Author: sohil.shah(a)jboss.com Date: 2009-10-02 18:09:20 -0400 (Fri, 02 Oct 2009) New Revision: 813 Added: authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/ authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/AbstractIntegrationTest.java authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/TestTimeOfDay.java authz/trunk/core-components/src/main/java/org/jboss/security/authz/components/environment/ authz/trunk/core-components/src/main/java/org/jboss/security/authz/components/environment/TimeOfDay.java authz/trunk/core-components/src/test/java/org/jboss/security/authz/components/environment/ authz/trunk/core-components/src/test/java/org/jboss/security/authz/components/environment/TestTimeDroolsRules.java Modified: authz/trunk/component-spec/src/main/java/org/jboss/security/authz/component/ComponentCategory.java authz/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java Log: experimenting with introducing environment based components Added: authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/AbstractIntegrationTest.java =================================================================== --- authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/AbstractIntegrationTest.java (rev 0) +++ authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/AbstractIntegrationTest.java 2009-10-02 22:09:20 UTC (rev 813) @@ -0,0 +1,152 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.agent.test.integration; + +import java.util.Set; + +import junit.framework.TestCase; + +import org.apache.log4j.Logger; + +import org.hibernate.Session; +import org.hibernate.Transaction; +import org.jboss.security.authz.bootstrap.ServiceContainer; +import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; +import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; +import org.jboss.security.authz.agent.enforcement.EnforcementResponse; +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.services.PolicyComposer; +import org.jboss.security.authz.model.Policy; + +import org.jboss.security.authz.policy.server.tools.HibernateService; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public abstract class AbstractIntegrationTest extends TestCase +{ + private static Logger log = Logger.getLogger(AbstractIntegrationTest.class); + + PolicyComposer policyComposer; + PolicyEnforcementPoint enforcer; + PolicyProvisioner provisioner; + HibernateService hibernateService; + + + public void setUp() throws Exception + { + ServiceContainer.bootstrap(); + + this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); + this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); + this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); + this.hibernateService = (HibernateService)ServiceContainer.lookup("/policy-server/HibernateService"); + } + + public void tearDown() throws Exception + { + ServiceContainer.shutdown(); + } + + protected void assertServerState() throws Exception + { + //Assert Policy State of the Server + Set<Policy> policies = this.provisioner.readAllPolicies(); + + assertTrue("Policy Store must not be empty!!", (policies != null && !policies.isEmpty())); + for(Policy policy: policies) + { + log.info("------------------------------------------------------------------------------"); + log.info(policy.generateSystemPolicy()); + } + } + + protected void enforce(EnforcementContext enforcementContext, + boolean mustBePermitted) throws Exception + { + EnforcementResponse response = this.enforcer + .checkAccess(enforcementContext); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision=" + response.getMessage()); + + if (mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } + } + + protected EnforcementResponse enforceWithResponse(EnforcementContext enforcementContext, + boolean mustBePermitted) throws Exception + { + EnforcementResponse response = this.enforcer + .checkAccess(enforcementContext); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision=" + response.getMessage()); + + if (mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } + return response; + } + + /*protected void deleteAllPolicies() + { + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = hibernateService.getCurrentSession(); + tx = session.beginTransaction(); + + session.createQuery("delete XACMLPolicy").executeUpdate(); + + tx.commit(); + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } + }*/ +} Added: authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/TestTimeOfDay.java =================================================================== --- authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/TestTimeOfDay.java (rev 0) +++ authz/trunk/agent/src/test/java/org/jboss/security/authz/agent/test/integration/TestTimeOfDay.java 2009-10-02 