You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-dev@portals.apache.org by "Prasanna (JIRA)" <je...@portals.apache.org> on 2007/10/31 16:42:51 UTC
[jira] Commented: (JS2-21) Missing Security Feature: Check roles
assigned to any group to user belongs
[ https://issues.apache.org/jira/browse/JS2-21?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12539103 ]
Prasanna commented on JS2-21:
-----------------------------
We need this feature of retrieving the roles based on the group assigned to user.
I am planning to modify the o.a.j.security.impl.DefaultSecurityMappingHandler getRolePrincipals(username) to retrieve the groups from the user first and then roles from that group.
In my custom SecurityMappingHandler, I am able to retrieve the Roles from a Group assigned to User and its working fine.
Am I missing anything as I dont want to break some other functionality related to this getRolePrincipals() If I make the same modification in the DefaultSecurityMappingHandler
I really appreciate any help regarding this.
Prasanna
> Missing Security Feature: Check roles assigned to any group to user belongs
> ---------------------------------------------------------------------------
>
> Key: JS2-21
> URL: https://issues.apache.org/jira/browse/JS2-21
> Project: Jetspeed 2
> Issue Type: New Feature
> Components: Security
> Affects Versions: 2.0-FINAL, 2.1
> Reporter: David Le Strat
> Assignee: Ate Douma
> Fix For: 2.2
>
>
> Reported by Ate Douma:
> o.a.j.security.impl.RoleManagerImpl.isUserInRole() implementation is
> missing a required feature.
> A User can be part of a Group which can have Roles just like the User itself.
> The isUserInRole() method currently only checks if the specified role is assigned to the user, not if it is assigned to one of the groups the user belongs to.
> The Role definition in Servlet 2.3 SRV.12.4 (which according to portlet PLT.20.2 also applies for portlets) specifies that a user is in a specific role either when assigned directly to the user or
> when assigned to a group the user belongs to.
> Thus according to this definition the RoleManagerImpl.isUserInRole()
> should also check the roles assigned to any group to user belongs to.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: [jira] Commented: (JS2-21) Missing Security Feature: Check roles assigned to any group to user belongs
Posted by David Sean Taylor <da...@bluesunrise.com>.
Prasana,
checked in. see
http://svn.apache.org/viewvc?view=rev&revision=592149
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: [jira] Commented: (JS2-21) Missing Security Feature: Check roles assigned to any group to user belongs
Posted by David Sean Taylor <da...@bluesunrise.com>.
On Nov 4, 2007, at 8:05 PM, prasana wrote:
>
> Thanks for the reply.
>
> At an higher level, it looks like you have specified a solution for
> not
> showing the checkbox in the User Detail Administrative Portlet
> against the
> user if the role is not mapped directly to the user and mapped
> through the
> group.
yes, you can now check the isMapping setting and remove the check
boxes for deletion (once I commit)
>
> I am assuming that the solution that I had in my "Custom
> SecurityMappingHandler for retrieving roles based on group
> assigned to
> user, in the method of getRolePrincipals(String username), I am
> getting all
> the groups for the user getGroupPrincipals(String username) and
> for each
> group I am calling getRolesInGroup(String groupFullPathName)" holds
> good
> right?
Yes it does, but I am expecting a patch from you for that...
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: [jira] Commented: (JS2-21) Missing Security Feature: Check
roles assigned to any group to user belongs
Posted by prasana <pr...@bluenog.com>.
Thanks for the reply.
At an higher level, it looks like you have specified a solution for not
showing the checkbox in the User Detail Administrative Portlet against the
user if the role is not mapped directly to the user and mapped through the
group.
I am assuming that the solution that I had in my "Custom
SecurityMappingHandler for retrieving roles based on group assigned to
user, in the method of getRolePrincipals(String username), I am getting all
the groups for the user getGroupPrincipals(String username) and for each
group I am calling getRolesInGroup(String groupFullPathName)" holds good
right?
Please advice.
Thanks
Prasanna
David Sean Taylor wrote:
>
>
> On Nov 1, 2007, at 7:34 AM, prasana wrote:
>
>>
>> Thanks for the reply.
>>
>> I looked at those methods.
>>
>> In my custom SecurityMappingHandler, for retrieving roles based on
>> group
>> assigned to user, in the method of getRolePrincipals(String
>> username), I am
>> getting all the groups for the user getGroupPrincipals(String
>> username) and
>> for each group I am calling getRolesInGroup(String groupFullPathName)
>>
>> The only issue that I am seeing currently is Roles that are mapped
>> to Groups
>> assigned to user start showing up in User Detail Information Portlet
>> Ideally, there should not be a delete check box for these Roles as
>> they are
>> not mapped directly to User. They are mapped to Groups that the
>> user belongs
>> to.
