Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/DataTransfer/ResourcePermission.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/DataTransfer/ResourcePermission.cs	(revision 7950)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/DataTransfer/ResourcePermission.cs	(revision 7950)
@@ -0,0 +1,39 @@
+﻿#region License Information
+/* HeuristicLab
+ * Copyright (C) 2002-2012 Heuristic and Evolutionary Algorithms Laboratory (HEAL)
+ *
+ * This file is part of HeuristicLab.
+ *
+ * HeuristicLab is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * HeuristicLab is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with HeuristicLab. If not, see <http://www.gnu.org/licenses/>.
+ */
+#endregion
+
+using System;
+using System.Runtime.Serialization;
+
+namespace HeuristicLab.Services.Hive.DataTransfer {
+  [DataContract]
+  [Serializable]
+  public class ResourcePermission : HiveItem {
+    // info: this class is derived from HiveItem to simplify handling on the client side, altough it does not have a Id.
+    [DataMember]
+    public Guid ResourceId { get; set; }
+    [DataMember]
+    public Guid GrantedUserId { get; set; }
+    [DataMember]
+    public Guid GrantedByUserId { get; set; }
+
+    public ResourcePermission() { }
+  }
+}
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HeuristicLab.Services.Hive-3.3.csproj
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HeuristicLab.Services.Hive-3.3.csproj	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HeuristicLab.Services.Hive-3.3.csproj	(revision 7950)
@@ -90,4 +90,7 @@
       <HintPath>..\..\bin\HeuristicLab.Core-3.3.dll</HintPath>
     </Reference>
+    <Reference Include="HeuristicLab.GeoIP">
+      <HintPath>..\..\..\ClientUserManagement\HeuristicLab.GeoIP\1.12\obj\Debug\HeuristicLab.GeoIP.dll</HintPath>
+    </Reference>
     <Reference Include="HeuristicLab.Persistence-3.3">
       <HintPath>..\..\bin\HeuristicLab.Persistence-3.3.dll</HintPath>
@@ -95,4 +98,10 @@
     <Reference Include="HeuristicLab.PluginInfrastructure-3.3">
       <HintPath>..\..\bin\HeuristicLab.PluginInfrastructure-3.3.dll</HintPath>
+    </Reference>
+    <Reference Include="HeuristicLab.Services.Access">
+      <HintPath>..\..\..\ClientUserManagement\HeuristicLab.Services.Access\3.3\obj\Debug\HeuristicLab.Services.Access.dll</HintPath>
+    </Reference>
+    <Reference Include="HeuristicLab.Services.Access.DataAccess">
+      <HintPath>..\..\..\ClientUserManagement\HeuristicLab.Services.Access.DataAccess\3.3\obj\Debug\HeuristicLab.Services.Access.DataAccess.dll</HintPath>
     </Reference>
     <Reference Include="System" />
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HiveService.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HiveService.cs	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/HiveService.cs	(revision 7950)
@@ -41,5 +41,5 @@
       get { return ServiceLocator.Instance.HiveDao; }
     }
-    private IAuthenticationManager authen {
+    private HeuristicLab.Services.Access.IRoleVerifier authen {
       get { return ServiceLocator.Instance.AuthenticationManager; }
     }
@@ -53,5 +53,5 @@
       get { return ServiceLocator.Instance.EventManager; }
     }
-    private IUserManager userManager {
+    private HeuristicLab.Services.Access.IUserManager userManager {
       get { return ServiceLocator.Instance.UserManager; }
     }
@@ -59,4 +59,14 @@
       get { return ServiceLocator.Instance.HeartbeatManager; }
     }
+
+    #region Authorization Methods
+    public bool AuthorizesForResourceAdministration(Guid resourceId) {
+      try {
+        author.AuthorizeForResourceAdministration(resourceId);
+        return true;
+      }
+      catch (System.Security.SecurityException) { return false; }
+    }
+    #endregion
 
