001: /*
002: * Copyright 2007 Pentaho Corporation. All rights reserved.
003: * This software was developed by Pentaho Corporation and is provided under the terms
004: * of the Mozilla Public License, Version 1.1, or any later version. You may not use
005: * this file except in compliance with the license. If you need a copy of the license,
006: * please go to http://www.mozilla.org/MPL/MPL-1.1.txt. The Original Code is the Pentaho
007: * BI Platform. The Initial Developer is Pentaho Corporation.
008: *
009: * Software distributed under the Mozilla Public License is distributed on an "AS IS"
010: * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. Please refer to
011: * the license for the specific language governing your rights and limitations.
012: */
013: package com.pentaho.security.acls.voter;
014:
015: import org.acegisecurity.Authentication;
016: import org.acegisecurity.acl.basic.BasicAclEntry;
017: import org.acegisecurity.acl.basic.GrantedAuthorityEffectiveAclsResolver;
018: import org.acegisecurity.acl.AclEntry;
019: import org.pentaho.core.session.IPentahoSession;
020:
021: import com.pentaho.security.SecurityUtils;
022: import com.pentaho.security.acls.IAclHolder;
023: import com.pentaho.security.acls.PentahoAclEntry;
024:
025: import java.util.List;
026:
027: /**
028: * Standard basic ACL Voter. This voter simply aggregates all the applicable
029: * access controls on an object when asked for the effective ACL.
030: * <p>
031: * For example, if the user (sally) belongs to the following roles:
032: * <pre>
033: * <table>
034: * <tr>
035: * <th>User Id</th><th>Role</th>
036: * </tr>
037: * <tr>
038: * <td>sally</td><td>dev</td>
039: * </tr>
040: * <tr>
041: * <td></td><td>mgr</td>
042: * </tr>
043: * </table>
044: * </pre>
045: * And the object has the following defined access controls:
046: * <pre>
047: * <table>
048: * <tr>
049: * <th>Role</th><th>Access</th>
050: * </tr>
051: * <tr>
052: * <td>dev</td><td>Execute</td>
053: * </tr>
054: * <tr>
055: * <td>sales</td><td>Execute and Subscribe</td>
056: * </tr>
057: * <tr>
058: * <td>sally</td><td>Nothing</td>
059: * </tr>
060: * </table>
061: * </pre>
062: * With voter, sally would have Execute permissions on this object because this voter
063: * simply aggregates all applicable access controls.
064: * <p>
065: * @author mbatchel
066: * @see PentahoUserOverridesVoter
067: * @see PentahoAllowAnonymousAclVoter
068: *
069: */
070:
071: public class PentahoBasicAclVoter extends AbstractPentahoAclVoter
072: implements IAclVoter {
073:
074: // Allow overriding of the obtaining of the authentication. This
075: // allows someone to decide whether to create an anonymous authentication
076: // or not.
077: public Authentication getAuthentication(IPentahoSession session) {
078: return SecurityUtils.getAuthentication(session, false);
079: }
080:
081: public boolean hasAccess(IPentahoSession session,
082: IAclHolder holder, int mask) {
083: Authentication auth = getAuthentication(session);
084: // If we're not authenticated, default to no access and return.
085: if (auth == null) {
086: return false;
087: }
088: AclEntry[] effectiveAcls = getEffectiveAcls(session, holder);
089: if ((effectiveAcls == null) || (effectiveAcls.length == 0)) {
090: return false;
091: }
092: for (int i = 0; i < effectiveAcls.length; i++) {
093: BasicAclEntry acl = (BasicAclEntry) effectiveAcls[i];
094: if (acl.isPermitted(mask)) {
095: return true;
096: }
097: }
098: return false;
099: }
100:
101: public AclEntry[] getEffectiveAcls(IPentahoSession session,
102: IAclHolder holder) {
103: Authentication auth = getAuthentication(session);
104: if (auth == null) {
105: return null; // No user, so no ACLs.
106: }
107: List allAcls = holder.getEffectiveAccessControls();
108: AclEntry[] acls = new AclEntry[allAcls.size()];
109: acls = (AclEntry[]) allAcls.toArray(acls);
110: GrantedAuthorityEffectiveAclsResolver resolver = new GrantedAuthorityEffectiveAclsResolver();
111: AclEntry[] resolvedAcls = resolver.resolveEffectiveAcls(acls,
112: auth);
113: return resolvedAcls;
114: }
115:
116: public PentahoAclEntry getEffectiveAcl(IPentahoSession session,
117: IAclHolder holder) {
118: // First, get all the ACLs on the object that apply to the user.
119: AclEntry[] effectiveAcls = getEffectiveAcls(session, holder);
120: PentahoAclEntry entry = new PentahoAclEntry();
121: entry.setMask(PentahoAclEntry.NOTHING);
122: // By default, we'll OR together all the acls to create the whole mask
123: // which
124: // indicates their access.
125: if ((effectiveAcls != null) && effectiveAcls.length > 0) {
126: int[] allAcls = new int[effectiveAcls.length];
127: for (int i = 0; i < effectiveAcls.length; i++) {
128: allAcls[i] = ((PentahoAclEntry) effectiveAcls[i])
129: .getMask();
130: }
131: entry.addPermissions(allAcls);
132: return entry;
133: } else {
134: return entry;
135: }
136: }
137:
138: }
|