#781 process all kinds authorization relevant event and produce AuthorizationChangedEvent

scm-webapp/src/main/java/sonia/scm/ScmServletModule.java

@@ -166,6 +166,7 @@ import sonia.scm.net.ahc.JsonContentTransformer;
 import sonia.scm.net.ahc.XmlContentTransformer;
 import sonia.scm.schedule.QuartzScheduler;
 import sonia.scm.schedule.Scheduler;
+import sonia.scm.security.AuthorizationChangedEventProducer;
 import sonia.scm.security.XsrfProtectionFilter;
 import sonia.scm.web.UserAgentParser;
 
@@ -300,6 +301,7 @@ public class ScmServletModule extends ServletModule
     pluginLoader.processExtensions(binder());
 
     // bind security stuff
+    bind(AuthorizationChangedEventProducer.class);
     bind(PermissionResolver.class, RepositoryPermissionResolver.class);
     bind(AuthenticationManager.class, ChainAuthenticatonManager.class);
     bind(SecurityContext.class).to(BasicSecurityContext.class);
@@ -310,6 +312,7 @@ public class ScmServletModule extends ServletModule
 
     // bind cache
     bind(CacheManager.class, GuavaCacheManager.class);
+    bind(org.apache.shiro.cache.CacheManager.class, GuavaCacheManager.class);
 
     // bind dao
     bind(GroupDAO.class, XmlGroupDAO.class);
@@ -386,8 +389,7 @@ public class ScmServletModule extends ServletModule
     filter(PATTERN_ALL).through(BaseUrlFilter.class);
     filter(PATTERN_ALL).through(AutoLoginFilter.class);
     filterRegex(RESOURCE_REGEX).through(GZipFilter.class);
-    filter(PATTERN_RESTAPI,
-      PATTERN_DEBUG).through(ApiBasicAuthenticationFilter.class);
+    filter(PATTERN_RESTAPI, PATTERN_DEBUG).through(ApiBasicAuthenticationFilter.class);
     filter(PATTERN_RESTAPI, PATTERN_DEBUG).through(SecurityFilter.class);
     filter(PATTERN_CONFIG, PATTERN_ADMIN).through(AdminSecurityFilter.class);
 
@@ -434,11 +436,7 @@ public class ScmServletModule extends ServletModule
       UriExtensionsConfig.class.getName());
 
     String restPath = getRestPackages();
-
-    if (logger.isInfoEnabled())
-    {
-      logger.info("configure jersey with package path: {}", restPath);
-    }
+    logger.info("configure jersey with package path: {}", restPath);
 
     params.put(PackagesResourceConfig.PROPERTY_PACKAGES, restPath);
     serve(PATTERN_RESTAPI).with(GuiceContainer.class, params);

scm-webapp/src/main/java/sonia/scm/security/AuthenticationInfoCollector.java

@@ -93,7 +93,7 @@ public class AuthenticationInfoCollector {
     
     synchronizer.synchronize(user, groups);
     
-    if (isUserIsDisabled(user)) {
+    if (isUserDisabled(user)) {
       throwAccountIsDisabledExceptionAndLog(user.getName());
     }
     
@@ -112,7 +112,7 @@ public class AuthenticationInfoCollector {
     return collection;
   }
   
-  private boolean isUserIsDisabled(User user) {
+  private boolean isUserDisabled(User user) {
     return !user.isActive();
   }
   

scm-webapp/src/main/java/sonia/scm/security/AuthorizationChangedEventProducer.java

