server/src/test/java/org/apache/kylin/rest/controller/AccessControllerTest.java - kylin - Git at Google

 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
  * regarding copyright ownership.  The ASF licenses this file
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
 */

 package org.apache.kylin.rest.controller;

 import org.apache.kylin.cube.CubeInstance;
 import org.apache.kylin.metadata.project.ProjectInstance;
 import org.apache.kylin.rest.request.AccessRequest;
 import org.apache.kylin.rest.response.AccessEntryResponse;
 import org.apache.kylin.rest.response.CubeInstanceResponse;
 import org.apache.kylin.rest.security.AclEntityType;
 import org.apache.kylin.rest.security.AclPermissionType;
 import org.apache.kylin.rest.security.ManagedUser;
 import org.apache.kylin.rest.service.CubeService;
 import org.apache.kylin.rest.service.ProjectService;
 import org.apache.kylin.rest.service.ServiceTestBase;
 import org.apache.kylin.rest.service.UserGroupService;
 import org.apache.kylin.rest.service.UserService;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;

 import java.io.IOException;
 import java.util.List;

 import static junit.framework.TestCase.fail;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;

 /**
  * @author xduo
  */
 public class AccessControllerTest extends ServiceTestBase implements AclEntityType, AclPermissionType {

     private CubeController cubeController;

     private ProjectController projectController;

     private String MODELER = "MODELER";

     private String ANALYST = "ANALYST";

     private String ADMIN = "ADMIN";

     @Autowired
     @Qualifier("projectService")
     ProjectService projectService;

     @Autowired
     @Qualifier("accessController")
     AccessController accessController;

     @Autowired
     @Qualifier("cubeMgmtService")
     CubeService cubeService;

     @Autowired
     @Qualifier("userService")
     UserService userService;

     @Autowired
     @Qualifier("userGroupService")
     private UserGroupService userGroupService;

     @Before
     public void setup() throws Exception {
         super.setup();
         cubeController = new CubeController();
         cubeController.setCubeService(cubeService);
         projectController = new ProjectController();
         projectController.setProjectService(projectService);
     }

     @Test
     public void testGetUserPermissionInPrj() throws IOException {
         List<ProjectInstance> projects = projectController.getProjects(10000, 0);
         assertTrue(projects.size() > 0);
         ProjectInstance project = projects.get(0);
         userGroupService.addGroup("g1");
         userGroupService.addGroup("g2");
         userGroupService.addGroup("g3");
         userGroupService.addGroup("g4");

         ManagedUser user = new ManagedUser("u", "kylin", false, "all_users", "g1", "g2", "g3", "g4");
         userService.createUser(user);

         grantPermission("g1", READ, project.getUuid());
         grantPermission("g2", READ, project.getUuid());

         swichUser("u", "g1", "g2");
         Assert.assertEquals(READ, accessController.getUserPermissionInPrj(project.getName()));

         grantPermission("g1", MANAGEMENT, project.getUuid());
         grantPermission("g2", ADMINISTRATION, project.getUuid());
         grantPermission("g3", OPERATION, project.getUuid());
         grantPermission("g4", READ, project.getUuid());

         swichUser("u", "g1", "g2", "g3", "g4");
         Assert.assertEquals(ADMINISTRATION, accessController.getUserPermissionInPrj(project.getName()));
     }

     @Test
     public void testBasics() throws IOException {
         swichToAdmin();
         List<AccessEntryResponse> aes = accessController.getAccessEntities(CUBE_INSTANCE,
                 "a24ca905-1fc6-4f67-985c-38fa5aeafd92");
         Assert.assertTrue(aes.size() == 0);

         AccessRequest accessRequest = getAccessRequest(MODELER, ADMINISTRATION, true);
         aes = accessController.grant(CUBE_INSTANCE, "a24ca905-1fc6-4f67-985c-38fa5aeafd92", accessRequest);
         Assert.assertTrue(aes.size() == 1);

         int aeId = 0;
         for (AccessEntryResponse ae : aes) {
             aeId = (Integer) ae.getId();
         }
         Assert.assertNotNull(aeId);

