@Test public void testUnauthorizedDueToUnknownUser() throws Exception { final String userIdentifier = "userIdentifier1"; final String userIdentity = "userIdentity1"; final String notUser1Identity = "not userIdentity1"; final User user = new User.Builder() .identity(userIdentity) .identifier(userIdentifier) .build(); final AccessPolicy policy = new AccessPolicy.Builder() .identifier("1") .resource(TEST_RESOURCE.getIdentifier()) .addUser(userIdentifier) .action(RequestAction.READ) .build(); final ConfigurableUserGroupProvider userGroupProvider = mock(ConfigurableUserGroupProvider.class); when(userGroupProvider.getUserAndGroups(notUser1Identity)).thenReturn(new UserAndGroups() { @Override public User getUser() { return null; } @Override public Set<Group> getGroups() { return Collections.EMPTY_SET; } }); final ConfigurableAccessPolicyProvider accessPolicyProvider = mock(ConfigurableAccessPolicyProvider.class); when(accessPolicyProvider.getAccessPolicy(TEST_RESOURCE.getIdentifier(), RequestAction.READ)).thenReturn(policy); when(accessPolicyProvider.getUserGroupProvider()).thenReturn(userGroupProvider); final AuthorizationRequest request = new AuthorizationRequest.Builder() .identity(notUser1Identity) .resource(TEST_RESOURCE) .action(RequestAction.READ) .accessAttempt(true) .anonymous(false) .build(); final StandardManagedAuthorizer managedAuthorizer = getStandardManagedAuthorizer(accessPolicyProvider); assertTrue(AuthorizationResult.approved().getResult().equals(managedAuthorizer.authorize(request).getResult())); }
@Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { if (isAdmin(request.getIdentity())) { return AuthorizationResult.approved(); } String resourceIdentifier = request.getResource().getIdentifier(); if(resourceIdentifier.startsWith(ResourceType.ProvenanceData.getValue())){ resourceIdentifier = ResourceType.Provenance.getValue(); } final AccessPolicy policy = accessPolicyProvider.getAccessPolicy(resourceIdentifier, request.getAction()); if (policy == null) { return AuthorizationResult.resourceNotFound(); } final UserAndGroups userAndGroups = userGroupProvider.getUserAndGroups(request.getIdentity()); final User user = userAndGroups.getUser(); if (user == null) { if (request.isAnonymous()) { if (request.getRequestedResource().getName().equals("HandleHttpRequest")) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(String.format("user identity can't be '%s'.", request.getIdentity())); } User newUser = new User.Builder().identifier(generateUuid(request.getIdentity())).identity(request.getIdentity()).build(); if(!autoGenerateUser(newUser)){ return AuthorizationResult.denied("Unable to access!"); } ((ConfigurableUserGroupProvider)userGroupProvider).addUser(newUser); ((ConfigurableAccessPolicyProvider) accessPolicyProvider).setUserDefaultAccesPilicy(newUser); return AuthorizationResult.approved(); } final Set<Group> userGroups = userAndGroups.getGroups(); if (policy.getUsers().contains(user.getIdentifier()) || containsGroup(userGroups, policy)) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); }
StandardManagedAuthorizer implements ManagedAuthorizer { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { if (isAdmin(request.getIdentity())) { return AuthorizationResult.approved(); } String resourceIdentifier = request.getResource().getIdentifier(); if(resourceIdentifier.startsWith(ResourceType.ProvenanceData.getValue())){ resourceIdentifier = ResourceType.Provenance.getValue(); } final AccessPolicy policy = accessPolicyProvider.getAccessPolicy(resourceIdentifier, request.getAction()); if (policy == null) { return AuthorizationResult.resourceNotFound(); } final UserAndGroups userAndGroups = userGroupProvider.getUserAndGroups(request.getIdentity()); final User user = userAndGroups.getUser(); if (user == null) { if (request.isAnonymous()) { if (request.getRequestedResource().getName().equals("HandleHttpRequest")) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(String.format("user identity can't be '%s'.", request.getIdentity())); } User newUser = new User.Builder().identifier(generateUuid(request.getIdentity())).identity(request.getIdentity()).build(); if(!autoGenerateUser(newUser)){ return AuthorizationResult.denied("Unable to access!"); } ((ConfigurableUserGroupProvider)userGroupProvider).addUser(newUser); ((ConfigurableAccessPolicyProvider) accessPolicyProvider).setUserDefaultAccesPilicy(newUser); return AuthorizationResult.approved(); } final Set<Group> userGroups = userAndGroups.getGroups(); if (policy.getUsers().contains(user.getIdentifier()) || containsGroup(userGroups, policy)) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); } }
