Examples with MissingAuthorization org.camunda.bpm.engine.authorization.MissingAuthorization used on opensource projects

Example 11 with MissingAuthorization

use of org.camunda.bpm.engine.authorization.MissingAuthorization in project camunda-bpm-platform by camunda.

the class IdentityServiceAuthorizationsTest method testUserCreateAuthorizations.

public void testUserCreateAuthorizations() {
    // add base permission which allows nobody to create users:
    Authorization basePerms = authorizationService.createNewAuthorization(AUTH_TYPE_GLOBAL);
    basePerms.setResource(USER);
    basePerms.setResourceId(ANY);
    // add all then remove 'create'
    basePerms.addPermission(ALL);
    basePerms.removePermission(CREATE);
    authorizationService.saveAuthorization(basePerms);
    processEngineConfiguration.setAuthorizationEnabled(true);
    identityService.setAuthenticatedUserId(jonny2);
    try {
        identityService.newUser("jonny1");
        fail("exception expected");
    } catch (AuthorizationException e) {
        assertEquals(1, e.getMissingAuthorizations().size());
        MissingAuthorization info = e.getMissingAuthorizations().get(0);
        assertEquals(jonny2, e.getUserId());
        assertExceptionInfo(CREATE.getName(), USER.resourceName(), null, info);
    }
    // circumvent auth check to get new transient userobject
    User newUser = new UserEntity("jonny1");
    try {
        identityService.saveUser(newUser);
        fail("exception expected");
    } catch (AuthorizationException e) {
        assertEquals(1, e.getMissingAuthorizations().size());
        MissingAuthorization info = e.getMissingAuthorizations().get(0);
        assertEquals(jonny2, e.getUserId());
        assertExceptionInfo(CREATE.getName(), USER.resourceName(), null, info);
    }
}

Example 12 with MissingAuthorization

use of org.camunda.bpm.engine.authorization.MissingAuthorization in project camunda-bpm-platform by camunda.

the class IdentityServiceAuthorizationsTest method testUserUpdateAuthorizations.

public void testUserUpdateAuthorizations() {
    // crate user while still in god-mode:
    User jonny1 = identityService.newUser("jonny1");
    identityService.saveUser(jonny1);
    // create global auth
    Authorization basePerms = authorizationService.createNewAuthorization(AUTH_TYPE_GLOBAL);
    basePerms.setResource(USER);
    basePerms.setResourceId(ANY);
    basePerms.addPermission(ALL);
    // revoke update
    basePerms.removePermission(UPDATE);
    authorizationService.saveAuthorization(basePerms);
    // turn on authorization
    processEngineConfiguration.setAuthorizationEnabled(true);
    identityService.setAuthenticatedUserId(jonny2);
    // fetch user:
    jonny1 = identityService.createUserQuery().singleResult();
    jonny1.setFirstName("Jonny");
    try {
        identityService.saveUser(jonny1);
        fail("exception expected");
    } catch (AuthorizationException e) {
        assertEquals(1, e.getMissingAuthorizations().size());
        MissingAuthorization info = e.getMissingAuthorizations().get(0);
        assertEquals(jonny2, e.getUserId());
        assertExceptionInfo(UPDATE.getName(), USER.resourceName(), "jonny1", info);
    }
    // but I can create a new user:
    User jonny3 = identityService.newUser("jonny3");
    identityService.saveUser(jonny3);
}

Example 13 with MissingAuthorization

use of org.camunda.bpm.engine.authorization.MissingAuthorization in project camunda-bpm-platform by camunda.

the class IdentityServiceAuthorizationsTest method testGroupDeleteAuthorizations.

