You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Ken in Nashua <kc...@live.com> on 2013/03/21 14:40:20 UTC
adding roles and adding permissions
Folks, My domain model it thoroughly fortified with java code to supply sufficient roles and perms. So in my authentication method I attempt to add them. Can someone confirm this for me? My security model is simple...psuedo semantics follow:here are my users - administrator - anonymous here are my roles - administrator - anonymous here are my perms - create - read - update - delete Les said name collisions are fine with the above. But in my code I attempt to add these into shiro during authorization as follows. PERMS Question: do I need to embellish and manipulate the strings as they are added ? you know like CLASS:PERM:INSTANCE as in String permString = "*:" + permission.name() + ":*";
or will shiro take care of this for me? can I just add it like String permString = permission.name();
if (!principals.fromRealm(getName()).isEmpty()) info.addStringPermission(permString);
Is there any difference in adding roles? Or can I just throw the string at shiro and be done with it? This is how I am doing it...
// do roles
Set<String> rroles = new HashSet<String>(user.getRoles().size());
Set<Role> roles = user.getRoles();
for (Role role : roles)
rroles.add(role.name());
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(rroles);
// do permissions
Set<Permission> permissions = user.getPermissions();
for (Permission permission : permissions) {
//String permString = "*:" + permission.name() + ":*";
String permString = permission.name();
if (!principals.fromRealm(getName()).isEmpty()) info.addStringPermission(permString);
}
return info;
} below is my full method -----------------------------------------protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals)
{
if (principals == null)
throw new AuthorizationException("PrincipalCollection was null, which should not happen"); if (principals.isEmpty())
{
System.out.println("principals collection is empty");
return null;
}
if (principals.fromRealm(getName()).size() <= 0)
{
System.out.println("principals from realm collection is empty");
return null;
}
Person user = applicationStateManager.get(Person.class);
// do roles
Set<String> rroles = new HashSet<String>(user.getRoles().size());
Set<Role> roles = user.getRoles();
for (Role role : roles)
rroles.add(role.name());
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(rroles);
// do permissions
Set<Permission> permissions = user.getPermissions();
for (Permission permission : permissions) {
//String permString = "*:" + permission.name() + ":*";
String permString = permission.name();
if (!principals.fromRealm(getName()).isEmpty()) info.addStringPermission(permString);
}
return info;
}
RE: adding roles and adding permissions
Posted by Ken in Nashua <kc...@live.com>.
Well this is my shiro configuration.
The fact that i decided to operate CLASS:PERM:INSTANCE as *:PERM:*
leaves me to believe that the following shiro configuration is sufficient?
configuration.add(factory.createChain("/roles/anonymous/**").add(factory.roles(), "anonymous").build());
configuration.add(factory.createChain("/roles/administrator/**").add(factory.roles(), "administrator").build());
configuration.add(factory.createChain("/perms/create/**").add(factory.perms(), "*:create:*").build());
configuration.add(factory.createChain("/perms/read/**").add(factory.perms(), "*:read:*").build());
configuration.add(factory.createChain("/perms/update/**").add(factory.perms(), "*:update:*").build());
configuration.add(factory.createChain("/perms/delete/**").add(factory.perms(), "*:delete:*").build());
configuration.add(factory.createChain("/authc/**").add(factory.authc()).build());
Do i need to add fixtures to the configuration for my TeamYear class? or other classes for that matter ?
Thanks for any tips.
I guess I am wondering if I need to tell shiro anything else.
But that still doesnt explain to me why tapestry-security service is not getting triggered.
RE: adding roles and adding permissions
Posted by Ken in Nashua <kc...@live.com>.
: )
Not my code... my mistake when I said OUR. It belongs to a filter/interceptor expert.
I am just trying to present myself to the shiro group for assistance.
What I am finding is the roles can be added as-is.
Perms could either be added in as-is ... or with CLASS:PERM:INSTANCE
But my main issue is... I built with tapestry-security framework...
and the security service I posted isn't even being called
???
Is anyone out there using tapestry-security?
I included it in my pom and referring to it in my AppModule.JAVA
I am not sure what else I need to do to get that service to work.
Thanks for any assistance.
RE: adding roles and adding permissions
Posted by NabbleSometimesSucks <bi...@yahoo.com>.
I am sorry, but why do you have that service class which is just
re-implementing all the SecurityUtils and Subject methods???
Typically in your web tier you only have two or three lines needed to
getSubject from SecurityUtils and a call to Subject login() if
subject.isAuthenticated returns false. And now you are authenticated for
their session. So no need to call those methods ever again for that user.
Then you set methods or URLs to Roles or Permission either with annotations
or other configuration. So to me that service class would be rarely if ever
used.
Also, (which I am basing this on Spring Security) why is a Domain object
annotated with those annotations, typically those annotations would show up
on URLs mapping or in a Use Case class. So that domain object you have
annotations with would never be looked at, it would be the service method
that edits the domain object that would have the annotations. So since they
don't have them in your code, then anyone will be able to call the service
edit method on any domain object.
Just my 2 cents. It is ok to tell me to shut up, I won't mind.
Thanks and good luck
Mark
--
View this message in context: http://shiro-user.582556.n2.nabble.com/adding-roles-and-adding-permissions-tp7578488p7578502.html
Sent from the Shiro User mailing list archive at Nabble.com.
RE: adding roles and adding permissions
Posted by Ken in Nashua <kc...@live.com>.
