Determines if the passed-in IPerson represents a user that is a member of the administrator
group or any of its sub groups.

@param p
@return
182735
public static boolean isAdmin(IPerson p) {
        IAuthorizationPrincipal iap =
                AuthorizationServiceFacade.instance()
                        .newPrincipal(
                                p.getEntityIdentifier().getKey(),
                                p.getEntityIdentifier().getType());

        return isAdmin(iap);
    }
806012
public boolean hasPrincipalsInOtherOus() {

        if (m_hasPrincipalsInOtherOus == null) {
            // lazzy initialization
            m_hasPrincipalsInOtherOus = Boolean.FALSE;
            try {
                Iterator<CmsPrincipal> itPrincipals = getPrincipals(true).iterator();
                while (itPrincipals.hasNext()) {
                    CmsPrincipal principal = itPrincipals.next();
                    if (!principal.getOuFqn().equals(getCms().getRequestContext().getCurrentUser().getOuFqn())) {
                        m_hasPrincipalsInOtherOus = Boolean.TRUE;
                        break;
                    }
                }
            } catch (Exception e) {
                // ignore
            }
        }
        return m_hasPrincipalsInOtherOus.booleanValue();
    }
1268273
public boolean checkPermission(Principal user, int operation) 
  {  
    if (tc.isEntryEnabled()) 
      SibTr.entry(tc, "checkPermission", new Object[]{user, new Integer(operation)});
    boolean allowed = false;
    
    if(operation == 1) // a publish operation
    {
      // check whether permission has been granted to special group Everyone. 
      // We can do this before we check whether the user is authenticated
      if(accumGroupAllowedToPublish.size() > 0
         && accumGroupAllowedToPublish.contains(everyone))
      {
        allowed = true;
      }
      // Now check whether the user is authenticated, ie we have a username
      else if (user.getName() != null 
               && user.getName().length() > 0)
      {
        // User is authenticated
                  
        // Check user list next
        if(accumUsersAllowedToPublish.size() > 0 &&
            accumUsersAllowedToPublish.contains(user))
        {
          allowed = true;
        }
        else // Now check the groups
        {
          if(accumGroupAllowedToPublish.size() > 0)
          {
            // user hasn't been granted access directly, check the groups
            // check for AllAuthenticated first     
            if (accumGroupAllowedToPublish.contains(allAuthenticated))
            {
              allowed = true;
            }
            else
            {              
              Iterator itr = accumGroupAllowedToPublish.iterator();
              while (itr.hasNext())
              {
                Group group = (Group)itr.next();
                if(group.isMember(user))
                {
                  allowed = true;
                  break;
                }
              } // eof while
            }
          }
        } 
      }
    }
    else // a subscribe operation
    {
      // check whether permission has been granted to special group Everyone. 
      // We can do this before we check whether the user is authenticated
      if(accumGroupAllowedToSubscribe.size() > 0
         && accumGroupAllowedToSubscribe.contains(everyone))
      {
        allowed = true;
      }
      // Now check whether the user is authenticated, ie we have a username
      else if (user.getName() != null 
               && user.getName().length() > 0)
      {
        // User is authenticated
                  
        // Check user list next        
        if(accumUsersAllowedToSubscribe.size() > 0 &&
           accumUsersAllowedToSubscribe.contains(user))
        {
          allowed = true;
        }
        else // Now check the groups
        {
          if(accumGroupAllowedToSubscribe.size() > 0)
          {
            // user hasn't been granted access directly, check the groups
            // check for AllAuthenticated first     
            if (accumGroupAllowedToSubscribe.contains(allAuthenticated))
            {
              allowed = true;
            }
            else
            {                       
              Iterator itr = accumGroupAllowedToSubscribe.iterator();
           
