Examples of javax.jcr.security.AccessControlManager

javax.jcr.security.AccessControlManager


        // make sure the 'rep:policy' node has been created.
        assertTrue(superuser.itemExists(tmpl.getPath() + "/rep:policy"));


        Session testSession = getTestSession();
        AccessControlManager testAcMgr = getTestACManager();
        // test: MODIFY_AC granted at 'path'
        assertTrue(testAcMgr.hasPrivileges(path, privilegesFromName(Privilege.JCR_MODIFY_ACCESS_CONTROL)));


        // test if testuser can READ access control on the path and on the
        // entire subtree that gets the policy inherited.
        AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
        testAcMgr.getEffectivePolicies(path);
        testAcMgr.getEffectivePolicies(childNPath);


        // test: READ_AC privilege does not apply outside of the tree.
        try {
            testAcMgr.getPolicies(siblingPath);
            fail("READ_AC privilege must not apply outside of the tree it has applied to.");
        } catch (AccessDeniedException e) {
            // success
        }


        // test: MODIFY_AC privilege does not apply outside of the tree.
        try {
            testAcMgr.setPolicy(siblingPath, policies[0]);
            fail("MODIFY_AC privilege must not apply outside of the tree it has applied to.");
        } catch (AccessDeniedException e) {
            // success
        }


        // test if testuser can modify AC-items
        // 1) add an ac-entry
        ACLTemplate acl = (ACLTemplate) policies[0];
        acl.addAccessControlEntry(testUser.getPrincipal(), privilegesFromName(PrivilegeRegistry.REP_WRITE));
        testAcMgr.setPolicy(path, acl);
        testSession.save();


        assertTrue(testAcMgr.hasPrivileges(path,
                privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES)));


        // 2) remove the policy
        testAcMgr.removePolicy(path, policies[0]);
        testSession.save();


        // Finally: testuser removed the policy that granted him permission
        // to modify the AC content. Since testuser removed the policy, it's
        // privileges must be gone again...
        try {
            testAcMgr.getEffectivePolicies(childNPath);
            fail("READ_AC privilege has been revoked -> must throw again.");
        } catch (AccessDeniedException e) {
            // success
        }
        // ... and since the ACE is stored with the policy all right except

View Full Code Here

        // READ must be gone.
        checkReadOnly(path);
    }


    public void testRemovePermission9() throws NotExecutableException, RepositoryException {
        AccessControlManager testAcMgr = getTestACManager();
        /*
          precondition:
          testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);
        checkReadOnly(childNPath);


        Privilege[] rmChildNodes = privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES);
        Privilege[] rmNode = privilegesFromName(Privilege.JCR_REMOVE_NODE);


        // add 'remove_child_nodes' at 'path and allow 'remove_node' at childNPath
        givePrivileges(path, rmChildNodes, getRestrictions(superuser, path));
        givePrivileges(childNPath, rmNode, getRestrictions(superuser, childNPath));
        /*
         expected result:
         - rep:policy node can still not be remove for it is access-control
           content that requires jcr:modifyAccessControl privilege instead.
         */
        String policyPath = childNPath + "/rep:policy";
        assertFalse(getTestSession().hasPermission(policyPath, javax.jcr.Session.ACTION_REMOVE));
        assertTrue(testAcMgr.hasPrivileges(policyPath, new Privilege[] {rmChildNodes[0], rmNode[0]}));
    }

View Full Code Here

        assertTrue(it.hasNext());
    }


    public void testInheritance2() throws RepositoryException, NotExecutableException {
        Session testSession = getTestSession();
        AccessControlManager testAcMgr = getTestACManager();


        /*
          precondition:
          testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);
        checkReadOnly(childNPath);


        // give jcr:write privilege on 'path' and withdraw them on 'childNPath'
        Privilege[] privileges = privilegesFromNames(new String[] {Privilege.JCR_WRITE});
        givePrivileges(path, privileges, getRestrictions(superuser, path));
        withdrawPrivileges(childNPath, privileges, getRestrictions(superuser, path));


        /*
        since evaluation respects inheritance through the node
        hierarchy, the jcr:write privilege must not be granted at childNPath
        */
        assertFalse(testAcMgr.hasPrivileges(childNPath, privileges));


        /*
         ... same for permissions at 'childNPath'
         */
        String actions = Session.ACTION_SET_PROPERTY + "," + Session.ACTION_REMOVE + "," + Session.ACTION_ADD_NODE;


        String nonExistingItemPath = childNPath + "/anyItem";
        assertFalse(testSession.hasPermission(nonExistingItemPath, actions));


        // yet another level in the hierarchy
        Node grandChild = superuser.getNode(childNPath).addNode(nodeName3);
        superuser.save();
        String gcPath = grandChild.getPath();


