inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-31 17:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

RM-2123 Use runAsAuthentication instead of actual authentication.

Browse Source 
Check that the user the command is run as has clearance to view the
classification levels, rather than the user that initiated the command.

+review RM-58

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/HEAD@104729 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Tom Page
2015-05-22 08:43:12 +00:00
parent 412d27ad9e
commit eafaad25ea
4 changed files with 37 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/classification/SecurityClearanceServiceImpl.java
View File

@@ -73,7 +73,7 @@ public class SecurityClearanceServiceImpl extends ServiceBaseImpl implements Sec
return new SecurityClearance(null, clearanceManager.getMostSecureLevel()); return new SecurityClearance(null, clearanceManager.getMostSecureLevel());
} }
final String currentUser = authenticationUtil.getFullyAuthenticatedUser(); final String currentUser = authenticationUtil.getRunAsUser();
ParameterCheck.mandatoryString("currentUser", currentUser); ParameterCheck.mandatoryString("currentUser", currentUser);
return getUserSecurityClearance(currentUser); return getUserSecurityClearance(currentUser);

31
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/util/AuthenticationUtil.java
View File

@@ -18,13 +18,14 @@
*/ */
package org.alfresco.module.org_alfresco_module_rm.util; package org.alfresco.module.org_alfresco_module_rm.util;
import org.alfresco.repo.security.authentication.AuthenticationException;
import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork; import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
/** /**
* Helper bean to allow injection of AuthenticationUtil methods. * Helper bean to allow injection of AuthenticationUtil methods.
* <p> * <p>
* Useful when testing using mocks. * Useful when testing using mocks.
* *
* @author Roy Wetherall * @author Roy Wetherall
* @since 2.3 * @since 2.3
*/ */
@@ -53,46 +54,58 @@ public class AuthenticationUtil
{ {
return org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(runAsWork, uid); return org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(runAsWork, uid);
} }
/** /**
* Helper method that gets the fully authenticated user. * Helper method that gets the fully authenticated user.
* <p> * <p>
* Useful when testing using mocks. * Useful when testing using mocks.
* *
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#getFullyAuthenticatedUser() * @see org.alfresco.repo.security.authentication.AuthenticationUtil#getFullyAuthenticatedUser()
*/ */
public String getFullyAuthenticatedUser() public String getFullyAuthenticatedUser()
{ {
return org.alfresco.repo.security.authentication.AuthenticationUtil.getFullyAuthenticatedUser(); return org.alfresco.repo.security.authentication.AuthenticationUtil.getFullyAuthenticatedUser();
} }
/** /**
* Helper method that gets the admin user name. * Helper method that gets the admin user name.
* <p> * <p>
* Useful when testing using mocks. * Useful when testing using mocks.
* *
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#getAdminUserName() * @see org.alfresco.repo.security.authentication.AuthenticationUtil#getAdminUserName()
*/ */
public String getAdminUserName() public String getAdminUserName()
{ {
return org.alfresco.repo.security.authentication.AuthenticationUtil.getAdminUserName(); return org.alfresco.repo.security.authentication.AuthenticationUtil.getAdminUserName();
} }
/** /**
* Helper method that gets the system user name. * Helper method that gets the system user name.
* *
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#getSystemUserName() * @see org.alfresco.repo.security.authentication.AuthenticationUtil#getSystemUserName()
*/ */
public String getSystemUserName() public String getSystemUserName()
{ {
return org.alfresco.repo.security.authentication.AuthenticationUtil.getSystemUserName(); return org.alfresco.repo.security.authentication.AuthenticationUtil.getSystemUserName();
} }
/** /**
* @see org.alfresco.repo.security.authentication.AuthenticationUtil#isRunAsUserTheSystemUser() * @see org.alfresco.repo.security.authentication.AuthenticationUtil#isRunAsUserTheSystemUser()
*/ */
public boolean isRunAsUserTheSystemUser() public boolean isRunAsUserTheSystemUser()
{ {
return org.alfresco.repo.security.authentication.AuthenticationUtil.isRunAsUserTheSystemUser(); return org.alfresco.repo.security.authentication.AuthenticationUtil.isRunAsUserTheSystemUser();
}
/**
* Helper method to get the user that is currently in effect for purposes of authentication. This includes any
* overlays introduced by {@link #runAs}.
*
* @return Returns the name of the user
* @throws AuthenticationException
*/
public String getRunAsUser() throws AuthenticationException
{
return org.alfresco.repo.security.authentication.AuthenticationUtil.getRunAsUser();
} }
} }

