Package cz.metacentrum.perun.core.impl

Class AuthzResolverImpl

java.lang.Object

cz.metacentrum.perun.core.impl.AuthzResolverImpl

All Implemented Interfaces:

AuthzResolverImplApi

public class AuthzResolverImpl
extends Object
implements AuthzResolverImplApi

Constructor Summary

Constructors

Constructor	Description
AuthzResolverImpl(DataSource perunPool)

Method Summary

Modifier and Type	Method	Description
void	addAdmin(PerunSession sess, Facility facility, Group group)	Add group of users role admin for the facility
void	addAdmin(PerunSession sess, Facility facility, User user)	Add user role admin for the facility
void	addAdmin(PerunSession sess, Group group, Group authorizedGroup)	Add group of users role admin for the group
void	addAdmin(PerunSession sess, Group group, User user)	Add user role admin for the group
void	addAdmin(PerunSession sess, Resource resource, Group group)	Add group of users role admin for the resource
void	addAdmin(PerunSession sess, Resource resource, User user)	Add user role admin for the resource
void	addAdmin(PerunSession sess, SecurityTeam securityTeam, Group group)
void	addAdmin(PerunSession sess, SecurityTeam securityTeam, User user)
void	addAdmin(PerunSession sess, User sponsoredUser, Group group)	Add group of users role admin for the sponsored user
void	addAdmin(PerunSession sess, User sponsoredUser, User user)	Add user role admin for the sponsored user
void	addResourceRole(PerunSession sess, Group group, String role, Resource resource)	Sets role to given group for given resource.
void	addResourceRole(PerunSession sess, User user, String role, Resource resource)	Sets role to given user for given resource.
void	addVoRole(PerunSession sess, String role, Vo vo, Group group)	Adds role for group in a VO.
void	addVoRole(PerunSession sess, String role, Vo vo, User user)	Adds role for user in VO.
static List<PerunPolicy>	fetchPolicyWithAllIncludedPolicies(String policyName)	Get the policy according the policy name and all its inlcuded policies (without cycle).
List<Group>	getAdminGroups(Map<String,Integer> mappingOfValues)	Get all authorizedGroups for complementary object and role.
List<User>	getAdmins(Map<String,Integer> mappingOfValues, boolean onlyDirectAdmins)	Get all valid richUser administrators (for group-based rights, status must be VALID for both Vo and group) for complementary object and role with specified attributes.
static List<PerunPolicy>	getAllPolicies()	Return all loaded perun policies.
static List<RoleManagementRules>	getAllRolesManagementRules()	Return all loaded roles management rules.
Set<Facility>	getFacilitiesWhereUserIsInRoles(User user, List<String> roles)	Get all Facilities where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.
Set<Group>	getGroupsWhereUserIsInRoles(User user, List<String> roles)	Get all Groups where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.
Set<Member>	getMembersWhereUserIsInRoles(User user, List<String> roles)	Get all Members where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.
static PerunPolicy	getPerunPolicy(String policyName)	Get PerunPolicy for the policy name from the PerunPoliciesContainer
Set<Resource>	getResourcesWhereUserIsInRoles(User user, List<String> roles)	Get all Resources where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.
Map<String,Map<String,Map<Integer,List<Group>>>>	getRoleComplementaryObjectsWithAuthorizedGroups(User user)	Returns map of role name and map of corresponding role complementary objects (perun beans) distinguished by type.
Integer	getRoleId(String role)	Fetch the identification of the role from the table roles in the database;
int	getRoleIdByName(String name)	Returns role id based on its name
static RoleManagementRules	getRoleManagementRules(String roleName)	Get RoleManagementRules for the role name from the PerunPoliciesContainer
AuthzRoles	getRoles(Group group)	Returns all group's roles.
AuthzRoles	getRoles(User user, boolean getAuthorizedGroupBasedRoles)	Returns user's direct roles, can also include roles resulting from being a VALID member of authorized groups
AuthzRoles	getRolesObtainedFromAuthorizedGroupMemberships(User user)	Returns user's roles resulting from being a VALID member of authorized groups
static Map<String,Set<ActionType>>	getRolesWhichCanWorkWithAttribute(ActionType actionType, AttributeDefinition attrDef)	Deprecated.
Set<SecurityTeam>	getSecurityTeamsWhereUserIsInRoles(User user, List<String> roles)	Get all SecurityTeams where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.
List<Integer>	getVoIdsForGroupInRole(PerunSession sess, Group group, String role)	Gets list of VOs for which the group has the role.
List<Integer>	getVoIdsForUserInRole(PerunSession sess, User user, String role)	Gets list of VOs for which the user has the role.
