AdminPermissionChecker { public static boolean hasAdministrativePermissions(@NotNull Session session, String... additionalAdminAuthorizableIds) throws RepositoryException { String userId = session.getUserID(); if (ADMIN_USER.equals(userId) || SYSTEM_USER.equals(userId)) { return true; } List<String> additionalAdminIds = Arrays.asList(Optional.ofNullable(additionalAdminAuthorizableIds).orElse(new String[0])); if (additionalAdminIds.contains(userId)) { return true; } if (!(session instanceof JackrabbitSession)) { log.warn("could not evaluate group permissions but just user name"); return false; } JackrabbitSession jackrabbitSession = (JackrabbitSession) session; Authorizable authorizable = jackrabbitSession.getUserManager().getAuthorizable(userId); if (authorizable == null) { return false; } Iterator<Group> groupIterator = authorizable.memberOf(); while (groupIterator.hasNext()) { String groupId = groupIterator.next().getID(); if (ADMINISTRATORS_GROUP.equals(groupId)) { return true; } if (additionalAdminIds.contains(groupId)) { return true; } } return false; }  static boolean hasAdministrativePermissions(@NotNull Session session, String... additionalAdminAuthorizableIds);  }
@Test public void testAdminUser() throws Exception { assertTrue("user admin should have admin permissions", AdminPermissionChecker.hasAdministrativePermissions(admin)); }
@Test public void testNotAdminUser() throws Exception { JackrabbitSession jackrabbitSession = (JackrabbitSession) admin; Authorizable vip = jackrabbitSession.getUserManager().getAuthorizable(TEST_USER); assertNull("test user must not exist", vip); jackrabbitSession.getUserManager().createUser(TEST_USER, TEST_USER); admin.save(); Session session = repository.login(new SimpleCredentials(TEST_USER, TEST_USER.toCharArray())); try { assertFalse( "\"" + TEST_USER + "\" is not admin/system and doesn't belong to administrators thus shouldn't have admin permissions", AdminPermissionChecker.hasAdministrativePermissions(session)); } finally { session.logout(); } }
@Test public void testAdminGroup() throws Exception { JackrabbitSession jackrabbitSession = (JackrabbitSession) admin; Authorizable admins = jackrabbitSession.getUserManager().getAuthorizable("administrators"); if (admins == null) { admins = jackrabbitSession.getUserManager().createGroup("administrators"); } Group adminsGroup = (Group) admins; User testUser = (User) jackrabbitSession.getUserManager().getAuthorizable(TEST_USER); if (testUser == null) { testUser = jackrabbitSession.getUserManager().createUser(TEST_USER, TEST_USER); } adminsGroup.addMember(testUser); admin.save(); Session session = repository.login(new SimpleCredentials(TEST_USER, TEST_USER.toCharArray())); try { assertTrue( "user \"" + TEST_USER + "\" has been added to administrators group thus should have admin permissions", AdminPermissionChecker.hasAdministrativePermissions(session)); } finally { session.logout(); } }
@Test public void testAdditionalAdminUser() throws AccessDeniedException, UnsupportedRepositoryOperationException, RepositoryException { JackrabbitSession jackrabbitSession = (JackrabbitSession) admin; Authorizable vip = jackrabbitSession.getUserManager().getAuthorizable(TEST_USER); assertNull("test user must not exist", vip); jackrabbitSession.getUserManager().createUser(TEST_USER, TEST_USER); admin.save(); Session session = repository.login(new SimpleCredentials(TEST_USER, TEST_USER.toCharArray())); try { assertTrue( "\"" + TEST_USER + "\" is additional admin/system thus should have admin permissions", AdminPermissionChecker.hasAdministrativePermissions(session, TEST_USER)); } finally { session.logout(); } }
@Test public void testAdditionalAdminGroup() throws Exception { JackrabbitSession jackrabbitSession = (JackrabbitSession) admin; Authorizable admins = jackrabbitSession.getUserManager().getAuthorizable("myadmins"); if (admins == null) { admins = jackrabbitSession.getUserManager().createGroup("myadmins"); } Group adminsGroup = (Group) admins; User testUser = (User) jackrabbitSession.getUserManager().getAuthorizable(TEST_USER); if (testUser == null) { testUser = jackrabbitSession.getUserManager().createUser(TEST_USER, TEST_USER); } adminsGroup.addMember(testUser); admin.save(); Session session = repository.login(new SimpleCredentials(TEST_USER, TEST_USER.toCharArray())); try { assertTrue( "user \"" + TEST_USER + "\" has been added to additional administrators group thus should have admin permissions", AdminPermissionChecker.hasAdministrativePermissions(session, "myadmins")); } finally { session.logout(); } }