openmicroscopy/openmicroscopy — pull request #3037 by joshmoore (2014-09-16 08:11:19+00:00)
Title: Group sudo

This removes the `@RolesAllowed("system")` restriction from `ISession.createSessionWithTimeout*` in favor of a `@RolesAllowed("user")` but with an inline test for `isAdmin OR isGroupOwner`. What this means in practice that any group owner can now use the `--sudo` flag from the `bin/omero login` in order to create a session for a member of his/her group. Currently, the only limitation put on this newly created session is that it **cannot** have `setSecurityContext` called, i.e. the session must remain in the group for which it was created.

To test:
* `bin/omero login --sudo $OWNER $MEMBER@server`
* Take the `$UUID` that's printed (/cc @sbesson)
* `bin/omero login -k $UUID server`
* `bin/omero import` ... etc.

Things that should not be possible:
* `bin/omero login --sudo $NONOWNER $MEMBER@server`
* `bin/omero sessions group $OTHERGROUP`

Questions:
* what restrictions should be placed on `chgrp` and similar?
* what other methods (e.g. from `IAdmin`) should be restricted?