22:09:20 UTC (rev 813) @@ -0,0 +1,99 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.security.authz.agent.test.integration; + +import java.net.URI; +import java.util.Calendar; + +import org.jboss.security.authz.model.Effect; +import org.jboss.security.authz.model.PolicyMetaData; + +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.subject.Roles; +import org.jboss.security.authz.components.action.Operation; +import org.jboss.security.authz.components.action.Read; +import org.jboss.security.authz.components.action.Write; +import org.jboss.security.authz.components.action.Manage; +import org.jboss.security.authz.components.environment.TimeOfDay; + +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.services.CompositionContext; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestTimeOfDay extends AbstractIntegrationTest +{ + public void testAccessBeforeSpecifiedTime() throws Exception + { + // SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/blah/index.html")); + + Read action = new Read(); + + TimeOfDay timeOfDay = new TimeOfDay(); + Calendar restrictiveCondition = Calendar.getInstance(); + int hour = restrictiveCondition.get(Calendar.HOUR_OF_DAY); + restrictiveCondition.set(Calendar.HOUR_OF_DAY, (hour + 1)); + timeOfDay.setTimeofDay(restrictiveCondition); + + + // Setup the Context for the Composition with these components + CompositionContext context = new CompositionContext(); + context.setPolicyTarget(resource); + context.addPolicyRule(Effect.PERMIT, action, timeOfDay, + "matchIfBefore"); + + // Store the policy into the Policy Server + this.provisioner.deploy(context); + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement + this.enforce(this.createEnforcementContext(resource, new Read()), true); + } + // ------------------------------------------------------------------------------------------------------------------------------------------------------ + private EnforcementContext createEnforcementContext(URIResource uriResource, + Operation operation) throws Exception + { + // Create an EnforcementContext + EnforcementContext context = new EnforcementContext(); + + // Create Resource + context.setAttribute("uri-resource", uriResource); + + // Create Subjects + Roles roles = new Roles(); + roles.addName("user"); + context.setAttribute("roles", roles); + + // Create Action + context.setAttribute("action", operation); + + TimeOfDay timeOfDay = new TimeOfDay(); + timeOfDay.setTimeofDay(Calendar.getInstance()); + context.setAttribute("currentTime", timeOfDay); + + return context; + } +} Modified: authz/trunk/component-spec/src/main/java/org/jboss/security/authz/component/ComponentCategory.java =================================================================== --- authz/trunk/component-spec/src/main/java/org/jboss/security/authz/component/ComponentCategory.java 2009-09-28 19:04:19 UTC (rev 812) +++ authz/trunk/component-spec/src/main/java/org/jboss/security/authz/component/ComponentCategory.java 2009-10-02 22:09:20 UTC (rev 813) @@ -82,9 +82,20 @@ { target.addActionMatch(expression); } - }; + }, //------Environment------------------------------------------------------------------------------------------------------------------------------------------- + CURRENT_TIME + { + public String getAttributeCategory() + { + return XACMLConstants.ATTRIBUTEID_CURRENT_TIME; + } + public void setExpression(Target target, AttributeExpression expression) + { + target.addEnvironmentMatch(expression); + } + }; //Define the enum behavior public abstract String getAttributeCategory(); Added: authz/trunk/core-components/src/main/java/org/jboss/security/authz/components/environment/TimeOfDay.java =================================================================== --- authz/trunk/core-components/src/main/java/org/jboss/security/authz/components/environment/TimeOfDay.java (rev 0) +++ authz/trunk/core-components/src/main/java/org/jboss/security/authz/components/environment/TimeOfDay.java 2009-10-02 22:09:20 UTC (rev 813) @@ -0,0 +1,163 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.security.authz.components.environment; + +import java.util.Calendar; + +import org.jboss.security.authz.tools.GeneralTool; + +import org.jboss.security.authz.component.Component; +import org.jboss.security.authz.component.ComponentType; +import org.jboss.security.authz.component.ComponentCategory; +import org.jboss.security.authz.component.SecurityContextData; +import org.jboss.security.authz.component.BooleanExpression; + +/** + * The TimeOfDay Security Component. Represents the "Time of the Day" that is to be used to make an access decision + * + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + * + */ +@Component( + name="timeofday", + type=ComponentType.LOGIC, + category=ComponentCategory.CURRENT_TIME +) +public class TimeOfDay +{ + protected static final String matchIfBeforeLogic = + "import java.util.Date\n"+ + "import java.util.Calendar\n"+ + + "function boolean before(Date currentTime)\n"+ + "{\n"+ + "Calendar allowedTime = Calendar.getInstance();\n"+ + "allowedTime.set(Calendar.HOUR_OF_DAY, <hour_of_day>);\n"+ + "allowedTime.set(Calendar.MINUTE, <minute>);\n"+ + + "allowedTime.set(Calendar.SECOND, 0);\n"+ + "allowedTime.set(Calendar.MILLISECOND, 0);\n"+ + + "return currentTime.before(allowedTime.getTime());\n"+ + "}\n"+ + + "rule \"<reference>\"\n"+ + "when\n"+ + "$ruleName: String()\n"+ + "$currentTime: Date()\n"+ + "eval($ruleName.contains(\"<reference>\"))\n"+ + "eval(before($currentTime))\n"+ + "then\n"+ + "insert(Boolean.TRUE);\n"+ + "end\n"; + + protected static final String matchIfAfterLogic = + "import java.util.Date\n"+ + "import java.util.Calendar\n"+ + + "function boolean after(Date currentTime)\n"+ + "{\n"+ + "Calendar allowedTime = Calendar.getInstance();\n"+ + "allowedTime.set(Calendar.HOUR_OF_DAY, <hour_of_day>);\n"+ + "allowedTime.set(Calendar.MINUTE, <minute>);\n"+ + + "allowedTime.set(Calendar.SECOND, 0);\n"+ + "allowedTime.set(Calendar.MILLISECOND, 0);\n"+ + + "return currentTime.after(allowedTime.getTime());\n"+ + "}\n"+ + + "rule \"<reference>\"\n"+ + "when\n"+ + "$ruleName: String()\n"+ + "$currentTime: Date()\n"+ + "eval($ruleName.contains(\"<reference>\"))\n"+ + "eval(after($currentTime))\n"+ + "then\n"+ + "insert(Boolean.TRUE);\n"+ + "end\n"; + + + + /** + * Role Names + */ + @SecurityContextData + protected Calendar timeofDay; + + + public TimeOfDay() + { + + } + + + public Calendar getTimeofDay() + { + return timeofDay; + } + + + + public void setTimeofDay(Calendar timeofDay) + { + this.timeofDay = timeofDay; + } + // ------------------------------------------------------------------------------------------------------------------------------------------------------------ + /** + * Creates a Policy Rule expression suggesting that access should be granted if the its performed *before* the specified time of the day + * + * @return the expression + */ + @BooleanExpression + public String[] matchIfBefore() + { + String ruleReference = "timeofday://matchIfBefore/" + + GeneralTool.generateUniqueId(); + + String ruleLogic = TimeOfDay.matchIfBeforeLogic.replaceAll("<hour_of_day>", ""+this.timeofDay.get(Calendar.HOUR_OF_DAY)); + ruleLogic = ruleLogic.replaceAll("<minute>", ""+this.timeofDay.get(Calendar.MINUTE)); + ruleLogic = ruleLogic.replaceAll("<reference>", ""+ruleReference); + + return new String[] { ruleReference, ruleLogic }; + } + + /** + * Creates a Policy Rule expression suggesting that access should be granted if the its performed *after* the specified time of the day + * + * @return the expression + */ + @BooleanExpression + public String[] matchIfAfter() + { + String ruleReference = "timeofday://matchIfAfter/" + + GeneralTool.generateUniqueId(); + + String ruleLogic = TimeOfDay.matchIfAfterLogic.replaceAll("<hour_of_day>", ""+this.timeofDay.get(Calendar.HOUR_OF_DAY)); + ruleLogic = ruleLogic.replaceAll("<minute>", ""+this.timeofDay.get(Calendar.MINUTE)); + ruleLogic = ruleLogic.replaceAll("<reference>", ""+ruleReference); + + return new String[] { ruleReference, ruleLogic }; + } +} Added: authz/trunk/core-components/src/test/java/org/jboss/security/authz/components/environment/TestTimeDroolsRules.java =================================================================== --- authz/trunk/core-components/src/test/java/org/jboss/security/authz/components/environment/TestTimeDroolsRules.java (rev 0) +++ authz/trunk/core-components/src/test/java/org/jboss/security/authz/components/environment/TestTimeDroolsRules.java 2009-10-02 22:09:20 UTC (rev 813) @@ -0,0 +1,198 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.security.authz.components.environment; + +import java.io.ByteArrayInputStream; +import java.io.InputStreamReader; +import java.io.Reader; +import java.util.Iterator; +import java.util.Date; +import java.util.Calendar; + +import junit.framework.TestCase; + +import org.apache.log4j.Logger; + +import org.drools.RuleBase; +import org.drools.RuleBaseFactory; +import org.drools.StatefulSession; +import org.drools.WorkingMemory; +import org.drools.compiler.PackageBuilder; + +import org.jboss.security.authz.components.environment.TimeOfDay; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestTimeDroolsRules extends TestCase +{ + private static Logger log = Logger.getLogger(TestTimeDroolsRules.class); + private static String rulePkg = "package security\n" + + "import org.jboss.security.authz.model.