From b9f971b295be6c9a711c964e3d0795406b9f3670 Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Wed, 5 Apr 2023 17:33:16 +0200 Subject: Issue #24: Erste Implementierung eines PermissionEvaluators Diese erste Implementierung wertet die Zugriffsberechtigung auf den Personenstamm aus, in dem der Patient oder eines der Formulare zum Patienten gehört. --- .../PersonPoolBasedPermissionEvaluator.java | 78 ++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java (limited to 'src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java new file mode 100644 index 0000000..766cc70 --- /dev/null +++ b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java @@ -0,0 +1,78 @@ +package DNPM.security; + +import de.itc.onkostar.api.Patient; +import de.itc.onkostar.api.Procedure; +import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.security.access.PermissionEvaluator; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.userdetails.UserDetails; + +import javax.sql.DataSource; +import java.io.Serializable; +import java.util.List; + +/** + * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Personenstammberechtigung + */ +public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { + + private final JdbcTemplate jdbcTemplate; + + public PersonPoolBasedPermissionEvaluator(final DataSource dataSource) { + this.jdbcTemplate = new JdbcTemplate(dataSource); + } + + /** + * Auswertung der Zugriffsberechtigung für authentifizierten Benutzer auf Zielobjekt mit angeforderter Berechtigung. + * @param authentication Das Authentication Objekt + * @param targetObject Das Zielobjekt + * @param permissionType Die angeforderte Berechtigung + * @return Gibt true zurück, wenn der Benutzer die Berechtigung hat + */ + @Override + public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { + if (permissionType instanceof PermissionType) { + if (targetObject instanceof Patient) { + return getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) + .contains(((Patient)targetObject).getPersonPoolCode()); + } else if (targetObject instanceof Procedure) { + return getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) + .contains(((Procedure)targetObject).getPatient().getPersonPoolCode()); + } + } + return false; + } + + /** + * Auswertung nicht anhand der ID möglich. Gibt immer false zurück. + * @param authentication Authentication-Object + * @param targetId ID des Objekts + * @param s + * @param o + * @return Gibt immer false zurück + */ + @Override + public boolean hasPermission(Authentication authentication, Serializable targetId, String s, Object o) { + return false; + } + + private List getPersonPoolIdsForPermission(Authentication authentication, PermissionType permissionType) { + var sql = "SELECT p.kennung FROM personenstamm_zugriff " + + " JOIN usergroup u ON personenstamm_zugriff.benutzergruppe_id = u.id " + + " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + + " JOIN akteur a ON au.akteur_id = a.id " + + " JOIN personenstamm p on personenstamm_zugriff.personenstamm_id = p.id " + + " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; + + if (PermissionType.WRITE == permissionType) { + sql += " AND personenstamm_zugriff.bearbeiten "; + } + + var userDetails = (UserDetails)authentication.getPrincipal(); + + return jdbcTemplate + .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("id")); + } + + +} -- cgit v1.2.3 From dfbcf3186e6974ef71dfa77b2148f9a8bfe2ce42 Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Wed, 5 Apr 2023 17:39:42 +0200 Subject: Issue #24: Verwende Berechtigung READ und READ_WRITE Schreibberechtigung bedeutet gleichzeitig Berechtigung den Eintrag zu lesen. --- src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java index 766cc70..4d895e4 100644 --- a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java @@ -64,7 +64,7 @@ public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { " JOIN personenstamm p on personenstamm_zugriff.personenstamm_id = p.id " + " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; - if (PermissionType.WRITE == permissionType) { + if (PermissionType.READ_WRITE == permissionType) { sql += " AND personenstamm_zugriff.bearbeiten "; } -- cgit v1.2.3 From e0dba6f4ee1550c55e2765adeabf334200984543 Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Thu, 6 Apr 2023 14:42:35 +0200 Subject: Issue #24: Füge Annotationen und Spring-AOP Aspect zum Absichern von Methodenaufrufen hinzu --- src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java index 4d895e4..2eac69c 100644 --- a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java @@ -6,6 +6,7 @@ import org.springframework.jdbc.core.JdbcTemplate; import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.core.Authentication; import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.stereotype.Component; import javax.sql.DataSource; import java.io.Serializable; @@ -14,6 +15,7 @@ import java.util.List; /** * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Personenstammberechtigung */ +@Component public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { private final JdbcTemplate jdbcTemplate; @@ -71,7 +73,7 @@ public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { var userDetails = (UserDetails)authentication.getPrincipal(); return jdbcTemplate - .