@Test
public void
shouldSetViewPermissionByDefaultIfNameIsPresentAndPermissionsAreOff_whileSettingAttributes() {
PipelineConfigs group = createWithPipeline(PipelineConfigMother.pipelineConfig("pipeline1"));
group.setConfigAttributes(
m(
BasicPipelineConfigs.AUTHORIZATION,
a(
m(
Authorization.NAME,
"user1",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(OFF, OFF, OFF)),
m(
Authorization.NAME,
"role1",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(OFF, OFF, OFF)))));
Authorization authorization = group.getAuthorization();
assertThat(authorization.getViewConfig().size(), is(2));
assertThat(
authorization.getViewConfig(),
hasItems(
(Admin) new AdminRole(new CaseInsensitiveString("role1")),
(Admin) new AdminUser(new CaseInsensitiveString("user1"))));
assertThat(authorization.getOperationConfig().size(), is(0));
assertThat(authorization.getAdminsConfig().size(), is(0));
}
public void testActionAuthorizationYml() throws Exception {
Map<String, String> resource = createJobResource("myScript", "/yml/bar/baz/boo");
Subject subject = createSubject("yml_user_1", "yml_group_1");
/* Check that workflow_run is actually a matching action */
Decision decision = authorization.evaluate(resource, subject, "pattern_match", environment);
assertEquals(
"Decision for successful authoraztion for action: pattern_match does not match, but should."
+ decision,
Code.GRANTED,
decision.explain().getCode());
assertTrue("Action not granted authorization.", decision.isAuthorized());
resource = createJobResource("Script2", "/listAction");
decision = authorization.evaluate(resource, subject, "action_list_2", environment);
assertEquals(
"Decision for successful authoraztion for action: action_list_2 does not match, but should.",
Code.GRANTED,
decision.explain().getCode());
assertTrue("Action not granted authorization.", decision.isAuthorized());
resource = createJobResource("Script3", "/wldcrd");
decision =
authorization.evaluate(
resource, subject, "action_list_not_in_list_and_shouldn't_be", environment);
assertEquals(
"Decision for successful authoraztion for action: action_list_not_in_list_and_shouldn't_be does not match, but should.",
Code.GRANTED,
decision.explain().getCode());
assertTrue("Action not granted authorization.", decision.isAuthorized());
}
protected void addUserAuthorizations(
String username, List<Authorization> authorizations, Connection conn) {
PreparedStatement stat = null;
try {
stat = conn.prepareStatement(ADD_AUTHORIZATION);
for (int i = 0; i < authorizations.size(); i++) {
Authorization auth = authorizations.get(i);
if (null == auth) continue;
stat.setString(1, username);
if (null != auth.getGroup()) {
stat.setString(2, auth.getGroup().getName());
} else {
stat.setNull(2, Types.VARCHAR);
}
if (null != auth.getRole()) {
stat.setString(3, auth.getRole().getName());
} else {
stat.setNull(3, Types.VARCHAR);
}
stat.addBatch();
stat.clearParameters();
}
stat.executeBatch();
} catch (Throwable t) {
_logger.error("Error detected while addind user authorizations", t);
throw new RuntimeException("Error detected while addind user authorizations", t);
} finally {
this.closeDaoResources(null, stat);
}
}
public void testInvalidInput() throws Exception {
Map<String, String> resource = createJobResource("", "bar/baz/boo");
Subject subject = createSubject("testActionAuthorization", "admin-invalidinput");
// subject does not match
Decision decision = authorization.evaluate(resource, subject, "run", environment);
assertEquals(
"Expecting to see REJECTED_NO_SUBJECT_OR_ENV_FOUND.",
Code.REJECTED_NO_SUBJECT_OR_ENV_FOUND,
decision.explain().getCode());
assertFalse("An empty job name should not be authorized.", decision.isAuthorized());
subject = createSubject("testActionAuthorization", "admin");
try {
authorization.evaluate(
createJobResource(null, "test"), subject, "invalid_input_missing_key", environment);
assertTrue("A null resource key should not be evaluated.", false);
} catch (IllegalArgumentException e) {
assert e.getMessage().contains("Resource definition cannot contain null value");
}
try {
authorization.evaluate(
createJobResource("test_key_with_null_value", null),
subject,
"invalid_input_missing_value",
environment);