Set<Vo>	getVosWhereUserIsInRoles(User user, List<String> roles)	Get all Vos where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.
boolean	groupMatchesUserRolesFilter(PerunSession sess, User user, Group group, List<String> roles, List<RoleAssignmentType> types)	Check if the given group passes the user's roles filter.
void	initialize()	Load all authorization components to the database and to the PerunPoliciesContainer
boolean	isGroupInRoleForVo(PerunSession session, Group group, String role, Vo vo)	Checks whether the gruop is in role for Vo.
boolean	isUserInRoleForVo(PerunSession session, User user, String role, Vo vo)	Checks whether the user is in role for Vo.
boolean	isVoAdminOrObserver(PerunSession sess, Vo vo)	Returns true if the user in session is vo admin or vo observer of specific vo
void	loadAuthorizationComponents()	Load perun roles and policies from the configuration file perun-roles.yml.
void	makeAuthorizedGroupPerunObserver(PerunSession sess, Group authorizedGroup)	Make group Perun observer
void	makeUserCabinetAdmin(PerunSession sess, User user)	Make user Cabinet manager.
void	makeUserPerunAdmin(PerunSession sess, User user)	Make user to be perunAdmin
void	makeUserPerunObserver(PerunSession sess, User user)	Make user Perun observer
void	removeAdmin(PerunSession sess, Facility facility, Group group)	Remove group of users role admin for the facility
void	removeAdmin(PerunSession sess, Facility facility, User user)	Remove user role admin for the facility
void	removeAdmin(PerunSession sess, Group group, Group authorizedGroup)	Remove group of users role admin for the group
void	removeAdmin(PerunSession sess, Group group, User user)	Remove user role admin for the group
void	removeAdmin(PerunSession sess, Resource resource, Group group)	Remove group of users role admin for the resource
void	removeAdmin(PerunSession sess, Resource resource, User user)	Remove user role admin for the resource
void	removeAdmin(PerunSession sess, SecurityTeam securityTeam, Group group)
void	removeAdmin(PerunSession sess, SecurityTeam securityTeam, User user)
void	removeAdmin(PerunSession sess, User sponsoredUser, Group group)	Remove group of users role admin for the sponsoredUser
void	removeAdmin(PerunSession sess, User sponsoredUser, User user)	Remove user role admin for the sponsoredUser
void	removeAllAuthzForFacility(PerunSession sess, Facility facility)	Removes all authz entries for the facility
void	removeAllAuthzForGroup(PerunSession sess, Group group)	Removes all authz entries for the group
void	removeAllAuthzForResource(PerunSession sess, Resource resource)	Removes all authz entries for the resource
void	removeAllAuthzForSecurityTeam(PerunSession sess, SecurityTeam securityTeam)	Removes all authz entries for the securityTeam
void	removeAllAuthzForService(PerunSession sess, Service service)	Removes all authz entries for the service
void	removeAllAuthzForVo(PerunSession sess, Vo vo)	Removes all authz entries for the vo
void	removeAllSponsoredUserAuthz(PerunSession sess, User sponsoredUser)	Removes all authz entries for the sponsoredUser.
void	removeAllUserAuthz(PerunSession sess, User user)	Removes all authz entries for the user.
void	removeCabinetAdmin(PerunSession sess, User user)	Remove role Cabinet manager from user.
void	removePerunAdmin(PerunSession sess, User user)	Remove role perunAdmin for user.
void	removePerunObserver(PerunSession sess, User user)	Remove role Perun observer from user.
void	removePerunObserverFromAuthorizedGroup(PerunSession sess, Group authorizedGroup)	Remove role Perun observer from authorizedGroup.
void	removeResourceRole(PerunSession sess, String role, Resource resource, Group group)	Remove role to group for resource.
void	removeResourceRole(PerunSession sess, String role, Resource resource, User user)	Remove role to user for resource.
void	removeVoRole(PerunSession sess, String role, Vo vo, Group group)	Removes role from group in a VO.
void	removeVoRole(PerunSession sess, String role, Vo vo, User user)	Removes role from user in a VO.
boolean	roleExists(String role)	Check if the given role exists in the database.
void	setPerunRolesLoader(PerunRolesLoader perunRolesLoader)
void	setRole(PerunSession sess, Map<String,Integer> mappingOfValues, String role)	Set a role according the mapping of values
boolean	someAdminExists(Map<String,Integer> mappingOfValues, boolean onlyDirectAdmins)	Check if some valid user with specific role exists for given complementary object (for group-based rights, status must be VALID for both Vo and group).
void	unsetRole(PerunSession sess, Map<String,Integer> mappingOfValues, String role)	Unset a role according the mapping of values

