Package io.jenkins.plugins.batchcontrol.security

Class BatchControlRoleBasedAuthorizationStrategy

java.lang.Object

hudson.security.AuthorizationStrategy

com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

io.jenkins.plugins.batchcontrol.security.BatchControlRoleBasedAuthorizationStrategy

All Implemented Interfaces:

ExtensionPoint, Describable<AuthorizationStrategy>, GrantLayeredStrategy

public class BatchControlRoleBasedAuthorizationStrategy
extends com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
implements GrantLayeredStrategy

role-strategy's role-based strategy with Batch Control grants layered on top (D-35a, ARCHITECTURE section 4). Being a RoleBasedAuthorizationStrategy, it passes every instanceof check role-strategy makes: Manage and Assign Roles, the REST API and pipeline steps (getInstance()), pattern-based Item/Create and the role naming strategy keep working, and the role maps decide underneath the grant layer.

The item overloads are wrapped in a GrantAwareACL with the item's full name; the agent overloads with no grant scope (grants never apply to agents), which passes every decision through. The root ACL is not wrapped: the parent declares it as a SidACL, and the root carries no grant scope anyway (S-13). With no active grant, or while change control is off, the strategy behaves exactly like its parent.

D-35f, D-35g: role-strategy 927 or later is required (pinned in the pom). Since 918, the Manage Roles, Assign Roles and permission template pages edit the installed strategy in place, so every save keeps this class; the reset to a plain RoleBasedAuthorizationStrategy that older versions' Manage Roles save performed (D-35a, PoC-5 row 6) no longer happens. Installing a plain strategy on the global security page still stops grants from conferring (fail-safe), and ops.BatchControlStrategyMonitor then offers to reinstall this class.

role-strategy is an optional dependency; the descriptor is an optional extension.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	BatchControlRoleBasedAuthorizationStrategy.ConverterImpl	role-strategy's converter is public: the on-disk format is the same, only the type differs.
static final class	BatchControlRoleBasedAuthorizationStrategy.DescriptorImpl	Listed on the security page.

Nested classes/interfaces inherited from class hudson.security.AuthorizationStrategy

AuthorizationStrategy.Unsecured

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields inherited from class com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

ADMINISTER_AND_SOME_ROLES_ADMIN, AGENT_ROLES_ADMIN, DESCRIPTOR, GLOBAL, GROUP, ITEM_ROLES_ADMIN, MACRO_ROLE, MACRO_USER, PERMISSION_TEMPLATES, PROJECT, SLAVE, SYSTEM_READ_AND_ITEM_ROLES_ADMIN, SYSTEM_READ_AND_SOME_ROLES_ADMIN

Fields inherited from class hudson.security.AuthorizationStrategy

LIST, UNSECURED

Constructor Summary

Constructors

Constructor	Description
BatchControlRoleBasedAuthorizationStrategy(Map<String,com.michelin.cio.hudson.plugins.rolestrategy.RoleMap> grantedRoles, Set<com.michelin.cio.hudson.plugins.rolestrategy.PermissionTemplate> permissionTemplates)

Method Summary

Modifier and Type	Method	Description
ACL	getACL(AbstractItem item)
ACL	getACL(Computer computer)
ACL	getACL(Job<?,?> project)
ACL	getACL(Node node)
AuthorizationStrategy	toPlainStrategy()	A plain instance of the parent strategy with every entry of this one: the uninstall path of the migration action (D-35a).

Methods inherited from class com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

doAddRole, doAddTemplate, doAssignGroupRole, doAssignRole, doAssignUserRole, doDeleteGroup, doDeleteSid, doDeleteUser, doGetAllRoles, doGetMatchingAgents, doGetMatchingJobs, doGetRole, doGetRoleAssignments, doGetSidsInfo, doGetTemplate, doRemoveRoles, doRemoveTemplates, doUnassignGroupRole, doUnassignRole, doUnassignUserRole, getGrantedRoles, getGrantedRoles, getGrantedRolesEntries, getGrantedRolesEntries, getGroups, getInstance, getPermissionTemplate, getPermissionTemplates, getRoleMap, getRootACL, getSidEntries, getSIDs, hasPermissionTemplate, init, isCreateAllowed, validateConfig

Methods inherited from class hudson.security.AuthorizationStrategy

all, getACL, getACL, getACL, getACL, getACL

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface hudson.model.Describable

getDescriptor

Constructor Details

BatchControlRoleBasedAuthorizationStrategy

public BatchControlRoleBasedAuthorizationStrategy(Map<String,com.michelin.cio.hudson.plugins.rolestrategy.RoleMap> grantedRoles,
 @CheckForNull
 Set<com.michelin.cio.hudson.plugins.rolestrategy.PermissionTemplate> permissionTemplates)

Method Details

getACL

@NonNull
public ACL getACL(@NonNull
 Job<?,?> project)

Overrides:

getACL in class com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

getACL

@NonNull
public ACL getACL(@NonNull
 AbstractItem item)

Overrides:

getACL in class com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

getACL

@NonNull
public ACL getACL(@NonNull
 Computer computer)

Overrides:

getACL in class com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

getACL

@NonNull
public ACL getACL(@NonNull
 Node node)

Overrides:

getACL in class com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy

toPlainStrategy

@NonNull
public AuthorizationStrategy toPlainStrategy()

Description copied from interface: GrantLayeredStrategy

A plain instance of the parent strategy with every entry of this one: the uninstall path of the migration action (D-35a). The returned strategy confers nothing through grants.

Specified by:

toPlainStrategy in interface GrantLayeredStrategy