etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Renaming plugin packages to 'iam' instead if 'acl'

This commit is contained in:
Prachi Damle 2014-02-19 17:08:58 -08:00
parent f41604fc6c
commit b2ba6c05b4
23 changed files with 850 additions and 841 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/AddAccountToAclGroupCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AddAccountToAclGroupCmd.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import java.util.List;
@ -22,7 +22,7 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -32,7 +32,7 @@ import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.AccountResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclGroup;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/AddAclPermissionToAclPolicyCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AddAclPermissionToAclPolicyCmd.java
View File

@ -14,14 +14,14 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -30,7 +30,7 @@ import org.apache.cloudstack.api.ApiErrorCode;
import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclPolicy;
import org.apache.cloudstack.iam.api.AclPolicyPermission.Permission;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/AttachAclPolicyToAccountCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AttachAclPolicyToAccountCmd.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import java.util.List;
@ -22,7 +22,7 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -32,7 +32,7 @@ import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.AccountResponse;
import org.apache.cloudstack.api.response.SuccessResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import com.cloud.event.EventTypes;

8
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/AttachAclPolicyToAclGroupCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AttachAclPolicyToAclGroupCmd.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import java.util.List;
@ -22,7 +22,7 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -31,8 +31,8 @@ import org.apache.cloudstack.api.ApiErrorCode;
import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclGroup;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/CreateAclGroupCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateAclGroupCmd.java
View File

@ -14,13 +14,13 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
import org.apache.cloudstack.api.ApiConstants;
@ -29,7 +29,7 @@ import org.apache.cloudstack.api.BaseAsyncCreateCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.DomainResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclGroup;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/CreateAclPolicyCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/CreateAclPolicyCmd.java
View File

@ -14,13 +14,13 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -30,7 +30,7 @@ import org.apache.cloudstack.api.BaseAsyncCreateCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.DomainResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclPolicy;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/DeleteAclGroupCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/DeleteAclGroupCmd.java
View File

@ -14,13 +14,13 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -30,7 +30,7 @@ import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.SuccessResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import com.cloud.event.EventTypes;
import com.cloud.user.Account;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/DeleteAclPolicyCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/DeleteAclPolicyCmd.java
View File

@ -14,13 +14,13 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -30,7 +30,7 @@ import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.SuccessResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import com.cloud.event.EventTypes;
import com.cloud.user.Account;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/ListAclGroupsCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/ListAclGroupsCmd.java
View File

@ -14,20 +14,20 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
import org.apache.cloudstack.api.ApiConstants;
import org.apache.cloudstack.api.BaseListDomainResourcesCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.response.ListResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
@APICommand(name = "listAclGroups", description = "Lists acl groups", responseObject = AclGroupResponse.class)

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/ListAclPoliciesCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/ListAclPoliciesCmd.java
View File

@ -14,20 +14,20 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
import org.apache.cloudstack.api.ApiConstants;
import org.apache.cloudstack.api.BaseListDomainResourcesCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.response.ListResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
@APICommand(name = "listAclPolicies", description = "Lists acl policies", responseObject = AclPolicyResponse.class)

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/RemoveAccountFromAclGroupCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/RemoveAccountFromAclGroupCmd.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import java.util.List;
@ -22,7 +22,7 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -32,7 +32,7 @@ import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.AccountResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclGroup;

6
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/RemoveAclPermissionFromAclPolicyCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/RemoveAclPermissionFromAclPolicyCmd.java
View File

@ -14,14 +14,14 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -30,7 +30,7 @@ import org.apache.cloudstack.api.ApiErrorCode;
import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclPolicy;

8
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/RemoveAclPolicyFromAccountCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/RemoveAclPolicyFromAccountCmd.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import java.util.List;
@ -22,7 +22,7 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -31,8 +31,8 @@ import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.SuccessResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import com.cloud.event.EventTypes;

