Examples with JackrabbitAccessControlList org.apache.jackrabbit.api.security.JackrabbitAccessControlList used on opensource projects

Example 31 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class WriteTest method testReorderGroupPermissions.

public void testReorderGroupPermissions() throws NotExecutableException, RepositoryException {
    Group testGroup = getTestGroup();
    /* create a second group the test user is member of */
    Principal principal = new TestPrincipal("testGroup" + UUID.randomUUID());
    UserManager umgr = getUserManager(superuser);
    Group group2 = umgr.createGroup(principal);
    try {
        group2.addMember(testUser);
        if (!umgr.isAutoSave() && superuser.hasPendingChanges()) {
            superuser.save();
        }
        /* add privileges for the Group the test-user is member of */
        Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);
        withdrawPrivileges(path, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));
        givePrivileges(path, group2.getPrincipal(), privileges, getRestrictions(superuser, path));
        /*
             testuser must get the permissions/privileges inherited from
             the group it is member of.
             granting permissions for group2 must be effective
            */
        String actions = javax.jcr.Session.ACTION_SET_PROPERTY + "," + javax.jcr.Session.ACTION_READ;
        AccessControlManager testAcMgr = getTestACManager();
        assertTrue(getTestSession().hasPermission(path, actions));
        Privilege[] privs = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);
        assertTrue(testAcMgr.hasPrivileges(path, privs));
        // reorder the ACEs
        AccessControlEntry srcEntry = null;
        AccessControlEntry destEntry = null;
        JackrabbitAccessControlList acl = (JackrabbitAccessControlList) acMgr.getPolicies(path)[0];
        for (AccessControlEntry entry : acl.getAccessControlEntries()) {
            Principal princ = entry.getPrincipal();
            if (testGroup.getPrincipal().equals(princ)) {
                destEntry = entry;
            } else if (group2.getPrincipal().equals(princ)) {
                srcEntry = entry;
            }
        }
        acl.orderBefore(srcEntry, destEntry);
        acMgr.setPolicy(path, acl);
        superuser.save();
        /* after reordering the permissions must be denied */
        assertFalse(getTestSession().hasPermission(path, actions));
        assertFalse(testAcMgr.hasPrivileges(path, privs));
    } finally {
        group2.remove();
    }
}

Example 32 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class WriteTest method givePrivileges.

private JackrabbitAccessControlList givePrivileges(String nPath, Principal principal, Privilege[] privileges, Map<String, Value> restrictions, boolean nodeBased) throws NotExecutableException, RepositoryException {
    if (nodeBased) {
        return givePrivileges(nPath, principal, privileges, getRestrictions(superuser, nPath));
    } else {
        JackrabbitAccessControlList tmpl = getPrincipalBasedPolicy(acMgr, nPath, principal);
        tmpl.addEntry(principal, privileges, true, restrictions);
        acMgr.setPolicy(tmpl.getPath(), tmpl);
        superuser.save();
        return tmpl;
    }
}

Example 33 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class WriteTest method withdrawPrivileges.

private JackrabbitAccessControlList withdrawPrivileges(String nPath, Principal principal, Privilege[] privileges, Map<String, Value> restrictions, boolean nodeBased) throws NotExecutableException, RepositoryException {
    if (nodeBased) {
        return withdrawPrivileges(nPath, principal, privileges, getRestrictions(superuser, nPath));
    } else {
        JackrabbitAccessControlList tmpl = getPrincipalBasedPolicy(acMgr, nPath, principal);
        tmpl.addEntry(principal, privileges, false, restrictions);
        acMgr.setPolicy(tmpl.getPath(), tmpl);
        superuser.save();
        return tmpl;
    }
}

Example 34 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class ACLTemplateTest method testGetRestrictionTypes.

public void testGetRestrictionTypes() throws RepositoryException {
    JackrabbitAccessControlList acl = createEmptyTemplate(getTestPath());
    NameResolver resolver = (NameResolver) superuser;
    assertEquals(PropertyType.PATH, acl.getRestrictionType(resolver.getJCRName(ACLTemplate.P_NODE_PATH)));
    assertEquals(PropertyType.STRING, acl.getRestrictionType(resolver.getJCRName(ACLTemplate.P_GLOB)));
}

Example 35 with JackrabbitAccessControlList

use of org.apache.jackrabbit.api.security.JackrabbitAccessControlList in project jackrabbit by apache.

the class EffectivePolicyTest method testGetEffectivePoliciesByPrincipal.

public void testGetEffectivePoliciesByPrincipal() throws Exception {
    Privilege[] privileges = privilegesFromNames(new String[] { Privilege.JCR_READ_ACCESS_CONTROL });
    JackrabbitAccessControlManager jacMgr = (JackrabbitAccessControlManager) acMgr;
    Principal everyone = ((SessionImpl) superuser).getPrincipalManager().getEveryone();
    AccessControlPolicy[] acp = jacMgr.getEffectivePolicies(Collections.singleton(everyone));
    assertNotNull(acp);
    assertEquals(1, acp.length);
    assertTrue(acp[0] instanceof JackrabbitAccessControlPolicy);
    JackrabbitAccessControlPolicy jacp = (JackrabbitAccessControlPolicy) acp[0];
    assertFalse(jacMgr.hasPrivileges(jacp.getPath(), Collections.singleton(testUser.getPrincipal()), privileges));
    assertFalse(jacMgr.hasPrivileges(jacp.getPath(), Collections.singleton(everyone), privileges));
    acp = jacMgr.getApplicablePolicies(testUser.getPrincipal());
    if (acp.length == 0) {
        acp = jacMgr.getPolicies(testUser.getPrincipal());
    }
    assertNotNull(acp);
    assertEquals(1, acp.length);
    assertTrue(acp[0] instanceof JackrabbitAccessControlList);
    // let testuser read the ACL defined for 'testUser' principal.
    JackrabbitAccessControlList acl = (JackrabbitAccessControlList) acp[0];
    acl.addEntry(testUser.getPrincipal(), privileges, true, getRestrictions(superuser, acl.getPath()));
    jacMgr.setPolicy(acl.getPath(), acl);
    superuser.save();
    Session testSession = getTestSession();
    AccessControlManager testAcMgr = getTestACManager();
    // effective policies for testPrinicpal only on path -> must succeed.
    ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(Collections.singleton(testUser.getPrincipal()));
    // effective policies for a combination of principals -> must fail
    try {
        ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(((SessionImpl) testSession).getSubject().getPrincipals());
        fail();
    } catch (AccessDeniedException e) {
    // success
    }
}