assertTrue("A null resource value should not be evaluated.", false);
} catch (IllegalArgumentException e) {
assert e.getMessage().contains("Resource definition cannot contain null value");
}
}
public void runPreProcess() {
Authorization auth = new glguerin.authkit.imp.macosx.MacOSXAuthorization();
Privilege priv = new Privilege("system.privilege.admin");
// see kAuthorizationRightExecute in the AuthorizationTags.h from Security.framework
int count = 0;
boolean succeed = false;
do {
try {
auth.authorize(priv, true);
succeed = true;
break;
} catch (Throwable t) {
System.out.println("Throwable " + t);
}
count++;
} while (count <= 3);
if (succeed) {
String preinstallPath = createTemporaryPreinstallFile();
if (preinstallPath == null) return;
String[] progArray = {preinstallPath, System.getProperty("user.name")};
try {
Process p = auth.execPrivileged(progArray);
Thread.sleep(1000L);
} catch (Throwable t) {
System.out.println("Throwable " + t);
t.printStackTrace();
}
}
}
public void testActionAuthorizationMultifile() throws Exception {
Map<String, String> resource = createJobResource("test1", "QA blah");
Subject subject = createSubject("user1", "multi1");
Decision decision = authorization.evaluate(resource, subject, "read", environment);
assertEquals(Code.GRANTED, decision.explain().getCode());
assertTrue(decision.isAuthorized());
Decision decision2 = authorization.evaluate(resource, subject, "update", environment);
assertEquals(Code.GRANTED, decision2.explain().getCode());
assertTrue(decision2.isAuthorized());
Decision decision3 = authorization.evaluate(resource, subject, "blee", environment);
assertEquals(Code.GRANTED, decision3.explain().getCode());
assertTrue(decision3.isAuthorized());
// test deny actions: delete, blah
Decision decision4 = authorization.evaluate(resource, subject, "delete", environment);
assertEquals(Code.REJECTED_DENIED, decision4.explain().getCode());
assertFalse(decision4.isAuthorized());
Decision decision5 = authorization.evaluate(resource, subject, "blah", environment);
assertEquals(Code.REJECTED_DENIED, decision5.explain().getCode());
assertFalse(decision5.isAuthorized());
}
@Override
public void addUserAuthorization(String username, Authorization authorization) {
if (null == authorization || null == username) return;
String groupName =
(null != authorization.getGroup()) ? authorization.getGroup().getName() : null;
String roleName = (null != authorization.getRole()) ? authorization.getRole().getName() : null;
super.executeQueryWithoutResultset(ADD_AUTHORIZATION, username, groupName, roleName);
}
@Test
public void subscriptionId() {
Authorization authorization = new Authorization();
authorization.setResourceURI(
"http://localhost:8080/DataCustodian/espi/1_1/resource/Subscription/16228736-8e29-4807-a2a7-283be5cc253e");
assertThat(authorization.getSubscriptionId(), is("16228736-8e29-4807-a2a7-283be5cc253e"));
}
public void testInvalidParameters() throws Exception {
try {
authorization.evaluate((Map<String, String>) null, null, null, null);
} catch (Exception e) {
/* ignore...it should throw an exception */
}
try {
authorization.evaluate(
new HashMap<String, String>(), new Subject(), "", new HashSet<Attribute>());
} catch (Exception e) {
/* ignore...it should throw an exception */
}
}
////// Search for item dialog
private void searchActionPerformed(
java.awt.event.ActionEvent evt) { // GEN-FIRST:event_searchActionPerformed
if (Authorization.authorize(uid, password)) {
clearTable();
this.search_dialog.setVisible(true);
}
} // GEN-LAST:event_searchActionPerformed
public void testAdminModulePrivileges() throws Exception {
Map<String, String> resource = createJobResource("adhocScript", "foo/bar");
Subject subject = createSubject("default", "admin", "foo");
String action = "EXECUTE";
final Decision evaluate = authorization.evaluate(resource, subject, action, environment);
evaluate.explain().describe(System.err);
assertTrue(
"'default' does not have access to 'foo/bar/adhocScript' to 'EXECUTE' with no environment specified.",
evaluate.isAuthorized());
assertTrue(
"'default' does not have access to 'foo/bar/adhocScript' to 'EXECUTE' with no environment specified.",
authorization.evaluate(resource, subject, action, environment).isAuthorized());
}