@@ -0,0 +1,271 @@
+/**
+ * Copyright (c) 2014, Sebastian Sdorra
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. Neither the name of SCM-Manager; nor the names of its
+ *    contributors may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * http://bitbucket.org/sdorra/scm-manager
+ *
+ */
+package sonia.scm.security;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.eventbus.Subscribe;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import sonia.scm.EagerSingleton;
+import sonia.scm.ModificationHandlerEvent;
+import sonia.scm.event.HandlerEventBase;
+import sonia.scm.event.ScmEventBus;
+import sonia.scm.group.Group;
+import sonia.scm.group.GroupEvent;
+import sonia.scm.group.GroupModificationEvent;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryEvent;
+import sonia.scm.repository.RepositoryModificationEvent;
+import sonia.scm.user.User;
+import sonia.scm.user.UserEvent;
+import sonia.scm.user.UserModificationEvent;
+
+/**
+ * Receives all kinds of events, which affects authorization relevant data and fires an 
+ * {@link AuthorizationChangedEvent} if authorization data has changed.
+ * 
+ * @author Sebastian Sdorra
+ * @since 1.52
+ */
+@EagerSingleton
+public class AuthorizationChangedEventProducer {
+  
+  /**
+   * the logger for AuthorizationChangedEventProducer
+   */
+  private static final Logger logger = LoggerFactory.getLogger(AuthorizationChangedEventProducer.class);
+
+  /**
+   * Constructs a new instance.
+   */
+  public AuthorizationChangedEventProducer() {
+  }
+  
+  /**
+   * Invalidates the cache of a user which was modified. The cache entries for the user will be invalidated for the
+   * following reasons:
+   * <ul>
+   * <li>Admin or Active flag was modified.</li>
+   * <li>New user created, for the case of old cache values</li>
+   * <li>User deleted</li>
+   * </ul>
+   *
+   * @param event user event
+   */
+  @Subscribe
+  public void onEvent(UserEvent event) {
+    if (event.getEventType().isPost()) {
+      if (isModificationEvent(event)) {
+        handleUserModificationEvent((UserModificationEvent) event);
+      } else {
+        handleUserEvent(event);
+      }
+    }
+  }
+  
+  private boolean isModificationEvent(HandlerEventBase<?> event) {
+    return event instanceof ModificationHandlerEvent;
+  }
+  
+  private void handleUserEvent(UserEvent event) {
+    String username = event.getItem().getName();
+    logger.debug(
+      "fire authorization changed event for user {}, because of user {} event", username, event.getEventType()
+    );
+    fireEventForUser(username);
+  }
+  
+  private void handleUserModificationEvent(UserModificationEvent event) {
+    String username = event.getItem().getId();
+    User beforeModification = event.getItemBeforeModification();
+    if (isAuthorizationDataModified(event.getItem(), beforeModification)) {
+      logger.debug(
+        "fire authorization changed event for user {}, because of a authorization relevant field has changed", 
+        username
+      );
+      fireEventForUser(username);
+    } else {
+      logger.debug(
+        "authorization changed event for user {} is not fired, because no authorization relevant field has changed", 
+        username
+      );
+    }
+  }
+
+  private boolean isAuthorizationDataModified(User user, User beforeModification) {
+    return user.isAdmin() != beforeModification.isAdmin() || user.isActive() != beforeModification.isActive();
+  }
+
+  private void fireEventForUser(String username) {
+    sendEvent(AuthorizationChangedEvent.createForUser(username));
+  }
+
+  /**
+   * Invalidates the whole cache, if a repository has changed. The cache get cleared for one of the following reasons:
+   * <ul>
+   * <li>New repository created</li>
+   * <li>Repository was removed</li>
+   * <li>Archived, Public readable or permission field of the repository was modified</li>
+   * </ul>
+   *
+   * @param event repository event
+   */
+  @Subscribe
+  public void onEvent(RepositoryEvent event) {
+    if (event.getEventType().isPost()) {
+      if (isModificationEvent(event)) {
+        handleRepositoryModificationEvent((RepositoryModificationEvent) event);
+      } else {
+        handleRepositoryEvent(event);
