File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\AuthorizationStrategy.java.html

1 /*
2 * The MIT License
3 *
4 * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Seiji Sogabe, Tom Huybrechts
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 package hudson.security;
25
26 import hudson.DescriptorExtensionList;
27 import hudson.Extension;
28 import hudson.ExtensionPoint;
29 import hudson.model.*;
30 import hudson.slaves.Cloud;
31 import hudson.util.DescriptorList;
32
33 import java.io.Serializable;
34 import java.util.Collection;
35 import java.util.Collections;
36
37 import jenkins.model.Jenkins;
38 import net.sf.json.JSONObject;
39
40 import org.acegisecurity.Authentication;
41 import org.acegisecurity.acls.sid.Sid;
42 import org.kohsuke.stapler.StaplerRequest;
43
44 /**
45 * Controls authorization throughout Hudson.
46 *
47 * <h2>Persistence</h2>
48 * <p>
49 * This object will be persisted along with {@link jenkins.model.Jenkins} object.
50 * Hudson by itself won't put the ACL returned from {@link #getRootACL()} into the serialized object graph,
51 * so if that object contains state and needs to be persisted, it's the responsibility of
52 * {@link AuthorizationStrategy} to do so (by keeping them in an instance field.)
53 *
54 * <h2>Re-configuration</h2>
55 * <p>
56 * The corresponding {@link Describable} instance will be asked to create a new {@link AuthorizationStrategy}
57 * every time the system configuration is updated. Implementations that keep more state in ACL beyond
58 * the system configuration should use {@link jenkins.model.Jenkins#getAuthorizationStrategy()} to talk to the current
59 * instance to carry over the state.
60 *
61 * @author Kohsuke Kawaguchi
62 * @see SecurityRealm
63 */
64 public abstract class AuthorizationStrategy extends AbstractDescribableImpl<AuthorizationStrategy> implements ExtensionPoint {
65 /**
66 * Returns the instance of {@link ACL} where all the other {@link ACL} instances
67 * for all the other model objects eventually delegate.
68 * <p>
69 * IOW, this ACL will have the ultimate say on the access control.
70 */
71 public abstract ACL getRootACL();
72
73 /**
74 * @deprecated since 1.277
75 * Override {@link #getACL(Job)} instead.
76 */
77 @Deprecated
78 public ACL getACL(AbstractProject<?,?> project) {
79 return getACL((Job)project);
80 }
81
82 public ACL getACL(Job<?,?> project) {
83 return getRootACL();
84 }
85
86 /**
87 * Implementation can choose to provide different ACL for different views.
88 * This can be used as a basis for more fine-grained access control.
89 *
90 * <p>
91 * The default implementation makes the view visible if any of the items are visible
92 * or the view is configurable.
93 *
94 * @since 1.220
95 */
96 public ACL getACL(final View item) {
97 return new ACL() {
98 @Override
99 public boolean hasPermission(Authentication a, Permission permission) {
100 ACL base = item.getOwner().getACL();
101
102 boolean hasPermission = base.hasPermission(a, permission);
103 if (!hasPermission && permission == View.READ) {
104 return base.hasPermission(a,View.CONFIGURE) || !item.getItems().isEmpty();
105 }
106
107 return hasPermission;
108 }
109 };
110 }
111
112 /**
113 * Implementation can choose to provide different ACL for different items.
114 * This can be used as a basis for more fine-grained access control.
115 *
116 * <p>
117 * The default implementation returns {@link #getRootACL()}.
118 *
119 * @since 1.220
120 */
121 public ACL getACL(AbstractItem item) {
122 return getRootACL();
123 }
124
125 /**
126 * Implementation can choose to provide different ACL per user.
127 * This can be used as a basis for more fine-grained access control.
128 *
129 * <p>
130 * The default implementation returns {@link #getRootACL()}.
131 *
132 * @since 1.221
133 */
134 public ACL getACL(User user) {
135 return getRootACL();
136 }
137
138 /**
139 * Implementation can choose to provide different ACL for different computers.
140 * This can be used as a basis for more fine-grained access control.
141 *
142 * <p>
143 * The default implementation delegates to {@link #getACL(Node)}
144 *
145 * @since 1.220
146 */
147 public ACL getACL(Computer computer) {
148 return getACL(computer.getNode());
149 }
150
151 /**
152 * Implementation can choose to provide different ACL for different {@link Cloud}s.
153 * This can be used as a basis for more fine-grained access control.
154 *
155 * <p>
156 * The default implementation returns {@link #getRootACL()}.
157 *
158 * @since 1.252
159 */
160 public ACL getACL(Cloud cloud) {
161 return getRootACL();
162 }
163
164 public ACL getACL(Node node) {
165 return getRootACL();
166 }
167
168 /**
169 * Returns the list of all group/role names used in this authorization strategy,
170 * and the ACL returned from the {@link #getRootACL()} method.
171 * <p>
172 * This method is used by {@link ContainerAuthentication} to work around the servlet API issue
173 * that prevents us from enumerating roles that the user has.
174 * <p>
175 * If such enumeration is impossible, do the best to list as many as possible, then
176 * return it. In the worst case, just return an empty list. Doing so would prevent
177 * users from using role names as group names (see HUDSON-2716 for such one such report.)
178 *
179 * @return
180 * never null.
181 */
182 public abstract Collection<String> getGroups();
183
184 /**
185 * Returns all the registered {@link AuthorizationStrategy} descriptors.
186 */
187 public static DescriptorExtensionList<AuthorizationStrategy,Descriptor<AuthorizationStrategy>> all() {
188 return Jenkins.getInstance().<AuthorizationStrategy,Descriptor<AuthorizationStrategy>>getDescriptorList(AuthorizationStrategy.class);
189 }
190
191 /**
192 * All registered {@link SecurityRealm} implementations.
193 *
194 * @deprecated since 1.286
195 * Use {@link #all()} for read access, and {@link Extension} for registration.
196 */
197 public static final DescriptorList<AuthorizationStrategy> LIST = new DescriptorList<AuthorizationStrategy>(AuthorizationStrategy.class);
198
199 /**
200 * {@link AuthorizationStrategy} that implements the semantics
201 * of unsecured Hudson where everyone has full control.
202 *
203 * <p>
204 * This singleton is safe because {@link Unsecured} is stateless.
205 */
206 public static final AuthorizationStrategy UNSECURED = new Unsecured();
207
208 public static final class Unsecured extends AuthorizationStrategy implements Serializable {
209 /**
210 * Maintains the singleton semantics.
211 */
212 private Object readResolve() {
213 return UNSECURED;
214 }
215
216 @Override
217 public ACL getRootACL() {
218 return UNSECURED_ACL;
219 }
220
221 public Collection<String> getGroups() {
222 return Collections.emptySet();
223 }
224
225 private static final ACL UNSECURED_ACL = new ACL() {
226 public boolean hasPermission(Authentication a, Permission permission) {
227 return true;
228 }
229 };
230
231 @Extension
232 public static final class DescriptorImpl extends Descriptor<AuthorizationStrategy> {
233 public String getDisplayName() {
234 return Messages.AuthorizationStrategy_DisplayName();
235 }
236
237 @Override
238 public AuthorizationStrategy newInstance(StaplerRequest req, JSONObject formData) throws FormException {
239 return UNSECURED;
240 }
241
242 @Override
243 public String getHelpFile() {
244 return "/help/security/no-authorization.html";
245 }
246 }
247 }
248 }
249