8
services/iam/plugin/src/org/apache/cloudstack/api/command/acl/RemoveAclPolicyFromAclGroupCmd.java → services/iam/plugin/src/org/apache/cloudstack/api/command/iam/RemoveAclPolicyFromAclGroupCmd.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.command.acl;
package org.apache.cloudstack.api.command.iam;
import java.util.List;
@ -22,7 +22,7 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
@ -31,8 +31,8 @@ import org.apache.cloudstack.api.ApiErrorCode;
import org.apache.cloudstack.api.BaseAsyncCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.iam.api.AclGroup;

2
services/iam/plugin/src/org/apache/cloudstack/api/response/acl/AclGroupResponse.java → services/iam/plugin/src/org/apache/cloudstack/api/response/iam/AclGroupResponse.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.response.acl;
package org.apache.cloudstack.api.response.iam;
import java.util.LinkedHashSet;
import java.util.Set;

10
services/iam/plugin/src/org/apache/cloudstack/api/response/acl/AclPermissionResponse.java → services/iam/plugin/src/org/apache/cloudstack/api/response/iam/AclPermissionResponse.java
View File

@ -14,11 +14,11 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.response.acl;
package org.apache.cloudstack.api.response.iam;
import com.google.gson.annotations.SerializedName;
import org.apache.cloudstack.acl.AclEntityType;
import org.apache.cloudstack.acl.IAMEntityType;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.api.ApiConstants;
import org.apache.cloudstack.api.BaseResponse;
@ -34,7 +34,7 @@ public class AclPermissionResponse extends BaseResponse {
@SerializedName(ApiConstants.ENTITY_TYPE)
@Param(description = "the entity type of this permission")
private AclEntityType entityType;
private IAMEntityType entityType;
@SerializedName(ApiConstants.ACL_SCOPE)
@Param(description = "scope of this permission")
@ -48,11 +48,11 @@ public class AclPermissionResponse extends BaseResponse {
@Param(description = "allow or deny of this permission")
private AclPolicyPermission.Permission permission;
public AclEntityType getEntityType() {
public IAMEntityType getEntityType() {
return entityType;
}
public void setEntityType(AclEntityType entityType) {
public void setEntityType(IAMEntityType entityType) {
this.entityType = entityType;
}

2
services/iam/plugin/src/org/apache/cloudstack/api/response/acl/AclPolicyResponse.java → services/iam/plugin/src/org/apache/cloudstack/api/response/iam/AclPolicyResponse.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.api.response.acl;
package org.apache.cloudstack.api.response.iam;
import java.util.LinkedHashSet;
import java.util.Set;

168
services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiService.java → services/iam/plugin/src/org/apache/cloudstack/iam/AclApiService.java
View File

