You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2017/03/30 13:33:14 UTC
svn commit: r1789527 - in /jackrabbit/oak/trunk/oak-core/src:
main/java/org/apache/jackrabbit/oak/security/user/
test/java/org/apache/jackrabbit/oak/security/user/
Author: angela
Date: Thu Mar 30 13:33:14 2017
New Revision: 1789527
URL: http://svn.apache.org/viewvc?rev=1789527&view=rev
Log:
OAK-6012 : Add annotation with ImpersonationImpl
OAK-5882 : Improve coverage for oak.security code in oak-core (wip)
Added:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplEmptyTest.java (with props)
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplTest.java (with props)
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/ImpersonationImpl.java
Modified: jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/ImpersonationImpl.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/ImpersonationImpl.java?rev=1789527&r1=1789526&r2=1789527&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/ImpersonationImpl.java (original)
+++ jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/ImpersonationImpl.java Thu Mar 30 13:33:14 2017
@@ -20,6 +20,8 @@ import java.security.Principal;
import java.security.acl.Group;
import java.util.HashSet;
import java.util.Set;
+import javax.annotation.CheckForNull;
+import javax.annotation.Nonnull;
import javax.jcr.RepositoryException;
import javax.security.auth.Subject;
@@ -50,7 +52,7 @@ class ImpersonationImpl implements Imper
private final UserImpl user;
private final PrincipalManager principalManager;
- ImpersonationImpl(UserImpl user) throws RepositoryException {
+ ImpersonationImpl(@Nonnull UserImpl user) throws RepositoryException {
this.user = user;
this.principalManager = user.getUserManager().getPrincipalManager();
}
@@ -60,6 +62,7 @@ class ImpersonationImpl implements Imper
/**
* @see org.apache.jackrabbit.api.security.user.Impersonation#getImpersonators()
*/
+ @Nonnull
@Override
public PrincipalIterator getImpersonators() throws RepositoryException {
Set<String> impersonators = getImpersonatorNames();
@@ -84,7 +87,7 @@ class ImpersonationImpl implements Imper
* @see org.apache.jackrabbit.api.security.user.Impersonation#grantImpersonation(Principal)
*/
@Override
- public boolean grantImpersonation(Principal principal) throws RepositoryException {
+ public boolean grantImpersonation(@Nonnull Principal principal) throws RepositoryException {
if (!isValidPrincipal(principal)) {
return false;
}
@@ -110,7 +113,7 @@ class ImpersonationImpl implements Imper
* @see Impersonation#revokeImpersonation(java.security.Principal)
*/
@Override
- public boolean revokeImpersonation(Principal principal) throws RepositoryException {
+ public boolean revokeImpersonation(@Nonnull Principal principal) throws RepositoryException {
String pName = principal.getName();
Tree userTree = user.getTree();
@@ -127,7 +130,7 @@ class ImpersonationImpl implements Imper
* @see Impersonation#allows(javax.security.auth.Subject)
*/
@Override
- public boolean allows(Subject subject) throws RepositoryException {
+ public boolean allows(@CheckForNull Subject subject) throws RepositoryException {
if (subject == null) {
return false;
}
@@ -151,11 +154,13 @@ class ImpersonationImpl implements Imper
}
//------------------------------------------------------------< private >---
+ @Nonnull
private Set<String> getImpersonatorNames() {
return getImpersonatorNames(user.getTree());
}
- private Set<String> getImpersonatorNames(Tree userTree) {
+ @Nonnull
+ private Set<String> getImpersonatorNames(@Nonnull Tree userTree) {
Set<String> princNames = new HashSet<String>();
PropertyState impersonators = userTree.getProperty(REP_IMPERSONATORS);
if (impersonators != null) {
@@ -166,7 +171,7 @@ class ImpersonationImpl implements Imper
return princNames;
}
