Class SecurityUtil

java.lang.Object
ubic.gemma.core.security.util.SecurityUtil
public class SecurityUtil extends Object
Database-independent methods for ACLs
Version:
$Id: SecurityUtil.java,v 1.6 2013/09/14 16:56:04 paul Exp $
Author:
Paul

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecurityUtil()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static String
    getCurrentUsername()
    Returns the username of the authenticated user
    static boolean
    isOwner(org.springframework.security.acls.model.Acl acl, String username)
     
    static boolean
    isPrivate(org.springframework.security.acls.model.Acl acl)
    Test whether the given ACL is constraining access to users who are at privileges above "anonymous".
    static boolean
    isPublic(org.springframework.security.acls.model.Acl acl)
     
    static boolean
    isRunningAsAdmin()
     
    static boolean
    isShared(org.springframework.security.acls.model.Acl acl)
     
    static boolean
    isUserAdmin()
    Returns true if the current user has admin authority.
    static boolean
    isUserAgent()
    Returns true if the current caller holds the agent authority.
    static boolean
    isUserAnonymous()
    Returns true if the user is anonymous.
    static boolean
    isUserCurator()
    Returns true if the current caller holds the curator authority.
    static boolean
    isUserCuratorOrAdmin()
    Returns true if the current caller curates: a curator, or an administrator.
    static boolean
    isUserLoggedIn()
    Returns true if the user is non-anonymous.
    static String
    resolveActingIdentity(String onBehalfOf)
    Resolve the identity an action should be recorded against, given an optional onBehalfOf claim from the caller.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • SecurityUtil

      public SecurityUtil()

  • Method Details

    • getCurrentUsername

      public static String getCurrentUsername()
      Returns the username of the authenticated user

    • isOwner

      public static boolean isOwner(org.springframework.security.acls.model.Acl acl, String username)

    • isPublic

      public static boolean isPublic(org.springframework.security.acls.model.Acl acl)

    • isPrivate

      public static boolean isPrivate(org.springframework.security.acls.model.Acl acl)
      Test whether the given ACL is constraining access to users who are at privileges above "anonymous".
      Returns:
      true if the permissions indicate 'non-public', false if 'public'.

    • isRunningAsAdmin

      public static boolean isRunningAsAdmin()

    • isShared

      public static boolean isShared(org.springframework.security.acls.model.Acl acl)
      Returns:
      true if the ACL grants READ authority to at least one group that is not admin or agent.

    • isUserAdmin

      public static boolean isUserAdmin()
      Returns true if the current user has admin authority.
      Returns:
      true if the current user has admin authority

    • isUserAnonymous

      public static boolean isUserAnonymous()
      Returns true if the user is anonymous.

    • isUserLoggedIn

      public static boolean isUserLoggedIn()
      Returns true if the user is non-anonymous.

    • isUserCurator

      public static boolean isUserCurator()
      Returns true if the current caller holds the curator authority.

      🛑 Read the granted authorities directly rather than relying on the role hierarchy that makes an administrator satisfy hasAuthority('GROUP_CURATOR') in a @PreAuthorize expression. That expansion is performed by the access-decision voter, not baked into Authentication.getAuthorities(), so a programmatic check sees only what was actually granted. Callers wanting "curator or better" must ask for isUserAdmin() too, which is why isUserCuratorOrAdmin() exists.

    • isUserCuratorOrAdmin

      public static boolean isUserCuratorOrAdmin()
      Returns true if the current caller curates: a curator, or an administrator.
      See Also:

    • isUserAgent

      public static boolean isUserAgent()
      Returns true if the current caller holds the agent authority.

    • resolveActingIdentity

      public static String resolveActingIdentity(@Nullable String onBehalfOf)
      Resolve the identity an action should be recorded against, given an optional onBehalfOf claim from the caller.

      Curation writes reach Gemma through the curation agent rather than from a curator's browser, so the authenticated principal on those calls is the agent acting for someone else. Recording the principal would attribute every curator's work to the agent — and where the identity is part of a uniqueness key, as it is for a DRAFT's "draft-{curator}" run id, it does worse than mis-attribute: two curators collapse onto one row and the second write silently overwrites the first.

      So the acting identity travels on the wire, and the principal only decides whether the caller may claim it. Only an agent or an admin may; for anyone else a claim is refused rather than ignored, because quietly substituting their own name would record a different fact from the one they asked for.

      Parameters:
      onBehalfOf - the claimed identity, or null to act as yourself
      Returns:
      the identity to record
      Throws:
      org.springframework.security.access.AccessDeniedException - if a caller who is neither agent nor admin claims to be someone else
      IllegalStateException - if there is no authenticated caller to fall back to