@ -1,84 +1,84 @@
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements. See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership. The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License. You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.acl.api;
import java.util.List;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.response.ListResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.iam.api.AclGroup;
import org.apache.cloudstack.iam.api.AclPolicy;
import org.apache.cloudstack.iam.api.AclPolicyPermission;
import org.apache.cloudstack.iam.api.AclPolicyPermission.Permission;
import com.cloud.user.Account;
import com.cloud.utils.component.PluggableService;
public interface AclApiService extends PluggableService {
/* ACL group related interfaces */
AclGroup createAclGroup(Account caller, String aclGroupName, String description);
boolean deleteAclGroup(Long aclGroupId);
List<AclGroup> listAclGroups(long accountId);
AclGroup addAccountsToGroup(List<Long> acctIds, Long groupId);
AclGroup removeAccountsFromGroup(List<Long> acctIds, Long groupId);
/* ACL Policy related interfaces */
AclPolicy createAclPolicy(Account caller, String aclPolicyName, String description, Long parentPolicyId);
boolean deleteAclPolicy(long aclPolicyId);
List<AclPolicy> listAclPolicies(long accountId);
AclGroup attachAclPoliciesToGroup(List<Long> policyIds, Long groupId);
AclGroup removeAclPoliciesFromGroup(List<Long> policyIds, Long groupId);
void attachAclPolicyToAccounts(Long policyId, List<Long> accountIds);
void removeAclPolicyFromAccounts(Long policyId, List<Long> accountIds);
AclPolicy addAclPermissionToAclPolicy(long aclPolicyId, String entityType, PermissionScope scope, Long scopeId,
String action, Permission perm, Boolean recursive);
AclPolicy removeAclPermissionFromAclPolicy(long aclPolicyId, String entityType, PermissionScope scope, Long scopeId, String action);
AclPolicyPermission getAclPolicyPermission(long accountId, String entityType, String action);
/* Utility routine to grant/revoke invidivual resource to list of accounts */
void grantEntityPermissioinToAccounts(String entityType, Long entityId, AccessType accessType, String action, List<Long> accountIds);
void revokeEntityPermissioinFromAccounts(String entityType, Long entityId, AccessType accessType, String action, List<Long> accountIds);
/* Response Generation */
AclPolicyResponse createAclPolicyResponse(AclPolicy policy);
AclGroupResponse createAclGroupResponse(AclGroup group);
ListResponse<AclGroupResponse> listAclGroups(Long aclGroupId, String aclGroupName,
Long domainId, Long startIndex, Long pageSize);
ListResponse<AclPolicyResponse> listAclPolicies(Long aclPolicyId, String aclPolicyName,
Long domainId, Long startIndex, Long pageSize);
}
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements. See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership. The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License. You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.iam;
import java.util.List;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.response.ListResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.iam.api.AclGroup;
import org.apache.cloudstack.iam.api.AclPolicy;
import org.apache.cloudstack.iam.api.AclPolicyPermission;
import org.apache.cloudstack.iam.api.AclPolicyPermission.Permission;
import com.cloud.user.Account;
import com.cloud.utils.component.PluggableService;
public interface AclApiService extends PluggableService {
/* ACL group related interfaces */
AclGroup createAclGroup(Account caller, String aclGroupName, String description);
boolean deleteAclGroup(Long aclGroupId);
List<AclGroup> listAclGroups(long accountId);
AclGroup addAccountsToGroup(List<Long> acctIds, Long groupId);
AclGroup removeAccountsFromGroup(List<Long> acctIds, Long groupId);
/* ACL Policy related interfaces */
AclPolicy createAclPolicy(Account caller, String aclPolicyName, String description, Long parentPolicyId);
boolean deleteAclPolicy(long aclPolicyId);
List<AclPolicy> listAclPolicies(long accountId);
AclGroup attachAclPoliciesToGroup(List<Long> policyIds, Long groupId);
AclGroup removeAclPoliciesFromGroup(List<Long> policyIds, Long groupId);
void attachAclPolicyToAccounts(Long policyId, List<Long> accountIds);
void removeAclPolicyFromAccounts(Long policyId, List<Long> accountIds);
AclPolicy addAclPermissionToAclPolicy(long aclPolicyId, String entityType, PermissionScope scope, Long scopeId,
String action, Permission perm, Boolean recursive);
AclPolicy removeAclPermissionFromAclPolicy(long aclPolicyId, String entityType, PermissionScope scope, Long scopeId, String action);
AclPolicyPermission getAclPolicyPermission(long accountId, String entityType, String action);
/* Utility routine to grant/revoke invidivual resource to list of accounts */
void grantEntityPermissioinToAccounts(String entityType, Long entityId, AccessType accessType, String action, List<Long> accountIds);
void revokeEntityPermissioinFromAccounts(String entityType, Long entityId, AccessType accessType, String action, List<Long> accountIds);
/* Response Generation */
AclPolicyResponse createAclPolicyResponse(AclPolicy policy);
AclGroupResponse createAclGroupResponse(AclGroup group);
ListResponse<AclGroupResponse> listAclGroups(Long aclGroupId, String aclGroupName,
Long domainId, Long startIndex, Long pageSize);
ListResponse<AclPolicyResponse> listAclPolicies(Long aclPolicyId, String aclPolicyName,
Long domainId, Long startIndex, Long pageSize);
}

