AuthorizationHelper { public static boolean isAuthorized(ResourceType resourceType, Long resourceId, RoleAuthorization requiredAuthorization) { return isAuthorized(getAuthentication(), resourceType, resourceId, EnumSet.of(requiredAuthorization)); }  Collection<GrantedAuthority> convertPrivilegesToAuthorities(Collection<PrivilegeEntity> privilegeEntities); static String getAuthenticatedName(); static String getAuthenticatedName(String defaultUsername); static int getAuthenticatedId(); static boolean isAuthorized(ResourceType resourceType, Long resourceId, 
                                     RoleAuthorization requiredAuthorization); static boolean isAuthorized(ResourceType resourceType, Long resourceId, 
                                     Set<RoleAuthorization> requiredAuthorizations); static boolean isAuthorized(Authentication authentication, ResourceType resourceType,
                                     Long resourceId, RoleAuthorization requiredAuthorization); static boolean isAuthorized(Authentication authentication, ResourceType resourceType,
                                     Long resourceId, Set<RoleAuthorization> requiredAuthorizations); static void verifyAuthorization(ResourceType resourceType,
                                         Long resourceId,
                                         Set<RoleAuthorization> requiredAuthorizations); static void verifyAuthorization(Authentication authentication,
                                         ResourceType resourceType,
                                         Long resourceId,
                                         Set<RoleAuthorization> requiredAuthorizations); static Authentication getAuthentication(); static void addLoginNameAlias(String ambariUserName, String loginAlias); static String resolveLoginAliasToUserName(String loginAlias); static List<String> getAuthorizationNames(Authentication authentication);  }
@Test public void testIsAuthorized() { Provider viewInstanceDAOProvider = createNiceMock(Provider.class); Provider privilegeDAOProvider = createNiceMock(Provider.class); ViewInstanceDAO viewInstanceDAO = createNiceMock(ViewInstanceDAO.class); PrivilegeDAO privilegeDAO = createNiceMock(PrivilegeDAO.class); expect(viewInstanceDAOProvider.get()).andReturn(viewInstanceDAO).anyTimes(); expect(privilegeDAOProvider.get()).andReturn(privilegeDAO).anyTimes(); replayAll(); AuthorizationHelper.viewInstanceDAOProvider = viewInstanceDAOProvider; AuthorizationHelper.privilegeDAOProvider = privilegeDAOProvider; RoleAuthorizationEntity readOnlyRoleAuthorizationEntity = new RoleAuthorizationEntity(); readOnlyRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.CLUSTER_VIEW_METRICS.getId()); RoleAuthorizationEntity privilegedRoleAuthorizationEntity = new RoleAuthorizationEntity(); privilegedRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS.getId()); RoleAuthorizationEntity administratorRoleAuthorizationEntity = new RoleAuthorizationEntity(); administratorRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.AMBARI_MANAGE_USERS.getId()); ResourceTypeEntity ambariResourceTypeEntity = new ResourceTypeEntity(); ambariResourceTypeEntity.setId(1); ambariResourceTypeEntity.setName(ResourceType.AMBARI.name()); ResourceTypeEntity clusterResourceTypeEntity = new ResourceTypeEntity(); clusterResourceTypeEntity.setId(1); clusterResourceTypeEntity.setName(ResourceType.CLUSTER.name()); ResourceTypeEntity cluster2ResourceTypeEntity = new ResourceTypeEntity(); cluster2ResourceTypeEntity.setId(2); cluster2ResourceTypeEntity.setName(ResourceType.CLUSTER.name()); ResourceEntity ambariResourceEntity = new ResourceEntity(); ambariResourceEntity.setResourceType(ambariResourceTypeEntity); ambariResourceEntity.setId(1L); ResourceEntity clusterResourceEntity = new ResourceEntity(); clusterResourceEntity.setResourceType(clusterResourceTypeEntity); clusterResourceEntity.setId(1L); ResourceEntity cluster2ResourceEntity = new ResourceEntity(); cluster2ResourceEntity.setResourceType(cluster2ResourceTypeEntity); cluster2ResourceEntity.setId(2L); PermissionEntity readOnlyPermissionEntity = new PermissionEntity(); readOnlyPermissionEntity.addAuthorization(readOnlyRoleAuthorizationEntity); PermissionEntity privilegedPermissionEntity = new PermissionEntity(); privilegedPermissionEntity.addAuthorization(readOnlyRoleAuthorizationEntity); privilegedPermissionEntity.addAuthorization(privilegedRoleAuthorizationEntity); PermissionEntity