From 7cdcaa2467ba8e8f0f4696275d0853797bb84d1a Mon Sep 17 00:00:00 2001
From: felmer <felmer>
Date: Mon, 10 Sep 2012 13:46:08 +0000
Subject: [PATCH] BIS-142 Moving authorization annotations from ITrackingServer
 and IDemoServer to TrackingServer and DemoServer, respectively. Introducing
 QueryServerAuthorizationTest. Moving ServerInterfaceRegressionTest from
 shared to server package. Interfaces IRelationshipService and
 IEntityOperationChecker moved from shared to server.

SVN: 26571
---
 .../server/CommonBusinessObjectFactory.java   |  2 -
 .../openbis/generic/server/ETLService.java    |  2 +
 .../server/EntityOperationChecker.java        |  1 -
 .../IEntityOperationChecker.java              |  2 +-
 .../IRelationshipService.java                 |  2 +-
 .../generic/server/RelationshipService.java   |  1 -
 .../generic/server/TrackingServer.java        | 13 +++--
 .../bo/AbstractBusinessObjectFactory.java     |  4 +-
 .../bo/AbstractDataSetBusinessObject.java     |  2 +-
 .../bo/AbstractSampleBusinessObject.java      |  4 +-
 .../generic/server/business/bo/DataBO.java    |  2 +-
 .../server/business/bo/DataSetTable.java      |  2 +-
 .../business/bo/DeletedDataSetTable.java      |  2 +-
 .../server/business/bo/ExperimentBO.java      |  2 +-
 .../server/business/bo/ExperimentTable.java   |  2 +-
 .../generic/server/business/bo/ProjectBO.java |  2 +-
 .../generic/server/business/bo/SampleBO.java  |  4 +-
 .../server/business/bo/SampleTable.java       |  4 +-
 .../shared/IETLLIMSServiceConversational.java |  6 --
 .../generic/shared/ITrackingServer.java       |  4 --
 .../plugin/demo/server/DemoServer.java        | 19 +++++--
 .../plugin/demo/shared/IDemoServer.java       | 16 +-----
 .../server/ServerInterfaceRegressionTest.java |  7 +++
 .../server/business/bo/AbstractBOTest.java    |  4 +-
 .../ServerInterfaceRegressionTest.java        |  5 +-
 .../ETLServiceAuthorizationTest.java          | 55 +++++++++++++++++--
 .../GenericServerAuthorizationTest.java       |  2 +-
 .../openbis/systemtest/base/BaseTest.java     |  2 +-
 .../base/RelationshipServiceStub.java         |  2 +-
 .../base/builder/SessionBuilder.java          |  5 ++
 30 files changed, 116 insertions(+), 64 deletions(-)
 rename openbis/source/java/ch/systemsx/cisd/openbis/generic/{shared => server}/IEntityOperationChecker.java (97%)
 rename openbis/source/java/ch/systemsx/cisd/openbis/generic/{shared => server}/IRelationshipService.java (99%)
 rename openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/{shared => server}/ServerInterfaceRegressionTest.java (81%)

diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/CommonBusinessObjectFactory.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/CommonBusinessObjectFactory.java
index adf5605dce5..34d040ef220 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/CommonBusinessObjectFactory.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/CommonBusinessObjectFactory.java
@@ -80,8 +80,6 @@ import ch.systemsx.cisd.openbis.generic.server.business.bo.samplelister.ISampleL
 import ch.systemsx.cisd.openbis.generic.server.business.bo.samplelister.SampleLister;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.jython.api.v1.impl.IMasterDataScriptRegistrationRunner;
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.dto.Session;
 import ch.systemsx.cisd.openbis.generic.shared.dto.properties.EntityKind;
 
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/ETLService.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/ETLService.java
index 7b9d127353d..03717eaf8b0 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/ETLService.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/ETLService.java
@@ -1432,7 +1432,9 @@ public class ETLService extends AbstractCommonServer<IETLLIMSService> implements
     }
 
