|
|
|
|
@ -1,17 +1,17 @@
|
|
|
|
|
/*
|
|
|
|
|
* Copyright (c) 2015, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
|
|
|
|
|
* Copyright (c) 2016, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
|
|
|
|
|
*
|
|
|
|
|
* WSO2 Inc. licenses this file to you under the Apache License,
|
|
|
|
|
* Version 2.0 (the "License"); you may not use this file except
|
|
|
|
|
* in compliance with the License.
|
|
|
|
|
* you may obtain a copy of the License at
|
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
|
*
|
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
*
|
|
|
|
|
* Unless required by applicable law or agreed to in writing,
|
|
|
|
|
* software distributed under the License is distributed on an
|
|
|
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
|
|
|
* KIND, either express or implied. See the License for the
|
|
|
|
|
* KIND, either express or implied. See the License for the
|
|
|
|
|
* specific language governing permissions and limitations
|
|
|
|
|
* under the License.
|
|
|
|
|
*/
|
|
|
|
|
@ -21,17 +21,21 @@ package org.wso2.carbon.device.mgt.core.authorization;
|
|
|
|
|
import org.apache.commons.logging.Log;
|
|
|
|
|
import org.apache.commons.logging.LogFactory;
|
|
|
|
|
import org.wso2.carbon.context.CarbonContext;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.*;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.Device;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.DeviceIdentifier;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.DeviceManagementException;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.EnrolmentInfo;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.authorization.DeviceAccessAuthorizationException;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.authorization.DeviceAccessAuthorizationService;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.authorization.DeviceAuthorizationResult;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.group.mgt.DeviceGroup;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.group.mgt.GroupManagementException;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.permission.mgt.Permission;
|
|
|
|
|
import org.wso2.carbon.device.mgt.common.permission.mgt.PermissionManagementException;
|
|
|
|
|
import org.wso2.carbon.device.mgt.core.internal.DeviceManagementDataHolder;
|
|
|
|
|
import org.wso2.carbon.device.mgt.core.permission.mgt.PermissionUtils;
|
|
|
|
|
import org.wso2.carbon.user.api.UserRealm;
|
|
|
|
|
import org.wso2.carbon.user.api.UserStoreException;
|
|
|
|
|
import org.wso2.carbon.user.api.UserStoreManager;
|
|
|
|
|
|
|
|
|
|
import java.util.HashMap;
|
|
|
|
|
import java.util.List;
|
|
|
|
|
@ -45,18 +49,6 @@ public class DeviceAccessAuthorizationServiceImpl implements DeviceAccessAuthori
|
|
|
|
|
private final static String EMM_ADMIN_PERMISSION = "/device-mgt/admin-device-access";
|
|
|
|
|
private static Log log = LogFactory.getLog(DeviceAccessAuthorizationServiceImpl.class);
|
|
|
|
|
|
|
|
|
|
public static final class PermissionMethod {
|
|
|
|
|
private PermissionMethod() {
|
|
|
|
|
throw new AssertionError();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public static final String READ = "read";
|
|
|
|
|
public static final String WRITE = "write";
|
|
|
|
|
public static final String DELETE = "delete";
|
|
|
|
|
public static final String ACTION = "action";
|
|
|
|
|
public static final String UI_EXECUTE = "ui.execute";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public DeviceAccessAuthorizationServiceImpl() {
|
|
|
|
|
try {
|
|
|
|
|
this.addAdminPermissionToRegistry();
|
|
|
|
|
@ -66,158 +58,166 @@ public class DeviceAccessAuthorizationServiceImpl implements DeviceAccessAuthori
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public boolean isUserAuthorized(DeviceIdentifier deviceIdentifier) throws DeviceAccessAuthorizationException {
|
|
|
|
|
boolean status;
|
|
|
|
|
String username = this.getUserName();
|
|
|
|
|
public boolean isUserAuthorized(DeviceIdentifier deviceIdentifier, String username, String[] groupPermissions)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
int tenantId = this.getTenantId();
|
|
|
|
|
if (username == null || username.isEmpty()) {
|
|
|
|
|
return !DeviceManagementDataHolder.getInstance().requireDeviceAuthorization(deviceIdentifier.getType());
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
try {
|
|
|
|
|
//Check for admin users. If the user is an admin user we authorize the access to that device.
