cloudstack/server/test/com/cloud/user/MockAccountManagerImpl.java
Rohit Yadav 4347776ac6 CLOUDSTACK-8562: DB-Backed Dynamic Role Based API Access Checker
This feature allows root administrators to define new roles and associate API
permissions to them.

A limited form of role-based access control for the CloudStack management server
API is provided through a properties file, commands.properties, embedded in the
WAR distribution. Therefore, customizing API permissions requires unpacking the
distribution and modifying this file consistently on all servers. The old system
also does not permit the specification of additional roles.

FS:
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Dynamic+Role+Based+API+Access+Checker+for+CloudStack

DB-Backed Dynamic Role Based API Access Checker for CloudStack brings following
changes, features and use-cases:
- Moves the API access definitions from commands.properties to the mgmt server DB
- Allows defining custom roles (such as a read-only ROOT admin) beyond the
  current set of four (4) roles
- All roles will resolve to one of the four known roles types (Admin, Resource
  Admin, Domain Admin and User) which maintains this association by requiring
  all new defined roles to specify a role type.
- Allows changes to roles and API permissions per role at runtime including additions or
  removal of roles and/or modifications of permissions, without the need
  of restarting management server(s)

Upgrade/installation notes:
- The feature will be enabled by default for new installations, existing
  deployments will continue to use the older static role based api access checker
  with an option to enable this feature
- During fresh installation or upgrade, the upgrade paths will add four default
  roles based on the four default role types
- For ease of migration, at the time of upgrade commands.properties will be used
  to add existing set of permissions to the default roles. cloud.account
  will have a new role_id column which will be populated based on default roles
  as well

Dynamic-roles migration tool: scripts/util/migrate-dynamicroles.py
- Allows admins to migrate to the dynamic role based checker at a future date
- Performs a harder one-way migrate and update
- Migrates rules from existing commands.properties file into db and deprecates it
- Enables an internal hidden switch to enable dynamic role based checker feature

