Examples with Permission org.wso2.carbon.user.core.Permission used on opensource projects

Example 11 with Permission

use of org.wso2.carbon.user.core.Permission in project carbon-identity-framework by wso2.

the class ApplicationMgtUtil method updatePermissions.

/**
 * Updates the permissions of the application
 *
 * @param applicationName
 * @param permissions
 * @throws IdentityApplicationManagementException
 */
public static void updatePermissions(String applicationName, ApplicationPermission[] permissions) throws IdentityApplicationManagementException {
    String applicationNode = getApplicationPermissionPath() + PATH_CONSTANT + applicationName;
    Registry tenantGovReg = CarbonContext.getThreadLocalCarbonContext().getRegistry(RegistryType.USER_GOVERNANCE);
    try {
        boolean exist = tenantGovReg.resourceExists(applicationNode);
        if (!exist) {
            Collection appRootNode = tenantGovReg.newCollection();
            appRootNode.setProperty("name", applicationName);
            tenantGovReg.put(applicationNode, appRootNode);
        }
        Collection appNodeCollec = (Collection) tenantGovReg.get(applicationNode);
        String[] childern = appNodeCollec.getChildren();
        // new permissions are null. deleting all permissions case
        if ((childern != null && childern.length > 0) && (permissions == null || permissions.length == 0)) {
            // there are permissions
            tenantGovReg.delete(applicationNode);
        }
        if (ArrayUtils.isEmpty(permissions)) {
            return;
        }
        // no permission exist for the application, create new
        if (childern == null || appNodeCollec.getChildCount() < 1) {
            addPermission(applicationNode, permissions, tenantGovReg);
        } else {
            // there are permission
            List<ApplicationPermission> loadPermissions = loadPermissions(applicationName);
            for (ApplicationPermission applicationPermission : loadPermissions) {
                tenantGovReg.delete(applicationNode + PATH_CONSTANT + applicationPermission.getValue());
            }
            addPermission(applicationNode, permissions, tenantGovReg);
        }
    } catch (RegistryException e) {
        throw new IdentityApplicationManagementException("Error while storing permissions", e);
    }
}

Example 12 with Permission

use of org.wso2.carbon.user.core.Permission in project carbon-identity-framework by wso2.

the class ApplicationMgtUtil method storePermissions.

/**
 * Stores the permissions to applications.
 *
 * @param applicationName
 * @param permissionsConfig
 * @throws IdentityApplicationManagementException
 */
public static void storePermissions(String applicationName, String username, PermissionsAndRoleConfig permissionsConfig) throws IdentityApplicationManagementException {
    int tenantId = MultitenantConstants.INVALID_TENANT_ID;
    try {
        tenantId = CarbonContext.getThreadLocalCarbonContext().getTenantId();
        IdentityTenantUtil.initializeRegistry(tenantId);
    } catch (IdentityException e) {
        throw new IdentityApplicationManagementException("Error loading tenant registry for tenant domain: " + IdentityTenantUtil.getTenantDomain(tenantId), e);
    }
    Registry tenantGovReg = CarbonContext.getThreadLocalCarbonContext().getRegistry(RegistryType.USER_GOVERNANCE);
    String permissionResourcePath = getApplicationPermissionPath();
    try {
        if (!tenantGovReg.resourceExists(permissionResourcePath)) {
            boolean loggedInUserChanged = false;
            UserRealm realm = (UserRealm) CarbonContext.getThreadLocalCarbonContext().getUserRealm();
            if (!realm.getAuthorizationManager().isUserAuthorized(username, permissionResourcePath, UserMgtConstants.EXECUTE_ACTION)) {
                // Logged in user is not authorized to create the permission.
                // Temporarily change the user to the admin for creating the permission
                PrivilegedCarbonContext.getThreadLocalCarbonContext().setUsername(realm.getRealmConfiguration().getAdminUserName());
                tenantGovReg = CarbonContext.getThreadLocalCarbonContext().getRegistry(RegistryType.USER_GOVERNANCE);
                loggedInUserChanged = true;
            }
            Collection appRootNode = tenantGovReg.newCollection();
            appRootNode.setProperty("name", "Applications");
            tenantGovReg.put(permissionResourcePath, appRootNode);
            if (loggedInUserChanged) {
                PrivilegedCarbonContext.getThreadLocalCarbonContext().setUsername(username);
            }
        }
        if (permissionsConfig != null) {
            ApplicationPermission[] permissions = permissionsConfig.getPermissions();
            if (permissions == null || permissions.length < 1) {
                return;
            }
            // creating the application node in the tree
            String appNode = permissionResourcePath + PATH_CONSTANT + applicationName;
            Collection appNodeColl = tenantGovReg.newCollection();
            tenantGovReg.put(appNode, appNodeColl);
            // now start storing the permissions
            for (ApplicationPermission permission : permissions) {
                String permissinPath = appNode + PATH_CONSTANT + permission;
                Resource permissionNode = tenantGovReg.newResource();
                permissionNode.setProperty("name", permission.getValue());
                tenantGovReg.put(permissinPath, permissionNode);
            }
        }
    } catch (Exception e) {
        throw new IdentityApplicationManagementException("Error while storing permissions for application " + applicationName, e);
    }
}

