Author: sohil.shah(a)jboss.com Date: 2009-08-07 14:02:40 -0400 (Fri, 07 Aug 2009) New Revision: 13700 Added: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/AbstractFeatureTest.java modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/Blah.java modules/authorization/trunk/agent/src/test/resources/hibernate.cfg.xml modules/authorization/trunk/http-profile/src/test/resources/hibernate.cfg.xml modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/Cursor.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/tools/ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/tools/HibernateService.java Modified: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/services/RuleComposition.java modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestHierarchialPropagation.java modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliedActions.java modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliesHierarchialPropagation.java modules/authorization/trunk/common-api/src/main/java/org/jboss/security/authz/bootstrap/ServiceContainer.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/provisioning/RelationalDBPolicyStore.java modules/authorization/trunk/policy-server/src/main/resources/META-INF/authz-config.xml modules/authorization/trunk/policy-server/src/main/resources/policy.hbm.xml modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/provisioning/TestRelationalDBPolicyStore.java Log: Started Hibernate based RelationalDBPolicyStore implementation * full testsuite success Modified: modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/services/RuleComposition.java =================================================================== --- modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/services/RuleComposition.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/agent/src/main/java/org/jboss/security/authz/agent/services/RuleComposition.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -1,24 +1,24 @@ /* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.security.authz.agent.services; import java.lang.reflect.Method; @@ -41,176 +41,190 @@ /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> */ -class RuleComposition +class RuleComposition { private static Logger log = Logger.getLogger(RuleComposition.class); - + private String type; private Object targetComponent; private Object logicComponent; private String expressionName; private Effect effect; - + RuleComposition() { - + } - Object getTargetComponent() + Object getTargetComponent() { return targetComponent; } - void setTargetComponent(Object targetComponent) + void setTargetComponent(Object targetComponent) { this.targetComponent = targetComponent; } - Object getLogicComponent() + Object getLogicComponent() { return logicComponent; } - void setLogicComponent(Object logicComponent) + void setLogicComponent(Object logicComponent) { this.logicComponent = logicComponent; } - - Effect getEffect() + + Effect getEffect() { return effect; } - void setEffect(Effect effect) + void setEffect(Effect effect) { this.effect = effect; } - - String getExpressionName() + + String getExpressionName() { return expressionName; } - void setExpressionName(String expressionName) + void setExpressionName(String expressionName) { this.expressionName = expressionName; } - - String getType() + + String getType() { return type; } - void setType(String type) + void setType(String type) { this.type = type; } - //---------------------------------------------------------------------------------------------------------------------------------------------------------------- + + // ---------------------------------------------------------------------------------------------------------------------------------------------------------------- Set<Rule> compose() { - if(this.effect == null) + if (this.effect == null) { throw new IllegalStateException("Effect is missing!!"); } - - if(this.expressionName != null) + + if (this.expressionName != null) { - if(this.logicComponent == null) + if (this.logicComponent == null) { throw new IllegalStateException("Logic Component is missing!!"); } - } - + } + try { Set<Rule> rules = new HashSet<Rule>(); - + Rule rule = new Rule(); - + rule.setRuleId(GeneralTool.generateUniqueId()); rule.setEffect(this.effect); - - //Generate the Target for this rule + + // Generate the Target for this rule Set<Target> impliedActions = new HashSet<Target>(); - if(this.targetComponent != null) + if (this.targetComponent != null) { TargetComposition targetComposition = new TargetComposition(); targetComposition.setTargetComponent(this.targetComponent); rule.setTarget(targetComposition.compose()); - + Set<Target> cour = targetComposition.composeImpliedTargets(); - if(cour != null && !cour.isEmpty()) + if (cour != null && !cour.isEmpty()) { impliedActions.addAll(cour); } } - - //Generate the Logic Expression of this rule - if(this.expressionName != null) - { - rule.setExpression(this.generateExpression()); - } - else if(this.logicComponent != null) - { - //Generate a native XACML Conditional Expression - ComponentCategory category = CompositionUtil.findComponentCategory(this.logicComponent.getClass()); - String attributeCategory = category.getAttributeCategory(); - - //Read the SecurityContext State of the Component being provisioned - Object[] securityContextData = AnnotationProcessor.extractSecurityContextData(this.logicComponent); - if(securityContextData == null || securityContextData.length != 1) - { - throw new IllegalStateException("State of the Logic Component "+this.logicComponent+" is invalid!!"); - } - - //Get the Attribute expression based on the Security Context State - String conditionContext = securityContextData[0].toString(); - AttributeExpression conditionExpression = CompositionUtil.generateConditionExpression(conditionContext, attributeCategory); - - rule.setExpression(conditionExpression); - } - + + // Generate the Logic Expression of this rule + rule.setExpression(this.generateLogicExpression()); + rules.add(rule); - - //Add any implied actions - if(impliedActions != null && !impliedActions.isEmpty()) + + // Add any implied actions + if (impliedActions != null && !impliedActions.isEmpty()) { - for(Target impliedAction: impliedActions) + for (Target impliedAction : impliedActions) { Rule impliedRule = new Rule(); - + impliedRule.setRuleId(GeneralTool.generateUniqueId()); - impliedRule.setEffect(rule.getEffect()); - impliedRule.setExpression(rule.getExpression()); + impliedRule.setEffect(rule.getEffect()); + impliedRule.setExpression(this.generateLogicExpression()); impliedRule.setTarget(impliedAction); - + rules.add(impliedRule); } } - + return rules; } - catch(Exception e) + catch (Exception e) { - //TODO: handle this properly + // TODO: handle this properly log.error(this, e); throw new RuntimeException(e); } } - //---------------------------------------------------------------------------------------------------------------------------------------------------------------- + + // ---------------------------------------------------------------------------------------------------------------------------------------------------------------- private Expression generateExpression() throws Exception { DroolsRuleExpression expression = new DroolsRuleExpression(); - - //Read the LogicExpression of the Logic Component - Method expressionMethod = AnnotationProcessor.findExpression(this.logicComponent.getClass(), this.expressionName); + + // Read the LogicExpression of the Logic Component + Method expressionMethod = AnnotationProcessor.findExpression( + this.logicComponent.getClass(), this.expressionName); expressionMethod.setAccessible(true); - - String[] expressionMetaData = (String[])expressionMethod.invoke(this.logicComponent, null); - + + String[] expressionMetaData = (String[]) expressionMethod.invoke( + this.logicComponent, null); + expression.setRuleReference(expressionMetaData[0]); expression.setRule(expressionMetaData[1]); - + return expression; - } + } + + private Expression generateLogicExpression() throws Exception + { + if (this.expressionName != null) + { + return this.generateExpression(); + } + else if (this.logicComponent != null) + { + // Generate a native XACML Conditional Expression + ComponentCategory category = CompositionUtil + .findComponentCategory(this.logicComponent.getClass()); + String attributeCategory = category.getAttributeCategory(); + + // Read the SecurityContext State of the Component being provisioned + Object[] securityContextData = AnnotationProcessor + .extractSecurityContextData(this.logicComponent); + if (securityContextData == null || securityContextData.length != 1) + { + throw new IllegalStateException("State of the Logic Component " + + this.logicComponent + " is invalid!!"); + } + + // Get the Attribute expression based on the Security Context State + String conditionContext = securityContextData[0].toString(); + AttributeExpression conditionExpression = CompositionUtil + .generateConditionExpression(conditionContext, attributeCategory); + + return conditionExpression; + } + return null; + } } Added: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/AbstractFeatureTest.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/AbstractFeatureTest.java (rev 0) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/AbstractFeatureTest.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -0,0 +1,150 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.agent.features; + +import junit.framework.TestCase; + +import org.apache.log4j.Logger; + +import org.hibernate.Session; +import org.hibernate.Transaction; +import org.jboss.security.authz.bootstrap.ServiceContainer; +import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; +import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; +import org.jboss.security.authz.agent.enforcement.EnforcementResponse; +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.services.PolicyComposer; +import org.jboss.security.authz.model.Policy; + +import org.jboss.security.authz.policy.server.tools.HibernateService; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public abstract class AbstractFeatureTest extends TestCase +{ + private static Logger log = Logger.getLogger(AbstractFeatureTest.class); + + PolicyComposer policyComposer; + PolicyEnforcementPoint enforcer; + PolicyProvisioner provisioner; + HibernateService hibernateService; + + + public void setUp() throws Exception + { + ServiceContainer.bootstrap(); + + this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); + this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); + this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); + this.hibernateService = (HibernateService)ServiceContainer.lookup("/policy-server/HibernateService"); + } + + public void tearDown() throws Exception + { + ServiceContainer.shutdown(); + } + + protected void assertServerState() throws Exception + { + //Assert Policy State of the Server + Policy[] policies = this.provisioner.readAllPolicies(); + + assertTrue("Policy Store must not be empty!!", (policies != null && policies.length > 0)); + for(Policy policy: policies) + { + log.info("------------------------------------------------------------------------------"); + log.info(policy.generateSystemPolicy()); + } + } + + protected void enforce(EnforcementContext enforcementContext, + boolean mustBePermitted) throws Exception + { + EnforcementResponse response = this.enforcer + .checkAccess(enforcementContext); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision=" + response.getMessage()); + + if (mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } + } + + protected EnforcementResponse enforceWithResponse(EnforcementContext enforcementContext, + boolean mustBePermitted) throws Exception + { + EnforcementResponse response = this.enforcer + .checkAccess(enforcementContext); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision=" + response.getMessage()); + + if (mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } + return response; + } + + /*protected void deleteAllPolicies() + { + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = hibernateService.getCurrentSession(); + tx = session.beginTransaction(); + + session.createQuery("delete XACMLPolicy").executeUpdate(); + + tx.commit(); + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } + }*/ +} Added: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/Blah.