You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by mc...@apache.org on 2014/04/28 20:24:30 UTC
[1/6] git commit: updated refs/heads/master to 44ff7fe
Repository: cloudstack
Updated Branches:
refs/heads/master ca907d8d0 -> 44ff7fea5
CLOUDSTACK-6349: IAM - No error message presented to the user , when invalid password is provided.
- AccountManager now works using accountId instead of accountType
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/79716945
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/79716945
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/79716945
Branch: refs/heads/master
Commit: 797169457bc145f4a8d18f8392a782393b495cdf
Parents: ca907d8
Author: Prachi Damle <pr...@cloud.com>
Authored: Tue Apr 15 17:25:56 2014 -0700
Committer: Min Chen <mi...@citrix.com>
Committed: Mon Apr 28 11:09:12 2014 -0700
----------------------------------------------------------------------
server/src/com/cloud/user/AccountManagerImpl.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/79716945/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index c6131b9..c28ff7d 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -2035,7 +2035,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
UserAccount userAccount = _userAccountDao.getUserAccount(username, domainId);
if (userAccount != null) {
if (userAccount.getState().equalsIgnoreCase(Account.State.enabled.toString())) {
- if (!isInternalAccount(userAccount.getType())) {
+ if (!isInternalAccount(userAccount.getId())) {
// Internal accounts are not disabled
int attemptsMade = userAccount.getLoginAttempts() + 1;
if (updateIncorrectLoginCount) {
[4/6] git commit: updated refs/heads/master to 44ff7fe
Posted by mc...@apache.org.
CLOUDSTACK-6502:IAMGroup.list and IAMPolicy.list in marvin base.py are
not working.
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/96af7396
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/96af7396
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/96af7396
Branch: refs/heads/master
Commit: 96af7396b6ea5da560975807b1c50d78ef875b79
Parents: 6af1a29
Author: Min Chen <mi...@citrix.com>
Authored: Thu Apr 24 18:20:13 2014 -0700
Committer: Min Chen <mi...@citrix.com>
Committed: Mon Apr 28 11:11:35 2014 -0700
----------------------------------------------------------------------
tools/marvin/marvin/lib/base.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/96af7396/tools/marvin/marvin/lib/base.py
----------------------------------------------------------------------
diff --git a/tools/marvin/marvin/lib/base.py b/tools/marvin/marvin/lib/base.py
index d753098..9606532 100755
--- a/tools/marvin/marvin/lib/base.py
+++ b/tools/marvin/marvin/lib/base.py
@@ -3937,7 +3937,7 @@ class IAMGroup:
def list(cls, apiclient, **kwargs):
cmd = listIAMGroups.listIAMGroupsCmd()
[setattr(cmd, k, v) for k, v in kwargs.items()]
- return apiclient.listIAMGroupsCmd(cmd)
+ return apiclient.listIAMGroups(cmd)
def addAccount(self, apiclient, accts):
"""Add accounts to iam group"""
@@ -3998,7 +3998,7 @@ class IAMPolicy:
def list(cls, apiclient, **kwargs):
cmd = listIAMPolicies.listIAMPoliciesCmd()
[setattr(cmd, k, v) for k, v in kwargs.items()]
- return apiclient.listIAMPoliciesCmd(cmd)
+ return apiclient.listIAMPolicies(cmd)
def addPermission(self, apiclient, permission):
"""Add permission to iam policy"""
[3/6] git commit: updated refs/heads/master to 44ff7fe
Posted by mc...@apache.org.
CLOUDSTACK-6501:IAM - DomainAdmin - When listVirtualMachines is used
with listall=true and account and domainId , Vms owned by the account
account is not listed.
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/6af1a291
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/6af1a291
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/6af1a291
Branch: refs/heads/master
Commit: 6af1a2919bfd91cdc722a400d926b7c25fc76200
Parents: 9514c9e
Author: Min Chen <mi...@citrix.com>
Authored: Thu Apr 24 18:13:59 2014 -0700
Committer: Min Chen <mi...@citrix.com>
Committed: Mon Apr 28 11:11:27 2014 -0700
----------------------------------------------------------------------
server/src/com/cloud/user/AccountManagerImpl.java | 6 +++++-
.../apache/cloudstack/iam/RoleBasedEntityQuerySelector.java | 4 ++--
2 files changed, 7 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/6af1a291/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index d265816..d7db6c2 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -2276,7 +2276,11 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
if (accountId != null) {
// specific account filter is specified
- if (grantedAccounts.contains(accountId)) {
+ if (grantedDomains.contains(domainId)) {
+ // the account domain is granted to the caller
+ permittedAccounts.add(accountId);
+ }
+ else if (grantedAccounts.contains(accountId)) {
permittedAccounts.add(accountId);
} else {
//TODO: we should also filter granted resources based on accountId passed.
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/6af1a291/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityQuerySelector.java
----------------------------------------------------------------------
diff --git a/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityQuerySelector.java b/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityQuerySelector.java
index 40c8549..b7c3d35 100644
--- a/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityQuerySelector.java
+++ b/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityQuerySelector.java
@@ -73,8 +73,8 @@ public class RoleBasedEntityQuerySelector extends AdapterBase implements QuerySe
domainId = p.getScopeId();
//domainIds.add(p.getScopeId());
}
- domainIds.add(domainId);
- // add all the domain children from this domain. Like RoleBasedEntityAccessChecker, we made an assumption, if DOMAIN scope is granted, it means that
+ //domainIds.add(domainId);
+ // add all the domain children from this domain (including this domain itself). Like RoleBasedEntityAccessChecker, we made an assumption, if DOMAIN scope is granted, it means that
// the whole domain tree is granted access.
DomainVO domain = _domainDao.findById(domainId);
List<Long> childDomains = _domainDao.getDomainChildrenIds(domain.getPath());
[6/6] git commit: updated refs/heads/master to 44ff7fe
Posted by mc...@apache.org.
CLOUDSTACK-6513: IAM - Templates - When templates are listed with
templatefilter="shared" is used , we see public templates also being
included in the list. This commit reverts listTemplates behavior to 4.3
old logic without using consistent interpretation of list parameters
adopted in new IAM model.
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/44ff7fea
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/44ff7fea
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/44ff7fea
Branch: refs/heads/master
Commit: 44ff7fea5f10dc6e979d482cc4a6d22fdfd1a5f0
Parents: 3e4151e
Author: Min Chen <mi...@citrix.com>
Authored: Fri Apr 25 17:24:34 2014 -0700
Committer: Min Chen <mi...@citrix.com>
Committed: Mon Apr 28 11:11:53 2014 -0700
----------------------------------------------------------------------
.../contrail/management/MockAccountManager.java | 7 +
.../com/cloud/api/query/QueryManagerImpl.java | 340 ++++++++++++++++++-
server/src/com/cloud/user/AccountManager.java | 5 +
.../src/com/cloud/user/AccountManagerImpl.java | 88 +++++
.../com/cloud/user/MockAccountManagerImpl.java | 6 +
5 files changed, 442 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/44ff7fea/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
index e9bbc8e..cad5a50 100644
--- a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
+++ b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
@@ -382,4 +382,11 @@ public class MockAccountManager extends ManagerBase implements AccountManager {
}
+ @Override
+ public void buildACLSearchParameters(Account caller, Long id, String accountName, Long projectId, List<Long> permittedAccounts,
+ Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject, boolean listAll, boolean forProjectInvitation) {
+ // TODO Auto-generated method stub
+
+ }
+
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/44ff7fea/server/src/com/cloud/api/query/QueryManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/query/QueryManagerImpl.java b/server/src/com/cloud/api/query/QueryManagerImpl.java
index dcb32a9..41b134f 100644
--- a/server/src/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/com/cloud/api/query/QueryManagerImpl.java
@@ -2806,7 +2806,8 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
return response;
}
- private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternal(ListTemplatesCmd cmd) {
+ // Temporarily disable this method which used IAM model to do template list
+ private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternalIAM(ListTemplatesCmd cmd) {
TemplateFilter templateFilter = TemplateFilter.valueOf(cmd.getTemplateFilter());
Long id = cmd.getId();
Map<String, String> tags = cmd.getTags();
@@ -2838,12 +2839,13 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
boolean showDomr = ((templateFilter != TemplateFilter.selfexecutable) && (templateFilter != TemplateFilter.featured));