Example 13 with Permission

use of org.wso2.carbon.user.core.Permission in project carbon-identity-framework by wso2.

the class ApplicationMgtUtil method loadPermissions.

/**
 * Loads the permissions of the application
 *
 * @param applicationName
 * @return
 * @throws IdentityApplicationManagementException
 */
public static List<ApplicationPermission> loadPermissions(String applicationName) throws IdentityApplicationManagementException {
    String applicationNode = getApplicationPermissionPath() + PATH_CONSTANT + applicationName;
    Registry tenantGovReg = CarbonContext.getThreadLocalCarbonContext().getRegistry(RegistryType.USER_GOVERNANCE);
    List<String> paths = new ArrayList<>();
    try {
        boolean exist = tenantGovReg.resourceExists(applicationNode);
        if (!exist) {
            return Collections.emptyList();
        }
        boolean loggedInUserChanged = false;
        String loggedInUser = CarbonContext.getThreadLocalCarbonContext().getUsername();
        UserRealm realm = (UserRealm) CarbonContext.getThreadLocalCarbonContext().getUserRealm();
        if (loggedInUser == null || !realm.getAuthorizationManager().isUserAuthorized(loggedInUser, applicationNode, UserMgtConstants.EXECUTE_ACTION)) {
            // Logged in user is not authorized to read the permission.
            // Temporarily change the user to the admin for reading the permission
            PrivilegedCarbonContext.getThreadLocalCarbonContext().setUsername(realm.getRealmConfiguration().getAdminUserName());
            tenantGovReg = CarbonContext.getThreadLocalCarbonContext().getRegistry(RegistryType.USER_GOVERNANCE);
            loggedInUserChanged = true;
        }
        // clear current paths
        paths.clear();
        List<ApplicationPermission> permissions = new ArrayList<ApplicationPermission>();
        // get permission paths
        permissionPath(tenantGovReg, applicationNode, paths, applicationNode);
        for (String permissionPath : paths) {
            ApplicationPermission permission;
            permission = new ApplicationPermission();
            permission.setValue(permissionPath);
            permissions.add(permission);
        }
        if (loggedInUserChanged) {
            PrivilegedCarbonContext.getThreadLocalCarbonContext().setUsername(loggedInUser);
        }
        return permissions;
    } catch (RegistryException | org.wso2.carbon.user.core.UserStoreException e) {
        throw new IdentityApplicationManagementException("Error while reading permissions", e);
    }
}

Example 14 with Permission

use of org.wso2.carbon.user.core.Permission in project carbon-identity-framework by wso2.

the class UserRealmProxy method getRolePermissions.