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("id")); + .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("kennung")); } -- cgit v1.2.3 From b56ff9e0d8a4efc71803e1eb435848c8bb42844c Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Sun, 9 Apr 2023 14:01:14 +0200 Subject: Issue #24: Ermögliche Berechtigungsprüfung anhand ID und Klassennamen --- .../PersonPoolBasedPermissionEvaluator.java | 47 ++++++++++++++++++---- 1 file changed, 40 insertions(+), 7 deletions(-) (limited to 'src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java index 2eac69c..0762dc9 100644 --- a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java @@ -1,5 +1,6 @@ package DNPM.security; +import de.itc.onkostar.api.IOnkostarApi; import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; import org.springframework.jdbc.core.JdbcTemplate; @@ -18,9 +19,12 @@ import java.util.List; @Component public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { + private final IOnkostarApi onkostarApi; + private final JdbcTemplate jdbcTemplate; - public PersonPoolBasedPermissionEvaluator(final DataSource dataSource) { + public PersonPoolBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final DataSource dataSource) { + this.onkostarApi = onkostarApi; this.jdbcTemplate = new JdbcTemplate(dataSource); } @@ -46,19 +50,48 @@ public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { } /** - * Auswertung nicht anhand der ID möglich. Gibt immer false zurück. + * Auswertung anhand der ID und des Namens des Zielobjekts. * @param authentication Authentication-Object * @param targetId ID des Objekts - * @param s - * @param o - * @return Gibt immer false zurück + * @param targetType Name der Zielobjektklasse + * @param permissionType Die angeforderte Berechtigung + * @return Gibt true zurück, wenn der Benutzer die Berechtigung hat */ @Override - public boolean hasPermission(Authentication authentication, Serializable targetId, String s, Object o) { + public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { + if (targetId instanceof Integer) { + var personPoolCode = getPersonPoolCode((int)targetId, targetType); + if (null != personPoolCode && permissionType instanceof PermissionType) { + return getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType).contains(personPoolCode); + } + } return false; } - private List getPersonPoolIdsForPermission(Authentication authentication, PermissionType permissionType) { + private String getPersonPoolCode(int id, String type) { + Patient patient = null; + switch (type) { + case "Patient": + patient = onkostarApi.getPatient(id); + break; + case "Procedure": + var procedure = onkostarApi.getProcedure(id); + if (null != procedure) { + patient = procedure.getPatient(); + } + break; + default: + break; + } + + if (null != patient) { + return patient.getPersonPoolCode(); + } + + return null; + } + + List getPersonPoolIdsForPermission(Authentication authentication, PermissionType permissionType) { var sql = "SELECT p.kennung FROM personenstamm_zugriff " + " JOIN usergroup u ON personenstamm_zugriff.benutzergruppe_id = u.id " + " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + -- cgit v1.2.3 From 44396ff04a24088ac9fb2cab270036a9a983944f Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Mon, 10 Apr 2023 13:09:54 +0200 Subject: Issue #24: Füge PermissionEvaluator zur Gesamtprüfung der Berechtigung hinzu Dieser PermissionEvaluator delegiert die einzelnen Prüfungen an PermissionEvaluatoren welche `AbstractDelegatedPermissionEvaluator` erweitern. Nur, wenn all diese PermissionEvaluatoren die Berechtigung erfolgreich geprüft haben, gibt dieser PermissionEvaluator ein positives Prüfungsergebnis zurück. --- .../PersonPoolBasedPermissionEvaluator.java | 31 +++++++--------------- 1 file changed, 10 insertions(+), 21 deletions(-) (limited to 'src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java index 0762dc9..21cdca1 100644 --- a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java @@ -3,8 +3,6 @@ package DNPM.security; import de.itc.onkostar.api.IOnkostarApi; import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; -import org.springframework.jdbc.core.JdbcTemplate; -import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.core.Authentication; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Component; @@ -17,15 +15,10 @@ import java.util.List; * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Personenstammberechtigung */ @Component -public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { - - private final IOnkostarApi onkostarApi; - - private final JdbcTemplate jdbcTemplate; +public class PersonPoolBasedPermissionEvaluator extends