inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-31 17:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

RM-2123 Use runAsAuthentication instead of actual authentication.

Browse Source 
Check that the user the command is run as has clearance to view the
classification levels, rather than the user that initiated the command.

+review RM-58

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/HEAD@104729 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Tom Page
2015-05-22 08:43:12 +00:00
parent 412d27ad9e
commit eafaad25ea
4 changed files with 37 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/classification/SecurityClearanceServiceImpl.java
View File

@@ -73,7 +73,7 @@ public class SecurityClearanceServiceImpl extends ServiceBaseImpl implements Sec
return new SecurityClearance(null, clearanceManager.getMostSecureLevel());
}
final String currentUser = authenticationUtil.getFullyAuthenticatedUser();
final String currentUser = authenticationUtil.getRunAsUser();
ParameterCheck.mandatoryString("currentUser", currentUser);
return getUserSecurityClearance(currentUser);

31
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/util/AuthenticationUtil.java
View File

@@ -18,13 +18,14 @@
*/
package org.alfresco.module.org_alfresco_module_rm.util;
import org.alfresco.repo.security.authentication.AuthenticationException;
import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
/**
* Helper bean to allow injection of AuthenticationUtil methods.
* <p>
* Useful when testing using mocks.
*
*
* @author Roy Wetherall
* @since 2.3
*/
@@ -53,46 +54,58 @@ public class AuthenticationUtil
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(runAsWork, uid);
}
/**
* Helper method that gets the fully authenticated user.
* <p>
* Useful when testing using mocks.
*
*
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#getFullyAuthenticatedUser()
*/
public String getFullyAuthenticatedUser()
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.getFullyAuthenticatedUser();
}
/**
* Helper method that gets the admin user name.
* <p>
* Useful when testing using mocks.
*
*
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#getAdminUserName()
*/
public String getAdminUserName()
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.getAdminUserName();
}
/**
* Helper method that gets the system user name.
*
*
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#getSystemUserName()
*/
public String getSystemUserName()
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.getSystemUserName();
}
/**
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#isRunAsUserTheSystemUser()
*/
public boolean isRunAsUserTheSystemUser()
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.isRunAsUserTheSystemUser();
return org.alfresco.repo.security.authentication.AuthenticationUtil.isRunAsUserTheSystemUser();
}
/**
* Helper method to get the user that is currently in effect for purposes of authentication. This includes any
* overlays introduced by {@link #runAs}.
*
* @return Returns the name of the user
* @throws AuthenticationException
*/
public String getRunAsUser() throws AuthenticationException
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.getRunAsUser();
}
}

12
rm-server/unit-test/java/org/alfresco/module/org_alfresco_module_rm/classification/SecurityClearanceServiceImplUnitTest.java
View File

