Changeset 4570

Timestamp:

07/09/09 12:51:04 (8 months ago)

Author:

jmoore

Message:

SecuritySystem : Support for configurable permissions (ticket:1405)

It is now possible to set omero.security.default_permissions
at compile time (in source:trunk/etc/omero.properties) or via
OmeroConfig? (ticket:800) at runtime.

Location:

trunk

Files:

• components/common/resources/ome/config.xml (modified) (1 diff)
• components/common/src/ome/system/PermissionsContext.java (added)
• components/model/src/ome/model/internal/Permissions.java (modified) (13 diffs)
• components/model/test/ome/model/utests/PermissionsTest.java (modified) (1 diff)
• components/server/src/ome/services/sessions/SessionManagerImpl.java (modified) (1 diff)
• etc/omero.properties (modified) (1 diff)

trunk/components/common/resources/ome/config.xml

@@ -28 +28 @@
     on how this works.
     </description>
+
+    <bean id="permissionsContext" class="ome.system.PermissionsContext">
+        <description>
+            Sets the value of the default permissions key based on the
+            PreferenceContext in the system properties to be loaded by
+            the ome.model.internal.Permissions class.
+        </description>
+        <constructor-arg ref="preferenceContext"/>
+    </bean>
 
     <bean id="preferenceContext" class="ome.system.PreferenceContext">

trunk/components/model/src/ome/model/internal/Permissions.java

@@ -1 +1 @@
 /*
- * ome.model.internal.Permissions
+ *   $Id$
  *
  *   Copyright 2006 University of Dundee. All rights reserved.
@@ -7 +7 @@
 package ome.model.internal;
 
-// Java imports
 import java.io.IOException;
 import java.io.ObjectInputStream;
@@ -15 +14 @@
 import javax.persistence.Column;
 
-// Third-party libraries
-
-// Application-internal dependencies
 import ome.conditions.ApiUsageException;
 import ome.model.IObject;
@@ -35 +31 @@
  * </p>
  * 
- * @see <a href="https://trac.openmicroscopy.org.uk/omero/ticket/180">ticket:180</a>
+ * @see <a
+ *      href="https://trac.openmicroscopy.org.uk/omero/ticket/180">ticket:180</a>
  */
 public class Permissions implements Serializable {
@@ -102 +99 @@
     /**
      * enumeration of flags which can be set on a {@link Permissions} instance.
-     * A {@link Flag#LOCKED} flag implies that the
-     * {@link Details#getOwner() owner}, {@link Details#getGroup() group}, and
+     * A {@link Flag#LOCKED} flag implies that the {@link Details#getOwner()
+     * owner}, {@link Details#getGroup() group}, and
      * {@link Details#getPermissions() permissions} for an {@link IObject}
      * instance may not be changed. {@link Flag#SOFT} implies that the given
@@ -186 +183 @@
 
         Permissions p = new Permissions(EMPTY);
-        String regex = "([Rr_][Ww_]){3}";
+        String regex = "([Rr_-][Ww_-]){3}";
 
         if (rwrwrw == null || !rwrwrw.matches(regex)) {
@@ -229 +226 @@
      * or empty rights are simply ignored. For example, <code>
      *   somePermissions().grant(USER,READ,WRITE,USE);
-     * </code>
-     * will guarantee that the current user has all rights on this entity.
+     * </code> will guarantee
+     * that the current user has all rights on this entity.
      */
     public Permissions grant(Role role, Right... rights) {
@@ -245 +242 @@
      * or empty rights are simply ignored. For example, <code>
      *   new Permissions().revoke(WORLD,WRITE,USE);
-     * </code>
-     * will return a Permissions instance which cannot be altered or linked to
-     * by members of WORLD.
+     * </code> will return a
+     * Permissions instance which cannot be altered or linked to by members of
+     * WORLD.
      */
     public Permissions revoke(Role role, Right... rights) {
@@ -264 +261 @@
      *   Permissions mask = new Permissions().grant(WORLD,READ);
      *   someEntity.getDetails().getPermissions().grantAllk(mask);
-     * </code>
-     * will allow READ access (and possibly more) to <code>someEntity</code>
-     * for members of WORLD.
+     * </code> will allow READ access (and possibly more) to
+     * <code>someEntity</code> for members of WORLD.
      */
     public Permissions grantAll(Permissions mask) {
@@ -283 +279 @@
      *   Permissions mask = new Permissions().revoke(WORLD,READ,WRITE,USE);
      *   someEntity.getDetails().getPermissions().applyMask(mask);
-     * </code>
-     * will disallow all access to <code>someEntity</code> for members of
-     * WORLD.
+     * </code> will disallow all access to <code>someEntity</code> for members
+     * of WORLD.
      * 
      * This also implies that applyMask can be used to make copies of
      * Permissions. For example, <code>
      *   new Permissions().applyMask( somePermissions );
-     * </code>
-     * will produce a copy of <code>somePermissions</code>.
+     * </code> will produce a copy of
+     * <code>somePermissions</code>.
      * 
      * Note: the logic here is different from Unix UMASKS.
@@ -366 +361 @@
 
     /**
-     * two {@link Permissions} instances are <code>identical</code> if they
-     * have the same bit representation.
+     * two {@link Permissions} instances are <code>identical</code> if they have
+     * the same bit representation.
      * 
      * @see <a
@@ -679 +674 @@
 
     /**
-     * an immutable {@link Permissions} instance which is used as the default
-     * value in all persistent classes. It revokes {@link Right#WRITE} to both
-     * {@link Role#GROUP} and {@link Role#WORLD}
-     */
-    public final static Permissions DEFAULT = USER_PRIVATE;
-
-    /**
      * an immutable {@link Permissions} instance with all {@link Right#WRITE}
      * rights turned off. Identical to {@link #WORLD_IMMUTABLE}
@@ -697 +685 @@
     public final static Permissions PUBLIC = WORLD_WRITEABLE;
 
+    /**
+     * an immutable {@link Permissions} instance which is used as the default
+     * value in all persistent classes. It is initiall set to
+     * {@link #USER_PRIVATE}, but is reset from the
+     * {@link ome.system.PermissionsContext#KEY} configuration value which is set by
+     * default in etc/omero.properties.
+     */
+    public/* final */static Permissions DEFAULT = USER_PRIVATE;
+
+    public static void setDefaultPermissions(String permissions) {
+        DEFAULT = new ImmutablePermissions(parseString(permissions));
+    }
+
 }

trunk/components/model/test/ome/model/utests/PermissionsTest.java

@@ -268 +268 @@
     public void testCompareWithString() throws Exception {
         assertTrue(Permissions.EMPTY.sameRights(Permissions
+                .parseString("------")));
+        assertTrue(Permissions.EMPTY.sameRights(Permissions
                 .parseString("______")));
         assertTrue(Permissions.DEFAULT.sameRights(Permissions
-                .parseString("rwr_r_")));
+                .parseString("rw____")));
         assertTrue(Permissions.GROUP_IMMUTABLE.sameRights(Permissions
                 .parseString("r_r___")));

trunk/components/server/src/ome/services/sessions/SessionManagerImpl.java

@@ -204 +204 @@
         s.setDefaultEventType(eventType);
         s.setDefaultPermissions(umask.toString());
-        s.getDetails().setPermissions(Permissions.USER_PRIVATE);
+        s.getDetails().setPermissions(Permissions.DEFAULT);
     }
 

trunk/etc/omero.properties

@@ -31 +31 @@
 omero.security.filter.bitand=(int8and(permissions,%s) = %s)
 omero.security.password_provider=chainedPasswordProvider
+omero.security.default_permissions=rw----