administratorPermissionEntity = new PermissionEntity(); administratorPermissionEntity.addAuthorization(readOnlyRoleAuthorizationEntity); administratorPermissionEntity.addAuthorization(privilegedRoleAuthorizationEntity); administratorPermissionEntity.addAuthorization(administratorRoleAuthorizationEntity); PrivilegeEntity readOnlyPrivilegeEntity = new PrivilegeEntity(); readOnlyPrivilegeEntity.setPermission(readOnlyPermissionEntity); readOnlyPrivilegeEntity.setResource(clusterResourceEntity); PrivilegeEntity readOnly2PrivilegeEntity = new PrivilegeEntity(); readOnly2PrivilegeEntity.setPermission(readOnlyPermissionEntity); readOnly2PrivilegeEntity.setResource(cluster2ResourceEntity); PrivilegeEntity privilegedPrivilegeEntity = new PrivilegeEntity(); privilegedPrivilegeEntity.setPermission(privilegedPermissionEntity); privilegedPrivilegeEntity.setResource(clusterResourceEntity); PrivilegeEntity privileged2PrivilegeEntity = new PrivilegeEntity(); privileged2PrivilegeEntity.setPermission(privilegedPermissionEntity); privileged2PrivilegeEntity.setResource(cluster2ResourceEntity); PrivilegeEntity administratorPrivilegeEntity = new PrivilegeEntity(); administratorPrivilegeEntity.setPermission(administratorPermissionEntity); administratorPrivilegeEntity.setResource(ambariResourceEntity); GrantedAuthority readOnlyAuthority = new AmbariGrantedAuthority(readOnlyPrivilegeEntity); GrantedAuthority readOnly2Authority = new AmbariGrantedAuthority(readOnly2PrivilegeEntity); GrantedAuthority privilegedAuthority = new AmbariGrantedAuthority(privilegedPrivilegeEntity); GrantedAuthority privileged2Authority = new AmbariGrantedAuthority(privileged2PrivilegeEntity); GrantedAuthority administratorAuthority = new AmbariGrantedAuthority(administratorPrivilegeEntity); Authentication noAccessUser = new TestAuthentication(Collections.<AmbariGrantedAuthority>emptyList()); Authentication readOnlyUser = new TestAuthentication(Collections.singleton(readOnlyAuthority)); Authentication privilegedUser = new TestAuthentication(Arrays.asList(readOnlyAuthority, privilegedAuthority)); Authentication privileged2User = new TestAuthentication(Arrays.asList(readOnly2Authority, privileged2Authority)); Authentication administratorUser = new TestAuthentication(Collections.singleton(administratorAuthority)); SecurityContext context = SecurityContextHolder.getContext(); assertFalse(AuthorizationHelper.isAuthorized(null, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(noAccessUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(noAccessUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(noAccessUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); assertTrue(AuthorizationHelper.isAuthorized(readOnlyUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(readOnlyUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(readOnlyUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); assertTrue(AuthorizationHelper.isAuthorized(privilegedUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertTrue(AuthorizationHelper.isAuthorized(privilegedUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(privilegedUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); assertFalse(AuthorizationHelper.isAuthorized(privileged2User, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(privileged2User, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(privileged2User, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); assertTrue(AuthorizationHelper.isAuthorized(administratorUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertTrue(AuthorizationHelper.isAuthorized(administratorUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertTrue(AuthorizationHelper.isAuthorized(administratorUser, ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); context.setAuthentication(noAccessUser); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); context.setAuthentication(readOnlyUser); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); context.setAuthentication(privilegedUser); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); context.setAuthentication(privileged2User); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); context.setAuthentication(administratorUser); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_VIEW_METRICS))); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.CLUSTER_TOGGLE_KERBEROS))); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS))); }
