Split the Root Admin policy to allow 'ListEntry' access for listing resources for scope 'all', but 'UseEntry' access only within Account scope

Prachi Damle · minchen07 · commit df302bdb3e99 · 2014-04-04T16:38:29.000-07:00
Same with Domain Admin policy
diff --git a/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedAPIAccessChecker.java b/services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedAPIAccessChecker.java
@@ -218,23 +218,6 @@ public void setServices(List<PluggableService> services) {
     private void addDefaultAclPolicyPermission(String apiName, Class<?> cmdClass, RoleType role) {
         AccessType accessType = null;
         Class<?>[] entityTypes = null;
-        if (cmdClass != null) {
-            BaseCmd cmdObj;
-            try {
-                cmdObj = (BaseCmd) cmdClass.newInstance();
-                if (cmdObj instanceof BaseListCmd) {
-                    accessType = AccessType.UseEntry;
-                } else if (!(cmdObj instanceof BaseAsyncCreateCmd)) {
-                    accessType = AccessType.OperateEntry;
-                }
-            } catch (Exception e) {
-                throw new CloudRuntimeException(String.format(
-                        "%s is claimed as an API command, but it cannot be instantiated", cmdClass.getName()));
-             }
-
-            APICommand at = cmdClass.getAnnotation(APICommand.class);
-            entityTypes = at.entityType();
-        }
 
         PermissionScope permissionScope = PermissionScope.ACCOUNT;
         Long policyId = getDefaultPolicyId(role);
@@ -256,15 +239,47 @@ private void addDefaultAclPolicyPermission(String apiName, Class<?> cmdClass, Ro
             break;
          }
 
+        boolean addAccountScopedUseEntry = false;
+
+        if (cmdClass != null) {
+            BaseCmd cmdObj;
+            try {
+                cmdObj = (BaseCmd) cmdClass.newInstance();
+                if (cmdObj instanceof BaseListCmd) {
+                    if (permissionScope == PermissionScope.ACCOUNT) {
+                        accessType = AccessType.UseEntry;
+                    } else {
+                        accessType = AccessType.ListEntry;
+                        addAccountScopedUseEntry = true;
+                    }
+                } else if (!(cmdObj instanceof BaseAsyncCreateCmd)) {
+                    accessType = AccessType.OperateEntry;
+                }
+            } catch (Exception e) {
+                throw new CloudRuntimeException(String.format(
+                        "%s is claimed as an API command, but it cannot be instantiated", cmdClass.getName()));
+            }
+
+            APICommand at = cmdClass.getAnnotation(APICommand.class);
+            entityTypes = at.entityType();
+        }
 
         if (entityTypes == null || entityTypes.length == 0) {
             _iamSrv.addIAMPermissionToIAMPolicy(policyId, null, permissionScope.toString(), new Long(IAMPolicyPermission.PERMISSION_SCOPE_ID_CURRENT_CALLER),
                     apiName, (accessType == null) ? null : accessType.toString(), Permission.Allow, false);
+            if (addAccountScopedUseEntry) {
+                _iamSrv.addIAMPermissionToIAMPolicy(policyId, null, PermissionScope.ACCOUNT.toString(), new Long(
+                        IAMPolicyPermission.PERMISSION_SCOPE_ID_CURRENT_CALLER), apiName, AccessType.UseEntry.toString(), Permission.Allow, false);
+            }
         } else {
             for (Class<?> entityType : entityTypes) {
                 _iamSrv.addIAMPermissionToIAMPolicy(policyId, entityType.getSimpleName(), permissionScope.toString(), new Long(
                         IAMPolicyPermission.PERMISSION_SCOPE_ID_CURRENT_CALLER),
                         apiName, (accessType == null) ? null : accessType.toString(), Permission.Allow, false);
+                if (addAccountScopedUseEntry) {
+                    _iamSrv.addIAMPermissionToIAMPolicy(policyId, entityType.getSimpleName(), PermissionScope.ACCOUNT.toString(), new Long(
+                            IAMPolicyPermission.PERMISSION_SCOPE_ID_CURRENT_CALLER), apiName, AccessType.UseEntry.toString(), Permission.Allow, false);
+                }
             }
          }
 