>>
>> When I tried to delete those Roles in User Detail Information
>> Portlet, its
>> giving an error saying "The user 'user_name' does not exist. "
>>
> The 'Mapped principal' attribute needs to be made public
>
> There is a InternalPrincipal.isMappingOnly, however there is not a
> public BasePrincipal equivalent (the base class for RolePrincipal,
> UserPrincipal, and GroupPrincipal)
> I propose adding to the BasePrincipal interface:
>
> /**
> * <p>is this principal a security principal mapping or a real
> principal</p>
> * @return true if is a mapping
> */
> boolean isMapping();
>
> and implementing it in BasePrincipalImpl.java:
>
> /** is this principal a mapping **/
> private boolean isMapping = false;
>
>
> In looking at the transition from internal principals to the public
> facing principals, it appears that we sometimes lose the attributes
> isEnabled and isMapping
> Looking at DefaultUserSecurityHandler.java, setEnabled is there, but
> not setIsMapping:
>
> public Principal getUserPrincipal(String username)
> {
> UserPrincipal userPrincipal = null;
> InternalUserPrincipal internalUser =
> securityAccess.getInternalUserPrincipal(username, false);
> if (null != internalUser)
> {
> userPrincipal = new UserPrincipalImpl
> (UserPrincipalImpl.getPrincipalNameFromFullPath
> (internalUser.getFullPath()));
> userPrincipal.setEnabled(internalUser.isEnabled());
> }
> return userPrincipal;
> }
>
> so we can add a constructor :
>
> userPrincipal = new UserPrincipalImpl
> (UserPrincipalImpl.getPrincipalNameFromFullPath
> (internalUser.getFullPath()), isMapping);
>
>
> Looking at the DefaultRoleSecurityHandler.java, looks neither
> attribute is considered:
>
>
> rolePrincipal = new RolePrincipalImpl(RolePrincipalImpl
> .getPrincipalNameFromFullPath
> (internalRole.getFullPath()));
>
> and same for DefaultGroupSecurityHandler.java:
>
> groupPrincipal = new GroupPrincipalImpl(GroupPrincipalImpl
> .getPrincipalNameFromFullPath
> (internalGroup.getFullPath()));
>
> thus we would have:
>
> rolePrincipal = new RolePrincipalImpl(RolePrincipalImpl
> .getPrincipalNameFromFullPath
> (internalRole.getFullPath()), internalGroup.isEnabled(),
> internalGroup.isMappingOnly());
>
>
> and
>
> groupPrincipal = new GroupPrincipalImpl(GroupPrincipalImpl
> .getPrincipalNameFromFullPath
> (internalGroup.getFullPath()), internalGroup.isEnabled(),
> internalGroup.isMappingOnly());
>
> finally, in the administrative portlet, we can check the the
> isMapping method during iteration...
>
> Iterator roles = roleManager.getRolesInGroup
> (selectedGroup).iterator();
>
> Let me know if these proposed changes will help
>
>
--
View this message in context: http://www.nabble.com/-jira--Commented%3A-%28JS2-21%29-Missing-Security-Feature%3A-Check-roles-assigned-to-any-group-to-user-belongs-tf4725912.html#a13581154
Sent from the Jetspeed - Dev mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: [jira] Commented: (JS2-21) Missing Security Feature: Check roles assigned to any group to user belongs
Posted by David Sean Taylor <da...@bluesunrise.com>.
On Nov 1, 2007, at 7:34 AM, prasana wrote:
>
> Thanks for the reply.
>
> I looked at those methods.
>
> In my custom SecurityMappingHandler, for retrieving roles based on
> group
> assigned to user, in the method of getRolePrincipals(String
> username), I am
> getting all the groups for the user getGroupPrincipals(String
> username) and
> for each group I am calling getRolesInGroup(String groupFullPathName)
>
> The only issue that I am seeing currently is Roles that are mapped
> to Groups
> assigned to user start showing up in User Detail Information Portlet
> Ideally, there should not be a delete check box for these Roles as
> they are
> not mapped directly to User. They are mapped to Groups that the
> user belongs
> to.