|
|
|
|
|
status = isAdminUser(username, tenantId);
|
|
|
|
|
} catch (UserStoreException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " + username, e);
|
|
|
|
|
//check for admin and ownership permissions
|
|
|
|
|
if (isAdminOrDeviceOwner(username, tenantId, deviceIdentifier)) {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
//Check for device ownership. If the user is the owner of the device we allow the access.
|
|
|
|
|
if (!status) {
|
|
|
|
|
try {
|
|
|
|
|
Device device = DeviceManagementDataHolder.getInstance().getDeviceManagementProvider().
|
|
|
|
|
getDevice(deviceIdentifier);
|
|
|
|
|
EnrolmentInfo enrolmentInfo = device.getEnrolmentInfo();
|
|
|
|
|
if (enrolmentInfo != null && username.equalsIgnoreCase(enrolmentInfo.getOwner())) {
|
|
|
|
|
status = true;
|
|
|
|
|
//check for group permissions
|
|
|
|
|
try {
|
|
|
|
|
if (groupPermissions == null || groupPermissions.length == 0) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
for (String groupPermission : groupPermissions) {
|
|
|
|
|
if (!isAuthorizedViaGroup(username, deviceIdentifier, groupPermission)) {
|
|
|
|
|
//if at least one fails, authorization fails
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
} catch (DeviceManagementException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " + username, e);
|
|
|
|
|
}
|
|
|
|
|
return true;
|
|
|
|
|
} catch (GroupManagementException | UserStoreException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " +
|
|
|
|
|
username, e);
|
|
|
|
|
}
|
|
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public DeviceAuthorizationResult isUserAuthorized(List<DeviceIdentifier> deviceIdentifiers) throws
|
|
|
|
|
DeviceAccessAuthorizationException {
|
|
|
|
|
boolean status;
|
|
|
|
|
DeviceAuthorizationResult deviceAuthorizationResult = new DeviceAuthorizationResult();
|
|
|
|
|
String username = this.getUserName();
|
|
|
|
|
public boolean isUserAuthorized(DeviceIdentifier deviceIdentifier, String username)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
return isUserAuthorized(deviceIdentifier, username, null);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public boolean isUserAuthorized(DeviceIdentifier deviceIdentifier, String[] groupPermissions)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
return isUserAuthorized(deviceIdentifier, this.getUserName(), groupPermissions);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public boolean isUserAuthorized(DeviceIdentifier deviceIdentifier) throws DeviceAccessAuthorizationException {
|
|
|
|
|
return isUserAuthorized(deviceIdentifier, this.getUserName(), null);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public DeviceAuthorizationResult isUserAuthorized(List<DeviceIdentifier> deviceIdentifiers, String username,
|
|
|
|
|
String[] groupPermissions)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
int tenantId = this.getTenantId();
|
|
|
|
|
if (username == null || username.isEmpty()) {
|
|
|
|
|
return deviceAuthorizationResult;
|
|
|
|
|
}
|
|
|
|
|
try {
|
|
|
|
|
//Check for admin users. If the user is an admin user we authorize the access to that device.
|
|
|
|
|
status = isAdminUser(username, tenantId);
|
|
|
|
|
} catch (UserStoreException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to devices for the user : " +
|
|
|
|
|
username, e);
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
//Check for device ownership. If the user is the owner of the device we allow the access.
|
|
|
|
|
if (!status) {
|
|
|
|
|
try {
|
|
|
|
|
//Get the list of devices of the user
|
|
|
|
|
List<Device> devicesOfUser = DeviceManagementDataHolder.getInstance().getDeviceManagementProvider().