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/Blah.java (rev 0) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/Blah.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -0,0 +1,142 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.security.authz.agent.features; + +import java.net.URI; + +import org.jboss.security.authz.bootstrap.ServiceContainer; + +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.subject.Identity; +import org.jboss.security.authz.components.subject.Roles; +import org.jboss.security.authz.components.action.Read; + +import org.jboss.security.authz.model.Effect; +import org.jboss.security.authz.model.PolicyMetaData; + +import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; +import org.jboss.security.authz.agent.enforcement.EnforcementContext; +import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; + +import org.jboss.security.authz.agent.services.CompositionContext; +import org.jboss.security.authz.agent.services.PolicyComposer; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class Blah extends AbstractFeatureTest +{ + public void setUp() throws Exception + { + // Create Policies into Policy Store before Boot Up so that they will be + // loaded into the + // Rule Engine on startup + this.seedPolicyStore(); + + super.setUp(); + } + + public void testBootUp() throws Exception + { + this.assertServerState(); + + Read action = new Read(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + this.enforce(this.createEnforcementContext(contextResource, action), true); + } + // ------------------------------------------------------------------------------------------------------------------------------------------------------ + private EnforcementContext createEnforcementContext( + URIResource protectedResource, Read action) throws Exception + { + // Create an EnforcementContext + EnforcementContext context = new EnforcementContext(); + + // Enable Hierarchial Enforcement + context.activateHierarchialEnforcement(); + + // Create Resource + context.setAttribute("uri-resource", protectedResource); + + // Create Subjects + Roles roles = new Roles(); + roles.addName("user"); + context.setAttribute("roles", roles); + Identity identity = new Identity(); + identity.setName(&quot;blah(a)blah.com&quot;); + context.setAttribute("identity", identity); + + // Create Action + context.setAttribute("action", action); + + return context; + } + + private void seedPolicyStore() throws Exception + { + try + { + ServiceContainer.bootstrap(); + + this.policyComposer = (PolicyComposer) ServiceContainer + .lookup("/agent/PolicyComposer"); + this.enforcer = (PolicyEnforcementPoint) ServiceContainer + .lookup("/agent/LocalEnforcementPoint"); + this.provisioner = (PolicyProvisioner) ServiceContainer + .lookup("/agent/LocalPolicyProvisioner"); + + // SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1/level2/index.html")); + + Read action = new Read(); + + Roles allowedRoles = new Roles(); + allowedRoles.addName("user"); + + Identity identity = new Identity(); + identity.setName(&quot;blah(a)blah.com&quot;); + + // Setup the Context for the Composition with these components + CompositionContext context = new CompositionContext(); + context.setPolicyTarget(resource); + context.addPolicyRule(Effect.PERMIT, action, allowedRoles,"allowExpression"); + + // Store the policy into the Policy Server + PolicyMetaData policyMetaData = this.policyComposer.compose(context); + + this.provisioner.newPolicy(policyMetaData); + } + finally + { + ServiceContainer.shutdown(); + this.policyComposer = null; + this.provisioner = null; + this.enforcer = null; + this.hibernateService = null; + } + } +} Modified: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestAgentCache.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -23,55 +23,24 @@ import java.net.URI; -import junit.framework.TestCase; -import org.apache.log4j.Logger; - -import org.jboss.security.authz.bootstrap.ServiceContainer; - import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Identity; import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.authz.components.action.Read; import org.jboss.security.authz.model.Effect; -import org.jboss.security.authz.model.Policy; import org.jboss.security.authz.model.PolicyMetaData; -import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; import org.jboss.security.authz.agent.enforcement.EnforcementContext; import org.jboss.security.authz.agent.enforcement.EnforcementResponse; -import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.services.CompositionContext; -import org.jboss.security.authz.agent.services.PolicyComposer; /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> */ -public class TestAgentCache extends TestCase +public class TestAgentCache extends AbstractFeatureTest { - private static Logger log = Logger.getLogger(TestAgentCache.class); - - private PolicyComposer policyComposer; - private PolicyEnforcementPoint enforcer; - private PolicyProvisioner provisioner; - - public void setUp() throws Exception - { - ServiceContainer.bootstrap(); - - this.policyComposer = (PolicyComposer) ServiceContainer - .lookup("/agent/PolicyComposer"); - this.enforcer = (PolicyEnforcementPoint) ServiceContainer - .lookup("/agent/LocalEnforcementPoint"); - this.provisioner = (PolicyProvisioner) ServiceContainer - .lookup("/agent/LocalPolicyProvisioner"); - } - - public void tearDown() throws Exception - { - } - public void testMultipleInvocations() throws Exception { // SetUp Resource @@ -103,45 +72,22 @@ for(int i=0; i<5; i++) { EnforcementContext enforcementContext = this.createEnforcementContext(contextResource, action); - EnforcementResponse response = this.enforce(enforcementContext, true); + EnforcementResponse response = this.enforceWithResponse(enforcementContext, true); - //Assert response state for caching related meta data - assertTrue("Must be Cached!!", response.isCached()); if(i == 0) { - assertTrue("Must be Evaluated by the Policy Server", response.isEvaluated()); - - Thread.currentThread().sleep(10); //to make sure the background caching thread finished its job + assertTrue("Must be Evaluated by the Policy Server", response.isEvaluated()); + Thread.currentThread().sleep(1000); //to make sure the background caching thread finished its job } else { assertFalse("Must Not Be Evaluated. Cache should be used instead!!", response.isEvaluated()); + //Assert response state for caching related meta data + assertTrue("Must be Cached!!", response.isCached()); } } } - - // ------------------------------------------------------------------------------------------------------------------------------------------------------ - private EnforcementResponse enforce(EnforcementContext enforcementContext, - boolean mustBePermitted) throws Exception - { - EnforcementResponse response = this.enforcer - .checkAccess(enforcementContext); - - assertNotNull(response); - log.info("-----------------------------------"); - log.info("Decision=" + response.getMessage()); - - if (mustBePermitted) - { - assertTrue("Access must be granted!!!", response.isAccessGranted()); - } - else - { - assertFalse("Access must be denied!!!", response.isAccessGranted()); - } - return response; - } - + // ------------------------------------------------------------------------------------------------------------------------------------------------------ private EnforcementContext createEnforcementContext( URIResource protectedResource, Read action) throws Exception { @@ -166,17 +112,5 @@ context.setAttribute("action", action); return context; - } - - private void assertServerState() throws Exception - { - // Assert Policy State of the Server - Policy[] policies = this.provisioner.readAllPolicies(); - - assertTrue("Policy Store must not be empty!!", - (policies != null && policies.length == 1)); - log - .info("------------------------------------------------------------------------------"); - log.info(policies[0].generateSystemPolicy()); - } + } } Modified: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestHierarchialPropagation.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestHierarchialPropagation.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestHierarchialPropagation.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -1,318 +1,276 @@ /* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.security.authz.agent.features; import java.net.URI; -import junit.framework.TestCase; -import org.apache.log4j.Logger; - -import org.jboss.security.authz.bootstrap.ServiceContainer; - import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Identity; import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.authz.components.action.Read; import org.jboss.security.authz.model.Effect; -import org.jboss.security.authz.model.Policy; import org.jboss.security.authz.model.PolicyMetaData; -import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; + import org.jboss.security.authz.agent.enforcement.EnforcementContext; -import org.jboss.security.authz.agent.enforcement.EnforcementResponse; -import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.services.CompositionContext; -import org.jboss.security.authz.agent.services.PolicyComposer; /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> */ -public class TestHierarchialPropagation extends TestCase +public class TestHierarchialPropagation extends AbstractFeatureTest { - private static Logger log = Logger.getLogger(TestHierarchialPropagation.class); - - private PolicyComposer policyComposer; - private PolicyEnforcementPoint enforcer; - private PolicyProvisioner provisioner; - - - public void setUp() throws Exception - { - ServiceContainer.bootstrap(); - - this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); - this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); - this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); - } - - public void tearDown() throws Exception - { - } - public void testExplicitPermit() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1/level2/index.html")); - + resource.setUri(new