12
rm-server/unit-test/java/org/alfresco/module/org_alfresco_module_rm/classification/SecurityClearanceServiceImplUnitTest.java
View File

@@ -118,7 +118,7 @@ public class SecurityClearanceServiceImplUnitTest
// Create the authorised user. // Create the authorised user.
String authorisedUserName = "authorisedUser"; String authorisedUserName = "authorisedUser";
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn(authorisedUserName); when(mockAuthenticationUtil.getRunAsUser()).thenReturn(authorisedUserName);
NodeRef authorisedPersonNode = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, authorisedUserName); NodeRef authorisedPersonNode = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, authorisedUserName);
PersonInfo authorisedPersonInfo = new PersonInfo(authorisedPersonNode, authorisedUserName, "first", "last"); PersonInfo authorisedPersonInfo = new PersonInfo(authorisedPersonNode, authorisedUserName, "first", "last");
when(mockPersonService.getPerson(authorisedUserName, false)).thenReturn(authorisedPersonNode); when(mockPersonService.getPerson(authorisedUserName, false)).thenReturn(authorisedPersonNode);
@@ -167,7 +167,7 @@ public class SecurityClearanceServiceImplUnitTest
// Create the user attempting to use the API with "Confidential" clearance. // Create the user attempting to use the API with "Confidential" clearance.
String userName = "unauthorisedUser"; String userName = "unauthorisedUser";
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn(userName); when(mockAuthenticationUtil.getRunAsUser()).thenReturn(userName);
NodeRef personNode = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, userName); NodeRef personNode = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, userName);
PersonInfo personInfo = new PersonInfo(personNode, userName, "first", "last"); PersonInfo personInfo = new PersonInfo(personNode, userName, "first", "last");
when(mockPersonService.getPerson(userName, false)).thenReturn(personNode); when(mockPersonService.getPerson(userName, false)).thenReturn(personNode);
@@ -199,7 +199,7 @@ public class SecurityClearanceServiceImplUnitTest
when(mockClassificationLevelManager.findLevelById("2")).thenReturn(secret); when(mockClassificationLevelManager.findLevelById("2")).thenReturn(secret);
createMockPerson("Cleared", "Cleared", "Cleared", "2"); createMockPerson("Cleared", "Cleared", "Cleared", "2");
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn("Uncleared"); when(mockAuthenticationUtil.getRunAsUser()).thenReturn("Cleared");
when(mockClearanceLevelManager.findLevelByClassificationLevelId("2")).thenReturn(new ClearanceLevel(secret, "Secret")); when(mockClearanceLevelManager.findLevelByClassificationLevelId("2")).thenReturn(new ClearanceLevel(secret, "Secret"));
// The authenticated user's clearance level is high enough to view the classification. // The authenticated user's clearance level is high enough to view the classification.
@@ -220,7 +220,7 @@ public class SecurityClearanceServiceImplUnitTest
when(mockClassificationLevelManager.findLevelById("2")).thenReturn(secret); when(mockClassificationLevelManager.findLevelById("2")).thenReturn(secret);
createMockPerson("Uncleared", "Uncleared", "Uncleared", ClassificationLevelManager.UNCLASSIFIED_ID); createMockPerson("Uncleared", "Uncleared", "Uncleared", ClassificationLevelManager.UNCLASSIFIED_ID);
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn("Uncleared"); when(mockAuthenticationUtil.getRunAsUser()).thenReturn("Uncleared");
when(mockClearanceLevelManager.findLevelByClassificationLevelId(ClassificationLevelManager.UNCLASSIFIED_ID)).thenReturn(ClearanceLevelManager.NO_CLEARANCE); when(mockClearanceLevelManager.findLevelByClassificationLevelId(ClassificationLevelManager.UNCLASSIFIED_ID)).thenReturn(ClearanceLevelManager.NO_CLEARANCE);
// The authenticated user's clearance level not high enough. // The authenticated user's clearance level not high enough.
@@ -238,8 +238,8 @@ public class SecurityClearanceServiceImplUnitTest
@Test public void isCurrentUserClearedForClassification_classificationNotFound() @Test public void isCurrentUserClearedForClassification_classificationNotFound()
{ {
ClassificationLevel topSecret = new ClassificationLevel("1", "TopSecret"); ClassificationLevel topSecret = new ClassificationLevel("1", "TopSecret");
createMockPerson("Uncleared", "Uncleared", "Uncleared", "1"); createMockPerson("Cleared", "Cleared", "Cleared", "1");
when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn("Uncleared"); when(mockAuthenticationUtil.getRunAsUser()).thenReturn("Cleared");
when(mockClearanceLevelManager.findLevelByClassificationLevelId("1")).thenReturn(new ClearanceLevel(topSecret, "TopSecret")); when(mockClearanceLevelManager.findLevelByClassificationLevelId("1")).thenReturn(new ClearanceLevel(topSecret, "TopSecret"));
// Set up the made up classification. // Set up the made up classification.
String madeUpId = "Made Up Id"; String madeUpId = "Made Up Id";

