Examples with GranteeAuthorizer org.graylog.security.GranteeAuthorizer used on opensource projects

Example 1 with GranteeAuthorizer

use of org.graylog.security.GranteeAuthorizer in project graylog2-server by Graylog2.

the class EntityDependencyPermissionCheckerTest method runCheck.

private ImmutableMultimap<GRN, EntityDescriptor> runCheck(boolean isSharingUserAuthorized, boolean isGranteeUserAuthorized) {
    final GRN granteeUser = grnRegistry.newGRN("user", "john");
    final GRN sharingUser = grnRegistry.newGRN("user", "jane");
    final GRN stream = grnRegistry.newGRN("stream", "54e3deadbeefdeadbeef0001");
    final GranteeAuthorizer sharingUserAuthorizer = mock(GranteeAuthorizer.class);
    final GranteeAuthorizer granteeUserAuthorizer = mock(GranteeAuthorizer.class);
    final ImmutableSet<GRN> selectedGrantees = ImmutableSet.of(granteeUser);
    final EntityDescriptor dependency = EntityDescriptor.create(stream, "Title", ImmutableSet.of());
    final ImmutableSet<EntityDescriptor> dependencies = ImmutableSet.of(dependency);
    when(userAuthorizerFactory.create(sharingUser)).thenReturn(sharingUserAuthorizer);
    when(userAuthorizerFactory.create(granteeUser)).thenReturn(granteeUserAuthorizer);
    when(sharingUserAuthorizer.isPermitted(anyString(), any(GRN.class))).thenReturn(isSharingUserAuthorized);
    when(granteeUserAuthorizer.isPermitted("streams:read", stream)).thenReturn(isGranteeUserAuthorized);
    final ImmutableMultimap<GRN, EntityDescriptor> checkResult = resolver.check(sharingUser, dependencies, selectedGrantees);
    verify(sharingUserAuthorizer, times(1)).isPermitted("streams:read", stream);
    verifyNoMoreInteractions(sharingUserAuthorizer);
    return checkResult;
}

Example 2 with GranteeAuthorizer

use of org.graylog.security.GranteeAuthorizer in project graylog2-server by Graylog2.

the class EntityDependencyPermissionChecker method check.

/**
 * Runs permission checks for the given dependencies for every selected grantee and returns the entities that
 * grantees cannot access.
 *
 * @param sharingUser      the sharing user
 * @param dependencies     the dependencies to check
 * @param selectedGrantees the selected grantees
 * @return dependencies that grantees cannot access, grouped by grantee
 */
public ImmutableMultimap<GRN, EntityDescriptor> check(GRN sharingUser, ImmutableSet<EntityDescriptor> dependencies, Set<GRN> selectedGrantees) {
    final ImmutableMultimap.Builder<GRN, EntityDescriptor> deniedDependencies = ImmutableMultimap.builder();
    final GranteeAuthorizer sharerAuthorizer = granteeAuthorizerFactory.create(sharingUser);
    for (final GRN grantee : selectedGrantees) {
        // We only check for existing grants for the actual grantee. If the grantee is a team, we only check if
        // the team has a grant, not if any users in the team can access the dependency via other grants.
        // The same for the "everyone" grantee, we only check if  the "everyone" grantee has access to a dependency.
        final GranteeAuthorizer granteeAuthorizer = granteeAuthorizerFactory.create(grantee);
        for (final EntityDescriptor dependency : dependencies) {
            // leaking information to the sharing user.
            if (cannotView(sharerAuthorizer, dependency)) {
                continue;
            }
            if (cannotView(granteeAuthorizer, dependency)) {
                deniedDependencies.put(grantee, dependency);
            }
        }
    }
    return deniedDependencies.build();
}