import javax.jcr.Repository;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
-import javax.jcr.security.AccessControlList;
import javax.jcr.security.AccessControlManager;
-import javax.jcr.security.AccessControlPolicy;
-import javax.jcr.security.AccessControlPolicyIterator;
import javax.jcr.security.Privilege;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
import org.argeo.ArgeoException;
import org.argeo.jcr.JcrUtils;
import org.argeo.util.security.SimplePrincipal;
/** Apply authorizations to a JCR repository. */
public class JcrAuthorizations implements Runnable {
- private final static Log log = LogFactory.getLog(JcrAuthorizations.class);
+ // private final static Log log =
+ // LogFactory.getLog(JcrAuthorizations.class);
private Repository repository;
private String workspace = null;
+ private String securityWorkspace = "security";
+
/**
* key := privilege1,privilege2/path/to/node<br/>
* value := group1,group2,user1
private Map<String, String> principalPrivileges = new HashMap<String, String>();
public void run() {
+ String currentWorkspace = workspace;
+ Session session = null;
+ try {
+ if (workspace != null && workspace.equals("*")) {
+ session = repository.login();
+ String[] workspaces = session.getWorkspace()
+ .getAccessibleWorkspaceNames();
+ JcrUtils.logoutQuietly(session);
+ for (String wksp : workspaces) {
+ currentWorkspace = wksp;
+ if (currentWorkspace.equals(securityWorkspace))
+ continue;
+ session = repository.login(currentWorkspace);
+ initAuthorizations(session);
+ JcrUtils.logoutQuietly(session);
+ }
+ } else {
+ session = repository.login(workspace);
+ initAuthorizations(session);
+ }
+ } catch (Exception e) {
+ JcrUtils.discardQuietly(session);
+ throw new ArgeoException(
+ "Cannot set authorizations " + principalPrivileges
+ + " on workspace " + currentWorkspace, e);
+ } finally {
+ JcrUtils.logoutQuietly(session);
+ }
+ }
+
+ protected void processWorkspace(String workspace) {
Session session = null;
try {
session = repository.login(workspace);
initAuthorizations(session);
} catch (Exception e) {
JcrUtils.discardQuietly(session);
+ throw new ArgeoException("Cannot set authorizations "
+ + principalPrivileges + " on repository " + repository, e);
} finally {
JcrUtils.logoutQuietly(session);
}
for (String principalName : principalNames.split(",")) {
Principal principal = getOrCreatePrincipal(session,
principalName);
- addPrivileges(session, principal, path, privs);
+ JcrUtils.addPrivileges(session, path, principal, privs);
+ // if (log.isDebugEnabled()) {
+ // StringBuffer privBuf = new StringBuffer();
+ // for (Privilege priv : privs)
+ // privBuf.append(priv.getName());
+ // log.debug("Added privileges " + privBuf + " to "
+ // + principal.getName() + " on " + path + " in '"
+ // + session.getWorkspace().getName() + "'");
+ // }
}
}
- session.save();
+
+ // if (log.isDebugEnabled())
+ // log.debug("JCR authorizations applied on '"
+ // + session.getWorkspace().getName() + "'");
}
/**
return new SimplePrincipal(principalName);
}
- public static void addPrivileges(Session session, Principal principal,
- String path, List<Privilege> privs) throws RepositoryException {
- AccessControlManager acm = session.getAccessControlManager();
- // search for an access control list
- AccessControlList acl = null;
- AccessControlPolicyIterator policyIterator = acm
- .getApplicablePolicies(path);
- if (policyIterator.hasNext()) {
- while (policyIterator.hasNext()) {
- AccessControlPolicy acp = policyIterator
- .nextAccessControlPolicy();
- if (acp instanceof AccessControlList)
- acl = ((AccessControlList) acp);
- }
- } else {
- AccessControlPolicy[] existingPolicies = acm.getPolicies(path);
- for (AccessControlPolicy acp : existingPolicies) {
- if (acp instanceof AccessControlList)
- acl = ((AccessControlList) acp);
- }
- }
-
- if (acl != null) {
- acl.addAccessControlEntry(principal,
- privs.toArray(new Privilege[privs.size()]));
- acm.setPolicy(path, acl);
- if (log.isDebugEnabled()) {
- StringBuffer buf = new StringBuffer("");
- for (int i = 0; i < privs.size(); i++) {
- if (i != 0)
- buf.append(',');
- buf.append(privs.get(i).getName());
- }
- log.debug("Added privilege(s) '" + buf + "' to '"
- + principal.getName() + "' on " + path
- + " from workspace '"
- + session.getWorkspace().getName() + "'");
- }
- } else {
- throw new ArgeoException("Don't know how to apply privileges "
- + privs + " to " + principal + " on " + path
- + " from workspace '" + session.getWorkspace().getName()
- + "'");
- }
- }
+ // public static void addPrivileges(Session session, Principal principal,
+ // String path, List<Privilege> privs) throws RepositoryException {
+ // AccessControlManager acm = session.getAccessControlManager();
+ // // search for an access control list
+ // AccessControlList acl = null;
+ // AccessControlPolicyIterator policyIterator = acm
+ // .getApplicablePolicies(path);
+ // if (policyIterator.hasNext()) {
+ // while (policyIterator.hasNext()) {
+ // AccessControlPolicy acp = policyIterator
+ // .nextAccessControlPolicy();
+ // if (acp instanceof AccessControlList)
+ // acl = ((AccessControlList) acp);
+ // }
+ // } else {
+ // AccessControlPolicy[] existingPolicies = acm.getPolicies(path);
+ // for (AccessControlPolicy acp : existingPolicies) {
+ // if (acp instanceof AccessControlList)
+ // acl = ((AccessControlList) acp);
+ // }
+ // }
+ //
+ // if (acl != null) {
+ // acl.addAccessControlEntry(principal,
+ // privs.toArray(new Privilege[privs.size()]));
+ // acm.setPolicy(path, acl);
+ // session.save();
+ // if (log.isDebugEnabled()) {
+ // StringBuffer buf = new StringBuffer("");
+ // for (int i = 0; i < privs.size(); i++) {
+ // if (i != 0)
+ // buf.append(',');
+ // buf.append(privs.get(i).getName());
+ // }
+ // log.debug("Added privilege(s) '" + buf + "' to '"
+ // + principal.getName() + "' on " + path
+ // + " from workspace '"
+ // + session.getWorkspace().getName() + "'");
+ // }
+ // } else {
+ // throw new ArgeoException("Don't know how to apply privileges "
+ // + privs + " to " + principal + " on " + path
+ // + " from workspace '" + session.getWorkspace().getName()
+ // + "'");
+ // }
+ // }
@Deprecated
public void setGroupPrivileges(Map<String, String> groupPrivileges) {
this.workspace = workspace;
}
+ public void setSecurityWorkspace(String securityWorkspace) {
+ this.securityWorkspace = securityWorkspace;
+ }
+
}
projects / lgpl / argeo-commons.git / blobdiff