     @Override
+    @RolesAllowed(RoleWithHierarchy.SPACE_ETL_SERVER)
     public AtomicEntityOperationResult performEntityOperations(String sessionToken,
+            @AuthorizationGuard(guardClass = AtomicOperationsPredicate.class)
             AtomicEntityOperationDetails operationDetails, IProgressListener progressListener)
     {
 
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/EntityOperationChecker.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/EntityOperationChecker.java
index f4ae030b2ce..644ca156c60 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/EntityOperationChecker.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/EntityOperationChecker.java
@@ -18,7 +18,6 @@ package ch.systemsx.cisd.openbis.generic.server;
 
 import java.util.List;
 
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewSample;
 import ch.systemsx.cisd.openbis.generic.shared.dto.IAuthSession;
 import ch.systemsx.cisd.openbis.generic.shared.dto.identifier.SampleOwnerIdentifier;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IEntityOperationChecker.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/IEntityOperationChecker.java
similarity index 97%
rename from openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IEntityOperationChecker.java
rename to openbis/source/java/ch/systemsx/cisd/openbis/generic/server/IEntityOperationChecker.java
index fa2b545b432..d33a09040e0 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IEntityOperationChecker.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/IEntityOperationChecker.java
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.generic.shared;
+package ch.systemsx.cisd.openbis.generic.server;
 
 import java.util.List;
 
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IRelationshipService.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/IRelationshipService.java
similarity index 99%
rename from openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IRelationshipService.java
rename to openbis/source/java/ch/systemsx/cisd/openbis/generic/server/IRelationshipService.java
index 90d4bb41423..e62f739784e 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IRelationshipService.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/IRelationshipService.java
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.generic.shared;
+package ch.systemsx.cisd.openbis.generic.server;
 
 import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/RelationshipService.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/RelationshipService.java
index 898991494ce..daa35a98eb0 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/RelationshipService.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/RelationshipService.java
@@ -19,7 +19,6 @@ package ch.systemsx.cisd.openbis.generic.server;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.util.SampleUtils;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.db.DAOFactory;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.BasicConstant;
 import ch.systemsx.cisd.openbis.generic.shared.dto.DataPE;
 import ch.systemsx.cisd.openbis.generic.shared.dto.DataSetRelationshipPE;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/TrackingServer.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/TrackingServer.java
index e53dbf6049b..916120b9530 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/TrackingServer.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/TrackingServer.java
@@ -29,10 +29,12 @@ import ch.systemsx.cisd.openbis.generic.server.business.bo.datasetlister.IDatase
 import ch.systemsx.cisd.openbis.generic.server.business.bo.samplelister.ISampleLister;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.shared.ITrackingServer;
+import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.RolesAllowed;
 import ch.systemsx.cisd.openbis.generic.shared.basic.SearchlinkUtilities;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.EntityKind;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ExternalData;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ListOrSearchSampleCriteria;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.TrackingDataSetCriteria;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.TrackingSampleCriteria;
@@ -44,20 +46,19 @@ public final class TrackingServer extends AbstractServer<ITrackingServer> implem
     private final ICommonBusinessObjectFactory businessObjectFactory;
 
     public TrackingServer(final ISessionManager<Session> sessionManager,
-            final IDAOFactory daoFactory,
-            final ICommonBusinessObjectFactory businessObjectFactory)
+            final IDAOFactory daoFactory, final ICommonBusinessObjectFactory businessObjectFactory)
     {
         this(sessionManager, daoFactory, null, businessObjectFactory);
     }
 
-    TrackingServer(final ISessionManager<Session> sessionManager,
-            final IDAOFactory daoFactory, IPropertiesBatchManager propertiesBatchManager,
+    TrackingServer(final ISessionManager<Session> sessionManager, final IDAOFactory daoFactory,
+            IPropertiesBatchManager propertiesBatchManager,
             final ICommonBusinessObjectFactory businessObjectFactory)
     {
         super(sessionManager, daoFactory, propertiesBatchManager);
         this.businessObjectFactory = businessObjectFactory;
     }
-    
+
     ICommonBusinessObjectFactory getBusinessObjectFactory()
     {
         return businessObjectFactory;
@@ -81,6 +82,7 @@ public final class TrackingServer extends AbstractServer<ITrackingServer> implem
     //
 
