You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Mark <el...@gmail.com> on 2015/09/09 05:54:54 UTC
Dynamic Authorization
I am working on a system that will store records in a database and I would
like to manage the access of these records using Shiro. The user will
determine the access when the record is created (User Read/Write, Group
Read/Write, World Read/Write). The group information is coming from roles
that are already defined in LDAP and I can obtain.
So I want to set the security permission, for instance
record:UserOnlyReadWrite, when the record is created and then when a user
comes along and tries to access this record I can use Shiro to determine if
the user has access. In this case another user would not.
Is this something that is feasible with Shiro? If so, are there use cases
for this or supporting documentation I can follow?
Re: Dynamic Authorization
Posted by Tomas Lund Petersen <ko...@gmail.com>.
Well you don't have to assign permissions dynamically. You just have to
know at run-time which permission you are checking for.
You say you want to check if user D has access to object QRS. Then your
permission would be "access:QRS"
you would have to change at run-time the string to match the object you are
trying to access.
I have my permissions in a jdbc realm so its a little bit different from
yours but the idea is there.
Maybe this will help http://shiro.apache.org/permissions.html
Sorry but i'm no expert. what i know is what i have figured out.
Cheers,
Tomas
On Wed, Sep 9, 2015 at 12:39 PM, Mark <el...@gmail.com> wrote:
> I am not interested in using annotations, so we don't need to worry about
> that.
>
> The part I don't understand here is, how can you assign permissions to a
> Subject dynamically?
>
>
>
> On Wed, Sep 9, 2015 at 11:12 AM, Tomas Lund Petersen <
> kotogadekiru@gmail.com> wrote:
>
>> Hi,
>> This is posible and I have done it.
>> But you can't use annotations. You have to manually check for the users
>> permisions using User.isPermited(requidedPermission);
>> For example:
>> f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
>> //do stuff here
>> }else{
>> throw new UnauthorizedException ();
>> }
>> Where requiredPermission must be the permission asociated to access
>> record XYZ or QRS in your example. You will have to look it up Dinamically.
>> Hope it helps,
>> Tomas Lund Petersen
>>
>> On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
>>
>>> Thanks for the information. Would it be possible to set a Subject's
>>> record access at runtime? I'm envisioning the following scenario:
>>>
>>> User A, who is in Group 1 creates a record (XYZ) and only wants to have
>>> full access for themself.
>>> User B, who is also in Group 1 tries to access record XYZ. User B
>>> should be denied.
>>>
>>> User C, who is in Group 1 creates a Record (QRS) wants everyone in their
>>> group to read the record.
>>> User D, who is in Group 1 wants to read record QRS. User D should be
>>> able to read record QRS but not make changes.
>>>
>>> This feels like it should be similar to UNIX file permissions, but I
>>> don't know how to enforce all this at runtime in Shiro. The first scenario
>>> would make the record XYZ have permission of 600, while the permissions on
>>> record QRS would be 660. Maybe I just need a custom class that can
>>> translate this in Shiro. If so, would this require a custom
>>> PermissionResolver?
>>>
>>>
>>>
>>>
>>> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
>>> wrote:
>>>
>>>> You can verify whether a user / role has access to the record by
>>>> including
>>>> these lines at the very beginning of the method which retrieves it from
>>>> your
>>>> database:
>>>> Set<WildcardPermission> permissions = new HashSet<>();
>>>> permissions.add(new WildcardPermission("record:read:user"));
>>>> permissions.add(new WildcardPermission("record:write:user"));
>>>> SecurityUtils.getSubject().checkPermission(permissions);
>>>> // retrieve stuff from database
>>>>
>>>> The checkPermission method will continue on normally when the subject
>>>> has
>>>> the needed permissions and throw an UnauthorizedException if not.
>>>>
>>>> You can also use annotations like
>>>> @RequiresPermissions({"record:read:user",
>>>> "record:write:user"}) but then you cannot define the needed permissions
>>>> dynamically because annotations require constant values - this is *not*
>>>> a
>>>> limitation of Shiro but of annotations.
>>>>
>>>> Have a look at the API to get an idea of what Shiro supports
>>>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>>>
>>>>
>>>>
>>>> --
>>>> View this message in context:
>>>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>>
>>>
>>>
>>
>
Re: Dynamic Authorization
Posted by Alessio Stalla <al...@manydesigns.com>.
