You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2019/05/10 08:39:37 UTC
svn commit: r1859071 - in
/jackrabbit/oak/trunk/oak-authorization-principalbased/src:
main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/
main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/
tes...
Author: angela
Date: Fri May 10 08:39:37 2019
New Revision: 1859071
URL: http://svn.apache.org/viewvc?rev=1859071&view=rev
Log:
OAK-8190 : Dedicated authorization for system users (replace PrincipalPolicy by Jackrabbit API)
Removed:
jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/PrincipalPolicy.java
Modified:
jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImpl.java
jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImporter.java
jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/AccessControlManagerLimitedUserTest.java
jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/EffectivePolicyTest.java
jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalBasedAccessControlManagerTest.java
jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImplTest.java
Modified: jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImpl.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImpl.java?rev=1859071&r1=1859070&r2=1859071&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImpl.java (original)
+++ jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImpl.java Fri May 10 08:39:37 2019
@@ -19,6 +19,7 @@ package org.apache.jackrabbit.oak.spi.se
import com.google.common.base.Objects;
import com.google.common.base.Strings;
import com.google.common.collect.Maps;
+import org.apache.jackrabbit.api.security.authorization.PrincipalAccessControlList;
import org.apache.jackrabbit.api.security.authorization.PrivilegeManager;
import org.apache.jackrabbit.oak.api.Tree;
import org.apache.jackrabbit.oak.api.Type;
@@ -26,7 +27,6 @@ import org.apache.jackrabbit.oak.plugins
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ACE;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AbstractAccessControlList;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
-import org.apache.jackrabbit.oak.spi.security.authorization.principalbased.PrincipalPolicy;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
@@ -52,7 +52,7 @@ import java.util.Set;
import static org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.Constants.REP_EFFECTIVE_PATH;
-class PrincipalPolicyImpl extends AbstractAccessControlList implements PrincipalPolicy {
+class PrincipalPolicyImpl extends AbstractAccessControlList implements PrincipalAccessControlList {
private static final Logger log = LoggerFactory.getLogger(PrincipalPolicyImpl.class);
@@ -92,7 +92,7 @@ class PrincipalPolicyImpl extends Abstra
return restrictionProvider;
}
- //----------------------------------------------------< PrincipalPolicy >---
+ //-----------------------------------------< PrincipalAccessControlList >---
@Override
@NotNull
@@ -216,7 +216,7 @@ class PrincipalPolicyImpl extends Abstra
@Nullable
private String extractPathFromRestrictions(@Nullable Map<String, Value> restrictions, @NotNull String jcrName) throws RepositoryException {
if (restrictions == null || !restrictions.containsKey(jcrName)) {
- throw new AccessControlException("Entries in principal based access control need to have a path specified. Add rep:nodePath restriction or use PrincipalPolicy.addEntry(String, Privilege[], Map, Map) instead.");
+ throw new AccessControlException("Entries in principal based access control need to have a path specified. Add rep:nodePath restriction or use PrincipalAccessControlList.addEntry(String, Privilege[], Map, Map) instead.");
}
// retrieve path from restrictions and filter that restriction entry for further processing
Modified: jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImporter.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImporter.java?rev=1859071&r1=1859070&r2=1859071&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImporter.java (original)
+++ jackrabbit/oak/trunk/oak-authorization-principalbased/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImporter.java Fri May 10 08:39:37 2019
@@ -148,7 +148,7 @@ class PrincipalPolicyImporter implements
if (isValidProtectedParent(protectedParent, policy)) {
getAccessControlManager().setPolicy(policy.getPath(), policy);
} else {
- log.warn("Protected parent {} does not match path of PrincipalPolicy {}.", protectedParent.getPath(), policy.getOakPath());
+ log.warn("Protected parent {} does not match path of PrincipalAccessControlList {}.", protectedParent.getPath(), policy.getOakPath());
getAccessControlManager().removePolicy(policy.getPath(), policy);
}
}
@@ -171,7 +171,7 @@ class PrincipalPolicyImporter implements
if (isValidProtectedParent(protectedParent, policy)) {
getAccessControlManager().setPolicy(policy.getPath(), policy);
} else {
- log.warn("Protected parent {} does not match path of PrincipalPolicy {}.", protectedParent.getPath(), policy.getOakPath());
+ log.warn("Protected parent {} does not match path of PrincipalAccessControlList {}.", protectedParent.getPath(), policy.getOakPath());
