Examples with PrincipalImpl org.apache.jackrabbit.core.security.principal.PrincipalImpl used on opensource projects

Example 1 with PrincipalImpl

use of org.apache.jackrabbit.core.security.principal.PrincipalImpl in project jackrabbit by apache.

the class WriteTest method testInvalidPrincipal.

public void testInvalidPrincipal() throws Exception {
    PrincipalManager pMgr = ((JackrabbitSession) superuser).getPrincipalManager();
    String unknown = "unknown";
    while (pMgr.hasPrincipal(unknown)) {
        unknown = unknown + "_";
    }
    Principal principal = new PrincipalImpl(unknown);
    if (acMgr instanceof JackrabbitAccessControlManager) {
        // first try applicable policies
        try {
            AccessControlPolicy[] policies = ((JackrabbitAccessControlManager) acMgr).getApplicablePolicies(principal);
            assertNotNull(policies);
            assertEquals(0, policies.length);
        } catch (AccessControlException e) {
        // success
        }
        // second existing policies
        try {
            AccessControlPolicy[] policies = ((JackrabbitAccessControlManager) acMgr).getPolicies(principal);
            assertNotNull(policies);
            assertEquals(0, policies.length);
        } catch (AccessControlException e) {
        // success
        }
    } else {
        throw new NotExecutableException();
    }
}

Example 2 with PrincipalImpl

use of org.apache.jackrabbit.core.security.principal.PrincipalImpl in project jackrabbit by apache.

the class SessionImplTest method testGetSubject.

/**
     * JCR-2895 : SessionImpl#getSubject() should return an unmodifiable subject
     *
     * @see <a href="https://issues.apache.org/jira/browse/JCR-2895">JCR-2895</a>
     */
public void testGetSubject() {
    Subject subject = ((SessionImpl) superuser).getSubject();
    assertFalse(subject.getPublicCredentials().isEmpty());
    assertFalse(subject.getPublicCredentials(Credentials.class).isEmpty());
    assertFalse(subject.getPrincipals().isEmpty());
    assertTrue(subject.isReadOnly());
    try {
        subject.getPublicCredentials().add(new SimpleCredentials("test", new char[0]));
        fail("Subject expected to be readonly");
    } catch (IllegalStateException e) {
    // success
    }
    try {
        subject.getPrincipals().add(new PrincipalImpl("test"));
        fail("Subject expected to be readonly");
    } catch (IllegalStateException e) {
    // success
    }
}

Example 3 with PrincipalImpl

use of org.apache.jackrabbit.core.security.principal.PrincipalImpl in project jackrabbit by apache.

the class AccessControlImporterTest method testImportPrincipalBasedACL.

/**
     * Imports a principal-based ACL containing a single entry mist fail with
     * the default configuration.
     *
     * @throws Exception
     */
public void testImportPrincipalBasedACL() throws Exception {
    JackrabbitAccessControlManager acMgr = (JackrabbitAccessControlManager) sImpl.getAccessControlManager();
    if (acMgr.getApplicablePolicies(EveryonePrincipal.getInstance()).length > 0 || acMgr.getPolicies(EveryonePrincipal.getInstance()).length > 0) {
        // test expects that only resource-based acl is supported
        throw new NotExecutableException();
    }
    PrincipalManager pmgr = sImpl.getPrincipalManager();
    if (!pmgr.hasPrincipal(SecurityConstants.ADMINISTRATORS_NAME)) {
        UserManager umgr = sImpl.getUserManager();
        umgr.createGroup(new PrincipalImpl(SecurityConstants.ADMINISTRATORS_NAME));
        if (!umgr.isAutoSave()) {
            sImpl.save();
        }
        if (pmgr.hasPrincipal(SecurityConstants.ADMINISTRATORS_NAME)) {
            throw new NotExecutableException();
        }
    }
    NodeImpl target;
    NodeImpl root = (NodeImpl) sImpl.getRootNode();
    if (!root.hasNode(AccessControlConstants.N_ACCESSCONTROL)) {
        target = root.addNode(AccessControlConstants.N_ACCESSCONTROL, AccessControlConstants.NT_REP_ACCESS_CONTROL, null);
    } else {
        target = root.getNode(AccessControlConstants.N_ACCESSCONTROL);
        if (!target.isNodeType(AccessControlConstants.NT_REP_ACCESS_CONTROL)) {
            target.setPrimaryType(sImpl.getJCRName(AccessControlConstants.NT_REP_ACCESS_CONTROL));
        }
    }
    try {
        InputStream in = new ByteArrayInputStream(XML_AC_TREE.getBytes("UTF-8"));
        SessionImporter importer = new SessionImporter(target, sImpl, ImportUUIDBehavior.IMPORT_UUID_COLLISION_THROW, new PseudoConfig());
        ImportHandler ih = new ImportHandler(importer, sImpl);
        new ParsingContentHandler(ih).parse(in);
        fail("Default config only allows resource-based ACL -> protected import must fail");
    } catch (SAXException e) {
        if (e.getException() instanceof ConstraintViolationException) {
        // success
        } else {
            throw e;
        }
    } finally {
        superuser.refresh(false);
    }
}

