Java Doc for GroupPermission.java in  » Wiki-Engine » JSPWiki » com » ecyrd » jspwiki » auth » permissions » Java Source Code / Java DocumentationJava Source Code and Java Documentation

Permission to perform an operation on a group in a given wiki. Permission actions include: view, edit, delete.

The target of a permission is a single group or collection in a given wiki. The syntax for the target is the wiki name, followed by a colon (:) and the name of the group. “All wikis” can be specified using a wildcard (*). Group collections may also be specified using a wildcard. For groups, the wildcard may be a prefix, suffix, or all by itself. Examples of targets include:

*:*
:TestPlanners
:*Planners
:Test*
mywiki:TestPlanners
mywiki:*Planners
mywiki:Test*

For a given target, certain permissions imply others:

• edit implies view
• delete implies edit and view

Targets that do not include a wiki prefix never imply others.

GroupPermission accepts a special target called <groupmember> that means “all groups that a user is a member of.” When included in a policy file grant block, it functions like a wildcard. Thus, this block:

 grant signedBy "jspwiki",
 principal com.ecyrd.jspwiki.auth.authorize.Role "Authenticated" {
 permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:<groupmember>", "edit";
 

GroupPermissions can only imply other GroupPermissions; no other permission types are implied.

Returns true if this GroupPermission was created with the token <groupmember> and the current thread’s Subject is a member of the Group indicated by the implied GroupPermission.

GroupPermissions can only imply other GroupPermissions; no other permission types are implied. One GroupPermission implies another if its actions if three conditions are met:

1. The other GroupPermission’s wiki is equal to, or a subset of, that of this permission. This permission’s wiki is considered a superset of the other if it contains a matching prefix plus a wildcard, or a wildcard followed by a matching suffix.
2. The other GroupPermission’s target is equal to, or a subset of, the target specified by this permission. This permission’s target is considered a superset of the other if it contains a matching prefix plus a wildcard, or a wildcard followed by a matching suffix.
3. All of other GroupPermission’s actions are equal to, or a subset of, those of this permission

Returns true if this GroupPermission was created with the token <groupmember> and the current thread’s Subject is a member of the Group indicated by the implied GroupPermission. Thus, a GroupPermission with the group <groupmember> implies GroupPermission for group "TestGroup" only if the Subject is a member of TestGroup.

We make this determination by obtaining the current Thread ’s java.security.AccessControlContext and requesting the javax.security.auth.SubjectDomainCombiner . If the combiner is not null, then we know that the access check was requested using a javax.security.auth.Subject ; that is, that an upstream caller caused a Subject to be associated with the Thread’s ProtectionDomain by executing a javax.security.auth.Subject.doAs(Subjectjava.security.PrivilegedAction) operation.

If a SubjectDomainCombiner exists, determining group membership is simple: just iterate through the Subject’s Principal set and look for all Principals of type com.ecyrd.jspwiki.auth.GroupPrincipal . If the name of any Principal matches the value of the implied Permission’s GroupPermission.getGroup value, then the Subject is a member of this group -- and therefore this impliesMember call returns true.

This may sound complicated, but it really isn’t. Consider the following examples:

Note that JSPWiki’s access control checks are made inside of com.ecyrd.jspwiki.auth.AuthorizationManager.checkPermission(com.ecyrd.jspwiki.WikiSessionPermission) , which performs a Subject.doAs() call. Thus, this Permission functions exactly the way it should during normal operations.