Examples with SecurityRuleEntry org.xwiki.security.authorization.SecurityRuleEntry used on opensource projects

Example 1 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultSecurityCacheTest method InsertUsersWithouShadow.

private Map<String, SecurityEntry> InsertUsersWithouShadow() throws ConflictingInsertionException, ParentEntryEvictedException {
    Map<String, SecurityEntry> entries = new HashMap<String, SecurityEntry>();
    // Add wikis
    for (SecurityReference ref : wikiRefs) {
        SecurityRuleEntry entry = mockSecurityRuleEntry(ref);
        entries.put(AddRuleEntry(entry), entry);
    }
    // XWiki spaces are required to load user entries
    for (SecurityReference ref : xwikiSpaceRefs) {
        SecurityRuleEntry entry = mockSecurityRuleEntry(ref);
        entries.put(AddRuleEntry(entry), entry);
    }
    // Insert some users
    for (SecurityReference ref : userRefs) {
        SecurityRuleEntry entry = mockSecurityRuleEntry(ref);
        entries.put(AddRuleEntry(entry), entry);
    }
    // Insert some groups
    for (SecurityReference ref : groupRefs.keySet()) {
        SecurityRuleEntry entry = mockSecurityRuleEntry(ref);
        entries.put(AddRuleEntry(entry), entry);
    }
    // Insert users in groups
    for (SecurityReference ref : groupUserRefs) {
        SecurityRuleEntry entry = mockSecurityRuleEntry(ref);
        entries.put(AddRuleEntry(entry), entry);
    }
    return entries;
}

Example 2 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultSecurityCacheTest method mockSecurityRuleEntry.

private SecurityRuleEntry mockSecurityRuleEntry(final SecurityReference ref) {
    SecurityRuleEntry entry = mock(SecurityRuleEntry.class, "Rules for " + ref.toString());
    when(entry.getReference()).thenReturn(ref);
    return entry;
}

Example 3 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultSecurityCacheTest method InsertEntities.

private Map<String, SecurityEntry> InsertEntities() throws ConflictingInsertionException, ParentEntryEvictedException {
    Map<String, SecurityEntry> entries = new HashMap<String, SecurityEntry>();
    for (SecurityReference ref : entityRefs) {
        if (securityCache.get(ref) == null) {
            SecurityRuleEntry entry = mockSecurityRuleEntry(ref);
            entries.put(AddRuleEntry(entry), entry);
        }
    }
    return entries;
}

Example 4 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultSecurityCacheLoader method loadUserEntry.

/**
 * Load rules for a user/group into the cache with relations to immediate groups. Groups should be already loaded,
 * else a ParentEntryEvictedException will be thrown. The parent chain of the loaded user will be loaded as needed.
 *
 * @param user The user/group to load.
 * @param groups The collection of groups associated with the user/group
 * @throws ParentEntryEvictedException if any of the parent entries of the group were evicted.
 * @throws ConflictingInsertionException When different threads have inserted conflicting entries into the cache.
 * @throws org.xwiki.security.authorization.AuthorizationException on error.
 */
private void loadUserEntry(UserSecurityReference user, Collection<GroupSecurityReference> groups) throws ParentEntryEvictedException, ConflictingInsertionException, AuthorizationException {
    // Make sure the parent of the user document is loaded.
    Deque<SecurityReference> chain = user.getReversedSecurityReferenceChain();
    chain.removeLast();
    for (SecurityReference ref : chain) {
        SecurityRuleEntry entry = securityCache.get(ref);
        if (entry == null) {
            entry = securityEntryReader.read(ref);
            securityCache.add(entry);
        }
    }
    SecurityRuleEntry entry = securityEntryReader.read(user);
    securityCache.add(entry, groups);
}

Example 5 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultAuthorizationSettlerTest method testSettleTieResolutionPolicy.

@Test
public void testSettleTieResolutionPolicy() throws Exception {
    SecurityRule allowAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("allowAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, ALLOW);
    SecurityRule denyAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("denyAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, DENY);
    SecurityRule denyAllTestRightsAnotherUserAndGroup = getMockedSecurityRule("denyAllTestRightsAnotherUserAndGroup", Arrays.asList(anotherUserRef), Arrays.asList(groupRef), allTestRights, DENY);
    Deque<SecurityRuleEntry> conflictAllowDenySameTarget = getMockedSecurityRuleEntries("conflictAllowDenySameTarget", docRef, Arrays.asList(Arrays.asList(allowAllTestRightsUserAndAnotherGroup, denyAllTestRightsUserAndAnotherGroup)));
    Deque<SecurityRuleEntry> conflictDenyAllowSameTarget = getMockedSecurityRuleEntries("conflictDenyAllowSameTarget", docRef, Arrays.asList(Arrays.asList(denyAllTestRightsUserAndAnotherGroup, allowAllTestRightsUserAndAnotherGroup)));
    Deque<SecurityRuleEntry> conflictAllowDenyUserGroup = getMockedSecurityRuleEntries("conflictAllowDenyUserGroup", docRef, Arrays.asList(Arrays.asList(allowAllTestRightsUserAndAnotherGroup, denyAllTestRightsAnotherUserAndGroup)));
    Deque<SecurityRuleEntry> conflictDenyAllowUserGroup = getMockedSecurityRuleEntries("conflictDenyAllowUserGroup", docRef, Arrays.asList(Arrays.asList(denyAllTestRightsAnotherUserAndGroup, allowAllTestRightsUserAndAnotherGroup)));
    XWikiSecurityAccess allowAccess = defaultAccess.clone();
    for (Right right : allTestRights) {
        allowAccess.allow(right);
    }
    XWikiSecurityAccess denyAccess = defaultAccess.clone();
    for (Right right : allTestRights) {
        denyAccess.deny(right);
    }
    XWikiSecurityAccess tieAccess = defaultAccess.clone();
    for (Right right : allTestRights) {
        tieAccess.set(right, right.getTieResolutionPolicy());
    }
    assertAccess("When allowed right for user is denied for same user in another rule, use tie resolution policy", userRef, docRef, tieAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenySameTarget));
    assertAccess("When denied right for user is allowed for same user in another rule, use tie resolution policy", userRef, docRef, tieAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictDenyAllowSameTarget));
    assertAccess("When allowed right for group is denied for same group in another rule, use tie resolution policy", anotherUserRef, docRef, tieAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenySameTarget));
    assertAccess("When denied right for group is allowed for same group in another rule, use tie resolution policy", anotherUserRef, docRef, tieAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictDenyAllowSameTarget));
    assertAccess("When allowed right for user is denied for its group in another rule, allow it.", userRef, docRef, allowAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenyUserGroup));
    assertAccess("When allowed right for group is denied for one of its user in another rule, deny it.", anotherUserRef, docRef, denyAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenyUserGroup));
    assertAccess("When denied right for group is allowed for one of its user in another rule, allow it.", userRef, docRef, allowAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictDenyAllowUserGroup));
    assertAccess("When denied right for user is allowed for its group in another rule, deny it.", anotherUserRef, docRef, denyAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictDenyAllowUserGroup));
}