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AuthzResolverImpl

public AuthzResolverImpl(DataSource perunPool)

Method Details

getRolesWhichCanWorkWithAttribute

@Deprecated
public static Map<String,Set<ActionType>> getRolesWhichCanWorkWithAttribute(ActionType actionType,
 AttributeDefinition attrDef)

Deprecated.

getPerunPolicy

public static PerunPolicy getPerunPolicy(String policyName)
                                  throws PolicyNotExistsException

Get PerunPolicy for the policy name from the PerunPoliciesContainer

Parameters:

policyName - for which will be the policy fetched

Returns:

PerunPolicy for the role name

Throws:

PolicyNotExistsException - of there is no policy for the policy name

fetchPolicyWithAllIncludedPolicies

public static List<PerunPolicy> fetchPolicyWithAllIncludedPolicies(String policyName)
                                                            throws PolicyNotExistsException

Get the policy according the policy name and all its inlcuded policies (without cycle).

Parameters:

policyName - from which will be the policies fetched

Returns:

list of policies

Throws:

PolicyNotExistsException - if policy or some included policies does not exists in PerunPoliciesContainer

getAllPolicies

public static List<PerunPolicy> getAllPolicies()

Return all loaded perun policies.

Returns:

all loaded policies

getAllRolesManagementRules

public static List<RoleManagementRules> getAllRolesManagementRules()

Return all loaded roles management rules.

Returns:

all roles management rules

getRoleManagementRules

public static RoleManagementRules getRoleManagementRules(String roleName)
                                                  throws RoleManagementRulesNotExistsException

Get RoleManagementRules for the role name from the PerunPoliciesContainer

Parameters:

roleName - for which will be the rules fetched

Returns:

RoleManagementRules for the role name

Throws:

PolicyNotExistsException - of there are no rules for the role name

RoleManagementRulesNotExistsException

addAdmin

public void addAdmin(PerunSession sess,
 Facility facility,
 User user)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add user role admin for the facility

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

facility -

user -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 Facility facility,
 Group group)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add group of users role admin for the facility

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

facility -

group -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 Resource resource,
 User user)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add user role admin for the resource

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

resource -

user -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 Resource resource,
 Group group)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add group of users role admin for the resource

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

resource -

group -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 User sponsoredUser,
 User user)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add user role admin for the sponsored user

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

sponsoredUser -

user -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 User sponsoredUser,
 Group group)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add group of users role admin for the sponsored user

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

sponsoredUser -

group -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 Group group,
 User user)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add user role admin for the group

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

group -

user -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 Group group,
 Group authorizedGroup)
              throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Add group of users role admin for the group

Specified by:

addAdmin in interface AuthzResolverImplApi

Parameters:

sess -

group -

authorizedGroup -

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 SecurityTeam securityTeam,
 User user)
              throws AlreadyAdminException

Specified by:

addAdmin in interface AuthzResolverImplApi

Throws:

AlreadyAdminException

addAdmin

public void addAdmin(PerunSession sess,
 SecurityTeam securityTeam,
 Group group)
              throws AlreadyAdminException

Specified by:

addAdmin in interface AuthzResolverImplApi

Throws:

AlreadyAdminException

addResourceRole

public void addResourceRole(PerunSession sess,
 User user,
 String role,
 Resource resource)
                     throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Sets role to given user for given resource.

