Commit Graph

66 Commits

Author SHA1 Message Date
Min Chen e6ead3176c CLOUDSTACK-7175:Domain Id is exposed in error message when cross domain
access is attempted when listing Vms.
2014-07-23 17:36:15 -07:00
Min Chen ba848087f8 Disable IAM feature from 4.4 release. 2014-05-22 18:27:08 -07:00
Prachi Damle 9514c9e045 CLOUDSTACK-6349: IAM - No error message presented to the user , when
invalid password is provided.

- AccountManager now works using accountId instead of accountType in
following methods too:
- isResourceDomainAdmin()
- isAdmin()
2014-04-28 11:10:50 -07:00
Min Chen da13165743 Change AccountManagerImpl.checkAccess to invoke SecurityChecker
interface that takes multiple controlled entities.
2014-04-17 17:53:01 -07:00
Prachi Damle 897e0d3abe SecurityChecker can accept multiple ControlledEntity 2014-04-04 16:38:29 -07:00
Prachi Damle c3ee01cca1 More changes to support 'readOnly' access 2014-03-19 11:00:23 -07:00
Prachi Damle 36c0a4e2c3 Removed the AccessType.UseNetwork - replaced all referrences by AccessType.UseEntry 2014-03-13 15:32:38 -07:00
Min Chen 586ee74000 Clean up SecurityChecker.AccessType and modify code to use them
consistently.
2014-02-14 11:23:05 -08:00
Prachi Damle f84375442e Merge branch 'master' into rbac
Conflicts:
	api/src/org/apache/cloudstack/api/command/user/autoscale/ListAutoScaleVmProfilesCmd.java
	api/src/org/apache/cloudstack/api/command/user/volume/ResizeVolumeCmd.java
	plugins/network-elements/juniper-contrail/test/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
	server/src/com/cloud/api/ApiServer.java
	server/src/com/cloud/api/query/QueryManagerImpl.java
	server/src/com/cloud/template/TemplateAdapterBase.java
	setup/db/db/schema-430to440.sql
	tools/apidoc/gen_toc.py
2014-02-04 12:07:32 -08:00
Daan Hoogland 44bc2beb14 findbugs: null-checks(cherry picked from commit
c58e509924)
2014-01-28 15:44:04 +01:00
Min Chen 929fbabaa2 Merge branch 'master' into rbac. 2014-01-17 14:37:08 -08:00
Prachi Damle 1a985227b5 Changes to SecurityChecker 2013-12-12 16:30:53 -08:00
Alex Huang d620df2bdd Reformatted all of the code. 2013-11-21 06:15:26 -08:00
Alex Huang 224f479974 Removed trailing spaces 2013-11-21 04:08:01 -08:00
Prachi Damle e0d2423f06 Refactoring account_type for Domain_Admin and Normal_User types 2013-11-20 16:53:59 -08:00
Alex Huang 8d62744681 Reformat all source code. Added checkstyle to check the source code 2013-11-20 07:26:53 -08:00
Prachi Damle aba54356d5 Account_Type Refactoring for Root Admin Role
- change the AccountService::isRootAdmin(short) to  isRootAdmin(long accountId);
- Change all callers
- Change all places that check the account.getType() directly to call the AccountManagerImpl.
2013-09-24 15:31:09 -07:00
Prachi Damle 6a0bda0280 CLOUDSTACK-4337 Dedicated Resources: Zone dedicated to an account should only be visible and accessible to that account
Changes:
- When listing a zone, add clause in the search to check the account_id for a dedicated zone
- When listsing a zone with a domainid, add a similar clause.
- DomainCheck:: checkAccess() for a zone should consider that zone can now be dediacted to a specific account and check access accordingly.

