Examples with AccessControlList org.opencastproject.security.api.AccessControlList used on opensource projects

Example 61 with AccessControlList

use of org.opencastproject.security.api.AccessControlList in project opencast by opencast.

the class XACMLSecurityTest method testSecurity.

@Test
public void testSecurity() throws Exception {
    // Create a mediapackage and some role/action tuples
    MediaPackage mediapackage = MediaPackageBuilderFactory.newInstance().newMediaPackageBuilder().createNew();
    // Get default ACL
    AccessControlList defaultAcl = authzService.getActiveAcl(mediapackage).getA();
    Assert.assertEquals(0, defaultAcl.getEntries().size());
    // Default with series
    mediapackage.setSeries("123");
    defaultAcl = authzService.getActiveAcl(mediapackage).getA();
    Assert.assertEquals(0, defaultAcl.getEntries().size());
    AccessControlList aclSeries1 = new AccessControlList();
    List<AccessControlEntry> entriesSeries1 = aclSeries1.getEntries();
    entriesSeries1.add(new AccessControlEntry("admin", "delete", true));
    entriesSeries1.add(new AccessControlEntry("admin", "read", true));
    entriesSeries1.add(new AccessControlEntry("student", "read", true));
    entriesSeries1.add(new AccessControlEntry("student", "comment", true));
    entriesSeries1.add(new AccessControlEntry(DefaultOrganization.DEFAULT_ORGANIZATION_ANONYMOUS, "read", true));
    entriesSeries1.add(new AccessControlEntry(DefaultOrganization.DEFAULT_ORGANIZATION_ANONYMOUS, "comment", false));
    AccessControlList aclSeries2 = new AccessControlList();
    List<AccessControlEntry> entriesSeries2 = aclSeries2.getEntries();
    entriesSeries2.add(new AccessControlEntry("admin", "delete", true));
    entriesSeries2.add(new AccessControlEntry("admin", "read", true));
    entriesSeries2.add(new AccessControlEntry("student", "read", false));
    entriesSeries2.add(new AccessControlEntry("student", "comment", false));
    entriesSeries2.add(new AccessControlEntry(DefaultOrganization.DEFAULT_ORGANIZATION_ANONYMOUS, "read", true));
    entriesSeries2.add(new AccessControlEntry(DefaultOrganization.DEFAULT_ORGANIZATION_ANONYMOUS, "comment", false));
    AccessControlList aclEpisode = new AccessControlList();
    // Add the security policy to the mediapackage
    authzService.setAcl(mediapackage, AclScope.Series, aclSeries1);
    // Ensure that the permissions specified are respected by the security service
    currentRoles.clear();
    currentRoles.add(new JaxbRole("admin", organization, ""));
    Assert.assertTrue(authzService.hasPermission(mediapackage, "delete"));
    Assert.assertTrue(authzService.hasPermission(mediapackage, "read"));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "comment"));
    currentRoles.clear();
    currentRoles.add(new JaxbRole("student", organization, ""));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "delete"));
    Assert.assertTrue(authzService.hasPermission(mediapackage, "read"));
    Assert.assertTrue(authzService.hasPermission(mediapackage, "comment"));
    currentRoles.clear();
    currentRoles.add(new JaxbRole("admin", organization));
    mediapackage = authzService.setAcl(mediapackage, AclScope.Episode, aclEpisode).getA();
    Assert.assertEquals(AclScope.Episode, authzService.getActiveAcl(mediapackage).getB());
    Assert.assertFalse(authzService.hasPermission(mediapackage, "delete"));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "read"));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "comment"));
    mediapackage = authzService.removeAcl(mediapackage, AclScope.Episode);
    AccessControlList computedAcl = authzService.getActiveAcl(mediapackage).getA();
    Assert.assertEquals("ACLs are the same size?", entriesSeries1.size(), computedAcl.getEntries().size());
    Assert.assertTrue("ACLs contain the same ACEs?", computedAcl.getEntries().containsAll(entriesSeries1));
    authzService.setAcl(mediapackage, AclScope.Series, aclSeries2);
    currentRoles.clear();
    currentRoles.add(new JaxbRole("student", organization));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "delete"));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "read"));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "comment"));
    currentRoles.clear();
    currentRoles.add(new JaxbRole(DefaultOrganization.DEFAULT_ORGANIZATION_ANONYMOUS, organization, ""));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "delete"));
    Assert.assertTrue(authzService.hasPermission(mediapackage, "read"));
    Assert.assertFalse(authzService.hasPermission(mediapackage, "comment"));
}

Example 62 with AccessControlList

use of org.opencastproject.security.api.AccessControlList in project opencast by opencast.

the class AclScanner method updateAcl.