On Wed, Sep 9, 2015 at 7:56 PM, Mark <el...@gmail.com> wrote:
> All users are coming from an LDAP server that I do not have the ability to
> modify. Users will authenticate off of the LDAP server which will in turn
> provide the user's Subject instance. Since I cannot modify the user's LDAP
> entry, how can I assign permissions to the user? I can get the list of
> groups(roles) for the user and could use that to populate the
> GroupPermission object, but there's no access info in LDAP for the user so
> I don't know where/how to insert the access that a user needs to complete
> this task.
>
Groups are a detail specific to Portofino; it's just an example. You could
have a UserDatabasePermission object holding just the information you need
to check a user's permissions on a database object, say the user id.
The important point is that Permission is a class, and not just a string; a
class implementing logic ("does permission X imply permission Y?") that you
can subclass and write according to your application's rules.
To add the Permission to the Subject requires a little bit of code in the
Realm:
public AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection
principals) {
...
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(groups);
...
Permission permission = new GroupPermission(groups);
info.setObjectPermissions(Collections.singleton(permission));
...
}
so if you're using the stock LDAPRealm, you'll have to subclass it to add
your special permission object.
>
> On Wed, Sep 9, 2015 at 11:57 AM, Alessio Stalla <
> alessio.stalla@manydesigns.com> wrote:
>
>> On Wed, Sep 9, 2015 at 5:39 PM, Mark <el...@gmail.com> wrote:
>>
>>> I am not interested in using annotations, so we don't need to worry
>>> about that.
>>>
>>> The part I don't understand here is, how can you assign permissions to a
>>> Subject dynamically?
>>>
>>
>> As far as I know, you can't. What you can do is to have your own, dynamic
>> subclass of Permission. Your users will have a fixed set of permissions -
>> they could be a single permissions object, or Read/Write or whatever,
>> depending on the granularity you want to achieve. Those will, however,
>> dynamically imply a variable set of permissions that reflect your data.
>>
>> An example will perhaps make it clearer. In Portofino[*], we have users
>> with groups (roles) and an application made of pages which can be
>> dynamically added, removed, moved around etc. Each page has its own
>> permission setup - for example, /home will be readable by anyone, while
>> /admin only by administrators, and /home/profile only by authenticated
>> users. Page permissions can be changed dynamically as well and can be
>> inherited from parent pages. So, computing permissions statically when the
>> user logs in is not possible.
>> Thus, each user is assigned a single Permission object which contains all
>> their groups.
>> http://sourceforge.net/p/portofino/mercurial/ci/default/tree/portofino-pageactions/src/main/java/com/manydesigns/portofino/shiro/GroupPermission.java
>> Each page, on the other hand, is associated to a PagePermission object.
>> http://sourceforge.net/p/portofino/mercurial/ci/default/tree/portofino-pageactions/src/main/java/com/manydesigns/portofino/shiro/PagePermission.java
>> That object holds the actual permissions for that page, computed for each
>> web request according to inheritance. The magic happens in
>> GroupPermission.implies, which is called against the user's permissions and
>> the page's declared permissions. So, in the end, user code only has to do
>>
>> PagePermission pagePermission = new PagePermission(...);
>> if(subject.isPermitted(pagePermission)) {
>> ...
>> }
>>
>> Hope this helps.
>>
>> PS we do use annotations as well, because our data happens to be code
>> (for the pages' methods). However, that won't be your case.
>>
>> [*] our web application framework, http://portofino.manydesigns.com
>>
>>
>>> On Wed, Sep 9, 2015 at 11:12 AM, Tomas Lund Petersen <
>>> kotogadekiru@gmail.com> wrote:
>>>
>>>> Hi,
>>>> This is posible and I have done it.
>>>> But you can't use annotations. You have to manually check for the users
>>>> permisions using User.isPermited(requidedPermission);
>>>> For example:
>>>> f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
>>>> //do stuff here
>>>> }else{
>>>> throw new UnauthorizedException ();
>>>> }
>>>> Where requiredPermission must be the permission asociated to access
>>>> record XYZ or QRS in your example. You will have to look it up Dinamically.
>>>> Hope it helps,
>>>> Tomas Lund Petersen
>>>>
>>>> On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
>>>>
>>>>> Thanks for the information. Would it be possible to set a Subject's
>>>>> record access at runtime? I'm envisioning the following scenario:
>>>>>
>>>>> User A, who is in Group 1 creates a record (XYZ) and only wants to
>>>>> have full access for themself.
>>>>> User B, who is also in Group 1 tries to access record XYZ. User B
>>>>> should be denied.
>>>>>
>>>>> User C, who is in Group 1 creates a Record (QRS) wants everyone in
>>>>> their group to read the record.