HypervisorType hypervisorType = HypervisorType.getType(cmd.getHypervisor());
- return searchForTemplatesInternal(id, cmd.getTemplateName(), cmd.getKeyword(), templateFilter, false, null,
+ return searchForTemplatesInternalIAM(id, cmd.getTemplateName(), cmd.getKeyword(), templateFilter, false, null,
cmd.getPageSizeVal(), cmd.getStartIndex(), cmd.getZoneId(), hypervisorType, showDomr,
cmd.listInReadyState(), permittedDomains, permittedAccounts, permittedResources, isRecursive, caller, listProjectResourcesCriteria, tags, showRemovedTmpl);
}
- private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternal(Long templateId, String name,
+ // Temporarily disable this method which used IAM model to do template list
+ private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternalIAM(Long templateId, String name,
String keyword, TemplateFilter templateFilter, boolean isIso, Boolean bootable, Long pageSize,
Long startIndex, Long zoneId, HypervisorType hyperType, boolean showDomr, boolean onlyReady,
List<Long> permittedDomains, List<Long> permittedAccounts, List<Long> permittedResources, boolean isRecursive, Account caller,
@@ -3079,6 +3081,302 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
}
+ private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternal(ListTemplatesCmd cmd) {
+ TemplateFilter templateFilter = TemplateFilter.valueOf(cmd.getTemplateFilter());
+ Long id = cmd.getId();
+ Map<String, String> tags = cmd.getTags();
+ boolean showRemovedTmpl = cmd.getShowRemoved();
+ Account caller = CallContext.current().getCallingAccount();
+
+ boolean listAll = false;
+ if (templateFilter != null && templateFilter == TemplateFilter.all) {
+ if (caller.getType() == Account.ACCOUNT_TYPE_NORMAL) {
+ throw new InvalidParameterValueException("Filter " + TemplateFilter.all
+ + " can be specified by admin only");
+ }
+ listAll = true;
+ }
+
+ List<Long> permittedAccountIds = new ArrayList<Long>();
+ Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(
+ cmd.getDomainId(), cmd.isRecursive(), null);
+ _accountMgr.buildACLSearchParameters(caller, id, cmd.getAccountName(), cmd.getProjectId(), permittedAccountIds,
+ domainIdRecursiveListProject, listAll, false);
+ ListProjectResourcesCriteria listProjectResourcesCriteria = domainIdRecursiveListProject.third();
+ List<Account> permittedAccounts = new ArrayList<Account>();
+ for (Long accountId : permittedAccountIds) {
+ permittedAccounts.add(_accountMgr.getAccount(accountId));
+ }
+
+ boolean showDomr = ((templateFilter != TemplateFilter.selfexecutable) && (templateFilter != TemplateFilter.featured));
+ HypervisorType hypervisorType = HypervisorType.getType(cmd.getHypervisor());
+
+ return searchForTemplatesInternal(id, cmd.getTemplateName(), cmd.getKeyword(), templateFilter, false, null,
+ cmd.getPageSizeVal(), cmd.getStartIndex(), cmd.getZoneId(), hypervisorType, showDomr,
+ cmd.listInReadyState(), permittedAccounts, caller, listProjectResourcesCriteria, tags, showRemovedTmpl);
+ }
+
+ private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternal(Long templateId, String name,
+ String keyword, TemplateFilter templateFilter, boolean isIso, Boolean bootable, Long pageSize,
+ Long startIndex, Long zoneId, HypervisorType hyperType, boolean showDomr, boolean onlyReady,
+ List<Account> permittedAccounts, Account caller, ListProjectResourcesCriteria listProjectResourcesCriteria,
+ Map<String, String> tags, boolean showRemovedTmpl) {
+
+ // check if zone is configured, if not, just return empty list
+ List<HypervisorType> hypers = null;
+ if (!isIso) {
+ hypers = _resourceMgr.listAvailHypervisorInZone(null, null);
+ if (hypers == null || hypers.isEmpty()) {
+ return new Pair<List<TemplateJoinVO>, Integer>(new ArrayList<TemplateJoinVO>(), 0);
+ }
+ }
+
+ VMTemplateVO template = null;
+
+ Boolean isAscending = Boolean.parseBoolean(_configDao.getValue("sortkey.algorithm"));
+ isAscending = (isAscending == null ? true : isAscending);
+ Filter searchFilter = new Filter(TemplateJoinVO.class, "sortKey", isAscending, startIndex, pageSize);
+
+ SearchBuilder<TemplateJoinVO> sb = _templateJoinDao.createSearchBuilder();
+ sb.select(null, Func.DISTINCT, sb.entity().getTempZonePair()); // select distinct (templateId, zoneId) pair
+ SearchCriteria<TemplateJoinVO> sc = sb.create();
+
+ // verify templateId parameter and specially handle it
+ if (templateId != null) {
+ template = _templateDao.findByIdIncludingRemoved(templateId); // Done for backward compatibility - Bug-5221
+ if (template == null) {
+ throw new InvalidParameterValueException("Please specify a valid template ID.");
+ }// If ISO requested then it should be ISO.
+ if (isIso && template.getFormat() != ImageFormat.ISO) {
+ s_logger.error("Template Id " + templateId + " is not an ISO");
+ InvalidParameterValueException ex = new InvalidParameterValueException(
+ "Specified Template Id is not an ISO");
+ ex.addProxyObject(template.getUuid(), "templateId");
+ throw ex;
+ }// If ISO not requested then it shouldn't be an ISO.
+ if (!isIso && template.getFormat() == ImageFormat.ISO) {
+ s_logger.error("Incorrect format of the template id " + templateId);
+ InvalidParameterValueException ex = new InvalidParameterValueException("Incorrect format "
+ + template.getFormat() + " of the specified template id");
+ ex.addProxyObject(template.getUuid(), "templateId");
+ throw ex;
+ }
+
+ // if template is not public, perform permission check here
+ if (!template.isPublicTemplate() && caller.getType() != Account.ACCOUNT_TYPE_ADMIN) {
+ Account owner = _accountMgr.getAccount(template.getAccountId());
+ _accountMgr.checkAccess(caller, null, true, owner);
+ }
+
+ // if templateId is specified, then we will just use the id to
+ // search and ignore other query parameters
+ sc.addAnd("id", SearchCriteria.Op.EQ, templateId);
+ } else {
+
+ DomainVO domain = null;
+ if (!permittedAccounts.isEmpty()) {
+ domain = _domainDao.findById(permittedAccounts.get(0).getDomainId());
+ } else {
+ domain = _domainDao.findById(DomainVO.ROOT_DOMAIN);
+ }
+
+ // List<HypervisorType> hypers = null;
+ // if (!isIso) {
+ // hypers = _resourceMgr.listAvailHypervisorInZone(null, null);
+ // }
+
+ // add criteria for project or not
+ if (listProjectResourcesCriteria == ListProjectResourcesCriteria.SkipProjectResources) {
+ sc.addAnd("accountType", SearchCriteria.Op.NEQ, Account.ACCOUNT_TYPE_PROJECT);
+ } else if (listProjectResourcesCriteria == ListProjectResourcesCriteria.ListProjectResourcesOnly) {
+ sc.addAnd("accountType", SearchCriteria.Op.EQ, Account.ACCOUNT_TYPE_PROJECT);
+ }
+
+ // add criteria for domain path in case of domain admin
+ if ((templateFilter == TemplateFilter.self || templateFilter == TemplateFilter.selfexecutable)
+ && (caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN || caller.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN)) {
+ sc.addAnd("domainPath", SearchCriteria.Op.LIKE, domain.getPath() + "%");
+ }
+
+ List<Long> relatedDomainIds = new ArrayList<Long>();
+ List<Long> permittedAccountIds = new ArrayList<Long>();
+ if (!permittedAccounts.isEmpty()) {
+ for (Account account : permittedAccounts) {
+ permittedAccountIds.add(account.getId());
+ boolean publicTemplates = (templateFilter == TemplateFilter.featured || templateFilter == TemplateFilter.community);
+
+ // get all parent domain ID's all the way till root domain
+ DomainVO domainTreeNode = null;
+ //if template filter is featured, or community, all child domains should be included in search
+ if (publicTemplates) {
+ domainTreeNode = _domainDao.findById(Domain.ROOT_DOMAIN);
+
+ } else {
+ domainTreeNode = _domainDao.findById(account.getDomainId());
+ }
+ relatedDomainIds.add(domainTreeNode.getId());
+ while (domainTreeNode.getParent() != null) {
+ domainTreeNode = _domainDao.findById(domainTreeNode.getParent());
+ relatedDomainIds.add(domainTreeNode.getId());
+ }
+
+ // get all child domain ID's
+ if (_accountMgr.isAdmin(account.getId()) || publicTemplates) {
+ List<DomainVO> allChildDomains = _domainDao.findAllChildren(domainTreeNode.getPath(), domainTreeNode.getId());
+ for (DomainVO childDomain : allChildDomains) {
+ relatedDomainIds.add(childDomain.getId());
+ }
+ }
+ }
+ }
+
+ if (!isIso) {
+ // add hypervisor criteria for template case
+ if (hypers != null && !hypers.isEmpty()) {
+ String[] relatedHypers = new String[hypers.size()];
+ for (int i = 0; i < hypers.size(); i++) {
+ relatedHypers[i] = hypers.get(i).toString();
+ }
+ sc.addAnd("hypervisorType", SearchCriteria.Op.IN, relatedHypers);
+ }
+ }
+
+ // control different template filters
+ if (templateFilter == TemplateFilter.featured || templateFilter == TemplateFilter.community) {
+ sc.addAnd("publicTemplate", SearchCriteria.Op.EQ, true);
+ if (templateFilter == TemplateFilter.featured) {
+ sc.addAnd("featured", SearchCriteria.Op.EQ, true);
+ } else {
+ sc.addAnd("featured", SearchCriteria.Op.EQ, false);
+ }
+ if (!permittedAccounts.isEmpty()) {
+ SearchCriteria<TemplateJoinVO> scc = _templateJoinDao.createSearchCriteria();
+ scc.addOr("domainId", SearchCriteria.Op.IN, relatedDomainIds.toArray());
+ scc.addOr("domainId", SearchCriteria.Op.NULL);
+ sc.addAnd("domainId", SearchCriteria.Op.SC, scc);
+ }
