Examples with AclMetadataPrincipal org.pentaho.platform.repository2.unified.jcr.JcrAclMetadataStrategy.AclMetadataPrincipal used on opensource projects

Example 1 with AclMetadataPrincipal

use of org.pentaho.platform.repository2.unified.jcr.JcrAclMetadataStrategy.AclMetadataPrincipal in project pentaho-platform by pentaho.

the class SpringSecurityPrincipalProvider method getPrincipal.

/**
 * {@inheritDoc}
 * <p/>
 * <p> Attempts to load user using given {@code principalName} using a Pentaho {@code UserDetailsService}. If it fails
 * to find user, it returns a {@link Group} which will be caught by {@code SpringSecurityLoginModule}. </p>
 */
public synchronized Principal getPrincipal(final String principalName) {
    if (logger.isDebugEnabled()) {
        logger.debug("principalName: [" + principalName + "]");
    }
    checkInitialized();
    Assert.notNull(principalName);
    // specially
    if (AclMetadataPrincipal.isAclMetadataPrincipal(principalName)) {
        return new AclMetadataPrincipal(principalName);
    } else if (adminId.equals(principalName)) {
        return adminPrincipal;
    } else if (anonymousId.equals(principalName)) {
        return anonymousPrincipal;
    } else if (EveryonePrincipal.getInstance().getName().equals(principalName)) {
        return EveryonePrincipal.getInstance();
    } else {
        if (JcrTenantUtils.isTenantedUser(principalName)) {
            // 1. then try the user cache
            if (cacheManager != null) {
                Principal userFromUserCache = (Principal) cacheManager.getFromRegionCache(USER_CACHE_REGION, JcrTenantUtils.getTenantedUser(principalName));
                if (userFromUserCache != null) {
                    if (logger.isTraceEnabled()) {
                        // $NON-NLS-1$ //$NON-NLS-2$
                        logger.trace("user " + principalName + " found in cache");
                    }
                    return userFromUserCache;
                } else {
                    if (logger.isTraceEnabled()) {
                        // $NON-NLS-1$ //$NON-NLS-2$
                        logger.trace("user " + principalName + " not found in cache");
                    }
                }
            } else {
                if (logger.isTraceEnabled()) {
                    logger.trace(" Cache is not available. Will create a principal for user [" + principalName + ']');
                }
            }
            // it may not be necessary to get user's details to emit principal,
            if (skipUserVerification || internalGetUserDetails(principalName) != null) {
                final Principal user = new UserPrincipal(principalName);
                if (cacheManager != null) {
                    cacheManager.putInRegionCache(USER_CACHE_REGION, principalName, user);
                }
                return user;
            }
        } else if (JcrTenantUtils.isTenatedRole(principalName)) {
            // 1. first try the role cache
            if (cacheManager != null) {
                Principal roleFromCache = (Principal) cacheManager.getFromRegionCache(ROLE_CACHE_REGION, JcrTenantUtils.getTenantedRole(principalName));
                if (roleFromCache != null) {
                    if (logger.isTraceEnabled()) {
                        // $NON-NLS-1$ //$NON-NLS-2$
                        logger.trace("role " + principalName + " found in cache");
                    }
                    return roleFromCache;
                } else {
                    if (logger.isTraceEnabled()) {
                        // $NON-NLS-1$ //$NON-NLS-2$
                        logger.trace("role " + principalName + " not found in cache");
                    }
                }
            } else {
                if (logger.isTraceEnabled()) {
                    logger.trace(" Cache is not available. Will create a principal for role [" + principalName + ']');
                }
            }
            // 2. finally just assume role; this assumption serves two purposes:
            // (1) avoid any role search config by the user
            // and (2) performance (if we don't care that a role is not
            // present--why look it up); finally, a Group returned
            // by this class will be caught in
            // SpringSecurityLoginModule.getPrincipal and the login will fail
            final Principal roleToCache = createSpringSecurityRolePrincipal(principalName);
            if (cacheManager != null) {
                cacheManager.putInRegionCache(ROLE_CACHE_REGION, principalName, roleToCache);
            }
            if (logger.isTraceEnabled()) {
                // $NON-NLS-1$ //$NON-NLS-2$
                logger.trace("assuming " + principalName + " is a role");
            }
            return roleToCache;
        }
        return null;
    }
}

Example 2 with AclMetadataPrincipal

use of org.pentaho.platform.repository2.unified.jcr.JcrAclMetadataStrategy.AclMetadataPrincipal in project pentaho-platform by pentaho.

the class SpringSecurityPrincipalProvider method getGroupMembership.

