Author: sohil.shah(a)jboss.com Date: 2009-02-04 11:46:53 -0500 (Wed, 04 Feb 2009) New Revision: 12772 Added: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestEnterprisePolicyFinderModule.java Modified: modules/authorization/trunk/common/pom.xml modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/DroolsRuleExpression.java modules/authorization/trunk/core-components/pom.xml modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java modules/authorization/trunk/policy-server/pom.xml modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsFunction.java modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java Log: Integrating Drools based Expressions to specify Policy Rules for the HttpResource core component Modified: modules/authorization/trunk/common/pom.xml =================================================================== --- modules/authorization/trunk/common/pom.xml 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/common/pom.xml 2009-02-04 16:46:53 UTC (rev 12772) @@ -18,7 +18,7 @@ <dependency> <groupId>org.jboss.security</groupId> <artifactId>jboss-xacml</artifactId> - </dependency> + </dependency> </dependencies> <build> Modified: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/DroolsRuleExpression.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/DroolsRuleExpression.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/DroolsRuleExpression.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -30,25 +30,20 @@ */ public class DroolsRuleExpression extends Expression { - private String functionId = null; - private String ruleReference = null; - private String when = null; + private String functionId; + private String ruleReference; + private String rule; public DroolsRuleExpression() { - + this.functionId = "urn:oasis:names:tc:xacml:2.0:function:jboss-drools:rule"; } public String getFunctionId() { - return functionId; + return this.functionId; } - public void setFunctionId(String functionId) - { - this.functionId = functionId; - } - public String getRuleReference() { return ruleReference; @@ -59,13 +54,13 @@ this.ruleReference = ruleReference; } - public String getWhen() + public String getRule() { - return this.when; + return this.rule; } - public void setWhen(String when) + public void setRule(String rule) { - this.when = when; + this.rule = rule; } } Modified: modules/authorization/trunk/core-components/pom.xml =================================================================== --- modules/authorization/trunk/core-components/pom.xml 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/core-components/pom.xml 2009-02-04 16:46:53 UTC (rev 12772) @@ -24,6 +24,16 @@ <dependency> <groupId>org.jboss.security</groupId> <artifactId>jboss-xacml</artifactId> + </dependency> + + <!-- Drools --> + <dependency> + <groupId>org.drools</groupId> + <artifactId>drools-core</artifactId> + </dependency> + <dependency> + <groupId>org.drools</groupId> + <artifactId>drools-compiler</artifactId> </dependency> </dependencies> @@ -34,7 +44,8 @@ <artifactId>maven-surefire-plugin</artifactId> <version>2.3.1</version> <configuration> - <includes> + <includes> + <include>**/TestHttpResourceRules.java</include> </includes> </configuration> </plugin> Modified: modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java =================================================================== --- modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -35,6 +35,7 @@ import org.jboss.security.authz.model.Attribute; import org.jboss.security.authz.model.Resource; import org.jboss.security.authz.model.PolicyMetaData; +import org.jboss.security.authz.model.DroolsRuleExpression; import org.jboss.security.authz.tools.GeneralTool; import org.jboss.security.xacml.interfaces.XACMLConstants; @@ -51,6 +52,34 @@ */ public class HttpResource { + //make it package-level access so that unit tests can test these rules + static final String allowedRolesRule = + "rule \"allowedRolesRule\"\n"+ + "when\n"+ + "$ruleName: String()\n"+ + "eval($ruleName.contains(\"httpResource://permittedRoles\"))\n"+ + "then\n"+ + "System.out.println(\"AllowedRolesRule successfully fired\");\n"+ + "end\n"; + + static final String deniedRolesRule = + "rule \"deniedRolesRule\"\n"+ + "when\n"+ + "$ruleName: String()\n"+ + "eval($ruleName.contains(\"httpResource://deniedRoles\"))\n"+ + "then\n"+ + "System.out.println(\"DeniedRolesRule successfully fired\");\n"+ + "end\n"; + + static final String allowedIpsRule = + "rule \"allowedIpsRule\"\n"+ + "when\n"+ + "$ruleName: String()\n"+ + "eval($ruleName.contains(\"httpResource://allowedIps\"))\n"+ + "then\n"+ + "System.out.println(\"AllowedIpsRule successfully fired\");\n"+ + "end\n"; + /** * The URL that identifies this resource */ @@ -173,7 +202,7 @@ * * @param matchAllParameters 'true' = include matching of all the parameters, 'false' = only url matching, parameters are excluded */ - public Target getURLTarget(boolean matchAllParameters) + private Target getURLTarget(boolean matchAllParameters) { if(this.url == null || this.url.trim().length()==0) { @@ -208,7 +237,7 @@ * * @return the rule */ - public Rule getPermittedRolesRule() + private Rule getPermittedRolesRule() { if(this.allowedRoles == null || this.allowedRoles.isEmpty()) { @@ -216,18 +245,19 @@ } Rule permitRule = new Rule(); - Target ruleTarget = new Target(); - permitRule.setRuleId(GeneralTool.generateUniqueId()); + permitRule.setRuleId("httpResource://permittedRoles/"+GeneralTool.generateUniqueId()); permitRule.setEffect(Effect.PERMIT); - permitRule.setTarget(ruleTarget); - //Create a Subject Match Function + //Generate a Drools Rule for(String role: this.allowedRoles) { - ruleTarget.addSubjectMatch(ExpressionBuilder.getInstance().createBelongsToRoleExpression(role)); } + DroolsRuleExpression expression = new DroolsRuleExpression(); + expression.setRuleReference(GeneralTool.generateUniqueId()); + permitRule.setExpression(expression); + return permitRule; } @@ -236,7 +266,7 @@ * * @return the role */ - public Rule getDeniedRolesRule() + private Rule getDeniedRolesRule() { if(this.deniedRoles == null || this.deniedRoles.isEmpty()) { @@ -244,22 +274,22 @@ } Rule denyRule = new Rule(); - Target ruleTarget = new Target(); - denyRule.setRuleId(GeneralTool.generateUniqueId()); + denyRule.setRuleId("httpResource://deniedRoles/"+GeneralTool.generateUniqueId()); denyRule.setEffect(Effect.DENY); - denyRule.setTarget(ruleTarget); - //Create a Subject Match Function + //Generate a Drools Rule for(String role: this.deniedRoles) - { - ruleTarget.addSubjectMatch(ExpressionBuilder.getInstance().createBelongsToRoleExpression(role)); + { } + DroolsRuleExpression expression = new DroolsRuleExpression(); + expression.setRuleReference(GeneralTool.generateUniqueId()); + denyRule.setExpression(expression); return denyRule; } - public Rule getAllowedIpsRule() + private Rule getAllowedIpsRule() { if(this.allowedIps == null || this.allowedIps.isEmpty()) { @@ -267,22 +297,23 @@ } Rule rule = new Rule(); - Target ruleTarget = new Target(); - rule.setRuleId(GeneralTool.generateUniqueId()); + rule.setRuleId("httpResource://allowedIps/"+GeneralTool.generateUniqueId()); rule.setEffect(Effect.PERMIT); - rule.setTarget(ruleTarget); for(String allowedIp: this.allowedIps) { - AttributeExpression expression = new AttributeExpression(); + /*AttributeExpression expression = new AttributeExpression(); expression.setFunctionId(XACMLConstants.FUNCTION_REGEXP_IPADDRESS_MATCH); Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS, XMLSchemaConstants.DATATYPE_IPADDRESS, allowedIp); expression.setAttribute(attribute); - rule.setExpression(expression); + rule.setExpression(expression);*/ } + DroolsRuleExpression expression = new DroolsRuleExpression(); + expression.setRuleReference(GeneralTool.generateUniqueId()); + rule.setExpression(expression); return rule; } Modified: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java =================================================================== --- modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -46,9 +46,7 @@ { HttpResource httpResource = new HttpResource(); httpResource.setUrl("/portal/admin-tool/modifyLayout"); - - Target target = httpResource.getURLTarget(false); - + Policy policy = new MockPolicy("testGetURLTargetNoParameters", httpResource.getPolicyMetaData(false)); log.info("------------------------------------------------------------------"); @@ -62,7 +60,6 @@ httpResource.addParameter("test1", "test1://value"); httpResource.addParameter("test2", "test2://value"); - Target target = httpResource.getURLTarget(true); Policy policy = new MockPolicy("testGetURLTargetWithParameters", httpResource.getPolicyMetaData(true)); @@ -78,12 +75,7 @@ httpResource.addParameter("test2", "test2://value"); httpResource.addAllowedRole("admin"); httpResource.addDeniedRole("anonymous"); - - Target target = httpResource.getURLTarget(true); - Set<Rule> rules = new HashSet<Rule>(); - rules.add(httpResource.getPermittedRolesRule()); - rules.add(httpResource.getDeniedRolesRule()); - + Policy policy = new MockPolicy("testRoleRules", httpResource.getPolicyMetaData(true)); log.info("------------------------------------------------------------------"); @@ -99,16 +91,10 @@ httpResource.addAllowedRole("admin"); httpResource.addDeniedRole("anonymous"); httpResource.addAllowedIp("192.168.x.x"); - - Target target = httpResource.getURLTarget(true); - Set<Rule> rules = new