15
rm-server/unit-test/java/org/alfresco/module/org_alfresco_module_rm/test/util/MockAuthenticationUtilHelper.java
View File

@@ -22,8 +22,8 @@ package org.alfresco.module.org_alfresco_module_rm.test.util;
import static org.mockito.Matchers.any; import static org.mockito.Matchers.any;
import static org.mockito.Matchers.anyString; import static org.mockito.Matchers.anyString;
import static org.mockito.Mockito.doAnswer; import static org.mockito.Mockito.doAnswer;
import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.reset; import static org.mockito.Mockito.reset;
import static org.mockito.Mockito.when;
import org.alfresco.module.org_alfresco_module_rm.util.AuthenticationUtil; import org.alfresco.module.org_alfresco_module_rm.util.AuthenticationUtil;
import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork; import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
@@ -32,7 +32,7 @@ import org.mockito.stubbing.Answer;
/** /**
* A helper to initialise a mock {@link AuthenticationUtil}. * A helper to initialise a mock {@link AuthenticationUtil}.
* *
* @author tpage * @author tpage
*/ */
public class MockAuthenticationUtilHelper public class MockAuthenticationUtilHelper
@@ -41,7 +41,7 @@ public class MockAuthenticationUtilHelper
* Set up a Mockito mock <code>AuthenticationUtil</code> so that it executes all methods assuming the user has * Set up a Mockito mock <code>AuthenticationUtil</code> so that it executes all methods assuming the user has
* permissions. If the mock is asked for details about the user then it assumes the currently authenticated user is * permissions. If the mock is asked for details about the user then it assumes the currently authenticated user is
* "admin". * "admin".
* *
* @param mockAuthenticationUtil The mock to initialise. * @param mockAuthenticationUtil The mock to initialise.
*/ */
public static void setup(AuthenticationUtil mockAuthenticationUtil) public static void setup(AuthenticationUtil mockAuthenticationUtil)
@@ -52,7 +52,7 @@ public class MockAuthenticationUtilHelper
/** /**
* Set up a Mockito mock <code>AuthenticationUtil</code> so that it executes all methods assuming the user has * Set up a Mockito mock <code>AuthenticationUtil</code> so that it executes all methods assuming the user has
* permissions. * permissions.
* *
* @param mockAuthenticationUtil The mock to initialise. * @param mockAuthenticationUtil The mock to initialise.
* @param fullyAuthenticatedUser The name of the user that last authenticated. * @param fullyAuthenticatedUser The name of the user that last authenticated.
*/ */
@@ -87,8 +87,9 @@ public class MockAuthenticationUtilHelper
}).when(mockAuthenticationUtil).<Object> runAs(any(RunAsWork.class), anyString()); }).when(mockAuthenticationUtil).<Object> runAs(any(RunAsWork.class), anyString());
doReturn("admin").when(mockAuthenticationUtil).getAdminUserName(); when(mockAuthenticationUtil.getAdminUserName()).thenReturn("admin");
doReturn(fullyAuthenticatedUser).when(mockAuthenticationUtil).getFullyAuthenticatedUser(); when(mockAuthenticationUtil.getFullyAuthenticatedUser()).thenReturn(fullyAuthenticatedUser);
doReturn("system").when(mockAuthenticationUtil).getSystemUserName(); when(mockAuthenticationUtil.getRunAsUser()).thenReturn(fullyAuthenticatedUser);
when(mockAuthenticationUtil.getSystemUserName()).thenReturn("system");
} }
} }