-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Moving logic where auth checks are being done out of EntityDescriptorService implementations to allow for plugable implementations to make the determinations
- Loading branch information
Showing
22 changed files
with
204 additions
and
126 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5 changes: 5 additions & 0 deletions
5
backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/IApprovable.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| package edu.internet2.tier.shibboleth.admin.ui.domain; | ||
|
|
||
| public interface IApprovable { | ||
| String getIdOfOwner(); | ||
| } |
22 changes: 0 additions & 22 deletions
22
...va/edu/internet2/tier/shibboleth/admin/ui/security/permission/IPersistentEntityTuple.java
This file was deleted.
Oops, something went wrong.
26 changes: 12 additions & 14 deletions
26
...du/internet2/tier/shibboleth/admin/ui/security/permission/IShibUiPermissionEvaluator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,22 @@ | ||
| package edu.internet2.tier.shibboleth.admin.ui.security.permission; | ||
|
|
||
| import edu.internet2.tier.shibboleth.admin.ui.exception.ForbiddenException; | ||
| import org.springframework.security.access.PermissionEvaluator; | ||
| import org.springframework.security.core.Authentication; | ||
|
|
||
| import java.util.Collection; | ||
| import java.util.Map; | ||
|
|
||
| public interface IShibUiPermissionEvaluator extends PermissionEvaluator { | ||
| // | ||
| // /** | ||
| // * For a given permission, find all the persistant entities a user has rights to. | ||
| // */ | ||
| // Collection getPersistentEntitiesWithPermission(Authentication authentication, Object permission); | ||
| // | ||
| // /** | ||
| // * Get ALL persistent entities that user has access to | ||
| // * @param authentication | ||
| // * @return a map. The key value will be the entity tuple and the value portions will be the set of permissions a user has on those objects | ||
| // */ | ||
| // Map<IPersistentEntityTuple, Object> getPersistentEntities(Authentication authentication); | ||
|
|
||
| Collection getPersistentEntities(Authentication authentication, ShibUiType type, PermissionType permissionType); | ||
| /** | ||
| * Return a Collection of items matching the type describing those types that can be asked for and for which the authenticated | ||
| * user has the correct permission to access | ||
| * @param authentication The security Authorization | ||
| * @param type The permissible type that should be returned in the collection. This is an abstraction | ||
| * @param permissionType The type of permissions the user should have to access the items returned in the collection. Determining | ||
| * the relationship is up to the implementation | ||
| * @return Collection of objects representing the type described by the ShibUiPermissibleType enumeration | ||
| * @throws ForbiddenException if the user does not have the correct authority required | ||
| */ | ||
| Collection getPersistentEntities(Authentication authentication, ShibUiPermissibleType type, PermissionType permissionType) throws ForbiddenException; | ||
| } |
2 changes: 1 addition & 1 deletion
2
.../main/java/edu/internet2/tier/shibboleth/admin/ui/security/permission/PermissionType.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| package edu.internet2.tier.shibboleth.admin.ui.security.permission; | ||
|
|
||
| public enum PermissionType { | ||
| admin, enable, approver, user; | ||
| admin, approver, enable, fetch, viewOrEdit; | ||
| } |
5 changes: 5 additions & 0 deletions
5
...ava/edu/internet2/tier/shibboleth/admin/ui/security/permission/ShibUiPermissibleType.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| package edu.internet2.tier.shibboleth.admin.ui.security.permission; | ||
|
|
||
| public enum ShibUiPermissibleType { | ||
| entityDescriptorProjection // represents EntityDescriptorProjections | ||
| } |
87 changes: 87 additions & 0 deletions
87
.../edu/internet2/tier/shibboleth/admin/ui/security/permission/ShibUiPermissionDelegate.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package edu.internet2.tier.shibboleth.admin.ui.security.permission; | ||
|
|
||
| import edu.internet2.tier.shibboleth.admin.ui.domain.IActivatable; | ||
| import edu.internet2.tier.shibboleth.admin.ui.domain.IApprovable; | ||
| import edu.internet2.tier.shibboleth.admin.ui.exception.ForbiddenException; | ||
