SND Role Impersonation

[labkey-martyp]

Rationale

Override the new behavior of role impersonation to allow non-container based permissions checks.

Related Pull Requests

• Overridable Role Impersonation platform#5729

Changes

• Use hasAllPermissions instead of hasPermission in SNDSecurityManager
• Pass in roles to hasAllPermissions when doing Role Impersonation
• Add better error handling in SND test

[labkey-adam]

@labkey-martyp using an ImpersonationContext (directly or indirectly) does seem like the right approach. Would using LimitedUser or ElevatedUser meet your requirements? If so, this would be a more standard pattern.

[labkey-adam]

Actually, my preferred option would be to call SecurityManager.hasAllPermissions() and pass in the roles as the contextualRoles parameter (empty in the non-impersonating case). Using contextual roles is usually the recommended way to do this sort of thing... no need for a new class, new user, etc.

[labkey-adam]

See comments... I think this can be simplified significantly. This is a job for contextual roles.

[labkey-martyp]

See comments... I think this can be simplified significantly. This is a job for contextual roles.

Thanks @labkey-adam I'll check that out

[labkey-martyp]

See comments... I think this can be simplified significantly. This is a job for contextual roles.

Thanks @labkey-adam I'll check that out

@labkey-adam Ok refactored to use hasAllPermissions. Please review when you're available.