Examples with Result org.apache.qpid.server.security.Result used on opensource projects

Example 1 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class AbstractConfiguredObject method authorise.

private void authorise(final ConfiguredObject<?> configuredObject, SecurityToken token, final Operation operation, Map<String, Object> arguments) {
    AccessControl accessControl = getAccessControl();
    if (accessControl != null) {
        Result result = accessControl.authorise(token, operation, configuredObject, arguments);
        LOGGER.debug("authorise returned {}", result);
        if (result == Result.DEFER) {
            result = accessControl.getDefault();
            LOGGER.debug("authorise returned DEFER, returing default: {}", result);
        }
        if (result == Result.DENIED) {
            Class<? extends ConfiguredObject> categoryClass = configuredObject.getCategoryClass();
            String objectName = (String) configuredObject.getAttribute(ConfiguredObject.NAME);
            String operationName = operation.getName().equals(operation.getType().name()) ? operation.getName() : (operation.getType().name() + "(" + operation.getName() + ")");
            StringBuilder exceptionMessage = new StringBuilder(String.format("Permission %s is denied for : %s '%s'", operationName, categoryClass.getSimpleName(), objectName));
            Model model = configuredObject.getModel();
            Class<? extends ConfiguredObject> parentClass = model.getParentType(categoryClass);
            if (parentClass != null) {
                exceptionMessage.append(" on");
                String objectCategory = parentClass.getSimpleName();
                ConfiguredObject<?> parent = configuredObject.getParent();
                exceptionMessage.append(" ").append(objectCategory);
                if (parent != null) {
                    exceptionMessage.append(" '").append(parent.getAttribute(ConfiguredObject.NAME)).append("'");
                }
            }
            throw new AccessControlException(exceptionMessage.toString());
        }
    }
}

Example 2 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class CachingSecurityToken method authorise.

Result authorise(final RuleBasedAccessControl ruleBasedAccessControl, final Operation operation, final PermissionedObject configuredObject, final Map<String, Object> arguments) {
    AccessControlCache cache;
    while ((cache = CACHE_UPDATE.get(this)).getAccessControl() != ruleBasedAccessControl) {
        CACHE_UPDATE.compareAndSet(this, cache, new AccessControlCache(ruleBasedAccessControl));
    }
    final CachedMethodAuthKey key = new CachedMethodAuthKey(configuredObject, operation, arguments);
    Result result = cache.getCache().get(key);
    if (result == null) {
        result = ruleBasedAccessControl.authorise(operation, configuredObject, arguments);
        cache.getCache().putIfAbsent(key, result);
    }
    return result;
}

Example 3 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapterTest method testAuthoriseLogsAccessOnVirtualHost.

public void testAuthoriseLogsAccessOnVirtualHost() {
    when(_accessControl.authorise(same(LegacyOperation.INVOKE), same(ObjectType.VIRTUALHOST), any(ObjectProperties.class))).thenReturn(Result.DENIED);
    when(_accessControl.authorise(same(LegacyOperation.ACCESS_LOGS), same(ObjectType.VIRTUALHOST), any(ObjectProperties.class))).thenReturn(Result.ALLOWED);
    ConfiguredObject logger = mock(VirtualHostLogger.class);
    when(logger.getCategoryClass()).thenReturn(VirtualHostLogger.class);
    when(logger.getParent()).thenReturn(_virtualHost);
    when(logger.getModel()).thenReturn(_model);
    Result result = _adapter.authoriseMethod(logger, "getFile", Collections.singletonMap("fileName", "qpid.log"));
    assertEquals("Unexpected authorise result", Result.ALLOWED, result);
    ObjectProperties expectedObjectProperties = new ObjectProperties(_virtualHost.getName());
    verify(_accessControl).authorise(ACCESS_LOGS, VIRTUALHOST, expectedObjectProperties);
}

Example 4 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapterTest method testAuthoriseInvokeVirtualHostDescendantMethod.

public void testAuthoriseInvokeVirtualHostDescendantMethod() {
    String methodName = "clearQueue";
    Queue queue = mock(Queue.class);
    when(queue.getParent()).thenReturn(_virtualHost);
    when(queue.getModel()).thenReturn(_model);
    when(queue.getName()).thenReturn(TEST_QUEUE);
    when(queue.getAttribute(Queue.NAME)).thenReturn(TEST_QUEUE);
    when(queue.getCategoryClass()).thenReturn(Queue.class);
    when(queue.getAttribute(Queue.DURABLE)).thenReturn(false);
    when(queue.getAttribute(Queue.EXCLUSIVE)).thenReturn(ExclusivityPolicy.NONE);
    when(queue.getAttribute(Queue.LIFETIME_POLICY)).thenReturn(LifetimePolicy.DELETE_ON_CONNECTION_CLOSE);
    ObjectProperties properties = new ObjectProperties();
    properties.put(ObjectProperties.Property.NAME, TEST_QUEUE);
    properties.put(ObjectProperties.Property.METHOD_NAME, methodName);
    properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, _virtualHost.getName());
    properties.put(ObjectProperties.Property.COMPONENT, "VirtualHost.Queue");
    when(_accessControl.authorise(same(LegacyOperation.INVOKE), same(ObjectType.QUEUE), any(ObjectProperties.class))).thenReturn(Result.ALLOWED);
    Result result = _adapter.authoriseMethod(queue, methodName, Collections.emptyMap());
    assertEquals("Unexpected authorise result", Result.ALLOWED, result);
    verify(_accessControl).authorise(eq(LegacyOperation.INVOKE), eq(ObjectType.QUEUE), eq(properties));
    verify(_accessControl, never()).authorise(eq(LegacyOperation.PURGE), eq(ObjectType.QUEUE), any(ObjectProperties.class));
}

Example 5 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapterTest method testAuthoriseMethod.

public void testAuthoriseMethod() {
    when(_accessControl.authorise(same(LegacyOperation.INVOKE), any(ObjectType.class), any(ObjectProperties.class))).thenReturn(Result.DENIED);
    when(_accessControl.authorise(same(LegacyOperation.UPDATE), same(ObjectType.METHOD), any(ObjectProperties.class))).thenReturn(Result.ALLOWED);
    ObjectProperties properties = new ObjectProperties("deleteMessages");
    properties.put(ObjectProperties.Property.COMPONENT, "VirtualHost.Queue");
    properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
    Queue queue = mock(Queue.class);
    when(queue.getParent()).thenReturn(_virtualHost);
    when(queue.getVirtualHost()).thenReturn(_virtualHost);
    when(queue.getModel()).thenReturn(_model);
    when(queue.getAttribute(Queue.NAME)).thenReturn(TEST_QUEUE);
    when(queue.getCategoryClass()).thenReturn(Queue.class);
    Result result = _adapter.authoriseMethod(queue, "deleteMessages", Collections.emptyMap());
    assertEquals("Unexpected authorise result", Result.ALLOWED, result);
    verify(_accessControl).authorise(eq(LegacyOperation.UPDATE), eq(ObjectType.METHOD), eq(properties));
}