+ } else if (templateFilter == TemplateFilter.self || templateFilter == TemplateFilter.selfexecutable) {
+ if (!permittedAccounts.isEmpty()) {
+ sc.addAnd("accountId", SearchCriteria.Op.IN, permittedAccountIds.toArray());
+ }
+ } else if (templateFilter == TemplateFilter.sharedexecutable || templateFilter == TemplateFilter.shared) {
+ SearchCriteria<TemplateJoinVO> scc = _templateJoinDao.createSearchCriteria();
+ scc.addOr("accountId", SearchCriteria.Op.IN, permittedAccountIds.toArray());
+ scc.addOr("sharedAccountId", SearchCriteria.Op.IN, permittedAccountIds.toArray());
+ sc.addAnd("accountId", SearchCriteria.Op.SC, scc);
+ } else if (templateFilter == TemplateFilter.executable) {
+ SearchCriteria<TemplateJoinVO> scc = _templateJoinDao.createSearchCriteria();
+ scc.addOr("publicTemplate", SearchCriteria.Op.EQ, true);
+ if (!permittedAccounts.isEmpty()) {
+ scc.addOr("accountId", SearchCriteria.Op.IN, permittedAccountIds.toArray());
+ }
+ sc.addAnd("publicTemplate", SearchCriteria.Op.SC, scc);
+ }
+
+ // add tags criteria
+ if (tags != null && !tags.isEmpty()) {
+ SearchCriteria<TemplateJoinVO> scc = _templateJoinDao.createSearchCriteria();
+ for (String key : tags.keySet()) {
+ SearchCriteria<TemplateJoinVO> scTag = _templateJoinDao.createSearchCriteria();
+ scTag.addAnd("tagKey", SearchCriteria.Op.EQ, key);
+ scTag.addAnd("tagValue", SearchCriteria.Op.EQ, tags.get(key));
+ if (isIso) {
+ scTag.addAnd("tagResourceType", SearchCriteria.Op.EQ, ResourceObjectType.ISO);
+ } else {
+ scTag.addAnd("tagResourceType", SearchCriteria.Op.EQ, ResourceObjectType.Template);
+ }
+ scc.addOr("tagKey", SearchCriteria.Op.SC, scTag);
+ }
+ sc.addAnd("tagKey", SearchCriteria.Op.SC, scc);
+ }
+
+ // other criteria
+
+ if (keyword != null) {
+ sc.addAnd("name", SearchCriteria.Op.LIKE, "%" + keyword + "%");
+ } else if (name != null) {
+ sc.addAnd("name", SearchCriteria.Op.EQ, name);
+ }
+
+ if (isIso) {
+ sc.addAnd("format", SearchCriteria.Op.EQ, "ISO");
+
+ } else {
+ sc.addAnd("format", SearchCriteria.Op.NEQ, "ISO");
+ }
+
+ if (!hyperType.equals(HypervisorType.None)) {
+ sc.addAnd("hypervisorType", SearchCriteria.Op.EQ, hyperType);
+ }
+
+ if (bootable != null) {
+ sc.addAnd("bootable", SearchCriteria.Op.EQ, bootable);
+ }
+
+ if (onlyReady) {
+ SearchCriteria<TemplateJoinVO> readySc = _templateJoinDao.createSearchCriteria();
+ readySc.addOr("state", SearchCriteria.Op.EQ, TemplateState.Ready);
+ readySc.addOr("format", SearchCriteria.Op.EQ, ImageFormat.BAREMETAL);
+ SearchCriteria<TemplateJoinVO> isoPerhostSc = _templateJoinDao.createSearchCriteria();
+ isoPerhostSc.addAnd("format", SearchCriteria.Op.EQ, ImageFormat.ISO);
+ isoPerhostSc.addAnd("templateType", SearchCriteria.Op.EQ, TemplateType.PERHOST);
+ readySc.addOr("templateType", SearchCriteria.Op.SC, isoPerhostSc);
+ sc.addAnd("state", SearchCriteria.Op.SC, readySc);
+ }
+
+ if (!showDomr) {
+ // excluding system template
+ sc.addAnd("templateType", SearchCriteria.Op.NEQ, Storage.TemplateType.SYSTEM);
+ }
+ }
+
+ if (zoneId != null) {
+ SearchCriteria<TemplateJoinVO> zoneSc = _templateJoinDao.createSearchCriteria();
+ zoneSc.addOr("dataCenterId", SearchCriteria.Op.EQ, zoneId);
+ zoneSc.addOr("dataStoreScope", SearchCriteria.Op.EQ, ScopeType.REGION);
+ // handle the case where xs-tools.iso and vmware-tools.iso do not
+ // have data_center information in template_view
+ SearchCriteria<TemplateJoinVO> isoPerhostSc = _templateJoinDao.createSearchCriteria();
+ isoPerhostSc.addAnd("format", SearchCriteria.Op.EQ, ImageFormat.ISO);
+ isoPerhostSc.addAnd("templateType", SearchCriteria.Op.EQ, TemplateType.PERHOST);
+ zoneSc.addOr("templateType", SearchCriteria.Op.SC, isoPerhostSc);
+ sc.addAnd("dataCenterId", SearchCriteria.Op.SC, zoneSc);
+ }
+
+ // don't return removed template, this should not be needed since we
+ // changed annotation for removed field in TemplateJoinVO.
+ // sc.addAnd("removed", SearchCriteria.Op.NULL);
+
+ // search unique templates and find details by Ids
+ Pair<List<TemplateJoinVO>, Integer> uniqueTmplPair = null;
+ if (showRemovedTmpl) {
+ uniqueTmplPair = _templateJoinDao.searchIncludingRemovedAndCount(sc, searchFilter);
+ } else {
+ sc.addAnd("templateState", SearchCriteria.Op.EQ, State.Active);
+ uniqueTmplPair = _templateJoinDao.searchAndCount(sc, searchFilter);
+ }
+
+ Integer count = uniqueTmplPair.second();
+ if (count.intValue() == 0) {
+ // empty result
+ return uniqueTmplPair;
+ }
+ List<TemplateJoinVO> uniqueTmpls = uniqueTmplPair.first();
+ String[] tzIds = new String[uniqueTmpls.size()];
+ int i = 0;
+ for (TemplateJoinVO v : uniqueTmpls) {
+ tzIds[i++] = v.getTempZonePair();
+ }
+ List<TemplateJoinVO> vrs = _templateJoinDao.searchByTemplateZonePair(showRemovedTmpl, tzIds);
+ return new Pair<List<TemplateJoinVO>, Integer>(vrs, count);
+
+ // TODO: revisit the special logic for iso search in
+ // VMTemplateDaoImpl.searchForTemplates and understand why we need to
+ // specially handle ISO. The original logic is very twisted and no idea
+ // about what the code was doing.
+
+ }
+
@Override
public ListResponse<TemplateResponse> listIsos(ListIsosCmd cmd) {
Pair<List<TemplateJoinVO>, Integer> result = searchForIsosInternal(cmd);
@@ -3104,6 +3402,40 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
boolean listAll = false;
if (isoFilter != null && isoFilter == TemplateFilter.all) {
+ if (caller.getType() == Account.ACCOUNT_TYPE_NORMAL) {
+ throw new InvalidParameterValueException("Filter " + TemplateFilter.all
+ + " can be specified by admin only");
+ }
+ listAll = true;
+ }
+
+ List<Long> permittedAccountIds = new ArrayList<Long>();
+ Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(
+ cmd.getDomainId(), cmd.isRecursive(), null);
+ _accountMgr.buildACLSearchParameters(caller, id, cmd.getAccountName(), cmd.getProjectId(), permittedAccountIds,
+ domainIdRecursiveListProject, listAll, false);
+ ListProjectResourcesCriteria listProjectResourcesCriteria = domainIdRecursiveListProject.third();
+ List<Account> permittedAccounts = new ArrayList<Account>();
+ for (Long accountId : permittedAccountIds) {
+ permittedAccounts.add(_accountMgr.getAccount(accountId));
+ }
+
+ HypervisorType hypervisorType = HypervisorType.getType(cmd.getHypervisor());
+
+ return searchForTemplatesInternal(cmd.getId(), cmd.getIsoName(), cmd.getKeyword(), isoFilter, true,
+ cmd.isBootable(), cmd.getPageSizeVal(), cmd.getStartIndex(), cmd.getZoneId(), hypervisorType, true,
+ cmd.listInReadyState(), permittedAccounts, caller, listProjectResourcesCriteria, tags, showRemovedISO);
+ }
+
+ private Pair<List<TemplateJoinVO>, Integer> searchForIsosInternalIAM(ListIsosCmd cmd) {
+ TemplateFilter isoFilter = TemplateFilter.valueOf(cmd.getIsoFilter());
+ Long id = cmd.getId();
+ Map<String, String> tags = cmd.getTags();
+ boolean showRemovedISO = cmd.getShowRemoved();
+ Account caller = CallContext.current().getCallingAccount();
+
+ boolean listAll = false;
+ if (isoFilter != null && isoFilter == TemplateFilter.all) {
if (_accountMgr.isNormalUser(caller.getId())) {
throw new InvalidParameterValueException("Filter " + TemplateFilter.all
+ " can be specified by admin only");
@@ -3128,7 +3460,7 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
HypervisorType hypervisorType = HypervisorType.getType(cmd.getHypervisor());
- return searchForTemplatesInternal(cmd.getId(), cmd.getIsoName(), cmd.getKeyword(), isoFilter, true,
+ return searchForTemplatesInternalIAM(cmd.getId(), cmd.getIsoName(), cmd.getKeyword(), isoFilter, true,
cmd.isBootable(), cmd.getPageSizeVal(), cmd.getStartIndex(), cmd.getZoneId(), hypervisorType, true,
cmd.listInReadyState(), permittedDomains, permittedAccounts, permittedResources, isRecursive, caller, listProjectResourcesCriteria, tags, showRemovedISO);
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/44ff7fea/server/src/com/cloud/user/AccountManager.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManager.java b/server/src/com/cloud/user/AccountManager.java
index 03bf842..748be2b2c 100755
--- a/server/src/com/cloud/user/AccountManager.java
+++ b/server/src/com/cloud/user/AccountManager.java
@@ -102,6 +102,11 @@ public interface AccountManager extends AccountService {
List<Long> permittedResources, ListProjectResourcesCriteria listProjectResourcesCriteria);
+ // deprecated methods that should only be used in listTemplates due to backwards compatibility of templateFilter.
+ void buildACLSearchParameters(Account caller, Long id,
+ String accountName, Long projectId, List<Long> permittedAccounts, Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject, boolean listAll,
+ boolean forProjectInvitation);
+
/**
* Deletes a user by userId
*
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/44ff7fea/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index d7db6c2..06c55aa 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -2176,6 +2176,94 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
return _userAccountDao.getUserByApiKey(apiKey);
}
+ // NOTE: This method should only be used in listTemplates call, all other list calls should use the new buildACLSearchParameters which takes
+ // "action" as extra parameter and uses new IAM model.