/**
 * Get permission of roles list.
 *
 * @param roleNames List of roles.
 * @param tenantId  Tenanat ID.
 * @return Permissions.
 * @throws UserAdminException UserAdminException.
 */
public UIPermissionNode getRolePermissions(List<String> roleNames, int tenantId) throws UserAdminException {
    UIPermissionNode nodeRoot;
    Collection regRoot;
    Collection parent = null;
    Registry tenantRegistry = null;
    try {
        Registry registry = UserMgtDSComponent.getRegistryService().getGovernanceSystemRegistry();
        if (tenantId == MultitenantConstants.SUPER_TENANT_ID) {
            regRoot = (Collection) registry.get(UserMgtConstants.UI_PERMISSION_ROOT);
            String displayName = regRoot.getProperty(UserMgtConstants.DISPLAY_NAME);
            nodeRoot = new UIPermissionNode(UserMgtConstants.UI_PERMISSION_ROOT, displayName);
        } else {
            regRoot = (Collection) registry.get(UserMgtConstants.UI_ADMIN_PERMISSION_ROOT);
            tenantRegistry = UserMgtDSComponent.getRegistryService().getGovernanceSystemRegistry(tenantId);
            Collection appRoot;
            if (tenantRegistry.resourceExists(APPLICATIONS_PATH)) {
                appRoot = (Collection) tenantRegistry.get(APPLICATIONS_PATH);
                parent = (Collection) tenantRegistry.newCollection();
                parent.setProperty(UserMgtConstants.DISPLAY_NAME, "All Permissions");
                parent.setChildren(new String[] { regRoot.getPath(), appRoot.getPath() });
            }
            String displayName;
            if (parent != null) {
                displayName = parent.getProperty(UserMgtConstants.DISPLAY_NAME);
            } else {
                displayName = regRoot.getProperty(UserMgtConstants.DISPLAY_NAME);
            }
            nodeRoot = new UIPermissionNode(UserMgtConstants.UI_ADMIN_PERMISSION_ROOT, displayName);
        }
        if (parent != null) {
            buildUIPermissionNode(parent, nodeRoot, registry, tenantRegistry, realm.getAuthorizationManager(), roleNames);
        } else {
            buildUIPermissionNode(regRoot, nodeRoot, registry, tenantRegistry, realm.getAuthorizationManager(), roleNames);
        }
        return nodeRoot;
    } catch (UserStoreException | RegistryException e) {
        log.error(e.getMessage(), e);
        throw new UserAdminException(e.getMessage(), e);
    }
}

Example 15 with Permission

use of org.wso2.carbon.user.core.Permission in project carbon-identity-framework by wso2.

the class UserRealmProxy method buildUIPermissionNodeNotAllSelected.

private void buildUIPermissionNodeNotAllSelected(Collection parent, UIPermissionNode parentNode, Registry registry, Registry tenantRegistry, AuthorizationManager authMan, String roleName, String userName) throws RegistryException, UserStoreException {
    String[] children = parent.getChildren();
    UIPermissionNode[] childNodes = new UIPermissionNode[children.length];
    for (int i = 0; i < children.length; i++) {
        String child = children[i];
        Resource resource = null;
        if (tenantRegistry != null && child.startsWith("/permission/applications")) {
            resource = tenantRegistry.get(child);
        } else if (registry.resourceExists(child)) {
            resource = registry.get(child);
        } else {
            throw new RegistryException("Permission resource not found in the registry.");
        }
        boolean isSelected = false;
        if (roleName != null) {
            isSelected = authMan.isRoleAuthorized(roleName, child, UserMgtConstants.EXECUTE_ACTION);
        } else if (userName != null) {
            isSelected = authMan.isUserAuthorized(userName, child, UserMgtConstants.EXECUTE_ACTION);
        }
        childNodes[i] = getUIPermissionNode(resource, isSelected);
        if (resource instanceof Collection) {
            buildUIPermissionNodeNotAllSelected((Collection) resource, childNodes[i], registry, tenantRegistry, authMan, roleName, userName);
        }
    }
    parentNode.setNodeList(childNodes);
}