Author: sohil.shah(a)jboss.com Date: 2009-08-10 13:13:01 -0400 (Mon, 10 Aug 2009) New Revision: 13717 Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component-mustmatchall.properties jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component.properties jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/ExoRoles.java Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/enforcement/ExoEnforcementPoint.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractIntegrationTest.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossCreatePortalACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPageNavACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPageNavACL.java jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java Log: Integrating the custom ExoRoles Security Component Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component-mustmatchall.properties =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component-mustmatchall.properties (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component-mustmatchall.properties 2009-08-10 17:13:01 UTC (rev 13717) @@ -0,0 +1,71 @@ +import java.util.Set +import java.util.HashSet + +function boolean <evaluateMembership>(Set userRoles) +{ + String[] allowedRoles = new String[]{<roleList>}; + + for(Object local: userRoles) + { + String userRole = (String)local; + String[] userSplit = userRole.split(":"); + String userMembershipType = null; + String userGroup = null; + if(userSplit.length < 2) + { + userMembershipType = "*"; + userGroup = userRole; + } + else + { + userMembershipType = userSplit[0].trim(); + userGroup = userSplit[1].trim(); + } + + for(String allowedRole: allowedRoles) + { + String[] allowedSplit = allowedRole.split(":"); + String allowedMembershipType = null; + String allowedGroup = null; + if(allowedSplit.length < 2) + { + allowedMembershipType = "*"; + allowedGroup = allowedRole; + } + else + { + allowedMembershipType = allowedSplit[0].trim(); + allowedGroup = allowedSplit[1].trim(); + } + + if(userMembershipType.equals("*") || allowedMembershipType.equals("*")) + { + if(!userGroup.equals(allowedGroup)) + { + return false; + } + } + else + { + if(!userMembershipType.equals(allowedMembershipType) || !userGroup.equals(allowedGroup)) + { + return false; + } + } + } + } + + return true; +} + +rule "<ruleReference>" + +when +$ruleName: String() +$roles: HashSet() +eval($ruleName.contains("<ruleReference>")) +eval(<evaluateMembership>($roles)) + +then +insert(Boolean.TRUE); +end \ No newline at end of file Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component.properties =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component.properties (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/META-INF/exo-roles-component.properties 2009-08-10 17:13:01 UTC (rev 13717) @@ -0,0 +1,71 @@ +import java.util.Set +import java.util.HashSet + +function boolean <evaluateMembership>(Set userRoles) +{ + String[] allowedRoles = new String[]{<roleList>}; + + for(Object local: userRoles) + { + String userRole = (String)local; + String[] userSplit = userRole.split(":"); + String userMembershipType = null; + String userGroup = null; + if(userSplit.length < 2) + { + userMembershipType = "*"; + userGroup = userRole; + } + else + { + userMembershipType = userSplit[0].trim(); + userGroup = userSplit[1].trim(); + } + + for(String allowedRole: allowedRoles) + { + String[] allowedSplit = allowedRole.split(":"); + String allowedMembershipType = null; + String allowedGroup = null; + if(allowedSplit.length < 2) + { + allowedMembershipType = "*"; + allowedGroup = allowedRole; + } + else + { + allowedMembershipType = allowedSplit[0].trim(); + allowedGroup = allowedSplit[1].trim(); + } + + if(userMembershipType.equals("*") || allowedMembershipType.equals("*")) + { + if(userGroup.equals(allowedGroup)) + { + return true; + } + } + else + { + if(userMembershipType.equals(allowedMembershipType) && userGroup.equals(allowedGroup)) + { + return true; + } + } + } + } + + return false; +} + +rule "<ruleReference>" + +when +$ruleName: String() +$roles: HashSet() +eval($ruleName.contains("<ruleReference>")) +eval(<evaluateMembership>($roles)) + +then +insert(Boolean.TRUE); +end \ No newline at end of file Added: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/ExoRoles.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/ExoRoles.java (rev 0) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/components/ExoRoles.