- private void updateImpersonatorNames(Tree userTree, Set<String> principalNames) {
+ private void updateImpersonatorNames(@Nonnull Tree userTree, @Nonnull Set<String> principalNames) {
if (principalNames == null || principalNames.isEmpty()) {
userTree.removeProperty(REP_IMPERSONATORS);
} else {
@@ -174,7 +179,7 @@ class ImpersonationImpl implements Imper
}
}
- private boolean isAdmin(Principal principal) {
+ private boolean isAdmin(@Nonnull Principal principal) {
if (principal instanceof AdminPrincipal) {
return true;
} else if (principal instanceof Group) {
@@ -190,7 +195,7 @@ class ImpersonationImpl implements Imper
}
}
- private boolean isValidPrincipal(Principal principal) {
+ private boolean isValidPrincipal(@Nonnull Principal principal) {
Principal p = null;
// shortcut for TreeBasedPrincipal
if (principal instanceof TreeBasedPrincipal) {
Added: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplEmptyTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplEmptyTest.java?rev=1789527&view=auto
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplEmptyTest.java (added)
+++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplEmptyTest.java Thu Mar 30 13:33:14 2017
@@ -0,0 +1,221 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.user;
+
+import java.security.Principal;
+import java.util.Enumeration;
+import java.util.UUID;
+
+import javax.jcr.RepositoryException;
+import javax.security.auth.Subject;
+
+import com.google.common.collect.ImmutableSet;
+import org.apache.jackrabbit.api.security.user.Group;
+import org.apache.jackrabbit.api.security.user.User;
+import org.apache.jackrabbit.oak.AbstractSecurityTest;
+import org.apache.jackrabbit.oak.spi.security.principal.AdminPrincipal;
+import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl;
+import org.apache.jackrabbit.oak.spi.security.principal.SystemPrincipal;
+import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
+import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+public class ImpersonationImplEmptyTest extends AbstractSecurityTest {
+
+ final java.security.acl.Group groupPrincipal = new java.security.acl.Group() {
+ @Override
+ public boolean addMember(Principal user) {
+ throw new UnsupportedOperationException();
+ }
+
+ @Override
+ public boolean removeMember(Principal user) {
+ throw new UnsupportedOperationException();
+ }
+
+ @Override
+ public boolean isMember(Principal member) {
+ throw new UnsupportedOperationException();
+ }
+
+ @Override
+ public Enumeration<? extends Principal> members() {
+ throw new UnsupportedOperationException();
+ }
+
+ @Override
+ public String getName() {
+ return "name";
+ }
+ };
+
+ UserImpl user;
+ ImpersonationImpl impersonation;
+
+ @Override
+ public void before() throws Exception {
+ super.before();
+
+ String uid = "u" + UUID.randomUUID();
+ user = (UserImpl) getUserManager(root).createUser(uid, uid);
+ root.commit();
+
+ impersonation = new ImpersonationImpl(user);
+ }
+
+ @Override
+ public void after() throws Exception {
+ try {
+ root.refresh();
+ user.remove();
+ root.commit();
+ } finally {
+ super.after();
+ }
+ }
+
+ private Principal getAdminPrincipal() throws Exception {
+ String id = getConfig(UserConfiguration.class).getParameters().getConfigValue(UserConstants.PARAM_ADMIN_ID, UserConstants.DEFAULT_ADMIN_ID);
+ User adminUser = getUserManager(root).getAuthorizable(id, User.class);
+ assertNotNull(adminUser);
+
+ return adminUser.getPrincipal();
+ }
+
+ @Test
+ public void testGetImpersonators() throws Exception {
+ assertFalse(impersonation.getImpersonators().hasNext());
+ }
+
+ @Test
+ public void testGrantNonExistingPrincipal() throws Exception {
+ assertFalse(impersonation.grantImpersonation(new PrincipalImpl("principal" + UUID.randomUUID())));
+ }
+
+ @Test
+ public void testGrantAdminPrincipal() throws Exception {
