You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by sm...@apache.org on 2019/03/08 23:42:08 UTC
[directory-fortress-core] 01/01: FC-265 - Delegated Administration
Enhancements to Apache Fortress REST
This is an automated email from the ASF dual-hosted git repository.
smckinney pushed a commit to branch FC-265
in repository https://gitbox.apache.org/repos/asf/directory-fortress-core.git
commit 22a43828b7acca9cd5dca25ea82bc3b97ef7ef06
Author: Shawn McKinney <sm...@apache.org>
AuthorDate: Fri Mar 8 17:42:01 2019 -0600
FC-265 - Delegated Administration Enhancements to Apache Fortress REST
---
.../directory/fortress/core/GlobalErrIds.java | 9 +++
.../directory/fortress/core/impl/AdminMgrImpl.java | 19 ++-----
.../directory/fortress/core/impl/AdminUtil.java | 65 +++++++++++++++++++---
.../fortress/core/impl/DelAccessMgrImpl.java | 3 +-
4 files changed, 73 insertions(+), 23 deletions(-)
diff --git a/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java b/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
index 0cbe976..fef9811 100755
--- a/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
+++ b/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
@@ -387,6 +387,11 @@ public final class GlobalErrIds
public static final int USER_ADD_FAILED_ALREADY_EXISTS = 1038;
/**
+ * The Admin is not authorized to add the User.
+ */
+ public static final int USER_ADMIN_CANNOT_ADD = 1039;
+
+ /**
* 2000's User-Role assignments
*/
@@ -1626,6 +1631,10 @@ public final class GlobalErrIds
public static final int REST_UNAUTHORIZED_ERR = 10109;
/**
+ * The REST function could not get handle to HTTP Request.
+ */
+ public static final int REST_NULL_HTTP_REQ_ERR = 10110;
+ /**
* 10200's - RBAC Accelerator Error Ids
*/
diff --git a/src/main/java/org/apache/directory/fortress/core/impl/AdminMgrImpl.java b/src/main/java/org/apache/directory/fortress/core/impl/AdminMgrImpl.java
index 3a7ec5c..93c7191 100755
--- a/src/main/java/org/apache/directory/fortress/core/impl/AdminMgrImpl.java
+++ b/src/main/java/org/apache/directory/fortress/core/impl/AdminMgrImpl.java
@@ -33,20 +33,7 @@ import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.GlobalIds;
import org.apache.directory.fortress.core.SecurityException;
-import org.apache.directory.fortress.core.model.AdminRole;
-import org.apache.directory.fortress.core.model.ConstraintUtil;
-import org.apache.directory.fortress.core.model.Group;
-import org.apache.directory.fortress.core.model.Hier;
-import org.apache.directory.fortress.core.model.PermObj;
-import org.apache.directory.fortress.core.model.Permission;
-import org.apache.directory.fortress.core.model.PermissionAttribute;
-import org.apache.directory.fortress.core.model.PermissionAttributeSet;
-import org.apache.directory.fortress.core.model.Relationship;
-import org.apache.directory.fortress.core.model.Role;
-import org.apache.directory.fortress.core.model.RoleConstraint;
-import org.apache.directory.fortress.core.model.SDSet;
-import org.apache.directory.fortress.core.model.User;
-import org.apache.directory.fortress.core.model.UserRole;
+import org.apache.directory.fortress.core.model.*;
import org.apache.directory.fortress.core.util.Config;
import org.apache.directory.fortress.core.util.VUtil;
@@ -116,7 +103,8 @@ public final class AdminMgrImpl extends Manageable implements AdminMgr, Serializ
String methodName = "addUser";
assertContext( CLS_NM, methodName, user, GlobalErrIds.USER_NULL );
setEntitySession( CLS_NM, methodName, user );
-
+ // Perform delegated admin check:
+ AdminUtil.checkUser(user.getAdminSession(), user);
// Add the User record to ldap.
