File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\SidACL.java.html

1 /*
2 * The MIT License
3 *
4 * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 package hudson.security;
25
26 import org.acegisecurity.Authentication;
27 import org.acegisecurity.GrantedAuthority;
28 import org.acegisecurity.acls.sid.PrincipalSid;
29 import org.acegisecurity.acls.sid.GrantedAuthoritySid;
30 import org.acegisecurity.acls.sid.Sid;
31
32 import java.util.logging.Logger;
33 import static java.util.logging.Level.FINE;
34 import static java.util.logging.Level.FINER;
35
36 /**
37 * {@link ACL} that checks permissions based on {@link GrantedAuthority}
38 * of the {@link Authentication}.
39 *
40 * @author Kohsuke Kawaguchi
41 */
42 public abstract class SidACL extends ACL {
43
44 @Override
45 public boolean hasPermission(Authentication a, Permission permission) {
46 if(a==SYSTEM) {
47 if(LOGGER.isLoggable(FINE))
48 LOGGER.fine("hasPermission("+a+","+permission+")=>SYSTEM user has full access");
49 return true;
50 }
51 Boolean b = _hasPermission(a,permission);
52
53 if(LOGGER.isLoggable(FINE))
54 LOGGER.fine("hasPermission("+a+","+permission+")=>"+(b==null?"null, thus false":b));
55
56 if(b==null) b=false; // default to rejection
57 return b;
58 }
59
60 /**
61 * Implementation that backs up {@link #hasPermission(Authentication, Permission)}.
62 *
63 * @return
64 * true or false if {@link #hasPermission(Sid, Permission)} returns it.
65 * Otherwise null, indicating that this ACL doesn't have any entry for it.
66 */
67 protected Boolean _hasPermission(Authentication a, Permission permission) {
68 // ACL entries for this principal takes precedence
69 Boolean b = hasPermission(new PrincipalSid(a),permission);
70 if(LOGGER.isLoggable(FINER))
71 LOGGER.finer("hasPermission(PrincipalSID:"+a.getPrincipal()+","+permission+")=>"+b);
72 if(b!=null)
73 return b;
74
75 // after that, we check if the groups this principal belongs to
76 // has any ACL entries.
77 // here we are using GrantedAuthority as a group
78 for(GrantedAuthority ga : a.getAuthorities()) {
79 b = hasPermission(new GrantedAuthoritySid(ga),permission);
80 if(LOGGER.isLoggable(FINER))
81 LOGGER.finer("hasPermission(GroupSID:"+ga.getAuthority()+","+permission+")=>"+b);
82 if(b!=null)
83 return b;
84 }
85
86 // permissions granted to 'everyone' and 'anonymous' users are granted to everyone
87 for (Sid sid : AUTOMATIC_SIDS) {
88 b = hasPermission(sid,permission);
89 if(LOGGER.isLoggable(FINER))
90 LOGGER.finer("hasPermission("+sid+","+permission+")=>"+b);
91 if(b!=null)
92 return b;
93 }
94
95 return null;
96 }
97
98 /**
99 * Checks if the given {@link Sid} has the given {@link Permission}.
100 *
101 * <p>
102 * {@link #hasPermission(Authentication, Permission)} is implemented
103 * by checking authentication's {@link GrantedAuthority} by using
104 * this method.
105 *
106 * <p>
107 * It is the implementor's responsibility to recognize {@link Permission#impliedBy}
108 * and take that into account.
109 *
110 * @return
111 * true if the access should be granted, false if it should be denied.
112 * The null value indicates that the ACL does no rule for this Sid/Permission
113 * combination. The caller can decide what to do &mash; such as consulting the higher level ACL,
114 * or denying the access (if the model is no-access-by-default.)
115 */
116 protected abstract Boolean hasPermission(Sid p, Permission permission);
117
118 protected String toString(Sid p) {
119 if (p instanceof GrantedAuthoritySid)
120 return ((GrantedAuthoritySid) p).getGrantedAuthority();
121 if (p instanceof PrincipalSid)
122 return ((PrincipalSid) p).getPrincipal();
123 if (p == EVERYONE)
124 return "role_everyone";
125 // hmm...
126 return p.toString();
127 }
128
129 /**
130 * Creates a new {@link SidACL} that first consults 'this' {@link SidACL} and then delegate to
131 * the given parent {@link SidACL}. By doing this at the {@link SidACL} level and not at the
132 * {@link ACL} level, this allows the child ACLs to have an explicit deny entry.
133 * Note that the combined ACL calls hasPermission(Sid,Permission) in the child and parent
134 * SidACLs directly, so if these override _hasPermission then this custom behavior will
135 * not be applied.
136 */
137 public final SidACL newInheritingACL(final SidACL parent) {
138 final SidACL child = this;
139 return new SidACL() {
140 protected Boolean hasPermission(Sid p, Permission permission) {
141 Boolean b = child.hasPermission(p, permission);
142 if(b!=null) return b;
143 return parent.hasPermission(p,permission);
144 }
145 };
146 }
147
148 private static final Logger LOGGER = Logger.getLogger(SidACL.class.getName());
149 }
150