              while (itr.hasNext())
              {
                Group group = (Group)itr.next();
                if(group.isMember(user))
                {
                  allowed = true;
                  break;
                }
              }
            }
          } 
        } 
      }       
    }
    if (tc.isEntryEnabled()) SibTr.exit(tc, "checkPermission", new Boolean(allowed));
    return allowed;
  }
1253254
protected IAuthorizationPrincipal getPrincipalForUser(final IPerson person) {
        final EntityIdentifier ei = person.getEntityIdentifier();
        return AuthorizationServiceFacade.instance().newPrincipal(ei.getKey(), ei.getType());
    }
1129252
protected boolean validateInternal(final J2EContext context, final String grantType, final ProfileManager manager,
                                       final UserProfile userProfile) {
        return false;
    }
690957
public boolean hasPermission(Authentication authentication,
                                 Object resource,
                                 Object privilege) {
        boolean logPermission = isLogPermission(resource);
        return checkRole(authentication, privilege, logPermission)
            || checkPermission(authentication, resource, privilege, true, logPermission);
    }
751909
private IAuthorizationPrincipal getAuthorizationPrincipal(Authentication authentication) {

        final Object authPrincipal = authentication.getPrincipal();
        logger.trace("getAuthorizationPrincipal -- authPrincipal=[{}]", authPrincipal);

        String username;
        if (authPrincipal instanceof UserDetails) {
            // User is authenticated
            UserDetails userDetails = (UserDetails) authPrincipal;
            logger.trace(
                    "getAuthorizationPrincipal -- AUTHENTICATED, userDetails=[{}]", userDetails);
            username = userDetails.getUsername();
        } else {
            // Which guest user are we?
            final HttpServletRequest req = portalRequestUtils.getCurrentPortalRequest();
            final IPerson person = personManager.getPerson(req);
            logger.trace("getAuthorizationPrincipal -- UNAUTHENTICATED, person=[{}]", person);
            username = person.getUserName();
        }

        return authorizationServiceFacade.newPrincipal(username, IPerson.class);
    }
1303602
@Override
    public final Set<IPersonAttributes> getPeopleWithMultivaluedAttributes(
            Map<String, List<Object>> query) {
        Validate.notNull(query, "query may not be null.");

        // Generate the query to pass to the subclass
        final LocalAccountQuery queryBuilder = this.generateQuery(query);
        if (queryBuilder == null) {
            this.logger.debug(
                    "No queryBuilder was generated for query " + query + ", null will be returned");

            return null;
        }

        // Get the username from the query, if specified
        final IUsernameAttributeProvider usernameAttributeProvider =
                this.getUsernameAttributeProvider();

        // Execute the query in the subclass
        final List<ILocalAccountPerson> unmappedPeople = localAccountDao.getPeople(queryBuilder);
        if (unmappedPeople == null) {
            return null;
        }

        // Map the attributes of the found people according to resultAttributeMapping if it is set
        final Set<IPersonAttributes> mappedPeople = new LinkedHashSet<IPersonAttributes>();
        for (final ILocalAccountPerson unmappedPerson : unmappedPeople) {
            final IPersonAttributes mappedPerson = this.mapPersonAttributes(unmappedPerson);
            mappedPeople.add(mappedPerson);
        }

        return Collections.unmodifiableSet(mappedPeople);
    }
1071155
public boolean addMember(Principal principal)
   {
       if(groupMembers.contains(principal))
           return false;

       groupMembers.add(principal);
       return true;
   }
1169331
private boolean isMemberRecurse(Principal principal, Vector<Principal> vector)
   {
       for(Enumeration<Principal> enumeration = members(); enumeration.hasMoreElements();)
       {
           boolean flag = false;
           Principal principal1 = (Principal)enumeration.nextElement();
           if(principal1.equals(principal))
               return true;
           if(principal1 instanceof SecurityGroup)
           {
              SecurityGroup groupimpl = (SecurityGroup)principal1;
               vector.addElement(this);
               if(!vector.contains(groupimpl))
                   flag = groupimpl.isMemberRecurse(principal, vector);
           } 
           else
           if(principal1 instanceof SecurityGroup)
           {
        	   SecurityGroup group1 = (SecurityGroup)principal1;
               if(!vector.contains(group1))
                   flag = group1.isMember(principal);
           }