+      }
+    }
+  }
+  
+  private void handleRepositoryModificationEvent(RepositoryModificationEvent event) {
+    Repository repository = event.getItem();
+    if (isAuthorizationDataModified(repository, event.getItemBeforeModification())) {
+      logger.debug(
+        "fire authorization changed event, because a relevant field of repository {} has changed", repository.getName()
+      );
+      fireEventForEveryUser();
+    } else {
+      logger.debug(
+        "authorization changed event is not fired, because non relevant field of repository {} has changed",
+        repository.getName()
+      );
+    }
+  }
+
+  private boolean isAuthorizationDataModified(Repository repository, Repository beforeModification) {
+    return repository.isArchived() != beforeModification.isArchived()
+      || repository.isPublicReadable() != beforeModification.isPublicReadable()
+      || ! repository.getPermissions().equals(beforeModification.getPermissions());
+  }
+  
+  private void fireEventForEveryUser() {
+    sendEvent(AuthorizationChangedEvent.createForEveryUser());
+  }
+  
+  private void handleRepositoryEvent(RepositoryEvent event){
+    logger.debug(
+      "fire authorization changed event, because of received {} event for repository {}", 
+      event.getEventType(), event.getItem().getName()
+    );
+    fireEventForEveryUser();
+  }
+
+  /**
+   * Invalidates the whole cache if a group permission has changed and invalidates the cached entries of a user, if a
+   * user permission has changed.
+   *
+   * @param event permission event
+   */
+  @Subscribe
+  public void onEvent(StoredAssignedPermissionEvent event) {
+    if (event.getEventType().isPost()) {
+      StoredAssignedPermission permission = event.getPermission();
+      if (permission.isGroupPermission()) {
+        handleGroupPermissionChange(permission);
+      } else {
+        handleUserPermissionChange(permission);
+      }
+    }
+  }
+  
+  private void handleGroupPermissionChange(StoredAssignedPermission permission) {
+    logger.debug(
+      "fire authorization changed event, because global group permission {} has changed", 
+      permission.getId()
+    );
+    fireEventForEveryUser();
+  }
+  
+  private void handleUserPermissionChange(StoredAssignedPermission permission) {
+    logger.debug(
+        "fire authorization changed event for user {}, because permission {} has changed", 
+        permission.getName(), permission.getId()
+    );
+    fireEventForUser(permission.getName());    
+  }
+
+  /**
+   * Invalidates the whole cache, if a group has changed. The cache get cleared for one of the following reasons:
+   * <ul>
+   * <li>New group created</li>
+   * <li>Group was removed</li>
+   * <li>Group members was modified</li>
+   * </ul>
+   *
+   * @param event group event
+   */
+  @Subscribe
+  public void onEvent(GroupEvent event) {
+    if (event.getEventType().isPost()) {
+      if (isModificationEvent(event)) {
+        handleGroupModificationEvent((GroupModificationEvent) event); 
+      } else {
+        handleGroupEvent(event);
+      }
+    }
+  }
+
+  private void handleGroupModificationEvent(GroupModificationEvent event) {
+    Group group = event.getItem();
+    if (isAuthorizationDataModified(group, event.getItemBeforeModification())) {
+      logger.debug("fire authorization changed event, because group {} has changed", group.getId());
+      fireEventForEveryUser();
+    } else {
+      logger.debug(
+        "authorization changed event is not fired, because non relevant field of group {} has changed", 
+        group.getId()
+      );
+    }
+  }
+  
+  private boolean isAuthorizationDataModified(Group group, Group beforeModification) {
+    return !group.getMembers().equals(beforeModification.getMembers());
+  }
+  
+  private void handleGroupEvent(GroupEvent event){
+    logger.debug(
+      "fire authorization changed event, because of received group event {} for group {}", 
+      event.getEventType(), 
+      event.getItem().getId()
+    );
+    fireEventForEveryUser();    
+  }
+  
+  @VisibleForTesting
+  protected void sendEvent(AuthorizationChangedEvent event) {
+    ScmEventBus.getInstance().post(event);
+  }
+  
+}