AbstractDelegatedPermissionEvaluator { public PersonPoolBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final DataSource dataSource) { - this.onkostarApi = onkostarApi; - this.jdbcTemplate = new JdbcTemplate(dataSource); + super(onkostarApi, dataSource); } /** @@ -70,18 +63,14 @@ public class PersonPoolBasedPermissionEvaluator implements PermissionEvaluator { private String getPersonPoolCode(int id, String type) { Patient patient = null; - switch (type) { - case "Patient": - patient = onkostarApi.getPatient(id); - break; - case "Procedure": - var procedure = onkostarApi.getProcedure(id); - if (null != procedure) { - patient = procedure.getPatient(); - } - break; - default: - break; + + if (PATIENT.equals(type)) { + patient = onkostarApi.getPatient(id); + } else if (PROCEDURE.equals(type)) { + var procedure = onkostarApi.getProcedure(id); + if (null != procedure) { + patient = procedure.getPatient(); + } } if (null != patient) { -- cgit v1.2.3 From 5b9b12afc9ed29d005442b3a18a45b9a3104ad84 Mon Sep 17 00:00:00 2001 From: Paul-Christian Volkmer Date: Mon, 10 Apr 2023 14:26:35 +0200 Subject: Issue #24: Extrahiere Service mit Datenbankanfragen --- .../PersonPoolBasedPermissionEvaluator.java | 35 +++++----------------- 1 file changed, 7 insertions(+), 28 deletions(-) (limited to 'src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java') diff --git a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java index 21cdca1..e3ba16e 100644 --- a/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java +++ b/src/main/java/DNPM/security/PersonPoolBasedPermissionEvaluator.java @@ -4,12 +4,9 @@ import de.itc.onkostar.api.IOnkostarApi; import de.itc.onkostar.api.Patient; import de.itc.onkostar.api.Procedure; import org.springframework.security.core.Authentication; -import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Component; -import javax.sql.DataSource; import java.io.Serializable; -import java.util.List; /** * Permission-Evaluator zur Auswertung der Berechtigung auf Objekte aufgrund der Personenstammberechtigung @@ -17,8 +14,8 @@ import java.util.List; @Component public class PersonPoolBasedPermissionEvaluator extends AbstractDelegatedPermissionEvaluator { - public PersonPoolBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final DataSource dataSource) { - super(onkostarApi, dataSource); + public PersonPoolBasedPermissionEvaluator(final IOnkostarApi onkostarApi, final SecurityService securityService) { + super(onkostarApi, securityService); } /** @@ -32,10 +29,10 @@ public class PersonPoolBasedPermissionEvaluator extends AbstractDelegatedPermiss public boolean hasPermission(Authentication authentication, Object targetObject, Object permissionType) { if (permissionType instanceof PermissionType) { if (targetObject instanceof Patient) { - return getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) + return this.securityService.getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) .contains(((Patient)targetObject).getPersonPoolCode()); } else if (targetObject instanceof Procedure) { - return getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) + return this.securityService.getPersonPoolIdsForPermission(authentication, (PermissionType)permissionType) .contains(((Procedure)targetObject).getPatient().getPersonPoolCode()); } } @@ -52,10 +49,10 @@ public class PersonPoolBasedPermissionEvaluator extends AbstractDelegatedPermiss */ @Override public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permissionType) { - if (targetId instanceof Integer) { + if (targetId instanceof Integer && permissionType instanceof PermissionType) { var personPoolCode = getPersonPoolCode((int)targetId, targetType); - if (null != personPoolCode && permissionType instanceof PermissionType) { - return getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType).contains(personPoolCode); + if (null != personPoolCode) { + return this.securityService.getPersonPoolIdsForPermission(authentication, (PermissionType) permissionType).contains(personPoolCode); } } return false; @@ -80,23 +77,5 @@ public class PersonPoolBasedPermissionEvaluator extends AbstractDelegatedPermiss return null; } - List getPersonPoolIdsForPermission(Authentication authentication, PermissionType permissionType) { - var sql = "SELECT p.kennung FROM personenstamm_zugriff " + - " JOIN usergroup u ON personenstamm_zugriff.benutzergruppe_id = u.id " + - " JOIN akteur_usergroup au ON u.id = au.usergroup_id " + - " JOIN akteur a ON au.akteur_id = a.id " + - " JOIN personenstamm p on personenstamm_zugriff.personenstamm_id = p.id " + - " WHERE a.login = ? AND a.aktiv AND a.anmelden_moeglich "; - - if (PermissionType.READ_WRITE == permissionType) { - sql += " AND personenstamm_zugriff.bearbeiten "; - } - - var userDetails = (UserDetails)authentication.getPrincipal(); - - return jdbcTemplate - .query(sql, new Object[]{userDetails.getUsername()}, (rs, rowNum) -> rs.getString("kennung")); - } - } -- cgit v1.2.3