Examples with IAuthorizationPolicy org.pentaho.platform.api.engine.IAuthorizationPolicy used on opensource projects

Example 21 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project data-access by pentaho.

the class CsvDatasourceServiceImpl method hasManageDataAccessPermission.

/**
 * Returns true if the current user has Manage Data Source Security. Otherwise returns false.
 * @return
 */
protected boolean hasManageDataAccessPermission() {
    // If this breaks an OEM's plugin, provide a get-out-of-jail card with an entry in the pentaho.xml.
    final String override = PentahoSystem.getSystemSetting("data-access-override", "false");
    final Boolean rtnOverride = Boolean.valueOf(override);
    if (!rtnOverride) {
        final IAuthorizationPolicy policy = PentahoSystem.get(IAuthorizationPolicy.class);
        if (policy != null) {
            return policy.isAllowed("org.pentaho.platform.dataaccess.datasource.security.manage");
        } else {
            return false;
        }
    } else {
        // Override the security policy with the entry in the pentaho.xml.
        return true;
    }
}

Example 22 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileService method validateAccess.

protected void validateAccess(String importDir) throws PentahoAccessControlException {
    IAuthorizationPolicy policy = getPolicy();
    // check if we are admin or have publish permission
    boolean isAdminOrPublish = policy.isAllowed(RepositoryReadAction.NAME) && policy.isAllowed(RepositoryCreateAction.NAME) && (policy.isAllowed(AdministerSecurityAction.NAME) || policy.isAllowed(PublishAction.NAME));
    if (!isAdminOrPublish) {
        // the user does not have admin or publish permission, so we will check if the user imports to their home folder
        boolean usingHomeFolder = false;
        String tenatedUserName = PentahoSessionHolder.getSession().getName();
        // get user home home folder path
        String userHomeFolderPath = ServerRepositoryPaths.getUserHomeFolderPath(JcrTenantUtils.getUserNameUtils().getTenant(tenatedUserName), JcrTenantUtils.getUserNameUtils().getPrincipleName(tenatedUserName));
        if (userHomeFolderPath != null && userHomeFolderPath.length() > 0) {
            // we pass the relative path so add serverside root folder for every home folder
            usingHomeFolder = (ServerRepositoryPaths.getTenantRootFolderPath() + importDir).contains(userHomeFolderPath);
        }
        if (!(usingHomeFolder && policy.isAllowed(RepositoryCreateAction.NAME) && policy.isAllowed(RepositoryReadAction.NAME))) {
            throw new PentahoAccessControlException("User is not authorized to perform this operation");
        }
    }
}

Example 23 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileService method doGetFileOrDirAsDownload.

public DownloadFileWrapper doGetFileOrDirAsDownload(String userAgent, String pathId, String strWithManifest) throws Throwable {
    // change file id to path
    String path = idToPath(pathId);
    validateAccess(path);
    IAuthorizationPolicy policy = getPolicy();
    String originalFileName, encodedFileName = null;
    // if no path is sent, return bad request
    if (StringUtils.isEmpty(pathId)) {
        throw new InvalidParameterException(pathId);
    }
    // check if path is valid
    if (!isPathValid(path)) {
        throw new IllegalSelectorException();
    }
    // check if entity exists in repo
    RepositoryFile repositoryFile = getRepository().getFile(path);
    if (repositoryFile == null) {
        // file does not exist or is not readable but we can't tell at this point
        throw new FileNotFoundException(path);
    }
    // send zip with manifest by default
    boolean withManifest = "false".equals(strWithManifest) ? false : true;
    boolean requiresZip = repositoryFile.isFolder() || withManifest;
    BaseExportProcessor exportProcessor = getDownloadExportProcessor(path, requiresZip, withManifest);
    // $NON-NLS-1$//$NON-NLS-2$
    originalFileName = requiresZip ? repositoryFile.getName() + ".zip" : repositoryFile.getName();
    encodedFileName = makeEncodedFileName(originalFileName);
    String quotedFileName = makeQuotedFileName(originalFileName);
    // add export handlers for each expected file type
    exportProcessor.addExportHandler(getDownloadExportHandler());
    // copy streaming output
    StreamingOutput streamingOutput = getDownloadStream(repositoryFile, exportProcessor);
    final String attachment = makeAttachment(userAgent, encodedFileName, quotedFileName);
    return new DownloadFileWrapper(streamingOutput, attachment, encodedFileName);
}

Example 24 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class AuthorizationActionServiceTest method testDoValidateAuth.

@Test
public void testDoValidateAuth() {
    IAuthorizationPolicy policy = mock(IAuthorizationPolicy.class);
    List<IAuthorizationAction> actions = new ArrayList();
    actions.add(new AdministerSecurityAction());
    doReturn(actions).when(authorizationActionService).getActionList();
    doReturn(policy).when(authorizationActionService).getPolicy();
    doReturn(true).when(policy).isAllowed("org.pentaho.security.administerSecurity");
    boolean isAllowed = authorizationActionService.validateAuth("org.pentaho.security.administerSecurity");
    assertEquals(isAllowed, true);
    isAllowed = authorizationActionService.validateAuth("invalid-auth");
    assertEquals(isAllowed, false);
}

Example 25 with IAuthorizationPolicy

use of org.pentaho.platform.api.engine.IAuthorizationPolicy in project pentaho-platform by pentaho.

the class FileServiceTest method testDoCanAdminister.

public void testDoCanAdminister() throws Exception {
    IAuthorizationPolicy authorizationPolicy = mock(IAuthorizationPolicy.class);
    doReturn(authorizationPolicy).when(fileService).getPolicy();
    doReturn(true).when(authorizationPolicy).isAllowed(RepositoryReadAction.NAME);
    doReturn(true).when(authorizationPolicy).isAllowed(RepositoryCreateAction.NAME);
    doReturn(true).when(authorizationPolicy).isAllowed(AdministerSecurityAction.NAME);
    assertTrue(fileService.doCanAdminister());
    doReturn(false).when(authorizationPolicy).isAllowed(RepositoryReadAction.NAME);
    doReturn(true).when(authorizationPolicy).isAllowed(RepositoryCreateAction.NAME);
    doReturn(true).when(authorizationPolicy).isAllowed(AdministerSecurityAction.NAME);
    assertFalse(fileService.doCanAdminister());
    doReturn(true).when(authorizationPolicy).isAllowed(RepositoryReadAction.NAME);
    doReturn(false).when(authorizationPolicy).isAllowed(RepositoryCreateAction.NAME);
    doReturn(true).when(authorizationPolicy).isAllowed(AdministerSecurityAction.NAME);
    assertFalse(fileService.doCanAdminister());
    doReturn(true).when(authorizationPolicy).isAllowed(RepositoryReadAction.NAME);
    doReturn(true).when(authorizationPolicy).isAllowed(RepositoryCreateAction.NAME);
    doReturn(false).when(authorizationPolicy).isAllowed(AdministerSecurityAction.NAME);
    assertFalse(fileService.doCanAdminister());
    doReturn(false).when(authorizationPolicy).isAllowed(RepositoryReadAction.NAME);
    doReturn(false).when(authorizationPolicy).isAllowed(RepositoryCreateAction.NAME);
    doReturn(false).when(authorizationPolicy).isAllowed(AdministerSecurityAction.NAME);
    assertFalse(fileService.doCanAdminister());
}