Example 4 with PrincipalImpl

use of org.apache.jackrabbit.core.security.principal.PrincipalImpl in project jackrabbit by apache.

the class UserImporter method handlePropInfo.

// -----------------------------------------< ProtectedPropertyImporter >---
/**
     * @see ProtectedPropertyImporter#handlePropInfo(org.apache.jackrabbit.core.NodeImpl, org.apache.jackrabbit.core.xml.PropInfo, org.apache.jackrabbit.spi.QPropertyDefinition)
     */
public boolean handlePropInfo(NodeImpl parent, PropInfo protectedPropInfo, QPropertyDefinition def) throws RepositoryException {
    if (!initialized) {
        throw new IllegalStateException("Not initialized");
    }
    /* importer can only handle protected properties below user/group
           nodes that are properly stored underneath the configured users/groups
           hierarchies (see {@link UserManagerImpl#getAuthorizable(NodeImpl)}.
           this prevents from importing user/group nodes somewhere in the
           content hierarchy which isn't possible when creating user/groups
           using the corresponding API calls  {@link UserManager#createUser} or
           {@link UserManager#createGroup} respectively. */
    Authorizable a = userManager.getAuthorizable(parent);
    if (a == null) {
        log.warn("Cannot handle protected PropInfo " + protectedPropInfo + ". Node " + parent + " doesn't represent a valid Authorizable.");
        return false;
    }
    // assert that user manager is isn't in auto-save mode
    if (userManager.isAutoSave()) {
        userManager.autoSave(false);
    }
    try {
        Name propName = protectedPropInfo.getName();
        if (UserConstants.P_PRINCIPAL_NAME.equals(propName)) {
            // protected rep:principalName property defined by rep:Authorizable.
            if (def.isMultiple() || !UserConstants.NT_REP_AUTHORIZABLE.equals(def.getDeclaringNodeType())) {
                // some other unexpected property definition -> cannot handle
                log.warn("Unexpected definition for property rep:principalName");
                return false;
            }
            Value v = protectedPropInfo.getValues(PropertyType.STRING, resolver)[0];
            String princName = v.getString();
            userManager.setPrincipal(parent, new PrincipalImpl(princName));
            /*
                Execute authorizable actions for a NEW group as this is the
                same place in the userManager#createGroup that the actions
                are called.
                In case of a NEW user the actions are executed if the password
                has been imported before.
                */
            if (parent.isNew()) {
                if (a.isGroup()) {
                    userManager.onCreate((Group) a);
                } else if (currentPw.containsKey(a.getID())) {
                    userManager.onCreate((User) a, currentPw.remove(a.getID()));
                }
            }
            return true;
        } else if (UserConstants.P_PASSWORD.equals(propName)) {
            if (a.isGroup()) {
                log.warn("Expected parent node of type rep:User.");
                return false;
            }
            // minimal validation of the passed definition
            if (def.isMultiple() || !UserConstants.NT_REP_USER.equals(def.getDeclaringNodeType())) {
                // some other unexpected property definition -> cannot handle
                log.warn("Unexpected definition for property rep:password");
                return false;
            }
            Value v = protectedPropInfo.getValues(PropertyType.STRING, resolver)[0];
            String pw = v.getString();
            userManager.setPassword(parent, pw, false);
            /*
                 Execute authorizable actions for a NEW user at this point after
                 having set the password if the principal name has already been
                 processed, otherwise postpone it.
                 */
            if (parent.isNew()) {
                if (parent.hasProperty(UserConstants.P_PRINCIPAL_NAME)) {
                    userManager.onCreate((User) a, pw);
                } else {
                    // principal name not yet available -> remember the pw
                    currentPw.clear();
                    currentPw.put(a.getID(), pw);
                }
            }
            return true;
        } else if (UserConstants.P_IMPERSONATORS.equals(propName)) {
            if (a.isGroup()) {
                // unexpected parent type -> cannot handle
                log.warn("Expected parent node of type rep:User.");
                return false;
            }
            // minimal validation of the passed definition
            if (!def.isMultiple() || !UserConstants.MIX_REP_IMPERSONATABLE.equals(def.getDeclaringNodeType())) {
                // some other unexpected property definition -> cannot handle
                log.warn("Unexpected definition for property rep:impersonators");
                return false;
            }
            // since impersonators may be imported later on, postpone processing
            // to the end.
            // see -> process References
            Value[] vs = protectedPropInfo.getValues(PropertyType.STRING, resolver);
            referenceTracker.processedReference(new Impersonators(a.getID(), vs));
            return true;
        } else if (UserConstants.P_DISABLED.equals(propName)) {
            if (a.isGroup()) {
                log.warn("Expected parent node of type rep:User.");
                return false;
            }
            // minimal validation of the passed definition
            if (def.isMultiple() || !UserConstants.NT_REP_USER.equals(def.getDeclaringNodeType())) {
                // some other unexpected property definition -> cannot handle
                log.warn("Unexpected definition for property rep:disabled");
                return false;
            }
            Value v = protectedPropInfo.getValues(PropertyType.STRING, resolver)[0];
            ((User) a).disable(v.getString());
            return true;
        } else if (UserConstants.P_MEMBERS.equals(propName)) {
            if (!a.isGroup()) {
                // unexpected parent type -> cannot handle
                log.warn("Expected parent node of type rep:Group.");
                return false;
            }
            // minimal validation of the passed definition
            if (!def.isMultiple() || !UserConstants.NT_REP_GROUP.equals(def.getDeclaringNodeType())) {
                // some other unexpected property definition -> cannot handle
                log.warn("Unexpected definition for property rep:members");
                return false;
            }
            // since group-members are references to user/groups that potentially
            // are to be imported later on -> postpone processing to the end.
            // see -> process References
            Membership membership = new Membership(a.getID());
            for (Value v : protectedPropInfo.getValues(PropertyType.WEAKREFERENCE, resolver)) {
                membership.addMember(new NodeId(v.getString()));
            }
            referenceTracker.processedReference(membership);
            return true;
        }
        return false;
    } finally {
        // the original state.
        if (resetAutoSave) {
            userManager.autoSave(true);
        }
    }
}