public void off_testProjectEnvironment() throws Exception {
Map<String, String> resource = createJobResource("adhocScript", "foo/bar");
Subject subject = createSubject("testProjectEnvironment", "admin-environment");
environment.add(new Attribute(URI.create("http://dtolabs.com/rundeck/env/project"), "Lion"));
assertTrue(
"Policy did not match the Lion context.",
authorization.evaluate(resource, subject, "READ", environment).isAuthorized());
environment.add(new Attribute(URI.create("http://dtolabs.com/rundeck/env/project"), "Tiger"));
assertFalse(
"Policy should not match the Lion context.",
authorization.evaluate(resource, subject, "READ", environment).isAuthorized());
}
public void testActionAuthorizationYmlInvalid() throws Exception {
Map<String, String> resource = createJobResource("Script3", "/noactions");
Subject subject = createSubject("yml_usr_2", "broken");
Decision decision = authorization.evaluate(resource, subject, "none", environment);
assertEquals(
"Decision for authoraztion for action: none is not REJECTED_NO_ACTIONS_DECLARED.",
Code.REJECTED,
decision.explain().getCode());
assertFalse("Action granted authorization.", decision.isAuthorized());
subject = createSubject("yml_usr_3", "missing_rules");
decision = authorization.evaluate(resource, subject, "none", environment);
assertEquals(
"Decision for authoraztion for action: none is not REJECTED_NO_RULES_DEFINED.",
Code.REJECTED_NO_SUBJECT_OR_ENV_FOUND,
decision.explain().getCode());
assertFalse("Action granted authorization.", decision.isAuthorized());
}
@Test
public void shouldReInitializeAuthorizationIfWeClearAllPermissions() {
PipelineConfigs group = createWithPipeline(PipelineConfigMother.pipelineConfig("pipeline1"));
group.setConfigAttributes(
m(
BasicPipelineConfigs.AUTHORIZATION,
a(
m(
Authorization.NAME,
"loser",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(ON, DISABLED, DISABLED)),
m(
Authorization.NAME,
"boozer",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(OFF, ON, ON)),
m(
Authorization.NAME,
"geezer",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(DISABLED, OFF, ON)),
m(
Authorization.NAME,
"gang_of_losers",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(DISABLED, OFF, ON)),
m(
Authorization.NAME,
"blinds",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(ON, ON, OFF)))));
Authorization authorization = group.getAuthorization();
assertThat(authorization.getAdminsConfig().size(), is(2));
assertThat(authorization.getOperationConfig().size(), is(2));
assertThat(authorization.getViewConfig().size(), is(3));
group.setConfigAttributes(m());
authorization = group.getAuthorization();
assertThat(authorization.getAdminsConfig().size(), is(0));
assertThat(authorization.getOperationConfig().size(), is(0));
assertThat(authorization.getViewConfig().size(), is(0));
}
@Override
public void run() {
if (Authorization.loadAccessToken() == null) return;
if (MinecraftLogTweet.regularTweet == true) {
if (MinecraftLogTweet.player == 0) {
String str = MinecraftLogTweet.regularTweetMessageNP;
str = MinecraftLogTweet.checkConstants(str);
Authorization.tweetString(str);
} else {
String str = MinecraftLogTweet.regularTweetMessage;
str = MinecraftLogTweet.checkConstants(str);
Authorization.tweetString(str);
}
}
}
public void testActionAuthorizationYmlNoMatchIssue() throws Exception {
Map<String, String> resource = createJobResource("Script_123", "/AB3");
Subject subject = createSubject("yml_usr_2", "issue_not_match");
Decision decision = authorization.evaluate(resource, subject, "foobar", environment);
assertEquals(
"Decision for authoraztion for action: foobar is not GRANTED_ACTIONS_AND_COMMANDS_MATCHED. "
+ decision,
Code.GRANTED,
decision.explain().getCode());
assertTrue("Action granted authorization.", decision.isAuthorized());
}
public void testActionAuthorization() throws Exception {
Map<String, String> resource = createJobResource("testjob", "bar/baz/boo");
Subject subject = createSubject("testActionAuthorization", "test1");
/* Check that workflow_run is actually a matching action */
Decision decision = authorization.evaluate(resource, subject, "run", environment);
assertEquals(
"Decision for successful authoraztion for action: run does not match, but should."