1378
services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiServiceImpl.java → services/iam/plugin/src/org/apache/cloudstack/iam/AclApiServiceImpl.java
View File

File diff suppressed because it is too large Load Diff

14
services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedAPIAccessChecker.java → services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedAPIAccessChecker.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.acl;
package org.apache.cloudstack.iam;
import java.util.HashMap;
import java.util.HashSet;
@ -28,6 +28,10 @@ import javax.naming.ConfigurationException;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.APIChecker;
import org.apache.cloudstack.acl.IAMEntityType;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.RoleType;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.BaseAsyncCreateCmd;
@ -129,9 +133,9 @@ public class RoleBasedAPIAccessChecker extends AdapterBase implements APIChecker
// add permissions for public templates
List<VMTemplateVO> pTmplts = _templateDao.listByPublic();
for (VMTemplateVO tmpl : pTmplts){
_iamSrv.addAclPermissionToAclPolicy(new Long(Account.ACCOUNT_TYPE_DOMAIN_ADMIN + 1), AclEntityType.VirtualMachineTemplate.toString(),
_iamSrv.addAclPermissionToAclPolicy(new Long(Account.ACCOUNT_TYPE_DOMAIN_ADMIN + 1), IAMEntityType.VirtualMachineTemplate.toString(),
PermissionScope.RESOURCE.toString(), tmpl.getId(), "listTemplates", AccessType.UseEntry.toString(), Permission.Allow, false);
_iamSrv.addAclPermissionToAclPolicy(new Long(Account.ACCOUNT_TYPE_NORMAL + 1), AclEntityType.VirtualMachineTemplate.toString(),
_iamSrv.addAclPermissionToAclPolicy(new Long(Account.ACCOUNT_TYPE_NORMAL + 1), IAMEntityType.VirtualMachineTemplate.toString(),
PermissionScope.RESOURCE.toString(), tmpl.getId(), "listTemplates", AccessType.UseEntry.toString(), Permission.Allow, false);
}
@ -214,7 +218,7 @@ public class RoleBasedAPIAccessChecker extends AdapterBase implements APIChecker
private void addDefaultAclPolicyPermission(String apiName, Class<?> cmdClass, RoleType role) {
AccessType accessType = null;
AclEntityType[] entityTypes = null;
IAMEntityType[] entityTypes = null;
if (cmdClass != null) {
BaseCmd cmdObj;
try {
@ -258,7 +262,7 @@ public class RoleBasedAPIAccessChecker extends AdapterBase implements APIChecker
_iamSrv.addAclPermissionToAclPolicy(policyId, null, permissionScope.toString(), new Long(AclPolicyPermission.PERMISSION_SCOPE_ID_CURRENT_CALLER),
apiName, (accessType == null) ? null : accessType.toString(), Permission.Allow, false);
} else {
for (AclEntityType entityType : entityTypes) {
for (IAMEntityType entityType : entityTypes) {
_iamSrv.addAclPermissionToAclPolicy(policyId, entityType.toString(), permissionScope.toString(), new Long(AclPolicyPermission.PERMISSION_SCOPE_ID_CURRENT_CALLER),
apiName, (accessType == null) ? null : accessType.toString(), Permission.Allow, false);
}

5
services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityAccessChecker.java → services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityAccessChecker.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.acl;
package org.apache.cloudstack.iam;
import java.util.ArrayList;
import java.util.HashMap;
@ -24,6 +24,9 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.ControlledEntity;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.SecurityChecker;
import org.apache.cloudstack.api.InternalIdentity;
import org.apache.cloudstack.iam.api.AclGroup;
import org.apache.cloudstack.iam.api.AclPolicy;

4
services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityQuerySelector.java → services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityQuerySelector.java
View File

@ -14,7 +14,7 @@
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.acl;
package org.apache.cloudstack.iam;
import java.util.ArrayList;
import java.util.List;
@ -23,6 +23,8 @@ import javax.inject.Inject;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.PermissionScope;
import org.apache.cloudstack.acl.QuerySelector;
import org.apache.cloudstack.iam.api.AclGroup;
import org.apache.cloudstack.iam.api.AclPolicy;
import org.apache.cloudstack.iam.api.AclPolicyPermission;

