Examples with ConfigAttribute org.springframework.security.access.ConfigAttribute used on opensource projects

Example 86 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project midpoint by Evolveum.

the class MidPointGuiAuthorizationEvaluator method decide.

@Override
public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
    if (!(object instanceof FilterInvocation)) {
        return;
    }
    FilterInvocation filterInvocation = (FilterInvocation) object;
    Collection<ConfigAttribute> guiConfigAttr = new ArrayList<>();
    for (PageUrlMapping urlMapping : PageUrlMapping.values()) {
        addSecurityConfig(filterInvocation, guiConfigAttr, urlMapping.getUrl(), urlMapping.getAction());
    }
    Map<String, DisplayableValue<String>[]> actions = DescriptorLoader.getActions();
    for (Map.Entry<String, DisplayableValue<String>[]> entry : actions.entrySet()) {
        addSecurityConfig(filterInvocation, guiConfigAttr, entry.getKey(), entry.getValue());
    }
    if (configAttributes == null || guiConfigAttr.isEmpty()) {
        return;
    }
    Collection<ConfigAttribute> configAttributesToUse = guiConfigAttr;
    if (guiConfigAttr.isEmpty()) {
        configAttributesToUse = configAttributes;
    }
    try {
        securityEnforcer.decide(authentication, object, configAttributesToUse);
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("DECIDE: authentication={}, object={}, configAttributesToUse={}: OK", authentication, object, configAttributesToUse);
        }
    } catch (AccessDeniedException | InsufficientAuthenticationException e) {
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("DECIDE: authentication={}, object={}, configAttributesToUse={}: {}", authentication, object, configAttributesToUse, e);
        }
        throw e;
    }
}

Example 87 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project dhis2-core by dhis2.

the class ActionAccessVoter method allAuthorities.

private int allAuthorities(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    int supported = 0;
    for (ConfigAttribute attribute : attributes) {
        if (supports(attribute)) {
            ++supported;
            boolean found = false;
            for (GrantedAuthority authority : authentication.getAuthorities()) {
                if (authority.getAuthority().equals(attribute.getAttribute())) {
                    found = true;
                    break;
                }
            }
            if (!found) {
                LOG.debug("ACCESS_DENIED [" + object.toString() + "]");
                return ACCESS_DENIED;
            }
        }
    }
    if (supported > 0) {
        LOG.debug("ACCESS_GRANTED [" + object.toString() + "]");
        return ACCESS_GRANTED;
    }
    LOG.debug("ACCESS_ABSTAIN [" + object.toString() + "]: No supported attributes.");
    return ACCESS_ABSTAIN;
}

Example 88 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project dhis2-core by dhis2.

the class ActionAccessVoter method vote.

@Override
public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    if (!supports(object.getClass())) {
        LOG.debug("ACCESS_ABSTAIN [" + object.toString() + "]: Class not supported.");
        return ACCESS_ABSTAIN;
    }
    ActionConfig actionConfig = (ActionConfig) object;
    Collection<ConfigAttribute> requiredAuthorities = StrutsAuthorityUtils.getConfigAttributes(actionConfig, requiredAuthoritiesKey);
    Collection<ConfigAttribute> anyAuthorities = StrutsAuthorityUtils.getConfigAttributes(actionConfig, anyAuthoritiesKey);
    int allStatus = allAuthorities(authentication, object, requiredAuthorities);
    if (allStatus == ACCESS_DENIED) {
        return ACCESS_DENIED;
    }
    int anyStatus = anyAuthority(authentication, object, anyAuthorities);
    if (anyStatus == ACCESS_DENIED) {
        return ACCESS_DENIED;
    }
    if (allStatus == ACCESS_GRANTED || anyStatus == ACCESS_GRANTED) {
        return ACCESS_GRANTED;
    }
    return ACCESS_ABSTAIN;
}