public void testGroupDeleteAuthorizations() {
    // crate group while still in god-mode:
    Group group1 = identityService.newGroup("group1");
    identityService.saveGroup(group1);
    // create global auth
    Authorization basePerms = authorizationService.createNewAuthorization(AUTH_TYPE_GLOBAL);
    basePerms.setResource(GROUP);
    basePerms.setResourceId(ANY);
    basePerms.addPermission(ALL);
    // revoke delete
    basePerms.removePermission(DELETE);
    authorizationService.saveAuthorization(basePerms);
    // turn on authorization
    processEngineConfiguration.setAuthorizationEnabled(true);
    identityService.setAuthenticatedUserId(jonny2);
    try {
        identityService.deleteGroup("group1");
        fail("exception expected");
    } catch (AuthorizationException e) {
        assertEquals(1, e.getMissingAuthorizations().size());
        MissingAuthorization info = e.getMissingAuthorizations().get(0);
        assertEquals(jonny2, e.getUserId());
        assertExceptionInfo(DELETE.getName(), GROUP.resourceName(), "group1", info);
    }
}

Example 14 with MissingAuthorization

use of org.camunda.bpm.engine.authorization.MissingAuthorization in project camunda-bpm-platform by camunda.

the class AuthorizationScenarioInstance method assertAuthorizationException.

public void assertAuthorizationException(AuthorizationException e) {
    if (!missingAuthorizations.isEmpty() && e != null) {
        String message = e.getMessage();
        String assertionFailureMessage = describeScenarioFailure("Expected an authorization exception but the message was wrong: " + e.getMessage());
        List<MissingAuthorization> actualMissingAuthorizations = new ArrayList<MissingAuthorization>(e.getMissingAuthorizations());
        List<MissingAuthorization> expectedMissingAuthorizations = MissingAuthorizationMatcher.asMissingAuthorizations(missingAuthorizations);
        Assert.assertThat(actualMissingAuthorizations, containsInAnyOrder(MissingAuthorizationMatcher.asMatchers(expectedMissingAuthorizations)));
        for (Authorization missingAuthorization : missingAuthorizations) {
            Assert.assertTrue(assertionFailureMessage, message.contains(missingAuthorization.getUserId()));
            Assert.assertEquals(missingAuthorization.getUserId(), e.getUserId());
            for (Permission permission : missingAuthorization.getPermissions(Permissions.values())) {
                if (permission != Permissions.NONE) {
                    Assert.assertTrue(assertionFailureMessage, message.contains(permission.getName()));
                }
            }
            if (!Authorization.ANY.equals(missingAuthorization.getResourceId())) {
                // missing ANY authorizations are not explicitly represented in the error message
                Assert.assertTrue(assertionFailureMessage, message.contains(missingAuthorization.getResourceId()));
            }
            Resource resource = AuthorizationTestUtil.getResourceByType(missingAuthorization.getResourceType());
            Assert.assertTrue(assertionFailureMessage, message.contains(resource.resourceName()));
        }
    } else if (missingAuthorizations.isEmpty() && e == null) {
    // nothing to do
    } else {
        if (e != null) {
            Assert.fail(describeScenarioFailure("Expected no authorization exception but got one: " + e.getMessage()));
        } else {
            Assert.fail(describeScenarioFailure("Expected failure due to missing authorizations but code under test was successful"));
        }
    }
}

Example 15 with MissingAuthorization

use of org.camunda.bpm.engine.authorization.MissingAuthorization in project camunda-bpm-platform by camunda.

the class AuthorizationServiceAuthorizationsTest method testDeleteAuthorization.

public void testDeleteAuthorization() {
    // create global auth
    Authorization basePerms = authorizationService.createNewAuthorization(AUTH_TYPE_GLOBAL);
    basePerms.setResource(AUTHORIZATION);
    basePerms.setResourceId(ANY);
    basePerms.addPermission(ALL);
    // revoke delete
    basePerms.removePermission(DELETE);
    authorizationService.saveAuthorization(basePerms);
    // turn on authorization
    processEngineConfiguration.setAuthorizationEnabled(true);
    identityService.setAuthenticatedUserId(jonny2);
    try {
        // try to delete authorization
        authorizationService.deleteAuthorization(basePerms.getId());
        fail("exception expected");
    } catch (AuthorizationException e) {
        assertEquals(1, e.getMissingAuthorizations().size());
        MissingAuthorization info = e.getMissingAuthorizations().get(0);
        assertEquals(jonny2, e.getUserId());
        assertExceptionInfo(DELETE.getName(), AUTHORIZATION.resourceName(), basePerms.getId(), info);
    }
}