        // grant write privilege again
        givePrivileges(gcPath, privileges, getRestrictions(superuser, path));
        assertTrue(testAcMgr.hasPrivileges(gcPath, privileges));
        assertTrue(testSession.hasPermission(gcPath + "/anyProp", Session.ACTION_SET_PROPERTY));
        // however: removing the grand-child nodes must not be allowed as
        // remove_child_node privilege is missing on the direct ancestor.
        assertFalse(testSession.hasPermission(gcPath, Session.ACTION_REMOVE));
    }

View Full Code Here

        assertFalse(testSession.hasPermission(gcPath, Session.ACTION_REMOVE));
    }


    public void testInheritedGroupPermissions() throws NotExecutableException, RepositoryException {
        Group testGroup = getTestGroup();
        AccessControlManager testAcMgr = getTestACManager();
        /*
         precondition:
         testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);


        Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);


        /* give MODIFY_PROPERTIES privilege for testGroup at 'path' */
        givePrivileges(path, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));
        /*
         withdraw MODIFY_PROPERTIES privilege for everyone at 'childNPath'
         */
        withdrawPrivileges(childNPath, EveryonePrincipal.getInstance(), privileges, getRestrictions(superuser, path));


        // result at 'child path' must be deny
        assertFalse(testAcMgr.hasPrivileges(childNPath, privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES)));    
    }

View Full Code Here

        assertFalse(testAcMgr.hasPrivileges(childNPath, privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES)));    
    }


    public void testInheritedGroupPermissions2() throws NotExecutableException, RepositoryException {
        Group testGroup = getTestGroup();
        AccessControlManager testAcMgr = getTestACManager();
        /*
         precondition:
         testuser must have READ-only permission on test-node and below
        */
        checkReadOnly(path);


        Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);


        // NOTE: same as testInheritedGroupPermissions above but using
        // everyone on path, testgroup on childpath -> result must be the same


        /* give MODIFY_PROPERTIES privilege for everyone at 'path' */
        givePrivileges(path, EveryonePrincipal.getInstance(), privileges, getRestrictions(superuser, path));
        /*
         withdraw MODIFY_PROPERTIES privilege for testGroup at 'childNPath'
         */
        withdrawPrivileges(childNPath, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));


        // result at 'child path' must be deny
        assertFalse(testAcMgr.hasPrivileges(childNPath, privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES)));
    }

View Full Code Here

            ImportHandler ih = new ImportHandler(importer, sImpl);
            new ParsingContentHandler(ih).parse(in);


            String path = target.getPath();


            AccessControlManager acMgr = sImpl.getAccessControlManager();
            AccessControlPolicy[] policies = acMgr.getPolicies(path);


            assertEquals(1, policies.length);
            assertTrue(policies[0] instanceof JackrabbitAccessControlList);


            AccessControlEntry[] entries = ((JackrabbitAccessControlList) policies[0]).getAccessControlEntries();
            assertEquals(2, entries.length);


            AccessControlEntry entry = entries[0];
            assertEquals("unknownprincipal", entry.getPrincipal().getName());
            assertEquals(1, entry.getPrivileges().length);
            assertEquals(acMgr.privilegeFromName(Privilege.JCR_WRITE), entry.getPrivileges()[0]);


            entry = entries[1];
            assertEquals("admin", entry.getPrincipal().getName());
            assertEquals(1, entry.getPrivileges().length);
            assertEquals(acMgr.privilegeFromName(Privilege.JCR_WRITE), entry.getPrivileges()[0]);


            if(entry instanceof JackrabbitAccessControlEntry) {
                assertTrue(((JackrabbitAccessControlEntry) entry).isAllow());
            }
        } finally {

View Full Code Here

            return;
        }


        NodeImpl target = (NodeImpl) testRootNode;
        target = (NodeImpl) target.addNode("test", "test:sameNameSibsFalseChildNodeDefinition");
        AccessControlManager acMgr = sImpl.getAccessControlManager();
        for (AccessControlPolicyIterator it = acMgr.getApplicablePolicies(target.getPath()); it.hasNext();) {
            AccessControlPolicy policy = it.nextAccessControlPolicy();
            if (policy instanceof AccessControlList) {
                Privilege[] privs = new Privilege[] {acMgr.privilegeFromName(Privilege.JCR_LOCK_MANAGEMENT)};
                ((AccessControlList) policy).addAccessControlEntry(sImpl.getPrincipalManager().getEveryone(), privs);
                acMgr.setPolicy(target.getPath(), policy);
            }
        }


        try {


            InputStream in = new ByteArrayInputStream(XML_POLICY_TREE_2.getBytes("UTF-8"));
            SessionImporter importer = new SessionImporter(target, sImpl, ImportUUIDBehavior.IMPORT_UUID_CREATE_NEW, new PseudoConfig());
            ImportHandler ih = new ImportHandler(importer, sImpl);
            new ParsingContentHandler(ih).parse(in);


