Author: sohil.shah(a)jboss.com Date: 2009-07-30 07:07:33 -0400 (Thu, 30 Jul 2009) New Revision: 13634 Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossGroupPageACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossUserPageACL.java Removed: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossAuthzIntegration.java Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java Log: porting "Page" security related test cases to the new framework approach * same exact functionality, just security swapped Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java 2009-07-30 11:07:33 UTC (rev 13634) @@ -0,0 +1,389 @@ +/** + * + */ +package org.exoplatform.portal.config.security.jboss; + +import java.net.URI; +import java.util.Collection; + +import org.exoplatform.portal.config.model.PortalConfig; +import org.exoplatform.portal.config.model.Page; +import org.exoplatform.services.security.MembershipEntry; + +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.services.CompositionContext; +import org.jboss.security.authz.components.action.Read; +import org.jboss.security.authz.components.action.Write; +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.subject.Identity; +import org.jboss.security.authz.components.subject.Roles; +import org.jboss.security.authz.model.Effect; +import org.jboss.security.authz.model.PolicyMetaData; + +/** + * @author soshah + * + */ +public abstract class JBossAbstractSharedPageACL extends + JBossAbstractTestUserACL +{ + protected abstract String getOwnerType(); + + public void testPage() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[0]); + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + // Assert + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + + public void testPageAccessibleByEveryone() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[] { "Everyone" }); + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + // Assert + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + true); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + + public void testPageEditableByEveryone() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[0]); + page.setEditPermission("Everyone"); + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + // Assert + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), true); + this.enforce(this.writePageEnforcementContext(this.manager, page), true); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), true); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), true); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + + public void testPageAccessibleByGuests() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[]{"whatever:/platform/guests"}); //TODO: make this "*:/platform/guests" once the custom Roles component is implemented + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + // Assert + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + + public void testPageEditableByGuests() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[0]); + page.setEditPermission("whatever:/platform/guests"); //TODO: make this "*:/platform/guests" once the custom Roles component is implemented + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + // Assert + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), true); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + + public void testPageAccessibleByEveryOneAndGuests() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[]{"Everyone", "whatever:/platform/guests"}); //TODO: make this "*:/platform/guests" once the custom Roles component is implemented + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + // Assert + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), true); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + + public void testPageWithAccessPermission() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[]{"manager:/manageable"}); + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), false); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + + //TODO: test with *:/manageable once wild card based custom Roles component is implemented + } + + public void testPageWithEditPermission() throws Exception + { + Page page = new Page(); + page.setName("index"); + page.setOwnerType(this.getOwnerType()); + page.setOwnerId("foo"); + page.setAccessPermissions(new String[0]); + page.setEditPermission("manager:/manageable"); + + this.provisionPagePolicy(page); + this.dumpPolicyRepository(); + + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), true); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), false); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + + //TODO: test with *:/manageable once wild card based custom Roles component is implemented + } + // ------------------------------------------------------------------------------------------------------------------------------------------------------------------ + /** + * Provisioning Phase: Provisions the Policy associated with the "Page". The + * Policy Structure is created using "Security Components" whose state is + * populated from state of the Page Object + * + * + * TODO: If OwnerType is User, it needs the Policy Combining Algorithm customization feature from + * the core framework + */ + private void provisionPagePolicy(Page page) throws Exception + { + // SetUp Resource + URIResource target = new URIResource(); + target.setUri(new URI(page.getName())); + + // Setup the Context for the Composition with these components + CompositionContext context = new CompositionContext(); + context.setPolicyTarget(target); + + // Read Access + if (page.getAccessPermissions() != null + && page.getAccessPermissions().length > 0) + { + Roles readRoles = new Roles(); + String[] accessPermissions = page.getAccessPermissions(); + for (String accessPermission : accessPermissions) + { + readRoles.addName(accessPermission); + } + context.addPolicyRule(Effect.PERMIT, new Read(), readRoles, + "allowExpression"); + } + + // Write Access + String editPermission = page.getEditPermission(); + if (editPermission != null && editPermission.trim().length() > 0) + { + Roles writeRoles = new Roles(); + writeRoles.addName(editPermission); + context.addPolicyRule(Effect.PERMIT, new Write(), writeRoles, + "allowExpression"); + } + + // Super User/Everyone (gives access without further evaluation) + org.jboss.security.authz.components.subject.Identity superuser = new org.jboss.security.authz.components.subject.Identity(); + superuser.setName(this.root.getId()); // Provided via system configuration + + // Setup the super user and everyone based rules + context.addPolicyRule(Effect.PERMIT, new Write(), superuser); + + // SetUp OwnerType based Rules + if (page.