Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OAK-9415 expose the bound principals of a session as attribute #291

Closed
wants to merge 5 commits into from
Closed

OAK-9415 expose the bound principals of a session as attribute #291

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
289958c
OAK-9415 exposed the bound principals of a session as attribute
kwin Apr 28, 2021
3d7a7e5
clarify documentation
kwin Apr 28, 2021
e641c4c
fix test which incorrectly assumes that the refresh interval is always
kwin Apr 28, 2021
ce2fc61
make tests more stable by not relying on attribute name order
kwin Apr 28, 2021
1fc6f92
extend tests to cover attribute "oak.bound-principals"
kwin Apr 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
17 changes: 16 additions & 1 deletion oak-doc/src/site/markdown/differences.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@
limitations under the License.
-->

<!-- MACRO{toc} -->

Backward compatibility
======================

Expand Down Expand Up @@ -316,6 +318,19 @@ Node Name Length Limit

With the document storage backend (MongoDB, RDBMS), there is currently
a limit of 150 UTF-8 bytes on the length of the node names.
See also OAK-2644.
See also [OAK-2644](https://issues.apache.org/jira/browse/OAK-2644).

Session Attributes
------------------

Oak exposes the following attributes via [`Session.getAttribute(...)`][1] and [`Session.getAttributeNames()`][2].
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's not entirely correct.... it also exposes credentials attributes as intended by the JCR specification. maybe rather state something like: in addition to attributes defined on credentials.......

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 3d7a7e5.


Attribute Name | Attribute Value Type | Description
--- | --- | ---
`oak.refresh-interval` | `Long` | The session refresh interval in seconds.
`oak.relaxed-locking` | `Boolean` | Whether relaxed locking behaviour is enabled for the session. See [OAK-1329](https://issues.apache.org/jira/browse/OAK-1329).
`oak.bound-principals` | `Set<Principal>` | The principals associated with the JCR session. See [OAK-9415](https://issues.apache.org/jira/browse/OAK-9415)

[0]: https://docs.adobe.com/content/docs/en/spec/jsr170/javadocs/jcr-2.0/javax/jcr/Session.html#setNamespacePrefix(java.lang.String,%20java.lang.String)
[1]: https://docs.adobe.com/content/docs/en/spec/jsr170/javadocs/jcr-2.0/javax/jcr/Session.html#getAttribute(java.lang.String)
[2]: https://docs.adobe.com/content/docs/en/spec/jsr170/javadocs/jcr-2.0/javax/jcr/Session.html#getAttributeNames()
7 changes: 7 additions & 0 deletions oak-jcr/src/main/java/org/apache/jackrabbit/oak/jcr/repository/RepositoryImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,13 @@ public class RepositoryImpl implements JackrabbitRepository {
*/
public static final String RELAXED_LOCKING = "oak.relaxed-locking";

/**
* Name of the session attribute exposing the associated principals
*
* @see <a href="https://issues.apache.org/jira/browse/OAK-9415">OAK-9415</a>
*/
public static final String BOUND_PRINCIPALS = "oak.bound-principals";

/**
* logger instance
*/
Expand Down
5 changes: 5 additions & 0 deletions oak-jcr/src/main/java/org/apache/jackrabbit/oak/jcr/session/SessionImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@
import org.apache.jackrabbit.oak.jcr.delegate.NodeDelegate;
import org.apache.jackrabbit.oak.jcr.delegate.PropertyDelegate;
import org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate;
import org.apache.jackrabbit.oak.jcr.repository.RepositoryImpl;
import org.apache.jackrabbit.oak.jcr.security.AccessManager;
import org.apache.jackrabbit.oak.jcr.session.operation.SessionOperation;
import org.apache.jackrabbit.oak.jcr.xml.ImportHandler;
Expand Down Expand Up @@ -248,11 +249,15 @@ public String getUserID() {
public String[] getAttributeNames() {
Set<String> names = newTreeSet(sessionContext.getAttributes().keySet());
Collections.addAll(names, sd.getAuthInfo().getAttributeNames());
names.add(RepositoryImpl.BOUND_PRINCIPALS);
return names.toArray(new String[names.size()]);
}

@Override
public Object getAttribute(String name) {
if (RepositoryImpl.BOUND_PRINCIPALS.equals(name)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i would rather move that to the end of the method.... as the last piece to check.... in other words: if someone came up with the crazy idea to set "oak.bound_principals" attribute on his credentials, it probably should take precedence to fulfill the API contract defined by the JCR specification, shouldn't it?

Copy link
Member Author

@kwin kwin Apr 28, 2021 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is IMHO dangerous, as the bound principals can be used for checking if certain code paths should be allowed (e.g. in the context of FileVault). If someone can forge these attributes by just creating a (otherwise restricted) session with those parameters, this could easily be abused for privilege escalation. IMHO those values should not be allowed to be overwritten by consumers.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fair point..... so let's keep it the way it is.

return sd.getAuthInfo().getPrincipals();
}
Object attribute = sd.getAuthInfo().getAttribute(name);
if (attribute == null) {
attribute = sessionContext.getAttributes().get(name);
Expand Down