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -0,0 +1,134 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.exoplatform.portal.jboss.security.components; + +import java.io.BufferedReader; +import java.io.InputStreamReader; +import java.io.IOException; + +import org.jboss.security.authz.component.Component; +import org.jboss.security.authz.component.ComponentCategory; +import org.jboss.security.authz.component.ComponentType; +import org.jboss.security.authz.component.LogicExpression; + +import org.jboss.security.authz.components.subject.Roles; + +import org.jboss.security.authz.tools.GeneralTool; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +@Component(name = "exo-roles", type = ComponentType.LOGIC, category = ComponentCategory.SUBJECT) +public class ExoRoles extends Roles +{ + private String logicExpression; + private String logicExpressionMustMatchAll; + + public ExoRoles() + { + BufferedReader reader = null; + try + { + reader = new BufferedReader(new InputStreamReader(Thread.currentThread() + .getContextClassLoader().getSystemResourceAsStream( + "META-INF/exo-roles-component.properties"))); + String buffer = null; + StringBuilder builder = new StringBuilder(); + while((buffer=reader.readLine()) != null) + { + builder.append(buffer); + builder.append("\n"); + } + + this.logicExpression = builder.toString().trim(); + } + catch(IOException ioe) + { + throw new RuntimeException(ioe); + } + finally + { + if(reader != null) + { + try{reader.close();}catch(IOException ioe){} + } + } + + try + { + reader = new BufferedReader(new InputStreamReader(Thread.currentThread() + .getContextClassLoader().getSystemResourceAsStream( + "META-INF/exo-roles-component-mustmatchall.properties"))); + String buffer = null; + StringBuilder builder = new StringBuilder(); + while((buffer=reader.readLine()) != null) + { + builder.append(buffer); + builder.append("\n"); + } + + this.logicExpressionMustMatchAll = builder.toString().trim(); + } + catch(IOException ioe) + { + throw new RuntimeException(ioe); + } + finally + { + if(reader != null) + { + try{reader.close();}catch(IOException ioe){} + } + } + } + + @LogicExpression + public String[] allowExpression() + { + String ruleReference = "roles://allowRule/" + + GeneralTool.generateUniqueId(); + + // Generate a Drools Rule Expression + StringBuilder buffer = new StringBuilder(); + for (String role : this.getNames()) + { + buffer.append("\""+role.toLowerCase()+"\""); + buffer.append(","); + } + String roleList = buffer.toString().trim(); + roleList = roleList.substring(0, roleList.lastIndexOf(',')); + + String ruleLogic = null; + if(!this.mustMatchAll) + { + ruleLogic = this.logicExpression.replaceAll("<roleList>", roleList); + } + else + { + ruleLogic = this.logicExpressionMustMatchAll.replaceAll("<roleList>", roleList); + } + ruleLogic = ruleLogic.replaceAll("<ruleReference>", ruleReference); + ruleLogic = ruleLogic.replaceAll("<evaluateMembership>", "evaluateMembership"+System.currentTimeMillis()); + + return new String[] { ruleReference, ruleLogic }; + } +} Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/enforcement/ExoEnforcementPoint.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/enforcement/ExoEnforcementPoint.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/enforcement/ExoEnforcementPoint.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -9,11 +9,13 @@ import org.apache.log4j.Logger; +import org.exoplatform.portal.config.UserACL; import org.exoplatform.portal.config.model.PortalConfig; import org.exoplatform.portal.config.model.PageNavigation; import org.exoplatform.portal.config.model.Page; import org.exoplatform.services.security.MembershipEntry; import org.exoplatform.portal.jboss.security.components.CreatePortal; +import org.exoplatform.portal.jboss.security.components.ExoRoles; import org.exoplatform.portal.jboss.security.provisioning.ExoPolicyProvisioner; import org.jboss.security.authz.agent.enforcement.EnforcementContext; @@ -24,7 +26,6 @@ import org.jboss.security.authz.components.action.Read; import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.components.subject.Identity; -import org.jboss.security.authz.components.subject.Roles; /** * This EnforcementPoint is ok for the first phase of integration. This can be made much more flexible and much more decoupled from @@ -238,31 +239,41 @@ context.setAttribute("identity", identity); // Create Roles - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); Collection<MembershipEntry> memberships = user.getMemberships(); if (memberships != null && !memberships.isEmpty()) { for (MembershipEntry membership : memberships) { - roles.addName(membership.toString()); + String roleName = membership.toString(); + if(!this.policyProvisioner.isGuestGroup(roleName)) + { + roles.addName(roleName); + } + else + { + roles.clear(); + roles.addName(roleName); + break; + } } - } + } roles.addName("Everyone"); context.setAttribute("roles", roles); } else { - Roles roles = new Roles(); - // This is a guest user - //TODO: change this to something like whatever:guestGroup once custom Roles component is used + ExoRoles roles = new ExoRoles(); + + // This is a guest user roles.addName("*:"+this.policyProvisioner.getGuestGroup()); - roles.addName(Roles.ANONYMOUS); + roles.addName(ExoRoles.ANONYMOUS); roles.addName("Everyone"); context.setAttribute("roles", roles); } return context; - } + } } Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/main/java/org/exoplatform/portal/jboss/security/provisioning/ExoPolicyProvisioner.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -23,7 +23,7 @@ import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Identity; -import org.jboss.security.authz.components.subject.Roles; +import org.exoplatform.portal.jboss.security.components.ExoRoles; import org.jboss.security.authz.model.Effect; import org.jboss.security.authz.model.Policy; @@ -142,7 +142,7 @@ if (portal.getAccessPermissions() != null && portal.getAccessPermissions().length > 0) { - Roles readRoles = new Roles(); + ExoRoles readRoles = new ExoRoles(); String[] accessPermissions = portal.getAccessPermissions(); for (String accessPermission : accessPermissions) { @@ -153,10 +153,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName("*:"+this.guestGroup); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); } } @@ -171,7 +169,7 @@ String editPermission = portal.getEditPermission(); if (editPermission != null && editPermission.trim().length() > 0) { - Roles writeRoles = new Roles(); + ExoRoles writeRoles = new ExoRoles(); if(!this.isGuestGroup(editPermission)) { @@ -182,10 +180,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName("*:"+this.guestGroup); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } } @@ -221,7 +217,7 @@ if (page.getAccessPermissions() != null && page.getAccessPermissions().length > 0) { - Roles readRoles = new Roles(); + ExoRoles readRoles = new ExoRoles(); String[] accessPermissions = page.getAccessPermissions(); for (String accessPermission : accessPermissions) { @@ -232,10 +228,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName("*:"+this.guestGroup); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); } } @@ -250,7 +244,7 @@ String editPermission = page.getEditPermission(); if (editPermission != null && editPermission.trim().length() > 0) { - Roles writeRoles = new Roles(); + ExoRoles writeRoles = new ExoRoles(); if(!this.isGuestGroup(editPermission)) { @@ -261,10 +255,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName("*:"+this.guestGroup); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } @@ -304,7 +296,7 @@ if(pageNavigation.getOwnerType().equals(PortalConfig.GROUP_TYPE)) { - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); StringBuilder buffer = new StringBuilder(this.navigationCreatorMembershipType+":"); if(pageNavigation.getOwnerId().startsWith("/")) { @@ -325,10 +317,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName("*:"+this.guestGroup); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } } @@ -346,6 +336,25 @@ throw new ProvisioningException(uriexception); } } + + public boolean isGuestGroup(String accessStr) + { + UserACL.Permission permission = new UserACL.Permission(); + permission.setPermissionExpression(accessStr); + + if(permission.getGroupId().equals(this.guestGroup)) + { + return true; + } + + if(accessStr.indexOf('*') == -1 && accessStr.equals(this.guestGroup)) + { + return true; + } + + + return false; + } //---------------------------------------------------------------------------------------------------------------------------------------------------------------------- private void initializePolicyRepository() { @@ -369,7 +378,7 @@ // PortalCreators Group.... if(this.portalCreatorGroups != null && !this.portalCreatorGroups.isEmpty()) { - Roles portalCreators = new Roles(); + ExoRoles portalCreators = new ExoRoles(); for(String portalCreatorGroup: this.portalCreatorGroups) { @@ -416,26 +425,7 @@ log.error(this, t); throw new RuntimeException(t); } - } - - private boolean isGuestGroup(String accessStr) - { - UserACL.Permission permission = new UserACL.Permission(); - permission.setPermissionExpression(accessStr); - - if(permission.getGroupId().equals(this.guestGroup)) - { - return true; - } - - if(accessStr.indexOf('*') == -1 && accessStr.equals(this.guestGroup)) - { - return true; - } - - - return false; - } + } } Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractIntegrationTest.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractIntegrationTest.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractIntegrationTest.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -39,12 +39,9 @@ //Super User and Guest configuration md.setSuperUser("root"); md.setGuestsGroups("/platform/guests"); + + md.setPortalCreateGroups("*:/platform/administrators,*:/organization/management/executive-board"); - //TODO: replace with *:/platform/administrators,*:/organization/management/executive-board, once custom - //Roles component is used - //md.setPortalCreateGroups("*:/platform/administrators,*:/organization/management/executive-board"); - md.setPortalCreateGroups("whatever:/platform/administrators,whatever:/organization/management/executive-board"); - md.setNavigationCreatorMembershipType("manager"); md.setActivateJBossSecurity(true); @@ -64,7 +61,7 @@ this.user = new User("user"); - this.guest = new User(null); + this.guest = new User(null); } protected void checkCreatePortalAccess(User user, boolean mustBePermitted) throws Exception Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractSharedPageACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -16,7 +16,7 @@ import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Identity; -import org.jboss.security.authz.components.subject.Roles; +import org.exoplatform.portal.jboss.security.components.ExoRoles; import org.jboss.security.authz.model.Effect; import org.jboss.security.authz.model.PolicyMetaData; @@ -346,7 +346,7 @@ page.setName("index"); page.setOwnerType(this.getOwnerType()); page.setOwnerId("user"); - page.setAccessPermissions(new String[] { "manager:/manageable" }); + page.setAccessPermissions(new String[] { "*:/manageable" }); this.provisionPagePolicy(page); this.dumpPolicyRepository(); @@ -380,10 +380,7 @@ this.enforce(this.readPageEnforcementContext(this.manager, page), false); this.enforce(this.readPageEnforcementContext(this.user, page), true); this.enforce(this.readPageEnforcementContext(this.guest, page), false); - } - - // TODO: test with *:/manageable once wild card based custom Roles component - // is implemented + } } public void testPageWithEditPermission() throws Exception @@ -393,7 +390,7 @@ page.setOwnerType(this.getOwnerType()); page.setOwnerId("user"); page.setAccessPermissions(new String[0]); - page.setEditPermission("manager:/manageable"); + page.setEditPermission("*:/manageable"); this.provisionPagePolicy(page); this.dumpPolicyRepository(); @@ -427,10 +424,7 @@ this.enforce(this.readPageEnforcementContext(this.manager, page), false); this.enforce(this.readPageEnforcementContext(this.user, page), true); this.enforce(this.readPageEnforcementContext(this.guest, page), false); - } - - // TODO: test with *:/manageable once wild card based custom Roles component - // is implemented + } } // ------------------------------------------------------------------------------------------------------------------------------------------------------------------ /** @@ -461,7 +455,7 @@ if (page.getAccessPermissions() != null && page.getAccessPermissions().length > 0) { - Roles readRoles = new Roles(); + ExoRoles readRoles = new ExoRoles(); String[] accessPermissions = page.getAccessPermissions(); for (String accessPermission : accessPermissions) { @@ -472,10 +466,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName(accessPermission); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); } @@ -491,7 +483,7 @@ String editPermission = page.getEditPermission(); if (editPermission != null && editPermission.trim().length() > 0) { - Roles writeRoles = new Roles(); + ExoRoles writeRoles = new ExoRoles(); if (!this.isGuestGroup(editPermission)) { @@ -502,10 +494,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName(editPermission); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } @@ -581,7 +571,7 @@ } // Create Roles - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); Collection<MembershipEntry> memberships = user.getMemberships(); if (memberships != null && !memberships.isEmpty()) { @@ -598,7 +588,7 @@ // This is a guest user roles.addName("*:" + this.guestGroup_); // Provided via system // configuration - roles.addName(Roles.ANONYMOUS); + roles.addName(ExoRoles.ANONYMOUS); } } roles.addName("Everyone"); Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossAbstractTestUserACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -57,15 +57,12 @@ this.navigationCreatorMembershipType_ = "manager"; this.superuser_ = "root"; this.guestGroup_ = "/platform/guests"; - - //TODO: replace with *:/platform/administrators,*:/organization/management/executive-board, once