+ decision,
Code.GRANTED,
decision.explain().getCode());
assertTrue("Action not granted authorization.", decision.isAuthorized());
/* bobble_head action doesn't exist, so should not be authorized */
decision = authorization.evaluate(resource, subject, "bobble_head", environment);
assertEquals(
"Decision does not contain the proper explanation. ",
Code.REJECTED,
decision.explain().getCode());
assertFalse("Action bobble_head should not have been authorized", decision.isAuthorized());
/* Empty actions never match. */
decision = authorization.evaluate(resource, subject, "", environment);
assertEquals(
"Decision for empty action does not match",
Code.REJECTED_NO_ACTION_PROVIDED,
decision.explain().getCode());
assertFalse("An empty action should not select", decision.isAuthorized());
/* The given job=anyaction of group=foobar should allow any action. */
decision =
authorization.evaluate(
createJobResource("anyaction", "foobar"), subject, "my_wacky_action", environment);
assertEquals(
"my_wacky_action reason does not match.", Code.GRANTED, decision.explain().getCode());
assertTrue(
"foobar/barbaz was denied even though it allows any action.", decision.isAuthorized());
decision =
authorization.evaluate(
declareModule("foobar", "moduleName"), subject, "execute", environment);
assertFalse(
"foobar/moduleName was granted authorization when it shouldn't.", decision.isAuthorized());
Set<Map<String, String>> resources = new HashSet<Map<String, String>>();
final int resourcesCount = 100;
final int actionsCount = 10;
for (int i = 0; i < resourcesCount; i++) {
resources.add(createJobResource(Integer.toString(i), "big/test/" + Integer.toString(i)));
}
Set<String> actions = new HashSet<String>();
for (int i = 0; i < actionsCount; i++) {
actions.add("Action" + Integer.toString(i));
}
long start = System.currentTimeMillis();
authorization.evaluate(resources, subject, actions, environment);
long end = System.currentTimeMillis() - start;
System.out.println(
"Took "
+ end
+ "ms for "
+ resourcesCount
+ " resources and "
+ actionsCount
+ " actions.");
}
@Test
public void shouldUpdateAuthorization() {
PipelineConfigs group = createWithPipeline(PipelineConfigMother.pipelineConfig("pipeline1"));
group.setConfigAttributes(
m(
BasicPipelineConfigs.AUTHORIZATION,
a(
m(
Authorization.NAME,
"loser",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(ON, DISABLED, DISABLED)),
m(
Authorization.NAME,
"boozer",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(OFF, ON, ON)),
m(
Authorization.NAME,
"geezer",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(DISABLED, OFF, ON)),
m(
Authorization.NAME,
"gang_of_losers",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(DISABLED, OFF, ON)),
m(
Authorization.NAME,
"blinds",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(ON, ON, OFF)))));
Authorization authorization = group.getAuthorization();
assertThat(authorization.getAdminsConfig().size(), is(2));
assertThat(
authorization.getAdminsConfig(),
hasItems(
new AdminUser(new CaseInsensitiveString("loser")),
new AdminRole(new CaseInsensitiveString("blinds"))));
assertThat(authorization.getOperationConfig().size(), is(2));
assertThat(
authorization.getOperationConfig(),
hasItems(
new AdminUser(new CaseInsensitiveString("boozer")),
new AdminRole(new CaseInsensitiveString("blinds"))));
assertThat(authorization.getViewConfig().size(), is(3));
assertThat(
authorization.getViewConfig(),
hasItems(
new AdminUser(new CaseInsensitiveString("boozer")),
new AdminUser(new CaseInsensitiveString("geezer")),
new AdminRole(new CaseInsensitiveString("gang_of_losers"))));
}
private Operation parseMethod(Method method) {
Operation operation = new Operation();
RequestMapping requestMapping = method.getAnnotation(RequestMapping.class);
Class<?> responseClass = null;
List<String> produces = new ArrayList<String>();