Ok... this kinda scares me now... because its telling me shiro isnt doing anything internally.
Our framework has annotations like the following:
@Entity
@RequiresAuthentication
@RequiresRoles("administrator")
@RequiresPermissions("create, read, update, delete")
public class TeamYear implements Cloneable, Serializable {
..
}
But when Iog in as anonymous... anonymous is allowed to edit this guy when he shouldnt.
Not sure what to think...
Here is our security service implementation...
/*
* Licensed to the Apache Software Foundation (ASF) under one or more contributor license
* agreements. See the NOTICE file distributed with this work for additional information regarding
* copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with the License. You may obtain
* a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License
* is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
* or implied. See the License for the specific language governing permissions and limitations
* under the License.
*/
package org.tynamo.security.services.impl;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;
import org.tynamo.security.services.SecurityService;
/**
* DOCUMENT ME!
*
* @see SecurityService
*/
public class SecurityServiceImpl implements SecurityService
{
/**
* Delimeter that separates role names in tag attribute
*/
@SuppressWarnings("unused")
private static final String ROLE_NAMES_DELIMETER = ",";
/**
* Delimiter used for permissions, i.e. a |
*/
private static final String PERMISSIONS_DELIMETER = "\\|";
/**
* Delimited used for roles that allows , or |
*/
private static final String PERMISSIONS_OR_ROLES_DELIMETER = "(,|\\|)";
// public SecurityServiceImpl(@Autobuild TapestryRealmSecurityManager securityManager) {
// this.securityManager = securityManager;
// }
@Override
public Subject getSubject()
{
return SecurityUtils.getSubject();
}
@Override
public boolean isAuthenticated()
{
Subject subject = getSubject();
return (subject != null) && subject.isAuthenticated();
}
@Override
public boolean isNotAuthenticated()
{
Subject subject = getSubject();
return (subject == null) || !subject.isAuthenticated();
}
@Override
public boolean isUser()
{
Subject subject = getSubject();
return (subject != null) && (subject.getPrincipal() != null);
}
@Override
public boolean isGuest()
{
Subject subject = getSubject();
return (subject == null) || (subject.getPrincipal() == null);
}
@Override
public boolean hasAnyRoles(String roles)
{
boolean hasAnyRole = false;
Subject subject = getSubject();
if (subject != null)
{
// Iterate through roles and check to see if the user has one of the roles
for (String role : roles.split(PERMISSIONS_OR_ROLES_DELIMETER))
{
if (subject.hasRole(role.trim()))
{
hasAnyRole = true;
break;
}
}
}
return hasAnyRole;
}
@Override
public boolean hasAllRoles(String roles)
{
boolean hasAllRole = false; // no subject is false
Subject subject = getSubject();
if (subject != null)
{
hasAllRole = true; // but no roles is true
// Iterate through roles and check to see if the user has one of the roles
for (String role : roles.split(PERMISSIONS_OR_ROLES_DELIMETER))
{
if (!subject.hasRole(role.trim()))
{
hasAllRole = false;
break;
}
}
}
return hasAllRole;
}
@Override
public boolean hasAllPermissions(String permissions)
{
boolean hasAllPermissions = false; // no subject is false
Subject subject = getSubject();
if (subject != null)
{
return subject.isPermittedAll(permissions.split(PERMISSIONS_DELIMETER));
}
return hasAllPermissions;
}
@Override
public boolean hasAnyPermissions(String permissions)
{
boolean hasAnyPermissions = false;
Subject subject = getSubject();
if (subject != null)
{
// Iterate through roles and check to see if the user has one of the roles
for (String role : permissions.split(PERMISSIONS_DELIMETER))
{
if (subject.isPermitted(role.trim()))
{
hasAnyPermissions = true;
break;
}
}
}
return hasAnyPermissions;
}
@Override
public boolean hasPermission(String permission)
{
Subject subject = getSubject();
return (subject != null) && subject.isPermitted(permission);
}
@Override
public boolean hasRole(String role)
{
Subject subject = getSubject();
return (subject != null) && subject.hasRole(role);
}
@Override
public boolean isLacksPermission(String permission)
{
return !hasPermission(permission);
}
@Override
public boolean isLacksRole(String role)
{
return !hasRole(role);
}
}
???
Re: adding roles and adding permissions
Posted by Jared Bunting <ja...@peachjean.com>.
In general, at a first glance, this seems fine.
> String permString = "*:" + permission.name() + ":*";
>
This is my only concern. The interesting question to ask here is, "what
permissions does your application pass in isPermitted() method calls?". If
you are making calls like 'securityManager.isPermitted("create")' then you
simply want to do:
String permString = permission.name();
On the other hand, if you are making calls like
'securityManager.isPermitted("webpage:create:47")' then you want what you
have. Shiro does not dictate the CLASS:PERM:INSTANCE structure - it is
merely one suggested approach.
Re: adding roles and adding permissions
Posted by NabbleSometimesSucks <bi...@yahoo.com>.
Yes, that looks correct to me.
In my code, I instantiate a SimpleAccount instead of
SimpleAuthorizationInfo, but it looks like the same basic code.
So yes, just use the strings to add to the collections.
Mark
--
View this message in context: http://shiro-user.582556.n2.nabble.com/adding-roles-and-adding-permissions-tp7578488p7578490.html
Sent from the Shiro User mailing list archive at Nabble.com.