|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectcom.ecyrd.jspwiki.auth.AuthorizationManager
public final class AuthorizationManager
Manages all access control and authorization; determines what authenticated users are allowed to do.
Privileges in JSPWiki are expressed as Java-standard Permission
classes. There are two types of permissions:
WikiPermission
- privileges that apply
to an entire wiki instance: e.g., editing user profiles, creating pages, creating groupsPagePermission
- privileges that apply
to a single wiki page or range of pages: e.g., reading, editing, renaming
Calling classes determine whether they are entitled to perform a particular action
by constructing the appropriate permission first, then passing it and the current
WikiSession
to the
checkPermission(WikiSession, Permission)
method. If the session's
Subject possesses the permission, the action is allowed.
For WikiPermissions, the decision criteria is relatively simple: the caller either possesses the permission, as granted by the wiki security policy -- or not.
For PagePermissions, the logic is exactly the same if the page being checked does not have an access control list. However, if the page does have an ACL, the authorization decision is made based the union of the permissions granted in the ACL and in the security policy. In other words, the user must be named in the ACL (or belong to a group or role that is named in the ACL) and be granted (at least) the same permission in the security policy. We do this to prevent a user from gaining more permissions than they already have, based on the security policy.
See the checkPermission(WikiSession, Permission)
and
hasRoleOrPrincipal(WikiSession, Principal)
methods for more information
on the authorization logic.
AuthenticationManager
Field Summary | |
---|---|
static String |
DEFAULT_AUTHORIZER
The default external Authorizer is the WebContainerAuthorizer |
static String |
PROP_AUTHORIZER
The property name in jspwiki.properties for specifying the external Authorizer . |
Constructor Summary | |
---|---|
AuthorizationManager()
Constructs a new AuthorizationManager instance. |
Method Summary | |
---|---|
void |
addWikiEventListener(WikiEventListener listener)
Registers a WikiEventListener with this instance. |
boolean |
checkPermission(WikiSession session,
Permission permission)
Returns true or false , depending on
whether a Permission is allowed for the Subject associated with
a supplied WikiSession. |
protected boolean |
checkStaticPermission(Subject subject,
Permission permission)
Determines whether a Subject posesses a given "static" Permission as defined in the security policy file. |
protected void |
fireEvent(WikiSecurityEvent event)
Fires a wiki event to all registered listeners. |
protected Authorizer |
getAuthorizer()
Returns the current external Authorizer in use, which may be
null . |
Principal[] |
getRoles(WikiSession session)
Returns an array of Principal objects that represents the roles that the user associated with a WikiSession possesses. |
protected boolean |
hasRoleOrPrincipal(WikiSession session,
Principal principal)
Determines if the Subject associated with a supplied WikiSession contains a desired user Principal or built-in Role principal, OR is a member a Group or external Role. |
void |
initialize(WikiEngine engine,
Properties properties)
Initializes AuthorizationManager with an engine and set of properties. |
boolean |
isUserInRole(WikiSession session,
Principal principal)
Wrapper method that determines if the Subject associated with a supplied WikiSession contains a desired Role or GroupPrincipal. |
void |
removeWikiEventListener(WikiEventListener listener)
Un-registers a WikiEventListener with this instance. |
Principal |
resolvePrincipal(String name)
Given a supplied string representing a Principal's name from an Acl, this method resolves the correct type of Principal (role, group, or user). |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Field Detail |
---|
public static final String DEFAULT_AUTHORIZER
WebContainerAuthorizer
public static final String PROP_AUTHORIZER
Authorizer
.
Constructor Detail |
---|
public AuthorizationManager()
Method Detail |
---|
public final void addWikiEventListener(WikiEventListener listener)
listener
- the event listenerpublic final boolean checkPermission(WikiSession session, Permission permission)
true
or false
, depending on
whether a Permission is allowed for the Subject associated with
a supplied WikiSession. The access control algorithm works this way:
Acl
for the page is obtainedWikiSession
is obtainedUnresolvedPrincipal
s (see below).
Then iterate through the Subject's Principal set and determine whether
the user (Subject) posesses any one of these specified Roles or
Principals. The matching process delegates to
hasRoleOrPrincipal(WikiSession, Principal)
.
