1 package org.apache.archiva.security;
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22 import org.apache.archiva.redback.rbac.RBACManager;
23 import org.apache.archiva.redback.rbac.RbacManagerException;
24 import org.apache.archiva.redback.system.check.EnvironmentCheck;
25 import org.apache.archiva.security.common.ArchivaRoleConstants;
26 import org.slf4j.Logger;
27 import org.slf4j.LoggerFactory;
28 import org.springframework.stereotype.Service;
29
30 import javax.inject.Inject;
31 import javax.inject.Named;
32 import java.util.List;
33
34
35
36
37 @Service("environmentCheck#archiva-required-roles")
38 public class ArchivaStandardRolesCheck
39 implements EnvironmentCheck
40 {
41 private Logger log = LoggerFactory.getLogger( ArchivaStandardRolesCheck.class );
42
43
44
45
46 @Inject
47 @Named(value = "rbacManager#cached")
48 private RBACManager rbacManager;
49
50
51
52
53 private boolean checked = false;
54
55 @Override
56 public void validateEnvironment( List<String> violations )
57 {
58 if ( !checked )
59 {
60 String expectedRoles[] = new String[]{ ArchivaRoleConstants.SYSTEM_ADMINISTRATOR_ROLE,
61 ArchivaRoleConstants.GLOBAL_REPOSITORY_MANAGER_ROLE,
62 ArchivaRoleConstants.GLOBAL_REPOSITORY_OBSERVER_ROLE, ArchivaRoleConstants.GUEST_ROLE,
63 ArchivaRoleConstants.REGISTERED_USER_ROLE, ArchivaRoleConstants.USER_ADMINISTRATOR_ROLE };
64
65 log.info( "Checking the existance of required roles." );
66
67 for ( String roleName : expectedRoles )
68 {
69 try
70 {
71 if ( !rbacManager.roleExists( roleName ) )
72 {
73 violations.add( "Unable to validate the existances of the '" + roleName + "' role." );
74 }
75 }
76 catch ( RbacManagerException e )
77 {
78 log.warn( "fail to verify existence of role '{}'", roleName );
79 violations.add( "Unable to validate the existances of the '" + roleName + "' role." );
80 }
81 }
82
83 String expectedOperations[] = new String[]{ ArchivaRoleConstants.OPERATION_MANAGE_USERS,
84 ArchivaRoleConstants.OPERATION_MANAGE_CONFIGURATION, ArchivaRoleConstants.OPERATION_REGENERATE_INDEX,
85 ArchivaRoleConstants.OPERATION_RUN_INDEXER, ArchivaRoleConstants.OPERATION_ACCESS_REPORT,
86 ArchivaRoleConstants.OPERATION_ADD_REPOSITORY, ArchivaRoleConstants.OPERATION_DELETE_REPOSITORY,
87 ArchivaRoleConstants.OPERATION_REPOSITORY_ACCESS, ArchivaRoleConstants.OPERATION_EDIT_REPOSITORY,
88 ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD, ArchivaRoleConstants.OPERATION_REPOSITORY_ACCESS,
89 "archiva-guest" };
90
91 log.info( "Checking the existance of required operations." );
92
93 for ( String operation : expectedOperations )
94 {
95 if ( !rbacManager.operationExists( operation ) )
96 {
97 violations.add( "Unable to validate the existances of the '" + operation + "' operation." );
98 }
99 }
100
101 checked = true;
102 }
103
104 }
105
106 }