apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

APIChecker: Make interface generic, pass user and not just role

Browse Source 
Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
This commit is contained in:
Rohit Yadav 2013-01-14 15:06:46 -08:00
parent 9139949d96
commit 896e505da6
3 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
api/src/org/apache/cloudstack/acl/APIChecker.java
View File

@ -17,11 +17,11 @@
package org.apache.cloudstack.acl; package org.apache.cloudstack.acl;
import com.cloud.exception.PermissionDeniedException; import com.cloud.exception.PermissionDeniedException;
import org.apache.cloudstack.acl.RoleType; import com.cloud.user.User;
import com.cloud.utils.component.Adapter; import com.cloud.utils.component.Adapter;
// APIChecker checks the ownership and access control to API requests // APIChecker checks the ownership and access control to API requests
public interface APIChecker extends Adapter { public interface APIChecker extends Adapter {
// Interface for checking access for a role using apiname // Interface for checking access for a role using apiname
boolean checkAccess(RoleType roleType, String apiCommandName) throws PermissionDeniedException; boolean checkAccess(User user, String apiCommandName) throws PermissionDeniedException;
} }

12
plugins/acl/static-role-based/src/org/apache/cloudstack/acl/StaticRoleBasedAPIAccessChecker.java
View File

@ -18,6 +18,9 @@ package org.apache.cloudstack.acl;
import com.cloud.exception.PermissionDeniedException; import com.cloud.exception.PermissionDeniedException;
import com.cloud.server.ManagementServer; import com.cloud.server.ManagementServer;
import com.cloud.user.Account;
import com.cloud.user.AccountService;
import com.cloud.user.User;
import com.cloud.utils.component.AdapterBase; import com.cloud.utils.component.AdapterBase;
import com.cloud.utils.component.ComponentLocator; import com.cloud.utils.component.ComponentLocator;
import com.cloud.utils.component.PluggableService; import com.cloud.utils.component.PluggableService;
@ -42,6 +45,8 @@ public class StaticRoleBasedAPIAccessChecker extends AdapterBase implements APIC
private static Map<RoleType, Set<String>> s_roleBasedApisMap = private static Map<RoleType, Set<String>> s_roleBasedApisMap =
new HashMap<RoleType, Set<String>>(); new HashMap<RoleType, Set<String>>();
private static AccountService s_accountService;
protected StaticRoleBasedAPIAccessChecker() { protected StaticRoleBasedAPIAccessChecker() {
super(); super();
for (RoleType roleType: RoleType.values()) for (RoleType roleType: RoleType.values())
@ -49,8 +54,10 @@ public class StaticRoleBasedAPIAccessChecker extends AdapterBase implements APIC
} }
@Override @Override
public boolean checkAccess(RoleType roleType, String commandName) public boolean checkAccess(User user, String commandName)
throws PermissionDeniedException { throws PermissionDeniedException {
Account account = s_accountService.getAccount(user.getAccountId());
RoleType roleType = s_accountService.getRoleType(account);
boolean isAllowed = s_roleBasedApisMap.get(roleType).contains(commandName); boolean isAllowed = s_roleBasedApisMap.get(roleType).contains(commandName);
if (!isAllowed) { if (!isAllowed) {
throw new PermissionDeniedException("The API does not exist or is blacklisted. Role type=" + roleType.toString() + " is not allowed to request the api: " + commandName); throw new PermissionDeniedException("The API does not exist or is blacklisted. Role type=" + roleType.toString() + " is not allowed to request the api: " + commandName);
@ -64,6 +71,9 @@ public class StaticRoleBasedAPIAccessChecker extends AdapterBase implements APIC
// Read command properties files to build the static map per role. // Read command properties files to build the static map per role.
ComponentLocator locator = ComponentLocator.getLocator(ManagementServer.Name); ComponentLocator locator = ComponentLocator.getLocator(ManagementServer.Name);
s_accountService = locator.getManager(AccountService.class);
List<PluggableService> services = locator.getAllPluggableServices(); List<PluggableService> services = locator.getAllPluggableServices();
services.add((PluggableService) ComponentLocator.getComponent(ManagementServer.Name)); services.add((PluggableService) ComponentLocator.getComponent(ManagementServer.Name));

4
server/src/com/cloud/api/ApiServer.java
View File

@ -785,11 +785,9 @@ public class ApiServer implements HttpRequestHandler {
throw new PermissionDeniedException("User is null for role based API access check for command" + commandName); throw new PermissionDeniedException("User is null for role based API access check for command" + commandName);
} }
Account account = _accountMgr.getAccount(user.getAccountId());
RoleType roleType = _accountMgr.getRoleType(account);
for (APIChecker apiChecker : _apiAccessCheckers) { for (APIChecker apiChecker : _apiAccessCheckers) {
// Fail the checking if any checker fails to verify // Fail the checking if any checker fails to verify
if (!apiChecker.checkAccess(roleType, commandName)) if (!apiChecker.checkAccess(user, commandName))
return false; return false;
} }
return true; return true;