StandardManagedAuthorizer implements ManagedAuthorizer { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { if (isAdmin(request.getIdentity())) { return AuthorizationResult.approved(); } String resourceIdentifier = request.getResource().getIdentifier(); if(resourceIdentifier.startsWith(ResourceType.ProvenanceData.getValue())){ resourceIdentifier = ResourceType.Provenance.getValue(); } final AccessPolicy policy = accessPolicyProvider.getAccessPolicy(resourceIdentifier, request.getAction()); if (policy == null) { return AuthorizationResult.resourceNotFound(); } final UserAndGroups userAndGroups = userGroupProvider.getUserAndGroups(request.getIdentity()); final User user = userAndGroups.getUser(); if (user == null) { if (request.isAnonymous()) { if (request.getRequestedResource().getName().equals("HandleHttpRequest")) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(String.format("user identity can't be '%s'.", request.getIdentity())); } User newUser = new User.Builder().identifier(generateUuid(request.getIdentity())).identity(request.getIdentity()).build(); if(!autoGenerateUser(newUser)){ return AuthorizationResult.denied("Unable to access!"); } ((ConfigurableUserGroupProvider)userGroupProvider).addUser(newUser); ((ConfigurableAccessPolicyProvider) accessPolicyProvider).setUserDefaultAccesPilicy(newUser); return AuthorizationResult.approved(); } final Set<Group> userGroups = userAndGroups.getGroups(); if (policy.getUsers().contains(user.getIdentifier()) || containsGroup(userGroups, policy)) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); }  }
StandardManagedAuthorizer implements ManagedAuthorizer { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { if (isAdmin(request.getIdentity())) { return AuthorizationResult.approved(); } String resourceIdentifier = request.getResource().getIdentifier(); if(resourceIdentifier.startsWith(ResourceType.ProvenanceData.getValue())){ resourceIdentifier = ResourceType.Provenance.getValue(); } final AccessPolicy policy = accessPolicyProvider.getAccessPolicy(resourceIdentifier, request.getAction()); if (policy == null) { return AuthorizationResult.resourceNotFound(); } final UserAndGroups userAndGroups = userGroupProvider.getUserAndGroups(request.getIdentity()); final User user = userAndGroups.getUser(); if (user == null) { if (request.isAnonymous()) { if (request.getRequestedResource().getName().equals("HandleHttpRequest")) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(String.format("user identity can't be '%s'.", request.getIdentity())); } User newUser = new User.Builder().identifier(generateUuid(request.getIdentity())).identity(request.getIdentity()).build(); if(!autoGenerateUser(newUser)){ return AuthorizationResult.denied("Unable to access!"); } ((ConfigurableUserGroupProvider)userGroupProvider).addUser(newUser); ((ConfigurableAccessPolicyProvider) accessPolicyProvider).setUserDefaultAccesPilicy(newUser); return AuthorizationResult.approved(); } final Set<Group> userGroups = userAndGroups.getGroups(); if (policy.getUsers().contains(user.getIdentifier()) || containsGroup(userGroups, policy)) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); }  @Override void initialize(AuthorizerInitializationContext initializationContext); @Override void onConfigured(AuthorizerConfigurationContext configurationContext); @Override AuthorizationResult authorize(AuthorizationRequest request); boolean isSecurityUserAutoGenerateEnabled(); @Override String getFingerprint(); @Override void inheritFingerprint(String fingerprint); @Override void checkInheritability(String proposedFingerprint); @Override AccessPolicyProvider getAccessPolicyProvider(); @Override void preDestruction(); }
StandardManagedAuthorizer implements ManagedAuthorizer { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { if (isAdmin(request.getIdentity())) { return AuthorizationResult.approved(); } String resourceIdentifier = request.getResource().getIdentifier(); if(resourceIdentifier.startsWith(ResourceType.ProvenanceData.getValue())){ resourceIdentifier = ResourceType.Provenance.getValue(); } final AccessPolicy policy = accessPolicyProvider.getAccessPolicy(resourceIdentifier, request.getAction()); if (policy == null) { return AuthorizationResult.resourceNotFound(); } final UserAndGroups userAndGroups = userGroupProvider.getUserAndGroups(request.getIdentity()); final User user = userAndGroups.getUser(); if (user == null) { if (request.isAnonymous()) { if (request.getRequestedResource().getName().equals("HandleHttpRequest")) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(String.format("user identity can't be '%s'.", request.getIdentity())); } User newUser = new User.Builder().identifier(generateUuid(request.getIdentity())).identity(request.getIdentity()).build(); if(!autoGenerateUser(newUser)){ return AuthorizationResult.denied("Unable to access!"); } ((ConfigurableUserGroupProvider)userGroupProvider).addUser(newUser); ((ConfigurableAccessPolicyProvider) accessPolicyProvider).setUserDefaultAccesPilicy(newUser); return AuthorizationResult.approved(); } final Set<Group> userGroups = userAndGroups.getGroups(); if (policy.getUsers().contains(user.getIdentifier()) || containsGroup(userGroups, policy)) { return AuthorizationResult.approved(); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); }  @Override void initialize(AuthorizerInitializationContext initializationContext); @Override void onConfigured(AuthorizerConfigurationContext configurationContext); @Override AuthorizationResult authorize(AuthorizationRequest request); boolean isSecurityUserAutoGenerateEnabled(); @Override String getFingerprint(); @Override void inheritFingerprint(String fingerprint); @Override void checkInheritability(String proposedFingerprint); @Override AccessPolicyProvider getAccessPolicyProvider(); @Override void preDestruction();  }