+ @Override
+ public void buildACLSearchParameters(Account caller, Long id, String accountName, Long projectId, List<Long>
+ permittedAccounts, Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject,
+ boolean listAll, boolean forProjectInvitation) {
+ Long domainId = domainIdRecursiveListProject.first();
+ if (domainId != null) {
+ Domain domain = _domainDao.findById(domainId);
+ if (domain == null) {
+ throw new InvalidParameterValueException("Unable to find domain by id " + domainId);
+ }
+ // check permissions
+ checkAccess(caller, domain);
+ }
+
+ if (accountName != null) {
+ if (projectId != null) {
+ throw new InvalidParameterValueException("Account and projectId can't be specified together");
+ }
+
+ Account userAccount = null;
+ Domain domain = null;
+ if (domainId != null) {
+ userAccount = _accountDao.findActiveAccount(accountName, domainId);
+ domain = _domainDao.findById(domainId);
+ } else {
+ userAccount = _accountDao.findActiveAccount(accountName, caller.getDomainId());
+ domain = _domainDao.findById(caller.getDomainId());
+ }
+
+ if (userAccount != null) {
+ checkAccess(caller, null, false, userAccount);
+ // check permissions
+ permittedAccounts.add(userAccount.getId());
+ } else {
+ throw new InvalidParameterValueException("could not find account " + accountName + " in domain " + domain.getUuid());
+ }
+ }
+
+ // set project information
+ if (projectId != null) {
+ if (!forProjectInvitation) {
+ if (projectId.longValue() == -1) {
+ if (isNormalUser(caller.getId())) {
+ permittedAccounts.addAll(_projectMgr.listPermittedProjectAccounts(caller.getId()));
+ } else {
+ domainIdRecursiveListProject.third(Project.ListProjectResourcesCriteria.ListProjectResourcesOnly);
+ }
+ } else {
+ Project project = _projectMgr.getProject(projectId);
+ if (project == null) {
+ throw new InvalidParameterValueException("Unable to find project by id " + projectId);
+ }
+ if (!_projectMgr.canAccessProjectAccount(caller, project.getProjectAccountId())) {
+ throw new PermissionDeniedException("Account " + caller + " can't access project id=" + projectId);
+ }
+ permittedAccounts.add(project.getProjectAccountId());
+ }
+ }
+ } else {
+ if (id == null) {
+ domainIdRecursiveListProject.third(Project.ListProjectResourcesCriteria.SkipProjectResources);
+ }
+ if (permittedAccounts.isEmpty() && domainId == null) {
+ if (isNormalUser(caller.getId())) {
+ permittedAccounts.add(caller.getId());
+ } else if (!listAll) {
+ if (id == null) {
+ permittedAccounts.add(caller.getId());
+ } else if (!isRootAdmin(caller.getId())) {
+ domainIdRecursiveListProject.first(caller.getDomainId());
+ domainIdRecursiveListProject.second(true);
+ }
+ } else if (domainId == null) {
+ if (isDomainAdmin(caller.getId())) {
+ domainIdRecursiveListProject.first(caller.getDomainId());
+ domainIdRecursiveListProject.second(true);
+ }
+ }
+ } else if (domainId != null) {
+ if (isNormalUser(caller.getId())) {
+ permittedAccounts.add(caller.getId());
+ }
+ }
+ }
+ }
+
@Override
public void buildACLSearchParameters(Account caller, Long id, String accountName, Long projectId, List<Long> permittedDomains, List<Long> permittedAccounts,
List<Long> permittedResources, Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject, boolean listAll, boolean forProjectInvitation,
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/44ff7fea/server/test/com/cloud/user/MockAccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/test/com/cloud/user/MockAccountManagerImpl.java b/server/test/com/cloud/user/MockAccountManagerImpl.java
index e53974a..2f57abc 100644
--- a/server/test/com/cloud/user/MockAccountManagerImpl.java
+++ b/server/test/com/cloud/user/MockAccountManagerImpl.java
@@ -358,5 +358,11 @@ public class MockAccountManagerImpl extends ManagerBase implements Manager, Acco
}
+ @Override
+ public void buildACLSearchParameters(Account caller, Long id, String accountName, Long projectId, List<Long> permittedAccounts,
+ Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject, boolean listAll, boolean forProjectInvitation) {
+ // TODO Auto-generated method stub
+
+ }
}
[5/6] git commit: updated refs/heads/master to 44ff7fe
Posted by mc...@apache.org.
CLOUDSTACK-6512:IAM - Not able to list shared networks in the Vm
deployment flow. This commit is to revert
ec5ee761d98c67c7da2ea70b623d4a9f3da966b5 to still use old logic for
listNetworks to keep old behavior instead of new IAM model.
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/3e4151e1
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/3e4151e1
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/3e4151e1
Branch: refs/heads/master
Commit: 3e4151e13e1e2e8ae9b9593260cd136403230358
Parents: 96af739
Author: Min Chen <mi...@citrix.com>
Authored: Fri Apr 25 14:35:38 2014 -0700
Committer: Min Chen <mi...@citrix.com>
Committed: Mon Apr 28 11:11:42 2014 -0700
----------------------------------------------------------------------
.../com/cloud/network/NetworkServiceImpl.java | 322 +++++++++++++++----
1 file changed, 259 insertions(+), 63 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/3e4151e1/server/src/com/cloud/network/NetworkServiceImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/NetworkServiceImpl.java b/server/src/com/cloud/network/NetworkServiceImpl.java
index 6cd5cf8..9928707 100755
--- a/server/src/com/cloud/network/NetworkServiceImpl.java
+++ b/server/src/com/cloud/network/NetworkServiceImpl.java
@@ -108,6 +108,7 @@ import com.cloud.network.dao.IPAddressVO;
import com.cloud.network.dao.LoadBalancerVMMapDao;
import com.cloud.network.dao.NetworkDao;
import com.cloud.network.dao.NetworkDomainDao;
+import com.cloud.network.dao.NetworkDomainVO;
import com.cloud.network.dao.NetworkServiceMapDao;
import com.cloud.network.dao.NetworkVO;
import com.cloud.network.dao.OvsProviderDao;
@@ -140,13 +141,13 @@ import com.cloud.offerings.dao.NetworkOfferingDao;
import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
import com.cloud.org.Grouping;
import com.cloud.projects.Project;
-import com.cloud.projects.Project.ListProjectResourcesCriteria;
import com.cloud.projects.ProjectManager;
import com.cloud.server.ResourceTag.ResourceObjectType;
import com.cloud.tags.ResourceTagVO;
import com.cloud.tags.dao.ResourceTagDao;
import com.cloud.user.Account;
import com.cloud.user.AccountManager;
+import com.cloud.user.AccountVO;
import com.cloud.user.DomainManager;
import com.cloud.user.ResourceLimitService;
import com.cloud.user.User;
@@ -156,7 +157,6 @@ import com.cloud.user.dao.UserDao;
import com.cloud.utils.Journal;
import com.cloud.utils.NumbersUtil;
import com.cloud.utils.Pair;
-import com.cloud.utils.Ternary;
import com.cloud.utils.component.ManagerBase;
import com.cloud.utils.db.DB;
import com.cloud.utils.db.EntityManager;
@@ -1391,10 +1391,14 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
String trafficType = cmd.getTrafficType();
Boolean isSystem = cmd.getIsSystem();
String aclType = cmd.getAclType();
+ Long projectId = cmd.getProjectId();
+ List<Long> permittedAccounts = new ArrayList<Long>();
+ String path = null;
Long physicalNetworkId = cmd.getPhysicalNetworkId();
List<String> supportedServicesStr = cmd.getSupportedServices();
Boolean restartRequired = cmd.getRestartRequired();
boolean listAll = cmd.listAll();
+ boolean isRecursive = cmd.isRecursive();
Boolean specifyIpRanges = cmd.getSpecifyIpRanges();
Long vpcId = cmd.getVpcId();
Boolean canUseForDeploy = cmd.canUseForDeploy();
@@ -1413,16 +1417,66 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
throw new InvalidParameterValueException("System network belongs to system, account and domainId parameters can't be specified");
}
- List<Long> permittedDomains = new ArrayList<Long>();
- List<Long> permittedAccounts = new ArrayList<Long>();
- List<Long> permittedResources = new ArrayList<Long>();
- Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(cmd.getDomainId(),
- cmd.isRecursive(), null);
- _accountMgr.buildACLSearchParameters(caller, id, cmd.getAccountName(), cmd.getProjectId(), permittedDomains, permittedAccounts, permittedResources,
- domainIdRecursiveListProject, cmd.listAll(), false, "listNetworks");
- Boolean isRecursive = domainIdRecursiveListProject.second();
- ListProjectResourcesCriteria listProjectResourcesCriteria = domainIdRecursiveListProject.third();
+ if (domainId != null) {
+ DomainVO domain = _domainDao.findById(domainId);
+ if (domain == null) {
+ // see DomainVO.java
+ throw new InvalidParameterValueException("Specified domain id doesn't exist in the system");
+ }
+
+ _accountMgr.checkAccess(caller, domain);
+ if (accountName != null) {
+ Account owner = _accountMgr.getActiveAccountByName(accountName, domainId);
+ if (owner == null) {
+ // see DomainVO.java
+ throw new InvalidParameterValueException("Unable to find account " + accountName + " in specified domain");
+ }
+
+ _accountMgr.checkAccess(caller, null, true, owner);
+ permittedAccounts.add(owner.getId());
+ }
+ }
+
+ if (!_accountMgr.isAdmin(caller.getId()) || (projectId != null && projectId.longValue() != -1 && domainId == null)) {
+ permittedAccounts.add(caller.getId());
+ domainId = caller.getDomainId();
+ }
+ // set project information
+ boolean skipProjectNetworks = true;
+ if (projectId != null) {
+ if (projectId.longValue() == -1) {
+ if (!_accountMgr.isAdmin(caller.getId())) {
+ permittedAccounts.addAll(_projectMgr.listPermittedProjectAccounts(caller.getId()));
+ }
+ } else {
+ permittedAccounts.clear();
+ Project project = _projectMgr.getProject(projectId);
+ if (project == null) {
+ throw new InvalidParameterValueException("Unable to find project by specified id");
+ }
+ if (!_projectMgr.canAccessProjectAccount(caller, project.getProjectAccountId())) {
+ // getProject() returns type ProjectVO.