| import edu.internet2.tier.shibboleth.admin.ui.repository.EntityDescriptorProjection; | ||
| import edu.internet2.tier.shibboleth.admin.ui.repository.EntityDescriptorRepository; | ||
| import edu.internet2.tier.shibboleth.admin.ui.security.model.Ownable; | ||
| import edu.internet2.tier.shibboleth.admin.ui.security.service.UserAccess; | ||
| import edu.internet2.tier.shibboleth.admin.ui.security.service.UserService; | ||
| import lombok.AllArgsConstructor; | ||
| import org.springframework.security.core.Authentication; | ||
|
|
||
| import java.io.Serializable; | ||
| import java.util.Collection; | ||
| import java.util.List; | ||
|
|
||
| /** | ||
| * The ShibUiPermissionDelegate is the default service for SHIBUI, which delegates calls (primarily) to the the userService to determine | ||
| * whether a user has the correct abilty to act a particular way (possibly on certain objects). | ||
| */ | ||
| @AllArgsConstructor | ||
| public class ShibUiPermissionDelegate implements IShibUiPermissionEvaluator { | ||
| private EntityDescriptorRepository entityDescriptorRepository; | ||
|
|
||
| private UserService userService; | ||
|
|
||
| @Override | ||
| public Collection getPersistentEntities(Authentication authentication, ShibUiPermissibleType shibUiType, PermissionType permissionType) throws ForbiddenException { | ||
| switch (shibUiType) { | ||
| case entityDescriptorProjection: | ||
| switch (permissionType) { | ||
| case approver: | ||
| return getAllEntityDescriptorProjectionsNeedingApprovalBasedOnUserAccess(); | ||
| case enable: | ||
| // This particular list is used for an admin function, so the user must be an ADMIN | ||
| if (!hasPermission(authentication, null, PermissionType.admin)) { | ||
| throw new ForbiddenException(); | ||
| } | ||
| return entityDescriptorRepository.getEntityDescriptorsNeedingEnabling(); | ||
| case fetch: | ||
| if (!hasPermission(authentication, null, PermissionType.fetch)) { | ||
| throw new ForbiddenException("User has no access rights to get a list of Metadata Sources"); | ||
| } | ||
| return getAllEntityDescriptorProjectionsBasedOnUserAccess(); | ||
| } | ||
| } | ||
| return null; | ||
| } | ||
|
|
||
| private List<EntityDescriptorProjection> getAllEntityDescriptorProjectionsBasedOnUserAccess() { | ||
| if (userService.currentUserIsAdmin()) { | ||
| return entityDescriptorRepository.findAllReturnProjections(); | ||
| } else { | ||
| return entityDescriptorRepository.findAllByIdOfOwner(userService.getCurrentUser().getGroup().getOwnerId()); | ||
| } | ||
| } | ||
|
|
||
| private List<EntityDescriptorProjection> getAllEntityDescriptorProjectionsNeedingApprovalBasedOnUserAccess() { | ||
| List<String> groupsToApprove = userService.getGroupsCurrentUserCanApprove(); | ||
| List<EntityDescriptorProjection> result = entityDescriptorRepository.getEntityDescriptorsNeedingApproval(groupsToApprove); | ||
| return result; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) { | ||
| switch ((PermissionType) permission) { | ||
| case admin: // we don't care about the object - the user is an admin or not | ||
| return userService.currentUserIsAdmin(); | ||
| case approver: | ||
| if (userService.currentUserIsAdmin()) { return true; } | ||
| return targetDomainObject instanceof IApprovable ? userService.getGroupsCurrentUserCanApprove().contains(((IApprovable)targetDomainObject).getIdOfOwner()) : false; | ||
| case enable: | ||
| return targetDomainObject instanceof IActivatable ? userService.currentUserCanEnable((IActivatable) targetDomainObject) : false; | ||
| case fetch: | ||
| return userService.currentUserIsAdmin() || userService.getCurrentUserAccess().equals(UserAccess.GROUP); | ||
| case viewOrEdit: | ||
| return userService.canViewOrEditTarget((Ownable) targetDomainObject); | ||
| default: return false; | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public boolean hasPermission(Authentication authentication, Serializable targetId, String target, Object permission) { | ||
| return false; // Unused and Unimplemented - we don't need for this implementation to lookup objects | ||
| } | ||
| } |
4 changes: 0 additions & 4 deletions
4
...c/main/java/edu/internet2/tier/shibboleth/admin/ui/security/permission/ShibUiService.java
This file was deleted.
Oops, something went wrong.
5 changes: 0 additions & 5 deletions
5
.../src/main/java/edu/internet2/tier/shibboleth/admin/ui/security/permission/ShibUiType.java
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.