Examples of org.apache.shiro.authz.Permission

org.apache.shiro.authz.Permission
A Permission represents the ability to perform an action or access a resource. A Permission is the most granular, or atomic, unit in a system's security policy and is the cornerstone upon which fine-grained security models are built.
It is important to understand a Permission instance only represents functionality or access - it does not grant it. Granting access to an application functionality or a particular resource is done by the application's security configuration, typically by assigning Permissions to users, roles and/or groups.
Most typical systems are what the Shiro team calls role-based in nature, where a role represents common behavior for certain user types. For example, a system might have an Aministrator role, a User or Guest roles, etc.
But if you have a dynamic security model, where roles can be created and deleted at runtime, you can't hard-code role names in your code. In this environment, roles themselves aren't aren't very useful. What matters is what permissions are assigned to these roles.
Under this paradigm, permissions are immutable and reflect an application's raw functionality (opening files, accessing a web URL, creating users, etc). This is what allows a system's security policy to be dynamic: because Permissions represent raw functionality and only change when the application's source code changes, they are immutable at runtime - they represent 'what' the system can do. Roles, users, and groups are the 'who' of the application. Determining 'who' can do 'what' then becomes a simple exercise of associating Permissions to roles, users, and groups in some way.
Most applications do this by associating a named role with permissions (i.e. a role 'has a' collection of Permissions) and then associate users with roles (i.e. a user 'has a' collection of roles) so that by transitive association, the user 'has' the permissions in their roles. There are numerous variations on this theme (permissions assigned directly to users, or assigned to groups, and users added to groups and these groups in turn have roles, etc, etc). When employing a permission-based security model instead of a role-based one, users, roles, and groups can all be created, configured and/or deleted at runtime. This enables an extremely powerful security model.
A benefit to Shiro is that, although it assumes most systems are based on these types of static role or dynamic role w/ permission schemes, it does not require a system to model their security data this way - all Permission checks are relegated to {@link org.apache.shiro.realm.Realm} implementations, and only thoseimplementations really determine how a user 'has' a permission or not. The Realm could use the semantics described here, or it could utilize some other mechanism entirely - it is always up to the application developer.
Shiro provides a very powerful default implementation of this interface in the form of the {@link org.apache.shiro.authz.permission.WildcardPermission WildcardPermission}. We highly recommend that you investigate this class before trying to implement your own Permissions. @author Les Hazlewood @see org.apache.shiro.authz.permission.WildcardPermission WildcardPermission @since 0.2

    assertFalse(REQUEST_SERVER1_URI2.implies(ROLE_SERVER_SERVER1_URI_URI2));
    assertFalse(REQUEST_SERVER1_URI1.implies(ROLE_SERVER_SERVER1_URI_URI2));
  };
  @Test
  public void testUnexpected() throws Exception {
    Permission p = new Permission() {
      @Override
      public boolean implies(Permission p) {
        return false;
      }
    };

View Full Code Here


  private static final String ALL = SearchConstants.ALL;


  @Test
  public void testSimpleNoAction() throws Exception {
    Permission collection1 = create(new KeyValue("collection", "coll1"));
    Permission collection2 = create(new KeyValue("collection", "coll2"));
    Permission collection1Case = create(new KeyValue("colleCtIon", "coLl1"));


    assertTrue(collection1.implies(collection1));
    assertTrue(collection2.implies(collection2));
    assertTrue(collection1.implies(collection1Case));
    assertTrue(collection1Case.implies(collection1));


    assertFalse(collection1.implies(collection2));
    assertFalse(collection1Case.implies(collection2));
    assertFalse(collection2.implies(collection1));
    assertFalse(collection2.implies(collection1Case));
  }

View Full Code Here

    assertFalse(collection2.implies(collection1Case));
  }


  @Test
  public void testSimpleAction() throws Exception {
    Permission query =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
    Permission update =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
    Permission queryCase =
      create(new KeyValue("colleCtIon", "coLl1"), new KeyValue("AcTiOn", "QuERy"));


    assertTrue(query.implies(query));
    assertTrue(update.implies(update));
    assertTrue(query.implies(queryCase));
    assertTrue(queryCase.implies(query));


    assertFalse(query.implies(update));
    assertFalse(queryCase.implies(update));
    assertFalse(update.implies(query));
    assertFalse(update.implies(queryCase));
  }

View Full Code Here

    assertFalse(update.implies(queryCase));
  }


  @Test
  public void testRoleShorterThanRequest() throws Exception {
    Permission collection1 = create(new KeyValue("collection", "coll1"));
    Permission query =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
    Permission update =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
    Permission all =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", ALL));


    assertTrue(collection1.implies(query));
    assertTrue(collection1.implies(update));
    assertTrue(collection1.implies(all));


    assertFalse(query.implies(collection1));
    assertFalse(update.implies(collection1));
    assertTrue(all.implies(collection1));
  }

