Author: sohil.shah(a)jboss.com Date: 2009-08-04 12:47:45 -0400 (Tue, 04 Aug 2009) New Revision: 13661 Added: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementCache.java modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java Modified: modules/authorization/trunk/.classpath modules/authorization/trunk/agent/pom.xml modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementResponse.java modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/LocalEnforcementPoint.java modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/PolicyEnforcementPoint.java modules/authorization/trunk/agent/src/main/resources/META-INF/authz-config.xml modules/authorization/trunk/pom.xml Log: Started Agent Side Caching Service implementation Modified: modules/authorization/trunk/.classpath =================================================================== --- modules/authorization/trunk/.classpath 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/.classpath 2009-08-04 16:47:45 UTC (rev 13661) @@ -44,5 +44,6 @@ <classpathentry kind="var" path="M2_REPO/org/jboss/jboss-common-core/2.2.9.GA/jboss-common-core-2.2.9.GA.jar"/> <classpathentry kind="var" path="M2_REPO/javax/servlet/servlet-api/2.4/servlet-api-2.4.jar"/> <classpathentry kind="var" path="M2_REPO/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar"/> + <classpathentry kind="var" path="M2_REPO/com/thoughtworks/xstream/xstream/1.3.1/xstream-1.3.1.jar"/> <classpathentry kind="output" path="bin"/> </classpath> Modified: modules/authorization/trunk/agent/pom.xml =================================================================== --- modules/authorization/trunk/agent/pom.xml 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/agent/pom.xml 2009-08-04 16:47:45 UTC (rev 13661) @@ -28,7 +28,14 @@ <groupId>org.jboss.security.authz</groupId> <artifactId>policy-server</artifactId> <version>${project.version}</version> - </dependency> + </dependency> + + <!-- cache service related dependencies --> + <dependency> + <groupId>com.thoughtworks.xstream</groupId> + <artifactId>xstream</artifactId> + </dependency> + <!-- jboss xacml --> <dependency> <groupId>org.jboss.security</groupId> Added: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementCache.java =================================================================== --- modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementCache.java (rev 0) +++ modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementCache.java 2009-08-04 16:47:45 UTC (rev 13661) @@ -0,0 +1,86 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.agent.enforcement; + +import org.apache.log4j.Logger; + +import java.util.Map; +import java.util.HashMap; +import java.util.Date; + +import com.thoughtworks.xstream.XStream; +import com.thoughtworks.xstream.io.xml.DomDriver; + +/** + * TODO: implement this using JBoss Cache (for cluster wide invalidation events) once the functionality is properly implemented. + * This needs to be a cluster aware cache. But this fact should stay an implementation detail + * + * This is not really an in-request transactional cache. It does need to be invalidated based on the state of the Policies in the Policy Store + * Hence, Policy Provisioning requests do affect the data integrity of this Cache. These invalidation events need to be propagated across a + * cluster of nodes in case of a clustered application + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class EnforcementCache implements PolicyEnforcementPoint +{ + private static Logger log = Logger.getLogger(EnforcementCache.class); + + private Map<Integer, EnforcementResponse> responseCache; + private XStream xstream; + + public EnforcementCache() + { + + } + + public void start() + { + this.responseCache = new HashMap<Integer, EnforcementResponse>(); + this.xstream = new XStream(new DomDriver()); + } + + public void stop() + { + + } + //--------------PolicyEnforcementPoint implementation------------------------------------------------------------------------------------------------------------------------------ + public EnforcementResponse checkAccess(EnforcementContext enforcementContext) + throws EnforcementException + { + return this.responseCache.get(this.getCacheEntryKey(enforcementContext)); + } + //--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- + public void cache(EnforcementContext enforcementContext, EnforcementResponse enforcementResponse) + { + this.responseCache.put(this.getCacheEntryKey(enforcementContext), enforcementResponse); + enforcementResponse.setAttribute(EnforcementResponse.CACHED, new Date()); + } + + //TODO: Add Cache Invalidation Operations + //--------------------------------------------------------------------------------------------------------------------------------------------- + private Integer getCacheEntryKey(EnforcementContext enforcementContext) + { + String xml = xstream.toXML(enforcementContext); + int xmlHashCode = xml.trim().hashCode(); + return xmlHashCode; + } +} Modified: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementResponse.java =================================================================== --- modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementResponse.java 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/EnforcementResponse.java 2009-08-04 16:47:45 UTC (rev 13661) @@ -22,6 +22,9 @@ package org.jboss.security.authz.agent.enforcement; import java.io.Serializable; +import java.util.HashMap; +import java.util.Map; +import java.util.Set; /** * An Authorization Response @@ -30,12 +33,16 @@ */ public class EnforcementResponse implements Serializable { + static final String CACHED = "cached"; + static final String EVALUATED = "evaluated"; + private boolean accessGranted; private String message; + private Map<String, Object> attributes; public EnforcementResponse() { - + this.attributes = new HashMap<String, Object>(); } public boolean isAccessGranted() @@ -93,4 +100,44 @@ return isDenied; } + + public boolean isCached() + { + return this.getAttribute(CACHED)!=null; + } + + public boolean isEvaluated() + { + return (Boolean)this.getAttribute(EVALUATED); + } + + public Object getAttribute(String name) + { + return this.attributes.get(name); + } + + public void setAttribute(String name, Object attribute) + { + this.attributes.put(name, attribute); + } + + public Set<String> getNames() + { + return this.attributes.keySet(); + } + + public Object[] getValues() + { + return this.attributes.values().toArray(); + } + + public void clear(String name) + { + this.attributes.remove(name); + } + + public void clearAll() + { + this.attributes.clear(); + } } Modified: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/LocalEnforcementPoint.java =================================================================== --- modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/LocalEnforcementPoint.java 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/LocalEnforcementPoint.java 2009-08-04 16:47:45 UTC (rev 13661) @@ -48,6 +48,7 @@ private PolicyServer policyServer; private EnforcementStateGenerator stateGenerator; + private EnforcementCache enforcementCache; public LocalEnforcementPoint() { @@ -73,6 +74,17 @@ { this.stateGenerator = stateGenerator; } + + + public EnforcementCache getEnforcementCache() + { + return enforcementCache; + } + + public void setEnforcementCache(EnforcementCache enforcementCache) + { + this.enforcementCache = enforcementCache; + } //------------------------------------------------------------------------------------------------------------------------------------------------------------------------ public EnforcementResponse checkAccess(EnforcementContext enforcementContext) throws EnforcementException { @@ -80,22 +92,42 @@ { throw new IllegalArgumentException("Enforcement Context is Null"); } + EnforcementResponse enforcementResponse = null; try { + enforcementResponse = this.enforcementCache.checkAccess(enforcementContext); - Response response = this.policyServer.evaluate(this.generateEnforcementRequest(enforcementContext)); + if(enforcementResponse == null) + { + Response response = this.policyServer.evaluate(this.generateEnforcementRequest(enforcementContext)); + + enforcementResponse = new EnforcementResponse(); + enforcementResponse.setAccessGranted(response.isAccessGranted()); + enforcementResponse.setMessage(response.getMessage()); + enforcementResponse.setAttribute(EnforcementResponse.EVALUATED, Boolean.TRUE); + + //Cache this response into the Agent Side Enforcement Cache + //Perform this outside the application request context to improve performance + //The application request lifecycle has no interest in this system level service + //of the authorization layer, so it should not be bogged down by it + CacheUpdater cacheUpdater = this.new CacheUpdater(); + cacheUpdater.context = enforcementContext; + cacheUpdater.response = enforcementResponse; + Thread thread = new Thread(cacheUpdater); + thread.start(); + } + else + { + enforcementResponse.setAttribute(EnforcementResponse.EVALUATED, Boolean.FALSE); + } - EnforcementResponse enforcementResponse = new EnforcementResponse(); - enforcementResponse.setAccessGranted(response.isAccessGranted()); - enforcementResponse.setMessage(response.getMessage()); - return enforcementResponse; } catch(PolicyServerException pe) { log.error(this, pe); throw new EnforcementException(pe); - } + } } //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- private Request generateEnforcementRequest(EnforcementContext enforcementContext) @@ -160,4 +192,15 @@ return request; } + //--------------------------------------------------------------------------------------------------------------------------------------------- + private class CacheUpdater implements Runnable + { + private EnforcementContext context; + private EnforcementResponse response; + + public void run() + { + LocalEnforcementPoint.this.enforcementCache.cache(context, response); + } + } } Modified: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/PolicyEnforcementPoint.java =================================================================== --- modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/PolicyEnforcementPoint.java 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/enforcement/PolicyEnforcementPoint.java 