     @Override
+    @RolesAllowed(RoleWithHierarchy.INSTANCE_ADMIN)
     public List<Sample> listSamples(String sessionToken, TrackingSampleCriteria criteria)
     {
         final Session session = getSession(sessionToken);
@@ -103,6 +105,7 @@ public final class TrackingServer extends AbstractServer<ITrackingServer> implem
     }
 
     @Override
+    @RolesAllowed(RoleWithHierarchy.INSTANCE_ADMIN)
     public List<ExternalData> listDataSets(String sessionToken, TrackingDataSetCriteria criteria)
     {
         final Session session = getSession(sessionToken);
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBusinessObjectFactory.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBusinessObjectFactory.java
index e8e7e61b777..756252fba1b 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBusinessObjectFactory.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBusinessObjectFactory.java
@@ -19,10 +19,10 @@ package ch.systemsx.cisd.openbis.generic.server.business.bo;
 import javax.annotation.Resource;
 
 import ch.systemsx.cisd.openbis.generic.server.ComponentNames;
+import ch.systemsx.cisd.openbis.generic.server.IEntityOperationChecker;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.IDataStoreServiceFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 
 /**
  * An <i>abstract</i> <i>Business Object</i> factory.
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractDataSetBusinessObject.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractDataSetBusinessObject.java
index baa5a039559..b8c74e0a261 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractDataSetBusinessObject.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractDataSetBusinessObject.java
@@ -25,10 +25,10 @@ import java.util.Set;
 
 import ch.systemsx.cisd.common.collections.CollectionUtils;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDataDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IEntityPropertiesConverter;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.IEntityProperty;
 import ch.systemsx.cisd.openbis.generic.shared.dto.DataPE;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractSampleBusinessObject.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractSampleBusinessObject.java
index e8f707d7b1f..f872b73ab4d 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractSampleBusinessObject.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractSampleBusinessObject.java
@@ -26,14 +26,14 @@ import java.util.Map.Entry;
 import java.util.Set;
 
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IEntityOperationChecker;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.util.SampleOwner;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.util.SampleUtils;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDataDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IEntityPropertiesConverter;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.ISampleDAO;
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.BasicConstant;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.IEntityProperty;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataBO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataBO.java
index 38841dee92c..80e9c583444 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataBO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataBO.java
@@ -28,11 +28,11 @@ import org.springframework.dao.DataAccessException;
 
 import ch.rinn.restrictions.Friend;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDataDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IEntityPropertiesConverter;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IVocabularyDAO;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Code;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DataSetArchivingStatus;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataSetTable.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataSetTable.java
index 7474b38f909..2ae341b5003 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataSetTable.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DataSetTable.java
@@ -43,6 +43,7 @@ import ch.systemsx.cisd.common.exceptions.EnvironmentFailureException;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.common.logging.LogCategory;
 import ch.systemsx.cisd.common.logging.LogFactory;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.IDataStoreServiceFactory;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.exception.DataSetDeletionDisallowedTypesException;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.exception.DataSetDeletionUnknownLocationsException;
@@ -51,7 +52,6 @@ import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDataDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.event.DeleteDataSetEventBuilder;
 import ch.systemsx.cisd.openbis.generic.shared.Constants;
 import ch.systemsx.cisd.openbis.generic.shared.IDataStoreService;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.BasicConstant;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Code;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DeletedDataSetTable.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DeletedDataSetTable.java
index dfa17272a34..aabd39580c6 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DeletedDataSetTable.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/DeletedDataSetTable.java
@@ -29,13 +29,13 @@ import org.springframework.dao.DataAccessException;
 
