Author: sohil.shah(a)jboss.com Date: 2009-07-13 12:45:05 -0400 (Mon, 13 Jul 2009) New Revision: 13550 Modified: modules/authorization/trunk/http-profile/src/test/java/org/jboss/security/authz/http/provisioning/TestHttpPolicyConfig.java modules/authorization/trunk/http-profile/src/test/resources/http-policy.xml modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java Log: adapting the http-profile tests with the new framework Modified: modules/authorization/trunk/http-profile/src/test/java/org/jboss/security/authz/http/provisioning/TestHttpPolicyConfig.java =================================================================== --- modules/authorization/trunk/http-profile/src/test/java/org/jboss/security/authz/http/provisioning/TestHttpPolicyConfig.java 2009-07-12 20:31:28 UTC (rev 13549) +++ modules/authorization/trunk/http-profile/src/test/java/org/jboss/security/authz/http/provisioning/TestHttpPolicyConfig.java 2009-07-13 16:45:05 UTC (rev 13550) @@ -30,18 +30,20 @@ import org.apache.log4j.Logger; import org.jboss.security.authz.bootstrap.ServiceContainer; +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.enforcement.EnforcementResponse; import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.services.PolicyComposer; + import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.authz.http.component.action.Get; import org.jboss.security.authz.http.component.action.Post; import org.jboss.security.authz.http.component.resource.HttpResource; -import org.jboss.security.authz.http.configuration.HttpPolicyConfig; import org.jboss.security.authz.model.Policy; + +import org.jboss.security.authz.http.configuration.HttpPolicyConfig; import org.jboss.security.authz.tools.GeneralTool; -import org.jboss.security.authz.policy.client.enforcement.Request; -import org.jboss.security.authz.policy.client.enforcement.Response; import org.jboss.security.authz.policy.server.spi.PolicyConfig; /** @@ -63,13 +65,9 @@ this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); - this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); - } - //------------------------------------------------------------------------------------------------------------------------------------------------------ - //TODO: migrate to the new developer framework - public void testExecutiveFiles() throws Exception - { - PolicyConfig config = new HttpPolicyConfig(); + this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); + + PolicyConfig config = new HttpPolicyConfig(); ((HttpPolicyConfig)config).setPolicyComposer(this.policyComposer); InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream("http-policy.xml"); @@ -78,178 +76,128 @@ assertNotNull(policies); - for(int i=0; i<policies.length; i++) - { - String xacmlPolicy = policies[i].generateSystemPolicy(); - this.provisioner.newPolicy(policies[i].getMetaData()); - - log.info("------------------------------------------------------"); - log.info(xacmlPolicy); - log.info("------------------------------------------------------"); + for(Policy policy: policies) + { + this.provisioner.newPolicy(policy.getMetaData()); } is.close(); + //Assert Policy State of the Server + policies = this.provisioner.readAllPolicies(); + + assertTrue("Policy Store must not be empty!!", policies != null && policies.length > 0); + for(Policy policy: policies) + { + log.info("------------------------------------------------------------------------------"); + log.info(policy.generateSystemPolicy()); + } + } + //----------------------------------------------------------------------------------------------------------------------------------------------------------------------- + public void testExecutiveFiles() throws Exception + { //Perform an Enforcement - /*HttpResource incoming = new HttpResource(); + HttpResource incoming = new HttpResource(); incoming.setUri(new URI("/private/executives/index.html")); - incoming.addParameter("id", "1234"); + incoming.addParameter("id", "1234"); //Executive is allowed - this.enforce(this.createGetRequest(incoming, new String[]{"executive"}), true); - this.enforce(this.createPostRequest(incoming, new String[]{"executive"}), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive"}, new Get()), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive"}, new Post()), true); //Executive is allowed but Manager is not.....Permit overrides Deny according to the Rule Combining Algorithm used for this Policy - this.enforce(this.createGetRequest(incoming, new String[]{"executive", "manager"}), true); - this.enforce(this.createPostRequest(incoming, new String[]{"executive", "manager"}), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive", "manager"}, new Get()), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive", "manager"}, new Post()), true); //Manager is Not Allowed - this.enforce(this.createGetRequest(incoming, new String[]{"manager"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"manager"}, new Get()), false); //Anonymous is Not Allowed - this.enforce(this.createGetRequest(incoming, new String[]{"anonymous"}), false);*/ + this.enforce(this.createEnforcementContext(incoming, new