         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(aeId);
         accessRequest.setPermission(READ);

         aes = accessController.update(CUBE_INSTANCE, "a24ca905-1fc6-4f67-985c-38fa5aeafd92", accessRequest);
         Assert.assertTrue(aes.size() == 1);
         for (AccessEntryResponse ae : aes) {
             aeId = (Integer) ae.getId();
         }
         Assert.assertNotNull(aeId);

         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(aeId);
         accessRequest.setPermission(READ);
         accessRequest.setSid("ADMIN");
         aes = accessController.revoke(CUBE_INSTANCE, "a24ca905-1fc6-4f67-985c-38fa5aeafd92", accessRequest);
         assertEquals(0, aes.size());
     }

     @Test
     public void testAuthInProjectLevel() throws Exception {
         List<AccessEntryResponse> aes = null;
         swichToAdmin();
         List<ProjectInstance> projects = projectController.getProjects(10000, 0);
         assertTrue(projects.size() > 0);
         ProjectInstance project = projects.get(0);
         swichToAnalyst();
         projects = projectController.getProjects(10000, 0);
         assertEquals(0, projects.size());
         //grant auth in project level
         swichToAdmin();
         aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), getAccessRequest(ANALYST, READ, true));
         swichToAnalyst();
         projects = projectController.getProjects(10000, 0);
         assertEquals(1, projects.size());

         //revoke auth
         swichToAdmin();
         AccessRequest request = getAccessRequest(ANALYST, READ, true);
         request.setAccessEntryId((Integer) aes.get(0).getId());
         accessController.revoke(PROJECT_INSTANCE, project.getUuid(), request);
         swichToAnalyst();
         projects = projectController.getProjects(10000, 0);
         assertEquals(0, projects.size());
     }

     @Test
     public void testAuthInCubeLevel() throws Exception {
         swichToAdmin();
         List<CubeInstanceResponse> cubes = cubeController.getCubes(null, null, null, 100000, 0);
         assertTrue(cubes.size() > 0);
         CubeInstance cube = cubes.get(0);
         swichToAnalyst();
         cubes.clear();
         try {
             cubes = cubeController.getCubes(null, null, null, 100000, 0);
         } catch (AccessDeniedException e) {
             //correct
         }
         assertTrue(cubes.size() == 0);

         //grant auth
         AccessRequest accessRequest = getAccessRequest(ANALYST, READ, true);
         try {
             accessController.grant(CUBE_INSTANCE, cube.getUuid(), accessRequest);
             fail("ANALYST should not have auth to grant");
         } catch (AccessDeniedException e) {
             //correct
         }
         swichToAdmin();
         List<ProjectInstance> projects = projectController.getProjects(10000, 0);
         List<AccessEntryResponse> aes = accessController.grant(PROJECT_INSTANCE, projects.get(0).getUuid(),
                 accessRequest);
         Assert.assertTrue(aes.size() == 1);
         swichToAnalyst();
         cubes = cubeController.getCubes(null, null, "default", 100000, 0);
         assertTrue(cubes.size() > 0);
         cubes.clear();

         //revoke auth
         try {
             accessController.revoke(PROJECT_INSTANCE, projects.get(0).getUuid(), accessRequest);
             fail("ANALYST should not have auth to revoke");
         } catch (AccessDeniedException e) {
             //correct
         }
         swichToAdmin();
         accessRequest.setAccessEntryId((Integer) aes.get(0).getId());
         accessController.revoke(PROJECT_INSTANCE, projects.get(0).getUuid(), accessRequest);
         swichToAnalyst();
         try {
             cubes = cubeController.getCubes(null, null, null, 10000, 0);
         } catch (AccessDeniedException e) {
             //correct
         }
         assertEquals(0, cubes.size());
     }

     private void swichUser(String name, String... auth) {
         Authentication token = new TestingAuthenticationToken(name, name, auth);
         SecurityContextHolder.getContext().setAuthentication(token);
     }

