Examples of org.rhq.core.domain.authz.Role

org.rhq.core.domain.authz.Role
A role has zero or more {@link org.rhq.core.domain.resource.group.ResourceGroup}s assigned to it. You can assign a role to zero or more {@link Subject}s. A role defines a set of {@link Permission}s that the assigned {@link Subject}s are authorized for in order to operate on the Resources in the assigned {@link org.rhq.core.domain.resource.group.ResourceGroup}s. @author Greg Hinkle

    }


    @Test(enabled = TESTS_ENABLED)
    public void testAuthzBundleGroup() throws Exception {
        Subject subject = createNewSubject(TEST_USER_NAME);
        Role role = createNewRoleForSubject(subject, TEST_ROLE_NAME);


        subject = createSession(subject); // start a session so we can use this subject in SLSB calls


        BundleGroup bundleGroup = new BundleGroup(TEST_BUNDLE_GROUP_NAME);
        bundleGroup.setDescription("test");


        // deny bundle group create
        try {
            bundleManager.createBundleGroup(subject, bundleGroup);
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // allow bundle group create
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        bundleGroup = bundleManager.createBundleGroup(subject, bundleGroup);


        // deny bundle group delete
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        try {
            bundleManager.deleteBundleGroups(subject, new int[] { bundleGroup.getId() });
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // deny global perm bundleGroup view
        BundleGroupCriteria bgCriteria = new BundleGroupCriteria();
        List<BundleGroup> bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
        assertNotNull(bundleGroups);
        assert bundleGroups.isEmpty() : "Should not be able to see unassociated bundle group";


        // allow global perm bundleGroup view
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
        assertNotNull(bundleGroups);
        assertEquals("Should be able to see unassociated bundle group", 1, bundleGroups.size());


        // allow bundle group delete
        bundleManager.deleteBundleGroups(subject, new int[] { bundleGroup.getId() });
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);


        // deny unassigned bundle create (no global create or view)
        try {
            createBundle(subject, TEST_PREFIX + ".bundle");
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // deny unassigned bundle create (no global view)
        addRolePermissions(role, Permission.CREATE_BUNDLES);
        try {
            createBundle(subject, TEST_PREFIX + ".bundle");
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // deny unassigned bundle create (no global create)
        removeRolePermissions(role, Permission.CREATE_BUNDLES);
        addRolePermissions(role, Permission.VIEW_BUNDLES);
        try {
            createBundle(subject, TEST_PREFIX + ".bundle");
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // allow unassigned bundle create
        addRolePermissions(role, Permission.CREATE_BUNDLES);
        Bundle bundle = createBundle(subject, TEST_PREFIX + ".bundle");


        // deny unassigned bundle view
        removeRolePermissions(role, Permission.CREATE_BUNDLES, Permission.VIEW_BUNDLES);
        BundleCriteria bCriteria = new BundleCriteria();
        List<Bundle> bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
        assertNotNull(bundles);
        assert bundles.isEmpty() : "Should not be able to see unassigned bundle";


        // allow unassigned bundle view
        addRolePermissions(role, Permission.VIEW_BUNDLES);
        bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
        assertNotNull(bundles);
        assertEquals("Should be able to see unassigned bundle", 1, bundles.size());


        // deny global perm bundle assign
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);


        bundleGroup = new BundleGroup(TEST_BUNDLE_GROUP_NAME);
        bundleGroup.setDescription("test");


        bundleGroup = bundleManager.createBundleGroup(subject, bundleGroup);
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);


        try {
            bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
                new int[] { bundle.getId() });
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // allow bundle assign via global manage_bundle_groups
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
            new int[] { bundle.getId() });


        // allow bundle unassign via global manage_bundle_groups
        bundleManager.unassignBundlesFromBundleGroups(subject, new int[] { bundleGroup.getId() },
            new int[] { bundle.getId() });


        // allow bundle assign via global create
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        addRolePermissions(role, Permission.CREATE_BUNDLES);
        bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
            new int[] { bundle.getId() });


        // deny bundle unassign via global create
        try {
            bundleManager.unassignBundlesFromBundleGroups(subject, new int[] { bundleGroup.getId() },
                new int[] { bundle.getId() });
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // allow bundle unassign via global delete
        addRolePermissions(role, Permission.DELETE_BUNDLES);
        bundleManager.unassignBundlesFromBundleGroups(subject, new int[] { bundleGroup.getId() },
            new int[] { bundle.getId() });
        removeRolePermissions(role, Permission.DELETE_BUNDLES);