return userP.add( user );
}
@@ -176,6 +164,7 @@ public final class AdminMgrImpl extends Manageable implements AdminMgr, Serializ
String methodName = "updateUser";
assertContext( CLS_NM, methodName, user, GlobalErrIds.USER_NULL );
setEntitySession( CLS_NM, methodName, user );
+ setEntitySession( CLS_NM, methodName, user );
return userP.update( user );
}
diff --git a/src/main/java/org/apache/directory/fortress/core/impl/AdminUtil.java b/src/main/java/org/apache/directory/fortress/core/impl/AdminUtil.java
index 4988052..641514b 100755
--- a/src/main/java/org/apache/directory/fortress/core/impl/AdminUtil.java
+++ b/src/main/java/org/apache/directory/fortress/core/impl/AdminUtil.java
@@ -19,16 +19,18 @@
*/
package org.apache.directory.fortress.core.impl;
+import org.apache.commons.collections.CollectionUtils;
import org.apache.directory.fortress.core.DelAccessMgr;
import org.apache.directory.fortress.core.AuthorizationException;
import org.apache.directory.fortress.core.GlobalErrIds;
import org.apache.directory.fortress.core.SecurityException;
import org.apache.directory.fortress.core.DelAccessMgrFactory;
-import org.apache.directory.fortress.core.model.FortEntity;
-import org.apache.directory.fortress.core.model.Permission;
-import org.apache.directory.fortress.core.model.Role;
-import org.apache.directory.fortress.core.model.Session;
-import org.apache.directory.fortress.core.model.User;
+import org.apache.directory.fortress.core.model.*;
+import org.apache.directory.fortress.core.util.Config;
+
+import java.util.List;
+import java.util.Set;
+import java.util.TreeSet;
/**
* This class supplies static wrapper utilities to provide ARBAC functionality to Fortress internal Manager APIs.
@@ -40,8 +42,6 @@ import org.apache.directory.fortress.core.model.User;
*/
final class AdminUtil
{
- private static final String CLS_NM = AdminUtil.class.getName();
-
/**
* Private constructor
*
@@ -50,6 +50,57 @@ final class AdminUtil
{
}
+ static void checkUser(Session session, User user) throws SecurityException
+ {
+ String SUPER_ADMIN = Config.getInstance().getProperty("superadmin.role", "fortress-core-super-admin");
+
+ boolean result = false;
+ if( session != null )
+ {
+ List<UserAdminRole> uaRoles = session.getAdminRoles();
+ if(CollectionUtils.isNotEmpty( uaRoles ))
+ {
+ // validate user and retrieve user' ou:
+ //User ue = userP.read(user, false);
+ for(UserAdminRole uaRole : uaRoles)
+ {
+ if(uaRole.getName().equalsIgnoreCase(SUPER_ADMIN))
+ {
+ result = true;
+ break;
+ }
+ Set<String> osUs = uaRole.getOsUSet();
+ if(CollectionUtils.isNotEmpty( osUs ))
+ {
+ // create Set with case insensitive comparator:
+ Set<String> osUsFinal = new TreeSet<>(String.CASE_INSENSITIVE_ORDER);
+ for(String osU : osUs)
+ {
+ // Add osU children to the set:
+ osUsFinal.add(osU);
+ Set<String> children = UsoUtil.getInstance().getDescendants( osU, user.getContextId() );
+ osUsFinal.addAll(children);
+ }
+ // does the admin role have authority over the user object?
+ if(osUsFinal.contains(user.getOu()))
+ {
+ result = true;
+ }
+ }
+ }
+ }
+ }
+ else
+ {
+ result = true;
+ }
+ if( ! result )
+ {
+ String warning = "checkUser User [" + user.getUserId() + "] Admin [" + session.getUserId() + "] failed check.";
+ throw new SecurityException(GlobalErrIds.USER_ADMIN_CANNOT_ADD, warning);
+ }
+ }
+
/**
* Wrapper function to call {@link DelAccessMgrImpl#canAssign(org.apache.directory.fortress.core.model.Session, org.apache.directory.fortress.core.model.User, org.apache.directory.fortress.core.model.Role)}.
* This will determine if the user contains an AdminRole that is authorized assignment control over User-Role Assignment (URA). This adheres to the ARBAC02 functional specification for can-assign URA.
diff --git a/src/main/java/org/apache/directory/fortress/core/impl/DelAccessMgrImpl.java b/src/main/java/org/apache/directory/fortress/core/impl/DelAccessMgrImpl.java
index db18613..e250889 100755
--- a/src/main/java/org/apache/directory/fortress/core/impl/DelAccessMgrImpl.java
+++ b/src/main/java/org/apache/directory/fortress/core/impl/DelAccessMgrImpl.java
@@ -71,7 +71,8 @@ public class DelAccessMgrImpl extends AccessMgrImpl implements DelAccessMgr, Ser
private PermP permP;
private String SUPER_ADMIN;
- public DelAccessMgrImpl() {
+ public DelAccessMgrImpl()
+ {
userP = new UserP();
permP = new PermP();
SUPER_ADMIN = Config.getInstance().getProperty("superadmin.role", "fortress-core-super-admin");