forked from community/device-mgt-core
parent
bf4a8a8f63
commit
e639413e01
@ -0,0 +1,15 @@
|
||||
package io.entgra.device.mgt.core.device.mgt.common.authorization;
|
||||
|
||||
public interface GroupAccessAuthorizationService {
|
||||
|
||||
public boolean isUserAuthorized(int groupId, String username, String[] groupPermissions)
|
||||
throws DeviceAccessAuthorizationException;
|
||||
|
||||
public boolean isUserAuthorized(int groupId, String username)
|
||||
throws DeviceAccessAuthorizationException;
|
||||
|
||||
public boolean isUserAuthorized(int groupId, String[] groupPermissions)
|
||||
throws DeviceAccessAuthorizationException;
|
||||
|
||||
public boolean isUserAuthorized(int groupId) throws DeviceAccessAuthorizationException;
|
||||
}
|
||||
@ -0,0 +1,166 @@
|
||||
package io.entgra.device.mgt.core.device.mgt.core.authorization;
|
||||
|
||||
import io.entgra.device.mgt.core.device.mgt.common.DeviceIdentifier;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.authorization.DeviceAccessAuthorizationException;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.authorization.GroupAccessAuthorizationService;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.exceptions.DeviceManagementException;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.group.mgt.DeviceGroup;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.group.mgt.GroupManagementException;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.permission.mgt.Permission;
|
||||
import io.entgra.device.mgt.core.device.mgt.common.permission.mgt.PermissionManagementException;
|
||||
import io.entgra.device.mgt.core.device.mgt.core.internal.DeviceManagementDataHolder;
|
||||
import io.entgra.device.mgt.core.device.mgt.core.permission.mgt.PermissionUtils;
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
import org.wso2.carbon.CarbonConstants;
|
||||
import org.wso2.carbon.context.CarbonContext;
|
||||
import org.wso2.carbon.user.api.UserRealm;
|
||||
import org.wso2.carbon.user.api.UserStoreException;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
public class GroupAccessAuthorizationServiceImpl implements GroupAccessAuthorizationService {
|
||||
|
||||
private final static String GROUP_ADMIN_PERMISSION = "/device-mgt/devices/any-group/permitted-actions-under-owning-group";
|
||||
private final static String GROUP_ADMIN = "Group Management Administrator";
|
||||
private static Log log = LogFactory.getLog(DeviceAccessAuthorizationServiceImpl.class);
|
||||
|
||||
public GroupAccessAuthorizationServiceImpl() {
|
||||
try {
|
||||
this.addAdminPermissionToRegistry();
|
||||
} catch (PermissionManagementException e) {
|
||||
log.error("Unable to add the group-admin permission to the registry.", e);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isUserAuthorized(int groupId, String username, String[] groupPermissions)
|
||||
throws DeviceAccessAuthorizationException {
|
||||
int tenantId = this.getTenantId();
|
||||
if (username == null || username.isEmpty()) {
|
||||
username = this.getUserName();
|
||||
}
|
||||
//check for admin and ownership permissions
|
||||
if (isGroupAdminUser(username, tenantId) || isGroupOwner(groupId, username)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// if group owner
|
||||
if (isGroupOwner(groupId, username)) {
|
||||
//check for group permissions
|
||||
if (groupPermissions == null || groupPermissions.length == 0) {
|
||||
return false;
|
||||
} else {
|
||||
// if group permissions specified, check whether that permission is available in any user role of the group owner
|
||||
try {
|
||||
UserRealm userRealm = DeviceManagementDataHolder.getInstance().getRealmService()
|
||||
.getTenantUserRealm(getTenantId());
|
||||
String[] userRoles = userRealm.getUserStoreManager().getRoleListOfUser(username);
|
||||
boolean isAuthorized = true;
|
||||
for (String groupPermission : groupPermissions) {
|
||||
for (String role : userRoles) {
|
||||
if (!userRealm.getAuthorizationManager().
