Returns <code>IAuthorizationPrincipals</code> that have <code>IPermissions</code> for the
given owner, activity and target.

@return IAuthorizationPrincipal[]
@param owner
@param activity
@param target
513129
public IAuthorizationPrincipal[] getAuthorizedPrincipals(
            String owner, String activity, String target) throws AuthorizationException {
        IPermission[] permissions = getPermissionsForOwner(owner, activity, target);
        return getPrincipalsFromPermissions(permissions);
    }
384687
@Override
    public void removePermissions(IPermission[] permissions) throws AuthorizationException {
        if (permissions.length > 0) {
            getPermissionStore().delete(permissions);
            if (this.cachePermissions) {
                removeFromPermissionsCache(permissions);
            }
        }
    }
1219112
@Override
    public void add(IPermission[] perms) throws AuthorizationException {
        if (perms.length > 0) {
            try {
                primAdd(perms);
            } catch (Exception ex) {
                log.error("Exception adding permissions " + Arrays.toString(perms), ex);
                throw new AuthorizationException(ex);
            }
        }
    }
294384
private void removeFromPermissionsCache(IPermission[] permissions)
            throws AuthorizationException {
        IAuthorizationPrincipal[] principals = getPrincipalsFromPermissions(permissions);
        removeFromPermissionsCache(principals);
    }
1279568
@Override
    public Iterable<? extends IPortalData> getPortalData() {
        final List<IPermissionOwner> permissionOwners =
                this.permissionOwnerDao.getAllPermissionOwners();

        return Lists.transform(
                permissionOwners,
                new Function<IPermissionOwner, IPortalData>() {
                    /* (non-Javadoc)
                     * @see com.google.common.base.Function#apply(java.lang.Object)
                     */
                    @Override
                    public IPortalData apply(IPermissionOwner permissionOwner) {
                        return new SimpleStringPortalData(
                                permissionOwner.getFname(),
                                permissionOwner.getName(),
                                permissionOwner.getDescription());
                    }
                });
    }
1299055
private Iterator getInheritedPrincipals(IAuthorizationPrincipal principal)
            throws AuthorizationException {
        Iterator i = null;
        ArrayList<IAuthorizationPrincipal> al = new ArrayList<>(5);

        try {
            i = getGroupsForPrincipal(principal);
        } catch (GroupsException ge) {
            throw new AuthorizationException("Could not retrieve Groups for " + principal, ge);
        }

        while (i.hasNext()) {
            IEntityGroup group = (IEntityGroup) i.next();
            IAuthorizationPrincipal p = getPrincipalForGroup(group);
            al.add(p);
        }
        return al.iterator();
    }
676768
public void removeLockedObjectOwner( String owner ) {

        try {
            if (this.owner != null) {
                int size = this.owner.length;
                for (int i = 0; i < size; i++) {
                    // check every owner if it is the requested one
                    if (this.owner[i].equals(owner)) {
                        // remove the owner
                        size -= 1;
                        String[] newLockedObjectOwner = new String[size];
                        for (int j = 0; j < size; j++) {
                            if (j < i) {
                                newLockedObjectOwner[j] = this.owner[j];
                            } else {
                                newLockedObjectOwner[j] = this.owner[j + 1];
                            }
                        }
                        this.owner = newLockedObjectOwner;

                    }
                }
                if (this.owner.length == 0) {
                    this.owner = null;
                }
            }
        } catch (ArrayIndexOutOfBoundsException e) {
            LOGGER.error(e, new TextI18n("LockedObject.removeLockedObjectOwner()"));
        }
    }
1133763
public List<Permission> getPermissions(Principal p) {
		List<Permission> perms = new ArrayList<Permission>();
		lur.fishAll(p, perms);
		return perms;
	}
511355
public Set<Permission> authorize(AuthenticatedUser user, IResource resource)
    {
        if (user.isSuper())
            return Permission.ALL;

