Author: sohil.shah(a)jboss.com Date: 2009-08-09 00:56:16 -0400 (Sun, 09 Aug 2009) New Revision: 13712 Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPortalPageACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalPageACL.java Removed: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/OwnerType.java Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/config/UserACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java Log: fixed policy structure for Page protection Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/config/UserACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/config/UserACL.java 2009-08-09 03:00:18 UTC (rev 13711) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/config/UserACL.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -467,18 +467,7 @@ else { try - { - //TODO: this logic needs to be incorporated into the security framework via custom policy combining algrorithm - /*if (PortalConfig.USER_TYPE.equals(page.getOwnerType())) - { - if (page.getOwnerId().equals(identity.getUserId())) - { - page.setModifiable(true); - return true; - } - return false; - }*/ - + { boolean hasWriteAccess = this.enforcementPoint.checkWriteAccess(identity, page); if(hasWriteAccess) { @@ -517,18 +506,7 @@ else { try - { - //TODO: this logic needs to be incorporated into the security framework via custom policy combining algrorithm - /*if (PortalConfig.USER_TYPE.equals(page.getOwnerType())) - { - if (page.getOwnerId().equals(identity.getUserId())) - { - page.setModifiable(true); - return true; - } - return false; - }*/ - + { boolean hasWriteAccess = this.enforcementPoint.checkWriteAccess(identity, page); if(hasWriteAccess) { Deleted: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/OwnerType.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/OwnerType.java 2009-08-09 03:00:18 UTC (rev 13711) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/OwnerType.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -1,42 +0,0 @@ -/** - * - */ -package org.exoplatform.portal.jboss.security.components; - -import org.jboss.security.authz.component.Component; -import org.jboss.security.authz.component.ComponentCategory; -import org.jboss.security.authz.component.ComponentType; -import org.jboss.security.authz.component.SecurityContextData; - -/** - * This is a custom "Security Component" - * - * @author soshah - * - */ -@Component( - name="ownerType", - type=ComponentType.TARGET, - category=ComponentCategory.CUSTOM_SUBJECT_ATTRIBUTE -) -public class OwnerType -{ - //Indicates the Type of Owner that owns this Portal Object. Examples of usch types are User Types, Group Types etc - @SecurityContextData - private String type; - - public OwnerType() - { - - } - - public String getType() - { - return type; - } - - public void setType(String type) - { - this.type = type; - } -} Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java 2009-08-09 03:00:18 UTC (rev 13711) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -15,7 +15,6 @@ import org.exoplatform.portal.config.model.PageNavigation; import org.exoplatform.portal.config.model.Page; import org.exoplatform.portal.jboss.security.components.CreatePortal; -import org.exoplatform.portal.jboss.security.components.OwnerType; import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.provisioning.ProvisioningException; @@ -211,75 +210,71 @@ target.setUri(new URI("page://"+page.getName())); context.setPolicyTarget(target); - //SuperUser Access - org.jboss.security.authz.components.subject.Identity superuser = new org.jboss.security.authz.components.subject.Identity(); - superuser.setName(this.superuser); - context.addPolicyRule(Effect.PERMIT, new Write(), superuser); - - // Read Access - if (page.getAccessPermissions() != null - && page.getAccessPermissions().length > 0) + if(!page.getOwnerType().equals(PortalConfig.USER_TYPE)) { - Roles readRoles = new Roles(); - String[] accessPermissions = page.getAccessPermissions(); - for (String accessPermission : accessPermissions) + //SuperUser Access + org.jboss.security.authz.components.subject.Identity superuser = new org.jboss.security.authz.components.subject.Identity(); + superuser.setName(this.superuser); + context.addPolicyRule(Effect.PERMIT, new Write(), superuser); + + // Read Access + if (page.getAccessPermissions() != null + && page.getAccessPermissions().length > 0) { - if(!this.isGuestGroup(accessPermission)) + Roles readRoles = new Roles(); + String[] accessPermissions = page.getAccessPermissions(); + for (String accessPermission : accessPermissions) { - readRoles.addName(accessPermission); + if(!this.isGuestGroup(accessPermission)) + { + readRoles.addName(accessPermission); + } + else + { + // Guest Group + Roles guest = new Roles(); + guest.addName("*:"+this.guestGroup); + guest.addName(Roles.ANONYMOUS); + guest.setMustMatchAll(true); + context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); + } } + if(!readRoles.isEmpty()) + { + context.addPolicyRule(Effect.PERMIT, new Read(), readRoles, + "allowExpression"); + } + } + + // Write Access + String editPermission = page.getEditPermission(); + if (editPermission != null && editPermission.trim().length() > 0) + { + Roles writeRoles = new Roles(); + + if(!this.isGuestGroup(editPermission)) + { + writeRoles.addName(editPermission); + context.addPolicyRule(Effect.PERMIT, new Write(), writeRoles, + "allowExpression"); + } else - { + { // Guest Group Roles guest = new Roles(); - guest.addName("*:"+this.guestGroup); + guest.addName("*:"+this.guestGroup); guest.addName(Roles.ANONYMOUS); guest.setMustMatchAll(true); - context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); + context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } - } - if(!readRoles.isEmpty()) - { - context.addPolicyRule(Effect.PERMIT, new Read(), readRoles, - "allowExpression"); - } + + } } - - // Write Access - String editPermission = page.getEditPermission(); - if (editPermission != null && editPermission.trim().length() > 0) - { - Roles writeRoles = new Roles(); - - if(!this.isGuestGroup(editPermission)) - { - writeRoles.addName(editPermission); - context.addPolicyRule(Effect.PERMIT, new Write(), writeRoles, - "allowExpression"); - } - else - { - // Guest Group - Roles guest = new Roles(); - guest.addName("*:"+this.guestGroup); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); - context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); - } - - } - - - // SetUp OwnerType based Rules - if (page.getOwnerType().equals(PortalConfig.USER_TYPE)) - { - OwnerType ownerType = new OwnerType(); - ownerType.setType(PortalConfig.USER_TYPE); - + else + { Identity identity = new Identity(); identity.setName(page.getOwnerId()); - - context.addPolicyRule(Effect.PERMIT, ownerType, identity); + context.addPolicyRule(Effect.PERMIT, identity, identity); } this.policyProvisioner.deploy(context); Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java 2009-08-09 03:00:18 UTC (rev 13711) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -8,7 +8,6 @@ import org.exoplatform.portal.config.model.PortalConfig; import org.exoplatform.portal.config.model.Page; -import org.exoplatform.portal.jboss.security.components.OwnerType; import org.exoplatform.services.security.MembershipEntry; import org.jboss.security.authz.agent.enforcement.EnforcementContext; @@ -35,26 +34,43 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), - false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); - - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), - false); - this.enforce(this.readPageEnforcementContext(this.manager, page), false); - this.enforce(this.readPageEnforcementContext(this.user, page), false); - this.enforce(this.readPageEnforcementContext(this.guest, page), false); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } } public void testPageAccessibleByEveryone() throws Exception @@ -62,206 +78,359 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[] { "Everyone" }); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), - false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + true); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + } - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), - true); - this.enforce(this.readPageEnforcementContext(this.manager, page), true); - this.enforce(this.readPageEnforcementContext(this.user, page), true); - this.enforce(this.readPageEnforcementContext(this.guest, page), true); - } - public void testPageEditableByEveryone() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); - page.setEditPermission("Everyone"); + page.setEditPermission("Everyone"); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), true); - this.enforce(this.writePageEnforcementContext(this.manager, page), true); - this.enforce(this.writePageEnforcementContext(this.user, page), true); - this.enforce(this.writePageEnforcementContext(this.guest, page), true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + true); + this.enforce(this.writePageEnforcementContext(this.manager, page), true); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), true); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + true); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + } - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), true); - this.enforce(this.readPageEnforcementContext(this.manager, page), true); - this.enforce(this.readPageEnforcementContext(this.user, page), true); - this.enforce(this.readPageEnforcementContext(this.guest, page), true); - } - public void testPageAccessibleByGuests() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); - page.setAccessPermissions(new String[]{"*:"+this.guestGroup_}); + page.setOwnerId("user"); + page.setAccessPermissions(new String[] { "*:" + this.guestGroup_ }); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + } - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), false); - this.enforce(this.readPageEnforcementContext(this.manager, page), false); - this.enforce(this.readPageEnforcementContext(this.user, page), false); - this.enforce(this.readPageEnforcementContext(this.guest, page), true); - } - public void