>>>>> User D, who is in Group 1 wants to read record QRS. User D should be
>>>>> able to read record QRS but not make changes.
>>>>>
>>>>> This feels like it should be similar to UNIX file permissions, but I
>>>>> don't know how to enforce all this at runtime in Shiro. The first scenario
>>>>> would make the record XYZ have permission of 600, while the permissions on
>>>>> record QRS would be 660. Maybe I just need a custom class that can
>>>>> translate this in Shiro. If so, would this require a custom
>>>>> PermissionResolver?
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
>>>>> wrote:
>>>>>
>>>>>> You can verify whether a user / role has access to the record by
>>>>>> including
>>>>>> these lines at the very beginning of the method which retrieves it
>>>>>> from your
>>>>>> database:
>>>>>> Set<WildcardPermission> permissions = new HashSet<>();
>>>>>> permissions.add(new WildcardPermission("record:read:user"));
>>>>>> permissions.add(new WildcardPermission("record:write:user"));
>>>>>> SecurityUtils.getSubject().checkPermission(permissions);
>>>>>> // retrieve stuff from database
>>>>>>
>>>>>> The checkPermission method will continue on normally when the subject
>>>>>> has
>>>>>> the needed permissions and throw an UnauthorizedException if not.
>>>>>>
>>>>>> You can also use annotations like
>>>>>> @RequiresPermissions({"record:read:user",
>>>>>> "record:write:user"}) but then you cannot define the needed
>>>>>> permissions
>>>>>> dynamically because annotations require constant values - this is
>>>>>> *not* a
>>>>>> limitation of Shiro but of annotations.
>>>>>>
>>>>>> Have a look at the API to get an idea of what Shiro supports
>>>>>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> View this message in context:
>>>>>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>>>>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>>>>
>>>>>
>>>>>
>>>>
>>>
>>
>>
>> --
>> *Alessio Stalla* | Software Architect
>> M: +39 340 7824743 | T: +39 010 566441 | F: +39 010 8900455
>> alessio.stalla@manydesigns.com | www.manydesigns.com
>>
>> MANYDESIGNS s.r.l.
>> Via G. D'Annunzio, 2/51 | 16121 Genova (GE) | Italy
>>
>
>
--
*Alessio Stalla* | Software Architect
M: +39 340 7824743 | T: +39 010 566441 | F: +39 010 8900455
alessio.stalla@manydesigns.com | www.manydesigns.com
MANYDESIGNS s.r.l.
Via G. D'Annunzio, 2/51 | 16121 Genova (GE) | Italy
Re: Dynamic Authorization
Posted by scSynergy <ro...@scsynergy.de>.
"I can get the list of groups(roles) for the user and could use that to
populate the GroupPermission object, but there's no access info in LDAP for
the user so I don't know where/how to insert the access that a user needs to
complete this task."
You might be able to use a RolePermissionResolver to retrieve permissions
from some other data store (other LDAP branch or database) and map them to
the roles from the LDAP - here is an example I wrote for Active Directory (I
do not know whether LDAP realms can use RolePermissionResolvers):
rolePermissionResolver =
de.scsynergy.shiro.ActiveDirectoryRolePermissionResolver
rolePermissionResolver.tenantId = something
activeDirectoryRealm.rolePermissionResolver = $rolePermissionResolver
-------------------------------------------------------------------------------------------------------------------------
package de.scsynergy.elementary.qi.shiro;
import de.scsynergy.elementary.qi.Compendium;
import de.scsynergy.elementary.qi.QiFacade;
import de.scsynergy.elementary.qi.Role;
import java.util.ArrayList;
import java.util.Collection;
import javax.inject.Inject;
import org.apache.shiro.authz.Permission;
import org.apache.shiro.authz.permission.RolePermissionResolver;
import org.ops4j.pax.shiro.cdi.ShiroIni;
/**
*
* @author rf
*/
@ShiroIni
public class ActiveDirectoryRolePermissionResolver implements
RolePermissionResolver {
@Inject
private Compendium compendium;
@Inject
private QiFacade facade;
private String tenantidentifier = null;
public ActiveDirectoryRolePermissionResolver() {
}
@Override
public Collection<Permission> resolvePermissionsInRole(String
roleString) {
Collection<Permission> permissions = new ArrayList<>();
if (this.tenantidentifier != null) {
Role role = facade.getNamedRole(roleString,
compendium.getTenantId(), compendium.getUser());
if (role != null) {
permissions.addAll(role.getPermissions());
}
}
return permissions;
}
public String getIdentifier() {
return tenantidentifier;
}
public void setIdentifier(String tenantidentifier) {
this.tenantidentifier = tenantidentifier;
}
}
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580723.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Dynamic Authorization
Posted by Mark <el...@gmail.com>.
