Package org.camunda.bpm.webapp.impl.security

Class SetupAvailability

java.lang.Object
org.camunda.bpm.webapp.impl.security.SetupAvailability
public class SetupAvailability extends Object

Decides whether the initial setup of an engine - the creation of the very first administrator - may still be performed.

The setup steps are reachable without authentication by design, so this check is the only control protecting them. It must therefore consider an engine to be administered whenever an administrator exists by any of the routes the engine itself accepts (see AuthorizationManager.isCamundaAdmin(org.camunda.bpm.engine.impl.identity.Authentication)), not only by membership in Groups.CAMUNDA_ADMIN:

  • a user is a member of one of the configured administrator groups,
  • an administrator user is configured, e.g. by the AdministratorAuthorizationPlugin,
  • an authorization exists which grants ALL permissions on all authorizations, i.e. somebody can already administer authorizations and thus grant themselves any permission.

The last two checks only apply when authorization is enabled: without authorization the engine has no notion of an administrator, and blocking the setup there could lock an operator out of an engine with an empty user database.

All checks query the identity and authorization services and therefore have to be performed without authentication, see SecurityActions.runWithoutAuthentication(SecurityActions.SecurityAction, ProcessEngine).

  • Constructor Details

    • SetupAvailability

      protected SetupAvailability()

  • Method Details

    • isSetupAvailable

      public static boolean isSetupAvailable(ProcessEngine processEngine)
      Returns:
      true if the initial user may still be created through the setup steps

    • getSetupUnavailableReason

      public static String getSetupUnavailableReason(ProcessEngine processEngine)
      Returns:
      a human readable reason why the setup steps must not be performed, or null if they are still available

    • existsAdministratorAuthorization

      protected static boolean existsAdministratorAuthorization(ProcessEngine processEngine)

      Whether somebody already holds an administrator-equivalent authorization on Resources.AUTHORIZATION, i.e. one that lets its holder grant themselves every other permission:

      • UPDATE on any resource id. AuthorizationManager#update only checks UPDATE against the id of the authorization being changed, and the REST layer lets that update rewrite the authorization's subject, resource, resource id and permissions. Being allowed to change a single authorization is therefore enough to turn it into an ALL-on-* grant for oneself.
      • CREATE on the resource id *. AuthorizationManager#insert checks CREATE without a resource id, and such a check is only satisfied by an authorization with RESOURCE_ID_ = '*' - a CREATE authorization scoped to a single id grants nothing.

      ALL contains both permissions, which is what makes the members of Groups.CAMUNDA_ADMIN and the users of the AdministratorAuthorizationPlugin administrators. An engine containing such an authorization is administered even if the administrator group is empty.

      DELETE is not administrator-equivalent on its own - it cannot grant any permission - so an engine whose only authorization is a DELETE one has no administrator and stays bootstrappable.

    • existsAuthorization

      protected static boolean existsAuthorization(ProcessEngine processEngine, Permission permission, String resourceId)

      Whether a granting authorization on Resources.AUTHORIZATION conveys the given permission. Only the global and grant types are queried - a revoke authorization takes permissions away and must not close the gate.

      Parameters:
      resourceId - the resource id to restrict to, or null for any

    • getAdminGroups

      protected static List<String> getAdminGroups(ProcessEngineConfigurationImpl configuration)
      The configured administrator groups, always including Groups.CAMUNDA_ADMIN.

    • getConfiguration

      protected static ProcessEngineConfigurationImpl getConfiguration(ProcessEngine processEngine)