import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected AuthorizationEntity createGrantAuthorization(String userId, String groupId, Resource resource, String resourceId, Permission... permissions) {
  // assuming that there are no default authorizations for *
  if (userId != null) {
    ensureValidIndividualResourceId("Cannot create authorization for user " + userId, userId);
  }
  if (groupId != null) {
    ensureValidIndividualResourceId("Cannot create authorization for group " + groupId, groupId);
  }

  AuthorizationEntity authorization = new AuthorizationEntity(AUTH_TYPE_GRANT);
  authorization.setUserId(userId);
  authorization.setGroupId(groupId);
  authorization.setResource(resource);
  authorization.setResourceId(resourceId);

  if (permissions != null) {
    for (Permission permission : permissions) {
      authorization.addPermission(permission);
    }
  }

  return authorization;
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected static MissingAuthorization asMissingAuthorization(Authorization authorization) {
  String permissionName = null;
  String resourceId = null;
  String resourceName = null;

  for (Permission permission : authorization.getPermissions(Permissions.values())) {
    if (permission != Permissions.NONE) {
      permissionName = permission.getName();
      break;
    }
  }

  if (!Authorization.ANY.equals(authorization.getResourceId())) {
    // missing ANY authorizations are not explicitly represented in the error message
    resourceId = authorization.getResourceId();
  }

  Resource resource = AuthorizationTestUtil.getResourceByType(authorization.getResourceType());
  resourceName = resource.resourceName();
  return new MissingAuthorization(permissionName, resourceName, resourceId);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
@Override
protected void setUp() throws Exception {
  super.setUp();

  Resource resource1 = new TestResource("resource1", 100);
  Resource resource2 = new TestResource("resource2", 101);

  createAuthorization("user1", null, resource1, "resource1-1", Permissions.ACCESS);
  createAuthorization("user1", null, resource2, "resource2-1", Permissions.DELETE);
  createAuthorization("user2", null, resource1, "resource1-2");
  createAuthorization("user3", null, resource2, "resource2-1", Permissions.READ, Permissions.UPDATE);

  createAuthorization(null, "group1", resource1, "resource1-1");
  createAuthorization(null, "group1", resource1, "resource1-2", Permissions.UPDATE);
  createAuthorization(null, "group2", resource2, "resource2-2", Permissions.READ, Permissions.UPDATE);
  createAuthorization(null, "group3", resource2, "resource2-3", Permissions.DELETE);

}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected boolean isAuthorized(Permission permission, Resource resource, String resourceId) {
  if (!processEngine.getProcessEngineConfiguration().isAuthorizationEnabled()) {
    // if authorization is disabled everyone is authorized
    return true;
  }

  final IdentityService identityService = processEngine.getIdentityService();
  final AuthorizationService authorizationService = processEngine.getAuthorizationService();

  Authentication authentication = identityService.getCurrentAuthentication();
  if(authentication == null) {
    return true;

  } else {
    return authorizationService
       .isUserAuthorized(authentication.getUserId(), authentication.getGroupIds(), permission, resource, resourceId);
  }
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
@Test
@SuppressWarnings("unchecked")
public void testIsUserAuthorizedNoAuthentication() {

  List<String> exampleGroups = new ArrayList<String>();

  when(identityServiceMock.getCurrentAuthentication()).thenReturn(null);

  AuthorizationUtil authorizationUtil = new AuthorizationUtil(MockProvider.EXAMPLE_RESOURCE_TYPE_NAME, MockProvider.EXAMPLE_RESOURCE_TYPE_ID, MockProvider.EXAMPLE_PERMISSION_NAME);
  when(authorizationServiceMock.isUserAuthorized(MockProvider.EXAMPLE_USER_ID, exampleGroups, authorizationUtil, authorizationUtil)).thenReturn(false);

  given()
      .queryParam("permissionName", MockProvider.EXAMPLE_PERMISSION_NAME)
      .queryParam("resourceName", MockProvider.EXAMPLE_RESOURCE_TYPE_NAME)
      .queryParam("resourceType", MockProvider.EXAMPLE_RESOURCE_TYPE_ID)
  .then().expect().statusCode(Status.UNAUTHORIZED.getStatusCode())
  .when().get(AUTH_CHECK_PATH);

  verify(identityServiceMock, times(1)).getCurrentAuthentication();
  verify(authorizationServiceMock, never()).isUserAuthorized(any(String.class), any(List.class), any(Permission.class), any(Resource.class));
  verify(authorizationServiceMock, never()).isUserAuthorized(any(String.class), any(List.class), any(Permission.class), any(Resource.class), any(String.class));