*;\n" + + "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; + + private RuleBase activeRuleBase; + + private String matchIfBefore; + private String matchIfAfter; + + public void setUp() throws Exception + { + StringBuilder buffer = new StringBuilder(); + + buffer.append(rulePkg + "\n"); + + Calendar calendar = Calendar.getInstance(); + + buffer.append(this.getMatchIfBefore() + "\n"); + buffer.append(this.getMatchIfAfter() + "\n"); + + Reader source = new InputStreamReader(new ByteArrayInputStream(buffer + .toString().getBytes())); + try + { + PackageBuilder packageBuilder = new PackageBuilder(); + packageBuilder.addPackageFromDrl(source); + + if (this.activeRuleBase == null) + { + this.activeRuleBase = RuleBaseFactory.newRuleBase(); + } + + // Perform the reloading of the RuleBase with the updated Rules + this.activeRuleBase.lock(); + this.activeRuleBase.addPackage(packageBuilder.getPackage()); + this.activeRuleBase.unlock(); + } + finally + { + source.close(); + } + } + + public void tearDown() throws Exception + { + this.activeRuleBase = null; + } + + public void testMatchIfBefore() throws Exception + { + log.info("Executing----------" + this.matchIfBefore); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + + // SetUp the context data + workingMemory.insert(this.matchIfBefore); + workingMemory.insert(new Date()); + + workingMemory.fireAllRules(); + + // Extract result + boolean success = false; + Iterator itr = workingMemory.iterateObjects(); + while (itr.hasNext()) + { + Object curr = itr.next(); + if (curr instanceof Boolean) + { + success = ((Boolean) curr).booleanValue(); + } + } + + ((StatefulSession) workingMemory).dispose(); + + assertTrue("Rule did not execute!!", success); + } + + public void testMatchIfAfter() throws Exception + { + log.info("Executing----------" + this.matchIfAfter); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + + // SetUp the context data + workingMemory.insert(this.matchIfAfter); + workingMemory.insert(new Date()); + + workingMemory.fireAllRules(); + + // Extract result + boolean success = false; + Iterator itr = workingMemory.iterateObjects(); + while (itr.hasNext()) + { + Object curr = itr.next(); + if (curr instanceof Boolean) + { + success = ((Boolean) curr).booleanValue(); + } + } + + ((StatefulSession) workingMemory).dispose(); + assertTrue("Rule did not execute!!", success); + } + + // ------------------------------------------------------------------------------------------------------------------------------------------------------ + private String getMatchIfBefore() + { + String timerule = null; + + TimeOfDay timeOfDay = new TimeOfDay(); + Calendar restrictiveCondition = Calendar.getInstance(); + int hour = restrictiveCondition.get(Calendar.HOUR_OF_DAY); + restrictiveCondition.set(Calendar.HOUR_OF_DAY, (hour + 1)); + timeOfDay.setTimeofDay(restrictiveCondition); + + String[] booleanExpression = timeOfDay.matchIfBefore(); + + this.matchIfBefore = booleanExpression[0]; + timerule = booleanExpression[1]; + log + .info("--------------------------------------------------------------------------------"); + log.info(timerule); + log + .info("--------------------------------------------------------------------------------"); + + return timerule; + } + + private String getMatchIfAfter() + { + String timerule = null; + + TimeOfDay timeOfDay = new TimeOfDay(); + Calendar restrictiveCondition = Calendar.getInstance(); + int hour = restrictiveCondition.get(Calendar.HOUR_OF_DAY); + restrictiveCondition.set(Calendar.HOUR_OF_DAY, (hour -1)); + timeOfDay.setTimeofDay(restrictiveCondition); + + String[] booleanExpression = timeOfDay.matchIfAfter(); + + this.matchIfAfter = booleanExpression[0]; + timerule = booleanExpression[1]; + log + .info("--------------------------------------------------------------------------------"); + log.info(timerule); + log + .info("--------------------------------------------------------------------------------"); + + return timerule; + } +} \ No newline at end of file Modified: authz/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java =================================================================== --- authz/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java 2009-09-28 19:04:19 UTC (rev 812) +++ authz/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java 2009-10-02 22:09:20 UTC (rev 813) @@ -22,6 +22,7 @@ ******************************************************************************/ package org.jboss.security.authz.policy.server.plugin; +import java.util.Date; import java.util.List; import java.util.ArrayList; import java.util.Iterator; @@ -189,6 +190,9 @@ } - workingMemory.insert(roles); + workingMemory.insert(roles); + + //FIXME: hack job + workingMemory.insert(new Date()); } }