2009-08-04 16:47:45 UTC (rev 13661) @@ -21,8 +21,6 @@ */ package org.jboss.security.authz.agent.enforcement; -import org.jboss.security.authz.policy.client.enforcement.Response; - /** * This component typically integrates natively with the application layer to receive Authorization Requests * It then processes the native request and routes it to the Policy Decision Point component of the Policy Server to get a decision whether the Modified: modules/authorization/trunk/agent/src/main/resources/META-INF/authz-config.xml =================================================================== --- modules/authorization/trunk/agent/src/main/resources/META-INF/authz-config.xml 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/agent/src/main/resources/META-INF/authz-config.xml 2009-08-04 16:47:45 UTC (rev 13661) @@ -9,6 +9,9 @@ <bean name="/agent/EnforcementStateGenerator" class="org.jboss.security.authz.agent.services.EnforcementStateGenerator"> </bean> + <bean name="/agent/EnforcementCache" class="org.jboss.security.authz.agent.enforcement.EnforcementCache"> + </bean> + <bean name="/agent/LocalEnforcementPoint" class="org.jboss.security.authz.agent.enforcement.LocalEnforcementPoint"> <property name="policyServer"> <inject bean="/policy-server/PolicyServer"/> @@ -16,6 +19,10 @@ <property name="stateGenerator"> <inject bean="/agent/EnforcementStateGenerator"/> + </property> + + <property name="enforcementCache"> + <inject bean="/agent/EnforcementCache"/> </property> </bean> Added: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java (rev 0) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java 2009-08-04 16:47:45 UTC (rev 13661) @@ -0,0 +1,182 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.security.authz.agent.features; + +import java.net.URI; + +import junit.framework.TestCase; +import org.apache.log4j.Logger; + +import org.jboss.security.authz.bootstrap.ServiceContainer; + +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.subject.Identity; +import org.jboss.security.authz.components.subject.Roles; +import org.jboss.security.authz.components.action.Read; + +import org.jboss.security.authz.model.Effect; +import org.jboss.security.authz.model.Policy; +import org.jboss.security.authz.model.PolicyMetaData; + +import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.enforcement.EnforcementResponse; +import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; + +import org.jboss.security.authz.agent.services.CompositionContext; +import org.jboss.security.authz.agent.services.PolicyComposer; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestAgentCache extends TestCase +{ + private static Logger log = Logger.getLogger(TestAgentCache.class); + + private PolicyComposer policyComposer; + private PolicyEnforcementPoint enforcer; + private PolicyProvisioner provisioner; + + public void setUp() throws Exception + { + ServiceContainer.bootstrap(); + + this.policyComposer = (PolicyComposer) ServiceContainer + .lookup("/agent/PolicyComposer"); + this.enforcer = (PolicyEnforcementPoint) ServiceContainer + .lookup("/agent/LocalEnforcementPoint"); + this.provisioner = (PolicyProvisioner) ServiceContainer + .lookup("/agent/LocalPolicyProvisioner"); + } + + public void tearDown() throws Exception + { + } + + public void testMultipleInvocations() throws Exception + { + // SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1/level2/index.html")); + + Read action = new Read(); + + Roles allowedRoles = new Roles(); + allowedRoles.addName("user"); + + // Setup the Context for the Composition with these components + CompositionContext context = new CompositionContext(); + context.setPolicyTarget(resource); + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server + PolicyMetaData policyMetaData = this.policyComposer.compose(context); + this.provisioner.newPolicy(policyMetaData); + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + for(int i=0; i<5; i++) + { + EnforcementContext enforcementContext = this.createEnforcementContext(contextResource, action); + EnforcementResponse response = this.enforce(enforcementContext, true); + + //Assert response state for caching related meta data + assertTrue("Must be Cached!!", response.isCached()); + if(i == 0) + { + assertTrue("Must be Evaluated by the Policy Server", response.isEvaluated()); + + Thread.currentThread().sleep(10); //to make sure the background caching thread finished its job + } + else + { + assertFalse("Must Not Be Evaluated. Cache should be used instead!!", response.isEvaluated()); + } + } + } + + // ------------------------------------------------------------------------------------------------------------------------------------------------------ + private EnforcementResponse enforce(EnforcementContext enforcementContext, + boolean mustBePermitted) throws Exception + { + EnforcementResponse response = this.enforcer + .checkAccess(enforcementContext); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision=" + response.getMessage()); + + if (mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } + return response; + } + + private