/**
 * Update an ACL based upon an XACML file on all the organizations.
 *
 * @param artifact
 *          The File representing the XACML File.
 * @throws IOException
 * @throws JAXBException
 */
private void updateAcl(File artifact) throws IOException, XACMLParsingException {
    List<Organization> organizations = organizationDirectoryService.getOrganizations();
    logger.debug("Updating Acl {}", artifact.getAbsolutePath());
    String fileName = FilenameUtils.removeExtension(artifact.getName());
    AccessControlList acl = parseToAcl(artifact);
    // Update the Acl on all the organizations
    for (Organization org : organizations) {
        securityService.setOrganization(org);
        Long id = managedAcls.get(generateAclId(fileName, org));
        if (id != null) {
            // If the Acl Id is in the managedAcls map, we update the Acl
            if (!getAclService(org).updateAcl(new ManagedAclImpl(id, fileName, org.getId(), acl))) {
                logger.warn("No Acl found with the id {} for the organisation {}.", id, org.getName());
            } else {
                logger.debug("Acl from XACML file {} has been updated for the organisation {}", fileName, org.getName());
            }
        } else {
            logger.info("The XACML file {} has not been added to the organisation {} and will therefore not be updated", fileName, org.getName());
        }
    }
}

Example 63 with AccessControlList

use of org.opencastproject.security.api.AccessControlList in project opencast by opencast.

the class AclScanner method parseToAcl.

/**
 * Parse the given XACML file into an Access Control List
 *
 * @param artifact
 * @return
 * @throws FileNotFoundException
 * @throws JAXBException
 */
private AccessControlList parseToAcl(File artifact) throws FileNotFoundException, XACMLParsingException {
    FileInputStream in = null;
    AccessControlList acl = null;
    try {
        in = new FileInputStream(artifact);
        acl = XACMLUtils.parseXacml(in);
    } finally {
        IOUtils.closeQuietly(in);
    }
    return acl;
}

Example 64 with AccessControlList

use of org.opencastproject.security.api.AccessControlList in project opencast by opencast.

the class AssetManagerWithMessagingTest method mkAssetManager.

public AssetManagerWithMessaging mkAssetManager() throws Exception {
    final Workspace workspace = EasyMock.createNiceMock(Workspace.class);
    EasyMock.expect(workspace.get(EasyMock.anyObject(URI.class))).andReturn(new File(getClass().getResource("/dublincore-a.xml").toURI())).anyTimes();
    EasyMock.expect(workspace.read(EasyMock.anyObject(URI.class))).andAnswer(() -> getClass().getResourceAsStream("/dublincore-a.xml")).anyTimes();
    EasyMock.replay(workspace);
    final AuthorizationService authSvc = EasyMock.createNiceMock(AuthorizationService.class);
    final AccessControlList acl = new AccessControlList(new AccessControlEntry("admin", "write", true));
    EasyMock.expect(authSvc.getActiveAcl(EasyMock.<MediaPackage>anyObject())).andReturn(tuple(acl, AclScope.Episode)).anyTimes();
    EasyMock.replay(authSvc);
    ms = EasyMock.createMock(MessageSender.class);
    return new AssetManagerWithMessaging(// message receive part is currently not under test so we can pass null values
    mkAbstractAssetManager(), ms, null, authSvc, null, null, workspace, null);
}

Example 65 with AccessControlList

use of org.opencastproject.security.api.AccessControlList in project opencast by opencast.

the class AccessInformationUtilTest method testSerializeManagedAcl.

/**
 * Test method for {@link AccessInformationUtil#serializeManagedAcl(ManagedAcl)}
 */
@Test
public void testSerializeManagedAcl() throws Exception {
    AccessControlList acl = new AccessControlList();
    acl.getEntries().add(ACE_ROLE_ADMIN_ALLOW_ACTION_READ);
    ManagedAcl manAcl = new ManagedAclImpl(1L, MANAGED_ACL_1_NAME, ORGANISATION_1_ID, acl);
    JSONObject aclJson = AccessInformationUtil.serializeManagedAcl(manAcl);
    assertEquals(1L, aclJson.getLong("id"));
    assertEquals(MANAGED_ACL_1_NAME, aclJson.getString("name"));
}