@Test public void testIsAuthorizedForSpecificView() { RoleAuthorizationEntity readOnlyRoleAuthorizationEntity = new RoleAuthorizationEntity(); readOnlyRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.CLUSTER_VIEW_METRICS.getId()); RoleAuthorizationEntity viewUseRoleAuthorizationEntity = new RoleAuthorizationEntity(); viewUseRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.VIEW_USE.getId()); RoleAuthorizationEntity administratorRoleAuthorizationEntity = new RoleAuthorizationEntity(); administratorRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.AMBARI_MANAGE_USERS.getId()); ResourceTypeEntity ambariResourceTypeEntity = new ResourceTypeEntity(); ambariResourceTypeEntity.setId(1); ambariResourceTypeEntity.setName(ResourceType.AMBARI.name()); ResourceTypeEntity clusterResourceTypeEntity = new ResourceTypeEntity(); clusterResourceTypeEntity.setId(1); clusterResourceTypeEntity.setName(ResourceType.CLUSTER.name()); ResourceTypeEntity viewResourceTypeEntity = new ResourceTypeEntity(); viewResourceTypeEntity.setId(30); viewResourceTypeEntity.setName(ResourceType.VIEW.name()); ResourceEntity ambariResourceEntity = new ResourceEntity(); ambariResourceEntity.setResourceType(ambariResourceTypeEntity); ambariResourceEntity.setId(1L); ResourceEntity clusterResourceEntity = new ResourceEntity(); clusterResourceEntity.setResourceType(clusterResourceTypeEntity); clusterResourceEntity.setId(1L); ResourceEntity viewResourceEntity = new ResourceEntity(); viewResourceEntity.setResourceType(viewResourceTypeEntity); viewResourceEntity.setId(53L); PermissionEntity readOnlyPermissionEntity = new PermissionEntity(); readOnlyPermissionEntity.addAuthorization(readOnlyRoleAuthorizationEntity); PermissionEntity viewUsePermissionEntity = new PermissionEntity(); viewUsePermissionEntity.addAuthorization(readOnlyRoleAuthorizationEntity); viewUsePermissionEntity.addAuthorization(viewUseRoleAuthorizationEntity); PermissionEntity administratorPermissionEntity = new PermissionEntity(); administratorPermissionEntity.addAuthorization(readOnlyRoleAuthorizationEntity); administratorPermissionEntity.addAuthorization(viewUseRoleAuthorizationEntity); administratorPermissionEntity.addAuthorization(administratorRoleAuthorizationEntity); PrivilegeEntity readOnlyPrivilegeEntity = new PrivilegeEntity(); readOnlyPrivilegeEntity.setPermission(readOnlyPermissionEntity); readOnlyPrivilegeEntity.setResource(clusterResourceEntity); PrivilegeEntity viewUsePrivilegeEntity = new PrivilegeEntity(); viewUsePrivilegeEntity.setPermission(viewUsePermissionEntity); viewUsePrivilegeEntity.setResource(viewResourceEntity); PrivilegeEntity administratorPrivilegeEntity = new PrivilegeEntity(); administratorPrivilegeEntity.setPermission(administratorPermissionEntity); administratorPrivilegeEntity.setResource(ambariResourceEntity); GrantedAuthority readOnlyAuthority = new AmbariGrantedAuthority(readOnlyPrivilegeEntity); GrantedAuthority viewUseAuthority = new AmbariGrantedAuthority(viewUsePrivilegeEntity); GrantedAuthority administratorAuthority = new AmbariGrantedAuthority(administratorPrivilegeEntity); Authentication readOnlyUser = new TestAuthentication(Collections.singleton(readOnlyAuthority)); Authentication viewUser = new TestAuthentication(Arrays.asList(readOnlyAuthority, viewUseAuthority)); Authentication administratorUser = new TestAuthentication(Collections.singleton(administratorAuthority)); SecurityContext context = SecurityContextHolder.getContext(); Set<RoleAuthorization> permissionsViewUse = EnumSet.of(RoleAuthorization.VIEW_USE); context.setAuthentication(readOnlyUser); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 53L, permissionsViewUse)); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 50L, permissionsViewUse)); context.setAuthentication(viewUser); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 53L, permissionsViewUse)); assertFalse(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 50L, permissionsViewUse)); context.setAuthentication(administratorUser); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 53L, permissionsViewUse)); assertTrue(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 50L, permissionsViewUse)); }