EnforcementContext createEnforcementContext( + URIResource protectedResource, Read action) throws Exception + { + // Create an EnforcementContext + EnforcementContext context = new EnforcementContext(); + + // Enable Hierarchial Enforcement + context.activateHierarchialEnforcement(); + + // Create Resource + context.setAttribute("uri-resource", protectedResource); + + // Create Subjects + Roles roles = new Roles(); + roles.addName("user"); + context.setAttribute("roles", roles); + Identity identity = new Identity(); + identity.setName(&quot;blah(a)blah.com&quot;); + context.setAttribute("identity", identity); + + // Create Action + context.setAttribute("action", action); + + return context; + } + + private void assertServerState() throws Exception + { + // Assert Policy State of the Server + Policy[] policies = this.provisioner.readAllPolicies(); + + assertTrue("Policy Store must not be empty!!", + (policies != null && policies.length == 1)); + log + .info("------------------------------------------------------------------------------"); + log.info(policies[0].generateSystemPolicy()); + } +} Modified: modules/authorization/trunk/pom.xml =================================================================== --- modules/authorization/trunk/pom.xml 2009-08-04 15:15:06 UTC (rev 13660) +++ modules/authorization/trunk/pom.xml 2009-08-04 16:47:45 UTC (rev 13661) @@ -20,21 +20,7 @@ --> </modules> - <properties> - <!-- - Not needed for nows - <version.jboss.seam>2.0.2.SP1</version.jboss.seam> - <version.facelets>1.1.14</version.facelets> - <version.ajax4jsf>1.1.1</version.ajax4jsf> - <version.richfaces>3.0.1</version.richfaces> - <version.hibernate>3.0.0.GA</version.hibernate> - <version.javax.persistence>1.0</version.javax.persistence> - <version.javax.ejb>3.0</version.javax.ejb> - <version.javax.faces>1.2_04-p02</version.javax.faces> - <version.commons-beanutils>1.6</version.commons-beanutils> - <version.commons-digester>1.6</version.commons-digester> - --> - + <properties> <version.junit>3.8.2</version.junit> <version.apache.log4j>1.2.14</version.apache.log4j> @@ -46,6 +32,9 @@ <version.org.mvel.mvel>1.3.1-java1.4</version.org.mvel.mvel> <version.org.antlr>3.0</version.org.antlr> + <!-- xstream dependency used by the agent side caching service --> + <version.com.thoughtworks.xstream>1.3.1</version.com.thoughtworks.xstream> + <version.org.jboss.microcontainer>2.0.2.GA</version.org.jboss.microcontainer> <version.org.jboss.jboss-reflect>2.0.2.GA</version.org.jboss.jboss-reflect> <version.org.jboss.jboss-common-core>2.2.9.GA</version.org.jboss.jboss-common-core> @@ -56,86 +45,7 @@ </properties> <dependencyManagement> - <dependencies> - <!-- seam dependencies --> - <!-- - <dependency> - <groupId>org.jboss.seam</groupId> - <artifactId>jboss-seam</artifactId> - <version>${version.jboss.seam}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>org.jboss.seam</groupId> - <artifactId>jboss-seam-ui</artifactId> - <version>${version.jboss.seam}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>com.sun.facelets</groupId> - <artifactId>jsf-facelets</artifactId> - <version>${version.facelets}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>commons-beanutils</groupId> - <artifactId>commons-beanutils</artifactId> - <version>${version.commons-beanutils}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>commons-digester</groupId> - <artifactId>commons-digester</artifactId> - <version>${version.commons-digester}</version> - <scope>provided</scope> - </dependency> - --> - - <!-- richfaces dependencies --> - <!-- - <dependency> - <groupId>org.ajax4jsf</groupId> - <artifactId>ajax4jsf</artifactId> - <version>${version.ajax4jsf}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>org.richfaces</groupId> - <artifactId>richfaces</artifactId> - <version>${version.richfaces}</version> - <scope>provided</scope> - </dependency> - --> - - - <!-- dependencies provided by the runtime --> - <!-- - <dependency> - <groupId>org.hibernate</groupId> - <artifactId>hibernate-validator</artifactId> - <version>${version.hibernate}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>javax.persistence</groupId> - <artifactId>persistence-api</artifactId> - <version>${version.javax.persistence}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>javax.ejb</groupId> - <artifactId>ejb-api</artifactId> - <version>${version.javax.ejb}</version> - <scope>provided</scope> - </dependency> - <dependency> - <groupId>javax.faces</groupId> - <artifactId>jsf-api</artifactId> - <version>${version.javax.faces}</version> - <scope>provided</scope> - </dependency> - --> - + <dependencies> <!-- sun jaxb --> <dependency> <groupId>sun-jaxb</groupId> @@ -229,8 +139,15 @@ <artifactId>antlr-runtime</artifactId> <version>${version.org.antlr}</version> <scope>provided</scope> - </dependency> + </dependency> + <!-- xstream dependeny --> + <dependency> + <groupId>com.thoughtworks.xstream</groupId> + <artifactId>xstream</artifactId> + <version>${version.com.thoughtworks.xstream}</version> + </dependency> + <!-- JBoss Microcontainer --> <dependency> <groupId>org.jboss.microcontainer</groupId>