Examples with GRNPermission org.graylog.security.permissions.GRNPermission used on opensource projects

Example 1 with GRNPermission

use of org.graylog.security.permissions.GRNPermission in project graylog2-server by Graylog2.

the class RolesResource method getMembers.

@GET
@Path("{rolename}/members")
@RequiresPermissions({ RestPermissions.USERS_LIST, RestPermissions.ROLES_READ })
@ApiOperation("Retrieve the role's members")
public RoleMembershipResponse getMembers(@ApiParam(name = "rolename", required = true) @PathParam("rolename") String name) throws NotFoundException {
    final Role role = roleService.load(name);
    final Collection<User> users = userService.loadAllForRole(role);
    Set<UserSummary> userSummaries = Sets.newHashSetWithExpectedSize(users.size());
    for (User user : users) {
        final Set<String> roleNames = userService.getRoleNames(user);
        List<WildcardPermission> wildcardPermissions;
        List<GRNPermission> grnPermissions;
        if (isPermitted(RestPermissions.USERS_PERMISSIONSEDIT, user.getName())) {
            wildcardPermissions = userService.getWildcardPermissionsForUser(user);
            grnPermissions = userService.getGRNPermissionsForUser(user);
        } else {
            wildcardPermissions = ImmutableList.of();
            grnPermissions = ImmutableList.of();
        }
        userSummaries.add(UserSummary.create(user.getId(), user.getName(), user.getEmail(), user.getFirstName().orElse(null), user.getLastName().orElse(null), user.getFullName(), wildcardPermissions, grnPermissions, user.getPreferences(), firstNonNull(user.getTimeZone(), DateTimeZone.UTC).getID(), user.getSessionTimeoutMs(), user.isReadOnly(), user.isExternalUser(), user.getStartpage(), roleNames, // there is no session information available in this call, so we set it to null
        false, null, null, user.getAccountStatus()));
    }
    return RoleMembershipResponse.create(role.getName(), userSummaries);
}

Example 2 with GRNPermission

use of org.graylog.security.permissions.GRNPermission in project graylog2-server by Graylog2.

the class UsersResource method toUserResponse.

private UserSummary toUserResponse(User user, boolean includePermissions, AllUserSessions sessions) {
    final Set<String> roleIds = user.getRoleIds();
    Set<String> roleNames = Collections.emptySet();
    if (!roleIds.isEmpty()) {
        roleNames = userManagementService.getRoleNames(user);
        if (roleNames.isEmpty()) {
            LOG.error("Unable to load role names for role IDs {} for user {}", roleIds, user);
        }
    }
    boolean sessionActive = false;
    Date lastActivity = null;
    String clientAddress = null;
    final Optional<MongoDbSession> mongoDbSession = sessions.forUser(user);
    if (mongoDbSession.isPresent()) {
        final MongoDbSession session = mongoDbSession.get();
        sessionActive = true;
        lastActivity = session.getLastAccessTime();
        clientAddress = session.getHost();
    }
    List<WildcardPermission> wildcardPermissions;
    List<GRNPermission> grnPermissions;
    if (includePermissions) {
        wildcardPermissions = userManagementService.getWildcardPermissionsForUser(user);
        grnPermissions = userManagementService.getGRNPermissionsForUser(user);
    } else {
        wildcardPermissions = ImmutableList.of();
        grnPermissions = ImmutableList.of();
    }
    return UserSummary.create(user.getId(), user.getName(), user.getEmail(), user.getFirstName().orElse(null), user.getLastName().orElse(null), user.getFullName(), wildcardPermissions, grnPermissions, user.getPreferences(), user.getTimeZone() == null ? null : user.getTimeZone().getID(), user.getSessionTimeoutMs(), user.isReadOnly(), user.isExternalUser(), user.getStartpage(), roleNames, sessionActive, lastActivity, clientAddress, user.getAccountStatus());
}

Example 3 with GRNPermission

use of org.graylog.security.permissions.GRNPermission in project graylog2-server by Graylog2.

the class UserServiceImplTest method testGetPermissionsForUser.

@Test
public void testGetPermissionsForUser() throws Exception {
    final InMemoryRolePermissionResolver permissionResolver = mock(InMemoryRolePermissionResolver.class);
    final GRNRegistry grnRegistry = GRNRegistry.createWithBuiltinTypes();
    final UserService userService = new UserServiceImpl(mongoConnection, configuration, roleService, accessTokenService, userFactory, permissionResolver, serverEventBus, grnRegistry, permissionAndRoleResolver);
    final UserImplFactory factory = new UserImplFactory(new Configuration(), permissions);
    final UserImpl user = factory.create(new HashMap<>());
    user.setName("user");
    final Role role = createRole("Foo");
    user.setRoleIds(Collections.singleton(role.getId()));
    user.setPermissions(Collections.singletonList("hello:world"));
    when(permissionResolver.resolveStringPermission(role.getId())).thenReturn(Collections.singleton("foo:bar"));
    final GRNPermission ownerShipPermission = GRNPermission.create(RestPermissions.ENTITY_OWN, grnRegistry.newGRN(GRNTypes.DASHBOARD, "1234"));
    final GRN userGRN = grnRegistry.ofUser(user);
    when(permissionAndRoleResolver.resolvePermissionsForPrincipal(userGRN)).thenReturn(ImmutableSet.of(new CaseSensitiveWildcardPermission("perm:from:grant"), ownerShipPermission));
    final String roleId = "12345";
    when(permissionAndRoleResolver.resolveRolesForPrincipal(userGRN)).thenReturn(ImmutableSet.of(roleId));
    when(permissionResolver.resolveStringPermission(roleId)).thenReturn(ImmutableSet.of("perm:from:role"));
    assertThat(userService.getPermissionsForUser(user).stream().map(p -> p instanceof CaseSensitiveWildcardPermission ? p.toString() : p).collect(Collectors.toSet())).containsExactlyInAnyOrder("users:passwordchange:user", "users:edit:user", "foo:bar", "hello:world", "users:tokenlist:user", "users:tokencreate:user", "users:tokenremove:user", "perm:from:grant", ownerShipPermission, "perm:from:role");
}