String[]{"anonymous"}, new Get()), false); } - /*public void testBoardFiles() throws Exception - { - PolicyConfig config = new HttpPolicyConfig(); - InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream("http-policy.xml"); - - Policy[] policies = config.configure(GeneralTool.readStream(is)); - - assertNotNull(policies); - - for(int i=0; i<policies.length; i++) - { - String xacmlPolicy = policies[i].generateXACMLPolicy(); - this.policyServer.newPolicy(policies[i].getMetaData()); - log.info("------------------------------------------------------"); - log.info(xacmlPolicy); - log.info("------------------------------------------------------"); - } - - is.close(); - + public void testBoardFiles() throws Exception + { //Perform an Enforcement HttpResource incoming = new HttpResource(); incoming.setUri(new URI("/private/board/index.html")); incoming.addParameter("id", "5678"); //Executive is allowed - this.enforce(this.createGetRequest(incoming, new String[]{"executive"}), true); - this.enforce(this.createPostRequest(incoming, new String[]{"executive"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive"}, new Get()), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive"}, new Post()), false); //Executive is allowed but Manager is not.....Permit overrides Deny according to the Rule Combining Algorithm used for this Policy - this.enforce(this.createGetRequest(incoming, new String[]{"executive", "manager"}), true); - this.enforce(this.createPostRequest(incoming, new String[]{"executive", "manager"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive", "manager"}, new Get()), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive", "manager"}, new Post()), false); //Manager is Not Allowed - this.enforce(this.createGetRequest(incoming, new String[]{"manager"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"manager"}, new Get()), false); //Anonymous is Not Allowed - this.enforce(this.createGetRequest(incoming, new String[]{"anonymous"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"anonymous"}, new Get()), false); } public void testEditUser() throws Exception - { - PolicyConfig config = new HttpPolicyConfig(); - InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream("http-policy.xml"); - - Policy[] policies = config.configure(GeneralTool.readStream(is)); - - assertNotNull(policies); - - for(int i=0; i<policies.length; i++) - { - String xacmlPolicy = policies[i].generateXACMLPolicy(); - this.policyServer.newPolicy(policies[i].getMetaData()); - log.info("------------------------------------------------------"); - log.info(xacmlPolicy); - log.info("------------------------------------------------------"); - } - - is.close(); - + { //Perform an Enforcement HttpResource incoming = new HttpResource(); incoming.setUri(new URI("/editUser")); incoming.addParameter("userId", "9101112"); //Executive is allowed - this.enforce(this.createGetRequest(incoming, new String[]{"executive"}), true); - this.enforce(this.createPostRequest(incoming, new String[]{"executive"}), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive"}, new Get()), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive"}, new Post()), true); //Executive is allowed but Manager is not.....Permit overrides Deny according to the Rule Combining Algorithm used for this Policy - this.enforce(this.createGetRequest(incoming, new String[]{"executive", "manager"}), true); - this.enforce(this.createPostRequest(incoming, new String[]{"executive", "manager"}), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive", "manager"}, new Get()), true); + this.enforce(this.createEnforcementContext(incoming, new String[]{"executive", "manager"}, new Post()), true); //Manager is Not Allowed - this.enforce(this.createGetRequest(incoming, new String[]{"manager"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"manager"}, new Get()), false); //Anonymous is Not Allowed - this.enforce(this.createGetRequest(incoming, new String[]{"anonymous"}), false); + this.enforce(this.createEnforcementContext(incoming, new String[]{"anonymous"}, new Get()), false); } //------------------------------------------------------------------------------------------------------------------------------------------------- - private void enforce(Request request, boolean mustBePermitted) throws Exception + private void enforce(EnforcementContext enforcementContext, boolean mustBePermitted) throws Exception { - - Response response = this.enforcer.checkAccess(request); - - assertNotNull(response); - log.info("-----------------------------------"); - log.info("Decision="+response.getMessage()); - - if(mustBePermitted) - { - assertTrue("Access must be granted!!!", response.isAccessGranted()); - } - else - { - assertFalse("Access must be denied!!!", response.isAccessGranted()); - } + EnforcementResponse response = this.enforcer + .checkAccess(enforcementContext); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision=" + response.getMessage()); + + if (mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } } - private Request createGetRequest(HttpResource contextResource, String[] userRoles) throws