You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lenya.apache.org by th...@apache.org on 2006/08/21 19:23:46 UTC
svn commit: r433294 - in /lenya/sandbox/ac-restricted-1.4-src:
java/org/apache/lenya/ac/
modules-core/ac-impl/java/src/org/apache/lenya/ac/file/
modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/
modules-core/administration/java/src/org/apache/len...
Author: thorsten
Date: Mon Aug 21 10:23:45 2006
New Revision: 433294
URL: http://svn.apache.org/viewvc?rev=433294&view=rev
Log:
Fixing credential bug regarding the test set. We have to check the credential that the identity can obtain. Further returning now credentials sorted in importance order. Still missing ordering of rights (up and down) and fixing the bug with multiple role childs of an accreditable. This bug can be seen in the ac form, where only one credential is returned even if the accreditable has more role definitions.
Modified:
lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/ModifiablePolicy.java
lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/Policy.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/PolicyAuthorizer.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/URLPolicy.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/administration/java/src/org/apache/lenya/cms/ac/usecases/AccessControl.java
Modified: lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/ModifiablePolicy.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/ModifiablePolicy.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/ModifiablePolicy.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/ModifiablePolicy.java Mon Aug 21 10:23:45 2006
@@ -52,8 +52,4 @@
*/
void removeRoles(Accreditable accreditable) throws AccessControlException;
- /**
- * @return The credentials of this policy.
- */
- Credential[] getCredentials();
}
Modified: lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/Policy.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/Policy.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/Policy.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/Policy.java Mon Aug 21 10:23:45 2006
@@ -47,6 +47,8 @@
*/
boolean isEmpty() throws AccessControlException;
+ Credential[] getCredentials(Identity identity) throws AccessControlException;
+
Credential[] getCredentials() throws AccessControlException;
}
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java Mon Aug 21 10:23:45 2006
@@ -45,14 +45,15 @@
import org.apache.lenya.ac.Accreditable;
import org.apache.lenya.ac.AccreditableManager;
import org.apache.lenya.ac.Credential;
+import org.apache.lenya.ac.InheritingPolicyManager;
import org.apache.lenya.ac.ModifiablePolicy;
import org.apache.lenya.ac.Policy;
import org.apache.lenya.ac.Role;
import org.apache.lenya.ac.User;
import org.apache.lenya.ac.cache.CachingException;
import org.apache.lenya.ac.cache.SourceCache;
+import org.apache.lenya.ac.impl.CredentialImpl;
import org.apache.lenya.ac.impl.DefaultPolicy;
-import org.apache.lenya.ac.InheritingPolicyManager;
import org.apache.lenya.ac.impl.PolicyBuilder;
import org.apache.lenya.ac.impl.RemovedAccreditablePolicyBuilder;
import org.apache.lenya.ac.impl.URLPolicy;
@@ -374,11 +375,7 @@
List policies = new LinkedList();
HashMap orderedPolicies = new LinkedHashMap();
int position = 1;
-
- Policy policy = buildURLPolicy(controller, url);
- orderedPolicies.put(String.valueOf(position), policy);
- position++;
-
+ Policy policy;
// The live area should be restrictive and will use the policy belonging to self-or-ancestor
if (url.startsWith("/live")) {
while (url.indexOf("/") >= 0) {
@@ -402,6 +399,8 @@
position++;
}
}
+ policy = buildURLPolicy(controller, url);
+ orderedPolicies.put(String.valueOf(position), policy);
for (int i = orderedPolicies.size(); i > 0; i--) {
policies.add(orderedPolicies.get(String.valueOf(i)));
}
@@ -514,24 +513,18 @@
if (role != null) {
String url = USER_ADMIN_URL + ((User) accreditable).getId() + ".html";
ModifiablePolicy policy = (ModifiablePolicy) buildSubtreePolicy(manager, url);
- // policy.addRole(accreditable, role);
+ // FIXME: bug with multiple role childs of an accreditable.