|
|
|
|
|
getDevicesOfUser(username);
|
|
|
|
|
//Convert device-list to a Map
|
|
|
|
|
Map<String, String> ownershipData = this.getOwnershipOfDevices(devicesOfUser);
|
|
|
|
|
for (DeviceIdentifier deviceIdentifier : deviceIdentifiers) {
|
|
|
|
|
if (ownershipData.containsKey(deviceIdentifier.getId())) {
|
|
|
|
|
DeviceAuthorizationResult deviceAuthorizationResult = new DeviceAuthorizationResult();
|
|
|
|
|
for (DeviceIdentifier deviceIdentifier : deviceIdentifiers) {
|
|
|
|
|
//check for admin and ownership permissions
|
|
|
|
|
if (isAdminOrDeviceOwner(username, tenantId, deviceIdentifier)) {
|
|
|
|
|
deviceAuthorizationResult.addAuthorizedDevice(deviceIdentifier);
|
|
|
|
|
} else {
|
|
|
|
|
try {
|
|
|
|
|
if (groupPermissions == null || groupPermissions.length == 0) {
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
//check for group permissions
|
|
|
|
|
boolean isAuthorized = true;
|
|
|
|
|
for (String groupPermission : groupPermissions) {
|
|
|
|
|
if (!isAuthorizedViaGroup(username, deviceIdentifier, groupPermission)) {
|
|
|
|
|
//if at least one failed, authorizations fails and break the loop
|
|
|
|
|
isAuthorized = false;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (isAuthorized) {
|
|
|
|
|
deviceAuthorizationResult.addAuthorizedDevice(deviceIdentifier);
|
|
|
|
|
} else {
|
|
|
|
|
deviceAuthorizationResult.addUnauthorizedDevice(deviceIdentifier);
|
|
|
|
|
}
|
|
|
|
|
} catch (GroupManagementException | UserStoreException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " +
|
|
|
|
|
username, e);
|
|
|
|
|
}
|
|
|
|
|
} catch (DeviceManagementException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to devices for the user : "
|
|
|
|
|
+ username, e);
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
deviceAuthorizationResult.setAuthorizedDevices(deviceIdentifiers);
|
|
|
|
|
}
|
|
|
|
|
return deviceAuthorizationResult;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public boolean isUserAuthorized(DeviceIdentifier deviceIdentifier, String username)
|
|
|
|
|
public DeviceAuthorizationResult isUserAuthorized(List<DeviceIdentifier> deviceIdentifiers, String username)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
return isUserAuthorized(deviceIdentifiers, username, null);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public DeviceAuthorizationResult isUserAuthorized(List<DeviceIdentifier> deviceIdentifiers)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
return isUserAuthorized(deviceIdentifiers, this.getUserName(), null);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public DeviceAuthorizationResult isUserAuthorized(List<DeviceIdentifier> deviceIdentifiers, String[] groupPermissions)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
return isUserAuthorized(deviceIdentifiers, this.getUserName(), groupPermissions);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private boolean isAdminOrDeviceOwner(String username, int tenantId, DeviceIdentifier deviceIdentifier)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
boolean status;
|
|
|
|
|
int tenantId = this.getTenantId();
|
|
|
|
|
if (username == null || username.isEmpty()) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
try {
|
|
|
|
|
//Check for admin users. If the user is an admin user we authorize the access to that device.
|
|
|
|
|
status = isAdminUser(username, tenantId);
|
|
|
|
|
//First Check for admin users. If the user is an admin user we authorize the access to that device.
|
|
|
|
|
//Secondly Check for device ownership. If the user is the owner of the device we allow the access.
|
|
|
|
|
return (isAdminUser(username, tenantId) || isDeviceOwner(deviceIdentifier, username));
|
|
|
|
|
} catch (UserStoreException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " + username, e);
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " +
|
|
|
|
|
username, e);
|
|
|
|
|
}
|
|
|
|
|
//Check for device ownership. If the user is the owner of the device we allow the access.
|
|
|
|
|
if (!status) {
|
|
|
|
|
try {
|
|
|
|
|
Device device = DeviceManagementDataHolder.getInstance().getDeviceManagementProvider().
|
|
|
|
|
getDevice(deviceIdentifier);
|
|
|
|
|
EnrolmentInfo enrolmentInfo = device.getEnrolmentInfo();
|
|
|
|
|
if (enrolmentInfo != null && username.equalsIgnoreCase(enrolmentInfo.getOwner())) {
|
|
|
|
|
status = true;
|
|
|
|
|
}
|
|
|
|
|
} catch (DeviceManagementException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " + username, e);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private boolean isAuthorizedViaGroup(String username, DeviceIdentifier deviceIdentifier, String groupPermission)
|
|
|
|
|
throws GroupManagementException, UserStoreException {
|
|
|
|
|
List<DeviceGroup> authorizedGroups =
|
|
|
|
|
DeviceManagementDataHolder.getInstance().getGroupManagementProviderService()
|
|
|
|
|
.getGroups(username, groupPermission);
|
|
|
|
|
List<DeviceGroup> groupsWithDevice =
|
|
|
|
|
DeviceManagementDataHolder.getInstance().getGroupManagementProviderService()
|
|
|
|
|
.getGroups(deviceIdentifier);
|
|
|
|
|
for (DeviceGroup group : authorizedGroups) {
|
|
|
|
|
if (groupsWithDevice.contains(group)) {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return status;
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@Override
|
|
|
|
|
public DeviceAuthorizationResult isUserAuthorized(List<DeviceIdentifier> deviceIdentifiers, String username)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
boolean status;
|
|
|
|
|
int tenantId = this.getTenantId();
|
|
|
|
|
DeviceAuthorizationResult deviceAuthorizationResult = new DeviceAuthorizationResult();
|
|
|
|
|
if (username == null || username.isEmpty()) {
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
try {
|
|
|
|
|
//Check for admin users. If the user is an admin user we authorize the access to that device.