}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
private void addAuthorizationGroup(AuthorizationService authorizationService,
                                   Resource resource, String resourceId,
                                   String groupId, Permission[] permissions) {
    Authorization newAuthorization = authorizationService.createNewAuthorization(Authorization.AUTH_TYPE_GRANT);
    newAuthorization.setGroupId(groupId);
    newAuthorization.setResource(resource);
    newAuthorization.setResourceId(resourceId);
    for (Permission permission : permissions) {
        newAuthorization.addPermission(permission);
    }
    authorizationService.saveAuthorization(newAuthorization);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
public void addAuthorizationUser(AuthorizationService authorizationService,
                                 Resource resource, String resourceId,
                                 String userId, Permission[] permissions) {
    Authorization newAuthorization = authorizationService.createNewAuthorization(Authorization.AUTH_TYPE_GRANT);
    newAuthorization.setUserId(userId);
    newAuthorization.setResource(resource);
    newAuthorization.setResourceId(resourceId);
    Arrays.stream(permissions).forEach(newAuthorization::addPermission);
    for (Permission permission : permissions) {
        newAuthorization.addPermission(permission);
    }
    authorizationService.saveAuthorization(newAuthorization);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
private void adjustAuthorizations(){
	// create admin group if necessary
	if (identityService.createGroupQuery().groupId(Groups.CAMUNDA_ADMIN).count() == 0) {
		Group camundaAdminGroup = identityService.newGroup(Groups.CAMUNDA_ADMIN);
		camundaAdminGroup.setName("camunda BPM Administrators");
		camundaAdminGroup.setType(Groups.GROUP_TYPE_SYSTEM);
		identityService.saveGroup(camundaAdminGroup);
	}

	// create ADMIN authorizations on all built-in resources
	for (Resource resource : Resources.values()) {
		if (authorizationService.createAuthorizationQuery()
				.groupIdIn(Groups.CAMUNDA_ADMIN).resourceType(resource)
				.resourceId(ANY).count() == 0) {
			AuthorizationEntity userAdminAuth = new AuthorizationEntity(
					AUTH_TYPE_GRANT);
			userAdminAuth.setGroupId(Groups.CAMUNDA_ADMIN);
			userAdminAuth.setResource(resource);
			userAdminAuth.setResourceId(ANY);
			userAdminAuth.addPermission(ALL);
			authorizationService.saveAuthorization(userAdminAuth);
		}
	}

	// Task-List
	Authorization bvisTasklistAuth = authorizationService
			.createNewAuthorization(AUTH_TYPE_GRANT);
	bvisTasklistAuth.setGroupId("bvis");
	bvisTasklistAuth.addPermission(ACCESS);
	bvisTasklistAuth.setResourceId("tasklist");
	bvisTasklistAuth.setResource(APPLICATION);
	authorizationService.saveAuthorization(bvisTasklistAuth);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
@Override
public void postProcessEngineBuild(final ProcessEngine processEngine) {
  requireNonNull(adminUser);

  final IdentityService identityService = processEngine.getIdentityService();
  final AuthorizationService authorizationService = processEngine.getAuthorizationService();

  if (userAlreadyExists(identityService, adminUser)) {
    return;
  }

  createUser(identityService, adminUser);

  // create group
  if (identityService.createGroupQuery().groupId(CAMUNDA_ADMIN).count() == 0) {
    Group camundaAdminGroup = identityService.newGroup(CAMUNDA_ADMIN);
    camundaAdminGroup.setName("camunda BPM Administrators");
    camundaAdminGroup.setType(Groups.GROUP_TYPE_SYSTEM);
    identityService.saveGroup(camundaAdminGroup);
  }