           if(flag)
               return flag;
       }

       return false;
   }
504067
@Override
    @JsonIgnore
    public Set<IPersonAttributes> getPeopleWithMultivaluedAttributes(final Map<String, List<Object>> query,
                                                                     final IPersonAttributeDaoFilter filter) {
        if (this.logger.isDebugEnabled()) {
            this.logger.debug("invoking getPeopleWithMultivaluedAttributes(" + query + ")");
        }

        final IUsernameAttributeProvider usernameAttributeProvider = super.getUsernameAttributeProvider();
        String uid = usernameAttributeProvider.getUsernameFromQuery(query);
        if (uid == null) {
            if (this.logger.isDebugEnabled()) {
                this.logger.debug("No username attribute found in query, returning null");
            }

            return null;
        }
        uid = usernameCaseCanonicalizationMode.canonicalize(uid, usernameCaseCanonicalizationLocale);

        String targetName = this.descriptors.getName();
        if (targetName == null) {
            if (this.currentUserProvider != null) {
                targetName = this.currentUserProvider.getCurrentUserName();
            }

            if (targetName == null) {
                this.logger.warn("AdditionalDescriptors has a null name and a null name was returned by the currentUserProvider, returning null. " + this.descriptors);
                return null;
            }
        }

        targetName = usernameCaseCanonicalizationMode.canonicalize(targetName, usernameCaseCanonicalizationLocale);
        if (uid.equals(targetName)) {
            if (this.logger.isDebugEnabled()) {
                this.logger.debug("Adding additional descriptors " + this.descriptors);
            }

            final IPersonAttributes personAttributes = new CaseInsensitiveNamedPersonImpl(targetName, this.descriptors.getAttributes());
            return Collections.singleton(personAttributes);
        }

        return null;
    }
440258
public boolean isValidUser() {

        CmsShell shell = new CmsShell(
            getWebAppRfsPath() + "WEB-INF" + File.separator,
            getServletMapping(),
            getDefaultWebApplication(),
            "${user}@${project}>",
            null);
        boolean validUser = shell.validateUser(getAdminUser(), getAdminPwd(), CmsRole.ROOT_ADMIN);
        shell.exit();
        return validUser;
    }
737021
public synchronized boolean isUserInRole(Principal user, String roleName)
    {
        if (user instanceof WrappedUser)
            return ((WrappedUser)user).isUserInRole(roleName);
         
        if (user==null || ((User)user).getUserRealm()!=this)
            return false;
        
        HashSet userSet = (HashSet)_roles.get(roleName);
        return userSet!=null && userSet.contains(user.getName());
    }
218092
@Override
    public Set<IPersonAttributes> getPeopleWithMultivaluedAttributes(final Map<String, List<Object>> query,
                                                                     final IPersonAttributeDaoFilter filter) {
        if (query == null) {
            throw new IllegalArgumentException("seed may not be null");
        }

        return Collections.singleton((IPersonAttributes)
                new AttributeNamedPersonImpl(getUsernameAttributeProvider().getUsernameAttribute(), query));
    }
83294
public IPersonAttributesGroupDefinition createPagsDefinition(
            IPerson person, IEntityGroup parent, String groupName, String description) {

        // What's the target of the upcoming permissions check?
        String target =
                parent != null
                        ? parent.getEntityIdentifier().getKey()
                        : IPermission
                                .ALL_GROUPS_TARGET; // Must have blanket permission to create one
        // w/o a parent

        // Verify permission
        if (!hasPermission(person, IPermission.CREATE_GROUP_ACTIVITY, target)) {
            throw new RuntimeAuthorizationException(
                    person, IPermission.CREATE_GROUP_ACTIVITY, target);
        }