     #region Task Methods
@@ -467,21 +477,23 @@
 
     #region ResourcePermission Methods
-    public void GrantResourcePermission(Guid resourceId, Guid grantedUserId) {
+    public void GrantResourcePermissions(Guid resourceId, params Guid[] grantedUserIds) {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to grant permission for this resource"));
-        dao.AddResourcePermission(new ResourcePermission { ResourceId = resourceId, GrantedByUserId = userManager.CurrentUserId, GrantedUserId = grantedUserId });
-      });
-    }
-
-    public void RevokeResourcePermission(Guid resourceId, Guid grantedUserId) {
+        if (resource.OwnerUserId != userManager.CurrentUserId && !authen.IsInRole(HiveRoles.Administrator)) throw new FaultException<FaultReason>(new FaultReason("Not allowed to grant permission for this resource"));
+        foreach (Guid id in grantedUserIds)
+          dao.AddResourcePermission(new ResourcePermission { ResourceId = resourceId, GrantedByUserId = userManager.CurrentUserId, GrantedUserId = id });
+      });
+    }
+
+    public void RevokeResourcePermissions(Guid resourceId, params Guid[] grantedUserIds) {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to revoke permission for this resource"));
-        dao.DeleteResourcePermission(resourceId, grantedUserId);
+        if (resource.OwnerUserId != userManager.CurrentUserId && !authen.IsInRole(HiveRoles.Administrator)) throw new FaultException<FaultReason>(new FaultReason("Not allowed to revoke permission for this resource"));
+        foreach (Guid id in grantedUserIds)
+          dao.DeleteResourcePermission(resourceId, id);
       });
     }
@@ -492,5 +504,4 @@
         Resource resource = dao.GetResource(resourceId);
         if (resource == null) throw new FaultException<FaultReason>(new FaultReason("Could not find resource with id " + resourceId));
-        if (resource.OwnerUserId != userManager.CurrentUserId) throw new FaultException<FaultReason>(new FaultReason("Not allowed to list permissions for this resource"));
         return dao.GetResourcePermissions(x => x.ResourceId == resourceId);
       });
@@ -515,5 +526,5 @@
 
     public Guid AddSlaveGroup(SlaveGroup slaveGroup) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       return trans.UseTransaction(() => dao.AddSlaveGroup(slaveGroup));
     }
@@ -531,20 +542,20 @@
     public IEnumerable<Slave> GetSlaves() {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      return dao.GetSlaves(x => x.OwnerUserId == null
-                             || x.OwnerUserId == userManager.CurrentUserId
-                             || x.ResourcePermissions.Count(y => y.GrantedUserId == userManager.CurrentUserId) > 0
-                             || authen.IsInRole(HiveRoles.Administrator));
+      return dao.GetSlaves(x => true).Where(x => x.OwnerUserId == null
+                                         || x.OwnerUserId == userManager.CurrentUserId
+                                         || userManager.VerifyUser(userManager.CurrentUserId, GetResourcePermissions(x.Id).Select(y => y.GrantedUserId).ToList())
+                                         || authen.IsInRole(HiveRoles.Administrator)).ToArray();
     }
 
     public IEnumerable<SlaveGroup> GetSlaveGroups() {
       authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      return dao.GetSlaveGroups(x => x.OwnerUserId == null
-                                  || x.OwnerUserId == userManager.CurrentUserId
-                                  || x.ResourcePermissions.Count(y => y.GrantedUserId == userManager.CurrentUserId) > 0
-                                  || authen.IsInRole(HiveRoles.Administrator));
+      return dao.GetSlaveGroups(x => true).Where(x => x.OwnerUserId == null
+                                              || x.OwnerUserId == userManager.CurrentUserId
+                                              || userManager.VerifyUser(userManager.CurrentUserId, GetResourcePermissions(x.Id).Select(y => y.GrantedUserId).ToList())
+                                              || authen.IsInRole(HiveRoles.Administrator)).ToArray();
     }
 
     public void UpdateSlave(Slave slave) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         dao.UpdateSlave(slave);
@@ -553,5 +564,5 @@
 
     public void UpdateSlaveGroup(SlaveGroup slaveGroup) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       trans.UseTransaction(() => {
         dao.UpdateSlaveGroup(slaveGroup);
@@ -560,5 +571,6 @@
 
     public void DeleteSlave(Guid slaveId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(slaveId);
       trans.UseTransaction(() => {
         dao.DeleteSlave(slaveId);
@@ -567,5 +579,6 @@
 
     public void DeleteSlaveGroup(Guid slaveGroupId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(slaveGroupId);
       trans.UseTransaction(() => {
         dao.DeleteSlaveGroup(slaveGroupId);
@@ -623,10 +636,13 @@
     #region Downtime Methods
     public Guid AddDowntime(Downtime downtime) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(downtime.ResourceId);
       return trans.UseTransaction(() => dao.AddDowntime(downtime));
     }
 
     public void DeleteDowntime(Guid downtimeId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      // TODO: pass resource id
+      // author.AuthorizeForResource(resourceId);
       trans.UseTransaction(() => {
         dao.DeleteDowntime(downtimeId);
@@ -635,5 +651,6 @@
 