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + OwnerType ownerType = new OwnerType(); + ownerType.setType(PortalConfig.USER_TYPE); + + Identity identity = new Identity(); + identity.setName(page.getOwnerId()); + + context.addPolicyRule(Effect.PERMIT, ownerType, identity); + } + + // Store the policy into the Policy Server + PolicyMetaData policyMetaData = this.policyComposer.compose(context); + this.provisioner.newPolicy(policyMetaData); + } + + // ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- + /** + * Enforcement Phase: Creates an EnforcementContext for an incoming request + * that is trying to "Read the Page Object". The EnforcementContext is + * populated with "Security Components" whose state comes from the state of + * the application for the incoming thread + */ + private EnforcementContext readPageEnforcementContext(User user, Page page) + throws Exception + { + // Create an EnforcementContext + EnforcementContext context = this.accessPageEnforcementContext(user, page); + + // Create Action + context.setAttribute("action", new Read()); + + return context; + } + + /** + * Enforcement Phase: Creates an EnforcementContext for an incoming request + * that is trying to "Edit the Portal Object". The EnforcementContext is + * populated with "Security Components" whose state comes from the state of + * the application for the incoming thread + */ + private EnforcementContext writePageEnforcementContext(User user, Page page) + throws Exception + { + // Create an EnforcementContext + EnforcementContext context = this.accessPageEnforcementContext(user, page); + + // Create Action + context.setAttribute("action", new Write()); + + return context; + } + + private EnforcementContext accessPageEnforcementContext(User user, Page page) + throws Exception + { + // Create an EnforcementContext + EnforcementContext context = new EnforcementContext(); + + // Create Resource + URIResource portalRes = new URIResource(); + portalRes.setUri(new URI(page.getName())); + context.setAttribute("resource", portalRes); + + // Create Identity + Identity identity = new Identity(); + if (user.getId() != null) + { + identity.setName(user.getId()); + context.setAttribute("identity", identity); + } + + // Create Roles + Roles roles = new Roles(); + roles.addName("Everyone"); + Collection<MembershipEntry> memberships = user.getMemberships(); + if (memberships != null && !memberships.isEmpty()) + { + for (MembershipEntry membership : memberships) + { + roles.addName(membership.toString()); + } + } + else + { + // Check to see if this is guest access + if (user.getId() == null) + { + // This is a guest user + roles.addName("whatever:/platform/guests"); // Provided via system configuration + roles.addName(Roles.ANONYMOUS); + } + } + context.setAttribute("roles", roles); + + return context; + } +} Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java 2009-07-30 09:59:57 UTC (rev 13633) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java 2009-07-30 11:07:33 UTC (rev 13634) @@ -124,17 +124,20 @@ everyone.addName(UserACL.EVERYONE); //Guest Group + //TODO: replace whatever:/platform/guests with *:/platform/guests once custom Roles component is implemented Roles guest = new Roles(); - guest.addName("/platform/guests"); //Provided via system configuration + //guest.addName("*:/platform/guests"); //Provided via system configuration + guest.addName("whatever:/platform/guests"); guest.addName(Roles.ANONYMOUS); guest.setMustMatchAll(true); - //TODO: use a custom Roles component //PortalCreators Group.... + //TODO: replace whatever:/platform/administrators, and whatever:/organization/management/executive-board + //with *:/platform/administrators, and *:/organization/management/executive-board once custom Roles component is implemented Roles portalCreators = new Roles(); //portalCreators.addName("*:/platform/administrators"); //Provided via system configuration - //portalCreators.addName("*:/organization/management/executive-board"); - portalCreators.addName("whatever:/platform/administrators"); //Provided via system configuration + //portalCreators.addName("*:/organization/management/executive-board"); //Provided via system configuration + portalCreators.addName("whatever:/platform/administrators"); portalCreators.addName("whatever:/organization/management/executive-board"); //Setup the Context for the Composition with these components Deleted: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossAuthzIntegration.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossAuthzIntegration.java 2009-07-30 09:59:57 UTC (rev 13633) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossAuthzIntegration.java 2009-07-30 11:07:33 UTC (rev 13634) @@ -1,131 +0,0 @@ -package org.exoplatform.portal.config.security.jboss; - - -import java.net.URI; - -import org.apache.log4j.Logger; - -import org.exoplatform.test.BasicTestCase; - -import org.jboss.security.authz.bootstrap.ServiceContainer; - -import org.jboss.security.authz.components.resource.URIResource; -import org.jboss.security.authz.components.subject.Roles; -import org.jboss.security.authz.components.action.Read; - -import org.jboss.security.authz.model.Effect; -import org.jboss.security.authz.model.Policy; -import org.jboss.security.authz.model.PolicyMetaData; - -import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; -import org.jboss.security.authz.agent.enforcement.EnforcementContext; -import org.jboss.security.authz.agent.enforcement.EnforcementResponse; -import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; - -import