URI("/root/level1/level2/index.html")); + Read action = new Read(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); - this.provisioner.newPolicy(policyMetaData); - + this.provisioner.newPolicy(policyMetaData); + this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), true); } - + public void testExplicitDeny() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1/level2/index.html")); - + resource.setUri(new URI("/root/level1/level2/index.html")); + Read action = new Read(); - + Roles deniedRoles = new Roles(); deniedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.DENY, action, deniedRoles, "denyExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.DENY, action, deniedRoles, "denyExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - + this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), false); } - + public void testPermitInheritance() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); resource.setUri(new URI("/root/level1")); - + Read action = new Read(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); - this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + this.provisioner.newPolicy(policyMetaData); + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), true); } - + public void testDenyInheritance() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1")); - + resource.setUri(new URI("/root/level1")); + Read action = new Read(); - + Roles deniedRoles = new Roles(); deniedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.DENY, action, deniedRoles, "denyExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.DENY, action, deniedRoles, "denyExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); - this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + this.provisioner.newPolicy(policyMetaData); + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), false); } - + public void testDenyOverridesPermitInheritance() throws Exception { - //SetUp Permit policy + // SetUp Permit policy URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1")); - + resource.setUri(new URI("/root/level1")); + Read action = new Read(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - //Setup denied policy + + // Setup denied policy resource = new URIResource(); resource.setUri(new URI("/root/level1/level2")); - + Roles deniedRoles = new Roles(); deniedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.DENY, action, deniedRoles, "denyExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.DENY, action, deniedRoles, "denyExpression"); + + // Store the policy into the Policy Server policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), false); } - + public void testNotApplicable() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); resource.setUri(new URI("/root2")); - + Read action = new Read(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); - this.provisioner.newPolicy(policyMetaData); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + this.provisioner.newPolicy(policyMetaData); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), false); } - + public void testExplicitPermitByIdentity() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1/level2/index.html")); - + resource.setUri(new URI("/root/level1/level2/index.html")); + Read action = new Read(); - + Identity identity = new Identity(); identity.setName(&quot;blah(a)blah.com&quot;); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, identity, null); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, identity, null); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); - this.provisioner.newPolicy(policyMetaData); - + this.provisioner.newPolicy(policyMetaData); + this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement this.enforce(this.createEnforcementContext(contextResource, action), true); } - //------------------------------------------------------------------------------------------------------------------------------------------------------ - private void enforce(EnforcementContext enforcementContext, boolean mustBePermitted) throws Exception - { - EnforcementResponse response = this.enforcer.checkAccess(enforcementContext); - - assertNotNull(response); - log.info("-----------------------------------"); - log.info("Decision="+response.getMessage()); - - if(mustBePermitted) - { - assertTrue("Access must be granted!!!", response.isAccessGranted()); - } - else - { - assertFalse("Access must be denied!!!", response.isAccessGranted()); - } - } - - private EnforcementContext createEnforcementContext(URIResource protectedResource, Read action) throws Exception - { - // Create an EnforcementContext + // ------------------------------------------------------------------------------------------------------------------------------------------------------ + private EnforcementContext createEnforcementContext( + URIResource protectedResource, Read action) throws Exception + { + // Create an EnforcementContext EnforcementContext context = new EnforcementContext(); // Enable Hierarchial Enforcement @@ -333,16 +291,5 @@ context.setAttribute("action", action); return context; - } - - - private void assertServerState() throws Exception - { - //Assert Policy State of the Server - Policy[] policies = this.provisioner.readAllPolicies(); - - assertTrue("Policy Store must not be empty!!", (policies != null && policies.length == 1)); - log.info("------------------------------------------------------------------------------"); - log.info(policies[0].generateSystemPolicy()); } } Modified: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliedActions.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliedActions.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliedActions.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -1,35 +1,29 @@ /* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.security.authz.agent.features; import java.net.URI; -import junit.framework.TestCase; -import org.apache.log4j.Logger; - -import org.jboss.security.authz.bootstrap.ServiceContainer; - import org.jboss.security.authz.model.Effect; -import org.jboss.security.authz.model.Policy; import org.jboss.security.authz.model.PolicyMetaData; import org.jboss.security.authz.components.resource.URIResource; @@ -40,160 +34,112 @@ import org.jboss.security.authz.components.action.Manage; import org.jboss.security.authz.agent.enforcement.EnforcementContext; -import org.jboss.security.authz.agent.enforcement.EnforcementResponse; -import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; -import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.services.CompositionContext; -import org.jboss.security.authz.agent.services.PolicyComposer; - /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> */ -public class TestImpliedActions extends TestCase +public class TestImpliedActions extends AbstractFeatureTest { - private static Logger log = Logger.getLogger(TestImpliedActions.class); - - private PolicyComposer policyComposer; - private PolicyEnforcementPoint enforcer; - private PolicyProvisioner provisioner; - - - public void setUp() throws Exception - { - ServiceContainer.bootstrap(); - - this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); - this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); - this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); - } - - public void tearDown() throws Exception - { - } - public void testReadImpliedWithWrite() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/blah/index.html")); - + resource.setUri(new URI("/blah/index.html")); + Write action = new Write(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - + this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + // Go ahead and produce a RequestContext for a "Permit" Enforcement this.enforce(this.createEnforcementContext(resource, new Read()), true); } - + public void testWriteImpliedWithManage() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/blah/index.html")); - + resource.setUri(new URI("/blah/index.html")); + Manage action = new Manage(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - + this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + // Go ahead and produce a RequestContext for a "Permit" Enforcement this.enforce(this.createEnforcementContext(resource, new Write()), true); } - + public void testWriteNotImpliedWithRead() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/blah/index.html")); - + resource.setUri(new URI("/blah/index.html")); + Read action = new Read(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - + this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Deny" Enforcement + + // Go ahead and produce a RequestContext for a "Deny" Enforcement this.enforce(this.createEnforcementContext(resource, new Write()), false); } - //------------------------------------------------------------------------------------------------------------------------------------------------------ - private void enforce(EnforcementContext enforcementContext, boolean mustBePermitted) throws Exception - { - EnforcementResponse response = this.enforcer.checkAccess(enforcementContext); - - assertNotNull(response); - log.info("-----------------------------------"); - log.info("Decision="+response.getMessage()); - - if(mustBePermitted) - { - assertTrue("Access must be granted!!!", response.isAccessGranted()); - } - else - { - assertFalse("Access must be denied!!!", response.isAccessGranted()); - } - } - - private EnforcementContext createEnforcementContext(URIResource uriResource, Operation operation) throws Exception - { - //Create an EnforcementContext - EnforcementContext context = new EnforcementContext(); - - //Create Resource - context.setAttribute("uri-resource", uriResource); - - //Create Subjects - Roles roles = new Roles(); - roles.addName("user"); - context.setAttribute("roles", roles); - - //Create Action - context.setAttribute("action", operation); - - return context; - } - - private void assertServerState() throws Exception + + // ------------------------------------------------------------------------------------------------------------------------------------------------------ + private EnforcementContext createEnforcementContext(URIResource uriResource, + Operation operation) throws Exception { - //Assert Policy State of the Server - Policy[] policies = this.provisioner.readAllPolicies(); - - assertTrue("Policy Store must not be empty!!", (policies != null && policies.length == 1)); - log.info("------------------------------------------------------------------------------"); - log.info(policies[0].generateSystemPolicy()); + // Create an EnforcementContext + EnforcementContext context = new EnforcementContext(); + + // Create Resource + context.setAttribute("uri-resource", uriResource); + + // Create Subjects + Roles roles = new Roles(); + roles.addName("user"); + context.setAttribute("roles", roles); + + // Create Action + context.setAttribute("action", operation); + + return context; } } Modified: modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliesHierarchialPropagation.java =================================================================== --- modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliesHierarchialPropagation.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/agent/src/test/java/org/jboss/security/authz/agent/features/TestImpliesHierarchialPropagation.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -1,42 +1,33 @@ /* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.security.authz.agent.features; import java.net.URI; -import junit.framework.TestCase; -import org.apache.log4j.Logger; - import org.jboss.security.authz.model.Effect; -import org.jboss.security.authz.model.Policy; import org.jboss.security.authz.model.PolicyMetaData; -import org.jboss.security.authz.bootstrap.ServiceContainer; -import org.jboss.security.authz.agent.enforcement.PolicyEnforcementPoint; import org.jboss.security.authz.agent.enforcement.EnforcementContext; -import org.jboss.security.authz.agent.enforcement.EnforcementResponse; -import org.jboss.security.authz.agent.provisioning.PolicyProvisioner; import org.jboss.security.authz.agent.services.CompositionContext; -import org.jboss.security.authz.agent.services.PolicyComposer; import org.jboss.security.authz.components.resource.URIResource; import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.authz.components.action.Operation; @@ -44,244 +35,205 @@ import org.jboss.security.authz.components.action.Write; import org.jboss.security.authz.components.action.Manage; - /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> */ -public class TestImpliesHierarchialPropagation extends TestCase +public class TestImpliesHierarchialPropagation extends AbstractFeatureTest { - private static Logger log = Logger.getLogger(TestImpliesHierarchialPropagation.class); - - private PolicyComposer policyComposer; - private PolicyEnforcementPoint enforcer; - private PolicyProvisioner provisioner; - - - public void setUp() throws Exception - { - ServiceContainer.bootstrap(); - - this.policyComposer = (PolicyComposer)ServiceContainer.lookup("/agent/PolicyComposer"); - this.enforcer = (PolicyEnforcementPoint)ServiceContainer.lookup("/agent/LocalEnforcementPoint"); - this.provisioner = (PolicyProvisioner)ServiceContainer.lookup("/agent/LocalPolicyProvisioner"); - } - - public void tearDown() throws Exception - { - } - public void testExplicitPermitReadImpliedWithWrite() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); resource.setUri(new URI("/root/level1/level2/index.html")); - + Write action = new Write(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement - this.enforce(this.createEnforcementContext(contextResource, new Read()), true); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + this.enforce(this.createEnforcementContext(contextResource, new Read()), + true); } - + public void testExplicitDenyWriteNotImpliedWithRead() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1/level2/index.html")); - + resource.setUri(new URI("/root/level1/level2/index.html")); + Read action = new Read(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement - this.enforce(this.createEnforcementContext(contextResource, new Write()), false); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + this.enforce(this.createEnforcementContext(contextResource, new Write()), + false); } - + public void testPermitInheritanceWriteImpliedWithManage() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1")); - + resource.setUri(new URI("/root/level1")); + Manage action = new Manage(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement - this.enforce(this.createEnforcementContext(contextResource, new Write()), true); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + this.enforce(this.createEnforcementContext(contextResource, new Write()), + true); } - + public void testDenyInheritanceManageNotImpliedWithWrite() throws Exception { - //SetUp Resource + // SetUp Resource URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1")); - + resource.setUri(new URI("/root/level1")); + Write action = new Write(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - this.assertServerState(); - - //Go ahead and produce a RequestContext for a "Permit" Enforcement + + this.assertServerState(); + + // Go ahead and produce a RequestContext for a "Permit" Enforcement URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement - this.enforce(this.createEnforcementContext(contextResource, new Manage()), false); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + this.enforce(this.createEnforcementContext(contextResource, new Manage()), + false); } - + public void testDenyOverridesPermitInheritance() throws Exception { - //SetUp Permit policy...User can write to level1 + // SetUp Permit policy...User can write to level1 URIResource resource = new URIResource(); - resource.setUri(new URI("/root/level1")); - + resource.setUri(new URI("/root/level1")); + Write action = new Write(); - + Roles allowedRoles = new Roles(); allowedRoles.addName("user"); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components CompositionContext context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, action, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, action, allowedRoles, + "allowExpression"); + + // Store the policy into the Policy Server PolicyMetaData policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - //Setup denied policy....User can only read level2 + + // Setup denied policy....User can only read level2 resource = new URIResource(); resource.setUri(new URI("/root/level1/level2")); - + Read read = new Read(); - - //Setup the Context for the Composition with these components + + // Setup the Context for the Composition with these components context = new CompositionContext(); context.setPolicyTarget(resource); - context.addPolicyRule(Effect.PERMIT, read, allowedRoles, "allowExpression"); - - //Store the policy into the Policy Server + context.addPolicyRule(Effect.PERMIT, read, allowedRoles, "allowExpression"); + + // Store the policy into the Policy Server policyMetaData = this.policyComposer.compose(context); this.provisioner.newPolicy(policyMetaData); - - - //Go ahead and produce a RequestContext for a "Permit" Enforcement - //Trying to "Write" to level2 should be Denied + + // Go ahead and produce a RequestContext for a "Permit" Enforcement + // Trying to "Write" to level2 should be Denied URIResource contextResource = new URIResource(); - contextResource.setUri(new URI("/root/level1/level2/index.html")); - - //Perform enforcement - this.enforce(this.createEnforcementContext(contextResource, new Write()), false); - } - //------------------------------------------------------------------------------------------------------------------------------------------------------ - private void enforce(EnforcementContext enforcementContext, boolean mustBePermitted) throws Exception - { - EnforcementResponse response = this.enforcer.checkAccess(enforcementContext); - - assertNotNull(response); - log.info("-----------------------------------"); - log.info("Decision="+response.getMessage()); - - if(mustBePermitted) - { - assertTrue("Access must be granted!!!", response.isAccessGranted()); - } - else - { - assertFalse("Access must be denied!!!", response.isAccessGranted()); - } + contextResource.setUri(new URI("/root/level1/level2/index.html")); + + // Perform enforcement + this.enforce(this.createEnforcementContext(contextResource, new Write()), + false); } - - private EnforcementContext createEnforcementContext(URIResource uriResource, Operation action) throws Exception - { - //Create a EnforcementContext - EnforcementContext context = new EnforcementContext(); - - //Enable Hierarchial Enforcement - context.activateHierarchialEnforcement(); - - //Create Resource - context.setAttribute("uri-resource", uriResource); - - //Create Subjects - Roles roles = new Roles(); - roles.addName("user"); - context.setAttribute("roles", roles); - - //Create Action - context.setAttribute("action", action); - - return context; - } - - private void assertServerState() throws Exception + //------------------------------------------------------------------------------------------------------------------------------------------ + private EnforcementContext createEnforcementContext(URIResource uriResource, + Operation action) throws Exception { - //Assert Policy State of the Server - Policy[] policies = this.provisioner.readAllPolicies(); - - assertTrue("Policy Store must not be empty!!", (policies != null && policies.length == 1)); - log.info("------------------------------------------------------------------------------"); - log.info(policies[0].generateSystemPolicy()); + // Create a EnforcementContext + EnforcementContext context = new EnforcementContext(); + + // Enable Hierarchial Enforcement + context.activateHierarchialEnforcement(); + + // Create Resource + context.setAttribute("uri-resource", uriResource); + + // Create Subjects + Roles roles = new Roles(); + roles.addName("user"); + context.setAttribute("roles", roles); + + // Create Action + context.setAttribute("action", action); + + return context; } } Added: modules/authorization/trunk/agent/src/test/resources/hibernate.cfg.xml =================================================================== --- modules/authorization/trunk/agent/src/test/resources/hibernate.cfg.xml (rev 0) +++ modules/authorization/trunk/agent/src/test/resources/hibernate.cfg.xml 2009-08-07 18:02:40 UTC (rev 13700) @@ -0,0 +1,59 @@ +<?xml version='1.0' encoding='utf-8'?> +<!--~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ~ JBoss, a division of Red Hat ~ + ~ Copyright 2006, Red Hat Middleware, LLC, and individual ~ + ~ contributors as indicated by the @authors tag. See the ~ + ~ copyright.txt in the distribution for a full listing of ~ + ~ individual contributors. ~ + ~ ~ + ~ This is free software; you can redistribute it and/or modify it ~ + ~ under the terms of the GNU Lesser General Public License as ~ + ~ published by the Free Software Foundation; either version 2.1 of ~ + ~ the License, or (at your option) any later version. ~ + ~ ~ + ~ This software is distributed in the hope that it will be useful, ~ + ~ but WITHOUT ANY WARRANTY; without even the implied warranty of ~ + ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ~ + ~ Lesser General Public License for more details. ~ + ~ ~ + ~ You should have received a copy of the GNU Lesser General Public ~ + ~ License along with this software; if not, write to the Free ~ + ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA ~ + ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org. ~ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--> + +<!DOCTYPE hibernate-configuration PUBLIC + "-//Hibernate/Hibernate Configuration DTD//EN" + "http://hibernate.sourceforge.net/hibernate-configuration-3.0.dtd"> + +<hibernate-configuration> + <session-factory> + <!-- Database connection settings --> + <property name="connection.driver_class">org.hsqldb.jdbcDriver</property> + <property name="connection.url">jdbc:hsqldb:file:target/testdb</property> + <property name="connection.username">sa</property> + <property name="connection.password"></property> + + <!-- JDBC connection pool (use the built-in) --> + <property name="connection.pool_size">1</property> + + <!-- SQL dialect --> + <property name="dialect">org.hibernate.dialect.HSQLDialect</property> + + <!