Class SecurityServiceImpl

java.lang.Object

ubic.gemma.core.security.SecurityServiceImpl

All Implemented Interfaces:

SecurityService

public class SecurityServiceImpl
extends Object
implements SecurityService

Methods for changing security on objects, creating and modifying groups, checking security on objects.

We removed the ACL filtering/checking from most of these methods, because it results in basically checking permissions inside of methods that are checking permissions etc. We assume that anybody with read access on an object can know something about its security state.

Version:

$Id: SecurityServiceImpl.java,v 1.28 2013/12/12 00:10:12 paul Exp $

Author:

keshav, paul

Constructor Summary

Constructors

Constructor

Description

SecurityServiceImpl(AclService aclService, org.springframework.security.core.session.SessionRegistry sessionRegistry, org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy, org.springframework.security.acls.model.SidRetrievalStrategy sidRetrievalStrategy, UserDetailsManager userDetailsManager, GroupManager groupManager, BaseUserService userService)

Method Summary

Modifier and Type	Method	Description
void	addUserToGroup(String userName, String groupName)	Add a given user to a group by name.
<T extends Securable> Map<T,Boolean>	arePrivate(Collection<T> securables)	Check if the given securables are private.
<T extends Securable> Map<T,Boolean>	arePublic(Collection<T> securables)	Check if the given securables are public.
<T extends Securable> Map<T,Boolean>	areShared(Collection<T> securables)	Check if the given securable are shared.
<T extends Securable> Collection<T>	choosePrivate(Collection<T> securables)	Pick private securables.
<T extends Securable> Collection<T>	choosePublic(Collection<T> securables)	Pick public securables.
void	createGroup(String groupName)	If the group already exists, an exception will be thrown.
Collection<String>	editableBy(Securable s)	Retrieve a list of users allowed to edit a given securable.
int	getAuthenticatedUserCount()	Obtain the number of authenticated users.
Collection<String>	getAuthenticatedUserNames()
Collection<org.springframework.security.acls.model.Sid>	getAvailableSids()	Obtain a collection of all availble security IDs (basically, user names and group authorities).
List<String>	getGroupAuthoritiesNameFromGroupName(String groupName)	From the group name get the authority which should be underscored with GROUP_
<T extends Securable> Map<T, Collection<String>>	getGroupsEditableBy(Collection<T> securables)
Collection<String>	getGroupsEditableBy(Securable s)
<T extends Securable> Map<T, Collection<String>>	getGroupsReadableBy(Collection<T> securables)
Collection<String>	getGroupsReadableBy(Securable s)	Obtain all the groups whose members can read a given object.
Collection<String>	getGroupsUserCanEdit(String userName)	Obtain all the groups that the user can edit.
org.springframework.security.acls.model.Sid	getOwner(Securable s)	Obtain the owner of a given object.
<T extends Securable> Map<T, org.springframework.security.acls.model.Sid>	getOwners(Collection<T> securables)	Obtain the owners of a collection of objects.
boolean	isEditableByCurrentUser(Securable s)	Determine if the current user can edit the securable.
boolean	isEditableByGroup(Securable s, String groupName)	Determine if the given group is allowed to edit an object.
boolean	isEditableByUser(Securable s, String userName)	Determine if the given user is allowed to edit an object.
boolean	isOwnedByCurrentUser(Securable s)
boolean	isPrivate(Securable s)	Determine if a securable is private (i.e.
boolean	isPublic(Securable s)	Determine if a securable is public (i.e.
boolean	isReadableByCurrentUser(Securable s)	Determine if the current user can read an object.
boolean	isReadableByGroup(Securable s, String groupName)	Determine if members of a group is allowed to read an object.
boolean	isReadableByUser(Securable s, String userName)
boolean	isShared(Securable s)	Determine if a securable is shared (i.e.
void	makeEditableByGroup(Securable s, String groupName)	Adds write (and read) permissions.
void	makeOwnedByUser(Securable s, String userName)	Administrative method to allow a user to get access to an object.
void	makePrivate(Collection<? extends Securable> objs)	Make a collection of objects private.
void	makePrivate(Securable object)	Makes the object private.
void	makePublic(Collection<? extends Securable> objs)	Make a collection of objects public.
void	makePublic(Securable object)	Makes the object public
void	makeReadableByGroup(Securable s, String groupName)	Adds read permission for a given group.
void	makeUneditableByGroup(Securable s, String groupName)	Remove write permissions.
void	makeUnreadableByGroup(Securable s, String groupName)	Remove read permissions; also removes write permissions.
Collection<String>	readableBy(Securable s)
void	removeUserFromGroup(String userName, String groupName)	Remove a user from a group.
void	setOwner(Securable s, String userName)	Change the 'owner' of an object to a specific user.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecurityServiceImpl

public SecurityServiceImpl(AclService aclService,
 org.springframework.security.core.session.SessionRegistry sessionRegistry,
 org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy,
 org.springframework.security.acls.model.SidRetrievalStrategy sidRetrievalStrategy,
 UserDetailsManager userDetailsManager,
 GroupManager groupManager,
 BaseUserService userService)

Method Details

arePublic

@Transactional(readOnly=true)
public <T extends Securable> Map<T,Boolean> arePublic(Collection<T> securables)

Description copied from interface: SecurityService

Check if the given securables are public.

Specified by:

arePublic in interface SecurityService

arePrivate

@Transactional(readOnly=true)
public <T extends Securable> Map<T,Boolean> arePrivate(Collection<T> securables)

Description copied from interface: SecurityService

Check if the given securables are private.

Specified by:

arePrivate in interface SecurityService

areShared

@Transactional(readOnly=true)
public <T extends Securable> Map<T,Boolean> areShared(Collection<T> securables)

Description copied from interface: SecurityService

Check if the given securable are shared.

Specified by:

areShared in interface SecurityService

choosePrivate

@Transactional(readOnly=true)
public <T extends Securable> Collection<T> choosePrivate(Collection<T> securables)

Description copied from interface: SecurityService

Pick private securables.

Specified by:

choosePrivate in interface SecurityService

Returns:

the subset which are private, if any

choosePublic

@Transactional(readOnly=true)
public <T extends Securable> Collection<T> choosePublic(Collection<T> securables)

Description copied from interface: SecurityService

Pick public securables.

Specified by:

choosePublic in interface SecurityService

Returns:

the subset that are public, if any

readableBy

@Transactional(readOnly=true)
public Collection<String> readableBy(Securable s)

Specified by:

readableBy in interface SecurityService

Returns:

list of userNames of users who can read the given securable.

editableBy

@Transactional(readOnly=true)
public Collection<String> editableBy(Securable s)

Description copied from interface: SecurityService

Retrieve a list of users allowed to edit a given securable.

Specified by:

editableBy in interface SecurityService

Returns:

list of userNames who can edit the given securable.

getAuthenticatedUserCount

public int getAuthenticatedUserCount()

Description copied from interface: SecurityService

Obtain the number of authenticated users.

We make this available to anonymous

Specified by:

getAuthenticatedUserCount in interface SecurityService

getAuthenticatedUserNames

public Collection<String> getAuthenticatedUserNames()

Specified by:

getAuthenticatedUserNames in interface SecurityService

Returns:

user names

getAvailableSids

@Transactional(readOnly=true)
public Collection<org.springframework.security.acls.model.Sid> getAvailableSids()

Description copied from interface: SecurityService

Obtain a collection of all availble security IDs (basically, user names and group authorities).

This methods is only available to administrators.