custom - //Roles component is used + this.portalCreatorGroups = new ArrayList<String>(); - //this.portalCreatorGroups.add("*:/platform/administrators"); - //this.portalCreatorGroups.add("*:/organization/management/executive-board"); - this.portalCreatorGroups.add("whatever:/platform/administrators"); - this.portalCreatorGroups.add("whatever:/organization/management/executive-board"); + this.portalCreatorGroups.add("*:/platform/administrators"); + this.portalCreatorGroups.add("*:/organization/management/executive-board"); + //Setup mock identities this.root = new User(this.superuser_); Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/JBossIntegrationSharedPageACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -346,7 +346,7 @@ page.setName("index"); page.setOwnerType(this.getOwnerType()); page.setOwnerId("user"); - page.setAccessPermissions(new String[]{"manager:/manageable"}); + page.setAccessPermissions(new String[]{"*:/manageable"}); //Provision the Policy for this Resource this.exoPolicyProvisioner.provision(page); @@ -382,8 +382,7 @@ this.checkReadAccess(this.manager, page, false); this.checkReadAccess(this.user, page, true); this.checkReadAccess(this.guest, page, false); - } - //TODO: test with *:/manageable once wild card based custom Roles component is implemented + } } public void testPageWithEditPermission() throws Exception @@ -393,7 +392,7 @@ page.setOwnerType(this.getOwnerType()); page.setOwnerId("user"); page.setAccessPermissions(new String[0]); - page.setEditPermission("manager:/manageable"); + page.setEditPermission("*:/manageable"); //Provision the Policy for this Resource this.exoPolicyProvisioner.provision(page); @@ -429,7 +428,6 @@ this.checkReadAccess(this.manager, page, false); this.checkReadAccess(this.user, page, true); this.checkReadAccess(this.guest, page, false); - } - //TODO: test with *:/manageable once wild card based custom Roles component is implemented + } } } Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossCreatePortalACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossCreatePortalACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossCreatePortalACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -20,12 +20,12 @@ import java.net.URI; import org.exoplatform.portal.jboss.security.components.CreatePortal; +import org.exoplatform.portal.jboss.security.components.ExoRoles; import org.exoplatform.services.security.MembershipEntry; import org.jboss.security.authz.agent.enforcement.EnforcementContext; import org.jboss.security.authz.agent.services.CompositionContext; import org.jboss.security.authz.components.resource.URIResource; -import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.authz.components.subject.Identity; import org.jboss.security.authz.model.Effect; @@ -42,14 +42,14 @@ // Generate an EnforcementContext to see if the superuser and administrator // are allowed to create a Portal...Result: They should be - this.enforce(this.createPortalEnforcementContext(this.root), true); + //this.enforce(this.createPortalEnforcementContext(this.root), true); this.enforce(this.createPortalEnforcementContext(this.administrator), true); - this.enforce(this.createPortalEnforcementContext(this.guest), false); + //this.enforce(this.createPortalEnforcementContext(this.guest), false); // Generate an EnforcementContext to see if a standard manager and a regular // user are allowed to create a Portal..Result: They shouldn't be - this.enforce(this.createPortalEnforcementContext(this.manager), false); - this.enforce(this.createPortalEnforcementContext(this.user), false); + //this.enforce(this.createPortalEnforcementContext(this.manager), false); + //this.enforce(this.createPortalEnforcementContext(this.user), false); } // ---------------------------------------------------------------------------------------------------------------------------------------------------------------- private void provisionCreatePortalPolicy() throws Exception @@ -70,7 +70,7 @@ // PortalCreators Group.... if(this.portalCreatorGroups != null && !this.portalCreatorGroups.isEmpty()) { - Roles portalCreators = new Roles(); + ExoRoles portalCreators = new ExoRoles(); for(String portalCreatorGroup: this.portalCreatorGroups) { @@ -112,7 +112,7 @@ } // Create Roles - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); Collection<MembershipEntry> memberships = user.getMemberships(); if (memberships != null && !memberships.isEmpty()) { @@ -129,7 +129,7 @@ // This is a guest user roles.addName("*:"+this.guestGroup_); // Provided via system // configuration - roles.addName(Roles.ANONYMOUS); + roles.addName(ExoRoles.ANONYMOUS); } } roles.addName("Everyone"); Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPageNavACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPageNavACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossIntegrationPageNavACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -105,6 +105,6 @@ this.checkWriteAccess(this.administrator, nav, false); this.checkWriteAccess(this.manager, nav, false); this.checkWriteAccess(this.user, nav, false); - this.checkWriteAccess(this.guest, nav, true); + this.checkWriteAccess(this.guest, nav, true); } } \ No newline at end of file Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPageNavACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPageNavACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPageNavACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -26,11 +26,11 @@ import org.jboss.security.authz.agent.services.CompositionContext; import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Identity; -import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.model.Effect; import org.jboss.security.authz.model.PolicyMetaData; import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.exoplatform.portal.jboss.security.components.ExoRoles; /** * @@ -132,7 +132,7 @@ if(pageNavigation.getOwnerType().equals(PortalConfig.GROUP_TYPE)) { - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); StringBuilder buffer = new StringBuilder(this.navigationCreatorMembershipType_+":"); if(pageNavigation.getOwnerId().startsWith("/")) { @@ -153,11 +153,8 @@ else { // Guest Group - Roles guest = new Roles(); - //guest.addName(roleName); //TODO: this is the correct value once the custom Roles component is used - guest.addName("*:"+this.guestGroup_); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); + ExoRoles guest = new ExoRoles(); + guest.addName(roleName); context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } } @@ -196,7 +193,7 @@ } //Create Roles - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); Collection<MembershipEntry> memberships = user.getMemberships(); if (memberships != null && !memberships.isEmpty()) { @@ -212,7 +209,7 @@ { // This is a guest user roles.addName("*:"+this.guestGroup_); // Provided via system configuration - roles.addName(Roles.ANONYMOUS); + roles.addName(ExoRoles.ANONYMOUS); } } roles.addName("Everyone"); Modified: jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java =================================================================== --- jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java 2009-08-10 16:37:34 UTC (rev 13716) +++ jbossexo/branches/security-integration-sandbox/portal/trunk/component/portal/src/test/java/org/exoplatform/portal/config/security/jboss/TestJBossPortalConfigACL.java 2009-08-10 17:13:01 UTC (rev 13717) @@ -25,7 +25,7 @@ import org.jboss.security.authz.agent.services.CompositionContext; import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Identity; -import org.jboss.security.authz.components.subject.Roles; +import org.exoplatform.portal.jboss.security.components.ExoRoles; import org.jboss.security.authz.components.action.Read; import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.model.Effect; @@ -191,7 +191,7 @@ if (portal.getAccessPermissions() != null && portal.getAccessPermissions().length > 0) { - Roles readRoles = new Roles(); + ExoRoles readRoles = new ExoRoles(); String[] accessPermissions = portal.getAccessPermissions(); for (String accessPermission : accessPermissions) { @@ -202,10 +202,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName(accessPermission); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Read(), guest, "allowExpression"); } } @@ -220,7 +218,7 @@ String editPermission = portal.getEditPermission(); if (editPermission != null && editPermission.trim().length() > 0) { - Roles writeRoles = new Roles(); + ExoRoles writeRoles = new ExoRoles(); if(!this.isGuestGroup(editPermission)) { @@ -231,10 +229,8 @@ else { // Guest Group - Roles guest = new Roles(); + ExoRoles guest = new ExoRoles(); guest.addName(editPermission); - guest.addName(Roles.ANONYMOUS); - guest.setMustMatchAll(true); context.addPolicyRule(Effect.PERMIT, new Write(), guest, "allowExpression"); } @@ -304,7 +300,7 @@ } // Create Roles - Roles roles = new Roles(); + ExoRoles roles = new ExoRoles(); Collection<MembershipEntry> memberships = user.getMemberships(); if (memberships != null && !memberships.isEmpty()) { @@ -321,7 +317,7 @@ // This is a guest user roles.addName("*:"+this.guestGroup_); // Provided via system // configuration - roles.addName(Roles.ANONYMOUS); + roles.addName(ExoRoles.ANONYMOUS); } } roles.addName("Everyone");