Exception + private EnforcementContext createEnforcementContext(HttpResource protectedResource, String[] userRoles, Object actionComponent) throws Exception { - //Create a RequestType - Request request = new Request(); - - //Create Subjects - Roles roles = new Roles(); - for(int i=0; i<userRoles.length; i++) - { - roles.addName(userRoles[i]); - } - request.addSubject(roles.getSubject()); - - //Create Resource - request.addResource(contextResource.getResource()); - - //Create Action - request.setAction(new Get().getAction()); - - return request; - } - - private Request createPostRequest(HttpResource contextResource, String[] userRoles) throws Exception - { - //Create a RequestType - Request request = new Request(); - - //Create Subjects - Roles roles = new Roles(); - for(int i=0; i<userRoles.length; i++) - { - roles.addName(userRoles[i]); - } - request.addSubject(roles.getSubject()); - - //Create Resource - request.addResource(contextResource.getResource()); - - //Create Action - request.setAction(new Post().getAction()); - - return request; - }*/ + // Create an EnforcementContext + EnforcementContext context = new EnforcementContext(); + + //Resource being accessed + context.setAttribute("http-resource", protectedResource); + + // Create Subjects + Roles roles = new Roles(); + for (int i = 0; i < userRoles.length; i++) + { + roles.addName(userRoles[i]); + } + context.setAttribute("roles", roles); + + //Action being performed + context.setAttribute("http-action", actionComponent); + + return context; + } } Modified: modules/authorization/trunk/http-profile/src/test/resources/http-policy.xml =================================================================== --- modules/authorization/trunk/http-profile/src/test/resources/http-policy.xml 2009-07-12 20:31:28 UTC (rev 13549) +++ modules/authorization/trunk/http-profile/src/test/resources/http-policy.xml 2009-07-13 16:45:05 UTC (rev 13550) @@ -1,5 +1,5 @@ <?xml version="1.0" encoding="UTF-8"?> -<web-security> +<web-security> <security-constraint> <web-resource-collection> <web-resource> @@ -10,7 +10,7 @@ </parameters> <http-method>GET</http-method> <http-method>POST</http-method> - </web-resource> + </web-resource> <web-resource> <web-resource-name>Board/Investor Files</web-resource-name> <url-pattern>/private/board/*</url-pattern> @@ -18,7 +18,7 @@ <parameter name="id">5678</parameter> </parameters> <http-method>GET</http-method> - </web-resource> + </web-resource> </web-resource-collection> <auth-constraint> <!-- constaints based on user roles --> @@ -68,8 +68,7 @@ <http-method>POST</http-method> </web-resource> </web-resource-collection> - <auth-constraint> - <!-- constaints based on user roles --> + <auth-constraint> <roles allow="true"> <role-name>Admin</role-name> <role-name>Executive</role-name> @@ -79,5 +78,5 @@ <role-name>Developer</role-name> </roles> </auth-constraint> - </security-constraint> + </security-constraint> </web-security> \ No newline at end of file Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java 2009-07-12 20:31:28 UTC (rev 13549) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java 2009-07-13 16:45:05 UTC (rev 13550) @@ -22,6 +22,8 @@ ******************************************************************************/ package org.jboss.security.authz.policy.server.plugin; +import java.util.List; +import java.util.ArrayList; import java.io.IOException; import java.io.ByteArrayInputStream; @@ -57,11 +59,11 @@ private static Logger log = Logger.getLogger(EnterprisePolicyFinderModule.class); private PolicyReader reader; - private PolicyCollection policies; + private List<PolicyCollection> policies; public EnterprisePolicyFinderModule() { - this.policies = new PolicyCollection(); + this.policies = new ArrayList<PolicyCollection>(); } public void addPolicy(Policy policy) throws PolicyServerException @@ -74,7 +76,9 @@ AbstractPolicy xacmlPolicy = this.reader.readPolicy(bos); - this.policies.addPolicy(xacmlPolicy); + PolicyCollection newPolicyCollection = new PolicyCollection(); + newPolicyCollection.addPolicy(xacmlPolicy); + this.policies.add(newPolicyCollection); } catch(Exception e) { @@ -135,21 +139,35 @@ */ public PolicyFinderResult findPolicy(EvaluationCtx context) { - try - { - AbstractPolicy policy = this.policies.getPolicy(context); - if (policy == null) - { - return new PolicyFinderResult(); - } - else - { - return new PolicyFinderResult(policy); - } - } - catch (TopLevelPolicyException e) - { - return new PolicyFinderResult(e.getStatus()); - } + TopLevelPolicyException exception = null; + PolicyFinderResult result = null; + for (PolicyCollection policyCollection : this.policies) + { + try + { + AbstractPolicy policy = policyCollection.getPolicy(context); + if (policy != null) + { + return new PolicyFinderResult(policy); + } + } + catch (TopLevelPolicyException e) + { + exception = e; + } + } + + //If I am here......No Policy Found for the incoming request!! + if(exception != null) + { + result = new PolicyFinderResult(exception.getStatus()); + } + else + { + result = new PolicyFinderResult(); + } + + + return result; } } \ No newline at end of file