 import ch.systemsx.cisd.common.collections.CollectionUtils;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.IDataStoreServiceFactory;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.exception.DataSetDeletionDisallowedTypesException;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.exception.DataSetDeletionUnknownLocationsException;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDataDAO;
 import ch.systemsx.cisd.openbis.generic.shared.IDataStoreService;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DataSetArchivingStatus;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DatasetLocation;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentBO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentBO.java
index b25b9fdce8d..a7255525140 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentBO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentBO.java
@@ -28,12 +28,12 @@ import org.springframework.dao.DataAccessException;
 import ch.rinn.restrictions.Private;
 import ch.systemsx.cisd.common.collections.CollectionUtils;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.util.SampleUtils;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IAttachmentDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IEntityPropertiesConverter;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.ISampleDAO;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Code;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.IEntityProperty;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentTable.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentTable.java
index 74e1f762aa6..3458892ff32 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentTable.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ExperimentTable.java
@@ -27,10 +27,10 @@ import java.util.Set;
 import org.springframework.dao.DataAccessException;
 
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IEntityPropertiesConverter;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IExperimentDAO;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.EntityType;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ExperimentBatchUpdateDetails;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.IEntityProperty;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ProjectBO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ProjectBO.java
index 43af99656d9..c4ef0d0b0d7 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ProjectBO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/ProjectBO.java
@@ -26,11 +26,11 @@ import org.springframework.orm.ObjectRetrievalFailureException;
 
 import ch.systemsx.cisd.common.collections.CollectionUtils;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IAttachmentDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDeletionDAO;
 import ch.systemsx.cisd.openbis.generic.server.util.SpaceIdentifierHelper;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewAttachment;
 import ch.systemsx.cisd.openbis.generic.shared.dto.AttachmentHolderPE;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleBO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleBO.java
index a0d07aa06d3..827769e6048 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleBO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleBO.java
@@ -24,12 +24,12 @@ import java.util.Set;
 import org.springframework.dao.DataAccessException;
 
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IEntityOperationChecker;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.util.SampleUtils;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IAttachmentDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IEntityPropertiesConverter;
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.IEntityProperty;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewAttachment;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleTable.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleTable.java
index c9a19ee3df2..1345eb2d8b6 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleTable.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/bo/SampleTable.java
@@ -29,10 +29,10 @@ import org.springframework.dao.DataAccessException;
 
 import ch.systemsx.cisd.common.exceptions.EnvironmentFailureException;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
+import ch.systemsx.cisd.openbis.generic.server.IEntityOperationChecker;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.util.SampleOwner;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.IEntityProperty;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewSample;
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IETLLIMSServiceConversational.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IETLLIMSServiceConversational.java
index 2030ae3acd2..08d097a9183 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IETLLIMSServiceConversational.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/IETLLIMSServiceConversational.java
@@ -20,11 +20,7 @@ import org.springframework.transaction.annotation.Transactional;
 
 import ch.systemsx.cisd.common.conversation.IConversationalRmiServer;
 import ch.systemsx.cisd.common.conversation.IProgressListener;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.AuthorizationGuard;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.RolesAllowed;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.predicate.AtomicOperationsPredicate;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DatabaseModificationKind.ObjectKind;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
 import ch.systemsx.cisd.openbis.generic.shared.dto.AtomicEntityOperationDetails;
 import ch.systemsx.cisd.openbis.generic.shared.dto.AtomicEntityOperationResult;
 
@@ -34,13 +30,11 @@ import ch.systemsx.cisd.openbis.generic.shared.dto.AtomicEntityOperationResult;
 public interface IETLLIMSServiceConversational extends IETLLIMSService, IConversationalRmiServer
 {
     @Transactional
-    @RolesAllowed(RoleWithHierarchy.SPACE_ETL_SERVER)
     @DatabaseUpdateModification(value =
         { ObjectKind.SAMPLE, ObjectKind.EXPERIMENT, ObjectKind.DATA_SET })
     @DatabaseCreateOrDeleteModification(value =
         { ObjectKind.SPACE, ObjectKind.PROJECT, ObjectKind.SAMPLE, ObjectKind.EXPERIMENT,
                 ObjectKind.DATA_SET })
     public AtomicEntityOperationResult performEntityOperations(String sessionToken,
-            @AuthorizationGuard(guardClass = AtomicOperationsPredicate.class)
             AtomicEntityOperationDetails operationDetails, IProgressListener progressListener);
 }
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/ITrackingServer.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/ITrackingServer.java
index ac66d85887a..c9186c81199 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/ITrackingServer.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/ITrackingServer.java
@@ -20,10 +20,8 @@ import java.util.List;
 
 import org.springframework.transaction.annotation.Transactional;
 
