Examples with Result org.apache.qpid.server.security.Result used on opensource projects

Example 6 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapterTest method testAuthoriseInvokeBrokerDescendantMethod.

public void testAuthoriseInvokeBrokerDescendantMethod() {
    String methodName = "getStatistics";
    VirtualHostNode<?> virtualHostNode = _virtualHostNode;
    ObjectProperties properties = new ObjectProperties();
    properties.put(ObjectProperties.Property.NAME, virtualHostNode.getName());
    properties.put(ObjectProperties.Property.METHOD_NAME, methodName);
    properties.put(ObjectProperties.Property.COMPONENT, "Broker.VirtualHostNode");
    when(_accessControl.authorise(same(LegacyOperation.INVOKE), same(ObjectType.VIRTUALHOSTNODE), any(ObjectProperties.class))).thenReturn(Result.ALLOWED);
    Result result = _adapter.authoriseMethod(virtualHostNode, methodName, Collections.emptyMap());
    assertEquals("Unexpected authorise result", Result.ALLOWED, result);
    verify(_accessControl).authorise(eq(LegacyOperation.INVOKE), eq(ObjectType.VIRTUALHOSTNODE), eq(properties));
}

Example 7 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapterTest method testAuthorisePurge.

public void testAuthorisePurge() {
    Queue queue = mock(Queue.class);
    when(queue.getParent()).thenReturn(_virtualHost);
    when(queue.getModel()).thenReturn(_model);
    when(queue.getAttribute(Queue.NAME)).thenReturn(TEST_QUEUE);
    when(queue.getCategoryClass()).thenReturn(Queue.class);
    when(queue.getAttribute(Queue.DURABLE)).thenReturn(false);
    when(queue.getAttribute(Queue.EXCLUSIVE)).thenReturn(ExclusivityPolicy.NONE);
    when(queue.getAttribute(Queue.LIFETIME_POLICY)).thenReturn(LifetimePolicy.DELETE_ON_CONNECTION_CLOSE);
    ObjectProperties properties = createExpectedQueueObjectProperties();
    when(_accessControl.authorise(same(LegacyOperation.INVOKE), any(ObjectType.class), any(ObjectProperties.class))).thenReturn(Result.DENIED);
    when(_accessControl.authorise(same(LegacyOperation.PURGE), same(ObjectType.QUEUE), any(ObjectProperties.class))).thenReturn(Result.ALLOWED);
    Result result = _adapter.authoriseMethod(queue, "clearQueue", Collections.emptyMap());
    assertEquals("Unexpected authorise result", Result.ALLOWED, result);
    verify(_accessControl).authorise(eq(LegacyOperation.PURGE), eq(ObjectType.QUEUE), eq(properties));
}

Example 8 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class AbstractVirtualHost method onRestart.

@StateTransition(currentState = { State.STOPPED }, desiredState = State.ACTIVE)
private ListenableFuture<Void> onRestart() {
    createHousekeepingExecutor();
    final VirtualHostStoreUpgraderAndRecoverer virtualHostStoreUpgraderAndRecoverer = new VirtualHostStoreUpgraderAndRecoverer((VirtualHostNode<?>) getParent());
    virtualHostStoreUpgraderAndRecoverer.reloadAndRecoverVirtualHost(getDurableConfigurationStore());
    final Collection<VirtualHostAccessControlProvider> accessControlProviders = getChildren(VirtualHostAccessControlProvider.class);
    if (!accessControlProviders.isEmpty()) {
        accessControlProviders.forEach(child -> child.addChangeListener(_accessControlProviderListener));
    }
    final List<ListenableFuture<Void>> childOpenFutures = new ArrayList<>();
    Subject.doAs(getSubjectWithAddedSystemRights(), (PrivilegedAction<Object>) () -> {
        applyToChildren(child -> {
            final ListenableFuture<Void> childOpenFuture = child.openAsync();
            childOpenFutures.add(childOpenFuture);
            addFutureCallback(childOpenFuture, new FutureCallback<Void>() {

                @Override
                public void onSuccess(final Void result) {
                }

                @Override
                public void onFailure(final Throwable t) {
                    LOGGER.error("Exception occurred while opening {} : {}", child.getClass().getSimpleName(), child.getName(), t);
                }
            }, getTaskExecutor());
        });
        return null;
    });
    ListenableFuture<List<Void>> combinedFuture = Futures.allAsList(childOpenFutures);
    return Futures.transformAsync(combinedFuture, input -> onActivate(), MoreExecutors.directExecutor());
}

Example 9 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapter method authoriseMethod.