All users are coming from an LDAP server that I do not have the ability to
modify. Users will authenticate off of the LDAP server which will in turn
provide the user's Subject instance. Since I cannot modify the user's LDAP
entry, how can I assign permissions to the user? I can get the list of
groups(roles) for the user and could use that to populate the
GroupPermission object, but there's no access info in LDAP for the user so
I don't know where/how to insert the access that a user needs to complete
this task.
On Wed, Sep 9, 2015 at 11:57 AM, Alessio Stalla <
alessio.stalla@manydesigns.com> wrote:
> On Wed, Sep 9, 2015 at 5:39 PM, Mark <el...@gmail.com> wrote:
>
>> I am not interested in using annotations, so we don't need to worry about
>> that.
>>
>> The part I don't understand here is, how can you assign permissions to a
>> Subject dynamically?
>>
>
> As far as I know, you can't. What you can do is to have your own, dynamic
> subclass of Permission. Your users will have a fixed set of permissions -
> they could be a single permissions object, or Read/Write or whatever,
> depending on the granularity you want to achieve. Those will, however,
> dynamically imply a variable set of permissions that reflect your data.
>
> An example will perhaps make it clearer. In Portofino[*], we have users
> with groups (roles) and an application made of pages which can be
> dynamically added, removed, moved around etc. Each page has its own
> permission setup - for example, /home will be readable by anyone, while
> /admin only by administrators, and /home/profile only by authenticated
> users. Page permissions can be changed dynamically as well and can be
> inherited from parent pages. So, computing permissions statically when the
> user logs in is not possible.
> Thus, each user is assigned a single Permission object which contains all
> their groups.
> http://sourceforge.net/p/portofino/mercurial/ci/default/tree/portofino-pageactions/src/main/java/com/manydesigns/portofino/shiro/GroupPermission.java
> Each page, on the other hand, is associated to a PagePermission object.
> http://sourceforge.net/p/portofino/mercurial/ci/default/tree/portofino-pageactions/src/main/java/com/manydesigns/portofino/shiro/PagePermission.java
> That object holds the actual permissions for that page, computed for each
> web request according to inheritance. The magic happens in
> GroupPermission.implies, which is called against the user's permissions and
> the page's declared permissions. So, in the end, user code only has to do
>
> PagePermission pagePermission = new PagePermission(...);
> if(subject.isPermitted(pagePermission)) {
> ...
> }
>
> Hope this helps.
>
> PS we do use annotations as well, because our data happens to be code (for
> the pages' methods). However, that won't be your case.
>
> [*] our web application framework, http://portofino.manydesigns.com
>
>
>> On Wed, Sep 9, 2015 at 11:12 AM, Tomas Lund Petersen <
>> kotogadekiru@gmail.com> wrote:
>>
>>> Hi,
>>> This is posible and I have done it.
>>> But you can't use annotations. You have to manually check for the users
>>> permisions using User.isPermited(requidedPermission);
>>> For example:
>>> f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
>>> //do stuff here
>>> }else{
>>> throw new UnauthorizedException ();
>>> }
>>> Where requiredPermission must be the permission asociated to access
>>> record XYZ or QRS in your example. You will have to look it up Dinamically.
>>> Hope it helps,
>>> Tomas Lund Petersen
>>>
>>> On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
>>>
>>>> Thanks for the information. Would it be possible to set a Subject's
>>>> record access at runtime? I'm envisioning the following scenario:
>>>>
>>>> User A, who is in Group 1 creates a record (XYZ) and only wants to have
>>>> full access for themself.
>>>> User B, who is also in Group 1 tries to access record XYZ. User B
>>>> should be denied.
>>>>
>>>> User C, who is in Group 1 creates a Record (QRS) wants everyone in
>>>> their group to read the record.
>>>> User D, who is in Group 1 wants to read record QRS. User D should be
>>>> able to read record QRS but not make changes.
>>>>
>>>> This feels like it should be similar to UNIX file permissions, but I
>>>> don't know how to enforce all this at runtime in Shiro. The first scenario
>>>> would make the record XYZ have permission of 600, while the permissions on
>>>> record QRS would be 660. Maybe I just need a custom class that can
>>>> translate this in Shiro. If so, would this require a custom
>>>> PermissionResolver?