Example 5 with PrincipalImpl

use of org.apache.jackrabbit.core.security.principal.PrincipalImpl in project jackrabbit by apache.

the class ACLTemplateTest method testTwoEntriesPerPrincipal.

public void testTwoEntriesPerPrincipal() throws RepositoryException, NotExecutableException {
    JackrabbitAccessControlList pt = createEmptyTemplate(getTestPath());
    Privilege[] readPriv = privilegesFromName(Privilege.JCR_READ);
    Privilege[] writePriv = privilegesFromName(Privilege.JCR_WRITE);
    Privilege[] acReadPriv = privilegesFromName(Privilege.JCR_READ_ACCESS_CONTROL);
    pt.addEntry(testPrincipal, readPriv, true, emptyRestrictions);
    pt.addEntry(testPrincipal, writePriv, true, emptyRestrictions);
    pt.addEntry(testPrincipal, acReadPriv, true, emptyRestrictions);
    pt.addEntry(testPrincipal, readPriv, false, emptyRestrictions);
    pt.addEntry(new PrincipalImpl(testPrincipal.getName()), readPriv, false, emptyRestrictions);
    pt.addEntry(new Principal() {

        public String getName() {
            return testPrincipal.getName();
        }
    }, readPriv, false, emptyRestrictions);
    AccessControlEntry[] entries = pt.getAccessControlEntries();
    assertEquals(2, entries.length);
}