+ // to activate we need the method as parameter
+ //policy.addRole(accreditable, role, method);
saveSubtreePolicy(url, policy);
}
}
}
-
+
public Credential[] getCredentials(AccreditableManager controller, String url) throws AccessControlException {
- Credential[] copy=null;
- List credentials = new LinkedList();
-
- Policy policy = buildURLPolicy(controller, url);
- if (policy != null){
- Credential[] tmp=policy.getCredentials();
- for (int i = 0; i < tmp.length; i++) {
- Credential credential = tmp[i];
- credentials.add(credential);
- }
- }
+ HashMap orderedCredential = new LinkedHashMap();
+ int position = 1;
+ Policy policy ;
// The live area should be restrictive and will use the policy belonging to self-or-ancestor
if (url.startsWith("/live")) {
@@ -541,7 +534,8 @@
Credential[] tmp=policy.getCredentials();
for (int i = 0; i < tmp.length; i++) {
Credential credential = tmp[i];
- credentials.add(credential);
+ orderedCredential.put(String.valueOf(position), credential);
+ position++;
}
}
if (!policy.isEmpty()) {
@@ -560,16 +554,28 @@
Credential[] tmp=policy.getCredentials();
for (int j = 0; j < tmp.length; j++) {
Credential credential = tmp[j];
- credentials.add(credential);
+ orderedCredential.put(String.valueOf(position), credential);
+ position++;
}
}
}
- return (Credential[]) credentials.toArray(new Credential[credentials.size()]);
- /*Credential[] copy = new Credential[credentials.length];
- for (int i = 0; i < credentials.length; i++) {
- copy[i]=credentials[i];
- }
- return copy;*/
+ policy = buildURLPolicy(controller, url);
+ if (policy != null){
+ Credential[] tmp=policy.getCredentials();
+ for (int i = 0; i < tmp.length; i++) {
+ Credential credential = tmp[i];
+ orderedCredential.put(String.valueOf(position), credential);
+ }
+ }
+ Credential[] returnCredential = new CredentialImpl[orderedCredential.size()];
+ int y = 0;
+ for (int i = orderedCredential.size(); i > 0; i--) {
+ returnCredential[y]=(Credential) orderedCredential.get(String.valueOf(i));
+ y++;
+ }
+
+
+ return returnCredential;
}
}
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java Mon Aug 21 10:23:45 2006
@@ -188,4 +188,14 @@
}
}
+ public Credential[] getCredentials(Identity identity) throws AccessControlException {
+ Accreditable[] accreditables = identity.getAccreditables();
+
+ Set credentials = new LinkedHashSet();
+ for (int accrIndex = 0; accrIndex < accreditables.length; accrIndex++) {
+ credentials.add(getCredential(accreditables[accrIndex]));
+ }
+ return (Credential[]) credentials.toArray(new Credential[credentials.size()]);
+ }
+
}
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/PolicyAuthorizer.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/PolicyAuthorizer.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/PolicyAuthorizer.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/PolicyAuthorizer.java Mon Aug 21 10:23:45 2006
@@ -28,6 +28,7 @@
import org.apache.lenya.ac.AccreditableManager;
import org.apache.lenya.ac.Authorizer;
import org.apache.lenya.ac.Credential;
+import org.apache.lenya.ac.Identifiable;
import org.apache.lenya.ac.Identity;
import org.apache.lenya.ac.Policy;
import org.apache.lenya.ac.PolicyManager;
@@ -110,7 +111,14 @@
Policy policy = getPolicyManager().getPolicy(getAccreditableManager(), webappUrl);
Role[] roles = policy.getRoles(identity);
boolean authorized = false,out=false;
- Credential[] credentials = getPolicyManager().getCredentials(getAccreditableManager(), webappUrl);
+ /*
+ * If the policy does not contain any role
+ * that the identity can obtain, we can assume
+ * deny.
+ * */
+ if (roles.length<1)
+ return authorized;
+ Credential[] credentials = policy.getCredentials(identity);
for (int i = 0; i < credentials.length; i++) {
Credential credential = credentials[i];
for (int j = 0; j < roles.length; j++) {
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/URLPolicy.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/URLPolicy.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/URLPolicy.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/URLPolicy.java Mon Aug 21 10:23:45 2006
@@ -27,6 +27,7 @@
import java.util.Set;
import org.apache.lenya.ac.AccessControlException;
+import org.apache.lenya.ac.Accreditable;
import org.apache.lenya.ac.AccreditableManager;
import org.apache.lenya.ac.Credential;
import org.apache.lenya.ac.Identity;
@@ -73,6 +74,8 @@
private Policy[] policies = null;
+ private Credential[] credentials = null;
+
/**
* Obtains the policies from the policy manager. This method is expensive
* and therefore only called when needed.