>>>>
>>>>
>>>>
>>>>
>>>> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
>>>> wrote:
>>>>
>>>>> You can verify whether a user / role has access to the record by
>>>>> including
>>>>> these lines at the very beginning of the method which retrieves it
>>>>> from your
>>>>> database:
>>>>> Set<WildcardPermission> permissions = new HashSet<>();
>>>>> permissions.add(new WildcardPermission("record:read:user"));
>>>>> permissions.add(new WildcardPermission("record:write:user"));
>>>>> SecurityUtils.getSubject().checkPermission(permissions);
>>>>> // retrieve stuff from database
>>>>>
>>>>> The checkPermission method will continue on normally when the subject
>>>>> has
>>>>> the needed permissions and throw an UnauthorizedException if not.
>>>>>
>>>>> You can also use annotations like
>>>>> @RequiresPermissions({"record:read:user",
>>>>> "record:write:user"}) but then you cannot define the needed permissions
>>>>> dynamically because annotations require constant values - this is
>>>>> *not* a
>>>>> limitation of Shiro but of annotations.
>>>>>
>>>>> Have a look at the API to get an idea of what Shiro supports
>>>>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> View this message in context:
>>>>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>>>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>>>
>>>>
>>>>
>>>
>>
>
>
> --
> *Alessio Stalla* | Software Architect
> M: +39 340 7824743 | T: +39 010 566441 | F: +39 010 8900455
> alessio.stalla@manydesigns.com | www.manydesigns.com
>
> MANYDESIGNS s.r.l.
> Via G. D'Annunzio, 2/51 | 16121 Genova (GE) | Italy
>
Re: Dynamic Authorization
Posted by Alessio Stalla <al...@manydesigns.com>.
On Wed, Sep 9, 2015 at 5:39 PM, Mark <el...@gmail.com> wrote:
> I am not interested in using annotations, so we don't need to worry about
> that.
>
> The part I don't understand here is, how can you assign permissions to a
> Subject dynamically?
>
As far as I know, you can't. What you can do is to have your own, dynamic
subclass of Permission. Your users will have a fixed set of permissions -
they could be a single permissions object, or Read/Write or whatever,
depending on the granularity you want to achieve. Those will, however,
dynamically imply a variable set of permissions that reflect your data.
An example will perhaps make it clearer. In Portofino[*], we have users
with groups (roles) and an application made of pages which can be
dynamically added, removed, moved around etc. Each page has its own
permission setup - for example, /home will be readable by anyone, while
/admin only by administrators, and /home/profile only by authenticated
users. Page permissions can be changed dynamically as well and can be
inherited from parent pages. So, computing permissions statically when the
user logs in is not possible.
Thus, each user is assigned a single Permission object which contains all
their groups.
http://sourceforge.net/p/portofino/mercurial/ci/default/tree/portofino-pageactions/src/main/java/com/manydesigns/portofino/shiro/GroupPermission.java
Each page, on the other hand, is associated to a PagePermission object.
http://sourceforge.net/p/portofino/mercurial/ci/default/tree/portofino-pageactions/src/main/java/com/manydesigns/portofino/shiro/PagePermission.java
That object holds the actual permissions for that page, computed for each
web request according to inheritance. The magic happens in
GroupPermission.implies, which is called against the user's permissions and
the page's declared permissions. So, in the end, user code only has to do
PagePermission pagePermission = new PagePermission(...);
if(subject.isPermitted(pagePermission)) {
...
}
Hope this helps.
PS we do use annotations as well, because our data happens to be code (for
the pages' methods). However, that won't be your case.
[*] our web application framework, http://portofino.manydesigns.com
> On Wed, Sep 9, 2015 at 11:12 AM, Tomas Lund Petersen <
> kotogadekiru@gmail.com> wrote:
>
>> Hi,
>> This is posible and I have done it.
>> But you can't use annotations. You have to manually check for the users
>> permisions using User.isPermited(requidedPermission);
>> For example:
>> f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
>> //do stuff here
>> }else{
>> throw new UnauthorizedException ();
>> }
>> Where requiredPermission must be the permission asociated to access
>> record XYZ or QRS in your example. You will have to look it up Dinamically.
>> Hope it helps,
>> Tomas Lund Petersen
>>
>> On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
>>
>>> Thanks for the information. Would it be possible to set a Subject's
>>> record access at runtime? I'm envisioning the following scenario:
>>>
>>> User A, who is in Group 1 creates a record (XYZ) and only wants to have
>>> full access for themself.
>>> User B, who is also in Group 1 tries to access record XYZ. User B
>>> should be denied.
