Java MutableAcl类代码示例

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
@Override
public MutableAcl createAcl(ObjectIdentity objectIdentity) throws AlreadyExistsException {
    Assert.notNull(objectIdentity, "Object Identity required");

    // Check this object identity hasn't already been persisted
    if (retrieveObjectIdentityPrimaryKey(objectIdentity) != null) {
        throw new AlreadyExistsException("Object identity '" + objectIdentity + "' already exists");
    }

    // Need to retrieve the current principal, in order to know who "owns" this ACL (can be changed later on)
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    PrincipalSid sid = new PrincipalSid(auth);

    // Create the acl_object_identity row
    createObjectIdentity(objectIdentity, sid);

    // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
    Acl acl = readAclById(objectIdentity);
    Assert.isInstanceOf(MutableAcl.class, acl, "MutableAcl should be been returned");

    return (MutableAcl) acl;
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
public MutableAcl createAcl(ObjectIdentity objectIdentity) throws AlreadyExistsException {
    Assert.notNull(objectIdentity, "Object Identity required");

    // Check this object identity hasn't already been persisted
    if (retrieveObjectIdentityPrimaryKey(objectIdentity) != null) {
        throw new AlreadyExistsException("Object identity '" + objectIdentity + "' already exists");
    }

    // Need to retrieve the current principal, in order to know who "owns" this ACL (can be changed later on)
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    PrincipalSid sid = new PrincipalSid(auth);

    // Create the acl_object_identity row
    createObjectIdentity(objectIdentity, sid);

    // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
    Acl acl = readAclById(objectIdentity);
    Assert.isInstanceOf(MutableAcl.class, acl, "MutableAcl should be been returned");

    return (MutableAcl) acl;
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
@Override
public MutableAcl createAcl(ObjectIdentity objectIdentity) throws AlreadyExistsException {
       Assert.notNull(objectIdentity, "Object Identity required");

       // Check this object identity hasn't already been persisted
       if (retrieveObjectIdentityPrimaryKey(objectIdentity) != null) {
           throw new AlreadyExistsException("Object identity '" + objectIdentity + "' already exists");
       }

       // Need to retrieve the current principal, in order to know who "owns" this ACL (can be changed later on)
       Authentication auth = SecurityContextHolder.getContext().getAuthentication();
       PrincipalSid sid = new PrincipalSid(auth);

       // Create the acl_object_identity row
       createObjectIdentity(objectIdentity, sid);

       // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
       Acl acl = readAclById(objectIdentity);
       Assert.isInstanceOf(MutableAcl.class, acl, "MutableAcl should be been returned");

       return (MutableAcl) acl;
   }
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
@Override
public void deletePermission(Long securedObjectId, Class clazz, String recipient, boolean principal, Permission perm) 
{
	logger.debug("Remove the requested permission for the recipient.");
	MutableAcl acl = fetchAclForObject(clazz, securedObjectId);

	List<AccessControlEntry> entries = acl.getEntries();

	int i = 0;
	if (entries != null)
	{
		for (AccessControlEntry entry : entries)
		{
			if (entry.getSid().equals(recipient) && entry.getPermission().equals(perm))
				acl.deleteAce(i);
			else
				i++;
		}
	}

	aclService.updateAcl(acl);

	if (logger.isDebugEnabled()) {
		logger.debug("Deleted securedObject " + securedObjectId + " ACL permissions for recipient " + recipient);
	}
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
/**
 * This implementation will simply delete all ACEs in the database and recreate them on each invocation of
 * this method. A more comprehensive implementation might use dirty state checking, or more likely use ORM
 * capabilities for create, update and delete operations of {@link MutableAcl}.
 */
@Override
public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
    Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");

    // Delete this ACL's ACEs in the acl_entry table
    aclDao.deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));

    // Create this ACL's ACEs in the acl_entry table
    createEntries(acl);

    // Change the mutable columns in acl_object_identity
    updateObjectIdentity(acl);

    // Clear the cache, including children
    clearCacheIncludingChildren(acl.getObjectIdentity());

    // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
    return (MutableAcl) readAclById(acl.getObjectIdentity());
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
@Transactional
@Override
public int createEvent(Event event) {

    int result = eventDao.createEvent(event);
    event.setId(result);