-- Enable Hibernate's automatic session context management --> + <property name="current_session_context_class">thread</property> + + <!-- Disable the second-level cache --> + <property name="cache.provider_class">org.hibernate.cache.NoCacheProvider</property> + + <!-- Echo all executed SQL to stdout --> + <property name="show_sql">true</property> + + <!-- + Drop and re-create the database schema on startup + --> + <property name="hbm2ddl.auto">create</property> + + <mapping resource="policy.hbm.xml"/> + </session-factory> +</hibernate-configuration> \ No newline at end of file Modified: modules/authorization/trunk/common-api/src/main/java/org/jboss/security/authz/bootstrap/ServiceContainer.java =================================================================== --- modules/authorization/trunk/common-api/src/main/java/org/jboss/security/authz/bootstrap/ServiceContainer.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/common-api/src/main/java/org/jboss/security/authz/bootstrap/ServiceContainer.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -40,6 +40,7 @@ private static Logger log = Logger.getLogger(ServiceContainer.class); private static Kernel kernel; + private static EmbeddedBootstrap bootstrap; public ServiceContainer() { @@ -50,7 +51,7 @@ { try { - EmbeddedBootstrap bootstrap = new EmbeddedBootstrap(); + bootstrap = new EmbeddedBootstrap(); bootstrap.run(); ClassLoader cl = Thread.currentThread().getContextClassLoader(); @@ -84,4 +85,9 @@ return service; } + + public static void shutdown() + { + bootstrap.deployer.shutdown(); + } } Added: modules/authorization/trunk/http-profile/src/test/resources/hibernate.cfg.xml =================================================================== --- modules/authorization/trunk/http-profile/src/test/resources/hibernate.cfg.xml (rev 0) +++ modules/authorization/trunk/http-profile/src/test/resources/hibernate.cfg.xml 2009-08-07 18:02:40 UTC (rev 13700) @@ -0,0 +1,59 @@ +<?xml version='1.0' encoding='utf-8'?> +<!--~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ~ JBoss, a division of Red Hat ~ + ~ Copyright 2006, Red Hat Middleware, LLC, and individual ~ + ~ contributors as indicated by the @authors tag. See the ~ + ~ copyright.txt in the distribution for a full listing of ~ + ~ individual contributors. ~ + ~ ~ + ~ This is free software; you can redistribute it and/or modify it ~ + ~ under the terms of the GNU Lesser General Public License as ~ + ~ published by the Free Software Foundation; either version 2.1 of ~ + ~ the License, or (at your option) any later version. ~ + ~ ~ + ~ This software is distributed in the hope that it will be useful, ~ + ~ but WITHOUT ANY WARRANTY; without even the implied warranty of ~ + ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ~ + ~ Lesser General Public License for more details. ~ + ~ ~ + ~ You should have received a copy of the GNU Lesser General Public ~ + ~ License along with this software; if not, write to the Free ~ + ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA ~ + ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org. ~ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--> + +<!DOCTYPE hibernate-configuration PUBLIC + "-//Hibernate/Hibernate Configuration DTD//EN" + "http://hibernate.sourceforge.net/hibernate-configuration-3.0.dtd"> + +<hibernate-configuration> + <session-factory> + <!-- Database connection settings --> + <property name="connection.driver_class">org.hsqldb.jdbcDriver</property> + <property name="connection.url">jdbc:hsqldb:file:target/testdb</property> + <property name="connection.username">sa</property> + <property name="connection.password"></property> + + <!-- JDBC connection pool (use the built-in) --> + <property name="connection.pool_size">1</property> + + <!-- SQL dialect --> + <property name="dialect">org.hibernate.dialect.HSQLDialect</property> + + <!-- Enable Hibernate's automatic session context management --> + <property name="current_session_context_class">thread</property> + + <!-- Disable the second-level cache --> + <property name="cache.provider_class">org.hibernate.cache.NoCacheProvider</property> + + <!-- Echo all executed SQL to stdout --> + <property name="show_sql">true</property> + + <!-- + Drop and re-create the database schema on startup + --> + <property name="hbm2ddl.auto">create</property> + + <mapping resource="policy.hbm.xml"/> + </session-factory> +</hibernate-configuration> \ No newline at end of file Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -1,24 +1,24 @@ /* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, a division of Red Hat + * Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.security.authz.policy.server; import java.util.Set; @@ -39,100 +39,108 @@ import org.jboss.security.authz.policy.server.plugin.EnterprisePolicyFinderModule; import org.jboss.security.authz.policy.server.plugin.DroolsRuleManager; - import org.jboss.security.xacml.sunxacml.finder.PolicyFinderModule; /** - * The Central Policy Server + * The Central Policy Server * * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> */ -public class PolicyServer +public class PolicyServer { private static Logger log = Logger.getLogger(PolicyServer.class); - + private PolicyDecisionPoint policyDecisionPoint; private PolicyStore policyStore; private EnterprisePolicyFinderModule policyFinderModule; private DroolsRuleManager ruleManager; - + public PolicyServer() { - + } - + public void start() { try { - Set<PolicyFinderModule> finders = this.policyDecisionPoint.getPDPConfiguration().getPolicyFinder().getModules(); - for(PolicyFinderModule module: finders) + Set<PolicyFinderModule> finders = this.policyDecisionPoint + .getPDPConfiguration().getPolicyFinder().getModules(); + for (PolicyFinderModule module : finders) { - if(module instanceof EnterprisePolicyFinderModule) + if (module instanceof EnterprisePolicyFinderModule) { - this.policyFinderModule = (EnterprisePolicyFinderModule)module; + this.policyFinderModule = (EnterprisePolicyFinderModule) module; + this.policyFinderModule.setPolicyStore(this.policyStore); + this.policyFinderModule.bootup(); } } } - catch(Exception e) + catch (Exception e) { throw new RuntimeException(e); } } - + public void stop() { this.policyDecisionPoint = null; } - - public PolicyDecisionPoint getPolicyDecisionPoint() + + public PolicyDecisionPoint getPolicyDecisionPoint() { return policyDecisionPoint; } - public void setPolicyDecisionPoint(PolicyDecisionPoint policyDecisionPoint) + public void setPolicyDecisionPoint(PolicyDecisionPoint policyDecisionPoint) { this.policyDecisionPoint = policyDecisionPoint; } - - public PolicyStore getPolicyStore() + + public PolicyStore getPolicyStore() { return policyStore; } - public void setPolicyStore(PolicyStore policyStore) + public void setPolicyStore(PolicyStore policyStore) { this.policyStore = policyStore; } - + public DroolsRuleManager getRuleManager() { return this.ruleManager; } - + public void setRuleManager(DroolsRuleManager ruleManager) { this.ruleManager = ruleManager; } - //--------Decision making services-------------------------------------------------------------------------------------------------------------------------- + + // --------Decision making + // services-------------------------------------------------------------------------------------------------------------------------- /** * Makes an Authorization Decision * - * This method is used when the PolicyDecisionPoint runs in-memory with the Application from which the native Enforcement components issue Authorization requests + * This method is used when the PolicyDecisionPoint runs in-memory with the + * Application from which the native Enforcement components issue + * Authorization requests * - * @param request Authorization Request + * @param request + * Authorization Request * @return response which contains the Authorization Decision */ public Response evaluate(Request request) throws PolicyServerException { return this.policyDecisionPoint.evaluate(request); } - + /** * Makes an Authorization Decision * - * This method is used when the PolicyDecisionPoint is accessed over the network by sending it the appropriate request in XML format - * The XML format used is compliant with the XACML spec + * This method is used when the PolicyDecisionPoint is accessed over the + * network by sending it the appropriate request in XML format The XML format + * used is compliant with the XACML spec * * @param xml * @return response in xml format confirming to the XACML spec @@ -140,91 +148,99 @@ public String evaluate(String xml) throws PolicyServerException { return this.policyDecisionPoint.evaluate(xml); - } - //------- Provisioning services----------------------------------------------------------------------------------------------------------------------------- - /** - * Generates a new Policy instance based on the supplied MetaData and stores it into the Policy Store - * - * @param policyMetaData meta data for the policy to be created - */ - public void newPolicy(PolicyMetaData policyMetaData) throws PolicyServerException - { - try - { - Policy policy = new XACMLPolicy(GeneralTool.generateUniqueId(), policyMetaData); - - //Save the policy in the Policy Store - this.policyStore.savePolicy(policy); - - //Update the PolicyFinder's runtime state with this new policy - this.policyFinderModule.addPolicy(policy); - - //Update the DroolsRuleManager's runtime state with any Drools based expressions if they are part of this new policy - Set<Rule> rules = policyMetaData.getRules(); - for(Rule rule: rules) - { - Object expression = rule.getExpression(); - if(expression instanceof DroolsRuleExpression) + } + + // ------- Provisioning + // services----------------------------------------------------------------------------------------------------------------------------- + /** + * Generates a new Policy instance based on the supplied MetaData and stores + * it into the Policy Store + * + * @param policyMetaData + * meta data for the policy to be created + */ + public void newPolicy(PolicyMetaData policyMetaData) + throws PolicyServerException + { + try + { + Policy policy = new XACMLPolicy(GeneralTool.generateUniqueId(), + policyMetaData); + + // Save the policy in the Policy Store + this.policyStore.savePolicy(policy); + + // Update the PolicyFinder's runtime state with this new policy + this.policyFinderModule.addPolicy(policy); + + // Update the DroolsRuleManager's runtime state with any Drools based + // expressions if they are part of this new policy + Set<Rule> rules = policyMetaData.getRules(); + for (Rule rule : rules) { - this.ruleManager.addRule((DroolsRuleExpression)expression); + Object expression = rule.getExpression(); + if (expression instanceof DroolsRuleExpression) + { + this.ruleManager.addRule((DroolsRuleExpression) expression); + } } - } - } - catch(PolicyException pe) - { - throw new PolicyServerException(pe); - } - } - - /** - * Read a stored Policy identified by the unique policyUri - * - * @param policyUri - * @return a stored Policy - */ - public Policy readPolicy(String policyUri) throws PolicyServerException - { - try - { - return this.policyStore.readPolicy(policyUri); - } - catch(PolicyException pe) - { - throw new PolicyServerException(pe); - } - } - - /** - * Returns