Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2025-11-18 11:11:07 +01:00
Code Issues Packages Projects Releases Activity

Do not resolve external groups for system accounts (#1541)

Browse Source 
This change modifies the behaviour of the DefaultGroupCollector.
The collector does not longer resolve external groups for the anonymous user and it does not resolve internal nor external groups for the account which is used by the AdministrationContext.
This should reduce the requests which are send to external systems like ldap servers.
This commit is contained in:
Sebastian Sdorra
2021-02-15 08:45:47 +01:00
committed by GitHub
parent 996a3b6f16
commit 1a2dabeb66
9 changed files with 83 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
scm-webapp/src/main/java/sonia/scm/group/DefaultGroupCollector.java
View File

@@ -21,7 +21,7 @@
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.group;
import com.cronutils.utils.VisibleForTesting;
@@ -63,13 +63,16 @@ public class DefaultGroupCollector implements GroupCollector {
public Set<String> collect(String principal) {
ImmutableSet.Builder<String> builder = ImmutableSet.builder();
if (!Authentications.isSubjectAnonymous(principal)) {
if (Authentications.isSubjectAnonymous(principal)) {
appendInternalGroups(principal, builder);
} else if (Authentications.isSubjectSystemAccount(principal)) {
builder.add(AUTHENTICATED);
} else {
builder.add(AUTHENTICATED);
builder.addAll(resolveExternalGroups(principal));
appendInternalGroups(principal, builder);
}
builder.addAll(resolveExternalGroups(principal));
appendInternalGroups(principal, builder);
Set<String> groups = builder.build();
LOG.debug("collected following groups for principal {}: {}", principal, groups);
return groups;

3
scm-webapp/src/main/java/sonia/scm/web/security/AdministrationContextRealm.java
View File

@@ -21,11 +21,10 @@
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.web.security;
import com.google.common.collect.Sets;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;

26
scm-webapp/src/main/java/sonia/scm/web/security/DefaultAdministrationContext.java
View File

@@ -21,7 +21,7 @@
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.web.security;
//~--- non-JDK imports --------------------------------------------------------
@@ -39,13 +39,11 @@ import org.apache.shiro.util.ThreadState;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import sonia.scm.SCMContext;
import sonia.scm.security.Authentications;
import sonia.scm.security.Role;
import sonia.scm.user.User;
import sonia.scm.util.AssertUtil;
import javax.xml.bind.JAXB;
import java.net.URL;
//~--- JDK imports ------------------------------------------------------------
/**
@@ -57,8 +55,13 @@ public class DefaultAdministrationContext implements AdministrationContext
{
/** Field description */
public static final String SYSTEM_ACCOUNT =
"/sonia/scm/web/security/system-account.xml";
private static final User SYSTEM_ACCOUNT = new User(
Authentications.PRINCIPAL_SYSTEM,
"SCM-Manager System Account",
null
);
/** Field description */
static final String REALM = "AdminRealm";
@@ -83,16 +86,7 @@ public class DefaultAdministrationContext implements AdministrationContext
this.injector = injector;
this.securityManager = securityManager;
URL url = DefaultAdministrationContext.class.getResource(SYSTEM_ACCOUNT);
if (url == null)
{
throw new RuntimeException("could not find resource for system account");
}
User adminUser = JAXB.unmarshal(url, User.class);
principalCollection = createAdminCollection(adminUser);
principalCollection = createAdminCollection(SYSTEM_ACCOUNT);
}
//~--- methods --------------------------------------------------------------