  // create ADMIN authorizations on all built-in resources
  for (Resource resource : Resources.values()) {
    if (authorizationService.createAuthorizationQuery().groupIdIn(CAMUNDA_ADMIN).resourceType(resource).resourceId(ANY).count() == 0) {
      AuthorizationEntity userAdminAuth = new AuthorizationEntity(AUTH_TYPE_GRANT);
      userAdminAuth.setGroupId(CAMUNDA_ADMIN);
      userAdminAuth.setResource(resource);
      userAdminAuth.setResourceId(ANY);
      userAdminAuth.addPermission(ALL);
      authorizationService.saveAuthorization(userAdminAuth);
    }
  }

  identityService.createMembership(adminUser.getId(), CAMUNDA_ADMIN);
  LOG.creatingInitialAdminUser(adminUser);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
public void afterPropertiesSet() throws Exception {

    System.out.println("Generating demo data");

    scheduleInstanceStart();

    // ensure admin user exists
    IdentityService identityService = processEngine.getIdentityService();
    User user = identityService.createUserQuery().userId("demo").singleResult();
    if(user == null) {
      User newUser = identityService.newUser("demo");
      newUser.setPassword("demo");
      identityService.saveUser(newUser);
      System.out.println("Created used 'demo', password 'demo'");
      AuthorizationService authorizationService = processEngine.getAuthorizationService();

      // create group
      if(identityService.createGroupQuery().groupId(Groups.CAMUNDA_ADMIN).count() == 0) {
        Group camundaAdminGroup = identityService.newGroup(Groups.CAMUNDA_ADMIN);
        camundaAdminGroup.setName("camunda BPM Administrators");
        camundaAdminGroup.setType(Groups.GROUP_TYPE_SYSTEM);
        identityService.saveGroup(camundaAdminGroup);
      }

      // create ADMIN authorizations on all built-in resources
      for (Resource resource : Resources.values()) {
        if(authorizationService.createAuthorizationQuery().groupIdIn(Groups.CAMUNDA_ADMIN).resourceType(resource).resourceId(ANY).count() == 0) {
          AuthorizationEntity userAdminAuth = new AuthorizationEntity(AUTH_TYPE_GRANT);
          userAdminAuth.setGroupId(Groups.CAMUNDA_ADMIN);
          userAdminAuth.setResource(resource);
          userAdminAuth.setResourceId(ANY);
          userAdminAuth.addPermission(ALL);
          authorizationService.saveAuthorization(userAdminAuth);
        }
      }

      processEngine.getIdentityService()
      .createMembership("demo", Groups.CAMUNDA_ADMIN);
    }
  }
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected void createGrantAuthorization(Resource resource, String resourceId, String userId, Permission... permissions) {
  Authorization authorization = createAuthorization(AUTH_TYPE_GRANT, resource, resourceId);
  authorization.setUserId(userId);
  for (Permission permission : permissions) {
    authorization.addPermission(permission);
  }
  authorizationService.saveAuthorization(authorization);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected Authorization createAuthorization(int type, Resource resource, String resourceId) {
  Authorization authorization = authorizationService.createNewAuthorization(type);

  authorization.setResource(resource);
  if (resourceId != null) {
    authorization.setResourceId(resourceId);
  }

  return authorization;
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected AuthorizationEntity updateAuthorization(AuthorizationEntity authorization, String userId, String groupId, Resource resource, String resourceId, Permission... permissions) {
  if (authorization == null) {
    authorization = createGrantAuthorization(userId, groupId, resource, resourceId);
    updateAuthorizationBasedOnCacheEntries(authorization, userId, groupId, resource, resourceId);
  }

  if (permissions != null) {
    for (Permission permission : permissions) {
      authorization.addPermission(permission);
    }
  }

