Repository: cloudstack Updated Branches: refs/heads/4.4-forward-iam-disabled c9c7c8cb4 -> 56b284f7f
Disabling IAM: Handling isAdmin using AccountType - Remove RoleBasedEntityAccessChecker from the list of SecurityCheckers - Remove upgrade code to put iam_group_account_map - DomainChecker should handle the isRootAdmin/isDomainAdmin/isResourceDomainAdmin using AccountType Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/94ddde33 Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/94ddde33 Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/94ddde33 Branch: refs/heads/4.4-forward-iam-disabled Commit: 94ddde33d9fca3bbd19dbfcbd9ca902f0f8be95b Parents: c9c7c8c Author: Prachi Damle <[email protected]> Authored: Wed May 14 11:43:26 2014 -0700 Committer: Prachi Damle <[email protected]> Committed: Wed May 14 12:00:32 2014 -0700 ---------------------------------------------------------------------- .../core/spring-core-registry-core-context.xml | 2 +- .../com/cloud/upgrade/dao/Upgrade430to440.java | 74 ++++++++------------ server/src/com/cloud/acl/DomainChecker.java | 7 +- 3 files changed, 36 insertions(+), 47 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cloudstack/blob/94ddde33/core/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml ---------------------------------------------------------------------- diff --git a/core/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml b/core/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml index 0f58d7d..d54823a 100644 --- a/core/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml +++ b/core/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml @@ -46,7 +46,7 @@ <property name="orderConfigKey" value="security.checkers.order" /> <property name="excludeKey" value="security.checkers.exclude" /> <property name="orderConfigDefault" - value="RoleBasedEntityAccessChecker,AffinityGroupAccessChecker,DomainChecker" /> + value="AffinityGroupAccessChecker,DomainChecker" /> </bean> <bean id="resourceDiscoverersRegistry" http://git-wip-us.apache.org/repos/asf/cloudstack/blob/94ddde33/engine/schema/src/com/cloud/upgrade/dao/Upgrade430to440.java ---------------------------------------------------------------------- diff --git a/engine/schema/src/com/cloud/upgrade/dao/Upgrade430to440.java b/engine/schema/src/com/cloud/upgrade/dao/Upgrade430to440.java index 26277dd..78db621 100644 --- a/engine/schema/src/com/cloud/upgrade/dao/Upgrade430to440.java +++ b/engine/schema/src/com/cloud/upgrade/dao/Upgrade430to440.java @@ -59,55 +59,39 @@ public class Upgrade430to440 implements DbUpgrade { @Override public void performDataMigration(Connection conn) { - populateIAMGroupAccountMap(conn); + // populateIAMGroupAccountMap(conn); secondaryIpsAccountAndDomainIdsUpdate(conn); moveCidrsToTheirOwnTable(conn); } - // populate iam_group_account_map table for existing accounts - private void populateIAMGroupAccountMap(Connection conn) { - PreparedStatement acctInsert = null; - PreparedStatement acctQuery = null; - ResultSet rs = null; - - s_logger.debug("Populating iam_group_account_map table for existing accounts..."); - try { - acctInsert = conn - .prepareStatement("INSERT INTO `cloud`.`iam_group_account_map` (group_id, account_id, created) values(?, ?, Now())"); - acctQuery = conn - .prepareStatement("select id, type from `cloud`.`account` where removed is null"); - rs = acctQuery.executeQuery(); - - while (rs.next()) { - Long acct_id = rs.getLong("id"); - short type = rs.getShort("type"); - - // insert entry in iam_group_account_map table - acctInsert.setLong(1, type + 1); - acctInsert.setLong(2, acct_id); - acctInsert.executeUpdate(); - } - } catch (SQLException e) { - String msg = "Unable to populate iam_group_account_map for existing accounts." + e.getMessage(); - s_logger.error(msg); - throw new CloudRuntimeException(msg, e); - } finally { - try { - if (rs != null) { - rs.close(); - } - - if (acctInsert != null) { - acctInsert.close(); - } - if (acctQuery != null) { - acctQuery.close(); - } - } catch (SQLException e) { - } - } - s_logger.debug("Completed populate iam_group_account_map for existing accounts."); - } + /* + * populate iam_group_account_map table for existing accounts private void + * populateIAMGroupAccountMap(Connection conn) { PreparedStatement + * acctInsert = null; PreparedStatement acctQuery = null; ResultSet rs = + * null; + * + * s_logger.debug( + * "Populating iam_group_account_map table for existing accounts..."); try { + * acctInsert = conn .prepareStatement( + * "INSERT INTO `cloud`.`iam_group_account_map` (group_id, account_id, created) values(?, ?, Now())" + * ); acctQuery = conn .prepareStatement( + * "select id, type from `cloud`.`account` where removed is null"); rs = + * acctQuery.executeQuery(); + * + * while (rs.next()) { Long acct_id = rs.getLong("id"); short type = + * rs.getShort("type"); + * + * // insert entry in iam_group_account_map table acctInsert.setLong(1, type + * + 1); acctInsert.setLong(2, acct_id); acctInsert.executeUpdate(); } } + * catch (SQLException e) { String msg = + * "Unable to populate iam_group_account_map for existing accounts." + + * e.getMessage(); s_logger.error(msg); throw new CloudRuntimeException(msg, + * e); } finally { try { if (rs != null) { rs.close(); } + * + * if (acctInsert != null) { acctInsert.close(); } if (acctQuery != null) { + * acctQuery.close(); } } catch (SQLException e) { } } s_logger.debug( + * "Completed populate iam_group_account_map for existing accounts."); } + */ http://git-wip-us.apache.org/repos/asf/cloudstack/blob/94ddde33/server/src/com/cloud/acl/DomainChecker.java ---------------------------------------------------------------------- diff --git a/server/src/com/cloud/acl/DomainChecker.java b/server/src/com/cloud/acl/DomainChecker.java index 9a1419d..729a0d1 100755 --- a/server/src/com/cloud/acl/DomainChecker.java +++ b/server/src/com/cloud/acl/DomainChecker.java @@ -332,15 +332,20 @@ public class DomainChecker extends AdapterBase implements SecurityChecker { if (action != null && ("SystemCapability".equals(action))) { if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_ADMIN) { return true; + } else { + return false; } - } else if (action != null && ("DomainCapability".equals(action))) { if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN) { return true; + } else { + return false; } } else if (action != null && ("DomainResourceCapability".equals(action))) { if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN) { return true; + } else { + return false; } } return checkAccess(caller, entity, accessType);