>>>
>>> User C, who is in Group 1 creates a Record (QRS) wants everyone in their
>>> group to read the record.
>>> User D, who is in Group 1 wants to read record QRS. User D should be
>>> able to read record QRS but not make changes.
>>>
>>> This feels like it should be similar to UNIX file permissions, but I
>>> don't know how to enforce all this at runtime in Shiro. The first scenario
>>> would make the record XYZ have permission of 600, while the permissions on
>>> record QRS would be 660. Maybe I just need a custom class that can
>>> translate this in Shiro. If so, would this require a custom
>>> PermissionResolver?
>>>
>>>
>>>
>>>
>>> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
>>> wrote:
>>>
>>>> You can verify whether a user / role has access to the record by
>>>> including
>>>> these lines at the very beginning of the method which retrieves it from
>>>> your
>>>> database:
>>>> Set<WildcardPermission> permissions = new HashSet<>();
>>>> permissions.add(new WildcardPermission("record:read:user"));
>>>> permissions.add(new WildcardPermission("record:write:user"));
>>>> SecurityUtils.getSubject().checkPermission(permissions);
>>>> // retrieve stuff from database
>>>>
>>>> The checkPermission method will continue on normally when the subject
>>>> has
>>>> the needed permissions and throw an UnauthorizedException if not.
>>>>
>>>> You can also use annotations like
>>>> @RequiresPermissions({"record:read:user",
>>>> "record:write:user"}) but then you cannot define the needed permissions
>>>> dynamically because annotations require constant values - this is *not*
>>>> a
>>>> limitation of Shiro but of annotations.
>>>>
>>>> Have a look at the API to get an idea of what Shiro supports
>>>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>>>
>>>>
>>>>
>>>> --
>>>> View this message in context:
>>>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>>
>>>
>>>
>>
>
--
*Alessio Stalla* | Software Architect
M: +39 340 7824743 | T: +39 010 566441 | F: +39 010 8900455
alessio.stalla@manydesigns.com | www.manydesigns.com
MANYDESIGNS s.r.l.
Via G. D'Annunzio, 2/51 | 16121 Genova (GE) | Italy
Re: Dynamic Authorization
Posted by Mark <el...@gmail.com>.
I think I have it figured out. I don't actually assign permissions to the
user. I take the permissions assigned to the record and then test the user
access against the record permissions.
Thanks!!
On Wed, Sep 9, 2015 at 11:39 AM, Mark <el...@gmail.com> wrote:
> I am not interested in using annotations, so we don't need to worry about
> that.
>
> The part I don't understand here is, how can you assign permissions to a
> Subject dynamically?
>
>
>
> On Wed, Sep 9, 2015 at 11:12 AM, Tomas Lund Petersen <
> kotogadekiru@gmail.com> wrote:
>
>> Hi,
>> This is posible and I have done it.
>> But you can't use annotations. You have to manually check for the users
>> permisions using User.isPermited(requidedPermission);
>> For example:
>> f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
>> //do stuff here
>> }else{
>> throw new UnauthorizedException ();
>> }
>> Where requiredPermission must be the permission asociated to access
>> record XYZ or QRS in your example. You will have to look it up Dinamically.
>> Hope it helps,
>> Tomas Lund Petersen
>>
>> On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
>>
>>> Thanks for the information. Would it be possible to set a Subject's
>>> record access at runtime? I'm envisioning the following scenario:
>>>
>>> User A, who is in Group 1 creates a record (XYZ) and only wants to have
>>> full access for themself.
>>> User B, who is also in Group 1 tries to access record XYZ. User B
>>> should be denied.
>>>
>>> User C, who is in Group 1 creates a Record (QRS) wants everyone in their
>>> group to read the record.
>>> User D, who is in Group 1 wants to read record QRS. User D should be
>>> able to read record QRS but not make changes.
>>>
>>> This feels like it should be similar to UNIX file permissions, but I
>>> don't know how to enforce all this at runtime in Shiro. The first scenario
>>> would make the record XYZ have permission of 600, while the permissions on
>>> record QRS would be 660. Maybe I just need a custom class that can
>>> translate this in Shiro. If so, would this require a custom
>>> PermissionResolver?
>>>
>>>
>>>
>>>
>>> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
>>> wrote:
>>>
>>>> You can verify whether a user / role has access to the record by
>>>> including
>>>> these lines at the very beginning of the method which retrieves it from
>>>> your
>>>> database:
>>>> Set<WildcardPermission> permissions = new HashSet<>();
>>>> permissions.add(new WildcardPermission("record:read:user"));
>>>> permissions.add(new WildcardPermission("record:write:user"));
>>>> SecurityUtils.getSubject().checkPermission(permissions);
>>>> // retrieve stuff from database
>>>>
>>>> The checkPermission method will continue on normally when the subject
>>>> has
>>>> the needed permissions and throw an UnauthorizedException if not.