HashSet<Rule>(); - rules.add(httpResource.getPermittedRolesRule()); - rules.add(httpResource.getDeniedRolesRule()); - rules.add(httpResource.getAllowedIpsRule()); - + Policy policy = new MockPolicy("testIPRules", httpResource.getPolicyMetaData(true)); log.info("------------------------------------------------------------------"); log.info(policy.generateXACMLPolicy()); - } + } } Added: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java =================================================================== --- modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java (rev 0) +++ modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -0,0 +1,116 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.components.http; + +import java.io.ByteArrayInputStream; +import java.io.InputStreamReader; +import java.io.Reader; + +import junit.framework.TestCase; + +import org.apache.log4j.Logger; + + +import org.drools.RuleBase; +import org.drools.RuleBaseFactory; +import org.drools.StatefulSession; +import org.drools.WorkingMemory; +import org.drools.compiler.PackageBuilder; +import org.jboss.security.authz.tools.GeneralTool; + + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestHttpResourceRules extends TestCase +{ + private static Logger log = Logger.getLogger(TestHttpResourceRules.class); + private static String rulePkg = + "package security\n"+ + "import org.jboss.security.authz.model.*;\n"+ + "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; + + private RuleBase activeRuleBase; + + public void setUp() throws Exception + { + StringBuilder buffer = new StringBuilder(); + + buffer.append(rulePkg+"\n"); + buffer.append(HttpResource.allowedRolesRule+"\n"); + buffer.append(HttpResource.deniedRolesRule+"\n"); + buffer.append(HttpResource.allowedIpsRule+"\n"); + + Reader source = new InputStreamReader(new ByteArrayInputStream(buffer.toString().getBytes())); + try + { + PackageBuilder packageBuilder = new PackageBuilder(); + packageBuilder.addPackageFromDrl(source); + + if(this.activeRuleBase == null) + { + this.activeRuleBase = RuleBaseFactory.newRuleBase(); + } + + //Perform the reloading of the RuleBase with the updated Rules + this.activeRuleBase.lock(); + this.activeRuleBase.addPackage(packageBuilder.getPackage()); + this.activeRuleBase.unlock(); + } + finally + { + source.close(); + } + } + + public void tearDown() throws Exception + { + this.activeRuleBase = null; + } + + public void testAllowedRolesRule() throws Exception + { + log.info("Executing----------testAllowedRolesRule"); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + workingMemory.insert("httpResource://permittedRoles/"+GeneralTool.generateUniqueId()); + workingMemory.fireAllRules(); + ((StatefulSession)workingMemory).dispose(); + } + + public void testDeniedRolesRule() throws Exception + { + log.info("Executing----------testDeniedRolesRule"); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + workingMemory.insert("httpResource://deniedRoles/"+GeneralTool.generateUniqueId()); + workingMemory.fireAllRules(); + ((StatefulSession)workingMemory).dispose(); + } + + public void testAllowedIpsRule() throws Exception + { + log.info("Executing----------testAllowedIpsRule"); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + workingMemory.insert("httpResource://allowedIps/"+GeneralTool.generateUniqueId()); + workingMemory.fireAllRules(); + ((StatefulSession)workingMemory).dispose(); + } +} Modified: modules/authorization/trunk/policy-server/pom.xml =================================================================== --- modules/authorization/trunk/policy-server/pom.xml 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/pom.xml 2009-02-04 16:46:53 UTC (rev 12772) @@ -65,8 +65,8 @@ <artifactId>maven-surefire-plugin</artifactId> <version>2.3.1</version> <configuration> - <includes> - <include>**/TestPolicyServer.java</include> + <includes> + <include>**/TestEnterprisePolicyFinderModule.java</include> </includes> </configuration> </plugin> Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -121,4 +121,9 @@ throw new PolicyServerException(e); } } + + public PDP getPDP() throws PolicyServerException + { + return this.policyDecisionPoint; + } } Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsFunction.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -43,7 +43,7 @@ */ public class DroolsFunction extends FunctionBase { - public static final String NAME = FUNCTION_NS + "drools:rule"; + public static final String NAME = "urn:oasis:names:tc:xacml:2.0:function:jboss-drools:rule"; /** * Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -88,13 +88,13 @@ { throw new IllegalArgumentException("Rule Reference is missing"); } - if(rule.getWhen() == null || rule.getWhen().trim().length() == 0) + if(rule.getRule() == null || rule.getRule().trim().length() == 0) { throw new IllegalArgumentException("LHS value is missing"); } - this.drls.put(rule.getRuleReference(), rule.getWhen()); + this.drls.put(rule.getRuleReference(), rule.getRule()); this.reloadActiveRuleBase(); } catch(Exception e) @@ -118,7 +118,7 @@ rule = new DroolsRuleExpression(); rule.setRuleReference(ruleReference); - rule.setWhen(when); + rule.setRule(when); return rule; } @@ -136,12 +136,12 @@ { throw new IllegalArgumentException("Rule Reference is missing"); } - if(rule.getWhen() == null || rule.getWhen().trim().length() == 0) + if(rule.getRule() == null || rule.getRule().trim().length() == 0) { throw new IllegalArgumentException("LHS value is missing"); } - this.drls.put(rule.getRuleReference(), rule.getWhen()); + this.drls.put(rule.getRuleReference(), rule.getRule()); this.reloadActiveRuleBase(); } catch(Exception e) Modified: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsFunction.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsFunction.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsFunction.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -204,8 +204,7 @@ writeRule.setTarget(ruleTarget); - DroolsRuleExpression ruleExpression = new DroolsRuleExpression(); - ruleExpression.setFunctionId(DroolsFunction.NAME); + DroolsRuleExpression ruleExpression = new DroolsRuleExpression(); ruleExpression.setRuleReference("WriteRuleReference"); writeRule.setExpression(ruleExpression); Modified: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -82,7 +82,7 @@ { DroolsRuleExpression expression = new DroolsRuleExpression(); expression.setRuleReference("Rule2"); - expression.setWhen(TestDroolsRuleManager.rule2); + expression.setRule(TestDroolsRuleManager.rule2); this.ruleManager.addRule(expression); WorkingMemory workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); @@ -95,7 +95,7 @@ ((StatefulSession)workingMemory).dispose(); expression.setRuleReference("Rule1"); - expression.setWhen(TestDroolsRuleManager.rule1); + expression.setRule(TestDroolsRuleManager.rule1); this.ruleManager.addRule(expression); workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); Modified: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java 2009-02-04 14:00:11 UTC (rev 12771) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -81,7 +81,7 @@ { DroolsRuleExpression expression = new DroolsRuleExpression(); expression.setRuleReference("Rule2"); - expression.setWhen(TestDroolsRules.rule2); + expression.setRule(TestDroolsRules.rule2); this.ruleManager.addRule(expression); WorkingMemory workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); @@ -94,7 +94,7 @@ ((StatefulSession)workingMemory).dispose(); expression.setRuleReference("Rule1"); - expression.setWhen(TestDroolsRules.rule1); + expression.setRule(TestDroolsRules.rule1); this.ruleManager.addRule(expression); workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); Added: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestEnterprisePolicyFinderModule.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestEnterprisePolicyFinderModule.java (rev 0) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestEnterprisePolicyFinderModule.java 2009-02-04 16:46:53 UTC (rev 12772) @@ -0,0 +1,178 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.policy.server.plugin; + +import java.util.Set; +import junit.framework.TestCase; +import org.apache.log4j.Logger; + +import org.jboss.security.authz.model.Policy; +import org.jboss.security.authz.model.Resource; +import org.jboss.security.authz.model.Attribute; +import org.jboss.security.authz.components.http.HttpResource; +import org.jboss.security.authz.policy.server.PolicyServer; +import org.jboss.security.authz.policy.server.Server; + +import org.jboss.security.xacml.core.model.context.ActionType; +import org.jboss.security.xacml.core.model.context.AttributeType; +import org.jboss.security.xacml.core.model.context.AttributeValueType; +import org.jboss.security.xacml.core.model.context.ObjectFactory; +import org.jboss.security.xacml.core.model.context.RequestType; +import org.jboss.security.xacml.core.model.context.ResourceType; +import org.jboss.security.xacml.core.model.context.SubjectType; +import org.jboss.security.xacml.factories.RequestResponseContextFactory; +import org.jboss.security.xacml.interfaces.RequestContext; +import org.jboss.security.xacml.interfaces.ResponseContext; +import org.jboss.security.xacml.interfaces.XACMLConstants; +import org.jboss.security.xacml.interfaces.XMLSchemaConstants; + +import org.jboss.security.xacml.sunxacml.PDP; +import org.jboss.security.xacml.sunxacml.ctx.RequestCtx; +import org.jboss.security.xacml.sunxacml.ctx.ResponseCtx; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestEnterprisePolicyFinderModule extends TestCase +{ + private static Logger log = Logger.getLogger(TestEnterprisePolicyFinderModule.class); + + private PolicyServer policyServer; + + public void setUp() throws Exception + { + Server.bootstrap(); + this.policyServer = (PolicyServer)Server.lookup("/policy-server/PolicyServer"); + } + + public void tearDown() throws Exception + { + } + + public void testNewPolicyEnforcement() throws Exception + { + HttpResource httpResource = new HttpResource(); + httpResource.setUrl("/blah/index.html"); + httpResource.addParameter("param1", "param1Value"); + httpResource.addParameter("param2", "param2Value"); + httpResource.addAllowedRole("Admin"); + + policyServer.newPolicy(httpResource.getPolicyMetaData(true)); + + //Assert Policy State of the Server + Policy[] policies = policyServer.readAllPolicies(); + + assertTrue("Policy Store must not be empty!!", (policies != null && policies.length == 1)); + log.info("------------------------------------------------------------------------------"); + log.info(policies[0].generateXACMLPolicy()); + + //Send an Enforcement request that should be allowed + this.enforce(this.createPermitRequestContext(httpResource), true); + + //Send an Enforcement request that should be denied + this.enforce(this.createPermitRequestContext(httpResource), false); + } + //---------------------------------------------------------------------------------------------------------------------------------------------------------- + private void enforce(RequestContext request, boolean mustBePermitted) throws Exception + { + log.info("-----------------------------------"); + request.marshall(System.out); + + PDP pdp = this.policyServer.getPolicyDecisionPoint().getPDP(); + + ResponseCtx response = pdp.evaluate((RequestCtx)request.get(XACMLConstants.REQUEST_CTX)); + assertNotNull(response); + + log.info("-----------------------------------"); + response.encode(System.out); + + ResponseContext responseContext = RequestResponseContextFactory.createResponseContext(); + responseContext.set(XACMLConstants.RESPONSE_CTX, response); + assertNotNull(responseContext); + if(mustBePermitted) + { + assertEquals(responseContext.getDecision(), XACMLConstants.DECISION_PERMIT); + } + else + { + assertEquals(responseContext.getDecision(), XACMLConstants.DECISION_DENY); + } + + log.info("-----------------------------------"); + log.info("Decision="+responseContext.getDecision()); + } + private RequestContext createPermitRequestContext(HttpResource httpResource) throws Exception + { + //Create ObjectFactory + ObjectFactory objectFactory = new ObjectFactory(); + + //Create RequestContext + RequestContext requestContext = RequestResponseContextFactory.createRequestCtx(); + + //Create a RequestType + RequestType requestType = objectFactory.createRequestType(); + + + //Create Subjects + SubjectType subject = objectFactory.createSubjectType(); + AttributeType subjectAttribute = objectFactory.createAttributeType(); + subjectAttribute.setAttributeId(XACMLConstants.ATTRIBUTEID_ROLE); + subjectAttribute.setDataType(XMLSchemaConstants.DATATYPE_STRING); + AttributeValueType subjectId = objectFactory.createAttributeValueType(); + subjectId.getContent().add("Admin"); + subjectAttribute.getAttributeValue().add(subjectId); + subject.getAttribute().add(subjectAttribute); + requestType.getSubject().add(subject); + + //Create Resource + Resource urlResource = httpResource.getURLResource(); + ResourceType resource = objectFactory.createResourceType(); + Set<Attribute> attributes = urlResource.getAttributes(); + for(Attribute attribute: attributes) + { + AttributeType resourceAttribute = objectFactory.createAttributeType(); + resourceAttribute.setAttributeId(attribute.getUri()); + resourceAttribute.setDataType(attribute.getDatatType()); + AttributeValueType resourceId = objectFactory.createAttributeValueType(); + resourceId.getContent().add(attribute.getValue()); + resourceAttribute.getAttributeValue().add(resourceId); + resource.getAttribute().add(resourceAttribute); + } + requestType.getResource().add(resource); + + //Create Action + ActionType action = objectFactory.createActionType(); + AttributeType actionAttribute = objectFactory.createAttributeType(); + actionAttribute.setAttributeId(XACMLConstants.ATTRIBUTEID_ACTION_ID); + actionAttribute.setDataType(XMLSchemaConstants.DATATYPE_STRING); + AttributeValueType actionId = objectFactory.createAttributeValueType(); + actionId.getContent().add("GET"); + actionAttribute.getAttributeValue().add(actionId); + action.getAttribute().add(actionAttribute); + requestType.setAction(action); + + //Spit out RequestContext + requestContext.setRequest(requestType); + + return requestContext; + } +}