-import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.RolesAllowed;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ExternalData;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.TrackingDataSetCriteria;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.TrackingSampleCriteria;
@@ -42,7 +40,6 @@ public interface ITrackingServer extends IServer
      * @return a sorted list of {@link Sample}.
      */
     @Transactional(readOnly = true)
-    @RolesAllowed(RoleWithHierarchy.INSTANCE_ADMIN)
     public List<Sample> listSamples(final String sessionToken, final TrackingSampleCriteria criteria);
 
     /**
@@ -51,7 +48,6 @@ public interface ITrackingServer extends IServer
      * @return a sorted list of {@link ExternalData}.
      */
     @Transactional(readOnly = true)
-    @RolesAllowed(RoleWithHierarchy.INSTANCE_ADMIN)
     public List<ExternalData> listDataSets(final String sessionToken,
             final TrackingDataSetCriteria criteria);
 
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/server/DemoServer.java b/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/server/DemoServer.java
index bf0d87442ba..ba3a63165d8 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/server/DemoServer.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/server/DemoServer.java
@@ -25,6 +25,7 @@ import org.springframework.stereotype.Component;
 import ch.rinn.restrictions.Private;
 import ch.systemsx.cisd.authentication.ISessionManager;
 import ch.systemsx.cisd.common.exceptions.NotImplementedException;
+import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.common.spring.IInvocationLoggerContext;
 import ch.systemsx.cisd.openbis.generic.server.AbstractServer;
 import ch.systemsx.cisd.openbis.generic.server.business.IPropertiesBatchManager;
@@ -32,9 +33,14 @@ import ch.systemsx.cisd.openbis.generic.server.business.bo.ISampleBO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.plugin.IDataSetTypeSlaveServerPlugin;
 import ch.systemsx.cisd.openbis.generic.server.plugin.ISampleTypeSlaveServerPlugin;
+import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.AuthorizationGuard;
+import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.RolesAllowed;
+import ch.systemsx.cisd.openbis.generic.shared.authorization.predicate.NewSamplePredicate;
+import ch.systemsx.cisd.openbis.generic.shared.authorization.predicate.SampleTechIdPredicate;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewAttachment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewSample;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.SampleParentWithDerived;
 import ch.systemsx.cisd.openbis.generic.shared.dto.SamplePE;
 import ch.systemsx.cisd.openbis.generic.shared.dto.SampleParentWithDerivedDTO;
@@ -99,8 +105,10 @@ public final class DemoServer extends AbstractServer<IDemoServer> implements IDe
     }
 
     @Override
-    public final SampleParentWithDerived getSampleInfo(final String sessionToken,
-            final TechId sampleId)
+    @RolesAllowed(RoleWithHierarchy.SPACE_OBSERVER)
+    public SampleParentWithDerived getSampleInfo(final String sessionToken,
+            @AuthorizationGuard(guardClass = SampleTechIdPredicate.class)
+            final TechId sampleId) throws UserFailureException
     {
         final Session session = getSession(sessionToken);
         final ISampleBO sampleBO = businessObjectFactory.createSampleBO(session);
@@ -118,13 +126,16 @@ public final class DemoServer extends AbstractServer<IDemoServer> implements IDe
     }
 
     @Override
-    public final void registerSample(final String sessionToken, final NewSample newSample,
-            final Collection<NewAttachment> attachments)
+    @RolesAllowed(RoleWithHierarchy.SPACE_USER)
+    public void registerSample(final String sessionToken,
+            @AuthorizationGuard(guardClass = NewSamplePredicate.class)
+            final NewSample newSample, final Collection<NewAttachment> attachments)
     {
         throw new NotImplementedException();
     }
 