Specified by:

getAvailableSids in interface SecurityService

getGroupAuthoritiesNameFromGroupName

@Transactional(readOnly=true)
public List<String> getGroupAuthoritiesNameFromGroupName(String groupName)

From the group name get the authority which should be underscored with GROUP_

Specified by:

getGroupAuthoritiesNameFromGroupName in interface SecurityService

Parameters:

groupName - The group name e.g. fish

Returns:

The authority e.g. GROUP_FISH_...

getGroupsEditableBy

@Transactional(readOnly=true)
public <T extends Securable>
Map<T, Collection<String>> getGroupsEditableBy(Collection<T> securables)

Specified by:

getGroupsEditableBy in interface SecurityService

getGroupsEditableBy

@Transactional(readOnly=true)
public Collection<String> getGroupsEditableBy(Securable s)

Specified by:

getGroupsEditableBy in interface SecurityService

getGroupsReadableBy

@Transactional(readOnly=true)
public <T extends Securable>
Map<T, Collection<String>> getGroupsReadableBy(Collection<T> securables)

Specified by:

getGroupsReadableBy in interface SecurityService

getGroupsReadableBy

@Transactional(readOnly=true)
public Collection<String> getGroupsReadableBy(Securable s)

Description copied from interface: SecurityService

Obtain all the groups whose members can read a given object.

Specified by:

getGroupsReadableBy in interface SecurityService

getGroupsUserCanEdit

@Transactional(readOnly=true)
public Collection<String> getGroupsUserCanEdit(String userName)

Description copied from interface: SecurityService

Obtain all the groups that the user can edit.

Specified by:

getGroupsUserCanEdit in interface SecurityService

getOwner

@Transactional(readOnly=true)
public org.springframework.security.acls.model.Sid getOwner(Securable s)

Description copied from interface: SecurityService

Obtain the owner of a given object.

Specified by:

getOwner in interface SecurityService

getOwners

@Transactional(readOnly=true)
public <T extends Securable>
Map<T, org.springframework.security.acls.model.Sid> getOwners(Collection<T> securables)

Description copied from interface: SecurityService

Obtain the owners of a collection of objects.

Pretty much have to be either the owner of the securables or administrator to call this.

Specified by:

getOwners in interface SecurityService

isOwnedByCurrentUser

@Transactional(readOnly=true)
public boolean isOwnedByCurrentUser(Securable s)

Specified by:

isOwnedByCurrentUser in interface SecurityService

Returns:

true if the owner is the same as the current authenticated user. Special case: if the owner is an administrator, and the uc

isReadableByCurrentUser

@Transactional(readOnly=true)
public boolean isReadableByCurrentUser(Securable s)

Description copied from interface: SecurityService

Determine if the current user can read an object.

Specified by:

isReadableByCurrentUser in interface SecurityService

isReadableByUser

@Transactional(readOnly=true)
public boolean isReadableByUser(Securable s,
 String userName)

Specified by:

isReadableByUser in interface SecurityService

Returns:

true if the given user can read the securable, false otherwise. (READ or ADMINISTRATION required)

isReadableByGroup

@Transactional(readOnly=true)
public boolean isReadableByGroup(Securable s,
 String groupName)

Description copied from interface: SecurityService

Determine if members of a group is allowed to read an object.

Specified by:

isReadableByGroup in interface SecurityService

isEditableByCurrentUser

@Transactional(readOnly=true)
public boolean isEditableByCurrentUser(Securable s)

Description copied from interface: SecurityService

Determine if the current user can edit the securable.

Specified by:

isEditableByCurrentUser in interface SecurityService

isEditableByUser

@Transactional(readOnly=true)
public boolean isEditableByUser(Securable s,
 String userName)

Description copied from interface: SecurityService

Determine if the given user is allowed to edit an object.

Specified by:

isEditableByUser in interface SecurityService

isEditableByGroup

@Transactional(readOnly=true)
public boolean isEditableByGroup(Securable s,
 String groupName)

Description copied from interface: SecurityService

Determine if the given group is allowed to edit an object.

Specified by:

isEditableByGroup in interface SecurityService

isPublic

@Transactional(readOnly=true)
public boolean isPublic(Securable s)

Description copied from interface: SecurityService

Determine if a securable is public (i.e. can be seen by anyone, including anonymous users).

Specified by:

isPublic in interface SecurityService

See Also:

• SecurityUtil.isPublic(Acl)

isPrivate

@Transactional(readOnly=true)
public boolean isPrivate(Securable s)

Description copied from interface: SecurityService

Determine if a securable is private (i.e. can only be seen by its owner or an administrator).