all the stored Policies for the system - * - * @return all the stored Policies - */ - public Policy[] readAllPolicies() throws PolicyServerException - { - try - { - return this.policyStore.readAllPolicies(); - } - catch(PolicyException pe) - { - throw new PolicyServerException(pe); - } - } - - /** - * Deletes the specified Policy from storage - * - * @param policyUri unique identifier for the Policy - */ - public void deletePolicy(String policyUri) throws PolicyServerException - { - try - { - this.policyStore.deletePolicy(policyUri); - } - catch(PolicyException pe) - { - throw new PolicyServerException(pe); - } - } + } + catch (PolicyException pe) + { + throw new PolicyServerException(pe); + } + } + + /** + * Read a stored Policy identified by the unique policyUri + * + * @param policyUri + * @return a stored Policy + */ + public Policy readPolicy(String policyUri) throws PolicyServerException + { + try + { + return this.policyStore.readPolicy(policyUri); + } + catch (PolicyException pe) + { + throw new PolicyServerException(pe); + } + } + + /** + * Returns all the stored Policies for the system + * + * @return all the stored Policies + */ + public Policy[] readAllPolicies() throws PolicyServerException + { + try + { + return this.policyStore.readAllPolicies(); + } + catch (PolicyException pe) + { + throw new PolicyServerException(pe); + } + } + + /** + * Deletes the specified Policy from storage + * + * @param policyUri + * unique identifier for the Policy + */ + public void deletePolicy(String policyUri) throws PolicyServerException + { + try + { + this.policyStore.deletePolicy(policyUri); + } + catch (PolicyException pe) + { + throw new PolicyServerException(pe); + } + } } Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/DroolsRuleManager.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -22,182 +22,245 @@ ******************************************************************************/ package org.jboss.security.authz.policy.server.plugin; +import java.util.List; import java.io.InputStreamReader; import java.io.Reader; import java.io.ByteArrayInputStream; import java.util.Map; import java.util.HashMap; +import org.apache.log4j.Logger; + +import org.hibernate.Session; +import org.hibernate.Transaction; + import org.drools.RuleBase; import org.drools.RuleBaseFactory; import org.drools.compiler.PackageBuilder; import org.jboss.security.authz.model.DroolsRuleExpression; +import org.jboss.security.authz.policy.server.tools.HibernateService; /** - * This service provides management for Drools based authorization Rules/Logic used by the Drools Function extension of the XACML Engine + * This service provides management for Drools based authorization Rules/Logic + * used by the Drools Function extension of the XACML Engine * * TODO: Add Database Persistence to the State of this Manager - * + * * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - * + * */ public final class DroolsRuleManager { - private static String rulePkg = - "package security\n"+ - "import org.jboss.security.authz.model.*;\n"+ - "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; - - private RuleBase activeRuleBase = null; - private Map<String, String> drls = null; - - public DroolsRuleManager() - { - } - - public void start() - { - try - { - this.drls = new HashMap<String, String>(); - this.reloadActiveRuleBase(); - } - catch(Exception e) - { - throw new RuntimeException(e); - } - } - - public void stop() - { - this.activeRuleBase = null; - this.drls = null; - } - //--------------------------------------------------------------------------------------------------------------------------------------------------------- - RuleBase getActiveRuleBase() - { - return this.activeRuleBase; - } - - public void addRule(DroolsRuleExpression rule) - { - try - { - if(rule.getRuleReference() == null || rule.getRuleReference().trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - if(rule.getRule() == null || rule.getRule().trim().length() == 0) - { - throw new IllegalArgumentException("LHS value is missing"); - } - - - this.drls.put(rule.getRuleReference(), rule.getRule()); - this.reloadActiveRuleBase(); - } - catch(Exception e) - { - throw new RuntimeException(e); - } - } - - public DroolsRuleExpression readRule(String ruleReference) - { - try - { - if(ruleReference == null || ruleReference.trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - - DroolsRuleExpression rule = null; - - String when = this.drls.get(ruleReference); - - rule = new DroolsRuleExpression(); - rule.setRuleReference(ruleReference); - rule.setRule(when); - - return rule; - } - catch(Exception e) - { - throw new RuntimeException(e); - } - } - - public void updateRule(DroolsRuleExpression rule) - { - try - { - if(rule.getRuleReference() == null || rule.getRuleReference().trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - if(rule.getRule() == null || rule.getRule().trim().length() == 0) - { - throw new IllegalArgumentException("LHS value is missing"); - } - - this.drls.put(rule.getRuleReference(), rule.getRule()); - this.reloadActiveRuleBase(); - } - catch(Exception e) - { - throw new RuntimeException(e); - } - } - - public void removeRule(String ruleReference) - { - try - { - if(ruleReference == null || ruleReference.trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - - this.drls.remove(ruleReference); - this.reloadActiveRuleBase(); - } - catch(Exception e) - { - throw new RuntimeException(e); - } - } - //----------------------------------------------------------------------------------------------------------------------------------------------------------- - private synchronized void reloadActiveRuleBase() throws Exception - { - StringBuilder buffer = new StringBuilder(); - - buffer.append(DroolsRuleManager.rulePkg+"\n"); - - for(String drl: this.drls.values()) - { - buffer.append(drl+"\n"); - } - - Reader source = new InputStreamReader(new ByteArrayInputStream(buffer.toString().getBytes())); - try - { - PackageBuilder packageBuilder = new PackageBuilder(); - packageBuilder.addPackageFromDrl(source); - - if(this.activeRuleBase == null) - { - this.activeRuleBase = RuleBaseFactory.newRuleBase(); - } - - //Perform the reloading of the RuleBase with the updated Rules - this.activeRuleBase.lock(); - this.activeRuleBase.addPackage(packageBuilder.getPackage()); - this.activeRuleBase.unlock(); - } - finally - { - source.close(); - } - } + private static Logger log = Logger.getLogger(DroolsRuleManager.class); + + private static String rulePkg = "package security\n" + + "import org.jboss.security.authz.model.*;\n" + + "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; + + private RuleBase activeRuleBase = null; + private Map<String, String> drls = null; + private HibernateService hibernateService; + + public DroolsRuleManager() + { + } + + public void start() + { + try + { + this.drls = new HashMap<String, String>(); + this.bootup(); + + this.reloadActiveRuleBase(); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + public void stop() + { + this.activeRuleBase = null; + this.drls = null; + } + + public HibernateService getHibernateService() + { + return hibernateService; + } + + public void setHibernateService(HibernateService hibernateService) + { + this.hibernateService = hibernateService; + } + // --------------------------------------------------------------------------------------------------------------------------------------------------------- + RuleBase getActiveRuleBase() + { + return this.activeRuleBase; + } + + public void addRule(DroolsRuleExpression rule) + { + try + { + if (rule.getRuleReference() == null + || rule.getRuleReference().trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + if (rule.getRule() == null || rule.getRule().trim().length() == 0) + { + throw new IllegalArgumentException("LHS value is missing"); + } + + this.drls.put(rule.getRuleReference(), rule.getRule()); + this.reloadActiveRuleBase(); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + public DroolsRuleExpression readRule(String ruleReference) + { + try + { + if (ruleReference == null || ruleReference.trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + + DroolsRuleExpression rule = null; + + String when = this.drls.get(ruleReference); + + rule = new DroolsRuleExpression(); + rule.setRuleReference(ruleReference); + rule.setRule(when); + + return rule; + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + public void updateRule(DroolsRuleExpression rule) + { + try + { + if (rule.getRuleReference() == null + || rule.getRuleReference().trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + if (rule.getRule() == null || rule.getRule().trim().length() == 0) + { + throw new IllegalArgumentException("LHS value is missing"); + } + + this.drls.put(rule.getRuleReference(), rule.getRule()); + this.reloadActiveRuleBase(); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + public void removeRule(String ruleReference) + { + try + { + if (ruleReference == null || ruleReference.trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + + this.drls.remove(ruleReference); + this.reloadActiveRuleBase(); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + // ----------------------------------------------------------------------------------------------------------------------------------------------------------- + private synchronized void reloadActiveRuleBase() throws Exception + { + StringBuilder buffer = new StringBuilder(); + + buffer.append(DroolsRuleManager.rulePkg + "\n"); + + for (String drl : this.drls.values()) + { + buffer.append(drl + "\n"); + } + + Reader source = new InputStreamReader(new ByteArrayInputStream(buffer + .toString().getBytes())); + try + { + PackageBuilder packageBuilder = new PackageBuilder(); + packageBuilder.addPackageFromDrl(source); + + if (this.activeRuleBase == null) + { + this.activeRuleBase = RuleBaseFactory.newRuleBase(); + } + + // Perform the reloading of the RuleBase with the updated Rules + this.activeRuleBase.lock(); + this.activeRuleBase.addPackage(packageBuilder.getPackage()); + this.activeRuleBase.unlock(); + } + finally + { + source.close(); + } + } + + private void bootup() throws Exception + { + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = hibernateService.getCurrentSession(); + tx = session.beginTransaction(); + + List allDroolsRuleExpressions = session.createQuery("from DroolsRuleExpression").list(); + + if(allDroolsRuleExpressions != null) + { + for(Object local: allDroolsRuleExpressions) + { + DroolsRuleExpression drlExpr = (DroolsRuleExpression)local; + this.drls.put(drlExpr.getRuleReference(), drlExpr.getRule()); + } + } + + tx.commit(); + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } + } } Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -28,6 +28,7 @@ import org.apache.log4j.Logger; import org.jboss.security.authz.model.Policy; +import org.jboss.security.authz.policy.server.spi.PolicyStore; import org.jboss.security.authz.policy.server.PolicyServerException; import org.jboss.security.xacml.sunxacml.EvaluationCtx; @@ -58,12 +59,38 @@ private PolicyReader reader; private PolicyCollection policies; + private PolicyStore policyStore; public EnterprisePolicyFinderModule() { this.policies = new PolicyCollection(); } + public void bootup() throws PolicyServerException + { + try + { + //Load the persisted Policies into the Finder's memory + log.info("------------------------------------------------------------------"); + log.info("Booting Up the Policy Rule Engine................................."); + Policy[] allPolicies = this.policyStore.readAllPolicies(); + if(allPolicies != null) + { + for(Policy policy: allPolicies) + { + this.addPolicy(policy); + } + log.info("Rule Engine successfully started with ["+allPolicies.length+"] stored Policies"); + } + log.info("------------------------------------------------------------------"); + } + catch(Throwable t) + { + log.error(this, t); + throw new PolicyServerException(t); + } + } + public void addPolicy(Policy policy) throws PolicyServerException { ByteArrayInputStream bos = null; @@ -92,6 +119,16 @@ } } } + + public PolicyStore getPolicyStore() + { + return policyStore; + } + + public void setPolicyStore(PolicyStore policyStore) + { + this.policyStore = policyStore; + } //-----------PolicyFinderModule Implementation------------------------------------------------------------------------------------------------------------ /** * Initializes this module for use by the given finder. Typically this Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/provisioning/RelationalDBPolicyStore.