@@ -118,7 +118,7 @@ public class SecurityClearanceServiceImplUnitTest
// Create the authorised user.
String authorisedUserName = "authorisedUser";
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn(authorisedUserName);
when(mockAuthenticationUtil.getRunAsUser()).thenReturn(authorisedUserName);
NodeRef authorisedPersonNode = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, authorisedUserName);
PersonInfo authorisedPersonInfo = new PersonInfo(authorisedPersonNode, authorisedUserName, "first", "last");
when(mockPersonService.getPerson(authorisedUserName, false)).thenReturn(authorisedPersonNode);
@@ -167,7 +167,7 @@ public class SecurityClearanceServiceImplUnitTest
// Create the user attempting to use the API with "Confidential" clearance.
String userName = "unauthorisedUser";
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn(userName);
when(mockAuthenticationUtil.getRunAsUser()).thenReturn(userName);
NodeRef personNode = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, userName);
PersonInfo personInfo = new PersonInfo(personNode, userName, "first", "last");
when(mockPersonService.getPerson(userName, false)).thenReturn(personNode);
@@ -199,7 +199,7 @@ public class SecurityClearanceServiceImplUnitTest
when(mockClassificationLevelManager.findLevelById("2")).thenReturn(secret);
createMockPerson("Cleared", "Cleared", "Cleared", "2");
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn("Uncleared");
when(mockAuthenticationUtil.getRunAsUser()).thenReturn("Cleared");
when(mockClearanceLevelManager.findLevelByClassificationLevelId("2")).thenReturn(new ClearanceLevel(secret, "Secret"));
// The authenticated user's clearance level is high enough to view the classification.
@@ -220,7 +220,7 @@ public class SecurityClearanceServiceImplUnitTest
when(mockClassificationLevelManager.findLevelById("2")).thenReturn(secret);
createMockPerson("Uncleared", "Uncleared", "Uncleared", ClassificationLevelManager.UNCLASSIFIED_ID);
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn("Uncleared");
when(mockAuthenticationUtil.getRunAsUser()).thenReturn("Uncleared");
when(mockClearanceLevelManager.findLevelByClassificationLevelId(ClassificationLevelManager.UNCLASSIFIED_ID)).thenReturn(ClearanceLevelManager.NO_CLEARANCE);
// The authenticated user's clearance level not high enough.
@@ -238,8 +238,8 @@ public class SecurityClearanceServiceImplUnitTest
@Test public void isCurrentUserClearedForClassification_classificationNotFound()
{
ClassificationLevel topSecret = new ClassificationLevel("1", "TopSecret");
createMockPerson("Uncleared", "Uncleared", "Uncleared", "1");
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn("Uncleared");
createMockPerson("Cleared", "Cleared", "Cleared", "1");
when(mockAuthenticationUtil.getRunAsUser()).thenReturn("Cleared");
when(mockClearanceLevelManager.findLevelByClassificationLevelId("1")).thenReturn(new ClearanceLevel(topSecret, "TopSecret"));
// Set up the made up classification.
String madeUpId = "Made Up Id";

15
rm-server/unit-test/java/org/alfresco/module/org_alfresco_module_rm/test/util/MockAuthenticationUtilHelper.java
View File

@@ -22,8 +22,8 @@ package org.alfresco.module.org_alfresco_module_rm.test.util;
import static org.mockito.Matchers.any;
import static org.mockito.Matchers.anyString;
import static org.mockito.Mockito.doAnswer;
import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.reset;
import static org.mockito.Mockito.when;
import org.alfresco.module.org_alfresco_module_rm.util.AuthenticationUtil;
import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
@@ -32,7 +32,7 @@ import org.mockito.stubbing.Answer;
/**
* A helper to initialise a mock {@link AuthenticationUtil}.
*
*
* @author tpage
*/
public class MockAuthenticationUtilHelper
@@ -41,7 +41,7 @@ public class MockAuthenticationUtilHelper
* Set up a Mockito mock <code>AuthenticationUtil</code> so that it executes all methods assuming the user has
* permissions. If the mock is asked for details about the user then it assumes the currently authenticated user is
* "admin".
*
*
* @param mockAuthenticationUtil The mock to initialise.
*/
public static void setup(AuthenticationUtil mockAuthenticationUtil)
@@ -52,7 +52,7 @@ public class MockAuthenticationUtilHelper
/**
* Set up a Mockito mock <code>AuthenticationUtil</code> so that it executes all methods assuming the user has
* permissions.
*
*
* @param mockAuthenticationUtil The mock to initialise.
* @param fullyAuthenticatedUser The name of the user that last authenticated.
*/
@@ -87,8 +87,9 @@ public class MockAuthenticationUtilHelper
}).when(mockAuthenticationUtil).<Object> runAs(any(RunAsWork.class), anyString());
doReturn("admin").when(mockAuthenticationUtil).getAdminUserName();
doReturn(fullyAuthenticatedUser).when(mockAuthenticationUtil).getFullyAuthenticatedUser();
doReturn("system").when(mockAuthenticationUtil).getSystemUserName();
when(mockAuthenticationUtil.getAdminUserName()).thenReturn("admin");
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn(fullyAuthenticatedUser);
when(mockAuthenticationUtil.getRunAsUser()).thenReturn(fullyAuthenticatedUser);
when(mockAuthenticationUtil.getSystemUserName()).thenReturn("system");
}
}