     private void swichToAdmin() {
         Authentication adminAuth = new TestingAuthenticationToken("ADMIN", "ADMIN", "ROLE_ADMIN");
         SecurityContextHolder.getContext().setAuthentication(adminAuth);
     }

     private void swichToAnalyst() {
         Authentication analystAuth = new TestingAuthenticationToken("ANALYST", "ANALYST", "ROLE_ANALYST");
         SecurityContextHolder.getContext().setAuthentication(analystAuth);
     }

     private AccessRequest getAccessRequest(String role, String permission, boolean isPrincipal) {
         AccessRequest accessRequest = new AccessRequest();
         accessRequest.setPermission(permission);
         accessRequest.setSid(role);
         accessRequest.setPrincipal(isPrincipal);
         return accessRequest;
     }

     private void grantPermission(String sid, String permission, String uuid) throws IOException {
         swichToAdmin();
         AccessRequest groupAccessRequest = getAccessRequest(sid, permission, false);
         accessController.grant(PROJECT_INSTANCE, uuid, groupAccessRequest);
     }

     @Test
     public void testIndexInAclOfResponse() throws IOException {
         swichToAdmin();
         List<ProjectInstance> projects = projectController.getProjects(10000, 0);
         assertTrue(projects.size() > 0);
         ProjectInstance project = projects.get(0);
         ManagedUser user = new ManagedUser("user_0", "kylin", false, "all_users");
         userService.createUser(user);
         user = new ManagedUser("user_1", "kylin", false, "all_users");
         userService.createUser(user);
         user = new ManagedUser("user_2", "kylin", false, "all_users");
         userService.createUser(user);
         List<AccessEntryResponse> aes = accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid());
         assertEquals(0, aes.size());

         AccessRequest accessRequest = getAccessRequest("user_0", ADMINISTRATION, true);
         aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(1, aes.size());

         int aeId = 0;
         for (AccessEntryResponse ae : aes) {
             aeId = (Integer) ae.getId();
         }
         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(aeId);
         accessRequest.setPermission(READ);

         aes = accessController.update(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(1, aes.size());

         accessRequest = getAccessRequest("user_1", ADMINISTRATION, true);
         aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(2, aes.size());

         accessRequest = getAccessRequest("user_2", ADMINISTRATION, true);
         aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(3, aes.size());


         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(1);
         accessRequest.setSid("user_1");
         accessRequest.setPrincipal(true);
         aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(2, aes.size());

         accessRequest = getAccessRequest("user_1", ADMINISTRATION, true);
         aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(3, aes.size());

         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(1);
         accessRequest.setSid("user_1");
         accessRequest.setPrincipal(true);
         aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(2, aes.size());

         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(0);
         accessRequest.setSid("user_0");
         accessRequest.setPrincipal(true);
         aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(1, aes.size());

         accessRequest = new AccessRequest();
         accessRequest.setAccessEntryId(0);
         accessRequest.setSid("user_2");
         accessRequest.setPrincipal(true);
         aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
         assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
             project.getUuid())));
         assertEquals(0, aes.size());
     }

     private boolean checkAccessEntryResponse(List<AccessEntryResponse> left, List<AccessEntryResponse> right) {
         for (int i = 0; i < left.size(); i++) {
             AccessEntryResponse leftAer = left.get(i);
             AccessEntryResponse rightAer = right.get(i);
             if (!(leftAer.getId().equals(rightAer.getId())
                 && leftAer.getPermission().getMask() == rightAer.getPermission().getMask()
                 && leftAer.getSid().equals(rightAer.getSid())
                 && leftAer.isGranting() == rightAer.isGranting())) {
                 return false;
             }
         }
         return true;
     }
 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	package org.apache.kylin.rest.controller;