+ InvalidParameterValueException ex = new InvalidParameterValueException("Account " + caller + " cannot access specified project id");
+ ex.addProxyObject(project.getUuid(), "projectId");
+ throw ex;
+ }
+
+ //add project account
+ permittedAccounts.add(project.getProjectAccountId());
+ //add caller account (if admin)
+ if (_accountMgr.isAdmin(caller.getId())) {
+ permittedAccounts.add(caller.getId());
+ }
+ }
+ skipProjectNetworks = false;
+ }
+
+ if (domainId != null) {
+ path = _domainDao.findById(domainId).getPath();
+ } else {
+ path = _domainDao.findById(caller.getDomainId()).getPath();
+ }
if (listAll && domainId == null) {
isRecursive = true;
@@ -1430,7 +1484,6 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
Filter searchFilter = new Filter(NetworkVO.class, "id", false, null, null);
SearchBuilder<NetworkVO> sb = _networksDao.createSearchBuilder();
- _accountMgr.buildACLSearchBuilder(sb, isRecursive, permittedDomains, permittedAccounts, permittedResources, listProjectResourcesCriteria);
if (forVpc != null) {
if (forVpc) {
@@ -1465,9 +1518,122 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
sb.join("tagSearch", tagSearch, sb.entity().getId(), tagSearch.entity().getResourceId(), JoinBuilder.JoinType.INNER);
}
- // build network search criteria
+ if (permittedAccounts.isEmpty()) {
+ SearchBuilder<DomainVO> domainSearch = _domainDao.createSearchBuilder();
+ domainSearch.and("path", domainSearch.entity().getPath(), SearchCriteria.Op.LIKE);
+ sb.join("domainSearch", domainSearch, sb.entity().getDomainId(), domainSearch.entity().getId(), JoinBuilder.JoinType.INNER);
+ }
+
+ SearchBuilder<AccountVO> accountSearch = _accountDao.createSearchBuilder();
+ accountSearch.and("typeNEQ", accountSearch.entity().getType(), SearchCriteria.Op.NEQ);
+ accountSearch.and("typeEQ", accountSearch.entity().getType(), SearchCriteria.Op.EQ);
+
+ sb.join("accountSearch", accountSearch, sb.entity().getAccountId(), accountSearch.entity().getId(), JoinBuilder.JoinType.INNER);
+
+ List<NetworkVO> networksToReturn = new ArrayList<NetworkVO>();
+
+ if (isSystem == null || !isSystem) {
+ if (!permittedAccounts.isEmpty()) {
+ //get account level networks
+ networksToReturn.addAll(listAccountSpecificNetworks(
+ buildNetworkSearchCriteria(sb, keyword, id, isSystem, zoneId, guestIpType, trafficType, physicalNetworkId, aclType, skipProjectNetworks, restartRequired,
+ specifyIpRanges, vpcId, tags, display), searchFilter, permittedAccounts));
+ //get domain level networks
+ if (domainId != null) {
+ networksToReturn.addAll(listDomainLevelNetworks(
+ buildNetworkSearchCriteria(sb, keyword, id, isSystem, zoneId, guestIpType, trafficType, physicalNetworkId, aclType, true, restartRequired,
+ specifyIpRanges, vpcId, tags, display), searchFilter, domainId, false));
+ }
+ } else {
+ //add account specific networks
+ networksToReturn.addAll(listAccountSpecificNetworksByDomainPath(
+ buildNetworkSearchCriteria(sb, keyword, id, isSystem, zoneId, guestIpType, trafficType, physicalNetworkId, aclType, skipProjectNetworks, restartRequired,
+ specifyIpRanges, vpcId, tags, display), searchFilter, path, isRecursive));
+ //add domain specific networks of domain + parent domains
+ networksToReturn.addAll(listDomainSpecificNetworksByDomainPath(
+ buildNetworkSearchCriteria(sb, keyword, id, isSystem, zoneId, guestIpType, trafficType, physicalNetworkId, aclType, skipProjectNetworks, restartRequired,
+ specifyIpRanges, vpcId, tags, display), searchFilter, path, isRecursive));
+ //add networks of subdomains
+ if (domainId == null) {
+ networksToReturn.addAll(listDomainLevelNetworks(
+ buildNetworkSearchCriteria(sb, keyword, id, isSystem, zoneId, guestIpType, trafficType, physicalNetworkId, aclType, true, restartRequired,
+ specifyIpRanges, vpcId, tags, display), searchFilter, caller.getDomainId(), true));
+ }
+ }
+ } else {
+ networksToReturn = _networksDao.search(
+ buildNetworkSearchCriteria(sb, keyword, id, isSystem, zoneId, guestIpType, trafficType, physicalNetworkId, null, skipProjectNetworks, restartRequired,
+ specifyIpRanges, vpcId, tags, display), searchFilter);
+ }
+
+ if (supportedServicesStr != null && !supportedServicesStr.isEmpty() && !networksToReturn.isEmpty()) {
+ List<NetworkVO> supportedNetworks = new ArrayList<NetworkVO>();
+ Service[] suppportedServices = new Service[supportedServicesStr.size()];
+ int i = 0;
+ for (String supportedServiceStr : supportedServicesStr) {
+ Service service = Service.getService(supportedServiceStr);
+ if (service == null) {
+ throw new InvalidParameterValueException("Invalid service specified " + supportedServiceStr);
+ } else {
+ suppportedServices[i] = service;
+ }
+ i++;
+ }
+
+ for (NetworkVO network : networksToReturn) {
+ if (areServicesSupportedInNetwork(network.getId(), suppportedServices)) {
+ supportedNetworks.add(network);
+ }
+ }
+
+ networksToReturn = supportedNetworks;
+ }
+
+ if (canUseForDeploy != null) {
+ List<NetworkVO> networksForDeploy = new ArrayList<NetworkVO>();
+ for (NetworkVO network : networksToReturn) {
+ if (_networkModel.canUseForDeploy(network) == canUseForDeploy) {
+ networksForDeploy.add(network);
+ }
+ }
+
+ networksToReturn = networksForDeploy;
+ }
+
+ //Now apply pagination
+ //Most likely pageSize will never exceed int value, and we need integer to partition the listToReturn
+ boolean notNull = cmd.getStartIndex() != null && cmd.getPageSizeVal() != null;
+ if (notNull && cmd.getStartIndex() <= Integer.MAX_VALUE && cmd.getStartIndex() >= Integer.MIN_VALUE && cmd.getPageSizeVal() <= Integer.MAX_VALUE
+ && cmd.getPageSizeVal() >= Integer.MIN_VALUE) {
+ int index = cmd.getStartIndex().intValue() == 0 ? 0 : cmd.getStartIndex().intValue() / cmd.getPageSizeVal().intValue();
+ List<NetworkVO> wPagination = new ArrayList<NetworkVO>();
+ List<List<NetworkVO>> partitions = partitionNetworks(networksToReturn, cmd.getPageSizeVal().intValue());
+ if (index < partitions.size()) {
+ wPagination = partitions.get(index);
+ }
+ return new Pair<List<? extends Network>, Integer>(wPagination, networksToReturn.size());
+ }
+
+ return new Pair<List<? extends Network>, Integer>(networksToReturn, networksToReturn.size());
+ }
+
+ private static List<List<NetworkVO>> partitionNetworks(List<NetworkVO> originalList, int chunkSize) {
+ List<List<NetworkVO>> listOfChunks = new ArrayList<List<NetworkVO>>();
+ for (int i = 0; i < originalList.size() / chunkSize; i++) {
+ listOfChunks.add(originalList.subList(i * chunkSize, i * chunkSize + chunkSize));
+ }
+ if (originalList.size() % chunkSize != 0) {
+ listOfChunks.add(originalList.subList(originalList.size() - originalList.size() % chunkSize, originalList.size()));
+ }
+ return listOfChunks;
+ }
+
+ private SearchCriteria<NetworkVO> buildNetworkSearchCriteria(SearchBuilder<NetworkVO> sb, String keyword, Long id, Boolean isSystem, Long zoneId, String guestIpType,
+ String trafficType, Long physicalNetworkId, String aclType, boolean skipProjectNetworks, Boolean restartRequired, Boolean specifyIpRanges, Long vpcId,
+ Map<String, String> tags, Boolean display) {
+
SearchCriteria<NetworkVO> sc = sb.create();
- _accountMgr.buildACLSearchCriteria(sc, isRecursive, permittedDomains, permittedAccounts, permittedResources, listProjectResourcesCriteria);
+
if (isSystem != null) {
sc.setJoinParameters("networkOfferingSearch", "systemOnly", isSystem);
}
@@ -1506,6 +1672,12 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
sc.addAnd("physicalNetworkId", SearchCriteria.Op.EQ, physicalNetworkId);
}
+ if (skipProjectNetworks) {
+ sc.setJoinParameters("accountSearch", "typeNEQ", Account.ACCOUNT_TYPE_PROJECT);
+ } else {
+ sc.setJoinParameters("accountSearch", "typeEQ", Account.ACCOUNT_TYPE_PROJECT);
+ }
+
if (restartRequired != null) {
sc.addAnd("restartRequired", SearchCriteria.Op.EQ, restartRequired);
}
@@ -1528,70 +1700,94 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
}
}
- List<NetworkVO> networksToReturn = _networksDao.search(sc, searchFilter);
+ return sc;
+ }
- // filter by supported services
- if (supportedServicesStr != null && !supportedServicesStr.isEmpty() && !networksToReturn.isEmpty()) {
- List<NetworkVO> supportedNetworks = new ArrayList<NetworkVO>();
- Service[] suppportedServices = new Service[supportedServicesStr.size()];
- int i = 0;
- for (String supportedServiceStr : supportedServicesStr) {
- Service service = Service.getService(supportedServiceStr);
- if (service == null) {
- throw new InvalidParameterValueException("Invalid service specified " + supportedServiceStr);
- } else {
- suppportedServices[i] = service;
- }
- i++;
- }
+ private List<NetworkVO> listDomainLevelNetworks(SearchCriteria<NetworkVO> sc, Filter searchFilter, long domainId, boolean parentDomainsOnly) {
+ List<Long> networkIds = new ArrayList<Long>();
+ Set<Long> allowedDomains = _domainMgr.getDomainParentIds(domainId);
+ List<NetworkDomainVO> maps = _networkDomainDao.listDomainNetworkMapByDomain(allowedDomains.toArray());
- for (NetworkVO network : networksToReturn) {
- if (areServicesSupportedInNetwork(network.getId(), suppportedServices)) {
- supportedNetworks.add(network);
- }
+ for (NetworkDomainVO map : maps) {
+ if (map.getDomainId() == domainId && parentDomainsOnly) {
+ continue;
+ }
+ boolean subdomainAccess = (map.isSubdomainAccess() != null) ? map.isSubdomainAccess() : getAllowSubdomainAccessGlobal();
+ if (map.getDomainId() == domainId || subdomainAccess) {
+ networkIds.add(map.getNetworkId());
}
-
- networksToReturn = supportedNetworks;
}
- // filter by usability to deploy
- if (canUseForDeploy != null) {
- List<NetworkVO> networksForDeploy = new ArrayList<NetworkVO>();
- for (NetworkVO network : networksToReturn) {
- if (_networkModel.canUseForDeploy(network) == canUseForDeploy) {