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2016-05-11 09:45:19 +05:30

406 lines
12 KiB
Java

// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements. See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership. The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License. You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package com.cloud.user;
import java.util.List;
import java.util.Map;
import java.net.InetAddress;
import javax.naming.ConfigurationException;
import org.springframework.stereotype.Component;
import org.apache.cloudstack.acl.ControlledEntity;
import org.apache.cloudstack.acl.RoleType;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.command.admin.account.UpdateAccountCmd;
import org.apache.cloudstack.api.command.admin.user.DeleteUserCmd;
import org.apache.cloudstack.api.command.admin.user.RegisterCmd;
import org.apache.cloudstack.api.command.admin.user.UpdateUserCmd;
import com.cloud.api.query.vo.ControlledViewEntity;
import com.cloud.domain.Domain;
import com.cloud.exception.ConcurrentOperationException;
import com.cloud.exception.PermissionDeniedException;
import com.cloud.exception.ResourceUnavailableException;
import com.cloud.offering.DiskOffering;
import com.cloud.offering.ServiceOffering;
import com.cloud.projects.Project.ListProjectResourcesCriteria;
import com.cloud.utils.Pair;
import com.cloud.utils.Ternary;
import com.cloud.utils.component.Manager;
import com.cloud.utils.component.ManagerBase;
import com.cloud.utils.db.SearchBuilder;
import com.cloud.utils.db.SearchCriteria;
@Component
public class MockAccountManagerImpl extends ManagerBase implements Manager, AccountManager {
@Override
public boolean deleteUserAccount(long accountId) {
// TODO Auto-generated method stub
return false;
}
@Override
public UserAccount disableUser(long userId) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount enableUser(long userId) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount lockUser(long userId) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount updateUser(UpdateUserCmd cmd) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account disableAccount(String accountName, Long domainId, Long accountId) throws ConcurrentOperationException, ResourceUnavailableException {
// TODO Auto-generated method stub
return null;
}
@Override
public Account enableAccount(String accountName, Long domainId, Long accountId) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account lockAccount(String accountName, Long domainId, Long accountId) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account updateAccount(UpdateAccountCmd cmd) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account getSystemAccount() {
return new AccountVO();
}
@Override
public User getSystemUser() {
return new UserVO();
}
@Override
public boolean deleteUser(DeleteUserCmd deleteUserCmd) {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isAdmin(Long accountId) {
// TODO Auto-generated method stub
return false;
}
@Override
public Account finalizeOwner(Account caller, String accountName, Long domainId, Long projectId) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account getActiveAccountByName(String accountName, Long domainId) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount getActiveUserAccount(String username, Long domainId) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount updateUser(Long userId, String firstName, String lastName, String email, String userName, String password, String apiKey, String secretKey,
String timeZone) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account getActiveAccountById(long accountId) {
// TODO Auto-generated method stub
return null;
}
@Override
public Account getAccount(long accountId) {
// TODO Auto-generated method stub
return null;
}
@Override
public User getActiveUser(long userId) {
// TODO Auto-generated method stub
return null;
}
@Override
public User getUserIncludingRemoved(long userId) {
// TODO Auto-generated method stub
return null;
}
@Override
public boolean isRootAdmin(Long accountId) {
// TODO Auto-generated method stub
return false;
}
@Override
public User getActiveUserByRegistrationToken(String registrationToken) {
// TODO Auto-generated method stub
return null;
}
@Override
public void markUserRegistered(long userId) {
// TODO Auto-generated method stub
}
@Override
public boolean disableAccount(long accountId) throws ConcurrentOperationException, ResourceUnavailableException {
// TODO Auto-generated method stub
return false;
}
@Override
public void checkAccess(Account account, Domain domain) throws PermissionDeniedException {
// TODO Auto-generated method stub
}
@Override
public void checkAccess(Account account, ServiceOffering so) throws PermissionDeniedException {
// TODO Auto-generated method stub
}
@Override
public void checkAccess(Account account, DiskOffering dof) throws PermissionDeniedException {
// TODO Auto-generated method stub
}
@Override
public Long checkAccessAndSpecifyAuthority(Account caller, Long zoneId) {
// TODO Auto-generated method stub
return null;
}
@Override
public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
return true;
}
@Override
public boolean start() {
return true;
}
@Override
public boolean stop() {
// TODO Auto-generated method stub
return false;
}
@Override
public String getName() {
// TODO Auto-generated method stub
return null;
}
@Override
public void checkAccess(Account account, AccessType accessType, boolean sameOwner, ControlledEntity... entities) throws PermissionDeniedException {
// TODO Auto-generated method stub
}
@Override
public UserAccount getUserAccountById(Long userId) {
// TODO Auto-generated method stub
return null;
}
@Override
public void logoutUser(long userId) {
// TODO Auto-generated method stub
}
@Override
public UserAccount authenticateUser(String username, String password, Long domainId, InetAddress loginIpAddress, Map<String, Object[]> requestParameters) {
return null;
}
@Override
public Pair<User, Account> findUserByApiKey(String apiKey) {
return null;
}
@Override
public String[] createApiKeyAndSecretKey(RegisterCmd cmd) {
return null;
}
@Override
public String[] createApiKeyAndSecretKey(final long userId) {
return null;
}
@Override
public boolean enableAccount(long accountId) {
// TODO Auto-generated method stub
return false;
}
@Override
public void buildACLSearchBuilder(SearchBuilder<? extends ControlledEntity> sb, Long domainId, boolean isRecursive, List<Long> permittedAccounts,
ListProjectResourcesCriteria listProjectResourcesCriteria) {
// TODO Auto-generated method stub
}
@Override
public void buildACLSearchCriteria(SearchCriteria<? extends ControlledEntity> sc, Long domainId, boolean isRecursive, List<Long> permittedAccounts,
ListProjectResourcesCriteria listProjectResourcesCriteria) {
// TODO Auto-generated method stub
}
@Override
public void buildACLSearchParameters(Account caller, Long id, String accountName, Long projectId, List<Long> permittedAccounts, Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject, boolean listAll, boolean forProjectInvitation) {
// TODO Auto-generated method stub
}
@Override
public void buildACLViewSearchBuilder(SearchBuilder<? extends ControlledViewEntity> sb, Long domainId,
boolean isRecursive, List<Long> permittedAccounts, ListProjectResourcesCriteria listProjectResourcesCriteria) {
// TODO Auto-generated method stub
}
@Override
public void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledViewEntity> sc, Long domainId,
boolean isRecursive, List<Long> permittedAccounts, ListProjectResourcesCriteria listProjectResourcesCriteria) {
// TODO Auto-generated method stub
}
/* (non-Javadoc)
* @see com.cloud.user.AccountService#getUserByApiKey(java.lang.String)
*/
@Override
public UserAccount getUserByApiKey(String apiKey) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount createUserAccount(String userName, String password, String firstName, String lastName, String email, String timezone, String accountName,
short accountType, Long roleId, Long domainId, String networkDomain, Map<String, String> details, String accountUUID, String userUUID) {
// TODO Auto-generated method stub
return null;
}
@Override
public UserAccount createUserAccount(String userName, String password, String firstName, String lastName, String email, String timezone, String accountName, short accountType, Long roleId,
Long domainId, String networkDomain, Map<String, String> details, String accountUUID, String userUUID, User.Source source) {
// TODO Auto-generated method stub
return null;
}
@Override
public User createUser(String userName, String password, String firstName,
String lastName, String email, String timeZone, String accountName,
Long domainId, String userUUID) {
// TODO Auto-generated method stub
return null;
}
@Override public User createUser(String userName, String password, String firstName, String lastName, String email, String timeZone, String accountName, Long domainId,
String userUUID, User.Source source) {
// TODO Auto-generated method stub
return null;
}
@Override
public RoleType getRoleType(Account account) {
return null;
}
@Override
public boolean deleteAccount(AccountVO account, long callerUserId, Account caller) {
// TODO Auto-generated method stub
return false;
}
@Override
public Account createAccount(String accountName, short accountType, Long roleId, Long domainId, String networkDomain, Map<String, String> details, String uuid) {
// TODO Auto-generated method stub
return null;
}
@Override
public boolean isDomainAdmin(Long accountId) {
// TODO Auto-generated method stub
return false;
}
@Override
public boolean isNormalUser(long accountId) {
// TODO Auto-generated method stub
return false;
}
@Override
public List<String> listAclGroupsByAccount(Long accountId) {
// TODO Auto-generated method stub
return null;
}
@Override
public void checkAccess(Account account, AccessType accessType, boolean sameOwner, String apiName,
ControlledEntity... entities) throws PermissionDeniedException {
// TODO Auto-generated method stub
}
@Override
public Long finalyzeAccountId(String accountName, Long domainId, Long projectId, boolean enabledOnly) {
// TODO Auto-generated method stub
return null;
}
}