            AccessControlPolicy[] policies = acMgr.getPolicies(target.getPath());


            assertEquals(1, policies.length);
            assertTrue(policies[0] instanceof JackrabbitAccessControlList);


            AccessControlEntry[] entries = ((JackrabbitAccessControlList) policies[0]).getAccessControlEntries();
            assertEquals(1, entries.length);


            AccessControlEntry entry = entries[0];
            assertEquals("everyone", entry.getPrincipal().getName());
            List<Privilege> privs = Arrays.asList(entry.getPrivileges());
            assertEquals(2, privs.size());
            assertTrue(privs.contains(acMgr.privilegeFromName(Privilege.JCR_WRITE)) &&
                    privs.contains(acMgr.privilegeFromName(Privilege.JCR_LOCK_MANAGEMENT)));


            assertEquals(acMgr.privilegeFromName(Privilege.JCR_WRITE), entry.getPrivileges()[0]);


            if(entry instanceof JackrabbitAccessControlEntry) {
                assertTrue(((JackrabbitAccessControlEntry) entry).isAllow());
            }

View Full Code Here

     * @throws Exception
     */
    public void testImportEmptyExistingPolicy() throws Exception {
        NodeImpl target = (NodeImpl) testRootNode;
        target = (NodeImpl) target.addNode("test", "test:sameNameSibsFalseChildNodeDefinition");
        AccessControlManager acMgr = sImpl.getAccessControlManager();
        for (AccessControlPolicyIterator it = acMgr.getApplicablePolicies(target.getPath()); it.hasNext();) {
            AccessControlPolicy policy = it.nextAccessControlPolicy();
            if (policy instanceof AccessControlList) {
                acMgr.setPolicy(target.getPath(), policy);
            }
        }


        try {


            InputStream in = new ByteArrayInputStream(XML_POLICY_ONLY.getBytes("UTF-8"));


            SessionImporter importer = new SessionImporter(target, sImpl, ImportUUIDBehavior.IMPORT_UUID_CREATE_NEW, new PseudoConfig());
            ImportHandler ih = new ImportHandler(importer, sImpl);
            new ParsingContentHandler(ih).parse(in);


            AccessControlPolicy[] policies = acMgr.getPolicies(target.getPath());


            assertEquals(1, policies.length);
            assertTrue(policies[0] instanceof JackrabbitAccessControlList);


            AccessControlEntry[] entries = ((JackrabbitAccessControlList) policies[0]).getAccessControlEntries();

View Full Code Here

            new ParsingContentHandler(ih).parse(in);


            assertTrue(target.hasNode("test"));
            String path = target.getNode("test").getPath();


            AccessControlManager acMgr = sImpl.getAccessControlManager();
            AccessControlPolicy[] policies = acMgr.getPolicies(path);


            assertEquals(1, policies.length);
            assertTrue(policies[0] instanceof JackrabbitAccessControlList);


            AccessControlEntry[] entries = ((JackrabbitAccessControlList) policies[0]).getAccessControlEntries();

View Full Code Here

        if (user == null) {
            user = userManager.createUser("test", "quatloos");
        }
        // set up permissions
        String path = session.getRootNode().getPath();
        AccessControlManager accessControlManager = session
                .getAccessControlManager();
        AccessControlPolicyIterator acls = accessControlManager
                .getApplicablePolicies(path);
        AccessControlList acl = null;
        if (acls.hasNext()) {
            acl = (AccessControlList) acls.nextAccessControlPolicy();
        } else {
            acl = (AccessControlList) accessControlManager.getPolicies(path)[0];
        }
        acl.addAccessControlEntry(user.getPrincipal(), accessControlManager.getSupportedPrivileges(path));
        accessControlManager.setPolicy(path, acl);


        session.save();
        session.logout();


        context.bind("repository", repository);

View Full Code Here

0 1 2 3 4 5 6 7 8 9

TOP

Related Classes of javax.jcr.security.AccessControlManager

org.apache.camel.component.jcr.JcrAuthTestBase

org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils

org.apache.jackrabbit.core.NodeImplTest

org.apache.jackrabbit.core.security.authorization.AbstractRepositoryOperationTest

org.apache.jackrabbit.core.security.authorization.AbstractWriteTest

org.apache.jackrabbit.core.security.authorization.acl.ACLProvider

org.apache.jackrabbit.core.security.authorization.acl.ACLProvider$Entries

org.apache.jackrabbit.core.security.authorization.acl.ACLTemplate

org.apache.jackrabbit.core.security.authorization.acl.AcReadWriteTest

org.apache.jackrabbit.core.security.authorization.acl.EffectivePolicyTest

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.