List<String> consumes = new ArrayList<String>();
String responseContainer = null;
String operationId = method.getName();
Map<String, Property> defaultResponseHeaders = null;
Set<Map<String, Object>> customExtensions = null;
ApiOperation apiOperation = method.getAnnotation(ApiOperation.class);
if (apiOperation.hidden()) return null;
if (!"".equals(apiOperation.nickname())) operationId = apiOperation.nickname();
defaultResponseHeaders = parseResponseHeaders(apiOperation.responseHeaders());
operation.summary(apiOperation.value()).description(apiOperation.notes());
customExtensions = parseCustomExtensions(apiOperation.extensions());
if (customExtensions != null) {
for (Map<String, Object> extension : customExtensions) {
if (extension != null) {
for (Map.Entry<String, Object> map : extension.entrySet()) {
operation.setVendorExtension(
map.getKey().startsWith("x-") ? map.getKey() : "x-" + map.getKey(), map.getValue());
}
}
}
}
if (apiOperation.response() != null && !Void.class.equals(apiOperation.response()))
responseClass = apiOperation.response();
if (!"".equals(apiOperation.responseContainer()))
responseContainer = apiOperation.responseContainer();
/// security
if (apiOperation.authorizations() != null) {
List<SecurityRequirement> securities = new ArrayList<SecurityRequirement>();
for (Authorization auth : apiOperation.authorizations()) {
if (auth.value() != null && !"".equals(auth.value())) {
SecurityRequirement security = new SecurityRequirement();
security.setName(auth.value());
AuthorizationScope[] scopes = auth.scopes();
for (AuthorizationScope scope : scopes) {
if (scope.scope() != null && !"".equals(scope.scope())) {
security.addScope(scope.scope());
}
}
securities.add(security);
}
}
if (securities.size() > 0) {
for (SecurityRequirement sec : securities) operation.security(sec);
}
}
if (responseClass == null) {
// pick out response from method declaration
LOG.info("picking up response class from method " + method);
Type t = method.getGenericReturnType();
responseClass = method.getReturnType();
if (responseClass.equals(ResponseEntity.class)) {
responseClass = getGenericSubtype(method.getReturnType(), method.getGenericReturnType());
}
if (!responseClass.equals(Void.class)
&& !"void".equals(responseClass.toString())
&& responseClass.getAnnotation(Api.class) == null) {
LOG.info("reading model " + responseClass);
Map<String, Model> models = ModelConverters.getInstance().readAll(t);
}
}
if (responseClass != null
&& !responseClass.equals(Void.class)
&& !responseClass.equals(ResponseEntity.class)
&& responseClass.getAnnotation(Api.class) == null) {
if (isPrimitive(responseClass)) {
Property responseProperty = null;
Property property = ModelConverters.getInstance().readAsProperty(responseClass);
if (property != null) {
if ("list".equalsIgnoreCase(responseContainer))
responseProperty = new ArrayProperty(property);
else if ("map".equalsIgnoreCase(responseContainer))
responseProperty = new MapProperty(property);
else responseProperty = property;
operation.response(
200,
new Response()
.description("successful operation")
.schema(responseProperty)
.headers(defaultResponseHeaders));
}
} else if (!responseClass.equals(Void.class) && !"void".equals(responseClass.toString())) {
Map<String, Model> models = ModelConverters.getInstance().read(responseClass);
if (models.size() == 0) {
Property pp = ModelConverters.getInstance().readAsProperty(responseClass);
operation.response(
200,
new Response()
.description("successful operation")
.schema(pp)
.headers(defaultResponseHeaders));
}
for (String key : models.keySet()) {
Property responseProperty = null;
if ("list".equalsIgnoreCase(responseContainer))
responseProperty = new ArrayProperty(new RefProperty().asDefault(key));
else if ("map".equalsIgnoreCase(responseContainer))
responseProperty = new MapProperty(new RefProperty().asDefault(key));
