Author: sohil.shah(a)jboss.com Date: 2009-09-11 14:38:51 -0400 (Fri, 11 Sep 2009) New Revision: 784 Modified: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java Log: bug fix Modified: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java =================================================================== --- authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java 2009-09-10 20:00:09 UTC (rev 783) +++ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java 2009-09-11 18:38:51 UTC (rev 784) @@ -53,21 +53,15 @@ public class SecurityInterceptor implements Interceptor { private static Logger log = Logger.getLogger(SecurityInterceptor.class); - - private PolicyEnforcementPoint enforcer; - + public String getName() { return this.getClass().getName(); } private PolicyEnforcementPoint getEnforcer() - { - if(this.enforcer == null) - { - this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); - } - return this.enforcer; + { + return (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); } //------------------------------------------------------------------------------------------------------------------------------------------------------------------------ public Object invoke(Invocation invocation) throws Throwable @@ -118,6 +112,7 @@ //Create an EnforcementContext and start the "Enforcement Phase" with the security framework---------------------------------------------------------------------- EnforcementContext context = new EnforcementContext(); + context.setIgnoreCache(true); context.setAttribute("pojo", resource); context.setAttribute("method", action); context.setAttribute("identity", identity); Modified: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java =================================================================== --- authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java 2009-09-10 20:00:09 UTC (rev 783) +++ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java 2009-09-11 18:38:51 UTC (rev 784) @@ -22,13 +22,16 @@ package org.jboss.security.authz.samples.pojo.provisioning; import java.net.URI; +import java.util.Set; +import org.apache.log4j.Logger; import org.jboss.security.authz.bootstrap.ServiceContainer; import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.services.CompositionContext; import org.jboss.security.authz.model.Effect; +import org.jboss.security.authz.model.Policy; import org.jboss.security.authz.components.action.Read; import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.components.resource.URIResource; @@ -45,14 +48,21 @@ */ public class SecurityProvisioning { - private PolicyProvisioner provisioner; - + private static Logger log = Logger.getLogger(SecurityProvisioning.class); + public void bootup() { try { - // Provision Admin Policy - this.provisionAdminPolicy(); + // Provision POJO Policy + this.provisionPOJOPolicy(); + + Set<Policy> policies = this.getProvisioner().readAllPolicies(); + for(Policy policy: policies) + { + log.info("------------------------------------------------------------------------------"); + log.info(policy.generateSystemPolicy()); + } } catch(Exception e) { @@ -60,7 +70,7 @@ } } // ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- - private void provisionAdminPolicy() throws Exception + private void provisionPOJOPolicy() throws Exception { // SetUp Resource URIResource resource = new URIResource(); @@ -68,10 +78,13 @@ Read read = new Read(); Roles readRoles = new Roles(); - readRoles.addName("admin"); + readRoles.setMustMatchAll(false); + readRoles.addName("regular"); + readRoles.addName("/blah1/blah2/blah3"); Write write = new Write(); Roles writeRoles = new Roles(); + writeRoles.setMustMatchAll(false); writeRoles.addName("admin"); // Setup the Context for the Composition with these components @@ -82,15 +95,10 @@ // Store the policy into the Policy Server this.getProvisioner().deploy(context); - } + } private PolicyProvisioner getProvisioner() - { - if (this.provisioner == null) - { - this.provisioner = (PolicyProvisioner) ServiceContainer - .lookup("/agent/LocalPolicyProvisioner"); - } - return this.provisioner; + { + return (PolicyProvisioner) ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); } } Modified: authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java =================================================================== --- authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java 2009-09-10 20:00:09 UTC (rev 783) +++ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java 2009-09-11 18:38:51 UTC (rev 784) @@ -1,24 +1,24 @@ /* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.security.authz.samples.pojo; import org.apache.log4j.Logger; @@ -35,93 +35,197 @@ public class TestSecurePojo extends TestCase { private static Logger log = Logger.getLogger(TestSecurePojo.class); - + private SecurityProvisioning provisioning; - + public void setUp() throws Exception - { - //Bootstrap the Security Service + { + // Bootstrap the Security Service ServiceContainer.bootstrap(); - - //Bootup the system with the appropriate Policies + + // Bootup the system with the appropriate Policies provisioning = new SecurityProvisioning(); provisioning.bootup(); - - //Start in Anonymous mode....each testcase will select its own authentication scenario + + // Start in Anonymous mode....each testcase will select its own + // authentication scenario AuthenticatedSession.activeSession.set(null); } - - public void testAsAdmin() throws Exception + + public void tearDown() throws Exception { - boolean accessGranted = true; + ServiceContainer.shutdown(); + } + + public void testAsAnonymous() throws Exception + { + boolean readGranted = true; + boolean writeGranted = true; + + Pojo pojo = new Pojo(); + try { - this.loginAsAdmin(); - - Pojo pojo = new Pojo(); - - //Write Action on the Pojo + // Write Action on the Pojo pojo.setSensitiveData("This is Top Secret Data!!! Protect Me!!"); - - //Read Action on the Pojo - log.info(pojo.getSensitiveData()); + writeGranted = true; } - catch(Exception iae) + catch (Exception r) { - if(iae instanceof IllegalAccessException) + if (r instanceof IllegalAccessException) { - accessGranted = false; + writeGranted = false; } else { - throw iae; + log.error(this, r); + throw r; } } - finally + + try { - assertTrue("Access Must be Granted!!", accessGranted); + String sensitiveData = pojo.getSensitiveData(); + log.info(sensitiveData); + assertEquals("Data Must Match!!", sensitiveData, + "This is Top Secret Data!!! Protect Me!!"); + readGranted = true; } + catch (Exception r) + { + if (r instanceof IllegalAccessException) + { + readGranted = false; + } + else + { + throw r; + } + } + + assertFalse("Read Access Must *Not* be Granted!!", readGranted); + assertFalse("Write Access Must *Not* be Granted!!", writeGranted); } - - public void testAsAnonymous() throws Exception + + public void testAsUser() throws Exception { - boolean accessGranted = true; + boolean readGranted = false; + boolean writeGranted = true; + + this.loginAsUser(); + Pojo pojo = new Pojo(); + + // Read Action on the Pojo try { - //No need to login......just access straight up - Pojo pojo = new Pojo(); - - //Write Action on the Pojo + String sensitiveData = pojo.getSensitiveData(); + log.info(sensitiveData); + assertNull("Data Must be Null!!", sensitiveData); + readGranted = true; + } + catch (Exception r) + { + if (r instanceof IllegalAccessException) + { + readGranted = false; + } + else + { + throw r; + } + } + + // Write Action on the Pojo + try + { pojo.setSensitiveData("This is Top Secret Data!!! Protect Me!!"); - - //Read Action on the Pojo - log.info(pojo.getSensitiveData()); } - catch(Exception iae) + catch (Exception r) { - if(iae instanceof IllegalAccessException) + if (r instanceof IllegalAccessException) { - accessGranted = false; + writeGranted = false; } else { - throw iae; + throw r; } } - finally + + assertTrue("Read Access Must be Granted!!", readGranted); + assertFalse("Write Access Must *Not* be Granted!!", writeGranted); + } + + public void testAsAdmin() throws Exception + { + boolean readGranted = false; + boolean writeGranted = false; + + this.loginAsAdmin(); + Pojo pojo = new Pojo(); + + try { - assertFalse("Access Must Not be Granted!!", accessGranted); + // Write Action on the Pojo + pojo.setSensitiveData("This is Top Secret Data!!! Protect Me!!"); + writeGranted = true; } + catch (Exception r) + { + if (r instanceof IllegalAccessException) + { + writeGranted = false; + } + else + { + log.error(this, r); + throw r; + } + } + + try + { + String sensitiveData = pojo.getSensitiveData(); + log.info(sensitiveData); + assertEquals("Data Must Match!!", sensitiveData, + "This is Top Secret Data!!! Protect Me!!"); + readGranted = true; + } + catch (Exception r) + { + if (r instanceof IllegalAccessException) + { + readGranted = false; + } + else + { + throw r; + } + } + + assertTrue("Read Access Must be Granted!!", readGranted); + assertTrue("Write Access Must be Granted!!", writeGranted); } - //--------------------------------------------------------------------------------------------------------------------------------------------------------------------------- + + // --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- private void loginAsAdmin() { AuthenticatedSession session = new AuthenticatedSession(); - + session.setUsername("admin"); - session.addRole("Admin"); - session.addRole("/system/admin/badassdude/blah/blah"); - + session.addRole("admin"); + // session.addRole("/system/admin/badassdude/blah/blah"); + AuthenticatedSession.activeSession.set(session); } + + private void loginAsUser() + { + AuthenticatedSession session = new AuthenticatedSession(); + + session.setUsername("user"); + session.addRole("regular"); + + AuthenticatedSession.activeSession.set(session); + } }