromNames(new String[] { Privilege.JCR_ADD_CHILD_NODES, Privilege.JCR_REMOVE_CHILD_NODES });
    assertEquals(privs, acl.getAccessControlEntries()[0].getPrivileges());
    // --- test4: remove policy at childNPath ------------------------------
    acMgr.removePolicy(childNPath, acMgr.getPolicies(childNPath)[0]);
    superuser.save();
    plcs = acMgr.getEffectivePolicies(path);
    AccessControlPolicy[] plcs3 = acMgr.getEffectivePolicies(childNPath);
    assertTrue(Arrays.equals(plcs, plcs3));
    assertFalse(Arrays.equals(plcs2, plcs3));
    for (AccessControlPolicy p : plcs3) {
        if (p instanceof JackrabbitAccessControlList) {
            if (childNPath.equals(((JackrabbitAccessControlList) p).getPath())) {
                fail("Policy at path has been removed.");
            }
        }
    }
    verifyACEs(plcs, path, 2);
}