getAccessControlManager().removePolicy(policy.getPath(), policy);
}
policy = null;
@@ -254,7 +254,7 @@ class PrincipalPolicyImporter implements
}
}
if (privs == null) {
- throw new ConstraintViolationException("Entries for PrincipalPolicy must specify the privileges to be granted.");
+ throw new ConstraintViolationException("Entries for PrincipalAccessControlList must specify the privileges to be granted.");
}
privileges = privs;
}
@@ -291,7 +291,7 @@ class PrincipalPolicyImporter implements
private void applyTo(@NotNull PrincipalPolicyImpl policy) throws RepositoryException {
if (effectivePath == null) {
log.error("Missing rep:effectivePath for entry {} of policy at {}", this, policy.getOakPath());
- throw new ConstraintViolationException("Entries for PrincipalPolicy must specify an effective path.");
+ throw new ConstraintViolationException("Entries for PrincipalAccessControlList must specify an effective path.");
}
policy.addEntry(Strings.emptyToNull(effectivePath), Iterables.toArray(privileges, Privilege.class), restrictions, mvRestrictions);
}
Modified: jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/AccessControlManagerLimitedUserTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/AccessControlManagerLimitedUserTest.java?rev=1859071&r1=1859070&r2=1859071&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/AccessControlManagerLimitedUserTest.java (original)
+++ jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/AccessControlManagerLimitedUserTest.java Fri May 10 08:39:37 2019
@@ -30,7 +30,6 @@ import org.apache.jackrabbit.oak.commons
import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ImmutableACL;
-import org.apache.jackrabbit.oak.spi.security.authorization.principalbased.PrincipalPolicy;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
import org.jetbrains.annotations.NotNull;
@@ -684,8 +683,8 @@ public class AccessControlManagerLimited
@Test(expected = CommitFailedException.class)
public void testRemoveEmptyPolicyTree() throws Exception {
- PrincipalPolicy policy = getPrincipalPolicyImpl(systemPrincipal, getAccessControlManager(root));
- for (AccessControlEntry entry : ((PrincipalPolicyImpl) policy).getEntries()) {
+ PrincipalPolicyImpl policy = getPrincipalPolicyImpl(systemPrincipal, getAccessControlManager(root));
+ for (AccessControlEntry entry : policy.getEntries()) {
policy.removeAccessControlEntry(entry);
}
getAccessControlManager(root).setPolicy(policy.getPath(), policy);
Modified: jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/EffectivePolicyTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/EffectivePolicyTest.java?rev=1859071&r1=1859070&r2=1859071&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/EffectivePolicyTest.java (original)
+++ jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/EffectivePolicyTest.java Fri May 10 08:39:37 2019
@@ -20,10 +20,10 @@ import com.google.common.collect.Immutab
import com.google.common.collect.ImmutableSet;
import org.apache.jackrabbit.JcrConstants;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry;
+import org.apache.jackrabbit.api.security.authorization.PrincipalAccessControlList;
import org.apache.jackrabbit.oak.commons.PathUtils;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ACE;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ImmutableACL;
-import org.apache.jackrabbit.oak.spi.security.authorization.principalbased.PrincipalPolicy;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
import org.junit.Before;
import org.junit.Test;
@@ -90,12 +90,12 @@ public class EffectivePolicyTest extends
List<JackrabbitAccessControlEntry> entries = ((ImmutableACL)effective[0]).getEntries();
assertEquals(2, entries.size());
- assertTrue(entries.get(0) instanceof PrincipalPolicy.Entry);
+ assertTrue(entries.get(0) instanceof PrincipalAccessControlList.Entry);
assertEquals(validPrincipal, entries.get(0).getPrincipal());
assertArrayEquals(privilegesFromNames(JCR_READ, REP_WRITE), entries.get(0).getPrivileges());
- assertEquals(jcrEffectivePath, ((PrincipalPolicy.Entry) entries.get(0)).getEffectivePath());
+ assertEquals(jcrEffectivePath, ((PrincipalAccessControlList.Entry) entries.get(0)).getEffectivePath());
- assertNull(((PrincipalPolicy.Entry) entries.get(1)).getEffectivePath());
+ assertNull(((PrincipalAccessControlList.Entry) entries.get(1)).getEffectivePath());
}
@Test
Modified: jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalBasedAccessControlManagerTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalBasedAccessControlManagerTest.java?rev=1859071&r1=1859070&r2=1859071&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalBasedAccessControlManagerTest.java (original)
+++ jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalBasedAccessControlManagerTest.java Fri May 10 08:39:37 2019
@@ -19,6 +19,7 @@ package org.apache.jackrabbit.oak.spi.se
import com.google.common.collect.ImmutableSet;
import org.apache.jackrabbit.JcrConstants;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlPolicy;