        UntypedResultSet result;
        try
        {
            ResultMessage.Rows rows = authorizeStatement.execute(QueryState.forInternalCalls(),
                                                                 QueryOptions.forInternalCalls(ConsistencyLevel.LOCAL_ONE,
                                                                                               Lists.newArrayList(ByteBufferUtil.bytes(user.getName()),
                                                                                                                  ByteBufferUtil.bytes(resource.getName()))));
            result = UntypedResultSet.create(rows.result);
        }
        catch (RequestValidationException e)
        {
            throw new AssertionError(e); // not supposed to happen
        }
        catch (RequestExecutionException e)
        {
            logger.warn("CassandraAuthorizer failed to authorize {} for {}", user, resource);
            return Permission.NONE;
        }

        if (result.isEmpty() || !result.one().has(PERMISSIONS))
            return Permission.NONE;

        Set<Permission> permissions = EnumSet.noneOf(Permission.class);
        for (String perm : result.one().getSet(PERMISSIONS, UTF8Type.instance))
            permissions.add(Permission.valueOf(perm));
        return permissions;
    }
1146259
@Override
    public List<IPersonAttributes> searchForPeople(
            final IPerson searcher, final Map<String, Object> query) {

        // get the IAuthorizationPrincipal for the searching user
        final IAuthorizationPrincipal principal = getPrincipalForUser(searcher);

        // build a set of all possible user attributes the current user has
        // permission to view
        final Set<String> permittedAttributes = getPermittedAttributes(principal);

        // remove any query attributes that the user does not have permission
        // to view
        final Map<String, Object> inUseQuery = new HashMap<>();
        for (Map.Entry<String, Object> queryEntry : query.entrySet()) {
            final String attr = queryEntry.getKey();
            if (permittedAttributes.contains(attr)) {
                inUseQuery.put(attr, queryEntry.getValue());
            } else {
                this.logger.warn(
                        "User '"
                                + searcher.getName()
                                + "' attempted searching on attribute '"
                                + attr
                                + "' which is not allowed in the current configuration. The attribute will be ignored.");
            }
        }

        // ensure the query has at least one search attribute defined
        if (inUseQuery.keySet().size() == 0) {
            throw new IllegalArgumentException("Search query is empty");
        }

        // get the set of people matching the search query
        final Set<IPersonAttributes> people = this.personAttributeDao.getPeople(inUseQuery);
        if (people == null) {
            return Collections.emptyList();
        }

        // To improve efficiency and not do as many permission checks or person directory searches,
        // if we have too many results and all people in the returned set of personAttributes have
        // a displayName, pre-sort the set and limit it to maxResults. The typical use case is that
        // LDAP returns results that have the displayName populated.  Note that a disadvantage of
        // this
        // approach is that the smaller result set may have entries that permissions prevent the
        // current users from viewing the person and thus reduce the number of final results, but
        // that is rare (typical use case is users can't view administrative internal accounts or
        // the
        // system account, none of which tend to be in LDAP).  We could retain a few more than
        // maxResults
        // to offset that chance, but IMHO not worth the cost of extra external queries.

        List<IPersonAttributes> peopleList = new ArrayList<>(people);
        if (peopleList.size() > maxResults && allListItemsHaveDisplayName(peopleList)) {
            logger.debug(
                    "All items contained displayName; pre-sorting list of size {} and truncating to {}",
                    peopleList.size(),
                    maxResults);
            // sort the list by display name
            Collections.sort(peopleList, new DisplayNameComparator());
            peopleList = peopleList.subList(0, maxResults);
        }
        // Construct a new representation of the persons limited to attributes the searcher
        // has permissions to view.  Will change order of the list.
        List<IPersonAttributes> list =
                getVisiblePersons(principal, permittedAttributes, peopleList);

        // Sort the list by display name
        Collections.sort(list, new DisplayNameComparator());