+ assertFalse(impersonation.grantImpersonation(new AdminPrincipal() {
+ @Override
+ public String getName() {
+ return "name";
+ }
+ }));
+ }
+
+ @Test
+ public void testGrantAdminPrincipal2() throws Exception {
+ assertFalse(impersonation.grantImpersonation(getAdminPrincipal()));
+ }
+
+ @Test
+ public void testGrantAdminPrincipal3() throws Exception {
+ assertFalse(impersonation.grantImpersonation(new PrincipalImpl(getAdminPrincipal().getName())));
+ }
+
+ @Test
+ public void testGrantSystemPrincipal() throws Exception {
+ assertFalse(impersonation.grantImpersonation(SystemPrincipal.INSTANCE));
+ }
+
+ @Test
+ public void testGrantGroupPrincipal() throws Exception {
+ Group group = getUserManager(root).createGroup("testGroup");
+ try {
+ assertFalse(impersonation.grantImpersonation(group.getPrincipal()));
+ } finally {
+ group.remove();
+ }
+ }
+
+ @Test
+ public void testGrantNonExistingGroupPrincipal() throws Exception {
+ assertFalse(impersonation.grantImpersonation(groupPrincipal));
+ }
+
+ @Test
+ public void testGrantExistingUserPrincipal() throws Exception {
+ assertTrue(impersonation.grantImpersonation(getTestUser().getPrincipal()));
+ }
+
+ @Test
+ public void testGrantAgain() throws Exception {
+ final Principal principal = getTestUser().getPrincipal();
+ impersonation.grantImpersonation(principal);
+
+ assertFalse(impersonation.grantImpersonation(principal));
+ assertFalse(impersonation.grantImpersonation(new PrincipalImpl(principal.getName())));
+ assertFalse(impersonation.grantImpersonation(new Principal() {
+
+ @Override
+ public String getName() {
+ return principal.getName();
+ }
+ }));
+ }
+
+ @Test
+ public void testGrantSelf() throws Exception {
+ assertFalse(impersonation.grantImpersonation(user.getPrincipal()));
+ }
+
+ @Test
+ public void testRevokeNotGranted() throws Exception {
+ assertFalse(impersonation.revokeImpersonation(getTestUser().getPrincipal()));
+ }
+
+ @Test
+ public void testAllowsNull() throws Exception {
+ assertFalse(impersonation.allows(null));
+ }
+
+ @Test
+ public void testAllowsEmpty() throws Exception {
+ assertFalse(impersonation.allows(new Subject()));
+ }
+
+ @Test
+ public void testAllowsGroup() throws Exception {
+ assertFalse(impersonation.allows(new Subject(true, ImmutableSet.of(groupPrincipal), ImmutableSet.of(), ImmutableSet.of())));
+ }
+
+ @Test
+ public void testAllowsAdminPrincipal() throws Exception {
+ Subject subject = new Subject(true, ImmutableSet.of(getAdminPrincipal()), ImmutableSet.of(), ImmutableSet.of());
+ assertTrue(impersonation.allows(subject));
+ }
+
+ @Test
+ public void testAllowsAdminPrincipal2() throws Exception {
+ Subject subject = new Subject(true, ImmutableSet.of(new AdminPrincipal() {
+ @Override
+ public String getName() {
+ return "principalName";
+ }
+ }), ImmutableSet.of(), ImmutableSet.of());
+ assertTrue(impersonation.allows(subject));
+ }
+
+ @Test
+ public void testAllowsSystemPrincipal() throws Exception {
+ Subject subject = new Subject(true, ImmutableSet.of(SystemPrincipal.INSTANCE), ImmutableSet.of(), ImmutableSet.of());
+ assertFalse(impersonation.allows(subject));
+ }
+}
\ No newline at end of file
Propchange: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplEmptyTest.java
------------------------------------------------------------------------------
svn:eol-style = native
Added: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplTest.java?rev=1789527&view=auto
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplTest.java (added)
+++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplTest.java Thu Mar 30 13:33:14 2017
@@ -0,0 +1,143 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.user;
+
+import java.security.Principal;
+import java.util.Set;
+import java.util.UUID;
+
+import javax.jcr.RepositoryException;