+import org.apache.jackrabbit.api.security.authorization.PrincipalAccessControlList;
import org.apache.jackrabbit.api.security.principal.ItemBasedPrincipal;
import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.api.Tree;
@@ -27,7 +28,6 @@ import org.apache.jackrabbit.oak.plugins
import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ImmutableACL;
import org.apache.jackrabbit.oak.spi.security.authorization.principalbased.FilterProvider;
-import org.apache.jackrabbit.oak.spi.security.authorization.principalbased.PrincipalPolicy;
import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal;
import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
@@ -227,7 +227,7 @@ public class PrincipalBasedAccessControl
@Test(expected = AccessControlException.class)
public void testSetInvalidPolicy() throws Exception {
- PrincipalPolicy policy = mock(PrincipalPolicy.class);
+ PrincipalAccessControlList policy = mock(PrincipalAccessControlList.class);
acMgr.setPolicy(validPrincipal.getPath(), policy);
}
@@ -248,7 +248,7 @@ public class PrincipalBasedAccessControl
@Test(expected = AccessControlException.class)
public void testSetPolicyNullPath() throws Exception {
- PrincipalPolicy policy = mock(PrincipalPolicy.class);
+ PrincipalAccessControlList policy = mock(PrincipalAccessControlList.class);
acMgr.setPolicy(null, policy);
}
@@ -325,7 +325,7 @@ public class PrincipalBasedAccessControl
@Test(expected = AccessControlException.class)
public void testRemoveInvalidPolicy() throws Exception {
- PrincipalPolicy policy = mock(PrincipalPolicy.class);
+ PrincipalAccessControlList policy = mock(PrincipalAccessControlList.class);
acMgr.removePolicy(validPrincipal.getPath(), policy);
}
@@ -346,7 +346,7 @@ public class PrincipalBasedAccessControl
@Test(expected = AccessControlException.class)
public void testRemovePolicyNullPath() throws Exception {
- PrincipalPolicy policy = mock(PrincipalPolicy.class);
+ PrincipalAccessControlList policy = mock(PrincipalAccessControlList.class);
acMgr.removePolicy(null, policy);
}
Modified: jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImplTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImplTest.java?rev=1859071&r1=1859070&r2=1859071&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImplTest.java (original)
+++ jackrabbit/oak/trunk/oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PrincipalPolicyImplTest.java Fri May 10 08:39:37 2019
@@ -22,6 +22,7 @@ import com.google.common.collect.Immutab
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Iterables;
+import org.apache.jackrabbit.api.security.authorization.PrincipalAccessControlList;
import org.apache.jackrabbit.api.security.authorization.PrivilegeManager;
import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Tree;
@@ -29,7 +30,6 @@ import org.apache.jackrabbit.oak.api.Typ
import org.apache.jackrabbit.oak.plugins.memory.PropertyStates;
import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
-import org.apache.jackrabbit.oak.spi.security.authorization.principalbased.PrincipalPolicy;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinitionImpl;
@@ -503,8 +503,8 @@ public class PrincipalPolicyImplTest ext
@Test
public void testOrderBefore() throws Exception {
- PrincipalPolicy.Entry entryA = policy.getEntries().get(0);
- PrincipalPolicy.Entry entryB = policy.getEntries().get(1);
+ PrincipalPolicyImpl.Entry entryA = policy.getEntries().get(0);
+ PrincipalPolicyImpl.Entry entryB = policy.getEntries().get(1);
policy.orderBefore(entryB, entryA);
assertArrayEquals(new AccessControlEntry[] {entryB, entryA}, policy.getAccessControlEntries());
@@ -512,7 +512,7 @@ public class PrincipalPolicyImplTest ext
@Test
public void testOrderBeforeDestNull() throws Exception {
- PrincipalPolicy.Entry entry = policy.getEntries().get(0);
+ PrincipalPolicyImpl.Entry entry = policy.getEntries().get(0);
policy.orderBefore(entry, null);
assertEquals(entry, policy.getAccessControlEntries()[1]);
}
@@ -524,14 +524,14 @@ public class PrincipalPolicyImplTest ext
@Test(expected = AccessControlException.class)
public void testOrderBeforeNonExistingSrc() throws Exception {
- PrincipalPolicy.Entry entry = policy.getEntries().get(0);
+ PrincipalPolicyImpl.Entry entry = policy.getEntries().get(0);
policy.removeAccessControlEntry(entry);
policy.orderBefore(entry, null);
}
@Test(expected = AccessControlException.class)
public void testOrderBeforeNonExistingDest() throws Exception {
- PrincipalPolicy.Entry entry = policy.getEntries().get(1);
+ PrincipalPolicyImpl.Entry entry = policy.getEntries().get(1);
policy.removeAccessControlEntry(entry);
policy.orderBefore(policy.getEntries().get(0), entry);
}
@@ -612,8 +612,8 @@ public class PrincipalPolicyImplTest ext
}
- private static PrincipalPolicy.Entry invalidEntry(@NotNull PrincipalPolicy.Entry entry) {
- return new PrincipalPolicy.Entry() {
+ private static PrincipalAccessControlList.Entry invalidEntry(@NotNull PrincipalAccessControlList.Entry entry) {
+ return new PrincipalAccessControlList.Entry() {
@Override
public @Nullable String getEffectivePath() {
return entry.getEffectivePath();