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/provisioning/RelationalDBPolicyStore.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/provisioning/RelationalDBPolicyStore.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -22,18 +22,22 @@ ******************************************************************************/ package org.jboss.security.authz.policy.server.provisioning; -import java.util.Map; -import java.util.HashMap; +import java.util.List; +import java.util.Set; +import java.util.HashSet; import org.apache.log4j.Logger; -import org.hibernate.SessionFactory; -import org.hibernate.cfg.Configuration; +import org.hibernate.Session; +import org.hibernate.Transaction; import org.jboss.security.authz.model.Policy; import org.jboss.security.authz.model.PolicyException; +import org.jboss.security.authz.model.Attribute; + import org.jboss.security.authz.policy.server.spi.PolicyStore; +import org.jboss.security.authz.policy.server.tools.HibernateService; /** * This Policy Store stores the system Policies into a Relational Database @@ -44,40 +48,31 @@ public class RelationalDBPolicyStore implements PolicyStore { private static Logger log = Logger.getLogger(RelationalDBPolicyStore.class); + + private HibernateService hibernateService; - private Map<String, Policy> policies; - - SessionFactory sessionFactory; - public RelationalDBPolicyStore() { - this.policies = new HashMap<String, Policy>(); } public void start() - { - try - { - Configuration configuration = new Configuration(); - this.sessionFactory = configuration.configure().buildSessionFactory(); - log - .info("-----------------------------------------------------------------------"); - log - .info("In-Memory Policy Store successfully started............................"); - log - .info("-----------------------------------------------------------------------"); - } - catch(Throwable t) - { - log.error(this, t); - throw new RuntimeException(t); - } + { } public void stop() + { + } + + + public HibernateService getHibernateService() { - this.sessionFactory.close(); - } + return hibernateService; + } + + public void setHibernateService(HibernateService hibernateService) + { + this.hibernateService = hibernateService; + } // ----------------------------------------------------------------------------------------------------------------------------------------------------------- /** * Read a stored Policy identified by the unique policyUri @@ -87,7 +82,7 @@ */ public Policy readPolicy(String policyUri) throws PolicyException { - return this.policies.get(policyUri); + return null; } /** @@ -97,7 +92,39 @@ */ public Policy[] readAllPolicies() throws PolicyException { - return this.policies.values().toArray(new Policy[0]); + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = hibernateService.getCurrentSession(); + tx = session.beginTransaction(); + + List allPolicies = session.createQuery("from XACMLPolicy").list(); + + Policy[] policies = null; + if(allPolicies != null && !allPolicies.isEmpty()) + { + policies = (Policy[])allPolicies.toArray(new Policy[allPolicies.size()]); + } + + tx.commit(); + + return policies; + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } } /** @@ -108,8 +135,32 @@ * Policy to be saved into storage */ public void savePolicy(Policy policy) throws PolicyException - { - this.policies.put(policy.getPolicyUri(), policy); + { + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = hibernateService.getCurrentSession(); + tx = session.beginTransaction(); + + session.saveOrUpdate(policy); + + tx.commit(); + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } } /** @@ -120,6 +171,37 @@ */ public void deletePolicy(String policyUri) throws PolicyException { - this.policies.remove(policyUri); + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = hibernateService.getCurrentSession(); + tx = session.beginTransaction(); + + session.createQuery("delete from XACMLPolicy policy where policy.policyUri=?").setString(0, policyUri). + executeUpdate(); + + tx.commit(); + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } } + //------------------------------------------------------------------------------------------------------------------------------------------------------------ + public Set<Policy> find(Set<Attribute> attributes) throws PolicyException + { + Set<Policy> policyPage = new HashSet<Policy>(); + return policyPage; + } } Added: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/Cursor.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/Cursor.java (rev 0) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/Cursor.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -0,0 +1,56 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.policy.server.spi; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class Cursor +{ + private int currentPosition; + private int capacity; + + public Cursor() + { + + } + + public int getCurrentPosition() + { + return currentPosition; + } + + public void setCurrentPosition(int currentPosition) + { + this.currentPosition = currentPosition; + } + + public int getCapacity() + { + return capacity; + } + + public void setCapacity(int capacity) + { + this.capacity = capacity; + } +} Added: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/tools/HibernateService.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/tools/HibernateService.java (rev 0) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/tools/HibernateService.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -0,0 +1,67 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.policy.server.tools; + +import org.apache.log4j.Logger; + +import org.hibernate.SessionFactory; +import org.hibernate.Session; +import org.hibernate.cfg.Configuration; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class HibernateService +{ + private static Logger log = Logger.getLogger(HibernateService.class); + + private SessionFactory sessionFactory; + + public HibernateService() + { + + } + + public void start() + { + try + { + Configuration configuration = new Configuration(); + this.sessionFactory = configuration.configure().buildSessionFactory(); + } + catch(Throwable t) + { + log.error(this, t); + throw new RuntimeException(t); + } + } + + public void stop() + { + this.sessionFactory.close(); + } + //-------------------------------------------------------------------------------------------------------------------------------------- + public Session getCurrentSession() + { + return this.sessionFactory.getCurrentSession(); + } +} Modified: modules/authorization/trunk/policy-server/src/main/resources/META-INF/authz-config.xml =================================================================== --- modules/authorization/trunk/policy-server/src/main/resources/META-INF/authz-config.xml 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/main/resources/META-INF/authz-config.xml 2009-08-07 18:02:40 UTC (rev 13700) @@ -23,8 +23,17 @@ </bean> <bean name="/policy-server/PolicyStore" class="org.jboss.security.authz.policy.server.provisioning.RelationalDBPolicyStore"> + <property name="hibernateService"> + <inject bean="/policy-server/HibernateService"/> + </property> </bean> <bean name="/policy-server/DroolsRuleManager" class="org.jboss.security.authz.policy.server.plugin.DroolsRuleManager"> + <property name="hibernateService"> + <inject bean="/policy-server/HibernateService"/> + </property> + </bean> + + <bean name="/policy-server/HibernateService" class="org.jboss.security.authz.policy.server.tools.HibernateService"> </bean> </deployment> \ No newline at end of file Modified: modules/authorization/trunk/policy-server/src/main/resources/policy.hbm.xml =================================================================== --- modules/authorization/trunk/policy-server/src/main/resources/policy.hbm.xml 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/main/resources/policy.hbm.xml 2009-08-07 18:02:40 UTC (rev 13700) @@ -33,6 +33,7 @@ </id> <property name="policyUri" not-null="true" + unique="true" /> <!-- one-to-one unidirectional relationship with the PolicyMetaData object --> <many-to-one name="metaData" @@ -105,6 +106,7 @@ </id> <property name="ruleId" not-null="true" + unique="true" /> <property name="effect" not-null="true" @@ -148,7 +150,7 @@ /> </subclass> <subclass name="org.jboss.security.authz.model.DroolsRuleExpression" discriminator-value="DROOLS_EXPR"> - <property name="ruleReference"/> + <property name="ruleReference" unique="true"/> <property name="rule"/> </subclass> </class> Modified: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRuleManager.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -22,7 +22,6 @@ ******************************************************************************/ package org.jboss.security.authz.policy.server.plugin; - import junit.framework.TestCase; import org.drools.WorkingMemory; @@ -32,104 +31,104 @@ import org.jboss.security.xacml.interfaces.XMLSchemaConstants; import org.jboss.security.authz.model.