Result authoriseMethod(final PermissionedObject configuredObject, final String methodName, final Map<String, Object> arguments) {
    Class<? extends ConfiguredObject> categoryClass = configuredObject.getCategoryClass();
    Result invokeResult = _accessControl.authorise(INVOKE, getACLObjectTypeManagingConfiguredObjectOfCategory(categoryClass), createObjectPropertiesForMethod(configuredObject, methodName));
    if (invokeResult == Result.ALLOWED) {
        return invokeResult;
    }
    // Otherwise fallback to the older rule-style
    if (categoryClass == Queue.class) {
        Queue queue = (Queue) configuredObject;
        final ObjectProperties properties = new ObjectProperties();
        if ("clearQueue".equals(methodName)) {
            setQueueProperties(queue, properties);
            return _accessControl.authorise(PURGE, QUEUE, properties);
        } else if (QUEUE_UPDATE_METHODS.contains(methodName)) {
            VirtualHost virtualHost = queue.getVirtualHost();
            final String virtualHostName = virtualHost.getName();
            properties.setName(methodName);
            properties.put(ObjectProperties.Property.COMPONENT, buildHierarchicalCategoryName(queue, virtualHost));
            properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, virtualHostName);
            return _accessControl.authorise(LegacyOperation.UPDATE, METHOD, properties);
        }
    } else if ((categoryClass == BrokerLogger.class || categoryClass == VirtualHostLogger.class) && LOG_ACCESS_METHOD_NAMES.contains(methodName)) {
        ObjectProperties empty = categoryClass == BrokerLogger.class ? ObjectProperties.EMPTY : new ObjectProperties(((ConfiguredObject) configuredObject).getParent().getName());
        return _accessControl.authorise(ACCESS_LOGS, categoryClass == BrokerLogger.class ? ObjectType.BROKER : ObjectType.VIRTUALHOST, empty);
    } else if (categoryClass == Broker.class && "initiateShutdown".equals(methodName)) {
        _accessControl.authorise(LegacyOperation.SHUTDOWN, ObjectType.BROKER, ObjectProperties.EMPTY);
    } else if (categoryClass == Exchange.class) {
        if ("bind".equals(methodName)) {
            final ObjectProperties properties = createObjectPropertiesForExchangeBind(arguments, configuredObject);
            return _accessControl.authorise(BIND, EXCHANGE, properties);
        } else if ("unbind".equals(methodName)) {
            final ObjectProperties properties = createObjectPropertiesForExchangeBind(arguments, configuredObject);
            return _accessControl.authorise(UNBIND, EXCHANGE, properties);
        }
    }
    return invokeResult;
}

Example 10 with Result

use of org.apache.qpid.server.security.Result in project qpid-broker-j by apache.

the class LegacyAccessControlAdapterTest method testAuthoriseLogsAccessOnBroker.

public void testAuthoriseLogsAccessOnBroker() {
    when(_accessControl.authorise(same(LegacyOperation.INVOKE), same(ObjectType.BROKER), any(ObjectProperties.class))).thenReturn(Result.DENIED);
    when(_accessControl.authorise(same(LegacyOperation.ACCESS_LOGS), same(ObjectType.BROKER), any(ObjectProperties.class))).thenReturn(Result.ALLOWED);
    ConfiguredObject logger = mock(BrokerLogger.class);
    when(logger.getCategoryClass()).thenReturn(BrokerLogger.class);
    when(logger.getModel()).thenReturn(_model);
    when(logger.getParent()).thenReturn(_broker);
    Result result = _adapter.authoriseMethod(logger, "getFile", Collections.singletonMap("fileName", "qpid.log"));
    assertEquals("Unexpected authorise result", Result.ALLOWED, result);
    verify(_accessControl).authorise(ACCESS_LOGS, BROKER, ObjectProperties.EMPTY);
}