com.marklogic.hub.deploy.commands

Class CreateGranularPrivilegesCommand

java.lang.Object

com.marklogic.client.ext.helper.LoggingObject

com.marklogic.hub.deploy.commands.CreateGranularPrivilegesCommand

All Implemented Interfaces:

com.marklogic.appdeployer.command.Command, com.marklogic.appdeployer.command.UndoableCommand

public class CreateGranularPrivilegesCommand
extends com.marklogic.client.ext.helper.LoggingObject
implements com.marklogic.appdeployer.command.Command, com.marklogic.appdeployer.command.UndoableCommand

Command for creating granular privileges after the resources that these privileges depend on have been created.

See the comments on saveGranularPrivileges for important information about how this class attempts to avoid causing an error by trying to create a privilege with the same action as an existing one.

Field Summary

Fields

Modifier and Type	Field and Description
static java.util.List<java.lang.String>	ROLES_THAT_CAN_BE_INHERITED Defines the roles that can be inherited when a data-hub-security-admin creates or edits a custom role.

Fields inherited from class com.marklogic.client.ext.helper.LoggingObject

logger

Constructor Summary

Constructors

Constructor and Description
CreateGranularPrivilegesCommand(HubConfig hubConfig)
CreateGranularPrivilegesCommand(HubConfig hubConfig, java.util.List<java.lang.String> groupNames)

Method Summary

Modifier and Type	Method and Description
protected java.util.Map<java.lang.String,com.marklogic.mgmt.api.security.Privilege>	buildGranularPrivileges(com.marklogic.mgmt.ManageClient manageClient)
void	execute(com.marklogic.appdeployer.command.CommandContext context)
java.lang.Integer	getExecuteSortOrder() It is anticipated that these privileges can always be added at the end of a deployment because none of the steps before that should depend on the privileges being added.
java.util.List<java.lang.String>	getGroupNames()
protected java.util.List<java.lang.String>	getGroupNamesForScheduledTaskPrivileges()
java.lang.Integer	getUndoSortOrder()
protected void	saveGranularPrivileges(com.marklogic.mgmt.ManageClient manageClient, java.util.Map<java.lang.String,com.marklogic.mgmt.api.security.Privilege> granularPrivileges) Save each of the given privileges.
void	undo(com.marklogic.appdeployer.command.CommandContext context) Delete every granular privilege.

Methods inherited from class com.marklogic.client.ext.helper.LoggingObject

format

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ROLES_THAT_CAN_BE_INHERITED

public static final java.util.List<java.lang.String> ROLES_THAT_CAN_BE_INHERITED

Defines the roles that can be inherited when a data-hub-security-admin creates or edits a custom role.

Constructor Detail

CreateGranularPrivilegesCommand

public CreateGranularPrivilegesCommand(HubConfig hubConfig)

CreateGranularPrivilegesCommand

public CreateGranularPrivilegesCommand(HubConfig hubConfig,
                                       java.util.List<java.lang.String> groupNames)

Method Detail

getExecuteSortOrder

public java.lang.Integer getExecuteSortOrder()

It is anticipated that these privileges can always be added at the end of a deployment because none of the steps before that should depend on the privileges being added.

Specified by:

getExecuteSortOrder in interface com.marklogic.appdeployer.command.Command

Returns:

getUndoSortOrder

public java.lang.Integer getUndoSortOrder()

Specified by:

getUndoSortOrder in interface com.marklogic.appdeployer.command.UndoableCommand

execute

public void execute(com.marklogic.appdeployer.command.CommandContext context)

Specified by:

execute in interface com.marklogic.appdeployer.command.Command

undo

public void undo(com.marklogic.appdeployer.command.CommandContext context)

Delete every granular privilege. Not to be used in a DHS environment of course.

Specified by:

undo in interface com.marklogic.appdeployer.command.UndoableCommand

Parameters:

context -

buildGranularPrivileges

protected java.util.Map<java.lang.String,com.marklogic.mgmt.api.security.Privilege> buildGranularPrivileges(com.marklogic.mgmt.ManageClient manageClient)

Parameters:

manageClient -

Returns:

a map of privilege action, containing an ID, and a Privilege object to be saved. The key must be an action with an ID so that we can determine if a privilege with the same action already exists.

saveGranularPrivileges

protected void saveGranularPrivileges(com.marklogic.mgmt.ManageClient manageClient,
                                      java.util.Map<java.lang.String,com.marklogic.mgmt.api.security.Privilege> granularPrivileges)

Save each of the given privileges. For each key in the map - where the key is expected to be an action with a resource ID in it - we check to see if an existing privilege has the same action. If so, then the roles in the granular privilege are added to that existing privilege. This ensures we never cause an error by trying to create a privilege with the same action as an existing one. This is crucial for DHS, as the DHS config will create some of the same granular privileges that DHF needs to create (but with a different name).

Parameters:

manageClient -

granularPrivileges -

getGroupNamesForScheduledTaskPrivileges

protected java.util.List<java.lang.String> getGroupNamesForScheduledTaskPrivileges()

getGroupNames

public java.util.List<java.lang.String> getGroupNames()