Package org.dspace.app.rest.security
package org.dspace.app.rest.security
DSpace-specific concepts and behaviors to support Spring Security.
These may be used by Spring EL expressions in Spring Security annotations.
hasPermission terms are evaluated by
DSpacePermissionEvaluator, an implementation of Spring's
PermissionEvaluator. It tests access to specific model objects
(Item, EPerson etc.) using those objects' policies. It is injected with a
collection of RestPermissionEvaluatorPlugins which do the work.
hasAuthority terms are implemented by GrantedAuthority
implementations such as EPersonRestAuthenticationProvider. These
test for authorization properties of the session itself, such as membership
in the site administrators group.
*PermissionEvaluatorPlugin classes test permission for specific
types of objects. They implement RestPermissionEvaluatorPlugin.
Other classes TBD:
- *Filter
- *Configuration
-
ClassDescriptionAdministrators are always allowed to perform any action on any DSpace object.This is a Filter class that'll fetch special groups from the
AuthenticationServiceand set these in the current DSpace Context.DSpaceObjectPermissionEvaluatorPlugin will check permissions based on the DSpaceAuthorizeService.Used byBitstreamRestRepository.findOne(Context, UUID)to get metadata of private bitstreams even though user can't access actual fileAn authenticated user is allowed to interact with a claimed task only if they own it claim.Custom logout handler to support stateless sessionsSpring security authentication entry point to return a 401 response for unauthorized requests This class is used in theWebSecurityConfigurationclass.Custom Authentication for use with DSpaceCustom SessionAuthenticationStrategy to be used alongside DSpaceCsrfTokenRepository.This is a custom Spring Security CsrfTokenRepository which supports *cross-domain* CSRF protection (allowing the client and backend to be on different domains).RestPermissionEvaluatorPluginclass that evaluate admin permission against a generic DSpace Object.DSpace permission evaluator.Enum that lists all available "permissions" an authenticated user can have on a specific REST endpoint.This class is responsible for authenticating a user via REST.An authenticated user is allowed to view, update or delete their own data.Methods of this class are used on PreAuthorize annotations to convert input parameters.An authenticated user is allowed to view information on all the groups they are a member of (READ permission).This EnableMethodSecurity configuration enables Spring Security annotation checks on all methods (e.g.This class will filter OpenID Connect (OIDC) requests and try and authenticate them.Permission evaluator plugin that check if the current user can perform an ORCID synchronization.This class will filter ORCID requests and try and authenticate them.Class that evaluate DELETE and READ permissionsPermission evaluator plugin that check if the current user can search for ORCID queue records by owner.An authenticated user is allowed to interact with a pool task only if it is in their list.This class will handle calls made to Process endpoints.This class will handle Permissions for theQAEventRestobject and its callsThis class will handle Permissions for theQASourceRestobject andQATopicRestPermissionEvaluatorPluginclass that evaluate READ permissions for an AuthorizationAn authenticated user is allowed to view, update or delete their own data.RestPermissionEvaluatorPluginclass that evaluate ADMIN permissions over a Resource PolicyRestPermissionEvaluatorPluginclass that evaluate READ, WRITE and DELETE permissions over a ResourcePolicy.Interface for a service that can provide authentication for the REST APIAbstractRestPermissionEvaluatorPluginclass that contains utility methods to evaluate permissions for a Rest Object.Interface to define a permission evaluator plugin.A filter that examines requests to see if the user has been authenticated via SAML.This class will filter Shibboleth requests to see if the user has been authenticated via Shibboleth.Custom Spring authentication filter for Stateless authentication, intercepts requests to check for valid authentication.This class will filter /api/authn/login requests to try and authenticate them.This class will handle calls made to SubmissionCCLicenseUrlRest endpoints.RestPermissionEvaluatorPluginclass that evaluate READ, WRITE and DELETE permissions over a SubscriptionAn authenticated user is allowed to view a suggestion related to a Target object that he owns (as defined by "dspace.object.owner" metadata field) SeeRestPermissionEvaluatorPluginfor the inherited contract.An authenticated user is allowed to view a suggestion summary (SuggestionTarget) related to a Target object that they own (as defined by "dspace.object.owner" metadata field) SeeRestPermissionEvaluatorPluginfor the inherited contract.RestObjectPermissionEvaluatorPluginclass that evaluate WRITE and DELETE permission over a TemplateItemThis class will handle Permissions for theUsageReportRestobject and its callsThis class acts as a PermissionEvaluator to decide whether a given request to a Versioning endpoint is allowed to pass through or notMethods of this class are used on PreAuthorize annotations to check security on versioning endpointThis class evaluate ADMIN permissions to patch operation over a Version.This class acts as a PermissionEvaluator to decide whether a given request to a Versioning endpoint is allowed to pass through or not.Spring Security configuration for DSpace Server WebappThis class will contain the logic to allow us to evaluate an expression given through a String.An authenticated user is allowed to interact with workflow item only if they belong to a task that they own or could claim.RestPermissionEvaluatorPluginclass that evaluate READ, WRITE and DELETE permissions over a WorkspaceItem.