Specified by:

isPrivate in interface SecurityService

Returns:

true if anonymous users can view (READ) the object, false otherwise. If the object doesn't have an ACL, return true (be safe!)

See Also:

• BasicLookupStrategy
• SecurityUtil.isPrivate(Acl)

isShared

@Transactional(readOnly=true)
public boolean isShared(Securable s)

Description copied from interface: SecurityService

Determine if a securable is shared (i.e. can be seen by any registered users).

Specified by:

isShared in interface SecurityService

See Also:

• SecurityUtil.isShared(Acl)

makeOwnedByUser

@Transactional
public void makeOwnedByUser(Securable s,
 String userName)

Description copied from interface: SecurityService

Administrative method to allow a user to get access to an object. This is useful for cases where a data set is loaded by admin but we need to hand it off to a user. If the user is the same as the current owner nothing is done.

TODO: consider allowing a groupauthority to be the owner (GROUP_ADMIN) - see bug 2996

Specified by:

makeOwnedByUser in interface SecurityService

makePrivate

@Transactional
public void makePrivate(Collection<? extends Securable> objs)

Description copied from interface: SecurityService

Make a collection of objects private.

Specified by:

makePrivate in interface SecurityService

makePrivate

@Transactional
public void makePrivate(Securable object)

Description copied from interface: SecurityService

Makes the object private.

Specified by:

makePrivate in interface SecurityService

makePublic

@Transactional
public void makePublic(Collection<? extends Securable> objs)

Description copied from interface: SecurityService

Make a collection of objects public.

Specified by:

makePublic in interface SecurityService

makePublic

@Transactional
public void makePublic(Securable object)

Description copied from interface: SecurityService

Makes the object public

Specified by:

makePublic in interface SecurityService

makeReadableByGroup

@Transactional
public void makeReadableByGroup(Securable s,
 String groupName)
                         throws org.springframework.security.access.AccessDeniedException

Description copied from interface: SecurityService

Adds read permission for a given group.

Specified by:

makeReadableByGroup in interface SecurityService

Throws:

org.springframework.security.access.AccessDeniedException

makeUnreadableByGroup

@Transactional
public void makeUnreadableByGroup(Securable s,
 String groupName)
                           throws org.springframework.security.access.AccessDeniedException

Description copied from interface: SecurityService

Remove read permissions; also removes write permissions.

Specified by:

makeUnreadableByGroup in interface SecurityService

Throws:

org.springframework.security.access.AccessDeniedException

makeUneditableByGroup

@Transactional
public void makeUneditableByGroup(Securable s,
 String groupName)
                           throws org.springframework.security.access.AccessDeniedException

Description copied from interface: SecurityService

Remove write permissions. Leaves read permissions, if present.

Specified by:

makeUneditableByGroup in interface SecurityService

Throws:

org.springframework.security.access.AccessDeniedException

makeEditableByGroup

@Transactional
public void makeEditableByGroup(Securable s,
 String groupName)
                         throws org.springframework.security.access.AccessDeniedException

Description copied from interface: SecurityService

Adds write (and read) permissions.

Specified by:

makeEditableByGroup in interface SecurityService

Throws:

org.springframework.security.access.AccessDeniedException

setOwner

@Transactional
public void setOwner(Securable s,
 String userName)

Description copied from interface: SecurityService

Change the 'owner' of an object to a specific user. Note that this doesn't support making the owner a grantedAuthority.

Specified by:

setOwner in interface SecurityService

createGroup

@Transactional
public void createGroup(String groupName)

Description copied from interface: SecurityService

If the group already exists, an exception will be thrown.

Specified by:

createGroup in interface SecurityService

addUserToGroup

@Transactional
public void addUserToGroup(String userName,
 String groupName)

Description copied from interface: SecurityService

Add a given user to a group by name.

Specified by:

addUserToGroup in interface SecurityService

removeUserFromGroup

@Transactional
public void removeUserFromGroup(String userName,
 String groupName)

Description copied from interface: SecurityService

Remove a user from a group.

Specified by:

removeUserFromGroup in interface SecurityService