Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Authorization refactoring
Rename FedoraPolicyEnforcementPoint interface to FedoraAuthorizationDelegate. Instead of passing principals to PEP/authorization delegates, pass the session instance. User and group principals added as session attributes. ServletContainerAuthenticationProvider adds the servlet request as a session attribute (so authorization classes can access request IP address, etc). Changed FedoraUserSecurityContext constructor to take a Principal instance rather than ServletCredentials. Added additional documentation for PEP/authz delegate and other methods. Resolves: https://www.pivotaltracker.com/story/show/66946122
- Loading branch information
Showing
31 changed files
with
571 additions
and
504 deletions.
There are no files selected for viewing
84 changes: 84 additions & 0 deletions
84
fcrepo-auth-common/src/main/java/org/fcrepo/auth/common/FedoraAuthorizationDelegate.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,84 @@ | ||
/** | ||
* Copyright 2013 DuraSpace, Inc. | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
package org.fcrepo.auth.common; | ||
|
||
import org.modeshape.jcr.value.Path; | ||
|
||
import javax.jcr.Session; | ||
|
||
/** | ||
* An interface that can authorize access to specific resources within | ||
* repositories. | ||
* <p> | ||
* An implementation has the opportunity to inspect nodes and the session, which | ||
* may have additional information assigned as session attributes, such as the | ||
* associated servlet request. This interface defines the Fedora-specific | ||
* attributes which may be added. | ||
* </p> | ||
* | ||
* @author Gregory Jansen | ||
* @see org.fcrepo.auth.roles.common.AbstractRolesAuthorizationDelegate | ||
* @see org.fcrepo.auth.roles.basic.BasicRolesAuthorizationDelegate | ||
*/ | ||
public interface FedoraAuthorizationDelegate { | ||
|
||
/** | ||
* The name of the session attribute containing the servlet request (an | ||
* instance of javax.servlet.http.HttpServletRequest). | ||
*/ | ||
public static final String FEDORA_SERVLET_REQUEST = | ||
"fedora-servlet-request"; | ||
|
||
/** | ||
* The name of the session attribute containing an instance of Principal | ||
* representing the current authenticated user. | ||
*/ | ||
public static final String FEDORA_USER_PRINCIPAL = "fedora-user-principal"; | ||
|
||
/** | ||
* The name of the session attribute containing a set of instances of | ||
* Principal, representing the current user's credentials, including the | ||
* value of the FEDORA_USER_PRINCIPAL session attribute. | ||
*/ | ||
public static final String FEDORA_ALL_PRINCIPALS = "fedora-all-principals"; | ||
|
||
/** | ||
* Determine if the supplied session has permission at absPath for all of | ||
* the actions. | ||
* <p> | ||
* The authentication provider may have added session attributes, which can | ||
* be accessed in implementations by calling session#getAttribute. If an | ||
* attribute is not available in session attributes and would be required to | ||
* establish that the session has permission for any action given, an | ||
* implementation should usually return false. | ||
* </p> | ||
* <p> | ||
* Note that accessing nodes using the provided session will result in | ||
* additional calls to this method and thus an infinite loop. Instead, | ||
* obtain a new session instance if your implementation requires access to | ||
* nodes. See AbstractRolesAuthorizationDelegate for an example. | ||
* </p> | ||
* | ||
* @param session | ||
* @param absPath | ||
* @param actions | ||
* @return true if the given session has permission at absPath for all of | ||
* the given actions, or false otherwise | ||
*/ | ||
boolean hasPermission(Session session, Path absPath, String[] actions); | ||
|
||
} |
47 changes: 0 additions & 47 deletions
47
fcrepo-auth-common/src/main/java/org/fcrepo/auth/common/FedoraPolicyEnforcementPoint.java
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
40 changes: 0 additions & 40 deletions
40
fcrepo-auth-common/src/main/java/org/fcrepo/auth/common/HTTPPrincipalFactory.java
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
fcrepo-auth-common/src/main/java/org/fcrepo/auth/common/PrincipalProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
/** | ||
* Copyright 2013 DuraSpace, Inc. | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
package org.fcrepo.auth.common; | ||
|
||
import javax.jcr.Credentials; | ||
|
||
import java.security.Principal; | ||
import java.util.Set; | ||
|
||
/** | ||
* This interface provides a way for authentication code to communicate generic | ||
* credentials to authorization delegates. An implementation of this interface | ||
* could perform a query to determine group membership, for example. | ||
* <p> | ||
* The ServletContainerAuthenticationProvider may be configured with one or more | ||
* implementations of this class, which it will consult during authentication. | ||
* The results will be assigned to the FEDORA_ALL_PRINCIPALS session attribute. | ||
* </p> | ||
* | ||
* @author Gregory Jansen | ||
* @see HttpHeaderPrincipalProvider | ||
*/ | ||
public interface PrincipalProvider { | ||
|
||
/** | ||
* Extract principals from the provided credentials. | ||
* <p> | ||
* If no principals can be extracted, for example because the credentials | ||
* are of a different type than expected, implementations of this method | ||
* should return the empty set rather than null. | ||
* </p> | ||
* | ||
* @param credentials the credentials | ||
* @return a set of security principals | ||
*/ | ||
Set<Principal> getPrincipals(Credentials credentials); | ||
|
||
} |
Oops, something went wrong.