     @Override
+    @RolesAllowed(RoleWithHierarchy.SPACE_OBSERVER)
     public int getNumberOfExperiments(String sessionToken)
     {
         return getDAOFactory().getExperimentDAO().listExperiments().size();
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/shared/IDemoServer.java b/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/shared/IDemoServer.java
index 7b567646c8d..c50ee03544a 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/shared/IDemoServer.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/plugin/demo/shared/IDemoServer.java
@@ -23,17 +23,12 @@ import org.springframework.transaction.annotation.Transactional;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.DatabaseCreateOrDeleteModification;
 import ch.systemsx.cisd.openbis.generic.shared.IServer;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.AuthorizationGuard;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.annotation.RolesAllowed;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.predicate.NewSamplePredicate;
-import ch.systemsx.cisd.openbis.generic.shared.authorization.predicate.SampleTechIdPredicate;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DatabaseModificationKind.ObjectKind;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewAttachment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewSample;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.SampleParentWithDerived;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DatabaseModificationKind.ObjectKind;
 
 /**
  * The <i>demo</i> server.
@@ -46,7 +41,6 @@ public interface IDemoServer extends IServer
      * Returns number of experiments.
      */
     @Transactional
-    @RolesAllowed(RoleWithHierarchy.SPACE_OBSERVER)
     public int getNumberOfExperiments(String sessionToken);
 
     /**
@@ -57,18 +51,14 @@ public interface IDemoServer extends IServer
      *             uniquely identified by given <var>sampleId</var> does not exist.
      */
     @Transactional(readOnly = true)
-    @RolesAllowed(RoleWithHierarchy.SPACE_OBSERVER)
-    public SampleParentWithDerived getSampleInfo(final String sessionToken,
-            @AuthorizationGuard(guardClass = SampleTechIdPredicate.class) final TechId sampleId)
+    public SampleParentWithDerived getSampleInfo(final String sessionToken, final TechId sampleId)
             throws UserFailureException;
 
     /**
      * Registers a new sample.
      */
     @Transactional
-    @RolesAllowed(RoleWithHierarchy.SPACE_USER)
     @DatabaseCreateOrDeleteModification(value = ObjectKind.SAMPLE)
-    public void registerSample(final String sessionToken,
-            @AuthorizationGuard(guardClass = NewSamplePredicate.class) final NewSample newSample,
+    public void registerSample(final String sessionToken, final NewSample newSample,
             final Collection<NewAttachment> attachments);
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/ServerInterfaceRegressionTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/ServerInterfaceRegressionTest.java
index b924e1b485c..d4ad2bfc6a4 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/ServerInterfaceRegressionTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/ServerInterfaceRegressionTest.java
@@ -20,6 +20,7 @@ import org.testng.annotations.Test;
 
 import ch.systemsx.cisd.openbis.generic.shared.ICommonServer;
 import ch.systemsx.cisd.openbis.generic.shared.IETLLIMSService;
+import ch.systemsx.cisd.openbis.generic.shared.ITrackingServer;
 import ch.systemsx.cisd.openbis.generic.shared.RegressionTestCase;
 
 /**
@@ -40,4 +41,10 @@ public class ServerInterfaceRegressionTest extends RegressionTestCase
     {
         assertMandatoryMethodAnnotations(IETLLIMSService.class, ETLService.class);
     }
+
+    @Test
+    public void testITrackingServer()
+    {
+        assertMandatoryMethodAnnotations(ITrackingServer.class, TrackingServer.class);
+    }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBOTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBOTest.java
index 4f2bf00ac23..4f3ea35af62 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBOTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/generic/server/business/bo/AbstractBOTest.java
@@ -25,6 +25,8 @@ import org.testng.annotations.AfterMethod;
 import org.testng.annotations.BeforeMethod;
 
 import ch.rinn.restrictions.Friend;
+import ch.systemsx.cisd.openbis.generic.server.IEntityOperationChecker;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.ScriptBO.IScriptFactory;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.datasetlister.IDatasetLister;
 import ch.systemsx.cisd.openbis.generic.server.business.bo.samplelister.ISampleLister;
@@ -57,8 +59,6 @@ import ch.systemsx.cisd.openbis.generic.server.dataaccess.ISpaceDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IVocabularyDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IVocabularyTermDAO;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.db.IPermIdDAO;
-import ch.systemsx.cisd.openbis.generic.shared.IEntityOperationChecker;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.dto.DatabaseInstancePE;
 
