@Test public void testIsAuthorizedUserHasWriteAccess() throws Exception { createUser( USER_ALPACA, "Al 'Archiva' Paca" ); assignRepositoryManagerRole( USER_ALPACA, "corporate" ); UserManager userManager = securitySystem.getUserManager(); User user = userManager.findUser( USER_ALPACA ); AuthenticationResult result = new AuthenticationResult( true, USER_ALPACA, null ); SecuritySession session = new DefaultSecuritySession( result, user ); boolean isAuthorized = servletAuth.isAuthorized( request, session, "corporate", ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD ); assertTrue( isAuthorized ); restoreGuestInitialValues( USER_ALPACA ); }
@Override public boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId, String permission ) throws AuthorizationException, UnauthorizedException { AuthorizationResult authzResult = securitySystem.authorize( securitySession, permission, repositoryId ); if ( !authzResult.isAuthorized() ) { if ( authzResult.getException() != null ) { log.info( "Authorization Denied [ip={},permission={},repo={}] : {}", request.getRemoteAddr(), permission, repositoryId, authzResult.getException().getMessage() ); throw new UnauthorizedException( "Access denied for repository " + repositoryId ); } throw new UnauthorizedException( "User account is locked" ); } return true; }
ArchivaServletAuthenticator implements ServletAuthenticator { @Override public boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId, String permission ) throws AuthorizationException, UnauthorizedException { AuthorizationResult authzResult = securitySystem.authorize( securitySession, permission, repositoryId ); if ( !authzResult.isAuthorized() ) { if ( authzResult.getException() != null ) { log.info( "Authorization Denied [ip={},permission={},repo={}] : {}", request.getRemoteAddr(), permission, repositoryId, authzResult.getException().getMessage() ); throw new UnauthorizedException( "Access denied for repository " + repositoryId ); } throw new UnauthorizedException( "User account is locked" ); } return true; } }
ArchivaServletAuthenticator implements ServletAuthenticator { @Override public boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId, String permission ) throws AuthorizationException, UnauthorizedException { AuthorizationResult authzResult = securitySystem.authorize( securitySession, permission, repositoryId ); if ( !authzResult.isAuthorized() ) { if ( authzResult.getException() != null ) { log.info( "Authorization Denied [ip={},permission={},repo={}] : {}", request.getRemoteAddr(), permission, repositoryId, authzResult.getException().getMessage() ); throw new UnauthorizedException( "Access denied for repository " + repositoryId ); } throw new UnauthorizedException( "User account is locked" ); } return true; }  }
ArchivaServletAuthenticator implements ServletAuthenticator { @Override public boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId, String permission ) throws AuthorizationException, UnauthorizedException { AuthorizationResult authzResult = securitySystem.authorize( securitySession, permission, repositoryId ); if ( !authzResult.isAuthorized() ) { if ( authzResult.getException() != null ) { log.info( "Authorization Denied [ip={},permission={},repo={}] : {}", request.getRemoteAddr(), permission, repositoryId, authzResult.getException().getMessage() ); throw new UnauthorizedException( "Access denied for repository " + repositoryId ); } throw new UnauthorizedException( "User account is locked" ); } return true; }  @Override boolean isAuthenticated( HttpServletRequest request, AuthenticationResult result ); @Override boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId,
                                 String permission ); @Override boolean isAuthorized( String principal, String repoId, String permission ); SecuritySystem getSecuritySystem(); void setSecuritySystem( SecuritySystem securitySystem ); }
ArchivaServletAuthenticator implements ServletAuthenticator { @Override public boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId, String permission ) throws AuthorizationException, UnauthorizedException { AuthorizationResult authzResult = securitySystem.authorize( securitySession, permission, repositoryId ); if ( !authzResult.isAuthorized() ) { if ( authzResult.getException() != null ) { log.info( "Authorization Denied [ip={},permission={},repo={}] : {}", request.getRemoteAddr(), permission, repositoryId, authzResult.getException().getMessage() ); throw new UnauthorizedException( "Access denied for repository " + repositoryId ); } throw new UnauthorizedException( "User account is locked" ); } return true; }  @Override boolean isAuthenticated( HttpServletRequest request, AuthenticationResult result ); @Override boolean isAuthorized( HttpServletRequest request, SecuritySession securitySession, String repositoryId,
                                 String permission ); @Override boolean isAuthorized( String principal, String repoId, String permission ); SecuritySystem getSecuritySystem(); void setSecuritySystem( SecuritySystem securitySystem );  }