|
||||
isRoleAuthorized(role, groupPermission, CarbonConstants.UI_PERMISSION_ACTION)) {
|
||||
isAuthorized = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
return isAuthorized;
|
||||
} catch (UserStoreException e) {
|
||||
throw new DeviceAccessAuthorizationException("Unable to authorize the access to group : " +
|
||||
groupId + " for the user : " +
|
||||
username, e);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isUserAuthorized(int groupId, String username)
|
||||
throws DeviceAccessAuthorizationException {
|
||||
return isUserAuthorized(groupId, username, null);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isUserAuthorized(int groupId, String[] groupPermissions)
|
||||
throws DeviceAccessAuthorizationException {
|
||||
return isUserAuthorized(groupId, this.getUserName(), groupPermissions);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isUserAuthorized(int groupId) throws DeviceAccessAuthorizationException {
|
||||
return isUserAuthorized(groupId, this.getUserName(), null);
|
||||
}
|
||||
|
||||
public boolean isGroupAdminUser() throws DeviceAccessAuthorizationException {
|
||||
String username = this.getUserName();
|
||||
int tenantId = this.getTenantId();
|
||||
try {
|
||||
return isGroupAdminUser(username, tenantId);
|
||||
} catch (DeviceAccessAuthorizationException e) {
|
||||
throw new DeviceAccessAuthorizationException("Unable to check the admin permissions of user : " +
|
||||
username + " in tenant : " + tenantId, e);
|
||||
}
|
||||
}
|
||||
|
||||
private boolean isGroupOwner(int groupId, String username)
|
||||
throws DeviceAccessAuthorizationException {
|
||||
//Check for group ownership. If the user is the owner of the group we allow the access.
|
||||
try {
|
||||
DeviceGroup group = DeviceManagementDataHolder.getInstance().
|
||||
getGroupManagementProviderService().getGroup(groupId, false);
|
||||
return username.equals(group.getOwner());
|
||||
} catch (GroupManagementException e) {
|
||||
throw new DeviceAccessAuthorizationException("Unable to authorize the access to group : " +
|
||||
groupId + " for the user : " +
|
||||
username, e);
|
||||
}
|
||||
}
|
||||
|
||||
private boolean isGroupAdminUser(String username, int tenantId) throws DeviceAccessAuthorizationException {
|
||||
try {
|
||||
UserRealm userRealm = DeviceManagementDataHolder.getInstance().getRealmService().getTenantUserRealm(tenantId);
|
||||
if (userRealm != null && userRealm.getAuthorizationManager() != null) {
|
||||
return userRealm.getAuthorizationManager()
|
||||
.isUserAuthorized(removeTenantDomain(username),
|
||||
PermissionUtils.getAbsolutePermissionPath(GROUP_ADMIN_PERMISSION),
|
||||
CarbonConstants.UI_PERMISSION_ACTION);
|
||||
}
|
||||
return false;
|
||||
} catch (UserStoreException e) {
|
||||
throw new DeviceAccessAuthorizationException("Unable to authorize the access for the user : " +
|
||||
username, e);
|
||||
}
|
||||
}
|
||||
|
||||
private String getUserName() {
|
||||
String username = CarbonContext.getThreadLocalCarbonContext().getUsername();
|
||||
if (username != null && !username.isEmpty()) {
|
||||
return removeTenantDomain(username);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private String removeTenantDomain(String username) {
|
||||
String tenantDomain = CarbonContext.getThreadLocalCarbonContext().getTenantDomain();
|
||||
if (username.endsWith(tenantDomain)) {
|
||||
return username.substring(0, username.lastIndexOf("@"));
|
||||
}
|
||||
return username;
|
||||
}
|
||||
|
||||
private int getTenantId() {
|
||||
return CarbonContext.getThreadLocalCarbonContext().getTenantId();
|
||||
}
|
||||
|
||||
private boolean addAdminPermissionToRegistry() throws PermissionManagementException {
|
||||
Permission permission = new Permission();
|
||||
permission.setName(GROUP_ADMIN);
|
||||
permission.setPath(PermissionUtils.getAbsolutePermissionPath(GROUP_ADMIN_PERMISSION));
|
||||
return PermissionUtils.putPermission(permission);
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in new issue