  return authorization;
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
/**
 * Searches through the cache, if there is already an authorization with same rights. If that's the case
 * update the given authorization with the permissions and remove the old one from the cache.
 */
protected void updateAuthorizationBasedOnCacheEntries(AuthorizationEntity authorization, String userId, String groupId,
                                                      Resource resource, String resourceId) {
  DbEntityManager dbManager = Context.getCommandContext().getDbEntityManager();
  List<AuthorizationEntity> list = dbManager.getCachedEntitiesByType(AuthorizationEntity.class);
  for (AuthorizationEntity authEntity : list) {
    boolean hasSameAuthRights = hasEntitySameAuthorizationRights(authEntity, userId, groupId, resource, resourceId);
    if (hasSameAuthRights) {
      int previousPermissions = authEntity.getPermissions();
      authorization.setPermissions(previousPermissions);
      dbManager.getDbEntityCache().remove(authEntity);
      return;
    }
  }
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected boolean hasEntitySameAuthorizationRights(AuthorizationEntity authEntity, String userId, String groupId,
                                                   Resource resource, String resourceId) {
  boolean sameUserId = areIdsEqual(authEntity.getUserId(), userId);
  boolean sameGroupId = areIdsEqual(authEntity.getGroupId(), groupId);
  boolean sameResourceId = areIdsEqual(authEntity.getResourceId(), (resourceId));
  boolean sameResourceType = authEntity.getResourceType() == resource.resourceType();
  boolean sameAuthorizationType = authEntity.getAuthorizationType() == AUTH_TYPE_GRANT;
  return sameUserId && sameGroupId &&
      sameResourceType && sameResourceId &&
      sameAuthorizationType;
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
public AuthorizationEntity findAuthorization(int type, String userId, String groupId, Resource resource, String resourceId) {
  Map<String, Object> params = new HashMap<String, Object>();

  params.put("type", type);
  params.put("userId", userId);
  params.put("groupId", groupId);
  params.put("resourceId", resourceId);

  if (resource != null) {
    params.put("resourceType", resource.resourceType());
  }

  return (AuthorizationEntity) getDbEntityManager().selectOne("selectAuthorizationByParameters", params);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
@Override
public void checkAuthorization(Permission permission, Resource resource, String resourceId) {
  if(isAuthCheckExecuted()) {
    Authentication currentAuthentication = getCurrentAuthentication();
    boolean isAuthorized = isAuthorized(currentAuthentication.getUserId(), currentAuthentication.getGroupIds(), permission, resource, resourceId);
    if (!isAuthorized) {
      throw new AuthorizationException(
          currentAuthentication.getUserId(),
          permission.getName(),
          resource.resourceName(),
          resourceId);
    }
  }

}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
public boolean isAuthorized(Permission permission, Resource resource, String resourceId) {
  // this will be called by LdapIdentityProviderSession#isAuthorized() for executing LdapQueries.
  // to be backward compatible a check whether authorization has been enabled inside the given
  // command context will not be done.
  final Authentication currentAuthentication = getCurrentAuthentication();

  if(isAuthorizationEnabled() && currentAuthentication != null && currentAuthentication.getUserId() != null) {
    return isAuthorized(currentAuthentication.getUserId(), currentAuthentication.getGroupIds(), permission, resource, resourceId);

  } else {
    return true;

  }
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
public void configureQueryHistoricFinishedInstanceReport(ListQueryParameterObject query, Resource resource) {
  configureQuery(query);

  CompositePermissionCheck compositePermissionCheck = new PermissionCheckBuilder()
    .conjunctive()
      .atomicCheck(resource, "RES.KEY_", READ)
      .atomicCheck(resource, "RES.KEY_", READ_HISTORY)
    .build();

  query.getAuthCheck().setPermissionChecks(compositePermissionCheck);
}
 

import org.camunda.bpm.engine.authorization.Resource; //导入依赖的package包/类
protected void addPermissionCheck(ListQueryParameterObject query, Resource resource, String queryParam, Permission permission) {
  CommandContext commandContext = getCommandContext();
  if (isAuthorizationEnabled() && getCurrentAuthentication() != null && commandContext.isAuthorizationCheckEnabled()) {
    PermissionCheck permCheck = newPermissionCheck();
    permCheck.setResource(resource);
    permCheck.setResourceIdQueryParam(queryParam);
    permCheck.setPermission(permission);

    query.getAuthCheck().addAtomicPermissionCheck(permCheck);
  }
}