Examples with AuthorizationService org.camunda.bpm.engine.AuthorizationService used on opensource projects

Example 6 with AuthorizationService

use of org.camunda.bpm.engine.AuthorizationService in project camunda-bpm-platform by camunda.

the class AuthorizationRestServiceImpl method isUserAuthorized.

public AuthorizationCheckResultDto isUserAuthorized(String permissionName, String resourceName, Integer resourceType, String resourceId) {
    // validate request:
    if (permissionName == null) {
        throw new InvalidRequestException(Status.BAD_REQUEST, "Query parameter 'permissionName' cannot be null");
    } else if (resourceName == null) {
        throw new InvalidRequestException(Status.BAD_REQUEST, "Query parameter 'resourceName' cannot be null");
    } else if (resourceType == null) {
        throw new InvalidRequestException(Status.BAD_REQUEST, "Query parameter 'resourceType' cannot be null");
    }
    final Authentication currentAuthentication = processEngine.getIdentityService().getCurrentAuthentication();
    if (currentAuthentication == null) {
        throw new InvalidRequestException(Status.UNAUTHORIZED, "You must be authenticated in order to use this resource.");
    }
    final AuthorizationService authorizationService = processEngine.getAuthorizationService();
    // create new authorization dto implementing both Permission and Resource
    AuthorizationUtil authorizationUtil = new AuthorizationUtil(resourceName, resourceType, permissionName);
    boolean isUserAuthorized = false;
    if (resourceId == null || Authorization.ANY.equals(resourceId)) {
        isUserAuthorized = authorizationService.isUserAuthorized(currentAuthentication.getUserId(), currentAuthentication.getGroupIds(), authorizationUtil, authorizationUtil);
    } else {
        isUserAuthorized = authorizationService.isUserAuthorized(currentAuthentication.getUserId(), currentAuthentication.getGroupIds(), authorizationUtil, authorizationUtil, resourceId);
    }
    return new AuthorizationCheckResultDto(isUserAuthorized, authorizationUtil, resourceId);
}

Example 7 with AuthorizationService

use of org.camunda.bpm.engine.AuthorizationService in project camunda-bpm-platform by camunda.

the class RuntimeAuthorizationQueryPerformanceTest method createAuthorizations.

@Before
public void createAuthorizations() {
    AuthorizationService authorizationService = engine.getAuthorizationService();
    List<Authorization> auths = authorizationService.createAuthorizationQuery().list();
    for (Authorization authorization : auths) {
        authorizationService.deleteAuthorization(authorization.getId());
    }
    userGrant("test", resource, permissions);
    for (int i = 0; i < 5; i++) {
        grouptGrant("g" + i, resource, permissions);
    }
    engine.getProcessEngineConfiguration().setAuthorizationEnabled(true);
}

Example 8 with AuthorizationService

use of org.camunda.bpm.engine.AuthorizationService in project camunda-bpm-platform by camunda.

the class AdministratorAuthorizationPlugin method postProcessEngineBuild.

public void postProcessEngineBuild(ProcessEngine processEngine) {
    if (!authorizationEnabled) {
        return;
    }
    final AuthorizationService authorizationService = processEngine.getAuthorizationService();
    if (administratorGroupName != null && administratorGroupName.length() > 0) {
        // create ADMIN authorizations on all built-in resources for configured group
        for (Resource resource : Resources.values()) {
            if (authorizationService.createAuthorizationQuery().groupIdIn(administratorGroupName).resourceType(resource).resourceId(ANY).count() == 0) {
                AuthorizationEntity adminGroupAuth = new AuthorizationEntity(AUTH_TYPE_GRANT);
                adminGroupAuth.setGroupId(administratorGroupName);
                adminGroupAuth.setResource(resource);
                adminGroupAuth.setResourceId(ANY);
                adminGroupAuth.addPermission(ALL);
                authorizationService.saveAuthorization(adminGroupAuth);
                LOG.grantGroupPermissions(administratorGroupName, resource.resourceName());
            }
        }
    }
    if (administratorUserName != null && administratorUserName.length() > 0) {
        // create ADMIN authorizations on all built-in resources for configured user
        for (Resource resource : Resources.values()) {
            if (authorizationService.createAuthorizationQuery().userIdIn(administratorUserName).resourceType(resource).resourceId(ANY).count() == 0) {
                AuthorizationEntity adminUserAuth = new AuthorizationEntity(AUTH_TYPE_GRANT);
                adminUserAuth.setUserId(administratorUserName);
                adminUserAuth.setResource(resource);
                adminUserAuth.setResourceId(ANY);
                adminUserAuth.addPermission(ALL);
                authorizationService.saveAuthorization(adminUserAuth);
                LOG.grantUserPermissions(administratorUserName, resource.resourceName());
            }
        }
    }
}