Specified by:

addResourceRole in interface AuthzResolverImplApi

Parameters:

sess - session

user - user

role - role

resource - resource

Throws:

AlreadyAdminException - when already in role

addResourceRole

public void addResourceRole(PerunSession sess,
 Group group,
 String role,
 Resource resource)
                     throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Sets role to given group for given resource.

Specified by:

addResourceRole in interface AuthzResolverImplApi

Parameters:

sess - session

group - group

role - role

resource - resource

Throws:

AlreadyAdminException - when already in role

addVoRole

public void addVoRole(PerunSession sess,
 String role,
 Vo vo,
 User user)
               throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Adds role for user in VO.

Specified by:

addVoRole in interface AuthzResolverImplApi

Parameters:

sess - perun session

role - role of user in VO

vo - virtual organization

user - user

Throws:

AlreadyAdminException

addVoRole

public void addVoRole(PerunSession sess,
 String role,
 Vo vo,
 Group group)
               throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Adds role for group in a VO.

Specified by:

addVoRole in interface AuthzResolverImplApi

Parameters:

sess - perun session

role - role of group in VO

vo - virtual organization

group - group

Throws:

AlreadyAdminException

getAdminGroups

public List<Group> getAdminGroups(Map<String,Integer> mappingOfValues)

Description copied from interface: AuthzResolverImplApi

Get all authorizedGroups for complementary object and role.

Specified by:

getAdminGroups in interface AuthzResolverImplApi

Parameters:

mappingOfValues - according to which will be the role selected

Returns:

list of authorizedGroups

getAdmins

public List<User> getAdmins(Map<String,Integer> mappingOfValues,
 boolean onlyDirectAdmins)

Description copied from interface: AuthzResolverImplApi

Get all valid richUser administrators (for group-based rights, status must be VALID for both Vo and group) for complementary object and role with specified attributes.

Specified by:

getAdmins in interface AuthzResolverImplApi

Parameters:

mappingOfValues - from which will be the query created (keys are column names and values are their ids)

onlyDirectAdmins - if we do not want to include also members of authorized groups.

Returns:

list of user administrators for complementary object and role with specified attributes.

someAdminExists

public boolean someAdminExists(Map<String,Integer> mappingOfValues,
 boolean onlyDirectAdmins)

Description copied from interface: AuthzResolverImplApi

Check if some valid user with specific role exists for given complementary object (for group-based rights, status must be VALID for both Vo and group).

Specified by:

someAdminExists in interface AuthzResolverImplApi

Parameters:

mappingOfValues - from which will be the query created (keys are column names and values are their ids)

onlyDirectAdmins - if true, search only direct user administrators (if false, search both direct and indirect)

Returns:

true, if some user with required role exists, false otherwise.

getFacilitiesWhereUserIsInRoles

public Set<Facility> getFacilitiesWhereUserIsInRoles(User user,
 List<String> roles)

Description copied from interface: AuthzResolverImplApi

Get all Facilities where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.

Specified by:

getFacilitiesWhereUserIsInRoles in interface AuthzResolverImplApi

Parameters:

user - for who Facilities are retrieved

roles - for which Facilities are retrieved

Returns:

Set of Facilities

getGroupsWhereUserIsInRoles

public Set<Group> getGroupsWhereUserIsInRoles(User user,
 List<String> roles)

Description copied from interface: AuthzResolverImplApi

Get all Groups where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.

Method does not return subgroups of the fetched groups.

Specified by:

getGroupsWhereUserIsInRoles in interface AuthzResolverImplApi

Parameters:

user - for who Groups are retrieved

roles - for which Groups are retrieved

Returns:

Set of Groups

getMembersWhereUserIsInRoles

public Set<Member> getMembersWhereUserIsInRoles(User user,
 List<String> roles)

Description copied from interface: AuthzResolverImplApi

Get all Members where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.