- networksForDeploy.add(network);
- }
- }
+ if (!networkIds.isEmpty()) {
+ SearchCriteria<NetworkVO> domainSC = _networksDao.createSearchCriteria();
+ domainSC.addAnd("id", SearchCriteria.Op.IN, networkIds.toArray());
+ domainSC.addAnd("aclType", SearchCriteria.Op.EQ, ACLType.Domain.toString());
- networksToReturn = networksForDeploy;
+ sc.addAnd("id", SearchCriteria.Op.SC, domainSC);
+ return _networksDao.search(sc, searchFilter);
+ } else {
+ return new ArrayList<NetworkVO>();
}
+ }
- //Now apply pagination
- //Most likely pageSize will never exceed int value, and we need integer to partition the listToReturn
- boolean notNull = cmd.getStartIndex() != null && cmd.getPageSizeVal() != null;
- if (notNull && cmd.getStartIndex() <= Integer.MAX_VALUE && cmd.getStartIndex() >= Integer.MIN_VALUE && cmd.getPageSizeVal() <= Integer.MAX_VALUE
- && cmd.getPageSizeVal() >= Integer.MIN_VALUE) {
- int index = cmd.getStartIndex().intValue() == 0 ? 0 : cmd.getStartIndex().intValue() / cmd.getPageSizeVal().intValue();
- List<NetworkVO> wPagination = new ArrayList<NetworkVO>();
- List<List<NetworkVO>> partitions = partitionNetworks(networksToReturn, cmd.getPageSizeVal().intValue());
- if (index < partitions.size()) {
- wPagination = partitions.get(index);
+ private List<NetworkVO> listAccountSpecificNetworks(SearchCriteria<NetworkVO> sc, Filter searchFilter, List<Long> permittedAccounts) {
+ SearchCriteria<NetworkVO> accountSC = _networksDao.createSearchCriteria();
+ if (!permittedAccounts.isEmpty()) {
+ accountSC.addAnd("accountId", SearchCriteria.Op.IN, permittedAccounts.toArray());
+ }
+
+ accountSC.addAnd("aclType", SearchCriteria.Op.EQ, ACLType.Account.toString());
+
+ sc.addAnd("id", SearchCriteria.Op.SC, accountSC);
+ return _networksDao.search(sc, searchFilter);
+ }
+
+ private List<NetworkVO> listAccountSpecificNetworksByDomainPath(SearchCriteria<NetworkVO> sc, Filter searchFilter, String path, boolean isRecursive) {
+ SearchCriteria<NetworkVO> accountSC = _networksDao.createSearchCriteria();
+ accountSC.addAnd("aclType", SearchCriteria.Op.EQ, ACLType.Account.toString());
+
+ if (path != null) {
+ if (isRecursive) {
+ sc.setJoinParameters("domainSearch", "path", path + "%");
+ } else {
+ sc.setJoinParameters("domainSearch", "path", path);
}
- return new Pair<List<? extends Network>, Integer>(wPagination, networksToReturn.size());
}
- return new Pair<List<? extends Network>, Integer>(networksToReturn, networksToReturn.size());
+ sc.addAnd("id", SearchCriteria.Op.SC, accountSC);
+ return _networksDao.search(sc, searchFilter);
}
- private static List<List<NetworkVO>> partitionNetworks(List<NetworkVO> originalList, int chunkSize) {
- List<List<NetworkVO>> listOfChunks = new ArrayList<List<NetworkVO>>();
- for (int i = 0; i < originalList.size() / chunkSize; i++) {
- listOfChunks.add(originalList.subList(i * chunkSize, i * chunkSize + chunkSize));
+ private List<NetworkVO> listDomainSpecificNetworksByDomainPath(SearchCriteria<NetworkVO> sc, Filter searchFilter, String path, boolean isRecursive) {
+
+ Set<Long> allowedDomains = new HashSet<Long>();
+ if (path != null) {
+ if (isRecursive) {
+ allowedDomains = _domainMgr.getDomainChildrenIds(path);
+ } else {
+ Domain domain = _domainDao.findDomainByPath(path);
+ allowedDomains.add(domain.getId());
+ }
}
- if (originalList.size() % chunkSize != 0) {
- listOfChunks.add(originalList.subList(originalList.size() - originalList.size() % chunkSize, originalList.size()));
+
+ List<Long> networkIds = new ArrayList<Long>();
+
+ List<NetworkDomainVO> maps = _networkDomainDao.listDomainNetworkMapByDomain(allowedDomains.toArray());
+
+ for (NetworkDomainVO map : maps) {
+ networkIds.add(map.getNetworkId());
+ }
+
+ if (!networkIds.isEmpty()) {
+ SearchCriteria<NetworkVO> domainSC = _networksDao.createSearchCriteria();
+ domainSC.addAnd("id", SearchCriteria.Op.IN, networkIds.toArray());
+ domainSC.addAnd("aclType", SearchCriteria.Op.EQ, ACLType.Domain.toString());
+
+ sc.addAnd("id", SearchCriteria.Op.SC, domainSC);
+ return _networksDao.search(sc, searchFilter);
+ } else {
+ return new ArrayList<NetworkVO>();
}
- return listOfChunks;
}
@Override
[2/6] git commit: updated refs/heads/master to 44ff7fe
Posted by mc...@apache.org.
CLOUDSTACK-6349: IAM - No error message presented to the user , when
invalid password is provided.
- AccountManager now works using accountId instead of accountType in
following methods too:
- isResourceDomainAdmin()
- isAdmin()
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/9514c9e0
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/9514c9e0
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/9514c9e0
Branch: refs/heads/master
Commit: 9514c9e0455d69988b1cd2f79d0b276fc1ebcc04
Parents: 7971694
Author: Prachi Damle <pr...@cloud.com>
Authored: Mon Apr 28 11:10:50 2014 -0700
Committer: Min Chen <mi...@citrix.com>
Committed: Mon Apr 28 11:10:50 2014 -0700
----------------------------------------------------------------------
api/src/com/cloud/user/AccountService.java | 2 +-
.../api/command/admin/user/CreateUserCmd.java | 2 +-
.../affinitygroup/CreateAffinityGroupCmd.java | 2 +-
.../affinitygroup/DeleteAffinityGroupCmd.java | 2 +-
.../api/command/user/iso/ListIsosCmd.java | 2 +-
.../user/resource/UpdateResourceCountCmd.java | 2 +-
.../securitygroup/CreateSecurityGroupCmd.java | 2 +-
.../command/user/ssh/DeleteSSHKeyPairCmd.java | 2 +-
.../command/user/template/ListTemplatesCmd.java | 2 +-
.../user/volume/ListResourceDetailsCmd.java | 2 +-
.../contrail/management/MockAccountManager.java | 2 +-
server/src/com/cloud/acl/DomainChecker.java | 4 ++
server/src/com/cloud/api/ApiDBUtils.java | 2 +-
.../com/cloud/api/query/QueryManagerImpl.java | 6 +--
.../api/query/dao/TemplateJoinDaoImpl.java | 2 +-
.../com/cloud/network/NetworkServiceImpl.java | 4 +-
.../resourcelimit/ResourceLimitManagerImpl.java | 2 +-
.../storage/snapshot/SnapshotManagerImpl.java | 2 +-
.../com/cloud/template/TemplateAdapterBase.java | 2 +-
.../com/cloud/template/TemplateManagerImpl.java | 4 +-
.../src/com/cloud/user/AccountManagerImpl.java | 41 +++++++++++++++-----
server/src/com/cloud/vm/UserVmManagerImpl.java | 2 +-
.../com/cloud/user/MockAccountManagerImpl.java | 2 +-
.../api/command/iam/CreateIAMGroupCmd.java | 2 +-
.../api/command/iam/CreateIAMPolicyCmd.java | 2 +-
25 files changed, 63 insertions(+), 36 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/com/cloud/user/AccountService.java
----------------------------------------------------------------------
diff --git a/api/src/com/cloud/user/AccountService.java b/api/src/com/cloud/user/AccountService.java
index 4b5dc36..71136bf 100755
--- a/api/src/com/cloud/user/AccountService.java
+++ b/api/src/com/cloud/user/AccountService.java
@@ -74,7 +74,7 @@ public interface AccountService {
User
createUser(String userName, String password, String firstName, String lastName, String email, String timeZone, String accountName, Long domainId, String userUUID);
- boolean isAdmin(short accountType);
+ boolean isAdmin(Long accountId);
Account finalizeOwner(Account caller, String accountName, Long domainId, Long projectId);
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/admin/user/CreateUserCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/admin/user/CreateUserCmd.java b/api/src/org/apache/cloudstack/api/command/admin/user/CreateUserCmd.java
index 51e218d..8f223ac 100644
--- a/api/src/org/apache/cloudstack/api/command/admin/user/CreateUserCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/admin/user/CreateUserCmd.java
@@ -131,7 +131,7 @@ public class CreateUserCmd extends BaseCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/affinitygroup/CreateAffinityGroupCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/affinitygroup/CreateAffinityGroupCmd.java b/api/src/org/apache/cloudstack/api/command/user/affinitygroup/CreateAffinityGroupCmd.java
index c30e528..96d8bec 100644
--- a/api/src/org/apache/cloudstack/api/command/user/affinitygroup/CreateAffinityGroupCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/affinitygroup/CreateAffinityGroupCmd.java
@@ -102,7 +102,7 @@ public class CreateAffinityGroupCmd extends BaseAsyncCreateCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/affinitygroup/DeleteAffinityGroupCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/affinitygroup/DeleteAffinityGroupCmd.java b/api/src/org/apache/cloudstack/api/command/user/affinitygroup/DeleteAffinityGroupCmd.java
index 945592b..21c2fa8 100644
--- a/api/src/org/apache/cloudstack/api/command/user/affinitygroup/DeleteAffinityGroupCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/affinitygroup/DeleteAffinityGroupCmd.java
@@ -110,7 +110,7 @@ public class DeleteAffinityGroupCmd extends BaseAsyncCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/iso/ListIsosCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/iso/ListIsosCmd.java b/api/src/org/apache/cloudstack/api/command/user/iso/ListIsosCmd.java
index 3aabf92..88e4326 100644
--- a/api/src/org/apache/cloudstack/api/command/user/iso/ListIsosCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/iso/ListIsosCmd.java
@@ -121,7 +121,7 @@ public class ListIsosCmd extends BaseListTaggedResourcesCmd {
public boolean listInReadyState() {
Account account = CallContext.current().getCallingAccount();
// It is account specific if account is admin type and domainId and accountName are not null
- boolean isAccountSpecific = (account == null || _accountService.isAdmin(account.getType())) && (getAccountName() != null) && (getDomainId() != null);
+ boolean isAccountSpecific = (account == null || _accountService.isAdmin(account.getId())) && (getAccountName() != null) && (getDomainId() != null);
// Show only those that are downloaded.
