Package org.apache.jackrabbit.oak.exercise.security.authorization.models.readonly

Class ReadOnlyAuthorizationConfiguration

  • All Implemented Interfaces:
    org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration, org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
    public final class ReadOnlyAuthorizationConfiguration
extends org.apache.jackrabbit.oak.spi.security.ConfigurationBase
implements org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration

    Read Only Authorization Model

    This authorization module forms part of the training material provided by the oak-exercise module and must not be used in a productive environment!

    Overview

    This simplistic authorization model is limited to permission evaluation and doesn't support access control management. The permission evaluation is hardcoded to only allow read access to every single item in the repository (even access control content). All other permissions are denied for every set of principals. There exists a single exception to that rule: For the internal SystemPrincipal permission evaluation is not enforced by this module i.e. this module is skipped.

    Intended Usage

    This authorization model is intended to be used in 'AND' combination with the default authorization setup defined by Oak (and optionally additional models such as e.g. oak-authorization-cug. It is not intended to be used as standalone model as it would grant full read access to everyone.

    Limitations

    Experimental model for training purpose and not intended for usage in production.

    Key Features

    Access Control Management

    FeatureDescription
    Supported Privilegesall
    Supports Custom Privilegesyes
    Management by Pathnot supported
    Management by Principalsnot supported
    Owned PoliciesNone
    Effective Policies by Pathfor every path a single effective policy of type NamedAccessControlPolicy
    Effective Policies by Principalsfor every set of principals a single effective policy of type NamedAccessControlPolicy

    Permission Evaluation

    FeatureDescription
    Supported Permissionsall
    Aggregated Permission Provideryes

    Representation in the Repository

    There exists no dedicated access control or permission content for this authorization model as it doesn't persist any information into the repository. SecurityConfiguration.getContext() therefore returns the default.

    Configuration

    This model comes with a single mandatory configurable property: - configurationRanking : CompositeConfiguration.PARAM_RANKING, no default value.

    Installation Instructions

    The following steps are required to install this authorization model in an OSGi based Oak setup.
    • Upload the oak-exercise bundle
    • Edit configuration of 'ReadOnlyAuthorizationConfiguration' specifying the mandatory ranking property
    • Edit configuration of SecurityProviderRegistration
      • add org.apache.jackrabbit.oak.exercise.security.authorization.models.readonly.ReadOnlyAuthorizationConfiguration to the list of required service IDs
      • make sure the 'Authorization Composition Type' is set to AND
    • Wait for the SecurityProvider to be successfully registered again.

    • Nested Class Summary

      • Nested classes/interfaces inherited from interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration

        org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

    • Field Summary

      • Fields inherited from interface org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration

        NAME

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      @NotNull javax.jcr.security.AccessControlManager getAccessControlManager​(@NotNull org.apache.jackrabbit.oak.api.Root root, @NotNull org.apache.jackrabbit.oak.namepath.NamePathMapper namePathMapper)  
      @NotNull java.util.List<? extends org.apache.jackrabbit.oak.spi.commit.CommitHook> getCommitHooks​(@NotNull java.lang.String workspaceName)  
      @NotNull java.util.List<org.apache.jackrabbit.oak.spi.commit.ThreeWayConflictHandler> getConflictHandlers()  
      @NotNull org.apache.jackrabbit.oak.spi.security.Context getContext()  
      @NotNull java.lang.String getName()  
      @NotNull org.apache.jackrabbit.oak.spi.security.ConfigurationParameters getParameters()  
      @NotNull org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider getPermissionProvider​(@NotNull org.apache.jackrabbit.oak.api.Root root, @NotNull java.lang.String workspaceName, @NotNull java.util.Set<java.security.Principal> principals)  
      @NotNull java.util.List<org.apache.jackrabbit.oak.spi.xml.ProtectedItemImporter> getProtectedItemImporters()  
      @NotNull org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer getRepositoryInitializer()  
      @NotNull org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider getRestrictionProvider()  
      @NotNull java.util.List<? extends org.apache.jackrabbit.oak.spi.commit.ValidatorProvider> getValidators​(@NotNull java.lang.String workspaceName, @NotNull java.util.Set<java.security.Principal> principals, @NotNull org.apache.jackrabbit.oak.spi.commit.MoveTracker moveTracker)  
      @NotNull org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer getWorkspaceInitializer()  