testPageEditableByGuests() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); - page.setEditPermission("*:"+this.guestGroup_); + page.setEditPermission("*:" + this.guestGroup_); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), true); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + } - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), false); - this.enforce(this.readPageEnforcementContext(this.manager, page), false); - this.enforce(this.readPageEnforcementContext(this.user, page), false); - this.enforce(this.readPageEnforcementContext(this.guest, page), true); - } - - public void testPageAccessibleByEveryOneAndGuests() throws Exception + public void testPageAccessibleByEveryOneAndGuests() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); - page.setAccessPermissions(new String[]{"Everyone", "*:"+this.guestGroup_}); + page.setOwnerId("user"); + page.setAccessPermissions(new String[] { "Everyone", + "*:" + this.guestGroup_ }); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + true); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + } - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), true); - this.enforce(this.readPageEnforcementContext(this.manager, page), true); - this.enforce(this.readPageEnforcementContext(this.user, page), true); - this.enforce(this.readPageEnforcementContext(this.guest, page), true); - } - - public void testPageAccessibleByGuestsOnly() throws Exception + public void testPageAccessibleByGuestsOnly() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); - page.setAccessPermissions(new String[]{"*:"+this.guestGroup_}); + page.setOwnerId("user"); + page.setAccessPermissions(new String[] { "*:" + this.guestGroup_ }); this.provisionPagePolicy(page); this.dumpPolicyRepository(); // Assert - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), true); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + } - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), false); - this.enforce(this.readPageEnforcementContext(this.manager, page), false); - this.enforce(this.readPageEnforcementContext(this.user, page), false); - this.enforce(this.readPageEnforcementContext(this.guest, page), true); - } - public void testPageWithAccessPermission() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); - page.setAccessPermissions(new String[]{"manager:/manageable"}); + page.setOwnerId("user"); + page.setAccessPermissions(new String[] { "manager:/manageable" }); this.provisionPagePolicy(page); this.dumpPolicyRepository(); - - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), false); - this.enforce(this.writePageEnforcementContext(this.manager, page), false); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), false); - this.enforce(this.readPageEnforcementContext(this.manager, page), true); - this.enforce(this.readPageEnforcementContext(this.user, page), false); - this.enforce(this.readPageEnforcementContext(this.guest, page), false); - - //TODO: test with *:/manageable once wild card based custom Roles component is implemented + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + + // TODO: test with *:/manageable once wild card based custom Roles component + // is implemented } - + public void testPageWithEditPermission() throws Exception { Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); - page.setAccessPermissions(new String[0]); - page.setEditPermission("manager:/manageable"); + page.setOwnerId("user"); + page.setAccessPermissions(new String[0]); + page.setEditPermission("manager:/manageable"); this.provisionPagePolicy(page); this.dumpPolicyRepository(); - - this.enforce(this.writePageEnforcementContext(this.root, page), true); - this.enforce(this.writePageEnforcementContext(this.administrator, page), false); - this.enforce(this.writePageEnforcementContext(this.manager, page), true); - this.enforce(this.writePageEnforcementContext(this.user, page), false); - this.enforce(this.writePageEnforcementContext(this.guest, page), false); - this.enforce(this.readPageEnforcementContext(this.root, page), true); - this.enforce(this.readPageEnforcementContext(this.administrator, page), false); - this.enforce(this.readPageEnforcementContext(this.manager, page), true); - this.enforce(this.readPageEnforcementContext(this.user, page), false); - this.enforce(this.readPageEnforcementContext(this.guest, page), false); - - //TODO: test with *:/manageable once wild card based custom Roles component is implemented + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.enforce(this.writePageEnforcementContext(this.root, page), true); + this.enforce(this.writePageEnforcementContext(this.administrator, page), + false); + this.enforce(this.writePageEnforcementContext(this.manager, page), true); + this.enforce(this.writePageEnforcementContext(this.user, page), false); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), true); + this.enforce(this.readPageEnforcementContext(this.administrator, page), + false); + this.enforce(this.readPageEnforcementContext(this.manager, page), true); + this.enforce(this.readPageEnforcementContext(this.user, page), false); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + else + { + this.enforce(this.writePageEnforcementContext(this.root, page), false); + this.enforce(this.writePageEnforcementContext(this.administrator, page), false); + this.enforce(this.writePageEnforcementContext(this.manager, page), false); + this.enforce(this.writePageEnforcementContext(this.user, page), true); + this.enforce(this.writePageEnforcementContext(this.guest, page), false); + + this.enforce(this.readPageEnforcementContext(this.root, page), false); + this.enforce(this.readPageEnforcementContext(this.administrator, page),false); + this.enforce(this.readPageEnforcementContext(this.manager, page), false); + this.enforce(this.readPageEnforcementContext(this.user, page), true); + this.enforce(this.readPageEnforcementContext(this.guest, page), false); + } + + // TODO: test with *:/manageable once wild card based custom Roles component + // is implemented } // ------------------------------------------------------------------------------------------------------------------------------------------------------------------ /** @@ -270,87 +439,84 @@ * populated from state of the Page Object * * - * TODO: If OwnerType is User, it needs the Policy Combining Algorithm customization feature from - * the core framework + * customization feature from the core framework */ private void provisionPagePolicy(Page page) throws Exception { CompositionContext context = new CompositionContext(); - + // SetUp Resource URIResource target = new URIResource(); target.setUri(new URI(page.getName())); context.setPolicyTarget(target); - //SuperUser Access - org.jboss.security.authz.components.subject.Identity superuser = new org.jboss.security.authz.components.subject.Identity(); - superuser.setName(this.root.getId()); // Provided via system configuration - context.addPolicyRule(Effect.PERMIT, new Write(), superuser); + if (!page.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + // SuperUser Access + org.jboss.security.authz.components.subject.Identity superuser = new org.jboss.security.authz.components.subject.Identity(); + superuser.setName(this.root.getId()); // Provided via system configuration + context.addPolicyRule(Effect.PERMIT, new Write(), superuser); - // Read Access - if (page.getAccessPermissions() != null - && page.getAccessPermissions().length > 0) - { - Roles readRoles = new Roles(); - String[] accessPermissions = page.getAccessPermissions(); - for (String accessPermission : accessPermissions) + // Read Access + if (page.getAccessPermissions() != null + && page.getAccessPermissions().length > 0) { - if(!this.isGuestGroup(accessPermission)) + Roles readRoles = new Roles(); + String[] accessPermissions = page.getAccessPermissions(); + for (String accessPermission : accessPermissions) { - readRoles.addName(accessPermission); + if (!this.isGuestGroup(accessPermission)) + { + readRoles.addName(accessPermission); + } + else + { + // Guest Group + Roles guest = new Roles(); + guest.addName(accessPermission); + guest.addName(Roles.ANONYMOUS); + guest.setMustMatchAll(true); + context.addPolicyRule(Effect.PERMIT, new Read(), guest, + "allowExpression"); + } } + if (!readRoles.isEmpty()) + { + context.addPolicyRule(Effect.PERMIT, new Read(), readRoles, + "allowExpression"); + } + } + + // Write Access + String editPermission = page.getEditPermission(); + if (editPermission != null && editPermission.trim().length() > 0) + { + Roles writeRoles = new Roles(); + + if (!this.isGuestGroup(editPermission)) + { + writeRoles.addName(editPermission); + context.addPolicyRule(Effect.PERMIT, new Write(), writeRoles, + "allowExpression"); + } else - { - // Guest Group - Roles guest = new Roles(); - guest.addName(accessPermission); + { + // Guest Group + Roles guest = new Roles(); + guest.addName(editPermission); guest.addName(Roles.ANONYMOUS); guest.setMustMatchAll(true); - context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); + context.addPolicyRule(Effect.PERMIT, new Write(), guest, + "allowExpression"); } - } - if(!readRoles.isEmpty()) - { - context.addPolicyRule(Effect.PERMIT, new Read(), readRoles, - "allowExpression"); - } - } - // Write Access - String editPermission = page.getEditPermission(); - if (editPermission != null && editPermission.trim().length() > 0) - { - Roles writeRoles = new Roles(); - - if(!this.isGuestGroup(editPermission)) - { - writeRoles.addName(editPermission); - context.addPolicyRule(Effect.PERMIT, new Write(), writeRoles, - "allowExpression"); } - else - { - // Guest Group - Roles guest = new Roles(); - guest.addName(editPermission); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); - context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); - } - } - - - // SetUp OwnerType based Rules - if (page.getOwnerType().equals(PortalConfig.USER_TYPE)) + else { - OwnerType ownerType = new OwnerType(); - ownerType.setType(PortalConfig.USER_TYPE); - Identity identity = new Identity(); identity.setName(page.getOwnerId()); - - context.addPolicyRule(Effect.PERMIT, ownerType, identity); + context.addPolicyRule(Effect.PERMIT, identity, identity); } // Store the policy into the Policy Server @@ -415,14 +581,14 @@ } // Create Roles - Roles roles = new Roles(); + Roles roles = new Roles(); Collection<MembershipEntry> memberships = user.getMemberships(); if (memberships != null && !memberships.isEmpty()) { for (MembershipEntry membership : memberships) { roles.addName(membership.toString()); - } + } } else { @@ -430,8 +596,9 @@ if (user.getId() == null) { // This is a guest user - roles.addName("*:"+this.guestGroup_); // Provided via system configuration - roles.addName(Roles.ANONYMOUS); + roles.addName("*:" + this.guestGroup_); // Provided via system + // configuration + roles.addName(Roles.ANONYMOUS); } } roles.addName("Everyone"); Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java 2009-08-09 03:00:18 UTC (rev 13711) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -3,19 +3,9 @@ */ package org.exoplatform.portal.config.security.jboss; -import java.net.URI; -import java.util.Collection; - import org.exoplatform.portal.config.model.Page; -import org.exoplatform.services.security.MembershipEntry; +import org.exoplatform.portal.config.model.PortalConfig; -import org.jboss.security.authz.agent.enforcement.EnforcementContext; -import org.jboss.security.authz.components.action.Read; -import org.jboss.security.authz.components.action.Write; -import org.jboss.security.authz.components.resource.URIResource; -import org.jboss.security.authz.components.subject.Identity; -import org.jboss.security.authz.components.subject.Roles; - /** * @author soshah * @@ -30,7 +20,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); //Provision the Policy for this Resource @@ -40,18 +30,36 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, false); - this.checkReadAccess(this.manager, page, false); - this.checkReadAccess(this.user, page, false); - this.checkReadAccess(this.guest, page, false); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, false); + this.checkReadAccess(this.guest, page, false); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageAccessibleByEveryone() throws Exception @@ -59,7 +67,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[] { "Everyone" }); //Provision the Policy for this Resource @@ -69,17 +77,35 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page,false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page,true); - this.checkReadAccess(this.manager, page, true); - this.checkReadAccess(this.user, page, true); - this.checkReadAccess(this.guest, page, true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page,false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page,true); + this.checkReadAccess(this.manager, page, true); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, true); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageEditableByEveryone() throws Exception @@ -87,7 +113,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); page.setEditPermission("Everyone"); @@ -98,17 +124,35 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, true); - this.checkWriteAccess(this.manager, page, true); - this.checkWriteAccess(this.user, page, true); - this.checkWriteAccess(this.guest, page, true); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, true); - this.checkReadAccess(this.manager, page, true); - this.checkReadAccess(this.user, page, true); - this.checkReadAccess(this.guest, page, true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, true); + this.checkWriteAccess(this.manager, page, true); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, true); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, true); + this.checkReadAccess(this.manager, page, true); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, true); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageAccessibleByGuests() throws Exception @@ -116,7 +160,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[]{this.exoPolicyProvisioner.getGuestGroup()}); //Provision the Policy for this Resource @@ -126,17 +170,35 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, false); - this.checkReadAccess(this.manager, page, false); - this.checkReadAccess(this.user, page, false); - this.checkReadAccess(this.guest, page, true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, false); + this.checkReadAccess(this.guest, page, true); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageEditableByGuests() throws Exception @@ -144,7 +206,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); page.setEditPermission(this.exoPolicyProvisioner.getGuestGroup()); @@ -155,17 +217,35 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, true); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, false); - this.checkReadAccess(this.manager, page, false); - this.checkReadAccess(this.user, page, false); - this.checkReadAccess(this.guest, page, true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, true); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, false); + this.checkReadAccess(this.guest, page, true); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageAccessibleByEveryOneAndGuests() throws Exception @@ -173,7 +253,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[]{"Everyone", this.exoPolicyProvisioner.getGuestGroup()}); //Provision the Policy for this Resource @@ -183,17 +263,35 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, true); - this.checkReadAccess(this.manager, page, true); - this.checkReadAccess(this.user, page, true); - this.checkReadAccess(this.guest, page, true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, true); + this.checkReadAccess(this.manager, page, true); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, true); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageAccessibleByGuestsOnly() throws Exception @@ -201,7 +299,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[]{this.exoPolicyProvisioner.getGuestGroup()}); //Provision the Policy for this Resource @@ -211,17 +309,35 @@ this.exoPolicyProvisioner.debug(); // Assert - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, false); - this.checkReadAccess(this.manager, page, false); - this.checkReadAccess(this.user, page, false); - this.checkReadAccess(this.guest, page, true); + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, false); + this.checkReadAccess(this.guest, page, true); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } } public void testPageWithAccessPermission() throws Exception @@ -229,7 +345,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[]{"manager:/manageable"}); //Provision the Policy for this Resource @@ -238,18 +354,35 @@ //Debug this.exoPolicyProvisioner.debug(); - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, false); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, false); - this.checkReadAccess(this.manager, page, true); - this.checkReadAccess(this.user, page, false); - this.checkReadAccess(this.guest, page, false); - + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, true); + this.checkReadAccess(this.user, page, false); + this.checkReadAccess(this.guest, page, false); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } //TODO: test with *:/manageable once wild card based custom Roles component is implemented } @@ -258,7 +391,7 @@ Page page = new Page(); page.setName("index"); page.setOwnerType(this.getOwnerType()); - page.setOwnerId("foo"); + page.setOwnerId("user"); page.setAccessPermissions(new String[0]); page.setEditPermission("manager:/manageable"); @@ -267,19 +400,36 @@ //Debug this.exoPolicyProvisioner.debug(); - - this.checkWriteAccess(this.root, page, true); - this.checkWriteAccess(this.administrator, page, false); - this.checkWriteAccess(this.manager, page, true); - this.checkWriteAccess(this.user, page, false); - this.checkWriteAccess(this.guest, page, false); - - this.checkReadAccess(this.root, page, true); - this.checkReadAccess(this.administrator, page, false); - this.checkReadAccess(this.manager, page, true); - this.checkReadAccess(this.user, page, false); - this.checkReadAccess(this.guest, page, false); - + + if(!this.getOwnerType().equals(PortalConfig.USER_TYPE)) + { + this.checkWriteAccess(this.root, page, true); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, true); + this.checkWriteAccess(this.user, page, false); + this.checkWriteAccess(this.guest, page, false); + + this.checkReadAccess(this.root, page, true); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, true); + this.checkReadAccess(this.user, page, false); + this.checkReadAccess(this.guest, page, false); + } + else + { + this.checkWriteAccess(this.root, page, false); + this.checkWriteAccess(this.administrator, page, false); + this.checkWriteAccess(this.manager, page, false); + this.checkWriteAccess(this.user, page, true); + this.checkWriteAccess(this.guest, page, false); + + + this.checkReadAccess(this.root, page, false); + this.checkReadAccess(this.administrator, page, false); + this.checkReadAccess(this.manager, page, false); + this.checkReadAccess(this.user, page, true); + this.checkReadAccess(this.guest, page, false); + } //TODO: test with *:/manageable once wild card based custom Roles component is implemented } } Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPortalPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPortalPageACL.java (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPortalPageACL.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -0,0 +1,18 @@ +/** + * + */ +package org.exoplatform.portal.config.security.jboss; + +import org.exoplatform.portal.config.model.PortalConfig; + +/** + * @author soshah + * + */ +public class TestJBossIntegrationPortalPageACL extends JBossIntegrationSharedPageACL +{ + public String getOwnerType() + { + return PortalConfig.PORTAL_TYPE; + } +} Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalPageACL.java (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalPageACL.java 2009-08-09 04:56:16 UTC (rev 13712) @@ -0,0 +1,18 @@ +/** + * + */ +package org.exoplatform.portal.config.security.jboss; + +import org.exoplatform.portal.config.model.PortalConfig; + +/** + * @author soshah + * + */ +public class TestJBossPortalPageACL extends JBossAbstractSharedPageACL +{ + public String getOwnerType() + { + return PortalConfig.PORTAL_TYPE; + } +}