Specified by:

getMembersWhereUserIsInRoles in interface AuthzResolverImplApi

Parameters:

user - for who Members are retrieved

roles - for which Members are retrieved

Returns:

Set of Members

getResourcesWhereUserIsInRoles

public Set<Resource> getResourcesWhereUserIsInRoles(User user,
 List<String> roles)

Description copied from interface: AuthzResolverImplApi

Get all Resources where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.

Specified by:

getResourcesWhereUserIsInRoles in interface AuthzResolverImplApi

Parameters:

user - for who Resources are retrieved

roles - for which Resources are retrieved

Returns:

Set of Resources

getRoleComplementaryObjectsWithAuthorizedGroups

public Map<String,Map<String,Map<Integer,List<Group>>>> getRoleComplementaryObjectsWithAuthorizedGroups(User user)

Description copied from interface: AuthzResolverImplApi

Returns map of role name and map of corresponding role complementary objects (perun beans) distinguished by type. * together with list of authorized groups where user is member: * Mapinvalid input: '<' RoleName, Mapinvalid input: '<' BeanName, Mapinvalid input: '<' BeanID, List >>>

Specified by:

getRoleComplementaryObjectsWithAuthorizedGroups in interface AuthzResolverImplApi

Parameters:

user -

Returns:

Mapinvalid input: '<'String, Map invalid input: '<' String, Map invalid input: '<' Integer, List invalid input: '<' Group>>>> complementary objects with associated authorized groups

getRoleId

public Integer getRoleId(String role)

Description copied from interface: AuthzResolverImplApi

Fetch the identification of the role from the table roles in the database;

Specified by:

getRoleId in interface AuthzResolverImplApi

Returns:

identification of the role

getRoleIdByName

public int getRoleIdByName(String name)

Returns role id based on its name

Specified by:

getRoleIdByName in interface AuthzResolverImplApi

Parameters:

name - - name of the role

Returns:

role id

getRoles

public AuthzRoles getRoles(User user,
 boolean getAuthorizedGroupBasedRoles)

Description copied from interface: AuthzResolverImplApi

Returns user's direct roles, can also include roles resulting from being a VALID member of authorized groups

Specified by:

getRoles in interface AuthzResolverImplApi

Parameters:

user -

getAuthorizedGroupBasedRoles -

Returns:

AuthzRoles object which contains all roles with perunbeans

getRoles

public AuthzRoles getRoles(Group group)

Description copied from interface: AuthzResolverImplApi

Returns all group's roles.

Specified by:

getRoles in interface AuthzResolverImplApi

Parameters:

group -

Returns:

AuthzRoles object which contains all roles with perunbeans

getRolesObtainedFromAuthorizedGroupMemberships

public AuthzRoles getRolesObtainedFromAuthorizedGroupMemberships(User user)

Description copied from interface: AuthzResolverImplApi

Returns user's roles resulting from being a VALID member of authorized groups

Specified by:

getRolesObtainedFromAuthorizedGroupMemberships in interface AuthzResolverImplApi

Parameters:

user - user

Returns:

AuthzRoles object which contains roles with perunbeans

getSecurityTeamsWhereUserIsInRoles

public Set<SecurityTeam> getSecurityTeamsWhereUserIsInRoles(User user,
 List<String> roles)

Description copied from interface: AuthzResolverImplApi

Get all SecurityTeams where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.

Specified by:

getSecurityTeamsWhereUserIsInRoles in interface AuthzResolverImplApi

Parameters:

user - for who SecurityTeams are retrieved

roles - for which SecurityTeams are retrieved

Returns:

Set of SecurityTeams

getVoIdsForGroupInRole

public List<Integer> getVoIdsForGroupInRole(PerunSession sess,
 Group group,
 String role)

Description copied from interface: AuthzResolverImplApi

Gets list of VOs for which the group has the role.

Specified by:

getVoIdsForGroupInRole in interface AuthzResolverImplApi

Parameters:

sess - perun session

group - group

role - role of group

Returns:

list of VOs from which the group has the role

getVoIdsForUserInRole

public List<Integer> getVoIdsForUserInRole(PerunSession sess,
 User user,
 String role)

Description copied from interface: AuthzResolverImplApi

Gets list of VOs for which the user has the role.