        // VALIDATION STEP:  The group name & description are allowable
        if (StringUtils.isBlank(groupName)) {
            throw new IllegalArgumentException("Specified groupName is blank:  " + groupName);
        }
        if (!GROUP_NAME_VALIDATOR_PATTERN.matcher(groupName).matches()) {
            throw new IllegalArgumentException(
                    "Specified groupName is too long, too short, or contains invalid characters:  "
                            + groupName);
        }
        if (!StringUtils.isBlank(description)) { // Blank description is allowable
            if (!GROUP_DESC_VALIDATOR_PATTERN.matcher(description).matches()) {
                throw new IllegalArgumentException(
                        "Specified description is too long or contains invalid characters:  "
                                + description);
            }
        }

        // VALIDATION STEP:  We don't have a group by that name already
        EntityIdentifier[] people =
                GroupService.searchForGroups(
                        groupName, IGroupConstants.SearchMethod.DISCRETE_CI, IPerson.class);
        EntityIdentifier[] portlets =
                GroupService.searchForGroups(
                        groupName,
                        IGroupConstants.SearchMethod.DISCRETE_CI,
                        IPortletDefinition.class);
        if (people.length != 0 || portlets.length != 0) {
            throw new IllegalArgumentException("Specified groupName already in use:  " + groupName);
        }

        IPersonAttributesGroupDefinition rslt =
                pagsGroupDefDao.createPersonAttributesGroupDefinition(groupName, description);
        if (parent != null) {
            // Should refactor this switch to instead choose a service and invoke a method on it
            switch (parent.getServiceName().toString()) {
                case SERVICE_NAME_LOCAL:
                    IEntityGroup member =
                            GroupService.findGroup(
                                    rslt.getCompositeEntityIdentifierForGroup().getKey());
                    if (member == null) {
                        String msg =
                                "The specified group was created, but is not present in the store:  "
                                        + rslt.getName();
                        throw new RuntimeException(msg);
                    }
                    parent.addChild(member);
                    parent.updateMembers();
                    break;
                case SERVICE_NAME_PAGS:
                    IPersonAttributesGroupDefinition parentDef =
                            getPagsGroupDefByName(parent.getName());
                    Set<IPersonAttributesGroupDefinition> members =
                            new HashSet<>(parentDef.getMembers());
                    members.add(rslt);
                    parentDef.setMembers(members);
                    pagsGroupDefDao.updatePersonAttributesGroupDefinition(parentDef);
                    break;
                default:
                    String msg =
                            "The specified group service does not support adding members:  "
                                    + parent.getServiceName();
                    throw new UnsupportedOperationException(msg);
            }
        }

        return rslt;
    }
1054273
public boolean hasUser(String userId) {
        String normalized = normalizerUserName(userId);
        return loginToUser.containsKey(normalized) || emailToUser.containsKey(normalized);
    }
1067040
protected final boolean isAuthorized(HttpServletRequest req) throws Exception {

        /*
         * This is sensitive data;  we must verify that the user
         * has the appropriate level of access to see it...
         */

        // STEP (1):  Is there an IPerson?
        final IPerson person = personManager.getPerson((HttpServletRequest) req);
        if (person != null) {

            // STEP (2):  Is the person authenticated?
            final ISecurityContext securityContext = person.getSecurityContext();
            if (securityContext != null && securityContext.isAuthenticated()) {

                // STEP (3):  Does this user have SUBSCRIBE permission for permissionsAdminChannel?
                IAuthorizationPrincipal principal =
                        authorizationService.newPrincipal(
                                (String) person.getAttribute(IPerson.USERNAME), IPerson.class);

                final IPortletDefinition permissionsAdminPortlet =
                        portletDefinitionRegistry.getPortletDefinitionByFname(
                                PERMISSIONS_ADMIN_PORTLET_FNAME);
                if (permissionsAdminPortlet == null) {
                    return false;
                }

                final String portletId =
                        permissionsAdminPortlet.getPortletDefinitionId().getStringId();
                if (authorizationService.canPrincipalSubscribe(principal, portletId)) {
                    return true;
                }
            }
        }

        return false;
    }