[Clustering/JBoss] - Re: deploy-hasingleton broke?
by newmanw10
You say you can also, I am confused.
Does this mean I should still put my ear with me MDB in the deploy-hasingleton directory?
Also deploy-hasingleton is for the cluster! It will deploy once on the master when the master comes up. If the master goes down a node in the cluster will take over as the master and everything in deploy-hasingleton will now be deployed to this new master. Hence the services in deploy-hasingleton will only ever be deployed to one node.
I tried to use the @Depends annotation And it does not work I get a deploy exception. My bean will not deploy becuase it is waiting on HASingletonDeploer. Not sure why this is happening.
Has anyone used @Depends to solve the issue of trying to deploy a singleton MDB?
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4238237#4238237
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4238237
17 years, 1 month
[Security & JAAS/JBoss] - JBoss XACML: target based on attribute existence or absence
by ffaure32
Hi all,
I've got a question concerning XACML policies (I've made some tests on JBoss XACML with unattended results, that's why I post this message here).
I have not found any way to add a target (on a rule or a policy) that is activated on the presence of an attribute and another one activated on the missing of the attribute.
I've found some workarounds on my policy but I'm not really satisfied with them:
I want to activated one rule A if the attribute MY_ATTRIBUTE_TO_TESTis present and one exclusive rule B if the attribute MY_ATTRIBUTE_TO_TESTis missing
- to test the presence of the attribute, as I know it's value, I just put a SubjectMatch in the target corresponding to this rule
| <Target>
| <Subjects>
| <Subject>
| <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
| <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">true</AttributeValue>
| <SubjectAttributeDesignator AttributeId="MY_ATTRIBUTE_TO_TEST" MustBePresent="false" DataType="http://www.w3.org/2001/XMLSchema#string" />
| </SubjectMatch>
| </Subject>
| </Subjects>
| </Target>
It works well if the attribute is present but it seems that the "MustBePresent" flag is not used as I get an error message in the logs (perharps due to the other part of my policy, cf. later):
15:25:21,382 ERROR [STDERR] 17 juin 2009 15:25:21 org.jboss.security.xacml.sunxacml.finder.AttributeFinder findAttribute
INFO: Failed to resolve any values for MY_ATTRIBUTE_TO_TEST
I'm borrowed by this error message but I can deal with it.
- to test the absence of this attribute in another rule, I did not manage to handle it with a target:
The only solution I found is to define a boolean variable that is valuated from the following test:
| <VariableDefinition VariableId="TESTVARIABLE">
| <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
| <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-equal">
| <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag-size">
| <SubjectAttributeDesignator AttributeId="MY_ATTRIBUTE_TO_TEST" MustBePresent="false" DataType="http://www.w3.org/2001/XMLSchema#string" />
| </Apply>
| <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#integer">0</AttributeValue>
| </Apply>
| </Apply>
| </VariableDefinition>
|
If the MY_ATTRIVUTE_TO_TEST is missing, as the "MustBePresent" flag is to false, it is valuated to an empty bag and the string-bag-size is 0. Then, TESTVARIABLE is put to false.
Unfortunately, I can use it in a condition but not in a target! Then, I can't replace the first solution I had for the target if the attribute is present.
Then my policy is a little bit messy:
- one variable definition used in a condition to activate the rule if the attribute is missing
- one test on an attribute value in a target to activate the rule if the attribute is there
I'm sure I'm not clear but hope you'll get the point and will be able to help me...
To sum up:
- is there a simple way to test the presence of an attribute in XACML (or is it not in XACML principles)
- is there a simple way to implement an "else" condition or exclusive targets without writing the tests twice?
- is there a way to remove the error log messages if a missing attribute is possible
Thanks in advance,
Fred
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4238234#4238234
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4238234
17 years, 1 month