Conflicts:

	server/src/com/cloud/api/query/vo/DataCenterJoinVO.java
	setup/db/db/schema-410to420.sql
2013-09-03 20:02:59 -07:00
Prachi Damle ef22b42b38 CLOUDSTACK-4221: Dedicated Resources: changes to associate the dedicated resource with the 'ExplicitDedication' affinity group
Changes:
- Implict creation of the 'ExplicitDedication' Affinity group during resource dedication
- Only one group per account or per domain will be present
- ListDedicatedResources by affinityGroup
- Deployment should consider dedicated resources associated to the group only
- Deleting affinity group should release the dedicated resouces
- Releasing the dedicated resources should remove the group associated if there are no more resources.

Conflicts:

	plugins/dedicated-resources/src/org/apache/cloudstack/dedicated/DedicatedResourceManagerImpl.java
	plugins/dedicated-resources/test/org/apache/cloudstack/dedicated/manager/DedicatedApiUnitTest.java
	server/src/com/cloud/configuration/ConfigurationManagerImpl.java
2013-09-03 20:02:38 -07:00
Prachi Damle a06bd9fa2b CLOUDSTACK-4168 Root Admin should be able to create 'ExplicitDedication' affinity group at domain level and make it available for all accounts in the domain
Changes:
- 'ExcplicitDedication' type of group can be created/deleted by Root admin only
- Users can no longer create this type of affinity group
- RootAdmin can create this type of affinitygroup at domain level. Such a domain level group is available for all accounts in that domain for listing and for use during deployVM.
- The domain level affinitygroup should be visible to the users in that domain, domain admins and Root admin.

Conflicts:

	server/src/com/cloud/api/query/QueryManagerImpl.java
	server/src/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java
	server/test/org/apache/cloudstack/affinity/AffinityApiUnitTest.java
2013-09-03 20:02:34 -07:00
Likitha Shetty 9c5da1c6e3 CLOUDSTACK-3361. [Projects] Allow a normal user to edit public templates created by him. 2013-07-05 16:21:47 +05:30
Alena Prokharchyk 77fd76acb4 CLOUDSTACK-3242: fixed updateTemplate and updateTemplate permissions security checks for project based templates 2013-06-27 11:32:41 -07:00
Alex Huang 10d9c019a9 All merge conflicts resolved 2013-01-18 12:14:57 -08:00
Chiradeep Vittal cadca5fc0c Merge branch 'master' into network-refactor-merge2
Conflicts:
	api/src/com/cloud/network/NetworkService.java
	api/src/com/cloud/network/element/RemoteAccessVPNServiceProvider.java
	plugins/network-elements/nicira-nvp/src/com/cloud/network/element/NiciraNvpElement.java
	server/src/com/cloud/acl/DomainChecker.java
	server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java
	server/src/com/cloud/network/NetworkManager.java
	server/src/com/cloud/network/NetworkManagerImpl.java
	server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
	server/src/com/cloud/vm/UserVmManagerImpl.java
	server/test/com/cloud/network/MockNetworkManagerImpl.java
	server/test/com/cloud/vpc/MockNetworkManagerImpl.java
2013-01-16 19:17:14 -08:00
Kelven Yang 0bcebd33b6 Fix problems after merge 2013-01-09 17:36:53 -08:00
Chiradeep Vittal 5a830c4db0 Network-refactor: Refactor NetworkManager into NetworkModel and NetworkManager.
NetworkManager's exclusive focus is now
 - handling plugins during orchestration, and
 - to deal with ip address allocation.
Those classes that used to refer to NetworkManager to get access to the datamodel now refer to NetworkModel

Signed-off-by: Chiradeep Vittal <chiradeep@apache.org>
2013-01-09 15:49:01 -08:00
Alex Huang 30f2565d98 Merge branch 'api_refactoring' into javelin 2013-01-08 12:36:04 -08:00
Rohit Yadav ed0637b8c2 api: Refactor move acl to org.apache.cloudstack
Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2013-01-06 15:30:58 -08:00
Rohit Yadav 21d6cd304b server: Reformat DomainChecker
Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2013-01-05 17:00:13 -08:00
Rohit Yadav bc8e0af0a3 plugin: ACL Static Role Based api access checker
Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2013-01-02 17:06:19 -08:00
Rohit Yadav d235859168 Fix PluggableService to provide interface for ACL adapters etc. to get configs
- Fix interface to return array of strings, or filenames
- Fix StaticRoleBased ACL adapter to process config files by going through all pluggable services
- Refactor interface names

Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2013-01-02 16:29:39 -08:00
Rohit Yadav 6ce68b93cc api: Fix APIAccessChecker and StaticRoleBasedAPIAccessChecker
- Add getCmd api interface in APIAccessChecker adapter to get cmd properties
- Add mechanism in StaticRoleBasedAPIAccessChecker to get config properties
- Add public interface to get the cmd properties for the adapter impl

Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2012-12-11 14:10:36 -08:00
Rohit Yadav 2146687112 api: initialize vars in constructor of StaticRoleBasedAPIAccessChecker
Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2012-12-10 17:28:06 -08:00
Rohit Yadav 293665fafb api: Add license headers for APIAccessChecker and StaticRoleBasedAPIAccessChecker
- Fix license headers
- Fix tabs, trailing whitespaces

Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2012-12-10 15:29:33 -08:00
Rohit Yadav 6fc3bc3760 api_refactor: refactor vpn and vm apis
- Refactor VPN and VM APIs to admin and user pkgs
- Names space, org.apache.cloudstack
- Fix refactored apis in commands*.in
- Fix comments etc.
- Expand tabs, remove trailing whitespace

Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2012-12-03 21:27:02 -08:00
Prachi Damle a2306f4917 some more poc work 2012-11-29 16:10:09 -08:00
Kelven Yang cea8f3bf37 Switch inject annotation to javax and let ComponentLocator to recognize both the new and original inject annotation 2012-11-07 15:03:22 -08:00
Kelven Yang aab02e2743 Add Spring annotation to major components 2012-11-07 14:53:39 -08:00
David Nalley e87558256c Patch from Chip Childers
https://reviews.apache.org/r/5704/
License header updates for the server folder
2012-07-02 09:51:21 -04:00
frank 2f634c0913 Switch to Apache license 2012-04-03 04:50:05 -07:00
prachi c2570b9e7d Bug 14482 - When user tries to delete an acquired Ip address ,right after this is successful, UI calls listRemoteAccessVpns() which results in java.lang.NullPointerException.User is presented with "Internal error executing command" error
Reviewed-By: Sheng

Changes:
- Added the null check for account object.
2012-03-26 14:43:49 -07:00
Alena Prokharchyk e73a23e8c0 bug 14271: return only domainId in error message when caller is not authorized to operate within the domain
status 14271: resolved fixed
2012-03-14 13:31:43 -07:00
Alena Prokharchyk cfea031b28 Fixed deploy vm for Project in private zone 2012-02-01 11:03:12 -08:00
Alena Prokharchyk ba826ddc21 Fixed listing public IP addresses 2012-01-20 11:34:54 -08:00
Alena Prokharchyk 57ddf63676 Special permission check for networks 2012-01-20 11:01:38 -08:00
Alena Prokharchyk c581506103 bug 12306: list* command revamp 2012-01-09 10:07:42 -08:00
alena 25c2734e03 More stuff to Projects feature - added support for adding resources (vms, templates, isos) to the project 2011-10-05 13:24:25 -07:00
alena ccd47c1b21 Implemented Project Invitations 2011-09-26 17:47:20 -07:00
alena 5c35b7f164 1) Resource limits for Projects
2) Security checker for Projects
2011-09-22 18:10:35 -07:00
alena e3f179844e bug 11236: domainAdmin/regularUser can edit/delete/copy/extract Public template/iso only if it was created by them. They still can use/see public template/iso when execute list/deploy/attachIso commands. Root admin can operate with other people templates w/o any restrictions.
status 11236: resolved fixed
2011-08-24 14:48:35 -07:00