scm-webapp/src/main/java/sonia/scm/security/AuthorizationCollector.java

@@ -57,14 +57,11 @@ import org.slf4j.LoggerFactory;
 
 import sonia.scm.cache.Cache;
 import sonia.scm.cache.CacheManager;
-import sonia.scm.group.GroupEvent;
 import sonia.scm.group.GroupNames;
 import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryDAO;
-import sonia.scm.repository.RepositoryEvent;
 import sonia.scm.user.User;
-import sonia.scm.user.UserEvent;
 import sonia.scm.util.Util;
 
 //~--- JDK imports ------------------------------------------------------------
@@ -72,10 +69,6 @@ import sonia.scm.util.Util;
 import java.util.List;
 import java.util.Set;
 import sonia.scm.Filter;
-import sonia.scm.group.Group;
-import sonia.scm.group.GroupModificationEvent;
-import sonia.scm.repository.RepositoryModificationEvent;
-import sonia.scm.user.UserModificationEvent;
 
 /**
  *
@@ -98,7 +91,7 @@ public class AuthorizationCollector
     LoggerFactory.getLogger(AuthorizationCollector.class);
 
   //~--- constructors ---------------------------------------------------------
-
+  
   /**
    * Constructs ...
    *
@@ -114,8 +107,7 @@ public class AuthorizationCollector
     RepositoryDAO repositoryDAO, SecuritySystem securitySystem,
     PermissionResolver resolver)
   {
-    this.cache = cacheManager.getCache(CacheKey.class, AuthorizationInfo.class,
-      CACHE_NAME);
+    this.cache = cacheManager.getCache(CacheKey.class, AuthorizationInfo.class, CACHE_NAME);
     this.repositoryDAO = repositoryDAO;
     this.securitySystem = securitySystem;
     this.resolver = resolver;
@@ -146,189 +138,9 @@ public class AuthorizationCollector
     return authorizationInfo;
   }
 
