Examples with RequiresPermissions org.apache.shiro.authz.annotation.RequiresPermissions used on opensource projects

Example 36 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class LdapResource method readGroups.

@GET
@ApiOperation(value = "Get the available LDAP groups", notes = "")
@RequiresPermissions(RestPermissions.LDAPGROUPS_READ)
@Path("/groups")
@Produces(MediaType.APPLICATION_JSON)
public Set<String> readGroups() {
    final LdapSettings ldapSettings = firstNonNull(ldapSettingsService.load(), ldapSettingsFactory.createEmpty());
    if (!ldapSettings.isEnabled()) {
        throw new BadRequestException("LDAP is disabled.");
    }
    if (isNullOrEmpty(ldapSettings.getGroupSearchBase()) || isNullOrEmpty(ldapSettings.getGroupIdAttribute())) {
        throw new BadRequestException("LDAP group configuration settings are not set.");
    }
    final LdapConnectionConfig config = new LdapConnectionConfig();
    final URI ldapUri = ldapSettings.getUri();
    config.setLdapHost(ldapUri.getHost());
    config.setLdapPort(ldapUri.getPort());
    config.setUseSsl(ldapUri.getScheme().startsWith("ldaps"));
    config.setUseTls(ldapSettings.isUseStartTls());
    if (ldapSettings.isTrustAllCertificates()) {
        config.setTrustManagers(new TrustAllX509TrustManager());
    }
    if (!isNullOrEmpty(ldapSettings.getSystemUserName()) && !isNullOrEmpty(ldapSettings.getSystemPassword())) {
        config.setName(ldapSettings.getSystemUserName());
        config.setCredentials(ldapSettings.getSystemPassword());
    }
    try (LdapNetworkConnection connection = ldapConnector.connect(config)) {
        return ldapConnector.listGroups(connection, ldapSettings.getGroupSearchBase(), ldapSettings.getGroupSearchPattern(), ldapSettings.getGroupIdAttribute());
    } catch (IOException | LdapException e) {
        LOG.error("Unable to retrieve available LDAP groups", e);
        throw new InternalServerErrorException("Unable to retrieve available LDAP groups", e);
    }
}

Example 37 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class LdapResource method updateLdapSettings.

@PUT
@Timed
@RequiresPermissions(RestPermissions.LDAP_EDIT)
@ApiOperation("Update the LDAP configuration")
@Path("/settings")
@Consumes(MediaType.APPLICATION_JSON)
@AuditEvent(type = AuditEventTypes.LDAP_CONFIGURATION_UPDATE)
public void updateLdapSettings(@ApiParam(name = "JSON body", required = true) @Valid @NotNull LdapSettingsRequest request) throws ValidationException {
    // load the existing config, or create a new one. we only support having one, currently
    final LdapSettings ldapSettings = firstNonNull(ldapSettingsService.load(), ldapSettingsFactory.createEmpty());
    ldapSettings.setSystemUsername(request.systemUsername());
    ldapSettings.setSystemPassword(request.systemPassword());
    ldapSettings.setUri(request.ldapUri());
    ldapSettings.setUseStartTls(request.useStartTls());
    ldapSettings.setTrustAllCertificates(request.trustAllCertificates());
    ldapSettings.setActiveDirectory(request.activeDirectory());
    ldapSettings.setSearchPattern(request.searchPattern());
    ldapSettings.setSearchBase(request.searchBase());
    ldapSettings.setEnabled(request.enabled());
    ldapSettings.setDisplayNameAttribute(request.displayNameAttribute());
    ldapSettings.setDefaultGroup(request.defaultGroup());
    ldapSettings.setGroupMapping(request.groupMapping());
    ldapSettings.setGroupSearchBase(request.groupSearchBase());
    ldapSettings.setGroupIdAttribute(request.groupIdAttribute());
    ldapSettings.setGroupSearchPattern(request.groupSearchPattern());
    ldapSettings.setAdditionalDefaultGroups(request.additionalDefaultGroups());
    ldapSettingsService.save(ldapSettings);
}

Example 38 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class JournalResource method show.

@GET
@Timed
@ApiOperation(value = "Get current state of the journal on this node.")
@RequiresPermissions(RestPermissions.JOURNAL_READ)
public JournalSummaryResponse show() {
    if (!journalEnabled) {
        return JournalSummaryResponse.createDisabled();
    }
    if (journal instanceof KafkaJournal) {
        final KafkaJournal kafkaJournal = (KafkaJournal) journal;
        final ThrottleState throttleState = kafkaJournal.getThrottleState();
        long oldestSegment = Long.MAX_VALUE;
        for (final LogSegment segment : kafkaJournal.getSegments()) {
            oldestSegment = Math.min(oldestSegment, segment.created());
        }
        return JournalSummaryResponse.createEnabled(throttleState.appendEventsPerSec, throttleState.readEventsPerSec, throttleState.uncommittedJournalEntries, Size.bytes(throttleState.journalSize), Size.bytes(throttleState.journalSizeLimit), kafkaJournal.numberOfSegments(), new DateTime(oldestSegment, DateTimeZone.UTC), kafkaJournalConfiguration);
    }
    log.warn("Unknown Journal implementation {} in use, cannot get information about it. Pretending journal is disabled.", journal.getClass());
    return JournalSummaryResponse.createDisabled();
}

Example 39 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class MessagesResource method all.

@GET
@Timed
@ApiOperation(value = "Get internal Graylog system messages")
@RequiresPermissions(RestPermissions.SYSTEMMESSAGES_READ)
@Produces(MediaType.APPLICATION_JSON)
public Map<String, Object> all(@ApiParam(name = "page", value = "Page") @QueryParam("page") int page) {
    final List<Map<String, Object>> messages = Lists.newArrayList();
    for (SystemMessage sm : systemMessageService.all(page(page))) {
        Map<String, Object> message = Maps.newHashMapWithExpectedSize(4);
        message.put("caller", sm.getCaller());
        message.put("content", sm.getContent());
        message.put("timestamp", Tools.getISO8601String(sm.getTimestamp()));
        message.put("node_id", sm.getNodeId());
        messages.add(message);
    }
    return ImmutableMap.of("messages", messages, "total", systemMessageService.totalCount());
}

Example 40 with RequiresPermissions

use of org.apache.shiro.authz.annotation.RequiresPermissions in project graylog2-server by Graylog2.

the class ClusterConfigResource method schema.

@GET
@Path("{configClass}")
@Produces(MoreMediaTypes.APPLICATION_SCHEMA_JSON)
@ApiOperation(value = "Get JSON schema of configuration class")
@Timed
@RequiresPermissions(RestPermissions.CLUSTER_CONFIG_ENTRY_READ)
public JsonSchema schema(@ApiParam(name = "configClass", value = "The name of the cluster configuration class", required = true) @PathParam("configClass") @NotBlank String configClass) {
    final Class<?> cls = classFromName(configClass);
    if (cls == null) {
        throw new NotFoundException("Couldn't find configuration class \"" + configClass + "\"");
    }
    final SchemaFactoryWrapper visitor = new SchemaFactoryWrapper();
    try {
        objectMapper.acceptJsonFormatVisitor(objectMapper.constructType(cls), visitor);
    } catch (JsonMappingException e) {
        throw new InternalServerErrorException("Couldn't generate JSON schema for configuration class " + configClass, e);
    }
    return visitor.finalSchema();
}