>
> When I tried to delete those Roles in User Detail Information
> Portlet, its
> giving an error saying "The user 'user_name' does not exist. "
>
The 'Mapped principal' attribute needs to be made public
There is a InternalPrincipal.isMappingOnly, however there is not a
public BasePrincipal equivalent (the base class for RolePrincipal,
UserPrincipal, and GroupPrincipal)
I propose adding to the BasePrincipal interface:
/**
* <p>is this principal a security principal mapping or a real
principal</p>
* @return true if is a mapping
*/
boolean isMapping();
and implementing it in BasePrincipalImpl.java:
/** is this principal a mapping **/
private boolean isMapping = false;
In looking at the transition from internal principals to the public
facing principals, it appears that we sometimes lose the attributes
isEnabled and isMapping
Looking at DefaultUserSecurityHandler.java, setEnabled is there, but
not setIsMapping:
public Principal getUserPrincipal(String username)
{
UserPrincipal userPrincipal = null;
InternalUserPrincipal internalUser =
securityAccess.getInternalUserPrincipal(username, false);
if (null != internalUser)
{
userPrincipal = new UserPrincipalImpl
(UserPrincipalImpl.getPrincipalNameFromFullPath
(internalUser.getFullPath()));
userPrincipal.setEnabled(internalUser.isEnabled());
}
return userPrincipal;
}
so we can add a constructor :
userPrincipal = new UserPrincipalImpl
(UserPrincipalImpl.getPrincipalNameFromFullPath
(internalUser.getFullPath()), isMapping);
Looking at the DefaultRoleSecurityHandler.java, looks neither
attribute is considered:
rolePrincipal = new RolePrincipalImpl(RolePrincipalImpl
.getPrincipalNameFromFullPath
(internalRole.getFullPath()));
and same for DefaultGroupSecurityHandler.java:
groupPrincipal = new GroupPrincipalImpl(GroupPrincipalImpl
.getPrincipalNameFromFullPath
(internalGroup.getFullPath()));
thus we would have:
rolePrincipal = new RolePrincipalImpl(RolePrincipalImpl
.getPrincipalNameFromFullPath
(internalRole.getFullPath()), internalGroup.isEnabled(),
internalGroup.isMappingOnly());
and
groupPrincipal = new GroupPrincipalImpl(GroupPrincipalImpl
.getPrincipalNameFromFullPath
(internalGroup.getFullPath()), internalGroup.isEnabled(),
internalGroup.isMappingOnly());
finally, in the administrative portlet, we can check the the
isMapping method during iteration...
Iterator roles = roleManager.getRolesInGroup
(selectedGroup).iterator();
Let me know if these proposed changes will help
Re: [jira] Commented: (JS2-21) Missing Security Feature: Check
roles assigned to any group to user belongs
Posted by prasana <pr...@bluenog.com>.
Thanks for the reply.
I looked at those methods.
In my custom SecurityMappingHandler, for retrieving roles based on group
assigned to user, in the method of getRolePrincipals(String username), I am
getting all the groups for the user getGroupPrincipals(String username) and
for each group I am calling getRolesInGroup(String groupFullPathName)
The only issue that I am seeing currently is Roles that are mapped to Groups
assigned to user start showing up in User Detail Information Portlet
Ideally, there should not be a delete check box for these Roles as they are
not mapped directly to User. They are mapped to Groups that the user belongs
to.
When I tried to delete those Roles in User Detail Information Portlet, its
giving an error saying "The user 'user_name' does not exist. "
Thanks
Prasanna
David Sean Taylor wrote:
>
>
> On Oct 31, 2007, at 8:42 AM, Prasanna (JIRA) wrote:
>
>>
>> [ https://issues.apache.org/jira/browse/JS2-21?
>> page=com.atlassian.jira.plugin.system.issuetabpanels:comment-
>> tabpanel#action_12539103 ]
>>
>> Prasanna commented on JS2-21:
>> -----------------------------
>>
>> We need this feature of retrieving the roles based on the group
>> assigned to user.
> Just FYI
>
> There is the Group Manager API:
>
> Collection getGroupsInRole(String roleFullPathName) throws
> SecurityException;
>
> and RoleManager:
>
> Collection getRolesInGroup(String groupFullPathName) throws
> SecurityException;
>
>
>
--
View this message in context: http://www.nabble.com/-jira--Commented%3A-%28JS2-21%29-Missing-Security-Feature%3A-Check-roles-assigned-to-any-group-to-user-belongs-tf4725912.html#a13529820
Sent from the Jetspeed - Dev mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org
Re: [jira] Commented: (JS2-21) Missing Security Feature: Check roles assigned to any group to user belongs
Posted by David Sean Taylor <da...@bluesunrise.com>.
On Oct 31, 2007, at 8:42 AM, Prasanna (JIRA) wrote:
>
> [ https://issues.apache.org/jira/browse/JS2-21?
> page=com.atlassian.jira.plugin.system.issuetabpanels:comment-
> tabpanel#action_12539103 ]
>
> Prasanna commented on JS2-21:
> -----------------------------
>
> We need this feature of retrieving the roles based on the group
> assigned to user.
Just FYI
There is the Group Manager API:
Collection getGroupsInRole(String roleFullPathName) throws
SecurityException;
and RoleManager:
Collection getRolesInGroup(String groupFullPathName) throws
SecurityException;