org.jboss.security.authz.agent.services.CompositionContext; -import org.jboss.security.authz.agent.services.PolicyComposer; - - - -/** - * - * @author soshah - * - */ -public class TestJBossAuthzIntegration extends BasicTestCase -{ - private static Logger log = Logger.getLogger(TestJBossAuthzIntegration.class); - - private PolicyComposer policyComposer; - private PolicyEnforcementPoint enforcer; - private PolicyProvisioner provisioner; - - @Override - protected void setUp() throws Exception - { - ServiceContainer.bootstrap(); - this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); - this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); - this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); - } - - public void testIntegration() throws Exception - { - //SetUp Resource - URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1/level2/index.html")); - - Read action = new Read(); - - Roles allowedRoles = new Roles(); - allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components - CompositionContext context = new CompositionContext(); - context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server - PolicyMetaData policyMetaData = this.policyComposer.compose(context); - this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement - URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement - this.enforce(this.createEnforcementContext(contextResource, action), true); - } - //------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ - private void assertServerState() throws Exception - { - //Assert Policy State of the Server - Policy[] policies = this.provisioner.readAllPolicies(); - - assertTrue("Policy Store must not be empty!!", (policies != null && policies.length == 1)); - log.info("------------------------------------------------------------------------------"); - log.info(policies[0].generateSystemPolicy()); - } - - private void enforce(EnforcementContext enforcementContext, boolean mustBePermitted) throws Exception - { - EnforcementResponse response = this.enforcer.checkAccess(enforcementContext); - - assertNotNull(response); - log.info("-----------------------------------"); - log.info("Decision="+response.getMessage()); - - if(mustBePermitted) - { - assertTrue("Access must be granted!!!", response.isAccessGranted()); - } - else - { - assertFalse("Access must be denied!!!", response.isAccessGranted()); - } - } - - private EnforcementContext createEnforcementContext(URIResource protectedResource, Read action) throws Exception - { - // Create an EnforcementContext - EnforcementContext context = new EnforcementContext(); - - // Enable Hierarchial Enforcement - context.activateHierarchialEnforcement(); - - // Create Resource - context.setAttribute("uri-resource", protectedResource); - - // Create Subjects - Roles roles = new Roles(); - roles.addName("user"); - context.setAttribute("roles", roles); - - // Create Action - context.setAttribute("action", action); - - return context; - } -} Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossGroupPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossGroupPageACL.java (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossGroupPageACL.java 2009-07-30 11:07:33 UTC (rev 13634) @@ -0,0 +1,18 @@ +/** + * + */ +package org.exoplatform.portal.config.security.jboss; + +import org.exoplatform.portal.config.model.PortalConfig; + +/** + * @author soshah + * + */ +public class TestJBossGroupPageACL extends JBossAbstractSharedPageACL +{ + public String getOwnerType() + { + return PortalConfig.GROUP_TYPE; + } +} Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java 2009-07-30 09:59:57 UTC (rev 13633) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java 2009-07-30 11:07:33 UTC (rev 13634) @@ -171,14 +171,10 @@ //Super User/Everyone (gives access without further evaluation) org.jboss.security.authz.components.subject.Identity superuser = new org.jboss.security.authz.components.subject.Identity(); - superuser.setName(this.root.getId()); //Provided via system configuration - Roles everyone = new Roles(); - everyone.addName(UserACL.EVERYONE); - - + superuser.setName(this.root.getId()); //Provided via system configuration + //Setup the Context for the Composition with these components........ context.addPolicyRule(Effect.PERMIT, new Write(), superuser); - context.addPolicyRule(Effect.PERMIT, new Write(), everyone, "allowExpression"); // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); @@ -235,29 +231,27 @@ } //Create Roles + Roles roles = new Roles(); + roles.addName("Everyone"); Collection<MembershipEntry> memberships = user.getMemberships(); - if(memberships != null && !memberships.isEmpty()) + if (memberships != null && !memberships.isEmpty()) { - Roles roles = new Roles(); - for(MembershipEntry membership: memberships) + for (MembershipEntry membership : memberships) { roles.addName(membership.toString()); - } - context.setAttribute("roles", roles); + } } else { - //Check to see if this is guest access - if(user.getId() == null) + // Check to see if this is guest access + if (user.getId() == null) { - //This is a guest user - Roles guest = new Roles(); - guest.addName("/platform/guests"); //Provided via system configuration - guest.addName(Roles.ANONYMOUS); - - context.setAttribute("roles", guest); + // This is a guest user + roles.addName("whatever:/platform/guests"); // Provided via system configuration + roles.addName(Roles.ANONYMOUS); } } + context.setAttribute("roles", roles); return context; } Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossUserPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossUserPageACL.java (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossUserPageACL.java 2009-07-30 11:07:33 UTC (rev 13634) @@ -0,0 +1,18 @@ +/** + * + */ +package org.exoplatform.portal.config.security.jboss; + +import org.exoplatform.portal.config.model.PortalConfig; + +/** + * @author soshah + * + */ +public class TestJBossUserPageACL extends JBossAbstractSharedPageACL +{ + public String getOwnerType() + { + return PortalConfig.USER_TYPE; + } +}