        // limit the list to a maximum number of returned results
        if (list.size() > maxResults) {
            list = list.subList(0, maxResults);
        }

        return list;
    }
711179
@Override
    public Set<Permission> authorize(AuthenticatedUser user, IResource resource)
    {
        if (!(resource instanceof DataResource))
            throw new IllegalArgumentException(String.format("%s resource is not supported by LegacyAuthorizer", resource.getName()));
        DataResource dr = (DataResource) resource;

        List<Object> legacyResource = new ArrayList<Object>();
        legacyResource.add(Resources.ROOT);
        legacyResource.add(Resources.KEYSPACES);
        if (!dr.isRootLevel())
            legacyResource.add(dr.getKeyspace());
        if (dr.isColumnFamilyLevel())
            legacyResource.add(dr.getColumnFamily());

        Set<Permission> permissions = authorize(user, legacyResource);
        if (permissions.contains(Permission.READ))
            permissions.add(Permission.SELECT);
        if (permissions.contains(Permission.WRITE))
            permissions.addAll(EnumSet.of(Permission.CREATE, Permission.ALTER, Permission.DROP, Permission.MODIFY));

        return permissions;
    }
1112995
protected Collection<? extends GrantedAuthority> buildGrantedAuthorities(PortletRequest context) {
        Collection<String> portletUserRoles = getUserRoles(context);
        Collection<? extends GrantedAuthority> userGas = portletUserRoles2GrantedAuthoritiesMapper.getGrantedAuthorities(portletUserRoles);

        if (logger.isDebugEnabled()) {
            logger.debug("Portlet roles [" + portletUserRoles + "] mapped to Granted Authorities: [" + userGas + "]");
        }
        return userGas;
    }
1010600
public List<AclEntry> getEntries() {
    ImmutableList.Builder<AclEntry> builder = new ImmutableList.Builder<>();
    builder.add(new AclEntry.Builder()
        .setType(AclEntryType.OWNING_USER)
        .setSubject(mOwningUser)
        .setActions(getOwningUserActions())
        .build());
    builder.add(new AclEntry.Builder()
        .setType(AclEntryType.OWNING_GROUP)
        .setSubject(mOwningGroup)
        .setActions(getOwningGroupActions())
        .build());
    builder.add(new AclEntry.Builder()
        .setType(AclEntryType.OTHER)
        .setActions(getOtherActions())
        .build());
    if (hasExtended()) {
      builder.addAll(mExtendedEntries.getEntries());
    }
    return builder.build();
  }
1181631
@Override
    public String getPrincipalString(IAuthorizationPrincipal principal) {
        return getPrincipalString(principal.getType(), principal.getKey());
    }
881018
public function newAuthorizeRequest($owner, $owner_id, $options)
  {
    return $this->getOAuth()->getAuthServer()
          ->getGrantType('authorization_code')
          ->newAuthoriseRequest($owner, $owner_id, $options);
  }
808897
private static void checkPermission(final Subject user, 
                                      final Permission... permissions) 
  throws AuthorizationException {
    try{
      Subject.doAs(user, 
                   new PrivilegedExceptionAction<Void>() {
                     @Override
                     public Void run() throws Exception {
                       try {
                         for(Permission permission : permissions) {
                           AccessController.checkPermission(permission);
                         }
                       } catch (AccessControlException ace) {
                         LOG.info("Authorization failed for " + 
                                  UserGroupInformation.getCurrentUGI(), ace);
                         throw new AuthorizationException(ace);
                       }
                      return null;
                     }
                   }
                  );
    } catch (PrivilegedActionException e) {
      throw new AuthorizationException(e.getException());
    }
  }
248135
protected Principal getAccessTokenAuthenticationPrincipal(final AccessToken accessToken, final J2EContext context, final RegisteredService registeredService) {
        val currentPrincipal = accessToken.getAuthentication().getPrincipal();
        LOGGER.debug("Preparing user profile response based on CAS principal [{}]", currentPrincipal);

        val principal = this.scopeToAttributesFilter.filter(accessToken.getService(), currentPrincipal, registeredService, context, accessToken);
        LOGGER.debug("Created CAS principal [{}] based on requested/authorized scopes", principal);

        return principal;
    }