TemplateFilter templateFilter = TemplateFilter.valueOf(getIsoFilter());
boolean onlyReady =
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java b/api/src/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
index 5a41749..81d725b 100644
--- a/api/src/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
@@ -106,7 +106,7 @@ public class UpdateResourceCountCmd extends BaseCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/securitygroup/CreateSecurityGroupCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/securitygroup/CreateSecurityGroupCmd.java b/api/src/org/apache/cloudstack/api/command/user/securitygroup/CreateSecurityGroupCmd.java
index b5758ca..d3d35bc 100644
--- a/api/src/org/apache/cloudstack/api/command/user/securitygroup/CreateSecurityGroupCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/securitygroup/CreateSecurityGroupCmd.java
@@ -97,7 +97,7 @@ public class CreateSecurityGroupCmd extends BaseCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/ssh/DeleteSSHKeyPairCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/ssh/DeleteSSHKeyPairCmd.java b/api/src/org/apache/cloudstack/api/command/user/ssh/DeleteSSHKeyPairCmd.java
index 0709686..9258587 100644
--- a/api/src/org/apache/cloudstack/api/command/user/ssh/DeleteSSHKeyPairCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/ssh/DeleteSSHKeyPairCmd.java
@@ -93,7 +93,7 @@ public class DeleteSSHKeyPairCmd extends BaseCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/template/ListTemplatesCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/template/ListTemplatesCmd.java b/api/src/org/apache/cloudstack/api/command/user/template/ListTemplatesCmd.java
index 249aa0e..7a2a158 100644
--- a/api/src/org/apache/cloudstack/api/command/user/template/ListTemplatesCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/template/ListTemplatesCmd.java
@@ -103,7 +103,7 @@ public class ListTemplatesCmd extends BaseListTaggedResourcesCmd {
Account account = CallContext.current().getCallingAccount();
// It is account specific if account is admin type and domainId and accountName are not null
- boolean isAccountSpecific = (account == null || _accountService.isAdmin(account.getType())) && (getAccountName() != null) && (getDomainId() != null);
+ boolean isAccountSpecific = (account == null || _accountService.isAdmin(account.getId())) && (getAccountName() != null) && (getDomainId() != null);
// Show only those that are downloaded.
TemplateFilter templateFilter = TemplateFilter.valueOf(getTemplateFilter());
boolean onlyReady =
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/api/src/org/apache/cloudstack/api/command/user/volume/ListResourceDetailsCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/user/volume/ListResourceDetailsCmd.java b/api/src/org/apache/cloudstack/api/command/user/volume/ListResourceDetailsCmd.java
index 93dc29d..afbfb99 100644
--- a/api/src/org/apache/cloudstack/api/command/user/volume/ListResourceDetailsCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/user/volume/ListResourceDetailsCmd.java
@@ -80,7 +80,7 @@ public class ListResourceDetailsCmd extends BaseListProjectAndAccountResourcesCm
List<ResourceDetailResponse> resourceDetailResponse = _queryService.listResourceDetails(this);
response.setResponses(resourceDetailResponse);
response.setResponseName(getCommandName());
- this.setResponseObject(response);
+ setResponseObject(response);
}
public ResourceTag.ResourceObjectType getResourceType() {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
----------------------------------------------------------------------
diff --git a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
index 1b4b96e..e9bbc8e 100644
--- a/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
+++ b/plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
@@ -165,7 +165,7 @@ public class MockAccountManager extends ManagerBase implements AccountManager {
}
@Override
- public boolean isAdmin(short arg0) {
+ public boolean isAdmin(Long accountId) {
// TODO Auto-generated method stub
return false;
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/acl/DomainChecker.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/acl/DomainChecker.java b/server/src/com/cloud/acl/DomainChecker.java
index da39f51..9ee65db 100755
--- a/server/src/com/cloud/acl/DomainChecker.java
+++ b/server/src/com/cloud/acl/DomainChecker.java
@@ -350,6 +350,10 @@ public class DomainChecker extends AdapterBase implements SecurityChecker {
if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN) {
return true;
}
+ } else if (action != null && ("DomainResourceCapability".equals(action))) {
+ if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN) {
+ return true;
+ }
}
return checkAccess(caller, entity, accessType);
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/api/ApiDBUtils.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ApiDBUtils.java b/server/src/com/cloud/api/ApiDBUtils.java
index 67e47f7..2da107f 100755
--- a/server/src/com/cloud/api/ApiDBUtils.java
+++ b/server/src/com/cloud/api/ApiDBUtils.java
@@ -1829,7 +1829,7 @@ public class ApiDBUtils {
}
public static boolean isAdmin(Account account) {
- return s_accountService.isAdmin(account.getType());
+ return s_accountService.isAdmin(account.getId());
}
public static List<ResourceTagJoinVO> listResourceTagViewByResourceUUID(String resourceUUID, ResourceObjectType resourceType) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/api/query/QueryManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/query/QueryManagerImpl.java b/server/src/com/cloud/api/query/QueryManagerImpl.java
index a007a07..dcb32a9 100644
--- a/server/src/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/com/cloud/api/query/QueryManagerImpl.java
@@ -777,7 +777,7 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
Object keyword = cmd.getKeyword();
boolean isAdmin = false;
boolean isRootAdmin = false;
- if (_accountMgr.isAdmin(caller.getType())) {
+ if (_accountMgr.isAdmin(caller.getId())) {
isAdmin = true;
}
if (_accountMgr.isRootAdmin(caller.getId())) {
@@ -1279,7 +1279,7 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
sb.select(null, Func.DISTINCT, sb.entity().getId()); // select distinct
// ids
- if (_accountMgr.isAdmin(caller.getType())) {
+ if (_accountMgr.isAdmin(caller.getId())) {
if (domainId != null) {
DomainVO domain = _domainDao.findById(domainId);
if (domain == null) {
@@ -1483,7 +1483,7 @@ public class QueryManagerImpl extends ManagerBase implements QueryService {
// verify permissions - only accounts belonging to the project can list
// project's account
- if (!_accountMgr.isAdmin(caller.getType()) && _projectAccountDao.findByProjectIdAccountId(projectId, caller.getAccountId()) == null) {
+ if (!_accountMgr.isAdmin(caller.getId()) && _projectAccountDao.findByProjectIdAccountId(projectId, caller.getAccountId()) == null) {
throw new PermissionDeniedException("Account " + caller + " is not authorized to list users of the project id=" + projectId);
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/query/dao/TemplateJoinDaoImpl.java b/server/src/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
index 1cab6e8..80ef0f6 100644
--- a/server/src/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
+++ b/server/src/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
@@ -302,7 +302,7 @@ public class TemplateJoinDaoImpl extends GenericDaoBase<TemplateJoinVO, Long> im
Account caller = CallContext.current().getCallingAccount();
boolean isAdmin = false;
- if ((caller == null) || _accountService.isAdmin(caller.getType())) {
+ if ((caller == null) || _accountService.isAdmin(caller.getId())) {
isAdmin = true;
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/network/NetworkServiceImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/NetworkServiceImpl.java b/server/src/com/cloud/network/NetworkServiceImpl.java
index 696d853..6cd5cf8 100755
--- a/server/src/com/cloud/network/NetworkServiceImpl.java
+++ b/server/src/com/cloud/network/NetworkServiceImpl.java
@@ -1085,14 +1085,14 @@ public class NetworkServiceImpl extends ManagerBase implements NetworkService {
}
// Only Admin can create Shared networks
- if (ntwkOff.getGuestType() == GuestType.Shared && !_accountMgr.isAdmin(caller.getType())) {
+ if (ntwkOff.getGuestType() == GuestType.Shared && !_accountMgr.isAdmin(caller.getId())) {
throw new InvalidParameterValueException("Only Admins can create network with guest type " + GuestType.Shared);
}
// Check if the network is domain specific
if (aclType == ACLType.Domain) {
// only Admin can create domain with aclType=Domain
- if (!_accountMgr.isAdmin(caller.getType())) {
+ if (!_accountMgr.isAdmin(caller.getId())) {
throw new PermissionDeniedException("Only admin can create networks with aclType=Domain");
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/resourcelimit/ResourceLimitManagerImpl.java b/server/src/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
index 85ebe0a..2b5d976 100755
--- a/server/src/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
+++ b/server/src/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
@@ -458,7 +458,7 @@ public class ResourceLimitManagerImpl extends ManagerBase implements ResourceLim
List<ResourceLimitVO> limits = new ArrayList<ResourceLimitVO>();
boolean isAccount = true;
- if (!_accountMgr.isAdmin(caller.getType())) {
+ if (!_accountMgr.isAdmin(caller.getId())) {
accountId = caller.getId();
domainId = null;