>>>>
>>>> You can also use annotations like
>>>> @RequiresPermissions({"record:read:user",
>>>> "record:write:user"}) but then you cannot define the needed permissions
>>>> dynamically because annotations require constant values - this is *not*
>>>> a
>>>> limitation of Shiro but of annotations.
>>>>
>>>> Have a look at the API to get an idea of what Shiro supports
>>>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>>>
>>>>
>>>>
>>>> --
>>>> View this message in context:
>>>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>>
>>>
>>>
>>
>
Re: Dynamic Authorization
Posted by Mark <el...@gmail.com>.
I am not interested in using annotations, so we don't need to worry about
that.
The part I don't understand here is, how can you assign permissions to a
Subject dynamically?
On Wed, Sep 9, 2015 at 11:12 AM, Tomas Lund Petersen <kotogadekiru@gmail.com
> wrote:
> Hi,
> This is posible and I have done it.
> But you can't use annotations. You have to manually check for the users
> permisions using User.isPermited(requidedPermission);
> For example:
> f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
> //do stuff here
> }else{
> throw new UnauthorizedException ();
> }
> Where requiredPermission must be the permission asociated to access record
> XYZ or QRS in your example. You will have to look it up Dinamically.
> Hope it helps,
> Tomas Lund Petersen
>
> On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
>
>> Thanks for the information. Would it be possible to set a Subject's
>> record access at runtime? I'm envisioning the following scenario:
>>
>> User A, who is in Group 1 creates a record (XYZ) and only wants to have
>> full access for themself.
>> User B, who is also in Group 1 tries to access record XYZ. User B should
>> be denied.
>>
>> User C, who is in Group 1 creates a Record (QRS) wants everyone in their
>> group to read the record.
>> User D, who is in Group 1 wants to read record QRS. User D should be
>> able to read record QRS but not make changes.
>>
>> This feels like it should be similar to UNIX file permissions, but I
>> don't know how to enforce all this at runtime in Shiro. The first scenario
>> would make the record XYZ have permission of 600, while the permissions on
>> record QRS would be 660. Maybe I just need a custom class that can
>> translate this in Shiro. If so, would this require a custom
>> PermissionResolver?
>>
>>
>>
>>
>> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
>> wrote:
>>
>>> You can verify whether a user / role has access to the record by
>>> including
>>> these lines at the very beginning of the method which retrieves it from
>>> your
>>> database:
>>> Set<WildcardPermission> permissions = new HashSet<>();
>>> permissions.add(new WildcardPermission("record:read:user"));
>>> permissions.add(new WildcardPermission("record:write:user"));
>>> SecurityUtils.getSubject().checkPermission(permissions);
>>> // retrieve stuff from database
>>>
>>> The checkPermission method will continue on normally when the subject has
>>> the needed permissions and throw an UnauthorizedException if not.
>>>
>>> You can also use annotations like
>>> @RequiresPermissions({"record:read:user",
>>> "record:write:user"}) but then you cannot define the needed permissions
>>> dynamically because annotations require constant values - this is *not* a
>>> limitation of Shiro but of annotations.
>>>
>>> Have a look at the API to get an idea of what Shiro supports
>>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>>
>>>
>>>
>>> --
>>> View this message in context:
>>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>
>>
>>
>
Re: Dynamic Authorization
Posted by Tomas Lund Petersen <ko...@gmail.com>.
Hi,
This is posible and I have done it.
But you can't use annotations. You have to manually check for the users
permisions using User.isPermited(requidedPermission);
For example:
f(SecurityUtils.getSubject().isPermitted(requiiredPermission)){
//do stuff here
}else{
throw new UnauthorizedException ();
}
Where requiredPermission must be the permission asociated to access record
XYZ or QRS in your example. You will have to look it up Dinamically.
Hope it helps,
Tomas Lund Petersen
On Wed, Sep 9, 2015 at 11:49 AM, Mark <el...@gmail.com> wrote:
> Thanks for the information. Would it be possible to set a Subject's
> record access at runtime? I'm envisioning the following scenario:
>
> User A, who is in Group 1 creates a record (XYZ) and only wants to have
> full access for themself.
> User B, who is also in Group 1 tries to access record XYZ. User B should
> be denied.