View Full Code Here

    assertTrue(all.implies(collection1));
  }


  @Test
  public void testCollectionAll() throws Exception {
    Permission collectionAll = create(new KeyValue("collection", ALL));
    Permission collection1 = create(new KeyValue("collection", "coll1"));
    assertTrue(collectionAll.implies(collection1));
    assertTrue(collection1.implies(collectionAll));


    Permission allUpdate =
      create(new KeyValue("collection", ALL), new KeyValue("action", "update"));
    Permission allQuery =
      create(new KeyValue("collection", ALL), new KeyValue("action", "query"));
    Permission coll1Update =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
    Permission coll1Query =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
    assertTrue(allUpdate.implies(coll1Update));
    assertTrue(allQuery.implies(coll1Query));
    assertTrue(coll1Update.implies(allUpdate));
    assertTrue(coll1Query.implies(allQuery));
    assertFalse(allUpdate.implies(coll1Query));
    assertFalse(coll1Update.implies(coll1Query));
    assertFalse(allQuery.implies(coll1Update));
    assertFalse(coll1Query.implies(allUpdate));
    assertFalse(allUpdate.implies(allQuery));
    assertFalse(allQuery.implies(allUpdate));
    assertFalse(coll1Update.implies(coll1Query));
    assertFalse(coll1Query.implies(coll1Update));


    // test different length paths
    assertTrue(collectionAll.implies(allUpdate));
    assertTrue(collectionAll.implies(allQuery));
    assertTrue(collectionAll.implies(coll1Update));
    assertTrue(collectionAll.implies(coll1Query));
    assertFalse(allUpdate.implies(collectionAll));
    assertFalse(allQuery.implies(collectionAll));
    assertFalse(coll1Update.implies(collectionAll));
    assertFalse(coll1Query.implies(collectionAll));
  }

View Full Code Here

    assertFalse(coll1Query.implies(collectionAll));
  }


  @Test
  public void testActionAll() throws Exception {
    Permission coll1All =
       create(new KeyValue("collection", "coll1"), new KeyValue("action", ALL));
    Permission coll1Update =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
    Permission coll1Query =
      create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
    assertTrue(coll1All.implies(coll1All));
    assertTrue(coll1All.implies(coll1Update));
    assertTrue(coll1All.implies(coll1Query));
    assertFalse(coll1Update.implies(coll1All));
    assertFalse(coll1Query.implies(coll1All));


    // test different lengths
    Permission coll1 =
       create(new KeyValue("collection", "coll1"));
    assertTrue(coll1All.implies(coll1));
    assertTrue(coll1.implies(coll1All));
  }

View Full Code Here

    assertTrue(coll1.implies(coll1All));
  }


  @Test
  public void testUnexpected() throws Exception {
    Permission p = new Permission() {
      @Override
      public boolean implies(Permission p) {
        return false;
      }
    };
    Permission collection1 = create(new KeyValue("collection", "coll1"));
    assertFalse(collection1.implies(null));
    assertFalse(collection1.implies(p));
    assertFalse(collection1.equals(null));
    assertFalse(collection1.equals(p));
  }

View Full Code Here

        Collection<Permission> perms = Collections.emptySet();
        PermissionResolver resolver = getPermissionResolver();
        if (resolver != null && !CollectionUtils.isEmpty(stringPerms)) {
            perms = new LinkedHashSet<Permission>(stringPerms.size());
            for (String strPermission : stringPerms) {
                Permission permission = getPermissionResolver().resolvePermission(strPermission);
                perms.add(permission);
            }
        }
        return perms;
    }

View Full Code Here

        }
        return perms;
    }


    public boolean isPermitted(PrincipalCollection principals, String permission) {
        Permission p = getPermissionResolver().resolvePermission(permission);
        return isPermitted(principals, p);
    }

View Full Code Here

        }
        return true;
    }


    public void checkPermission(PrincipalCollection subjectIdentifier, String permission) throws AuthorizationException {
        Permission p = getPermissionResolver().resolvePermission(permission);
        checkPermission(subjectIdentifier, p);
    }

View Full Code Here

0 1 2 3

TOP

Related Classes of org.apache.shiro.authz.Permission

org.apache.activemq.shiro.authz.ActiveMQPermissionResolverTest

org.apache.activemq.shiro.authz.ActiveMQWildcardPermissionTest

org.apache.activemq.shiro.authz.AuthorizationFilterTest

org.apache.activemq.shiro.authz.DestinationActionPermissionResolver

org.apache.activemq.shiro.authz.DestinationActionPermissionResolverTest

org.apache.camel.component.shiro.security.ShiroAuthorizationTest

org.apache.sentry.policy.db.TestDBWildcardPermission

org.apache.sentry.policy.search.TestSearchWildcardPermission

org.apache.sentry.provider.file.TestWildcardPermission

org.apache.shiro.realm.AuthorizingRealm

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.