@Test public void testCheckCallerIsSelfOrHasRightSameActor() { ThreadBasedUserCrnProvider.doAs(USER_CRN, () -> underTest.checkCallerIsSelfOrHasRight(USER_CRN, USER_CRN, AuthorizationResourceAction.GET_KEYTAB)); }
public void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action) { Crn actorCrn = Crn.safeFromString(actorCrnStr); Crn targetUserCrn = Crn.safeFromString(targetUserCrnStr); if (actorCrn.equals(targetUserCrn)) { return; } if (!actorCrn.getAccountId().equals(targetUserCrn.getAccountId())) { String unauthorizedMessage = "Unauthorized to run this operation in a different account"; LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } if (!umsClient.checkRight(ThreadBasedUserCrnProvider.INTERNAL_ACTOR_CRN, actorCrn.toString(), umsRightProvider.getRight(action), getRequestId())) { String unauthorizedMessage = String.format("You have no right to perform %s on user %s.", umsRightProvider.getRight(action), targetUserCrnStr); LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } }
UmsAccountAuthorizationService { public void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action) { Crn actorCrn = Crn.safeFromString(actorCrnStr); Crn targetUserCrn = Crn.safeFromString(targetUserCrnStr); if (actorCrn.equals(targetUserCrn)) { return; } if (!actorCrn.getAccountId().equals(targetUserCrn.getAccountId())) { String unauthorizedMessage = "Unauthorized to run this operation in a different account"; LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } if (!umsClient.checkRight(ThreadBasedUserCrnProvider.INTERNAL_ACTOR_CRN, actorCrn.toString(), umsRightProvider.getRight(action), getRequestId())) { String unauthorizedMessage = String.format("You have no right to perform %s on user %s.", umsRightProvider.getRight(action), targetUserCrnStr); LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } } }
UmsAccountAuthorizationService { public void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action) { Crn actorCrn = Crn.safeFromString(actorCrnStr); Crn targetUserCrn = Crn.safeFromString(targetUserCrnStr); if (actorCrn.equals(targetUserCrn)) { return; } if (!actorCrn.getAccountId().equals(targetUserCrn.getAccountId())) { String unauthorizedMessage = "Unauthorized to run this operation in a different account"; LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } if (!umsClient.checkRight(ThreadBasedUserCrnProvider.INTERNAL_ACTOR_CRN, actorCrn.toString(), umsRightProvider.getRight(action), getRequestId())) { String unauthorizedMessage = String.format("You have no right to perform %s on user %s.", umsRightProvider.getRight(action), targetUserCrnStr); LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } }  }
UmsAccountAuthorizationService { public void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action) { Crn actorCrn = Crn.safeFromString(actorCrnStr); Crn targetUserCrn = Crn.safeFromString(targetUserCrnStr); if (actorCrn.equals(targetUserCrn)) { return; } if (!actorCrn.getAccountId().equals(targetUserCrn.getAccountId())) { String unauthorizedMessage = "Unauthorized to run this operation in a different account"; LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } if (!umsClient.checkRight(ThreadBasedUserCrnProvider.INTERNAL_ACTOR_CRN, actorCrn.toString(), umsRightProvider.getRight(action), getRequestId())) { String unauthorizedMessage = String.format("You have no right to perform %s on user %s.", umsRightProvider.getRight(action), targetUserCrnStr); LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } }  void checkRightOfUser(String userCrn, AuthorizationResourceAction action); Boolean hasRightOfUser(String userCrn, String action); void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action); }
UmsAccountAuthorizationService { public void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action) { Crn actorCrn = Crn.safeFromString(actorCrnStr); Crn targetUserCrn = Crn.safeFromString(targetUserCrnStr); if (actorCrn.equals(targetUserCrn)) { return; } if (!actorCrn.getAccountId().equals(targetUserCrn.getAccountId())) { String unauthorizedMessage = "Unauthorized to run this operation in a different account"; LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } if (!umsClient.checkRight(ThreadBasedUserCrnProvider.INTERNAL_ACTOR_CRN, actorCrn.toString(), umsRightProvider.getRight(action), getRequestId())) { String unauthorizedMessage = String.format("You have no right to perform %s on user %s.", umsRightProvider.getRight(action), targetUserCrnStr); LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } }  void checkRightOfUser(String userCrn, AuthorizationResourceAction action); Boolean hasRightOfUser(String userCrn, String action); void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action);  }