Specified by:

getVoIdsForUserInRole in interface AuthzResolverImplApi

Parameters:

sess - perun session

user - user

role - role of user

Returns:

list of VOs for which the user has the role.

getVosWhereUserIsInRoles

public Set<Vo> getVosWhereUserIsInRoles(User user,
 List<String> roles)

Description copied from interface: AuthzResolverImplApi

Get all Vos where the given user has set one of the given roles or the given user is a member of an authorized group with such roles.

Specified by:

getVosWhereUserIsInRoles in interface AuthzResolverImplApi

Parameters:

user - for who Vos are retrieved

roles - for which Vos are retrieved

Returns:

Set of Vos

groupMatchesUserRolesFilter

public boolean groupMatchesUserRolesFilter(PerunSession sess,
 User user,
 Group group,
 List<String> roles,
 List<RoleAssignmentType> types)

Description copied from interface: AuthzResolverImplApi

Check if the given group passes the user's roles filter.

Specified by:

groupMatchesUserRolesFilter in interface AuthzResolverImplApi

Parameters:

sess - session

user - user

group - group

roles - list of selected roles (if empty, then return groups by all roles)

types - list of selected types of roles (if empty, then return by roles of all types)

Returns:

list of groups

initialize

public void initialize()

Load all authorization components to the database and to the PerunPoliciesContainer

Throws:

InternalErrorException

isGroupInRoleForVo

public boolean isGroupInRoleForVo(PerunSession session,
 Group group,
 String role,
 Vo vo)

Description copied from interface: AuthzResolverImplApi

Checks whether the gruop is in role for Vo.

Specified by:

isGroupInRoleForVo in interface AuthzResolverImplApi

Parameters:

session - perun session

group - group

role - role of group

vo - virtual organization

Returns:

true if group is in role for VO, otherwise false.

isUserInRoleForVo

public boolean isUserInRoleForVo(PerunSession session,
 User user,
 String role,
 Vo vo)

Description copied from interface: AuthzResolverImplApi

Checks whether the user is in role for Vo.

Specified by:

isUserInRoleForVo in interface AuthzResolverImplApi

Parameters:

session - perun session

user - user

role - role of user

vo - virtual organisation

Returns:

true if user is in role for VO, otherwise false.

isVoAdminOrObserver

public boolean isVoAdminOrObserver(PerunSession sess,
 Vo vo)

Returns true if the user in session is vo admin or vo observer of specific vo

Specified by:

isVoAdminOrObserver in interface AuthzResolverImplApi

Parameters:

sess - - session

vo - - vo

Returns:

loadAuthorizationComponents

public void loadAuthorizationComponents()

Description copied from interface: AuthzResolverImplApi

Load perun roles and policies from the configuration file perun-roles.yml. Roles are loaded to the database and policies are loaded to the PerunPoliciesContainer.

Specified by:

loadAuthorizationComponents in interface AuthzResolverImplApi

makeAuthorizedGroupPerunObserver

public void makeAuthorizedGroupPerunObserver(PerunSession sess,
 Group authorizedGroup)
                                      throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Make group Perun observer

Specified by:

makeAuthorizedGroupPerunObserver in interface AuthzResolverImplApi

Parameters:

sess - the perunSession

authorizedGroup - authorizedGroup to be promoted to perunObserver

Throws:

AlreadyAdminException

makeUserCabinetAdmin

public void makeUserCabinetAdmin(PerunSession sess,
 User user)

Description copied from interface: AuthzResolverImplApi

Make user Cabinet manager.