     public void UpdateDowntime(Downtime downtime) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      author.AuthorizeForResourceAdministration(downtime.ResourceId);
       trans.UseTransaction(() => {
         dao.UpdateDowntime(downtime);
@@ -642,5 +659,5 @@
 
     public IEnumerable<Downtime> GetDowntimesForResource(Guid resourceId) {
-      authen.AuthenticateForAnyRole(HiveRoles.Administrator);
+      authen.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       return trans.UseTransaction(() => dao.GetDowntimes(x => x.ResourceId == resourceId));
     }
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs	(revision 7950)
@@ -33,4 +33,6 @@
 
     void AuthorizeForJob(Guid jobId, Permission requiredPermission);
+
+    void AuthorizeForResourceAdministration(Guid resourceId);
   }
 }
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IServiceLocator.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IServiceLocator.cs	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Interfaces/IServiceLocator.cs	(revision 7950)
@@ -24,10 +24,10 @@
 namespace HeuristicLab.Services.Hive {
   public interface IServiceLocator {
-    IAuthenticationManager AuthenticationManager { get; }
+    HeuristicLab.Services.Access.IRoleVerifier AuthenticationManager { get; }
     IAuthorizationManager AuthorizationManager { get; }
     IHiveDao HiveDao { get; }
     IEventManager EventManager { get; }
     ITransactionManager TransactionManager { get; }
-    IUserManager UserManager { get; }
+    HeuristicLab.Services.Access.IUserManager UserManager { get; }
     HeartbeatManager HeartbeatManager { get; }
   }
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs	(revision 7950)
@@ -46,4 +46,10 @@
         throw new SecurityException("Current user is not authorized to access task");
     }
+
+    public void AuthorizeForResourceAdministration(Guid resourceId) {
+      Resource resource = DT.Convert.ToEntity(ServiceLocator.Instance.HiveDao.GetResource(resourceId));
+      if (resource.OwnerUserId != ServiceLocator.Instance.UserManager.CurrentUserId && !ServiceLocator.Instance.AuthenticationManager.IsInRole(HiveRoles.Administrator))
+        throw new SecurityException("Current user is not authorized to access resource");
+    }
   }
 }
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs	(revision 7950)
@@ -31,4 +31,9 @@
   public interface IHiveService {
 
+    #region Authorization Methods
+    [OperationContract]
+    bool AuthorizesForResourceAdministration(Guid resourceId);
+    #endregion
+
     #region Task Methods
     [OperationContract]
@@ -160,8 +165,8 @@
     #region ResourcePermission Methods
     [OperationContract]
-    void GrantResourcePermission(Guid resourceId, Guid grantedUserId);
-
-    [OperationContract]
-    void RevokeResourcePermission(Guid resourceId, Guid grantedUserId);
+    void GrantResourcePermissions(Guid resourceId, params Guid[] grantedUserIds);
+
+    [OperationContract]
+    void RevokeResourcePermissions(Guid resourceId, params Guid[] grantedUserIds);
 
     [OperationContract]
Index: /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceLocator.cs
===================================================================
--- /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceLocator.cs	(revision 7949)
+++ /branches/HiveResourcePermissionManagement (trunk integration)/HeuristicLab.Services.Hive/3.3/ServiceLocator.cs	(revision 7950)
@@ -42,8 +42,8 @@
     }
 
-    private IAuthenticationManager authenticationManager;
-    public IAuthenticationManager AuthenticationManager {
+    private HeuristicLab.Services.Access.IRoleVerifier authenticationManager;
+    public HeuristicLab.Services.Access.IRoleVerifier AuthenticationManager {
       get {
-        if (authenticationManager == null) authenticationManager = new AuthenticationManager();
+        if (authenticationManager == null) authenticationManager = new HeuristicLab.Services.Access.RoleVerifier();
         return authenticationManager;
       }
@@ -74,8 +74,8 @@
     }
 
-    private IUserManager userManager;
-    public IUserManager UserManager {
+    private HeuristicLab.Services.Access.IUserManager userManager;
+    public HeuristicLab.Services.Access.IUserManager UserManager {
       get {
-        if (userManager == null) userManager = new UserManager();
+        if (userManager == null) userManager = new HeuristicLab.Services.Access.UserManager();
         return userManager;
       }
@@ -85,5 +85,5 @@
     public HeartbeatManager HeartbeatManager {
       get {
-        if(heartbeatManager == null) heartbeatManager = new HeartbeatManager();
+        if (heartbeatManager == null) heartbeatManager = new HeartbeatManager();
         return heartbeatManager;
       }