	import org.apache.kylin.cube.CubeInstance;
	import org.apache.kylin.metadata.project.ProjectInstance;
	import org.apache.kylin.rest.request.AccessRequest;
	import org.apache.kylin.rest.response.AccessEntryResponse;
	import org.apache.kylin.rest.response.CubeInstanceResponse;
	import org.apache.kylin.rest.security.AclEntityType;
	import org.apache.kylin.rest.security.AclPermissionType;
	import org.apache.kylin.rest.security.ManagedUser;
	import org.apache.kylin.rest.service.CubeService;
	import org.apache.kylin.rest.service.ProjectService;
	import org.apache.kylin.rest.service.ServiceTestBase;
	import org.apache.kylin.rest.service.UserGroupService;
	import org.apache.kylin.rest.service.UserService;
	import org.junit.Assert;
	import org.junit.Before;
	import org.junit.Test;
	import org.springframework.beans.factory.annotation.Autowired;
	import org.springframework.beans.factory.annotation.Qualifier;
	import org.springframework.security.access.AccessDeniedException;
	import org.springframework.security.authentication.TestingAuthenticationToken;
	import org.springframework.security.core.Authentication;
	import org.springframework.security.core.context.SecurityContextHolder;

	import java.io.IOException;
	import java.util.List;

	import static junit.framework.TestCase.fail;
	import static org.junit.Assert.assertEquals;
	import static org.junit.Assert.assertTrue;

	/**
	* @author xduo
	*/
	public class AccessControllerTest extends ServiceTestBase implements AclEntityType, AclPermissionType {

	private CubeController cubeController;

	private ProjectController projectController;

	private String MODELER = "MODELER";

	private String ANALYST = "ANALYST";

	private String ADMIN = "ADMIN";

	@Autowired
	@Qualifier("projectService")
	ProjectService projectService;

	@Autowired
	@Qualifier("accessController")
	AccessController accessController;

	@Autowired
	@Qualifier("cubeMgmtService")
	CubeService cubeService;

	@Autowired
	@Qualifier("userService")
	UserService userService;

	@Autowired
	@Qualifier("userGroupService")
	private UserGroupService userGroupService;

	@Before
	public void setup() throws Exception {
	super.setup();
	cubeController = new CubeController();
	cubeController.setCubeService(cubeService);
	projectController = new ProjectController();
	projectController.setProjectService(projectService);
	}

	@Test
	public void testGetUserPermissionInPrj() throws IOException {
	List<ProjectInstance> projects = projectController.getProjects(10000, 0);
	assertTrue(projects.size() > 0);
	ProjectInstance project = projects.get(0);
	userGroupService.addGroup("g1");
	userGroupService.addGroup("g2");
	userGroupService.addGroup("g3");
	userGroupService.addGroup("g4");

	ManagedUser user = new ManagedUser("u", "kylin", false, "all_users", "g1", "g2", "g3", "g4");
	userService.createUser(user);

	grantPermission("g1", READ, project.getUuid());
	grantPermission("g2", READ, project.getUuid());

	swichUser("u", "g1", "g2");
	Assert.assertEquals(READ, accessController.getUserPermissionInPrj(project.getName()));

	grantPermission("g1", MANAGEMENT, project.getUuid());
	grantPermission("g2", ADMINISTRATION, project.getUuid());
	grantPermission("g3", OPERATION, project.getUuid());
	grantPermission("g4", READ, project.getUuid());

	swichUser("u", "g1", "g2", "g3", "g4");
	Assert.assertEquals(ADMINISTRATION, accessController.getUserPermissionInPrj(project.getName()));
	}

	@Test
	public void testBasics() throws IOException {
	swichToAdmin();
	List<AccessEntryResponse> aes = accessController.getAccessEntities(CUBE_INSTANCE,
	"a24ca905-1fc6-4f67-985c-38fa5aeafd92");
	Assert.assertTrue(aes.size() == 0);

	AccessRequest accessRequest = getAccessRequest(MODELER, ADMINISTRATION, true);
	aes = accessController.grant(CUBE_INSTANCE, "a24ca905-1fc6-4f67-985c-38fa5aeafd92", accessRequest);
	Assert.assertTrue(aes.size() == 1);

	int aeId = 0;
	for (AccessEntryResponse ae : aes) {
	aeId = (Integer) ae.getId();
	}
	Assert.assertNotNull(aeId);

