com.michelin.cio.hudson.plugins.rolestrategy

Class RoleBasedAuthorizationStrategy

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.AuthorizationStrategy>

hudson.security.AuthorizationStrategy

com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.AuthorizationStrategy>

public class RoleBasedAuthorizationStrategy
extends hudson.security.AuthorizationStrategy

Role-based authorization strategy.

Author:

Thomas Maurel

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	RoleBasedAuthorizationStrategy.ConverterImpl Converter used to persist and retrieve the strategy from disk.
static class	RoleBasedAuthorizationStrategy.DescriptorImpl Descriptor used to bind the strategy to the Web forms.

Nested classes/interfaces inherited from class hudson.security.AuthorizationStrategy

hudson.security.AuthorizationStrategy.Unsecured

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
static RoleBasedAuthorizationStrategy.DescriptorImpl	DESCRIPTOR
static String	GLOBAL
static String	MACRO_ROLE
static String	MACRO_USER
static String	PROJECT
static String	SLAVE

Fields inherited from class hudson.security.AuthorizationStrategy

LIST, UNSECURED

Constructor Summary

Constructors

Constructor and Description
RoleBasedAuthorizationStrategy()

Method Summary

Modifier and Type	Method and Description
void	doAddRole(String type, String roleName, String permissionIds, String overwrite, String pattern) API method to add roles
void	doAssignRole(String type, String roleName, String sid) API method to assign SID to role.
void	doDeleteSid(String type, String sid) API method to delete a SID from all granted roles.
void	doRemoveRoles(String type, String roleNames) API method to remove roles.
hudson.security.ACL	getACL(hudson.model.AbstractItem project)
hudson.security.ACL	getACL(hudson.model.Computer computer)
hudson.security.ACL	getACL(hudson.model.Job<?,?> project) Get the specific ACL for projects.
SortedMap<Role,Set<String>>	getGrantedRoles(String type) Get the roles from the global RoleMap.
Collection<String>	getGroups() Used by the container realm.
static RoleBasedAuthorizationStrategy	getInstance() Retrieves instance of the strategy.
hudson.security.SidACL	getRootACL() Get the root ACL.
Set<String>	getSIDs(String type) Get all the SIDs referenced by specified RoleMap type.
static boolean	isCreateAllowed() Control job create using RoleBasedProjectNamingStrategy.

Methods inherited from class hudson.security.AuthorizationStrategy

all, getACL, getACL, getACL, getACL, getACL

Methods inherited from class hudson.model.AbstractDescribableImpl

getDescriptor

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GLOBAL

public static final String GLOBAL

See Also:

Constant Field Values

PROJECT

public static final String PROJECT

See Also:

Constant Field Values

SLAVE

public static final String SLAVE

See Also:

Constant Field Values

MACRO_ROLE

public static final String MACRO_ROLE

See Also:

Constant Field Values

MACRO_USER

public static final String MACRO_USER

See Also:

Constant Field Values

DESCRIPTOR

@Extension
public static final RoleBasedAuthorizationStrategy.DescriptorImpl DESCRIPTOR

Constructor Detail

RoleBasedAuthorizationStrategy

public RoleBasedAuthorizationStrategy()

Method Detail

getRootACL

public hudson.security.SidACL getRootACL()

Get the root ACL.

Specified by:

getRootACL in class hudson.security.AuthorizationStrategy

Returns:

The global ACL

getACL

public hudson.security.ACL getACL(hudson.model.Job<?,?> project)

Get the specific ACL for projects.

Overrides:

getACL in class hudson.security.AuthorizationStrategy

Parameters:

project - The access-controlled project

Returns:

The project specific ACL

getACL

public hudson.security.ACL getACL(hudson.model.AbstractItem project)

Overrides:

getACL in class hudson.security.AuthorizationStrategy

getACL

public hudson.security.ACL getACL(hudson.model.Computer computer)

Overrides:

getACL in class hudson.security.AuthorizationStrategy

getGroups

public Collection<String> getGroups()

Used by the container realm.

Specified by:

getGroups in class hudson.security.AuthorizationStrategy

Returns:

All the sids referenced by the strategy

getGrantedRoles

public SortedMap<Role,Set<String>> getGrantedRoles(String type)

Get the roles from the global RoleMap.

The returned sorted map is unmodifiable.

Parameters:

type - The object type controlled by the RoleMap

Returns:

All roles from the global RoleMap

getSIDs

public Set<String> getSIDs(String type)

Get all the SIDs referenced by specified RoleMap type.

Parameters:

type - The object type controlled by the RoleMap

Returns:

All SIDs from the specified RoleMap.

doAddRole

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public void doAddRole(@QueryParameter(required=true)
                                                                                             String type,
                                                                                             @QueryParameter(required=true)
                                                                                             String roleName,
                                                                                             @QueryParameter(required=true)
                                                                                             String permissionIds,
                                                                                             @QueryParameter(required=true)
                                                                                             String overwrite,
                                                                                             @QueryParameter(required=false)
                                                                                             String pattern)
                                                                                      throws IOException

API method to add roles

example: curl -X POST localhost:8080/role-strategy/strategy/addRole --data "type=globalRoles&roleName=ADM& permissionIds=hudson.model.Item.Discover,hudson.model.Item.ExtendedRead&overwrite=true"

Parameters:

type - (globalRoles, projectRoles)

roleName - Name of role

permissionIds - Comma separated list of IDs for given roleName

overwrite - Overwrite existing role

pattern - Role pattern

Throws:

IOException - In case saving changes fails

Since:

2.5.0

doRemoveRoles

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public void doRemoveRoles(@QueryParameter(required=true)
                                                                                                 String type,
                                                                                                 @QueryParameter(required=true)
                                                                                                 String roleNames)
                                                                                          throws IOException

API method to remove roles. Example: curl -X POST localhost:8080/role-strategy/strategy/removeRoles --data "type=globalRoles& roleNames=ADM,DEV"

Parameters:

type - (globalRoles, projectRoles, slaveRoles)

roleNames - comma separated list of roles to remove from type

Throws:

IOException - in case saving changes fails

Since:

2.5.0

doAssignRole

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public void doAssignRole(@QueryParameter(required=true)
                                                                                                String type,
                                                                                                @QueryParameter(required=true)
                                                                                                String roleName,
                                                                                                @QueryParameter(required=true)
                                                                                                String sid)
                                                                                         throws IOException

API method to assign SID to role. Example: curl -X POST localhost:8080/role-strategy/strategy/assignRole --data "type=globalRoles&roleName=ADM &sid=username"

Parameters:

type - (globalRoles, projectRoles, slaveRoles)

roleName - name of role (single, no list)

sid - user ID (single, no list)

Throws:

IOException - in case saving changes fails

Since:

2.5.0

doDeleteSid

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public void doDeleteSid(@QueryParameter(required=true)
                                                                                               String type,
                                                                                               @QueryParameter(required=true)
                                                                                               String sid)
                                                                                        throws IOException

API method to delete a SID from all granted roles. Example: curl -X POST localhost:8080/role-strategy/strategy/deleteSid --data "type=globalRoles&sid=username"

Parameters:

type - (globalRoles, projectRoles, slaveRoles)

sid - user ID to remove

Throws:

IOException - in case saving changes fails

Since:

2.4.1

getInstance

@CheckForNull
public static RoleBasedAuthorizationStrategy getInstance()

Retrieves instance of the strategy.

Returns:

Strategy instance or null if it is disabled.

isCreateAllowed

public static boolean isCreateAllowed()

Control job create using RoleBasedProjectNamingStrategy.

Since:

2.2.0