18
services/iam/plugin/test/org/apache/cloudstack/acl/AclApiServiceTest.java
View File

@ -35,13 +35,13 @@ import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
import org.springframework.test.context.support.AnnotationConfigContextLoader;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.acl.api.AclApiService;
import org.apache.cloudstack.acl.api.AclApiServiceImpl;
import org.apache.cloudstack.iam.AclApiService;
import org.apache.cloudstack.iam.AclApiServiceImpl;
import org.apache.cloudstack.api.command.user.vm.ListVMsCmd;
import org.apache.cloudstack.api.response.ListResponse;
import org.apache.cloudstack.api.response.acl.AclGroupResponse;
import org.apache.cloudstack.api.response.acl.AclPermissionResponse;
import org.apache.cloudstack.api.response.acl.AclPolicyResponse;
import org.apache.cloudstack.api.response.iam.AclGroupResponse;
import org.apache.cloudstack.api.response.iam.AclPermissionResponse;
import org.apache.cloudstack.api.response.iam.AclPolicyResponse;
import org.apache.cloudstack.context.CallContext;
import org.apache.cloudstack.framework.messagebus.MessageBus;
import org.apache.cloudstack.iam.api.AclGroup;
@ -273,12 +273,12 @@ public class AclApiServiceTest {
Class clz = ListVMsCmd.class;
when(_apiServer.getCmdClass("listVirtualMachines")).thenReturn(clz);
when(
_iamSrv.addAclPermissionToAclPolicy(policyId, AclEntityType.VirtualMachine.toString(), PermissionScope.RESOURCE.toString(), resId, "listVirtualMachines",
_iamSrv.addAclPermissionToAclPolicy(policyId, IAMEntityType.VirtualMachine.toString(), PermissionScope.RESOURCE.toString(), resId, "listVirtualMachines",
AccessType.UseEntry.toString(), Permission.Allow, false)).thenReturn(policy);
_aclSrv.addAclPermissionToAclPolicy(policyId, AclEntityType.VirtualMachine.toString(), PermissionScope.RESOURCE, resId, "listVirtualMachines", Permission.Allow, false);
_aclSrv.addAclPermissionToAclPolicy(policyId, IAMEntityType.VirtualMachine.toString(), PermissionScope.RESOURCE, resId, "listVirtualMachines", Permission.Allow, false);
Pair<List<AclPolicy>, Integer> policyList = new Pair<List<AclPolicy>, Integer>(policies, 1);
List<AclPolicyPermission> policyPerms = new ArrayList<AclPolicyPermission>();
AclPolicyPermission perm = new AclPolicyPermissionVO(policyId, "listVirtualMachines", AclEntityType.VirtualMachine.toString(), AccessType.UseEntry.toString(),
AclPolicyPermission perm = new AclPolicyPermissionVO(policyId, "listVirtualMachines", IAMEntityType.VirtualMachine.toString(), AccessType.UseEntry.toString(),
PermissionScope.RESOURCE.toString(),
resId, Permission.Allow, false);
policyPerms.add(perm);
@ -294,7 +294,7 @@ public class AclApiServiceTest {
//remove permission from policy
policyPerms.remove(perm);
_aclSrv.removeAclPermissionFromAclPolicy(policyId, AclEntityType.VirtualMachine.toString(), PermissionScope.RESOURCE, resId, "listVirtualMachines");
_aclSrv.removeAclPermissionFromAclPolicy(policyId, IAMEntityType.VirtualMachine.toString(), PermissionScope.RESOURCE, resId, "listVirtualMachines");
policyResp = _aclSrv.listAclPolicies(null, "policy1", callerDomainId, 0L, 20L);
assertTrue("No. of response items should be one", policyResp.getCount() == 1);
resp = policyResp.getResponses().get(0);