apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-11-02 20:02:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

RootAdmin and DomainAdmin access check via IAM

Browse Source
This commit is contained in:
Prachi Damle 2014-01-10 17:06:10 -08:00
parent 4bb31c2044
commit 6cd121fe7b
2 changed files with 26 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
server/src/com/cloud/user/AccountManagerImpl.java
View File

@ -360,17 +360,28 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
@Override
public boolean isRootAdmin(long accountId) {
AccountVO acct = _accountDao.findById(accountId);
if (acct != null && acct.getType() == Account.ACCOUNT_TYPE_ADMIN) {
return true;
for (SecurityChecker checker : _securityCheckers) {
if (checker.checkAccess(acct, null, null, "SystemCapability")) {
if (s_logger.isDebugEnabled()) {
s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
}
return true;
}
}
return false;
}
@Override
public boolean isDomainAdmin(long accountId) {
AccountVO acct = _accountDao.findById(accountId);
if (acct != null && acct.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN) {
return true;
for (SecurityChecker checker : _securityCheckers) {
if (checker.checkAccess(acct, null, null, "DomainCapability")) {
if (s_logger.isDebugEnabled()) {
s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
}
return true;
}
}
return false;
}

11
services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityAccessChecker.java
View File

@ -57,6 +57,17 @@ public class RoleBasedEntityAccessChecker extends DomainChecker implements Secur
public boolean checkAccess(Account caller, ControlledEntity entity, AccessType accessType, String action)
throws PermissionDeniedException {
if (entity == null && action != null) {
// check if caller can do this action
List<AclPolicy> policies = _iamSrv.listAclPolicies(caller.getAccountId());
boolean isAllowed = _iamSrv.isActionAllowedForPolicies(action, policies);
if (!isAllowed) {
throw new PermissionDeniedException("The action '" + action + "' not allowed for account " + caller);
}
return true;
}
String entityType = entity.getEntityType().toString();
if (accessType == null) {