    // Add new ACL Entry:
    MutableAcl acl = aclService.createAcl(new ObjectIdentityImpl(event));
    PrincipalSid sid = new PrincipalSid(userContext.getCurrentUser().getEmail());
    acl.setOwner(sid);
    acl.insertAce(0,  BasePermission.READ, sid, true);
    aclService.updateAcl(acl);

    return result;
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
/**
   * Creates a new row in acl_entry for every ACE defined in the passed MutableAcl object.
   *
   * @param acl containing the ACEs to insert
   */
  protected void createEntries(final MutableAcl acl) {
if (acl.getEntries().isEmpty()) {
	return;
}
      jdbcTemplate.batchUpdate(insertEntry,
      	new BatchPreparedStatementSetter() {
              public int getBatchSize() {
                  return acl.getEntries().size();
              }

              public void setValues(PreparedStatement stmt, int i) throws SQLException {
                  AccessControlEntry entry_ = acl.getEntries().get(i);
                  Assert.isTrue(entry_ instanceof AccessControlEntryImpl, "Unknown ACE class");
                  AccessControlEntryImpl entry = (AccessControlEntryImpl) entry_;
                  stmt.setLong(1, ((Long) acl.getId()).longValue());
                  stmt.setInt(2, i);
                  stmt.setLong(3, createOrRetrieveSidPrimaryKey(entry.getSid(), true).longValue());
                  stmt.setInt(4, entry.getPermission().getMask());
                  stmt.setBoolean(5, entry.isGranting());
                  stmt.setBoolean(6, entry.isAuditSuccess());
                  stmt.setBoolean(7, entry.isAuditFailure());
              }
          });
  }
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
/**
 * This implementation will simply delete all ACEs in the database and recreate them on each invocation of
 * this method. A more comprehensive implementation might use dirty state checking, or more likely use ORM
 * capabilities for create, update and delete operations of {@link MutableAcl}.
 */
public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
    Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");

    // Delete this ACL's ACEs in the acl_entry table
    deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));

    // Create this ACL's ACEs in the acl_entry table
    createEntries(acl);

    // Change the mutable columns in acl_object_identity
    updateObjectIdentity(acl);

    // Clear the cache, including children
    clearCacheIncludingChildren(acl.getObjectIdentity());

    // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
    return (MutableAcl) super.readAclById(acl.getObjectIdentity());
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
/**
 * Updates an existing acl_object_identity row, with new information presented in the passed MutableAcl
 * object. Also will create an acl_sid entry if needed for the Sid that owns the MutableAcl.
 *
 * @param acl to modify (a row must already exist in acl_object_identity)
 *
 * @throws NotFoundException if the ACL could not be found to update.
 */
protected void updateObjectIdentity(MutableAcl acl) {
    Long parentId = null;

    if (acl.getParentAcl() != null) {
        Assert.isInstanceOf(ObjectIdentityImpl.class, acl.getParentAcl().getObjectIdentity(),
            "Implementation only supports ObjectIdentityImpl");

        ObjectIdentityImpl oii = (ObjectIdentityImpl) acl.getParentAcl().getObjectIdentity();
        parentId = retrieveObjectIdentityPrimaryKey(oii);
    }

    Assert.notNull(acl.getOwner(), "Owner is required in this implementation");

    Long ownerSid = createOrRetrieveSidPrimaryKey(acl.getOwner(), true);
    int count = jdbcTemplate.update(updateObjectIdentity,
            parentId, ownerSid, Boolean.valueOf(acl.isEntriesInheriting()), acl.getId());

    if (count != 1) {
        throw new NotFoundException("Unable to locate ACL to update");
    }
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
private void revocarPermisos(
		Sid sid,
		Class<?> objectClass,
		Serializable objectIdentifier,
		Permission[] permissions) throws NotFoundException {
	ObjectIdentity oid = new ObjectIdentityImpl(objectClass, objectIdentifier);
	try {
		MutableAcl acl = (MutableAcl)aclService.readAclById(oid);
		List<Integer> indexosPerEsborrar = new ArrayList<Integer>();
		int aceIndex = 0;
		for (AccessControlEntry ace: acl.getEntries()) {
			if (ace.getSid().equals(sid)) {
				for (Permission p: permissions) {
					if (p.equals(ace.getPermission()))
						indexosPerEsborrar.add(aceIndex);
				}
			}
			aceIndex++;
		}
		for (Integer index: indexosPerEsborrar)
			acl.deleteAce(index);
		aclService.updateAcl(acl);
	} catch (NotFoundException nfex) {
		// Si no troba l'ACL no fa res
	}
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
public void revokeProjectPermission(String name, String type) {
    //revoke user's project permission
    List<ProjectInstance> projectInstances = ProjectManager.getInstance(KylinConfig.getInstanceFromEnv()).listAllProjects();
    for (ProjectInstance pi : projectInstances) {
        // after KYLIN-2760, only project ACL will work, so entity type is always ProjectInstance.
        AclEntity ae = getAclEntity("ProjectInstance", pi.getUuid());

        MutableAcl acl = (MutableAcl) getAcl(ae);
        if (acl == null) {
            return;
        }
        List<AccessControlEntry> aces = acl.getEntries();
        if (aces == null) {
            return;
        }

        int indexOfAce = -1;
        for (int i = 0; i < aces.size(); i++) {
            if (needRevoke(aces.get(i).getSid(), name, type)) {
                indexOfAce = i;
                break;
            }
        }
        deleteAndUpdate(acl, indexOfAce);
    }
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
/**
    * This implementation will simply delete all ACEs in the database and recreate them on each invocation of
    * this method. A more comprehensive implementation might use dirty state checking, or more likely use ORM
    * capabilities for create, update and delete operations of {@link MutableAcl}.
    */
@Override
   public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
       Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");

       // Delete this ACL's ACEs in the acl_entry table
       deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));

       // Create this ACL's ACEs in the acl_entry table
       createEntries(acl);

       // Change the mutable columns in acl_object_identity
       updateObjectIdentity(acl);

       // Clear the cache, including children
       clearCacheIncludingChildren(acl.getObjectIdentity());

       // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
       return (MutableAcl) super.readAclById(acl.getObjectIdentity());
   }
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
protected void createEntries(final MutableAcl acl) {
	if (acl.getEntries() == null || acl.getEntries().size() == 0) return;
	int order = 0;
	for (AccessControlEntry entry_ : acl.getEntries()) {
		Assert.isTrue(entry_ instanceof AccessControlEntryImpl, "Unknown ACE class");
           AccessControlEntryImpl entry = (AccessControlEntryImpl) entry_;
           AclEntry aclEntry = new AclEntry();
           aclEntry.setSid(createOrRetrieveSidPrimaryKey(entry.getSid(), true));
           aclEntry.setOrder(order);
           aclEntry.setObjectIdentityId((String)acl.getId());
           aclEntry.setMask(entry.getPermission().getMask());
           aclEntry.setGranting(entry.isGranting());
           aclEntry.setAuditSuccess(entry.isAuditSuccess());
           aclEntry.setAuditFailure(entry.isAuditFailure());
           aclEntryRepository.save(aclEntry);
           
           order ++;
	}
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
/**
 * Updates an existing acl_object_identity row, with new information presented in the passed MutableAcl
 * object. Also will create an acl_sid entry if needed for the Sid that owns the MutableAcl.
 *
 * @param acl to modify (a row must already exist in acl_object_identity)
 *
 * @throws NotFoundException if the ACL could not be found to update.
 */
protected void updateObjectIdentity(MutableAcl acl) {
    String parentId = null;

    if (acl.getParentAcl() != null) {
        Assert.isInstanceOf(ObjectIdentityImpl.class, acl.getParentAcl().getObjectIdentity(),
            "Implementation only supports ObjectIdentityImpl");

        ObjectIdentityImpl oii = (ObjectIdentityImpl) acl.getParentAcl().getObjectIdentity();
        parentId = retrieveObjectIdentityPrimaryKey(oii);
    }

    Assert.notNull(acl.getOwner(), "Owner is required in this implementation");

    String ownerSid = createOrRetrieveSidPrimaryKey(acl.getOwner(), true);
    AclObjectIdentity aoi = objectIdentityRepository.findOne((String)acl.getId());
    if (aoi == null) {
        throw new NotFoundException("Unable to locate ACL to update");
    }
    aoi.setParentObjectId(parentId);
    aoi.setOwnerId(ownerSid);
    aoi.setEntriesInheriting(Boolean.valueOf(acl.isEntriesInheriting()));
    objectIdentityRepository.save(aoi);
}
 

import org.springframework.security.acls.model.MutableAcl; //导入依赖的package包/类
@Test
public void deleteAclRemovesRowsFromDatabase() throws Exception {
    SecurityContextHolder.getContext().setAuthentication(auth);
    MutableAcl child = mongodbMutableAclService.createAcl(childOid);
    child.insertAce(0, BasePermission.DELETE, new PrincipalSid(auth), false);
    mongodbMutableAclService.updateAcl(child);

    // Remove the child and check all related database rows were removed accordingly
    mongodbMutableAclService.deleteAcl(childOid, false);
    
    assertEquals(1, mongoTemplate.findAll(AclClass.class).size());
    assertEquals(0, mongoTemplate.findAll(AclObjectIdentity.class).size());
    assertEquals(0, mongoTemplate.findAll(AclEntry.class).size());

    // Check the cache
    assertNull(cache.getFromCache(childOid));
    assertNull(cache.getFromCache("102"));
}