CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

MIFOSX-333: ensure authenticaton only returns roles of the authenticated user.

Browse Source
This commit is contained in:
Keith Woodlock
2013-05-03 13:27:39 +01:00
parent 92f3c1474e
commit 950f6a5f44
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/api/AuthenticationApiResource.java
+8 -5
View File
@@ -7,6 +7,7 @@ package org.mifosplatform.infrastructure.security.api;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collection; import java.util.Collection;
import java.util.Set;
import javax.ws.rs.Consumes; import javax.ws.rs.Consumes;
import javax.ws.rs.POST; import javax.ws.rs.POST;
@@ -19,7 +20,7 @@ import org.mifosplatform.infrastructure.core.serialization.ToApiJsonSerializer;
import org.mifosplatform.infrastructure.security.data.AuthenticatedUserData; import org.mifosplatform.infrastructure.security.data.AuthenticatedUserData;
import org.mifosplatform.useradministration.data.RoleData; import org.mifosplatform.useradministration.data.RoleData;
import org.mifosplatform.useradministration.domain.AppUser; import org.mifosplatform.useradministration.domain.AppUser;
import org.mifosplatform.useradministration.service.RoleReadPlatformService; import org.mifosplatform.useradministration.domain.Role;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Scope; import org.springframework.context.annotation.Scope;
@@ -38,15 +39,13 @@ public class AuthenticationApiResource {
private final DaoAuthenticationProvider customAuthenticationProvider; private final DaoAuthenticationProvider customAuthenticationProvider;
private final ToApiJsonSerializer<AuthenticatedUserData> apiJsonSerializerService; private final ToApiJsonSerializer<AuthenticatedUserData> apiJsonSerializerService;
private final RoleReadPlatformService roleReadPlatformService;
@Autowired @Autowired
public AuthenticationApiResource( public AuthenticationApiResource(
@Qualifier("customAuthenticationProvider") final DaoAuthenticationProvider customAuthenticationProvider, @Qualifier("customAuthenticationProvider") final DaoAuthenticationProvider customAuthenticationProvider,
final ToApiJsonSerializer<AuthenticatedUserData> apiJsonSerializerService, final RoleReadPlatformService roleReadPlatformService) { final ToApiJsonSerializer<AuthenticatedUserData> apiJsonSerializerService) {
this.customAuthenticationProvider = customAuthenticationProvider; this.customAuthenticationProvider = customAuthenticationProvider;
this.apiJsonSerializerService = apiJsonSerializerService; this.apiJsonSerializerService = apiJsonSerializerService;
this.roleReadPlatformService = roleReadPlatformService;
} }
@POST @POST
@@ -68,7 +67,11 @@ public class AuthenticationApiResource {
AppUser principal = (AppUser) authenticationCheck.getPrincipal(); AppUser principal = (AppUser) authenticationCheck.getPrincipal();
byte[] base64EncodedAuthenticationKey = Base64.encode(username + ":" + password); byte[] base64EncodedAuthenticationKey = Base64.encode(username + ":" + password);
Collection<RoleData> roles = this.roleReadPlatformService.retrieveAll(); Collection<RoleData> roles = new ArrayList<RoleData>();
Set<Role> userRoles = principal.getRoles();
for (Role role : userRoles) {
roles.add(role.toData());
}
authenticatedUserData = new AuthenticatedUserData(username, roles, permissions, principal.getId(), new String( authenticatedUserData = new AuthenticatedUserData(username, roles, permissions, principal.getId(), new String(
base64EncodedAuthenticationKey)); base64EncodedAuthenticationKey));