else responseProperty = new RefProperty().asDefault(key);
operation.response(
200,
new Response()
.description("successful operation")
.schema(responseProperty)
.headers(defaultResponseHeaders));
swagger.model(key, models.get(key));
}
models = ModelConverters.getInstance().readAll(responseClass);
for (String key : models.keySet()) {
swagger.model(key, models.get(key));
}
}
}
operation.operationId(operationId);
if (requestMapping.produces() != null) {
for (String str : Arrays.asList(requestMapping.produces())) {
if (!produces.contains(str)) {
produces.add(str);
}
}
}
if (requestMapping.consumes() != null) {
for (String str : Arrays.asList(requestMapping.consumes())) {
if (!consumes.contains(str)) {
consumes.add(str);
}
}
}
ApiResponses responseAnnotation = method.getAnnotation(ApiResponses.class);
if (responseAnnotation != null) {
updateApiResponse(operation, responseAnnotation);
} else {
ResponseStatus responseStatus = method.getAnnotation(ResponseStatus.class);
if (responseStatus != null) {
operation.response(
responseStatus.value().value(), new Response().description(responseStatus.reason()));
}
}
boolean isDeprecated = false;
Deprecated annotation = method.getAnnotation(Deprecated.class);
if (annotation != null) isDeprecated = true;
boolean hidden = false;
if (apiOperation != null) hidden = apiOperation.hidden();
// process parameters
Class[] parameterTypes = method.getParameterTypes();
Type[] genericParameterTypes = method.getGenericParameterTypes();
Annotation[][] paramAnnotations = method.getParameterAnnotations();
// paramTypes = method.getParameterTypes
// genericParamTypes = method.getGenericParameterTypes
for (int i = 0; i < parameterTypes.length; i++) {
Type type = genericParameterTypes[i];
List<Annotation> annotations = Arrays.asList(paramAnnotations[i]);
List<Parameter> parameters = getParameters(type, annotations);
for (Parameter parameter : parameters) {
operation.parameter(parameter);
}
}
if (operation.getResponses() == null) {
operation.defaultResponse(new Response().description("successful operation"));
}
// Process @ApiImplicitParams
this.readImplicitParameters(method, operation);
return operation;
}
private void requestActionPerformed(
java.awt.event.ActionEvent evt) { // GEN-FIRST:event_requestActionPerformed
if (Authorization.authorize(uid, password)) {
this.request_dialog.setVisible(true);
}
} // GEN-LAST:event_requestActionPerformed
@Test
public void shouldIgnoreBlankUserOrRoleNames_whileSettingAttributes() {
PipelineConfigs group = createWithPipeline(PipelineConfigMother.pipelineConfig("pipeline1"));
group.setConfigAttributes(
m(
BasicPipelineConfigs.AUTHORIZATION,
a(
m(
Authorization.NAME,
"",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(ON, DISABLED, DISABLED)),
m(
Authorization.NAME,
null,
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(OFF, ON, ON)),
m(
Authorization.NAME,
"geezer",
Authorization.TYPE,
USER.toString(),
Authorization.PRIVILEGES,
privileges(DISABLED, OFF, ON)),
m(
Authorization.NAME,
"",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(DISABLED, ON, ON)),
m(
Authorization.NAME,
null,
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(ON, OFF, ON)),
m(
Authorization.NAME,
"blinds",
Authorization.TYPE,
ROLE.toString(),
Authorization.PRIVILEGES,
privileges(ON, ON, OFF)))));
Authorization authorization = group.getAuthorization();
assertThat(authorization.getAdminsConfig().size(), is(1));
assertThat(
authorization.getAdminsConfig(),
hasItem((Admin) new AdminRole(new CaseInsensitiveString("blinds"))));
assertThat(authorization.getOperationConfig().size(), is(1));
assertThat(
authorization.getOperationConfig(),
hasItem((Admin) new AdminRole(new CaseInsensitiveString("blinds"))));
assertThat(authorization.getViewConfig().size(), is(1));
assertThat(
authorization.getViewConfig(),
hasItem((Admin) new AdminUser(new CaseInsensitiveString("geezer"))));
}