Note that when iterating through the Acl's list of authorized Principals,
it is possible that one or more of the Acl's Principal entries are of
type UnresolvedPrincipal
. This means that the last time
the ACL was read, the Principal (user, built-in Role, authorizer Role, or
wiki Group) could not be resolved: the Role was not valid, the user
wasn't found in the UserDatabase, or the Group wasn't known to (e.g.,
cached) in the GroupManager. If an UnresolvedPrincipal
is
encountered, this method will attempt to resolve it first before
checking to see if the Subject possesses this principal, by calling
resolvePrincipal(String)
. If the (re-)resolution does not
succeed, the access check for the principal will fail by definition (the
Subject should never contain UnresolvedPrincipals).
If security not set to JAAS, will return true.
session
- the current wiki sessionpermission
- the Permission being checked
hasRoleOrPrincipal(WikiSession, Principal)
public final Principal[] getRoles(WikiSession session)
getName
method.
Note that this method does not consult the external
Authorizer or GroupManager; it relies on the Principals that
have been injected into the user's Subject at login time, or
after group creation/modification/deletion.
session
- the wiki session
public final boolean isUserInRole(WikiSession session, Principal principal)
Group
,
it is converted to an equivalent GroupPrincipal first.
For all other cases, this method returns false
.
Note that this method does not consult the external
Authorizer or GroupManager; it relies on the Principals that
have been injected into the user's Subject at login time, or
after group creation/modification/deletion.
session
- the current wiki session, which must be non-null. If null,
the result of this method always returns false
principal
- the Principal (role or group principal) to look
for, which must be non-null. If null, the result of this
method always returns false
true
if the Subject supplied with the WikiContext
posesses the Role or GroupPrincipal,
false
otherwiseprotected final boolean hasRoleOrPrincipal(WikiSession session, Principal principal)
Determines if the Subject associated with a supplied WikiSession contains a desired user Principal or built-in Role principal, OR is a member a Group or external Role. The rules are as follows:
isUserInRole(WikiSession, Principal)
. If the
result is true
, we're done. If the result is
negative and the WikiSession is not authenticated,
always return false
. We do this to prevent privilege
escalation.Note: as implied by the first rule above, this method
will always return false
when the
user isn't authenticated, and
the principal/role being
queried isn't a Role or GroupPrincipal. This is
to prevent privilege escalation by non-authenticated users.
Thus, to gain access to pages that name a specific user, that user
is required to log in. Ditto for groups he or she
belongs to. The exception is for ACLs that contain built-in roles;
e.g., "allow Asserted users to view" is allowed.
A consequence of this rule is that ACLs that specify
ALLOW Guest
will not work for
anonymous/asserted users (because Guest
is
a Principal, not a built-in Role). ACLs should specify
ALLOW Anonymous
instead.
session
- the current wiki session, which must be non-null. If null,
the result of this method always returns false
principal
- the Principal (role, group, or user principal) to look
for, which must be non-null. If null, the result of this
method always returns false
true
if the Subject supplied with the WikiContext
posesses the Role, GroupPrincipal or desired
user Principal, false
otherwisepublic final void initialize(WikiEngine engine, Properties properties) throws WikiException
WikiException
protected final void fireEvent(WikiSecurityEvent event)
event
- the eventprotected final Authorizer getAuthorizer()
Authorizer
in use, which may be
null
.
protected final boolean checkStaticPermission(Subject subject, Permission permission)
codeBase
is effectively this class,
not that of the caller. Therefore, this method will work best when what
matters in the policy is who makes the permission check, not
what the caller's code source is. Internally, this method works by
excuting Subject.doAsPrivileged
with a privileged action
that simply calls AccessController.checkPermission(Permission)
.
subject
- the Subject whose permission status is being queriedpermission
- the Permission the Subject must possess
true
if the Subject posesses the permission,
false
otherwisepublic final void removeWikiEventListener(WikiEventListener listener)
listener
- the event listenerpublic final Principal resolvePrincipal(String name)
Given a supplied string representing a Principal's name from an Acl, this method resolves the correct type of Principal (role, group, or user). This method is guaranteed to always return a Principal. The algorithm is straightforward:
Role
names,
return that built-in RoleAuthorizer
, return that RoleGroupManager
, return that GroupUserDatabase
, find the
first user who matches the supplied name by calling
UserDatabase.find(String)
.UnresolvedPrincipal
name
- the name of the Principal to resolve
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |