Author: sohil.shah(a)jboss.com Date: 2009-09-10 15:17:22 -0400 (Thu, 10 Sep 2009) New Revision: 782 Added: authz/trunk/samples/ authz/trunk/samples/pom.xml authz/trunk/samples/secure-pojo/ authz/trunk/samples/secure-pojo/pom.xml authz/trunk/samples/secure-pojo/src/ authz/trunk/samples/secure-pojo/src/main/ authz/trunk/samples/secure-pojo/src/main/java/ authz/trunk/samples/secure-pojo/src/main/java/org/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/AuthenticatedSession.java authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/Pojo.java authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java authz/trunk/samples/secure-pojo/src/main/resources/ authz/trunk/samples/secure-pojo/src/main/resources/hibernate.cfg.xml authz/trunk/samples/secure-pojo/src/main/resources/jboss-aop.xml authz/trunk/samples/secure-pojo/src/test/ authz/trunk/samples/secure-pojo/src/test/java/ authz/trunk/samples/secure-pojo/src/test/java/org/ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java authz/trunk/samples/secure-pojo/src/test/resources/ authz/trunk/samples/secure-pojo/src/test/resources/log4j.properties Modified: authz/trunk/.classpath authz/trunk/documentation/reference-guide/en/master.xml authz/trunk/pom.xml Log: sample used to illustrate the development process in the reference doc Modified: authz/trunk/.classpath =================================================================== --- authz/trunk/.classpath 2009-09-10 18:42:17 UTC (rev 781) +++ authz/trunk/.classpath 2009-09-10 19:17:22 UTC (rev 782) @@ -26,6 +26,8 @@ <classpathentry kind="src" path="portal-profile/src/test/java"/> <classpathentry kind="src" path="portal-profile/src/test/resources"/> <classpathentry kind="src" path="documentation/reference-guide/en/modules"/> + <classpathentry kind="src" path="samples/secure-pojo/src/main/java"/> + <classpathentry kind="src" path="samples/secure-pojo/src/test/java"/> <classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/> <classpathentry kind="var" path="M2_REPO/asm/asm/1.5.3/asm-1.5.3.jar"/> <classpathentry kind="var" path="M2_REPO/cglib/cglib/2.1_3/cglib-2.1_3.jar"/> @@ -47,5 +49,6 @@ <classpathentry kind="var" path="M2_REPO/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar"/> <classpathentry kind="var" path="M2_REPO/com/thoughtworks/xstream/xstream/1.3.1/xstream-1.3.1.jar"/> <classpathentry kind="var" path="M2_REPO/org/hibernate/hibernate/3.1.2/hibernate-3.1.2.jar"/> + <classpathentry kind="var" path="M2_REPO/org/jboss/aop/jboss-aop/2.1.3.GA/jboss-aop-2.1.3.GA.jar"/> <classpathentry kind="output" path="bin"/> </classpath> Modified: authz/trunk/documentation/reference-guide/en/master.xml =================================================================== --- authz/trunk/documentation/reference-guide/en/master.xml 2009-09-10 18:42:17 UTC (rev 781) +++ authz/trunk/documentation/reference-guide/en/master.xml 2009-09-10 19:17:22 UTC (rev 782) @@ -18,7 +18,7 @@ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="modules/architecture.xml"/> <!-- - <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="modules/samples.xml"/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="modules/sample.xml"/> --> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="modules/framework.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="modules/authz-component-spec.xml"/> Modified: authz/trunk/pom.xml =================================================================== --- authz/trunk/pom.xml 2009-09-10 18:42:17 UTC (rev 781) +++ authz/trunk/pom.xml 2009-09-10 19:17:22 UTC (rev 782) @@ -16,6 +16,7 @@ <module>agent</module> <module>policy-server</module> <module>http-profile</module> + <module>samples</module> <!-- <module>portal-profile</module> --> Added: authz/trunk/samples/pom.xml =================================================================== --- authz/trunk/samples/pom.xml (rev 0) +++ authz/trunk/samples/pom.xml 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,36 @@ +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <parent> + <groupId>org.jboss.security.authz</groupId> + <artifactId>jboss-authz-parent</artifactId> + <version>trunk-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <modelVersion>4.0.0</modelVersion> + <groupId>org.jboss.security.authz</groupId> + <artifactId>samples</artifactId> + <packaging>pom</packaging> + <name>JBoss Authorization Sample Code</name> + <url>http://www.jboss.org</url> + + + <modules> + <module>secure-pojo</module> + </modules> + + <properties> + <version.org.jboss.aop>2.1.3.GA</version.org.jboss.aop> + </properties> + + <dependencyManagement> + <dependencies> + <!-- JBoss AOP Dependency --> + <dependency> + <groupId>org.jboss.aop</groupId> + <artifactId>jboss-aop</artifactId> + <version>${version.org.jboss.aop}</version> + </dependency> + </dependencies> + </dependencyManagement> +</project> Added: authz/trunk/samples/secure-pojo/pom.xml =================================================================== --- authz/trunk/samples/secure-pojo/pom.xml (rev 0) +++ authz/trunk/samples/secure-pojo/pom.xml 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,106 @@ +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <parent> + <groupId>org.jboss.security.authz</groupId> + <artifactId>samples</artifactId> + <version>trunk-SNAPSHOT</version> + <relativePath>../pom.xml</relativePath> + </parent> + + <modelVersion>4.0.0</modelVersion> + <artifactId>secure-pojo</artifactId> + <packaging>jar</packaging> + <name>Samples demonstrating POJO security</name> + <url>http://www.jboss.org</url> + + <dependencies> + <dependency> + <groupId>org.jboss.aop</groupId> + <artifactId>jboss-aop</artifactId> + </dependency> + <dependency> + <groupId>org.jboss.security.authz</groupId> + <artifactId>common</artifactId> + <version>${project.version}</version> + </dependency> + <dependency> + <groupId>org.jboss.security.authz</groupId> + <artifactId>core-components</artifactId> + <version>${project.version}</version> + </dependency> + <dependency> + <groupId>org.jboss.security.authz</groupId> + <artifactId>agent</artifactId> + <version>${project.version}</version> + </dependency> + <dependency> + <groupId>org.jboss.security.authz</groupId> + <artifactId>policy-server</artifactId> + <version>${project.version}</version> + </dependency> + + <!-- test dependencies --> + <!-- jboss xacml --> + <dependency> + <groupId>org.jboss.security</groupId> + <artifactId>jboss-xacml</artifactId> + <scope>test</scope> + </dependency> + <!-- jboss microcontainer --> + <dependency> + <groupId>org.jboss.microcontainer</groupId> + <artifactId>jboss-kernel</artifactId> + <scope>test</scope> + </dependency> + <!-- Drools --> + <dependency> + <groupId>org.drools</groupId> + <artifactId>drools-core</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.drools</groupId> + <artifactId>drools-compiler</artifactId> + <scope>test</scope> + </dependency> + </dependencies> + + <build> + <plugins> + <!-- compile-time weaving of the module --> + <plugin> + <groupId>org.jboss.maven.plugins</groupId> + <artifactId>maven-jbossaop-plugin</artifactId> + <version>${version.org.jboss.aop}</version> + <executions> + <execution> + <id>compile</id> + <configuration> + <!-- if you want to include dependencies from the current module + (only needed if a class inherits a class thats not defined in this module + --> + <includeProjectDependency>false</includeProjectDependency> + <aoppaths> + <aoppath>src/main/resources/jboss-aop.xml</aoppath> + </aoppaths> + </configuration> + <goals> + <goal>compile</goal> + </goals> + </execution> + </executions> + </plugin> + + <!-- running the tests in AOP environment --> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-surefire-plugin</artifactId> + <version>2.3.1</version> + <configuration> + <forkMode>always</forkMode> + <useSystemClassLoader>true</useSystemClassLoader> + <argLine>-Djboss.aop.path=src/main/resources/jboss-aop.xml</argLine> + </configuration> + </plugin> + </plugins> + </build> +</project> Added: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/AuthenticatedSession.java =================================================================== --- authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/AuthenticatedSession.java (rev 0) +++ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/AuthenticatedSession.java 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,79 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.samples.pojo; + +import java.util.List; +import java.util.ArrayList; + +/** + * Just a mock AuthenticatedSession that carries security related information about the logged in user... + * + * Just using simple information to illustrate the usage of the framework + * + * This can carry other arbitrary information as well upon which security decisions can be based. + * + * But for now, just using username and roles + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class AuthenticatedSession +{ + public static ThreadLocal activeSession; + + static + { + activeSession = new ThreadLocal(); + } + + private String username; + private List<String> roles; + + public AuthenticatedSession() + { + this.roles = new ArrayList<String>(); + } + + public String getUsername() + { + return username; + } + + public void setUsername(String username) + { + this.username = username; + } + + public List<String> getRoles() + { + return roles; + } + + public void setRoles(List<String> roles) + { + this.roles = roles; + } + + public void addRole(String role) + { + this.roles.add(role); + } +} Added: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/Pojo.java =================================================================== --- authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/Pojo.java (rev 0) +++ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/Pojo.java 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,49 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.samples.pojo; + +/** + * This is the core application level component. + * + * Notice there is absolutely no security code here....It does not even know the security service exists + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class Pojo +{ + private String sensitiveData; + + public Pojo() + { + + } + + public String getSensitiveData() + { + return this.sensitiveData; + } + + public void setSensitiveData(String sensitiveData) + { + this.sensitiveData = sensitiveData; + } +} Added: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java =================================================================== --- authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java (rev 0) +++ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/enforcement/SecurityInterceptor.java 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,144 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.samples.pojo.enforcement; + +import java.lang.reflect.Method; +import java.net.URI; + +import org.apache.log4j.Logger; + +import org.jboss.aop.advice.Interceptor; +import org.jboss.aop.joinpoint.Invocation; +import org.jboss.aop.joinpoint.MethodInvocation; + +import org.jboss.security.authz.bootstrap.ServiceContainer; +import org.jboss.security.authz.components.subject.Identity; +import org.jboss.security.authz.components.subject.Roles; +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.action.Read; +import org.jboss.security.authz.components.action.Write; + +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; +import org.jboss.security.authz.agent.enforcement.EnforcementResponse; + +import org.jboss.security.authz.samples.pojo.AuthenticatedSession; + +/** + * A sample Enforcement Interceptor used to inject the security service into the application + * + * The scope of interception can be increased/decreased depending upon the application's security requirements + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class SecurityInterceptor implements Interceptor +{ + private static Logger log = Logger.getLogger(SecurityInterceptor.class); + + private PolicyEnforcementPoint enforcer; + + public String getName() + { + return this.getClass().getName(); + } + + private PolicyEnforcementPoint getEnforcer() + { + if(this.enforcer == null) + { + this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); + } + return this.enforcer; + } + //------------------------------------------------------------------------------------------------------------------------------------------------------------------------ + public Object invoke(Invocation invocation) throws Throwable + { + try + { + MethodInvocation methodInvocation = (MethodInvocation)invocation; + + Object pojoBeingAccessed = methodInvocation.getTargetObject(); + Method methodBeingCalled = methodInvocation.getMethod(); + + //Get the runtime application state (AuthenticatedSession) from ThreadLocal + AuthenticatedSession session = (AuthenticatedSession)AuthenticatedSession.activeSession.get(); + if(session == null) + { + //Anonymous access + session = new AuthenticatedSession(); + session.setUsername("anonymous"); + session.addRole("anonymous"); + } + + //Properly propagate runtime application state to the state of appropriate "Authz Components"-------------------------------------------------------------------- + //Subject Components + Identity identity = new Identity(); + identity.setName(session.getUsername()); + + Roles roles = new Roles(); + if(session.getRoles() != null) + { + for(String roleName: session.getRoles()) + roles.addName(roleName); + } + + //Resource Component + URIResource resource = new URIResource(); + resource.setUri(new URI(pojoBeingAccessed.getClass().getName())); + + //Action Component + Object action = null; + if(methodBeingCalled.getName().startsWith("get")) + { + action = new Read(); + } + else if(methodBeingCalled.getName().startsWith("set")) + { + action = new Write(); + } + + //Create an EnforcementContext and start the "Enforcement Phase" with the security framework---------------------------------------------------------------------- + EnforcementContext context = new EnforcementContext(); + context.setAttribute("pojo", resource); + context.setAttribute("method", action); + context.setAttribute("identity", identity); + context.setAttribute("roles", roles); + + //Process the result from Enforcement Phase execution------------------------------------------------------------------------------------------------------------- + EnforcementResponse response = this.getEnforcer().checkAccess(context); + + if(response.isAccessGranted()) + { + //Access to the Pojo is granted.....Proceed.. + return invocation.invokeNext(); + } + else + { + //Throw appropriate exception or handle it according to what the requirements are......... + throw new IllegalAccessException("Pojo Access Denied!!!"); + } + } + finally + { + } + } +} \ No newline at end of file Added: authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java =================================================================== --- authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java (rev 0) +++ authz/trunk/samples/secure-pojo/src/main/java/org/jboss/security/authz/samples/pojo/provisioning/SecurityProvisioning.java 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,96 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.security.authz.samples.pojo.provisioning; + +import java.net.URI; + +import org.jboss.security.authz.bootstrap.ServiceContainer; + +import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; +import org.jboss.security.authz.agent.services.CompositionContext; + +import org.jboss.security.authz.model.Effect; +import org.jboss.security.authz.components.action.Read; +import org.jboss.security.authz.components.action.Write; +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.subject.Roles; + +import org.jboss.security.authz.samples.pojo.Pojo; + +/** + * The Provisioning component that is in charge of managing the security policies of the application + * + * This is usually accessed via a GUI tool or the application's security dashboard etc + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class SecurityProvisioning +{ + private PolicyProvisioner provisioner; + + public void bootup() + { + try + { + // Provision Admin Policy + this.provisionAdminPolicy(); + } + catch(Exception e) + { + throw new RuntimeException(e); + } + } + // ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- + private void provisionAdminPolicy() throws Exception + { + // SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI(Pojo.class.getName())); + + Read read = new Read(); + Roles readRoles = new Roles(); + readRoles.addName("admin"); + + Write write = new Write(); + Roles writeRoles = new Roles(); + writeRoles.addName("admin"); + + // Setup the Context for the Composition with these components + CompositionContext context = new CompositionContext(); + context.setPolicyTarget(resource); + context.addPolicyRule(Effect.PERMIT, read, readRoles,"allowExpression"); + context.addPolicyRule(Effect.PERMIT, write, writeRoles,"allowExpression"); + + // Store the policy into the Policy Server + this.getProvisioner().deploy(context); + } + + private PolicyProvisioner getProvisioner() + { + if (this.provisioner == null) + { + this.provisioner = (PolicyProvisioner) ServiceContainer + .lookup("/agent/LocalPolicyProvisioner"); + } + return this.provisioner; + } +} Added: authz/trunk/samples/secure-pojo/src/main/resources/hibernate.cfg.xml =================================================================== --- authz/trunk/samples/secure-pojo/src/main/resources/hibernate.cfg.xml (rev 0) +++ authz/trunk/samples/secure-pojo/src/main/resources/hibernate.cfg.xml 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,59 @@ +<?xml version='1.0' encoding='utf-8'?> +<!--~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ~ JBoss, a division of Red Hat ~ + ~ Copyright 2006, Red Hat Middleware, LLC, and individual ~ + ~ contributors as indicated by the @authors tag. See the ~ + ~ copyright.txt in the distribution for a full listing of ~ + ~ individual contributors. ~ + ~ ~ + ~ This is free software; you can redistribute it and/or modify it ~ + ~ under the terms of the GNU Lesser General Public License as ~ + ~ published by the Free Software Foundation; either version 2.1 of ~ + ~ the License, or (at your option) any later version. ~ + ~ ~ + ~ This software is distributed in the hope that it will be useful, ~ + ~ but WITHOUT ANY WARRANTY; without even the implied warranty of ~ + ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ~ + ~ Lesser General Public License for more details. ~ + ~ ~ + ~ You should have received a copy of the GNU Lesser General Public ~ + ~ License along with this software; if not, write to the Free ~ + ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA ~ + ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org. ~ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--> + +<!DOCTYPE hibernate-configuration PUBLIC + "-//Hibernate/Hibernate Configuration DTD//EN" + "http://hibernate.sourceforge.net/hibernate-configuration-3.0.dtd"> + +<hibernate-configuration> + <session-factory> + <!-- Database connection settings --> + <property name="connection.driver_class">org.hsqldb.jdbcDriver</property> + <property name="connection.url">jdbc:hsqldb:file:target/testdb</property> + <property name="connection.username">sa</property> + <property name="connection.password"></property> + + <!-- JDBC connection pool (use the built-in) --> + <property name="connection.pool_size">1</property> + + <!-- SQL dialect --> + <property name="dialect">org.hibernate.dialect.HSQLDialect</property> + + <!-- Enable Hibernate's automatic session context management --> + <property name="current_session_context_class">thread</property> + + <!-- Disable the second-level cache --> + <property name="cache.provider_class">org.hibernate.cache.NoCacheProvider</property> + + <!-- Echo all executed SQL to stdout --> + <property name="show_sql">true</property> + + <!-- + Drop and re-create the database schema on startup + --> + <property name="hbm2ddl.auto">create</property> + + <mapping resource="policy.hbm.xml"/> + </session-factory> +</hibernate-configuration> \ No newline at end of file Added: authz/trunk/samples/secure-pojo/src/main/resources/jboss-aop.xml =================================================================== --- authz/trunk/samples/secure-pojo/src/main/resources/jboss-aop.xml (rev 0) +++ authz/trunk/samples/secure-pojo/src/main/resources/jboss-aop.xml 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,5 @@ +<aop> + <bind pointcut="execution(* org.jboss.security.authz.samples.pojo.Pojo->*(..))"> + <interceptor class="org.jboss.security.authz.samples.pojo.enforcement.SecurityInterceptor"/> + </bind> +</aop> Added: authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java =================================================================== --- authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java (rev 0) +++ authz/trunk/samples/secure-pojo/src/test/java/org/jboss/security/authz/samples/pojo/TestSecurePojo.java 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,127 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.samples.pojo; + +import org.apache.log4j.Logger; + +import junit.framework.TestCase; + +import org.jboss.security.authz.bootstrap.ServiceContainer; + +import org.jboss.security.authz.samples.pojo.provisioning.SecurityProvisioning; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestSecurePojo extends TestCase +{ + private static Logger log = Logger.getLogger(TestSecurePojo.class); + + private SecurityProvisioning provisioning; + + public void setUp() throws Exception + { + //Bootstrap the Security Service + ServiceContainer.bootstrap(); + + //Bootup the system with the appropriate Policies + provisioning = new SecurityProvisioning(); + provisioning.bootup(); + + //Start in Anonymous mode....each testcase will select its own authentication scenario + AuthenticatedSession.activeSession.set(null); + } + + public void testAsAdmin() throws Exception + { + boolean accessGranted = true; + try + { + this.loginAsAdmin(); + + Pojo pojo = new Pojo(); + + //Write Action on the Pojo + pojo.setSensitiveData("This is Top Secret Data!!! Protect Me!!"); + + //Read Action on the Pojo + log.info(pojo.getSensitiveData()); + } + catch(Exception iae) + { + if(iae instanceof IllegalAccessException) + { + accessGranted = false; + } + else + { + throw iae; + } + } + finally + { + assertTrue("Access Must be Granted!!", accessGranted); + } + } + + public void testAsAnonymous() throws Exception + { + boolean accessGranted = true; + try + { + //No need to login......just access straight up + Pojo pojo = new Pojo(); + + //Write Action on the Pojo + pojo.setSensitiveData("This is Top Secret Data!!! Protect Me!!"); + + //Read Action on the Pojo + log.info(pojo.getSensitiveData()); + } + catch(Exception iae) + { + if(iae instanceof IllegalAccessException) + { + accessGranted = false; + } + else + { + throw iae; + } + } + finally + { + assertFalse("Access Must Not be Granted!!", accessGranted); + } + } + //--------------------------------------------------------------------------------------------------------------------------------------------------------------------------- + private void loginAsAdmin() + { + AuthenticatedSession session = new AuthenticatedSession(); + + session.setUsername("admin"); + session.addRole("Admin"); + session.addRole("/system/admin/badassdude/blah/blah"); + + AuthenticatedSession.activeSession.set(session); + } +} Added: authz/trunk/samples/secure-pojo/src/test/resources/log4j.properties =================================================================== --- authz/trunk/samples/secure-pojo/src/test/resources/log4j.properties (rev 0) +++ authz/trunk/samples/secure-pojo/src/test/resources/log4j.properties 2009-09-10 19:17:22 UTC (rev 782) @@ -0,0 +1,8 @@ +# Set root category priority to INFO and its only appender to CONSOLE. +log4j.rootCategory=INFO, CONSOLE + +# CONSOLE is set to be a ConsoleAppender using a PatternLayout. +log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender +log4j.appender.CONSOLE.Threshold=INFO +log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout +log4j.appender.CONSOLE.layout.ConversionPattern=- %m%n