-  /**
-   * Invalidates the cache of a user which was modified. The cache entries for the user will be invalidated for the
-   * following reasons:
-   * <ul>
-   * <li>Admin or Active flag was modified.</li>
-   * <li>New user created, for the case of old cache values</li>
-   * <li>User deleted</li>
-   * </ul>
-   *
-   * @param event user event
-   */
-  @Subscribe
-  public void onEvent(UserEvent event)
-  {
-    if (event.getEventType().isPost())
-    {
-      User user = event.getItem();
-      String username = user.getId();
-      if (event instanceof UserModificationEvent)
-      {
-        User beforeModification = ((UserModificationEvent) event).getItemBeforeModification();
-        if (shouldCacheBeCleared(user, beforeModification))
-        {
-          logger.debug("invalidate cache of user {}, because of a permission relevant field has changed", username);
-          invalidateUserCache(username);
-        }
-        else
-        {
-          logger.debug("cache of user {} is not invalidated, because no permission relevant field has changed", username);
-        }
-      }
-      else
-      {
-        logger.debug("invalidate cache of user {}, because of user {} event", username, event.getEventType());
-        invalidateUserCache(username);
-      }
-    }
-  }
-
-  private boolean shouldCacheBeCleared(User user, User beforeModification)
-  {
-    return user.isAdmin() != beforeModification.isAdmin() || user.isActive() != beforeModification.isActive();
-  }
-
-  private void invalidateUserCache(final String username)
-  {
-    cache.removeAll(new Filter<CacheKey>()
-    {
-      @Override
-      public boolean accept(CacheKey item)
-      {
-        return username.equalsIgnoreCase(item.username);
-      }
-    });
-  }
-
-  /**
-   * Invalidates the whole cache, if a repository has changed. The cache get cleared for one of the following reasons:
-   * <ul>
-   * <li>New repository created</li>
-   * <li>Repository was removed</li>
-   * <li>Archived, Public readable or permission field of the repository was modified</li>
-   * </ul>
-   *
-   * @param event repository event
-   */
-  @Subscribe
-  public void onEvent(RepositoryEvent event)
-  {
-    if (event.getEventType().isPost())
-    {
-      Repository repository = event.getItem();
-      
-      if (event instanceof RepositoryModificationEvent)
-      {
-        Repository beforeModification = ((RepositoryModificationEvent) event).getItemBeforeModification();
-        if (shouldCacheBeCleared(repository, beforeModification))
-        {
-          logger.debug("clear cache, because a relevant field of repository {} has changed", repository.getName());
-          cache.clear();
-        }
-        else
-        {
-          logger.debug(
-            "cache is not invalidated, because non relevant field of repository {} has changed",
-            repository.getName()
-          );
-        }
-      }
-      else
-      {
-        logger.debug("clear cache, received {} event of repository {}", event.getEventType(), repository.getName());
-        cache.clear();
-      }
-    }
-  }
-
-  private boolean shouldCacheBeCleared(Repository repository, Repository beforeModification)
-  {
-    return repository.isArchived() != beforeModification.isArchived()
-      || repository.isPublicReadable() != beforeModification.isPublicReadable()
-      || ! repository.getPermissions().equals(beforeModification.getPermissions());
-  }
-
-  /**
-   * Invalidates the whole cache if a group permission has changed and invalidates the cached entries of a user, if a
-   * user permission has changed.
-   *
-   *
-   * @param event permission event
-   */
-  @Subscribe
-  public void onEvent(StoredAssignedPermissionEvent event)
-  {
-    if (event.getEventType().isPost())
-    {
-      StoredAssignedPermission permission = event.getPermission();
-      if (permission.isGroupPermission())
-      {
-        logger.debug("clear cache, because global group permission {} has changed", permission.getId());
-        cache.clear();
-      }
-      else
-      {
-        logger.debug(
-            "clear cache of user {}, because permission {} has changed", 
-            permission.getName(), event.getPermission().getId()
-        );
-        invalidateUserCache(permission.getName());
-      }
-    }
-  }
-
-  /**
-   * Invalidates the whole cache, if a group has changed. The cache get cleared for one of the following reasons:
-   * <ul>
-   * <li>New group created</li>
-   * <li>Group was removed</li>
-   * <li>Group members was modified</li>
-   * </ul>
-   *
-   * @param event group event
-   */
-  @Subscribe
-  public void onEvent(GroupEvent event)
-  {
-    if (event.getEventType().isPost())
-    {
-      Group group = event.getItem();
-      if (event instanceof GroupModificationEvent)
-      {
-        Group beforeModification = ((GroupModificationEvent) event).getItemBeforeModification();
-        if (shouldCacheBeCleared(group, beforeModification))
-        {
-          logger.debug("clear cache, because group {} has changed", group.getId());
-          cache.clear();
-        }
-        else
-        {
-          logger.debug(
-            "cache is not invalidated, because non relevant field of group {} has changed",
-            group.getId()
-          );
-        }
-      }
-      else
-      {
-        logger.debug("clear cache, received group event {} for group {}", event.getEventType(), group.getId());
-        cache.clear();
-      }
-    }
-  }
-
-  private boolean shouldCacheBeCleared(Group group, Group beforeModification)
-  {
-    return !group.getMembers().equals(beforeModification.getMembers());
-  }
-
   /**
    * Method description
    *
-   *
-   *
    * @param principals
    *
    * @return
@@ -567,6 +379,30 @@ public class AuthorizationCollector
       || ((!perm.isGroupPermission()) && user.getName().equals(perm.getName()));
     //J+
   }
+  
+  @Subscribe
+  public void invalidateCache(AuthorizationChangedEvent event) {
+    if (event.isEveryUserAffected()) {
+      invalidateUserCache(event.getNameOfAffectedUser());
+    } else {
+      invalidateCache();
+    }
+  }
+  
+  private void invalidateUserCache(final String username) {
+    logger.info("invalidate cache for user {}, because of a received authorization event", username);
+    cache.removeAll(new Filter<CacheKey>() {
+      @Override
+      public boolean accept(CacheKey item) {
+        return username.equalsIgnoreCase(item.username);
+      }
+    });
+  }
+  
+  private void invalidateCache() {
+    logger.info("invalidate cache, because of a received authorization event");
+    cache.clear();
+  }
 