      • Methods inherited from class org.apache.jackrabbit.oak.spi.security.ConfigurationBase

        getRootProvider, getSecurityProvider, getTreeProvider, setParameters, setRootProvider, setSecurityProvider, setTreeProvider

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

      • Methods inherited from interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration

        getMonitors

    • Constructor Detail

      • ReadOnlyAuthorizationConfiguration

        public ReadOnlyAuthorizationConfiguration()

    • Method Detail

      • getAccessControlManager

        @NotNull
public @NotNull javax.jcr.security.AccessControlManager getAccessControlManager​(@NotNull
                                                                                @NotNull org.apache.jackrabbit.oak.api.Root root,
                                                                                @NotNull
                                                                                @NotNull org.apache.jackrabbit.oak.namepath.NamePathMapper namePathMapper)
        Specified by:
        getAccessControlManager in interface org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration

      • getRestrictionProvider

        @NotNull
public @NotNull org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider getRestrictionProvider()
        Specified by:
        getRestrictionProvider in interface org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration

      • getPermissionProvider

        @NotNull
public @NotNull org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider getPermissionProvider​(@NotNull
                                                                                                                         @NotNull org.apache.jackrabbit.oak.api.Root root,
                                                                                                                         @NotNull
                                                                                                                         @NotNull java.lang.String workspaceName,
                                                                                                                         @NotNull
                                                                                                                         @NotNull java.util.Set<java.security.Principal> principals)
        Specified by:
        getPermissionProvider in interface org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration

      • getName

        @NotNull
public @NotNull java.lang.String getName()
        Specified by:
        getName in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getName in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getParameters

        @NotNull
public @NotNull org.apache.jackrabbit.oak.spi.security.ConfigurationParameters getParameters()
        Specified by:
        getParameters in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getParameters in class org.apache.jackrabbit.oak.spi.security.ConfigurationBase

      • getWorkspaceInitializer

        @NotNull
public @NotNull org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer getWorkspaceInitializer()
        Specified by:
        getWorkspaceInitializer in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getWorkspaceInitializer in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getRepositoryInitializer

        @NotNull
public @NotNull org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer getRepositoryInitializer()
        Specified by:
        getRepositoryInitializer in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getRepositoryInitializer in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getCommitHooks

        @NotNull
public @NotNull java.util.List<? extends org.apache.jackrabbit.oak.spi.commit.CommitHook> getCommitHooks​(@NotNull
                                                                                                         @NotNull java.lang.String workspaceName)
        Specified by:
        getCommitHooks in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getCommitHooks in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getValidators

        @NotNull
public @NotNull java.util.List<? extends org.apache.jackrabbit.oak.spi.commit.ValidatorProvider> getValidators​(@NotNull
                                                                                                               @NotNull java.lang.String workspaceName,
                                                                                                               @NotNull
                                                                                                               @NotNull java.util.Set<java.security.Principal> principals,
                                                                                                               @NotNull
                                                                                                               @NotNull org.apache.jackrabbit.oak.spi.commit.MoveTracker moveTracker)
        Specified by:
        getValidators in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getValidators in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getConflictHandlers

        @NotNull
public @NotNull java.util.List<org.apache.jackrabbit.oak.spi.commit.ThreeWayConflictHandler> getConflictHandlers()
        Specified by:
        getConflictHandlers in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getConflictHandlers in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getProtectedItemImporters

        @NotNull
public @NotNull java.util.List<org.apache.jackrabbit.oak.spi.xml.ProtectedItemImporter> getProtectedItemImporters()
        Specified by:
        getProtectedItemImporters in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getProtectedItemImporters in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default

      • getContext

        @NotNull
public @NotNull org.apache.jackrabbit.oak.spi.security.Context getContext()
        Specified by:
        getContext in interface org.apache.jackrabbit.oak.spi.security.SecurityConfiguration
        Overrides:
        getContext in class org.apache.jackrabbit.oak.spi.security.SecurityConfiguration.Default