	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(aeId);
	accessRequest.setPermission(READ);

	aes = accessController.update(CUBE_INSTANCE, "a24ca905-1fc6-4f67-985c-38fa5aeafd92", accessRequest);
	Assert.assertTrue(aes.size() == 1);
	for (AccessEntryResponse ae : aes) {
	aeId = (Integer) ae.getId();
	}
	Assert.assertNotNull(aeId);

	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(aeId);
	accessRequest.setPermission(READ);
	accessRequest.setSid("ADMIN");
	aes = accessController.revoke(CUBE_INSTANCE, "a24ca905-1fc6-4f67-985c-38fa5aeafd92", accessRequest);
	assertEquals(0, aes.size());
	}

	@Test
	public void testAuthInProjectLevel() throws Exception {
	List<AccessEntryResponse> aes = null;
	swichToAdmin();
	List<ProjectInstance> projects = projectController.getProjects(10000, 0);
	assertTrue(projects.size() > 0);
	ProjectInstance project = projects.get(0);
	swichToAnalyst();
	projects = projectController.getProjects(10000, 0);
	assertEquals(0, projects.size());
	//grant auth in project level
	swichToAdmin();
	aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), getAccessRequest(ANALYST, READ, true));
	swichToAnalyst();
	projects = projectController.getProjects(10000, 0);
	assertEquals(1, projects.size());

	//revoke auth
	swichToAdmin();
	AccessRequest request = getAccessRequest(ANALYST, READ, true);
	request.setAccessEntryId((Integer) aes.get(0).getId());
	accessController.revoke(PROJECT_INSTANCE, project.getUuid(), request);
	swichToAnalyst();
	projects = projectController.getProjects(10000, 0);
	assertEquals(0, projects.size());
	}

	@Test
	public void testAuthInCubeLevel() throws Exception {
	swichToAdmin();
	List<CubeInstanceResponse> cubes = cubeController.getCubes(null, null, null, 100000, 0);
	assertTrue(cubes.size() > 0);
	CubeInstance cube = cubes.get(0);
	swichToAnalyst();
	cubes.clear();
	try {
	cubes = cubeController.getCubes(null, null, null, 100000, 0);
	} catch (AccessDeniedException e) {
	//correct
	}
	assertTrue(cubes.size() == 0);

	//grant auth
	AccessRequest accessRequest = getAccessRequest(ANALYST, READ, true);
	try {
	accessController.grant(CUBE_INSTANCE, cube.getUuid(), accessRequest);
	fail("ANALYST should not have auth to grant");
	} catch (AccessDeniedException e) {
	//correct
	}
	swichToAdmin();
	List<ProjectInstance> projects = projectController.getProjects(10000, 0);
	List<AccessEntryResponse> aes = accessController.grant(PROJECT_INSTANCE, projects.get(0).getUuid(),
	accessRequest);
	Assert.assertTrue(aes.size() == 1);
	swichToAnalyst();
	cubes = cubeController.getCubes(null, null, "default", 100000, 0);
	assertTrue(cubes.size() > 0);
	cubes.clear();

	//revoke auth
	try {
	accessController.revoke(PROJECT_INSTANCE, projects.get(0).getUuid(), accessRequest);
	fail("ANALYST should not have auth to revoke");
	} catch (AccessDeniedException e) {
	//correct
	}
	swichToAdmin();
	accessRequest.setAccessEntryId((Integer) aes.get(0).getId());
	accessController.revoke(PROJECT_INSTANCE, projects.get(0).getUuid(), accessRequest);
	swichToAnalyst();
	try {
	cubes = cubeController.getCubes(null, null, null, 10000, 0);
	} catch (AccessDeniedException e) {
	//correct
	}
	assertEquals(0, cubes.size());
	}

	private void swichUser(String name, String... auth) {
	Authentication token = new TestingAuthenticationToken(name, name, auth);
	SecurityContextHolder.getContext().setAuthentication(token);
	}