   //~--- inner classes --------------------------------------------------------
 

scm-webapp/src/main/java/sonia/scm/security/ScmRealm.java

@@ -35,6 +35,7 @@ package sonia.scm.security;
 
 //~--- non-JDK imports --------------------------------------------------------
 
+import com.google.common.eventbus.Subscribe;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 
@@ -46,9 +47,11 @@ import org.apache.shiro.authc.UnknownAccountException;
 import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.authc.pam.UnsupportedTokenException;
 import org.apache.shiro.authz.AuthorizationInfo;
+import org.apache.shiro.cache.CacheManager;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
-
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import sonia.scm.web.security.AuthenticationResult;
 import sonia.scm.web.security.AuthenticationState;
 
@@ -63,6 +66,11 @@ import sonia.scm.web.security.AuthenticationState;
 @Singleton
 public class ScmRealm extends AuthorizingRealm {
   
+  /**
+   * the logger for ScmRealm
+   */
+  private static final Logger logger = LoggerFactory.getLogger(ScmRealm.class);
+  
   public static final String NAME = "scm";
   
 
@@ -74,32 +82,35 @@ public class ScmRealm extends AuthorizingRealm {
   /**
    * Constructs a new scm realm.
    *
+   * @param cacheManager cache manager
    * @param authenticator authenticator facade
    * @param loginAttemptHandler login attempt handler
    * @param authcCollector authentication info collector
    * @param authzCollector authorization collector
    */
   @Inject
-  public ScmRealm(AuthenticatorFacade authenticator, LoginAttemptHandler loginAttemptHandler, 
+  public ScmRealm(CacheManager cacheManager,
+    AuthenticatorFacade authenticator, LoginAttemptHandler loginAttemptHandler, 
     AuthenticationInfoCollector authcCollector, AuthorizationCollector authzCollector) {
+    super(cacheManager);
+    
     this.authenticator = authenticator;
     this.loginAttemptHandler = loginAttemptHandler;
     this.authcCollector = authcCollector;
     this.authzCollector = authzCollector;
-    
 
     // set token class
     setAuthenticationTokenClass(UsernamePasswordToken.class);
 
-    // use own custom caching
-    setCachingEnabled(false);
-    setAuthenticationCachingEnabled(false);
-    setAuthorizationCachingEnabled(false);
-
     // set components
     setPermissionResolver(new RepositoryPermissionResolver());
   }
 
+  @Override
+  protected Object getAuthorizationCacheKey(PrincipalCollection principals) {
+    return principals.getPrimaryPrincipal();
+  }
+  
   @Override
   protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authToken) throws AuthenticationException {
     UsernamePasswordToken token = castToken(authToken);
@@ -138,4 +149,23 @@ public class ScmRealm extends AuthorizingRealm {
   protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals){
     return authzCollector.collect(principals);
   }
+
+  @Subscribe
+  public void invalidateCache(AuthorizationChangedEvent event) {
+    if (event.isEveryUserAffected()) {
+      invalidateUserCache(event.getNameOfAffectedUser());
+    } else {
+      invalidateCache();
+    }
+  }
+  
+  private void invalidateUserCache(final String username) {
+    logger.info("invalidate cache for user {}, because of a received authorization event", username);
+    getAuthorizationCache().remove(username);
+  }
+  
+  private void invalidateCache() {
+    logger.info("invalidate cache, because of a received authorization event");
+    getAuthorizationCache().clear();
+  }
 }