Skip to content

Commit b3e2219

Browse files
author
Prachi Damle
committed
More changes to support 'readOnly' access
Conflicts: api/src/org/apache/cloudstack/api/ApiConstants.java
1 parent a919f74 commit b3e2219

5 files changed

Lines changed: 16 additions & 5 deletions

File tree

‎api/src/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -594,7 +594,7 @@ public class ApiConstants {
594594
public static final String SUPPORTS_REGION_LEVEL_VPC = "supportsregionLevelvpc";
595595
public static final String SUPPORTS_STRECHED_L2_SUBNET = "supportsstrechedl2subnet";
596596
public static final String REGION_LEVEL_VPC = "regionlevelvpc";
597-
public static final String READ_ONLY = "readOnly";
597+
public static final String READ_ONLY = "readonly";
598598

599599

600600
public enum HostDetails {

‎server/src/com/cloud/acl/DomainChecker.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,6 +328,17 @@ else if (_accountService.isDomainAdmin(account.getId())) {
328328
@Override
329329
public boolean checkAccess(Account caller, ControlledEntity entity, AccessType accessType, String action)
330330
throws PermissionDeniedException {
331+
332+
if (action != null && ("SystemCapability".equals(action))) {
333+
if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_ADMIN) {
334+
return true;
335+
}
336+
337+
} else if (action != null && ("DomainCapability".equals(action))) {
338+
if (caller != null && caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN) {
339+
return true;
340+
}
341+
}
331342
return checkAccess(caller, entity, accessType);
332343
}
333344
}

‎services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AddIAMPermissionToIAMPolicyCmd.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@
2929
import org.apache.cloudstack.api.BaseAsyncCmd;
3030
import org.apache.cloudstack.api.Parameter;
3131
import org.apache.cloudstack.api.ServerApiException;
32-
import org.apache.cloudstack.api.BaseCmd.CommandType;
3332
import org.apache.cloudstack.api.response.iam.IAMPolicyResponse;
3433
import org.apache.cloudstack.context.CallContext;
3534
import org.apache.cloudstack.iam.IAMApiService;

‎services/iam/plugin/src/org/apache/cloudstack/iam/IAMApiServiceImpl.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -721,7 +721,8 @@ public void grantEntityPermissioinToAccounts(String entityType, Long entityId, A
721721
String description = "Policy to grant permission to " + entityType + entityId;
722722
policy = createIAMPolicy(caller, aclPolicyName, description, null);
723723
// add permission to this policy
724-
addIAMPermissionToIAMPolicy(policy.getId(), entityType, PermissionScope.RESOURCE, entityId, action, Permission.Allow, false);
724+
addIAMPermissionToIAMPolicy(policy.getId(), entityType, PermissionScope.RESOURCE, entityId, action,
725+
Permission.Allow, false, false);
725726
}
726727
// attach this policy to list of accounts if not attached already
727728
Long policyId = policy.getId();

‎services/iam/plugin/test/org/apache/cloudstack/iam/test/IAMApiServiceTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -295,8 +295,8 @@ public void addRemovePermissionToPolicyTest() {
295295
_iamSrv.addIAMPermissionToIAMPolicy(policyId, VirtualMachine.class.getSimpleName(),
296296
PermissionScope.RESOURCE.toString(), resId, "listVirtualMachines",
297297
AccessType.UseEntry.toString(), Permission.Allow, false)).thenReturn(policy);
298-
_aclSrv.addIAMPermissionToIAMPolicy(policyId, VirtualMachine.class.getSimpleName(),
299-
PermissionScope.RESOURCE, resId, "listVirtualMachines", Permission.Allow, false);
298+
_aclSrv.addIAMPermissionToIAMPolicy(policyId, IAMEntityType.VirtualMachine.toString(),
299+
PermissionScope.RESOURCE, resId, "listVirtualMachines", Permission.Allow, false, false);
300300
Pair<List<IAMPolicy>, Integer> policyList = new Pair<List<IAMPolicy>, Integer>(policies, 1);
301301
List<IAMPolicyPermission> policyPerms = new ArrayList<IAMPolicyPermission>();
302302
IAMPolicyPermission perm = new IAMPolicyPermissionVO(policyId, "listVirtualMachines",

0 commit comments

Comments
 (0)