Example 9 with AuthorizationService

use of org.camunda.bpm.engine.AuthorizationService in project camunda-bpm-platform by camunda.

the class AuthorizationScenario method startProcessInstance.

@DescribesScenario("startProcessInstance")
@Times(1)
public static ScenarioSetup startProcessInstance() {
    return new ScenarioSetup() {

        public void execute(ProcessEngine engine, String scenarioName) {
            IdentityService identityService = engine.getIdentityService();
            String userId = USER_ID + scenarioName;
            String groupid = GROUP_ID + scenarioName;
            // create an user
            User user = identityService.newUser(userId);
            identityService.saveUser(user);
            // create group
            Group group = identityService.newGroup(groupid);
            identityService.saveGroup(group);
            // create membership
            identityService.createMembership(userId, groupid);
            // create full authorization
            AuthorizationService authorizationService = engine.getAuthorizationService();
            // authorization for process definition
            Authorization authProcDef = createAuthorization(authorizationService, Permissions.ALL, Resources.PROCESS_DEFINITION, userId);
            engine.getAuthorizationService().saveAuthorization(authProcDef);
            // authorization for deployment
            Authorization authDeployment = createAuthorization(authorizationService, Permissions.ALL, Resources.DEPLOYMENT, userId);
            engine.getAuthorizationService().saveAuthorization(authDeployment);
            // authorization for process instance create
            Authorization authProcessInstance = createAuthorization(authorizationService, Permissions.CREATE, Resources.PROCESS_INSTANCE, userId);
            engine.getAuthorizationService().saveAuthorization(authProcessInstance);
            // start a process instance
            engine.getRuntimeService().startProcessInstanceByKey(PROCESS_DEF_KEY, scenarioName);
        }
    };
}

Example 10 with AuthorizationService

use of org.camunda.bpm.engine.AuthorizationService in project camunda-bpm-platform by camunda.

the class PurgeDatabaseTest method createAuthenticationData.

private void createAuthenticationData() {
    IdentityService identityService = engineRule.getIdentityService();
    Group group = identityService.newGroup("group");
    identityService.saveGroup(group);
    User user = identityService.newUser("user");
    User user2 = identityService.newUser("user2");
    identityService.saveUser(user);
    identityService.saveUser(user2);
    Tenant tenant = identityService.newTenant("tenant");
    identityService.saveTenant(tenant);
    Tenant tenant2 = identityService.newTenant("tenant2");
    identityService.saveTenant(tenant2);
    identityService.createMembership("user", "group");
    identityService.createTenantUserMembership("tenant", "user");
    identityService.createTenantUserMembership("tenant2", "user2");
    TestResource resource1 = new TestResource("resource1", 100);
    // create global authorization which grants all permissions to all users (on resource1):
    AuthorizationService authorizationService = engineRule.getAuthorizationService();
    Authorization globalAuth = authorizationService.createNewAuthorization(AUTH_TYPE_GLOBAL);
    globalAuth.setResource(resource1);
    globalAuth.setResourceId(ANY);
    globalAuth.addPermission(ALL);
    authorizationService.saveAuthorization(globalAuth);
    // grant user read auth on resource2
    TestResource resource2 = new TestResource("resource2", 200);
    Authorization userGrant = authorizationService.createNewAuthorization(AUTH_TYPE_GRANT);
    userGrant.setUserId("user");
    userGrant.setResource(resource2);
    userGrant.setResourceId(ANY);
    userGrant.addPermission(READ);
    authorizationService.saveAuthorization(userGrant);
    identityService.setAuthenticatedUserId("user");
}