@@ -87,6 +90,20 @@
}
}
+ /**
+ * Obtains the credentials from the policy manager. This method is expensive
+ * and therefore only called when needed.
+ *
+ * @throws AccessControlException
+ * when something went wrong.
+ */
+ protected void obtainCredentials() throws AccessControlException {
+ if (this.credentials == null) {
+ this.credentials = getPolicyManager().getCredentials(
+ getAccreditableManager(), getUrl());
+ }
+ }
+
static final String[] VISITOR_ROLES = { "visitor", "visit" };
static final String[] ADMINISTRATOR_ROLES = { "administrator", "admin",
@@ -259,34 +276,36 @@
}
public Credential[] getCredentials() throws AccessControlException {
- obtainPolicies();
- Credential[] credential = null;
- if (this.policies != null) {
- int credentialCount = 0;
- String hit = "";
- int i = 0;
- while (i < this.policies.length) {
- Credential[] temp = this.policies[i].getCredentials();
- credentialCount = +temp.length;
- if (credentialCount > 0) {
- hit += ":" + i;
- }
- i++;
- }
- if (hit.length() > 0) {
- credential = new Credential[credentialCount];
- String[] token = hit.split(":");
- for (int j = 0; j < token.length; j++) {
- if (token[j].length() > 0) {
- // fixme: implement!!!
- // Credential[] temp= this.policies[j].getCredentials();
- credential = this.policies[j].getCredentials();
- }
+ obtainCredentials();
+ Set credentials = new LinkedHashSet();
+
+ for (int accrIndex = 0; accrIndex < this.credentials.length; accrIndex++) {
+ credentials.add(this.credentials[accrIndex]);
+ }
+ return (Credential[]) credentials.toArray(new Credential[credentials
+ .size()]);
+ }
+
+ public Credential[] getCredentials(Identity identity)
+ throws AccessControlException {
+ Accreditable[] accreditables = identity.getAccreditables();
+ Credential[] credentials = getCredentials();
+ Set returnCredential = new LinkedHashSet();
+
+ for (int credIndex = 0; credIndex < credentials.length; credIndex++) {
+ Credential credential = credentials[credIndex];
+
+ for (int accrIndex = 0; accrIndex < accreditables.length; accrIndex++) {
+ Accreditable accreditable = accreditables[accrIndex];
+
+ if (credential.getAccreditable().equals(accreditable)) {
+ returnCredential.add(credential);
}
}
}
- return credential;
+ return (Credential[]) returnCredential
+ .toArray(new Credential[returnCredential.size()]);
}
}
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/administration/java/src/org/apache/lenya/cms/ac/usecases/AccessControl.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/administration/java/src/org/apache/lenya/cms/ac/usecases/AccessControl.java?rev=433294&r1=433293&r2=433294&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/administration/java/src/org/apache/lenya/cms/ac/usecases/AccessControl.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/administration/java/src/org/apache/lenya/cms/ac/usecases/AccessControl.java Mon Aug 21 10:23:45 2006
@@ -440,9 +440,14 @@
ModifiablePolicy policies[] = getPolicies(urlOnly, inherit);
List policyCredentials = new ArrayList();
for (int i = 0; i < policies.length; i++) {
- Credential[] creds = policies[i].getCredentials();
- for (int j = 0; j < creds.length; j++) {
- policyCredentials.add(creds[j]);
+ Credential[] creds;
+ try {
+ creds = policies[i].getCredentials();
+ for (int j = 0; j < creds.length; j++) {
+ policyCredentials.add(creds[j]);
+ }
+ } catch (AccessControlException e) {
+ throw new ProcessingException("AccessControlException - receiving credential failed: ", e);
}
}
for (Iterator i = policyCredentials.iterator(); i.hasNext();) {
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@lenya.apache.org
For additional commands, e-mail: commits-help@lenya.apache.org