+import javax.security.auth.Subject;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Iterators;
+import org.apache.jackrabbit.api.security.principal.PrincipalIterator;
+import org.apache.jackrabbit.api.security.user.User;
+import org.apache.jackrabbit.oak.api.PropertyState;
+import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.api.Type;
+import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+public class ImpersonationImplTest extends ImpersonationImplEmptyTest {
+
+ private User impersonator;
+
+ @Override
+ public void before() throws Exception {
+ super.before();
+
+ impersonator = getUserManager(root).createUser("impersonator" + UUID.randomUUID().toString(), null);
+ impersonation.grantImpersonation(impersonator.getPrincipal());
+ root.commit();
+ }
+
+ @Override
+ public void after() throws Exception {
+ try {
+ root.refresh();
+ impersonator.remove();
+ root.commit();
+ } finally {
+ super.after();
+ }
+ }
+
+ @Test
+ public void testGetImpersonators() throws Exception {
+ PrincipalIterator it = impersonation.getImpersonators();
+ assertTrue(it.hasNext());
+ assertTrue(Iterators.contains(it, impersonator.getPrincipal()));
+ }
+
+ @Test
+ public void testGetImpersonatorsImpersonatorRemoved() throws Exception {
+ Principal p = impersonator.getPrincipal();
+ impersonator.remove();
+
+ PrincipalIterator it = impersonation.getImpersonators();
+ assertTrue(it.hasNext());
+ assertTrue(Iterators.contains(it, p));
+ }
+
+ @Test
+ public void testContentRepresentation() throws Exception {
+ Tree tree = root.getTree(user.getPath());
+
+ PropertyState property = tree.getProperty(UserConstants.REP_IMPERSONATORS);
+ assertNotNull(property);
+ assertEquals(ImmutableList.of(impersonator.getPrincipal().getName()), property.getValue(Type.STRINGS));
+ }
+
+ @Test
+ public void testAllows() throws Exception {
+ Subject s = new Subject(true, ImmutableSet.of(impersonator.getPrincipal()), ImmutableSet.of(), ImmutableSet.of());
+ assertTrue(impersonation.allows(s));
+ }
+
+ @Test
+ public void testAllowsIncludingNonExistingGroup() throws Exception {
+ Subject s = new Subject(true, ImmutableSet.of(impersonator.getPrincipal(), groupPrincipal), ImmutableSet.of(), ImmutableSet.of());
+ assertTrue(impersonation.allows(s));
+ }
+
+ @Test
+ public void testAllowsImpersonatorRemoved() throws Exception {
+ Subject s = new Subject(true, ImmutableSet.of(impersonator.getPrincipal()), ImmutableSet.of(), ImmutableSet.of());
+
+ impersonator.remove();
+ assertTrue(impersonation.allows(s));
+ }
+
+ @Test
+ public void testRevoke() throws Exception {
+ assertTrue(impersonation.revokeImpersonation(impersonator.getPrincipal()));
+ }
+
+ @Test
+ public void testContentRepresentationAfterModification() throws Exception {
+ Principal principal2 = getTestUser().getPrincipal();
+ impersonation.grantImpersonation(principal2);
+
+ Tree tree = root.getTree(user.getPath());
+
+ PropertyState property = tree.getProperty(UserConstants.REP_IMPERSONATORS);
+ assertNotNull(property);
+
+ Set<String> expected = ImmutableSet.of(impersonator.getPrincipal().getName(), principal2.getName());
+ assertEquals(expected, ImmutableSet.copyOf(property.getValue(Type.STRINGS)));
+
+ impersonation.revokeImpersonation(impersonator.getPrincipal());
+
+ property = tree.getProperty(UserConstants.REP_IMPERSONATORS);
+ assertNotNull(property);
+
+ expected = ImmutableSet.of(principal2.getName());
+ assertEquals(expected, ImmutableSet.copyOf(property.getValue(Type.STRINGS)));
+
+ impersonation.revokeImpersonation(principal2);
+ assertNull(tree.getProperty(UserConstants.REP_IMPERSONATORS));
+ }
+
+}
\ No newline at end of file
Propchange: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ImpersonationImplTest.java
------------------------------------------------------------------------------
svn:eol-style = native