|
|
|
|
|
status = isAdminUser(username, tenantId);
|
|
|
|
|
} catch (UserStoreException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to devices for the user : " +
|
|
|
|
|
username, e);
|
|
|
|
|
}
|
|
|
|
|
private boolean isDeviceOwner(DeviceIdentifier deviceIdentifier, String username)
|
|
|
|
|
throws DeviceAccessAuthorizationException {
|
|
|
|
|
//Check for device ownership. If the user is the owner of the device we allow the access.
|
|
|
|
|
if (!status) {
|
|
|
|
|
try {
|
|
|
|
|
Device device;
|
|
|
|
|
EnrolmentInfo enrolmentInfo;
|
|
|
|
|
for (DeviceIdentifier deviceIdentifier : deviceIdentifiers) {
|
|
|
|
|
device = DeviceManagementDataHolder.getInstance().getDeviceManagementProvider().
|
|
|
|
|
getDevice(deviceIdentifier);
|
|
|
|
|
enrolmentInfo = device.getEnrolmentInfo();
|
|
|
|
|
if (enrolmentInfo != null && username.equalsIgnoreCase(enrolmentInfo.getOwner())) {
|
|
|
|
|
deviceAuthorizationResult.addAuthorizedDevice(deviceIdentifier);
|
|
|
|
|
} else {
|
|
|
|
|
deviceAuthorizationResult.addUnauthorizedDevice(deviceIdentifier);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
} catch (DeviceManagementException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to devices for the user : "
|
|
|
|
|
+ username, e);
|
|
|
|
|
try {
|
|
|
|
|
Device device = DeviceManagementDataHolder.getInstance().getDeviceManagementProvider().
|
|
|
|
|
getDevice(deviceIdentifier);
|
|
|
|
|
EnrolmentInfo enrolmentInfo = device.getEnrolmentInfo();
|
|
|
|
|
if (enrolmentInfo != null && username.equalsIgnoreCase(enrolmentInfo.getOwner())) {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
deviceAuthorizationResult.setAuthorizedDevices(deviceIdentifiers);
|
|
|
|
|
} catch (DeviceManagementException e) {
|
|
|
|
|
throw new DeviceAccessAuthorizationException("Unable to authorize the access to device : " +
|
|
|
|
|
deviceIdentifier.getId() + " for the user : " +
|
|
|
|
|
username, e);
|
|
|
|
|
}
|
|
|
|
|
return deviceAuthorizationResult;
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private boolean isAdminUser(String username, int tenantId) throws UserStoreException {
|
|
|
|
|
UserRealm userRealm = DeviceManagementDataHolder.getInstance().getRealmService().getTenantUserRealm(tenantId);
|
|
|
|
|
if (userRealm != null && userRealm.getAuthorizationManager() != null) {
|
|
|
|
|
return userRealm.getAuthorizationManager()
|
|
|
|
|
.isUserAuthorized(removeTenantDomain(username), PermissionUtils.getAbsolutePermissionPath(EMM_ADMIN_PERMISSION),
|
|
|
|
|
PermissionMethod.UI_EXECUTE);
|
|
|
|
|
.isUserAuthorized(removeTenantDomain(username),
|
|
|
|
|
PermissionUtils.getAbsolutePermissionPath(EMM_ADMIN_PERMISSION),
|
|
|
|
|
PermissionMethod.UI_EXECUTE);
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
@ -263,4 +263,16 @@ public class DeviceAccessAuthorizationServiceImpl implements DeviceAccessAuthori
|
|
|
|
|
}
|
|
|
|
|
return ownershipData;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public static final class PermissionMethod {
|
|
|
|
|
public static final String READ = "read";
|
|
|
|
|
public static final String WRITE = "write";
|
|
|
|
|
public static final String DELETE = "delete";
|
|
|
|
|
public static final String ACTION = "action";
|
|
|
|
|
public static final String UI_EXECUTE = "ui.execute";
|
|
|
|
|
|
|
|
|
|
private PermissionMethod() {
|
|
|
|
|
throw new AssertionError();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
ayyoob
9 years ago