/**
 * {@inheritDoc}
 * <p/>
 * <p> Called from {@code AbstractLoginModule.getPrincipals()} </p>
 */
public PrincipalIterator getGroupMembership(final Principal principal) {
    checkInitialized();
    Assert.notNull(principal);
    // first handle anonymous and everyone specially
    Set<Principal> groups = new HashSet<Principal>();
    if (principal instanceof AnonymousPrincipal) {
        return PrincipalIteratorAdapter.EMPTY;
    } else if (principal instanceof EveryonePrincipal) {
        return PrincipalIteratorAdapter.EMPTY;
    }
    // metadata principals never have group membership
    if (!(principal instanceof Group) && !(principal instanceof AdminPrincipal) && !(principal instanceof AclMetadataPrincipal)) {
        UserDetails user = internalGetUserDetails(principal.getName());
        if (user == null) {
            return new PrincipalIteratorAdapter(groups);
        }
        for (final GrantedAuthority role : user.getAuthorities()) {
            final String roleAuthority = role.getAuthority();
            Principal fromCache;
            if (cacheManager == null) {
                fromCache = null;
            } else {
                fromCache = (Principal) cacheManager.getFromRegionCache(ROLE_CACHE_REGION, roleAuthority);
            }
            if (fromCache != null) {
                groups.add(fromCache);
            } else {
                groups.add(createSpringSecurityRolePrincipal(roleAuthority));
            }
        }
    }
    groups.add(EveryonePrincipal.getInstance());
    if (logger.isTraceEnabled()) {
        // $NON-NLS-1$ //$NON-NLS-2$
        logger.trace("group membership for principal=" + principal + " is " + groups);
    }
    return new PrincipalIteratorAdapter(groups);
}

Example 3 with AclMetadataPrincipal

use of org.pentaho.platform.repository2.unified.jcr.JcrAclMetadataStrategy.AclMetadataPrincipal in project pentaho-platform by pentaho.

the class TestPrincipalProvider method getGroupMembership.

/**
 * {@inheritDoc}
 *
 * <p>
 * Called from {@code AbstractLoginModule.getPrincipals()}
 * </p>
 */
@Override
public PrincipalIterator getGroupMembership(Principal principal) {
    if (principal instanceof EveryonePrincipal) {
        return PrincipalIteratorAdapter.EMPTY;
    }
    if (principal instanceof AclMetadataPrincipal) {
        return PrincipalIteratorAdapter.EMPTY;
    }
    Set<Principal> principals = new HashSet<Principal>(roleAssignments.containsKey(principal.getName()) ? roleAssignments.get(principal.getName()) : new HashSet<Principal>());
    principals.add(EveryonePrincipal.getInstance());
    if (principal instanceof AdminPrincipal) {
        principals.add(adminRolePrincipal);
    } else if (principal instanceof UserPrincipal) {
        if (userRoleDao != null) {
            List<IPentahoRole> roles;
            try {
                roles = userRoleDao.getUserRoles(null, principal.getName());
                for (IPentahoRole role : roles) {
                    principals.add(new SpringSecurityRolePrincipal(tenantedRoleNameUtils.getPrincipleId(role.getTenant(), role.getName())));
                }
            } catch (Exception e) {
                roles = userRoleDao.getUserRoles(null, principal.getName());
                for (IPentahoRole role : roles) {
                    principals.add(new SpringSecurityRolePrincipal(tenantedRoleNameUtils.getPrincipleId(role.getTenant(), role.getName())));
                }
            }
        } else {
            if (principal.getName() != null && (principal.getName().startsWith("admin") || principal.getName().startsWith("suzy") || principal.getName().startsWith("tiffany"))) {
                ITenant tenant = tenantedUserNameUtils.getTenant(principal.getName());
                principals.add(new SpringSecurityRolePrincipal(tenantedRoleNameUtils.getPrincipleId(tenant, "Authenticated")));
            }
            if (principal.getName() != null && principal.getName().startsWith("admin")) {
                ITenant tenant = tenantedUserNameUtils.getTenant(principal.getName());
                principals.add(new SpringSecurityRolePrincipal(tenantedRoleNameUtils.getPrincipleId(tenant, "TenantAdmin")));
            }
            if (principal.getName() != null && principal.getName().startsWith("super")) {
                ITenant tenant = tenantedUserNameUtils.getTenant(principal.getName());
                principals.add(new SpringSecurityRolePrincipal(tenantedRoleNameUtils.getPrincipleId(tenant, "SysAdmin")));
            }
        }
    }
    return new PrincipalIteratorAdapter(principals);
}