 /**
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/shared/ServerInterfaceRegressionTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/server/ServerInterfaceRegressionTest.java
similarity index 81%
rename from openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/shared/ServerInterfaceRegressionTest.java
rename to openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/server/ServerInterfaceRegressionTest.java
index 181b8e8f283..0d63ba312c3 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/shared/ServerInterfaceRegressionTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/plugin/demo/server/ServerInterfaceRegressionTest.java
@@ -14,11 +14,12 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.plugin.demo.shared;
+package ch.systemsx.cisd.openbis.plugin.demo.server;
 
 import org.testng.annotations.Test;
 
 import ch.systemsx.cisd.openbis.generic.shared.RegressionTestCase;
+import ch.systemsx.cisd.openbis.plugin.demo.shared.IDemoServer;
 
 /**
  * @author Franz-Josef Elmer
@@ -28,6 +29,6 @@ public class ServerInterfaceRegressionTest extends RegressionTestCase
     @Test
     public void testIGenericServer()
     {
-        assertMandatoryMethodAnnotations(IDemoServer.class);
+        assertMandatoryMethodAnnotations(IDemoServer.class, DemoServer.class);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/ETLServiceAuthorizationTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/ETLServiceAuthorizationTest.java
index c9709fc8656..5037a0283b8 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/ETLServiceAuthorizationTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/ETLServiceAuthorizationTest.java
@@ -18,7 +18,10 @@ package ch.systemsx.cisd.openbis.systemtest.authorization;
 
 import static org.testng.AssertJUnit.assertEquals;
 
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
@@ -27,11 +30,24 @@ import ch.systemsx.cisd.common.exceptions.AuthorizationFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ListSampleCriteria;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewExperiment;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewMaterial;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewProject;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewSample;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.NewSpace;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleCode;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
+import ch.systemsx.cisd.openbis.generic.shared.dto.AtomicEntityOperationDetails;
+import ch.systemsx.cisd.openbis.generic.shared.dto.DataSetBatchUpdatesDTO;
+import ch.systemsx.cisd.openbis.generic.shared.dto.ExperimentUpdatesDTO;
+import ch.systemsx.cisd.openbis.generic.shared.dto.MaterialUpdateDTO;
+import ch.systemsx.cisd.openbis.generic.shared.dto.NewExternalData;
+import ch.systemsx.cisd.openbis.generic.shared.dto.SampleUpdatesDTO;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
+import ch.systemsx.cisd.openbis.systemtest.base.builder.SessionBuilder;
 
 /**
  * @author Franz-Josef Elmer
@@ -44,19 +60,19 @@ public class ETLServiceAuthorizationTest extends BaseTest
 
     private Project project;
 
-    private Project anotherProject;
-
     private Experiment experiment;
 
+    private Sample sample;
+
     @BeforeClass
     public void createSomeEntities()
     {
         space = create(aSpace());
         anotherSpace = create(aSpace());
         project = create(aProject().inSpace(space));
-        anotherProject = create(aProject().inSpace(anotherSpace));
+        create(aProject().inSpace(anotherSpace));
         experiment = create(anExperiment().inProject(project));
-        create(aSample().inExperiment(experiment));
+        sample = create(aSample().inExperiment(experiment));
         create(aSample().inExperiment(experiment));
     }
 