        // deny bundle assign with global create but no view
        removeRolePermissions(role, Permission.VIEW_BUNDLES);
        try {
            bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
                new int[] { bundle.getId() });
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // go back and again assign via global create and view
        addRolePermissions(role, Permission.VIEW_BUNDLES);
        bundleManager.assignBundlesToBundleGroups(subject, new int[] { bundleGroup.getId() },
            new int[] { bundle.getId() });


        // deny assigned, unassociated-bundle-group bundle view
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        removeRolePermissions(role, Permission.VIEW_BUNDLES);
        bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
        assertNotNull(bundles);
        assert bundles.isEmpty() : "Should not be able to see assigned bundle";


        // allow assigned, associated-bundle-group bundle view
        addRoleBundleGroup(role, bundleGroup);
        bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
        assertNotNull(bundles);
        assertEquals("Should be able to see assigned bundle", 1, bundles.size());


        // check new bundle criteria options (no match)
        bCriteria.addFilterBundleGroupIds(87678);
        bCriteria.fetchBundleGroups(true);
        bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
        assertNotNull(bundles);
        assert bundles.isEmpty() : "Should not have found anything";


        // check new bundle criteria options (match)
        bCriteria.addFilterBundleGroupIds(bundleGroup.getId());
        bCriteria.fetchBundleGroups(true);
        bundles = bundleManager.findBundlesByCriteria(subject, bCriteria);
        assertNotNull(bundles);
        assertEquals("Should be able to see assigned bundle", 1, bundles.size());
        assertNotNull(bundles.get(0).getBundleGroups());
        assertEquals("Should have fetched bundlegroup", 1, bundles.get(0).getBundleGroups().size());
        assertEquals("Should have fetched expected bundlegroup", bundleGroup, bundles.get(0).getBundleGroups()
            .iterator().next());


        // check new bundle group criteria options (no match)
        bgCriteria.addFilterId(87678);
        bgCriteria.addFilterBundleIds(87678);
        bgCriteria.addFilterRoleIds(87678);
        bgCriteria.fetchBundles(true);
        bgCriteria.fetchRoles(true);
        bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
        assertNotNull(bundleGroups);
        assert bundleGroups.isEmpty() : "Should not have found anything";


        // check new bundle group criteria options (no match)
        bgCriteria.addFilterId(bundleGroup.getId());
        bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
        assertNotNull(bundleGroups);
        assert bundleGroups.isEmpty() : "Should not have found anything";


        // check new bundle group criteria options (no match)
        bgCriteria.addFilterBundleIds(bundle.getId());
        bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
        assertNotNull(bundleGroups);
        assert bundleGroups.isEmpty() : "Should not have found anything";


        // check new bundle group criteria options (match)
        bgCriteria.addFilterRoleIds(role.getId());
        bundleGroups = bundleManager.findBundleGroupsByCriteria(subject, bgCriteria);
        assertNotNull(bundleGroups);
        assertEquals("Should be able to see assigned bundle", 1, bundleGroups.size());
        assertNotNull(bundleGroups.get(0).getBundles());
        assertEquals("Should have fetched bundle in bundle group", 1, bundleGroups.get(0).getBundles().size());

View Full Code Here

    }


    @Test(enabled = TESTS_ENABLED)
    public void testAuthzCreateBundleVersion() throws Exception {
        Subject subject = createNewSubject(TEST_USER_NAME);
        Role role = createNewRoleForSubject(subject, TEST_ROLE_NAME);


        subject = createSession(subject); // start a session so we can use this subject in SLSB calls


        // create bundle group
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        BundleGroup bundleGroup1 = new BundleGroup(TEST_BUNDLE_GROUP_NAME + "_1");
        bundleGroup1.setDescription("bg-1");
        bundleGroup1 = bundleManager.createBundleGroup(subject, bundleGroup1);
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);


        // add bg1 to the role, but no perms
        addRoleBundleGroup(role, bundleGroup1);


        // deny bundle create in bg1 (no create perm)
        try {
            createBundle(subject, TEST_PREFIX + ".bundle", bundleGroup1.getId());
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // allow bundle creation in bg1 (has create perm)
        addRolePermissions(role, Permission.CREATE_BUNDLES_IN_GROUP);
        Bundle bundle = createBundle(subject, TEST_PREFIX + ".bundle", bundleGroup1.getId());


        // deny bundle version creation (perm taken away)
        removeRolePermissions(role, Permission.CREATE_BUNDLES_IN_GROUP);
        try {
            BundleVersion bv1 = createBundleVersion(subject, bundle.getName() + "-1", null, bundle);
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {
            // expected
        }


        // allow bundle version creation (perm granted)
        addRolePermissions(role, Permission.CREATE_BUNDLES_IN_GROUP);
        BundleVersion bv1 = createBundleVersion(subject, bundle.getName() + "-1", null, bundle);
        assertNotNull(bv1);
        assertEquals("1.0", bv1.getVersion());
        assert 0 == bv1.getVersionOrder();


        // create second role
        Role role2 = createNewRoleForSubject(subject, TEST_ROLE_NAME + "_2");
        addRolePermissions(role2, Permission.CREATE_BUNDLES_IN_GROUP);


        // create second bundle group
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        BundleGroup bundleGroup2 = new BundleGroup(TEST_BUNDLE_GROUP_NAME + "_2");

View Full Code Here

    }


    @Test(enabled = TESTS_ENABLED)
    public void testAuthzDeleteBundleVersion() throws Exception {
        Subject subject = createNewSubject(TEST_USER_NAME);
        Role role = createNewRoleForSubject(subject, TEST_ROLE_NAME);


        subject = createSession(subject); // start a session so we can use this subject in SLSB calls


        // create bundle group
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);

View Full Code Here

    }


    @Test(enabled = TESTS_ENABLED)
    public void testAuthzBundleDest() throws Exception {
        Subject subject = createNewSubject(TEST_USER_NAME);
        Role role = createNewRoleForSubject(subject, TEST_ROLE_NAME);
        subject = createSession(subject); // start a session so we can use this subject in SLSB calls


        // create bundle group
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        BundleGroup bundleGroup = new BundleGroup(TEST_BUNDLE_GROUP_NAME);
        bundleGroup.setDescription("bg");
        bundleGroup = bundleManager.createBundleGroup(subject, bundleGroup);
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);


        // add bg to the role with group create
        addRoleBundleGroup(role, bundleGroup);
        addRolePermissions(role, Permission.CREATE_BUNDLES_IN_GROUP);


        // allow bundle creation in bg (has create perm)
        Bundle b1 = createBundle(subject, "one", bundleGroup.getId());
        assertNotNull(b1);
        BundleVersion bv1 = createBundleVersion(subject, b1.getName() + "-1", null, b1);
        assertNotNull(bv1);
        ResourceGroup platformResourceGroup = createTestResourceGroup();
        assertNotNull(platformResourceGroup);


        // deny destination create (no view of resource group)
        try {
            BundleDestination dest1 = createDestination(subject, b1, "one", "/test", platformResourceGroup);
            fail("Should have thrown IllegalArgumentException");
        } catch (EJBException e) {
            assert e.getCause() instanceof IllegalArgumentException
                && e.getCause().getMessage().contains("Invalid groupId") : "Should have not had group visibility";
            // expected
        }


        // deny destination create (no deploy perm)
        LookupUtil.getRoleManager().addResourceGroupsToRole(overlord, role.getId(),
            new int[] { platformResourceGroup.getId() });
        try {
            BundleDestination dest1 = createDestination(subject, b1, "one", "/test", platformResourceGroup);
            fail("Should have thrown PermissionException");
        } catch (PermissionException e) {

View Full Code Here

    }


    @Test(enabled = TESTS_ENABLED)
    public void testAuthzBundleDeploy() throws Exception {
        Subject subject = createNewSubject(TEST_USER_NAME);
        Role role = createNewRoleForSubject(subject, TEST_ROLE_NAME);
        subject = createSession(subject); // start a session so we can use this subject in SLSB calls


        // create bundle group
        addRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);
        BundleGroup bundleGroup = new BundleGroup(TEST_BUNDLE_GROUP_NAME);
        bundleGroup.setDescription("bg");
        bundleGroup = bundleManager.createBundleGroup(subject, bundleGroup);
        removeRolePermissions(role, Permission.MANAGE_BUNDLE_GROUPS);


        // add bg to the role with group create
        addRoleBundleGroup(role, bundleGroup);
        addRolePermissions(role, Permission.CREATE_BUNDLES_IN_GROUP);


        // allow bundle creation in bg (has create perm)
        Bundle b1 = createBundle(subject, "one", bundleGroup.getId());
        assertNotNull(b1);
        BundleVersion bv1 = createBundleVersion(subject, b1.getName() + "-1", null, b1);
        assertNotNull(bv1);
        ResourceGroup platformResourceGroup = createTestResourceGroup();
        assertNotNull(platformResourceGroup);
        LookupUtil.getRoleManager().addResourceGroupsToRole(overlord, role.getId(),
            new int[] { platformResourceGroup.getId() });


        // allow dest/deploy create (global)
        addRolePermissions(role, Permission.DEPLOY_BUNDLES);
        BundleDestination dest1 = createDestination(subject, b1, "one", "/test", platformResourceGroup);

View Full Code Here


        return LookupUtil.getSubjectManager().createSubject(overlord, newSubject);
    }


    private Role createNewRoleForSubject(Subject subject, String roleName) throws Exception {
        Role newRole = new Role(roleName);
        newRole.setFsystem(false);
        newRole.addSubject(subject);


        return LookupUtil.getRoleManager().createRole(overlord, newRole);
    }

View Full Code Here


        executeInTransaction(new TransactionCallback() {
            public void execute() throws Exception {
                // Create the test group
                final Subject subject = SessionTestHelper.createNewSubject(em, "testSubject");
                final Role roleWithSubject = SessionTestHelper
                    .createNewRoleForSubject(em, subject, "role with subject");
                roleWithSubject.addPermission(Permission.VIEW_RESOURCE);
                ResourceGroup group = SessionTestHelper.createNewCompatibleGroupForRole(em, roleWithSubject,
                    "accessible group");


                // before adding resources check for EMPTY
                List<ResourceGroupAvailability> avails;

View Full Code Here

            @Override
            public void execute() throws Exception {


                Subject subject1 = SessionTestHelper.createNewSubject(em, "fake subject 1");
                Subject subject2 = SessionTestHelper.createNewSubject(em, "fake subject 2");
                Role inventoryManagerRole = SessionTestHelper.createNewRoleForSubject(em, subject2,
                    "inventory manager role", Permission.MANAGE_INVENTORY);


                for (int i = 0; i < 1000; i++) {
                    String iStr = String.valueOf(i);
                    savedSearchManager.createSavedSearch(subject1, new SavedSearch(SearchSubsystem.GROUP,

View Full Code Here

        return criteria;
    }


    private ResourceGroup createResourceGroup() {
        Subject subject = SessionTestHelper.createNewSubject(em, getRandomString());
        Role role = SessionTestHelper.createNewRoleForSubject(em, subject, getRandomString());
        return SessionTestHelper.createNewCompatibleGroupForRole(em, role, getRandomString());
    }

View Full Code Here

        try {
            EntityManager em = getEntityManager();


            // setup simple test structures
            Subject subject = SessionTestHelper.createNewSubject(em, "subject-ClusterManagerBeanTest");
            Role role = SessionTestHelper.createNewRoleForSubject(em, subject, "role-ClusterManagerBeanTest",
                Permission.MANAGE_INVENTORY);


            ResourceGroup clusterGroup = SessionTestHelper.createNewCompatibleGroupForRole(em, role,
                "clusterGroup-ClusterManagerBeanTest");

View Full Code Here

0 1 2 3 4 5 6 7 8 9

TOP

Related Classes of org.rhq.core.domain.authz.Role

org.rhq.core.domain.bundle.test.BundleGroupTest

org.rhq.coregui.client.admin.roles.RoleEditView

org.rhq.coregui.client.admin.roles.RolesDataSource

org.rhq.enterprise.gui.admin.role.AddLdapGroupsFormPrepareAction

org.rhq.enterprise.gui.admin.role.AddResourceGroupsFormPrepareAction

org.rhq.enterprise.gui.admin.role.AddUsersFormPrepareAction

org.rhq.enterprise.gui.admin.role.ChangeOwnerFormPrepareAction

org.rhq.enterprise.gui.admin.role.EditAction

org.rhq.enterprise.gui.admin.role.EditFormPrepareAction

org.rhq.enterprise.gui.admin.role.NewAction

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.