>
> User C, who is in Group 1 creates a Record (QRS) wants everyone in their
> group to read the record.
> User D, who is in Group 1 wants to read record QRS. User D should be able
> to read record QRS but not make changes.
>
> This feels like it should be similar to UNIX file permissions, but I don't
> know how to enforce all this at runtime in Shiro. The first scenario would
> make the record XYZ have permission of 600, while the permissions on
> record QRS would be 660. Maybe I just need a custom class that can
> translate this in Shiro. If so, would this require a custom
> PermissionResolver?
>
>
>
>
> On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
> wrote:
>
>> You can verify whether a user / role has access to the record by including
>> these lines at the very beginning of the method which retrieves it from
>> your
>> database:
>> Set<WildcardPermission> permissions = new HashSet<>();
>> permissions.add(new WildcardPermission("record:read:user"));
>> permissions.add(new WildcardPermission("record:write:user"));
>> SecurityUtils.getSubject().checkPermission(permissions);
>> // retrieve stuff from database
>>
>> The checkPermission method will continue on normally when the subject has
>> the needed permissions and throw an UnauthorizedException if not.
>>
>> You can also use annotations like
>> @RequiresPermissions({"record:read:user",
>> "record:write:user"}) but then you cannot define the needed permissions
>> dynamically because annotations require constant values - this is *not* a
>> limitation of Shiro but of annotations.
>>
>> Have a look at the API to get an idea of what Shiro supports
>> https://shiro.apache.org/static/1.2.3/apidocs/ .
>>
>>
>>
>> --
>> View this message in context:
>> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
>> Sent from the Shiro User mailing list archive at Nabble.com.
>>
>
>
Re: Dynamic Authorization
Posted by Mark <el...@gmail.com>.
Thanks for the information. Would it be possible to set a Subject's record
access at runtime? I'm envisioning the following scenario:
User A, who is in Group 1 creates a record (XYZ) and only wants to have
full access for themself.
User B, who is also in Group 1 tries to access record XYZ. User B should
be denied.
User C, who is in Group 1 creates a Record (QRS) wants everyone in their
group to read the record.
User D, who is in Group 1 wants to read record QRS. User D should be able
to read record QRS but not make changes.
This feels like it should be similar to UNIX file permissions, but I don't
know how to enforce all this at runtime in Shiro. The first scenario would
make the record XYZ have permission of 600, while the permissions on
record QRS would be 660. Maybe I just need a custom class that can
translate this in Shiro. If so, would this require a custom
PermissionResolver?
On Wed, Sep 9, 2015 at 2:48 AM, scSynergy <ro...@scsynergy.de>
wrote:
> You can verify whether a user / role has access to the record by including
> these lines at the very beginning of the method which retrieves it from
> your
> database:
> Set<WildcardPermission> permissions = new HashSet<>();
> permissions.add(new WildcardPermission("record:read:user"));
> permissions.add(new WildcardPermission("record:write:user"));
> SecurityUtils.getSubject().checkPermission(permissions);
> // retrieve stuff from database
>
> The checkPermission method will continue on normally when the subject has
> the needed permissions and throw an UnauthorizedException if not.
>
> You can also use annotations like @RequiresPermissions({"record:read:user",
> "record:write:user"}) but then you cannot define the needed permissions
> dynamically because annotations require constant values - this is *not* a
> limitation of Shiro but of annotations.
>
> Have a look at the API to get an idea of what Shiro supports
> https://shiro.apache.org/static/1.2.3/apidocs/ .
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Dynamic Authorization
Posted by scSynergy <ro...@scsynergy.de>.
You can verify whether a user / role has access to the record by including
these lines at the very beginning of the method which retrieves it from your
database:
Set<WildcardPermission> permissions = new HashSet<>();
permissions.add(new WildcardPermission("record:read:user"));
permissions.add(new WildcardPermission("record:write:user"));
SecurityUtils.getSubject().checkPermission(permissions);
// retrieve stuff from database
The checkPermission method will continue on normally when the subject has
the needed permissions and throw an UnauthorizedException if not.
You can also use annotations like @RequiresPermissions({"record:read:user",
"record:write:user"}) but then you cannot define the needed permissions
dynamically because annotations require constant values - this is *not* a
limitation of Shiro but of annotations.
Have a look at the API to get an idea of what Shiro supports
https://shiro.apache.org/static/1.2.3/apidocs/ .
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Dynamic-Authorization-tp7580696p7580697.html
Sent from the Shiro User mailing list archive at Nabble.com.