Specified by:

makeUserCabinetAdmin in interface AuthzResolverImplApi

Parameters:

sess - PerunSession

user - User to add Cabinet manager role.

makeUserPerunAdmin

public void makeUserPerunAdmin(PerunSession sess,
 User user)
                        throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Make user to be perunAdmin

Specified by:

makeUserPerunAdmin in interface AuthzResolverImplApi

Parameters:

sess -

user -

Throws:

AlreadyAdminException

makeUserPerunObserver

public void makeUserPerunObserver(PerunSession sess,
 User user)
                           throws AlreadyAdminException

Description copied from interface: AuthzResolverImplApi

Make user Perun observer

Specified by:

makeUserPerunObserver in interface AuthzResolverImplApi

Parameters:

sess - the perunSession

user - user to be promoted to perunObserver

Throws:

AlreadyAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 Facility facility,
 User user)
                 throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove user role admin for the facility

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

facility -

user -

Throws:

UserNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 Facility facility,
 Group group)
                 throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove group of users role admin for the facility

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

facility -

group -

Throws:

GroupNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 Resource resource,
 User user)
                 throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove user role admin for the resource

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

resource -

user -

Throws:

UserNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 Resource resource,
 Group group)
                 throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove group of users role admin for the resource

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

resource -

group -

Throws:

GroupNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 User sponsoredUser,
 User user)
                 throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove user role admin for the sponsoredUser

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

sponsoredUser -

user -

Throws:

UserNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 User sponsoredUser,
 Group group)
                 throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove group of users role admin for the sponsoredUser

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

sponsoredUser -

group -

Throws:

GroupNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 Group group,
 User user)
                 throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove user role admin for the group

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

group -

user -

Throws:

UserNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 Group group,
 Group authorizedGroup)
                 throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove group of users role admin for the group

Specified by:

removeAdmin in interface AuthzResolverImplApi

Parameters:

sess -

group -

authorizedGroup -

Throws:

GroupNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 SecurityTeam securityTeam,
 User user)
                 throws UserNotAdminException

Specified by:

removeAdmin in interface AuthzResolverImplApi

Throws:

UserNotAdminException

removeAdmin

public void removeAdmin(PerunSession sess,
 SecurityTeam securityTeam,
 Group group)
                 throws GroupNotAdminException

Specified by:

removeAdmin in interface AuthzResolverImplApi

Throws:

GroupNotAdminException

removeAllAuthzForFacility

public void removeAllAuthzForFacility(PerunSession sess,
 Facility facility)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the facility

Specified by:

removeAllAuthzForFacility in interface AuthzResolverImplApi

Parameters:

sess -

facility -

removeAllAuthzForGroup

public void removeAllAuthzForGroup(PerunSession sess,
 Group group)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the group

Specified by:

removeAllAuthzForGroup in interface AuthzResolverImplApi

Parameters:

sess -

group -

removeAllAuthzForResource

public void removeAllAuthzForResource(PerunSession sess,
 Resource resource)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the resource

Specified by:

removeAllAuthzForResource in interface AuthzResolverImplApi

Parameters:

sess -

resource -

removeAllAuthzForSecurityTeam

public void removeAllAuthzForSecurityTeam(PerunSession sess,
 SecurityTeam securityTeam)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the securityTeam

Specified by:

removeAllAuthzForSecurityTeam in interface AuthzResolverImplApi

Parameters:

sess -

securityTeam -

removeAllAuthzForService

public void removeAllAuthzForService(PerunSession sess,
 Service service)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the service

Specified by:

removeAllAuthzForService in interface AuthzResolverImplApi

Parameters:

sess -

service -

removeAllAuthzForVo

public void removeAllAuthzForVo(PerunSession sess,
 Vo vo)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the vo

Specified by:

removeAllAuthzForVo in interface AuthzResolverImplApi

Parameters:

sess -

vo -

removeAllSponsoredUserAuthz

public void removeAllSponsoredUserAuthz(PerunSession sess,
 User sponsoredUser)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the sponsoredUser.

Specified by:

removeAllSponsoredUserAuthz in interface AuthzResolverImplApi

Parameters:

sess -

sponsoredUser -

removeAllUserAuthz

public void removeAllUserAuthz(PerunSession sess,
 User user)

Description copied from interface: AuthzResolverImplApi

Removes all authz entries for the user.

Specified by:

removeAllUserAuthz in interface AuthzResolverImplApi

Parameters:

sess -

user -

removeCabinetAdmin

public void removeCabinetAdmin(PerunSession sess,
 User user)
                        throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove role Cabinet manager from user.