} else {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/storage/snapshot/SnapshotManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/storage/snapshot/SnapshotManagerImpl.java b/server/src/com/cloud/storage/snapshot/SnapshotManagerImpl.java
index c22e148..d19a0ed 100755
--- a/server/src/com/cloud/storage/snapshot/SnapshotManagerImpl.java
+++ b/server/src/com/cloud/storage/snapshot/SnapshotManagerImpl.java
@@ -769,7 +769,7 @@ public class SnapshotManagerImpl extends ManagerBase implements SnapshotManager,
if (account != null) {
long volAcctId = volume.getAccountId();
- if (_accountMgr.isAdmin(account.getType())) {
+ if (_accountMgr.isAdmin(account.getId())) {
Account userAccount = _accountDao.findById(Long.valueOf(volAcctId));
if (!_domainDao.isChildDomain(account.getDomainId(), userAccount.getDomainId())) {
throw new PermissionDeniedException("Unable to list snapshot schedule for volume " + volumeId + ", permission denied.");
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/template/TemplateAdapterBase.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/template/TemplateAdapterBase.java b/server/src/com/cloud/template/TemplateAdapterBase.java
index c84132d..cb38075 100755
--- a/server/src/com/cloud/template/TemplateAdapterBase.java
+++ b/server/src/com/cloud/template/TemplateAdapterBase.java
@@ -320,7 +320,7 @@ public abstract class TemplateAdapterBase extends AdapterBase implements Templat
private Long accountAndUserValidation(Account account, long userId, UserVmVO vmInstanceCheck, VMTemplateVO template, String msg) throws PermissionDeniedException {
if (account != null) {
- if (!_accountMgr.isAdmin(account.getType())) {
+ if (!_accountMgr.isAdmin(account.getId())) {
if ((vmInstanceCheck != null) && (account.getId() != vmInstanceCheck.getAccountId())) {
throw new PermissionDeniedException(msg + ". Permission denied.");
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/template/TemplateManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/template/TemplateManagerImpl.java b/server/src/com/cloud/template/TemplateManagerImpl.java
index 0a32c8e..ead841f 100755
--- a/server/src/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/com/cloud/template/TemplateManagerImpl.java
@@ -1218,7 +1218,7 @@ public class TemplateManagerImpl extends ManagerBase implements TemplateManager,
throw new InvalidParameterValueException("unable to update permissions for " + mediaType + " with id " + id);
}
- boolean isAdmin = _accountMgr.isAdmin(caller.getType());
+ boolean isAdmin = _accountMgr.isAdmin(caller.getId());
// check configuration parameter(allow.public.user.templates) value for
// the template owner
boolean allowPublicUserTemplates = AllowPublicUserTemplates.valueIn(template.getAccountId());
@@ -1485,7 +1485,7 @@ public class TemplateManagerImpl extends ManagerBase implements TemplateManager,
Long userId = CallContext.current().getCallingUserId();
Account caller = CallContext.current().getCallingAccount();
- boolean isAdmin = (_accountMgr.isAdmin(caller.getType()));
+ boolean isAdmin = (_accountMgr.isAdmin(caller.getId()));
_accountMgr.checkAccess(caller, null, templateOwner);
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/user/AccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index c28ff7d..d265816 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -353,9 +353,17 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
}
@Override
- public boolean isAdmin(short accountType) {
- return ((accountType == Account.ACCOUNT_TYPE_ADMIN) || (accountType == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN) ||
- (accountType == Account.ACCOUNT_TYPE_DOMAIN_ADMIN) || (accountType == Account.ACCOUNT_TYPE_READ_ONLY_ADMIN));
+ public boolean isAdmin(Long accountId) {
+ if (accountId != null) {
+ AccountVO acct = _accountDao.findById(accountId);
+ if ((isRootAdmin(accountId)) || (isDomainAdmin(accountId)) || (isResourceDomainAdmin(accountId))) {
+ return true;
+ } else if (acct.getType() == Account.ACCOUNT_TYPE_READ_ONLY_ADMIN) {
+ return true;
+ }
+
+ }
+ return false;
}
@Override
@@ -386,7 +394,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
try {
if (checker.checkAccess(acct, null, null, "DomainCapability")) {
if (s_logger.isDebugEnabled()) {
- s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
+ s_logger.debug("DomainAdmin Access granted to " + acct + " by " + checker.getName());
}
return true;
}
@@ -407,8 +415,23 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
return false;
}
- public boolean isResourceDomainAdmin(short accountType) {
- return (accountType == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN);
+ public boolean isResourceDomainAdmin(Long accountId) {
+ if (accountId != null) {
+ AccountVO acct = _accountDao.findById(accountId);
+ for (SecurityChecker checker : _securityCheckers) {
+ try {
+ if (checker.checkAccess(acct, null, null, "DomainResourceCapability")) {
+ if (s_logger.isDebugEnabled()) {
+ s_logger.debug("ResourceDomainAdmin Access granted to " + acct + " by " + checker.getName());
+ }
+ return true;
+ }
+ } catch (PermissionDeniedException ex) {
+ return false;
+ }
+ }
+ }
+ return false;
}
public boolean isInternalAccount(long accountId) {
@@ -476,7 +499,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
@Override
public Long checkAccessAndSpecifyAuthority(Account caller, Long zoneId) {
// We just care for resource domain admin for now. He should be permitted to see only his zone.
- if (isResourceDomainAdmin(caller.getType())) {
+ if (isResourceDomainAdmin(caller.getAccountId())) {
if (zoneId == null)
return getZoneIdForAccount(caller);
else if (zoneId.compareTo(getZoneIdForAccount(caller)) != 0)
@@ -1661,7 +1684,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
return getAccount(project.getProjectAccountId());
}
- if (isAdmin(caller.getType()) && accountName != null && domainId != null) {
+ if (isAdmin(caller.getId()) && accountName != null && domainId != null) {
Domain domain = _domainMgr.getDomain(domainId);
if (domain == null) {
throw new InvalidParameterValueException("Unable to find the domain by id=" + domainId);
@@ -1674,7 +1697,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
checkAccess(caller, domain);
return owner;
- } else if (!isAdmin(caller.getType()) && accountName != null && domainId != null) {
+ } else if (!isAdmin(caller.getId()) && accountName != null && domainId != null) {
if (!accountName.equals(caller.getAccountName()) || domainId.longValue() != caller.getDomainId()) {
throw new PermissionDeniedException("Can't create/list resources for account " + accountName + " in domain " + domainId + ", permission denied");
} else {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/src/com/cloud/vm/UserVmManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/vm/UserVmManagerImpl.java b/server/src/com/cloud/vm/UserVmManagerImpl.java
index 7a707ae..22f2798 100755
--- a/server/src/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/com/cloud/vm/UserVmManagerImpl.java
@@ -2075,7 +2075,7 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
long vmId = cmd.getId();
boolean expunge = cmd.getExpunge();
- if (!_accountMgr.isAdmin(ctx.getCallingAccount().getType()) && expunge) {
+ if (!_accountMgr.isAdmin(ctx.getCallingAccount().getId()) && expunge) {
throw new PermissionDeniedException("Parameter " + ApiConstants.EXPUNGE + " can be passed by Admin only");
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/server/test/com/cloud/user/MockAccountManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/test/com/cloud/user/MockAccountManagerImpl.java b/server/test/com/cloud/user/MockAccountManagerImpl.java
index 5938b3c..e53974a 100644
--- a/server/test/com/cloud/user/MockAccountManagerImpl.java
+++ b/server/test/com/cloud/user/MockAccountManagerImpl.java
@@ -120,7 +120,7 @@ public class MockAccountManagerImpl extends ManagerBase implements Manager, Acco
}
@Override
- public boolean isAdmin(short accountType) {
+ public boolean isAdmin(Long accountId) {
// TODO Auto-generated method stub
return false;
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMGroupCmd.java
----------------------------------------------------------------------
diff --git a/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMGroupCmd.java b/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMGroupCmd.java
index d0b9bc6..93940e8 100644
--- a/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMGroupCmd.java
+++ b/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMGroupCmd.java
@@ -97,7 +97,7 @@ public class CreateIAMGroupCmd extends BaseAsyncCreateCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9514c9e0/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMPolicyCmd.java
----------------------------------------------------------------------
diff --git a/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMPolicyCmd.java b/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMPolicyCmd.java
index be863de..7ebab67 100644
--- a/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMPolicyCmd.java
+++ b/services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateIAMPolicyCmd.java
@@ -104,7 +104,7 @@ public class CreateIAMPolicyCmd extends BaseAsyncCreateCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
- if ((account == null) || _accountService.isAdmin(account.getType())) {
+ if ((account == null) || _accountService.isAdmin(account.getId())) {
if ((domainId != null) && (accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {