diff --git a/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedAPIAccessChecker.java b/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedAPIAccessChecker.java index 1586c52ef63..d193c943450 100644 --- a/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedAPIAccessChecker.java +++ b/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedAPIAccessChecker.java @@ -86,7 +86,7 @@ public class RoleBasedAPIAccessChecker extends AdapterBase implements APIChecker List policies = _iamSrv.listAclPolicies(account.getAccountId()); - boolean isAllowed = _iamSrv.isAPIAccessibleForPolicies(commandName, policies); + boolean isAllowed = _iamSrv.isActionAllowedForPolicies(commandName, policies); if (!isAllowed) { throw new PermissionDeniedException("The API does not exist or is blacklisted. api: " + commandName); } diff --git a/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityAccessChecker.java b/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityAccessChecker.java index fa746044ff4..e180000ee5b 100644 --- a/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityAccessChecker.java +++ b/services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityAccessChecker.java @@ -25,9 +25,9 @@ import javax.inject.Inject; import org.apache.log4j.Logger; import org.apache.cloudstack.acl.api.AclApiService; -import org.apache.cloudstack.acl.dao.AclGroupAccountMapDao; -import org.apache.cloudstack.acl.dao.AclPolicyPermissionDao; import org.apache.cloudstack.iam.api.AclPolicy; +import org.apache.cloudstack.iam.api.AclPolicyPermission; +import org.apache.cloudstack.iam.api.IAMService; import com.cloud.acl.DomainChecker; import com.cloud.domain.dao.DomainDao; @@ -47,10 +47,7 @@ public class RoleBasedEntityAccessChecker extends DomainChecker implements Secur @Inject DomainDao _domainDao; @Inject - AclGroupAccountMapDao _aclGroupAccountMapDao; - - @Inject - AclPolicyPermissionDao _policyPermissionDao; + IAMService _iamSrv; @Override @@ -74,15 +71,15 @@ public class RoleBasedEntityAccessChecker extends DomainChecker implements Secur HashMap policyPermissionMap = new HashMap(); for (AclPolicy policy : policies) { - List permissions = new ArrayList(); + List permissions = new ArrayList(); if (action != null) { - permissions = _policyPermissionDao.listByPolicyActionAndEntity(policy.getId(), - action, entityType); + permissions = _iamSrv.listPolicyPermissionByEntityType(policy.getId(), action, entityType); } else { - permissions = _policyPermissionDao.listByPolicyAccessAndEntity(policy.getId(), accessType, entityType); + permissions = _iamSrv.listPolicyPermissionByAccessType(policy.getId(), accessType.toString(), + entityType, action); } - for (AclPolicyPermissionVO permission : permissions) { + for (AclPolicyPermission permission : permissions) { if (checkPermissionScope(caller, permission.getScope(), entity)) { if (permission.getEntityType().equals(entityType)) { policyPermissionMap.put(policy, permission.getPermission().isGranted()); @@ -109,13 +106,13 @@ public class RoleBasedEntityAccessChecker extends DomainChecker implements Secur return false; } - private boolean checkPermissionScope(Account caller, PermissionScope scope, ControlledEntity entity) { + private boolean checkPermissionScope(Account caller, String scope, ControlledEntity entity) { - if(scope.equals(PermissionScope.ACCOUNT)){ + if (scope.equals(PermissionScope.ACCOUNT.name())) { if(caller.getAccountId() == entity.getAccountId()){ return true; } - }else if(scope.equals(PermissionScope.DOMAIN)){ + } else if (scope.equals(PermissionScope.DOMAIN.name())) { if (_domainDao.isChildDomain(caller.getDomainId(), entity.getDomainId())) { return true; } diff --git a/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiService.java b/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiService.java index 344e59c2e46..12ecf8b3d10 100644 --- a/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiService.java +++ b/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiService.java @@ -60,8 +60,6 @@ public interface AclApiService { AclPolicyPermission getAclPolicyPermission(long accountId, String entityType, String action); - boolean isAPIAccessibleForPolicies(String apiName, List policies); - List getEffectivePolicies(Account caller, ControlledEntity entity); /* Response Generation */ diff --git a/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiServiceImpl.java b/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiServiceImpl.java index 02d015cefeb..b117d0c5671 100644 --- a/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiServiceImpl.java +++ b/services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiServiceImpl.java @@ -174,7 +174,8 @@ public class AclApiServiceImpl extends ManagerBase implements AclApiService, Man List policies = _iamSrv.listAclPolicies(accountId); AclPolicyPermission curPerm = null; for (AclPolicy policy : policies) { - List perms = _iamSrv.listPollcyPermissionByEntityType(policy.getId(), action, entityType); + List perms = _iamSrv.listPolicyPermissionByEntityType(policy.getId(), action, + entityType); if (perms == null || perms.size() == 0) continue; AclPolicyPermission perm = perms.get(0); // just pick one @@ -190,12 +191,6 @@ public class AclApiServiceImpl extends ManagerBase implements AclApiService, Man } - - @Override - public boolean isAPIAccessibleForPolicies(String apiName, List policies) { - return _iamSrv.isAPIAccessibleForPolicies(apiName, policies); - } - @Override public List getEffectivePolicies(Account caller, ControlledEntity entity) { diff --git a/services/iam/server/src/org/apache/cloudstack/iam/api/IAMService.java b/services/iam/server/src/org/apache/cloudstack/iam/api/IAMService.java index f85803b7b72..2d303d1493c 100644 --- a/services/iam/server/src/org/apache/cloudstack/iam/api/IAMService.java +++ b/services/iam/server/src/org/apache/cloudstack/iam/api/IAMService.java @@ -66,12 +66,14 @@ public interface IAMService { List listPolicyPermissionsByScope(long policyId, String action, String scope); - List listPollcyPermissionByEntityType(long policyId, String action, String entityType); + List listPolicyPermissionByEntityType(long policyId, String action, String entityType); - boolean isAPIAccessibleForPolicies(String apiName, List policies); + boolean isActionAllowedForPolicies(String action, List policies); List getGrantedEntities(long accountId, String action, String scope); AclPolicy resetAclPolicy(long aclPolicyId); + List listPolicyPermissionByAccessType(long policyId, String accessType, String entityType, String action); + } diff --git a/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java b/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java index 3696bb96d29..e6fcdcdca4f 100644 --- a/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java +++ b/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java @@ -601,9 +601,9 @@ public class IAMServiceImpl extends ManagerBase implements IAMService, Manager { } @Override - public boolean isAPIAccessibleForPolicies(String apiName, List policies) { + public boolean isActionAllowedForPolicies(String action, List policies) { - boolean accessible = false; + boolean allowed = false; List policyIds = new ArrayList(); for (AclPolicy policy : policies) { @@ -616,14 +616,15 @@ public class IAMServiceImpl extends ManagerBase implements IAMService, Manager { SearchCriteria sc = sb.create(); sc.setParameters("policyId", policyIds.toArray(new Object[policyIds.size()])); + sc.setParameters("action", action); List permissions = _policyPermissionDao.customSearch(sc, null); if (permissions != null && !permissions.isEmpty()) { - accessible = true; + allowed = true; } - return accessible; + return allowed; } @@ -664,13 +665,21 @@ public class IAMServiceImpl extends ManagerBase implements IAMService, Manager { } @Override - public List listPollcyPermissionByEntityType(long policyId, String action, String entityType) { + public List listPolicyPermissionByEntityType(long policyId, String action, String entityType) { List pp = _policyPermissionDao.listByPolicyActionAndEntity(policyId, action, entityType); List pl = new ArrayList(); pl.addAll(pp); return pl; } + @Override + public List listPolicyPermissionByAccessType(long policyId, String accessType, String entityType, String action) { + List pp = _policyPermissionDao.listByPolicyAccessAndEntity(policyId, accessType, entityType, action); + List pl = new ArrayList(); + pl.addAll(pp); + return pl; + } + @Override public AclPolicy getResourceOwnerPolicy() { return _aclPolicyDao.findByName("RESOURCE_OWNER"); diff --git a/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDao.java b/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDao.java index f2da895aa2f..5abadf948e8 100644 --- a/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDao.java +++ b/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDao.java @@ -33,6 +33,6 @@ public interface AclPolicyPermissionDao extends GenericDao listByPolicyActionAndEntity(long policyId, String action, String entityType); - List listByPolicyAccessAndEntity(long id, String accessType, String entityType); + List listByPolicyAccessAndEntity(long id, String accessType, String entityType, String action); } diff --git a/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDaoImpl.java b/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDaoImpl.java index d738e007e48..b014cb494fd 100644 --- a/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDaoImpl.java +++ b/services/iam/server/src/org/apache/cloudstack/iam/server/dao/AclPolicyPermissionDaoImpl.java @@ -104,11 +104,12 @@ public class AclPolicyPermissionDaoImpl extends GenericDaoBase listByPolicyAccessAndEntity(long policyId, String accessType, - String entityType) { + String entityType, String action) { SearchCriteria sc = fullSearch.create(); sc.setParameters("policyId", policyId); sc.setParameters("entityType", entityType); sc.setParameters("accessType", accessType); + sc.setParameters("action", action); return listBy(sc); }