Specified by:

removeCabinetAdmin in interface AuthzResolverImplApi

Parameters:

sess - PerunSession

user - User to have cabinet manager role removed

Throws:

UserNotAdminException - If user was not cabinet admin

removePerunAdmin

public void removePerunAdmin(PerunSession sess,
 User user)
                      throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove role perunAdmin for user.

Specified by:

removePerunAdmin in interface AuthzResolverImplApi

Parameters:

sess -

user -

Throws:

UserNotAdminException

removePerunObserver

public void removePerunObserver(PerunSession sess,
 User user)
                         throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove role Perun observer from user.

Specified by:

removePerunObserver in interface AuthzResolverImplApi

Parameters:

sess -

user -

Throws:

UserNotAdminException

removePerunObserverFromAuthorizedGroup

public void removePerunObserverFromAuthorizedGroup(PerunSession sess,
 Group authorizedGroup)
                                            throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove role Perun observer from authorizedGroup.

Specified by:

removePerunObserverFromAuthorizedGroup in interface AuthzResolverImplApi

Parameters:

sess -

authorizedGroup -

Throws:

GroupNotAdminException

removeResourceRole

public void removeResourceRole(PerunSession sess,
 String role,
 Resource resource,
 User user)
                        throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove role to user for resource.

Specified by:

removeResourceRole in interface AuthzResolverImplApi

Parameters:

sess - session

role - role

resource - resource

user - user

Throws:

UserNotAdminException - user was not admin

removeResourceRole

public void removeResourceRole(PerunSession sess,
 String role,
 Resource resource,
 Group group)
                        throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Remove role to group for resource.

Specified by:

removeResourceRole in interface AuthzResolverImplApi

Parameters:

sess - session

role - role

resource - resource

group - group

Throws:

GroupNotAdminException - group was not admin

removeVoRole

public void removeVoRole(PerunSession sess,
 String role,
 Vo vo,
 User user)
                  throws UserNotAdminException

Description copied from interface: AuthzResolverImplApi

Removes role from user in a VO.

Specified by:

removeVoRole in interface AuthzResolverImplApi

Parameters:

sess - perun session

role - role of user in a VO

vo - virtual organization

user - user

Throws:

UserNotAdminException

removeVoRole

public void removeVoRole(PerunSession sess,
 String role,
 Vo vo,
 Group group)
                  throws GroupNotAdminException

Description copied from interface: AuthzResolverImplApi

Removes role from group in a VO.

Specified by:

removeVoRole in interface AuthzResolverImplApi

Parameters:

sess - perun session

role - role of group in a VO

vo - virtual organization

group - group

Throws:

GroupNotAdminException

roleExists

public boolean roleExists(String role)

Description copied from interface: AuthzResolverImplApi

Check if the given role exists in the database. Check is case insensitive.

Specified by:

roleExists in interface AuthzResolverImplApi

Parameters:

role - which will be checked

Returns:

true if role exists, false otherwise.

setPerunRolesLoader

public void setPerunRolesLoader(PerunRolesLoader perunRolesLoader)

setRole

public void setRole(PerunSession sess,
 Map<String,Integer> mappingOfValues,
 String role)
             throws RoleAlreadySetException

Description copied from interface: AuthzResolverImplApi

Set a role according the mapping of values

Specified by:

setRole in interface AuthzResolverImplApi

Parameters:

sess -

mappingOfValues - from which will be the query created (keys are column names and values are their ids)

role - which will be set (just information for exception)

Throws:

RoleAlreadySetException

unsetRole

public void unsetRole(PerunSession sess,
 Map<String,Integer> mappingOfValues,
 String role)
               throws RoleNotSetException

Description copied from interface: AuthzResolverImplApi

Unset a role according the mapping of values

Specified by:

unsetRole in interface AuthzResolverImplApi

Parameters:

sess -

mappingOfValues - from which will be the query created (keys are column names and values are their ids)

role - which will be unset (just information for exception)

Throws:

RoleNotSetException