	private void swichToAdmin() {
	Authentication adminAuth = new TestingAuthenticationToken("ADMIN", "ADMIN", "ROLE_ADMIN");
	SecurityContextHolder.getContext().setAuthentication(adminAuth);
	}

	private void swichToAnalyst() {
	Authentication analystAuth = new TestingAuthenticationToken("ANALYST", "ANALYST", "ROLE_ANALYST");
	SecurityContextHolder.getContext().setAuthentication(analystAuth);
	}

	private AccessRequest getAccessRequest(String role, String permission, boolean isPrincipal) {
	AccessRequest accessRequest = new AccessRequest();
	accessRequest.setPermission(permission);
	accessRequest.setSid(role);
	accessRequest.setPrincipal(isPrincipal);
	return accessRequest;
	}

	private void grantPermission(String sid, String permission, String uuid) throws IOException {
	swichToAdmin();
	AccessRequest groupAccessRequest = getAccessRequest(sid, permission, false);
	accessController.grant(PROJECT_INSTANCE, uuid, groupAccessRequest);
	}

	@Test
	public void testIndexInAclOfResponse() throws IOException {
	swichToAdmin();
	List<ProjectInstance> projects = projectController.getProjects(10000, 0);
	assertTrue(projects.size() > 0);
	ProjectInstance project = projects.get(0);
	ManagedUser user = new ManagedUser("user_0", "kylin", false, "all_users");
	userService.createUser(user);
	user = new ManagedUser("user_1", "kylin", false, "all_users");
	userService.createUser(user);
	user = new ManagedUser("user_2", "kylin", false, "all_users");
	userService.createUser(user);
	List<AccessEntryResponse> aes = accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid());
	assertEquals(0, aes.size());

	AccessRequest accessRequest = getAccessRequest("user_0", ADMINISTRATION, true);
	aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(1, aes.size());

	int aeId = 0;
	for (AccessEntryResponse ae : aes) {
	aeId = (Integer) ae.getId();
	}
	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(aeId);
	accessRequest.setPermission(READ);

	aes = accessController.update(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(1, aes.size());

	accessRequest = getAccessRequest("user_1", ADMINISTRATION, true);
	aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(2, aes.size());

	accessRequest = getAccessRequest("user_2", ADMINISTRATION, true);
	aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(3, aes.size());


	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(1);
	accessRequest.setSid("user_1");
	accessRequest.setPrincipal(true);
	aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(2, aes.size());

	accessRequest = getAccessRequest("user_1", ADMINISTRATION, true);
	aes = accessController.grant(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(3, aes.size());

	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(1);
	accessRequest.setSid("user_1");
	accessRequest.setPrincipal(true);
	aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(2, aes.size());

	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(0);
	accessRequest.setSid("user_0");
	accessRequest.setPrincipal(true);
	aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(1, aes.size());

	accessRequest = new AccessRequest();
	accessRequest.setAccessEntryId(0);
	accessRequest.setSid("user_2");
	accessRequest.setPrincipal(true);
	aes = accessController.revoke(PROJECT_INSTANCE, project.getUuid(), accessRequest);
	assertTrue(checkAccessEntryResponse(aes, accessController.getAccessEntities(PROJECT_INSTANCE,
	project.getUuid())));
	assertEquals(0, aes.size());
	}

	private boolean checkAccessEntryResponse(List<AccessEntryResponse> left, List<AccessEntryResponse> right) {
	for (int i = 0; i < left.size(); i++) {
	AccessEntryResponse leftAer = left.get(i);
	AccessEntryResponse rightAer = right.get(i);
	if (!(leftAer.getId().equals(rightAer.getId())
	&& leftAer.getPermission().getMask() == rightAer.getPermission().getMask()
	&& leftAer.getSid().equals(rightAer.getSid())
	&& leftAer.isGranting() == rightAer.isGranting())) {
	return false;
	}
	}
	return true;
	}
	}