File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\ACL.java.html

1 /*
2 * The MIT License
3 *
4 * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 package hudson.security;
25
26 import jenkins.model.Jenkins;
27 import org.acegisecurity.AccessDeniedException;
28 import org.acegisecurity.Authentication;
29 import org.acegisecurity.context.SecurityContext;
30 import org.acegisecurity.context.SecurityContextHolder;
31 import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
32 import org.acegisecurity.acls.sid.PrincipalSid;
33 import org.acegisecurity.acls.sid.Sid;
34 import hudson.model.Executor;
35
36 /**
37 * Gate-keeper that controls access to Hudson's model objects.
38 *
39 * @author Kohsuke Kawaguchi
40 */
41 public abstract class ACL {
42 /**
43 * Checks if the current security principal has this permission.
44 *
45 * <p>
46 * This is just a convenience function.
47 *
48 * @throws AccessDeniedException
49 * if the user doesn't have the permission.
50 */
51 public final void checkPermission(Permission p) {
52 Authentication a = Jenkins.getAuthentication();
53 if(!hasPermission(a,p))
54 throw new AccessDeniedException2(a,p);
55 }
56
57 /**
58 * Checks if the current security principal has this permission.
59 *
60 * @return false
61 * if the user doesn't have the permission.
62 */
63 public final boolean hasPermission(Permission p) {
64 return hasPermission(Jenkins.getAuthentication(),p);
65 }
66
67 /**
68 * Checks if the given principle has the given permission.
69 *
70 * <p>
71 * Note that {@link #SYSTEM} can be passed in as the authentication parameter,
72 * in which case you should probably just assume it has every permission.
73 */
74 public abstract boolean hasPermission(Authentication a, Permission permission);
75
76 //
77 // Sid constants
78 //
79
80 /**
81 * Special {@link Sid} that represents "everyone", even including anonymous users.
82 *
83 * <p>
84 * This doesn't need to be included in {@link Authentication#getAuthorities()},
85 * but {@link ACL} is responsible for checking it nontheless, as if it was the
86 * last entry in the granted authority.
87 */
88 public static final Sid EVERYONE = new Sid() {
89 @Override
90 public String toString() {
91 return "EVERYONE";
92 }
93 };
94
95 /**
96 * {@link Sid} that represents the anonymous unauthenticated users.
97 * <p>
98 * {@link HudsonFilter} sets this up, so this sid remains the same
99 * regardless of the current {@link SecurityRealm} in use.
100 */
101 public static final Sid ANONYMOUS = new PrincipalSid("anonymous");
102
103 protected static final Sid[] AUTOMATIC_SIDS = new Sid[]{EVERYONE,ANONYMOUS};
104
105 /**
106 * {@link Sid} that represents the Hudson itself.
107 * <p>
108 * This is used when Hudson is performing computation for itself, instead
109 * of acting on behalf of an user, such as doing builds.
110 */
111 public static final Authentication SYSTEM = new UsernamePasswordAuthenticationToken("SYSTEM","SYSTEM");
112
113 /**
114 * Changes the {@link Authentication} associated with the current thread
115 * to the specified one, and returns the previous security context.
116 *
117 * <p>
118 * When the impersonation is over, be sure to restore the previous authentication
119 * via {@code SecurityContextHolder.setContext(returnValueFromThisMethod)}.
120 *
121 * <p>
122 * We need to create a new {@link SecurityContext} instead of {@link SecurityContext#setAuthentication(Authentication)}
123 * because the same {@link SecurityContext} object is reused for all the concurrent requests from the same session.
124 * @since 1.462
125 */
126 public static SecurityContext impersonate(Authentication auth) {
127 SecurityContext old = SecurityContextHolder.getContext();
128 SecurityContextHolder.setContext(new NotSerilizableSecurityContext(auth));
129 return old;
130 }
131 }
132