Package ome.security

Class SecuritySystemHolder

    • Method Detail

      • disable

        public void disable​(java.lang.String... ids)
        Description copied from interface: SecuritySystem
        disables components of the backend for the current Thread. Further checks to SecuritySystem.isDisabled(String) will return false. It is the responsibility of various security system components to then throw exceptions.
        Specified by:
        disable in interface SecuritySystem
        Parameters:
        ids - Non-null, non-empty array of String ids to disable.

      • enable

        public void enable​(java.lang.String... ids)
        Description copied from interface: SecuritySystem
        enables components of the backend for the current Thread. Further checks to SecuritySystem.isDisabled(String) will return true.
        Specified by:
        enable in interface SecuritySystem
        Parameters:
        ids - possibly null array of String ids. A null array specifies that all subsystems are to be enabled. Otherwise, only those subsystems specified by the ids.

      • getEventContext

        public ome.system.EventContext getEventContext​(boolean refresh)
        Description copied from interface: SecuritySystem
        If refresh is false, returns the current EventContext stored in the session. Otherwise, reloads the context to have the most up-to-date information.
        Specified by:
        getEventContext in interface SecuritySystem
        Parameters:
        refresh - if the event context should first be reloaded
        Returns:
        the event context
        See Also:
        Trac ticket #4011

      • getEffectiveUID

        public java.lang.Long getEffectiveUID()
        Description copied from interface: SecuritySystem
        Returns UID based on whether a share is active, etc. This is the UID value that should be used for writing data. The return value may be null if the user is currently querying across multiple contents. In this case another method for choosing the UID must be chosen, for example by taking the UID of another element under consideration. For example, 
         Annotation toSave = ...;
 if (toSave.getDetails().getOwner() == null) // No owner need to find one.
 {
     Long uid = sec.getEffectiveUID();
     if (uid != null)
     {
         toSave.getDetails().setOwner(new Experimenter(uid, false));
     }
     else
     {
         toSave.getDetails().setOwner(
            image.getDetails().getOwner()); // may be null.
     }
 }
 image.linkAnnotation(toSave);
 etc.
        Specified by:
        getEffectiveUID in interface SecuritySystem
        Returns:
        the effective user ID

      • checkRestriction

        public void checkRestriction​(java.lang.String name,
                             ome.model.IObject obj)
        Description copied from interface: SecuritySystem
        Checks whether or not a Policy instance of matching name has been registered, considers itself active, and considers the passed context object to be restricted.
        Specified by:
        checkRestriction in interface SecuritySystem
        Parameters:
        name - A non-null unique name for a class of policies.
        obj - An instance which is to be checked against matching policies.

      • isDisabled

        public boolean isDisabled​(java.lang.String id)
        Description copied from interface: SecuritySystem
        checks if the listed id is disabled for the current Thread.
        Specified by:
        isDisabled in interface SecuritySystem
        Parameters:
        id - non-null String representing a backend subsystem.
        Returns:
        true if the backend subsystem has been previously disabled by calls to SecuritySystem.disable(String[])

      • isReady

        public boolean isReady()
        Description copied from interface: SecuritySystem
        checks if this SecuritySystem instance is in a valid state. This includes that a user is properly logged in and that a connection is available to all necessary resources, e.g. database handle and mapping session. Not all methods require that the instance is ready.
        Specified by:
        isReady in interface SecuritySystem
        Returns:
        true if all methods on this interface are ready to be called.

      • isSystemType

        public boolean isSystemType​(java.lang.Class<? extends ome.model.IObject> klass)
        Description copied from interface: SecuritySystem
        checks if instances of the given type are "System-Types". Security logic for all system types is significantly different. In general, system types cannot be created, updated, or deleted by regular users, and are visible to all users.
        Specified by:
        isSystemType in interface SecuritySystem
        Parameters:
        klass - A class which extends from IObject
        Returns:
        true if instances of the class argument can be considered system types.

      • loadEventContext

        public void loadEventContext​(boolean isReadOnly)
        Description copied from interface: SecuritySystem
        Prepares the current EventContext instance with the current Principal. An exception is thrown if there is none.
        Specified by:
        loadEventContext in interface SecuritySystem

      • login

        public void login​(ome.system.Principal principal)
        Description copied from interface: SecuritySystem
        stores this Principal instance in the current thread context for authenticating and authorizing all actions. This method does not make any queries and is only a conduit for login information from the outermost levels. Session bean implementations and other in-JVM clients can fill the Principal. Note, however, a call must first be made to SecuritySystem.loadEventContext(boolean) for some calls to be made to the SecuritySystem. In general, this means that execution must pass through the EventHandler
        Specified by:
        login in interface SecuritySystem
        Parameters:
        principal - the new current principal

      • logout

        public int logout()
        Description copied from interface: SecuritySystem
        clears the top Principal instance from the current thread context.
        Specified by:
        logout in interface SecuritySystem
        Returns:
        the number of remaining instances.

      • runAsAdmin

        public void runAsAdmin​(ome.model.meta.ExperimenterGroup group,
                       AdminAction action)
        Description copied from interface: SecuritySystem
        Allows actions to be performed with the EventContext.isCurrentUserAdmin() flag enabled but without changing the value of EventContext.getCurrentUserId(), so that ownerships are properly handled. The merging of detached entity graphs should be disabled for the extent of the execution. Due to the addition of the group permission system, we also permit setting the group on the call so that the administrator can work within all groups. A value of null will not change the current group. Note: the IUpdate save methods should not be used, since they also accept detached entities, which could pose security risks. Instead load an entity from the database via IQuery, make changes, and save the changes with IUpdate.
        Specified by:
        runAsAdmin in interface SecuritySystem
        Parameters:
        group - the group to run the action as
        action - the action to run

      • isGraphCritical

        public boolean isGraphCritical​(ome.model.internal.Details details)
        Description copied from interface: SecuritySystem
        Determines if the current security context has the possibility of corrupting consistent graphs. Consistent graphs are enforced by the security context to make sure that all READ actions work smoothly. If an administrator or PI is logged into a private group, or otherwise may create an object linked to an object with lower READ rights, then corruption could occur. Starting with 4.4.2, a trusted details object should be passed in order to handle the situation where the current group id is -1. Possibles cases that can occur: 
          The current group is non-negative, then use the previous logic;
  else the current group is negative,
     and the object is in a non-"user" group: USE THAT GROUP;
     else the object is in the "user" group: UNCLEAR
     (for the moment we're throwing an exception)
        If no Details instance is passed or a Details without a ExperimenterGroup value, then throw as well.
        Specified by:
        isGraphCritical in interface SecuritySystem
        Parameters:
        details - the details
        Returns:
        if the graph is critical
        See Also:
        1769,