@@ -103,4 +119,35 @@ public class ETLServiceAuthorizationTest extends BaseTest
 
         assertEquals(1, projects.size());
     }
+
+    @Test(expectedExceptions =
+        { AuthorizationFailureException.class })
+    public void testRegistrationOfSamplesForUnauthorizedUser()
+    {
+        String sessionToken = create(aSession().withInstanceRole(RoleWithHierarchy.INSTANCE_ADMIN));
+        SessionBuilder session = aSession().withSpaceRole(RoleCode.POWER_USER, space);
+        create(session);
+        String userID = session.getUserID();
+        List<NewSpace> spaceRegistrations = Collections.emptyList();
+        List<NewProject> projectRegistrations = Collections.emptyList();
+        List<NewExperiment> experimentRegistrations = Collections.emptyList();
+        List<ExperimentUpdatesDTO> experimentUpdates =
+                Collections.<ExperimentUpdatesDTO> emptyList();
+        List<SampleUpdatesDTO> sampleUpdates = Collections.emptyList();
+        NewSample newSample = new NewSample();
+        newSample.setIdentifier(anotherSpace.getIdentifier() + "/SAMPLE-1");
+        newSample.setSampleType(sample.getSampleType());
+        List<NewSample> sampleRegistrations = Arrays.asList(newSample);
+        Map<String, List<NewMaterial>> materialRegistrations = Collections.emptyMap();
+        List<MaterialUpdateDTO> materialUpdates = Collections.emptyList();
+        List<? extends NewExternalData> dataSetRegistrations = Collections.emptyList();
+        List<DataSetBatchUpdatesDTO> dataSetUpdates = Collections.emptyList();
+
+        TechId registrationid = new TechId(etlService.drawANewUniqueID(sessionToken));
+
+        etlService.performEntityOperations(sessionToken, new AtomicEntityOperationDetails(
+                registrationid, userID, spaceRegistrations, projectRegistrations,
+                experimentRegistrations, experimentUpdates, sampleUpdates, sampleRegistrations,
+                materialRegistrations, materialUpdates, dataSetRegistrations, dataSetUpdates));
+    }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/GenericServerAuthorizationTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/GenericServerAuthorizationTest.java
index 718ac25771d..62eedc66abd 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/GenericServerAuthorizationTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/authorization/GenericServerAuthorizationTest.java
@@ -46,6 +46,6 @@ public class GenericServerAuthorizationTest extends BaseTest
         sample.setSampleType(sampleType);
 
         genericServer.registerSample(sessionToken, sample, Collections.<NewAttachment> emptySet());
-
     }
+
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/BaseTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/BaseTest.java
index 94ec40b7b71..7dc09c3c702 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/BaseTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/BaseTest.java
@@ -33,10 +33,10 @@ import ch.systemsx.cisd.common.logging.LogInitializer;
 import ch.systemsx.cisd.common.servlet.SpringRequestContextProvider;
 import ch.systemsx.cisd.openbis.generic.client.web.client.ICommonClientService;
 import ch.systemsx.cisd.openbis.generic.server.ICommonServerForInternalUse;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.IDAOFactory;
 import ch.systemsx.cisd.openbis.generic.server.dataaccess.db.search.IndexMode;
 import ch.systemsx.cisd.openbis.generic.shared.IETLLIMSService;
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.basic.TechId;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DatabaseInstance;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/RelationshipServiceStub.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/RelationshipServiceStub.java
index ef6714871a2..9a5992106f0 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/RelationshipServiceStub.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/RelationshipServiceStub.java
@@ -16,7 +16,7 @@
 
 package ch.systemsx.cisd.openbis.systemtest.base;
 
-import ch.systemsx.cisd.openbis.generic.shared.IRelationshipService;
+import ch.systemsx.cisd.openbis.generic.server.IRelationshipService;
 import ch.systemsx.cisd.openbis.generic.shared.dto.DataPE;
 import ch.systemsx.cisd.openbis.generic.shared.dto.ExperimentPE;
 import ch.systemsx.cisd.openbis.generic.shared.dto.IAuthSession;
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/builder/SessionBuilder.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/builder/SessionBuilder.java
index 2f050bf6485..8a0e20fd4d3 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/builder/SessionBuilder.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/builder/SessionBuilder.java
@@ -45,6 +45,11 @@ public class SessionBuilder extends Builder<String>
         this.instanceRoles = new ArrayList<RoleCode>();
     }
 
+    public String getUserID()
+    {
+        return userName;
+    }
+
     public SessionBuilder withSpaceRole(RoleCode role, Space space)
     {
         if (role == null)
-- 
GitLab