*; import org.jboss.security.authz.policy.server.plugin.DroolsRuleManager; +import org.jboss.security.authz.bootstrap.ServiceContainer; /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - * + * */ public class TestDroolsRuleManager extends TestCase { - private static final String rule1 = - "rule \"Rule1\"\n"+ - "when\n"+ - "$subject: Subject()\n"+ - "String(toString == \"Rule1\")\n"+ - "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ - "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ - "then\n"+ - "System.out.println(\"Rule1 successfully fired\");\n"+ - "end\n"; - - private static final String rule2 = - "rule \"Rule2\"\n"+ - "when\n"+ - "$subject: Subject()\n"+ - "String(toString == \"Rule2\")\n"+ - "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ - "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ - "then\n"+ - "System.out.println(\"Rule2 successfully fired\");\n"+ - "end\n"; - - - private DroolsRuleManager ruleManager = null; - - - @Override - protected void setUp() throws Exception - { - this.ruleManager = new DroolsRuleManager(); - this.ruleManager.start(); - } + private static final String rule1 = "rule \"Rule1\"\n" + + "when\n" + + "$subject: Subject()\n" + + "String(toString == \"Rule1\")\n" + + "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n" + + "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n" + + "then\n" + "System.out.println(\"Rule1 successfully fired\");\n" + + "end\n"; - @Override - protected void tearDown() throws Exception - { - this.ruleManager = null; - } - //------------------------------------------------------------------------------------------------------------------------------------------------------------ - public void testAddRule() throws Exception - { - DroolsRuleExpression expression = new DroolsRuleExpression(); - expression.setRuleReference("Rule2"); - expression.setRule(TestDroolsRuleManager.rule2); - this.ruleManager.addRule(expression); - - WorkingMemory workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule2"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule2........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - - expression.setRuleReference("Rule1"); - expression.setRule(TestDroolsRuleManager.rule1); - this.ruleManager.addRule(expression); - - workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule1"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule1........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - - workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule2"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule2........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - } - //----------------------------------------------------------------------------------------------------------------------------------------------------------- - private Subject getSubject() - { - Subject subject = new Subject(); - - subject.setCategory(XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT); - - //Create a Role Attribute - Attribute attribute = new Attribute(); - attribute.setUri(XACMLConstants.ATTRIBUTEID_ROLE); - attribute.setDataType(XMLSchemaConstants.DATATYPE_STRING); - attribute.setValue("developer"); - subject.addAttribute(attribute); - - return subject; - } + private static final String rule2 = "rule \"Rule2\"\n" + + "when\n" + + "$subject: Subject()\n" + + "String(toString == \"Rule2\")\n" + + "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n" + + "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n" + + "then\n" + "System.out.println(\"Rule2 successfully fired\");\n" + + "end\n"; + + private DroolsRuleManager ruleManager = null; + + @Override + protected void setUp() throws Exception + { + ServiceContainer.bootstrap(); + + this.ruleManager = (DroolsRuleManager) ServiceContainer + .lookup("/policy-server/DroolsRuleManager"); + } + + @Override + protected void tearDown() throws Exception + { + this.ruleManager = null; + } + + // ------------------------------------------------------------------------------------------------------------------------------------------------------------ + public void testAddRule() throws Exception + { + DroolsRuleExpression expression = new DroolsRuleExpression(); + expression.setRuleReference("Rule2"); + expression.setRule(TestDroolsRuleManager.rule2); + this.ruleManager.addRule(expression); + + WorkingMemory workingMemory = ruleManager.getActiveRuleBase() + .newStatefulSession(); + workingMemory.insert("Rule2"); + workingMemory.insert(this.getSubject()); + + // Fire + System.out.println("Firing Rule2........"); + workingMemory.fireAllRules(); + ((StatefulSession) workingMemory).dispose(); + + expression.setRuleReference("Rule1"); + expression.setRule(TestDroolsRuleManager.rule1); + this.ruleManager.addRule(expression); + + workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule1"); + workingMemory.insert(this.getSubject()); + + // Fire + System.out.println("Firing Rule1........"); + workingMemory.fireAllRules(); + ((StatefulSession) workingMemory).dispose(); + + workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule2"); + workingMemory.insert(this.getSubject()); + + // Fire + System.out.println("Firing Rule2........"); + workingMemory.fireAllRules(); + ((StatefulSession) workingMemory).dispose(); + } + + // ----------------------------------------------------------------------------------------------------------------------------------------------------------- + private Subject getSubject() + { + Subject subject = new Subject(); + + subject.setCategory(XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT); + + // Create a Role Attribute + Attribute attribute = new Attribute(); + attribute.setUri(XACMLConstants.ATTRIBUTEID_ROLE); + attribute.setDataType(XMLSchemaConstants.DATATYPE_STRING); + attribute.setValue("developer"); + subject.addAttribute(attribute); + + return subject; + } } Modified: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/plugin/TestDroolsRules.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -22,7 +22,6 @@ ******************************************************************************/ package org.jboss.security.authz.policy.server.plugin; - import junit.framework.TestCase; import org.drools.WorkingMemory; @@ -30,105 +29,106 @@ import org.jboss.security.xacml.interfaces.XACMLConstants; import org.jboss.security.xacml.interfaces.XMLSchemaConstants; +import org.jboss.security.authz.bootstrap.ServiceContainer; import org.jboss.security.authz.model.*; import org.jboss.security.authz.policy.server.plugin.DroolsRuleManager; /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - * + * */ public class TestDroolsRules extends TestCase { - private static final String rule2 = - "rule \"Rule2\"\n"+ - "when\n"+ - "$subject: Subject()\n"+ - "String(toString == \"Rule2\")\n"+ - "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ - "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ - "then\n"+ - "System.out.println(\"Rule2 successfully fired\");\n"+ - "end\n"; - - private static final String rule1 = - "rule \"Rule1\"\n"+ - "when\n"+ - "$subject: Subject()\n"+ - "String(toString == \"Rule1\")\n"+ - "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ - "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ - "then\n"+ - "System.out.println(\"Rule1 successfully fired\");\n"+ - "end\n"; - - private DroolsRuleManager ruleManager = null; - - - @Override - protected void setUp() throws Exception - { - this.ruleManager = new DroolsRuleManager(); - this.ruleManager.start(); - } + private static final String rule2 = "rule \"Rule2\"\n" + + "when\n" + + "$subject: Subject()\n" + + "String(toString == \"Rule2\")\n" + + "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n" + + "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n" + + "then\n" + "System.out.println(\"Rule2 successfully fired\");\n" + + "end\n"; - @Override - protected void tearDown() throws Exception - { - this.ruleManager = null; - } - //------------------------------------------------------------------------------------------------------------------------------------------------------------ - public void testAddRule() throws Exception - { - DroolsRuleExpression expression = new DroolsRuleExpression(); - expression.setRuleReference("Rule2"); - expression.setRule(TestDroolsRules.rule2); - this.ruleManager.addRule(expression); - - WorkingMemory workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule2"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule2........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - - expression.setRuleReference("Rule1"); - expression.setRule(TestDroolsRules.rule1); - this.ruleManager.addRule(expression); - - workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule1"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule1........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - - workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule2"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule2........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - } - //----------------------------------------------------------------------------------------------------------------------------------------------------------- - private Subject getSubject() - { - Subject subject = new Subject(); - - subject.setCategory(XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT); - - //Create a Role Attribute - Attribute attribute = new Attribute(); - attribute.setUri(XACMLConstants.ATTRIBUTEID_ROLE); - attribute.setDataType(XMLSchemaConstants.DATATYPE_STRING); - attribute.setValue("developer"); - subject.addAttribute(attribute); - - return subject; - } + private static final String rule1 = "rule \"Rule1\"\n" + + "when\n" + + "$subject: Subject()\n" + + "String(toString == \"Rule1\")\n" + + "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n" + + "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n" + + "then\n" + "System.out.println(\"Rule1 successfully fired\");\n" + + "end\n"; + + private DroolsRuleManager ruleManager = null; + + @Override + protected void setUp() throws Exception + { + ServiceContainer.bootstrap(); + + this.ruleManager = (DroolsRuleManager) ServiceContainer + .lookup("/policy-server/DroolsRuleManager"); + } + + @Override + protected void tearDown() throws Exception + { + this.ruleManager = null; + } + + // ------------------------------------------------------------------------------------------------------------------------------------------------------------ + public void testAddRule() throws Exception + { + DroolsRuleExpression expression = new DroolsRuleExpression(); + expression.setRuleReference("Rule2"); + expression.setRule(TestDroolsRules.rule2); + this.ruleManager.addRule(expression); + + WorkingMemory workingMemory = ruleManager.getActiveRuleBase() + .newStatefulSession(); + workingMemory.insert("Rule2"); + workingMemory.insert(this.getSubject()); + + // Fire + System.out.println("Firing Rule2........"); + workingMemory.fireAllRules(); + ((StatefulSession) workingMemory).dispose(); + + expression.setRuleReference("Rule1"); + expression.setRule(TestDroolsRules.rule1); + this.ruleManager.addRule(expression); + + workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule1"); + workingMemory.insert(this.getSubject()); + + // Fire + System.out.println("Firing Rule1........"); + workingMemory.fireAllRules(); + ((StatefulSession) workingMemory).dispose(); + + workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule2"); + workingMemory.insert(this.getSubject()); + + // Fire + System.out.println("Firing Rule2........"); + workingMemory.fireAllRules(); + ((StatefulSession) workingMemory).dispose(); + } + + // ----------------------------------------------------------------------------------------------------------------------------------------------------------- + private Subject getSubject() + { + Subject subject = new Subject(); + + subject.setCategory(XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT); + + // Create a Role Attribute + Attribute attribute = new Attribute(); + attribute.setUri(XACMLConstants.ATTRIBUTEID_ROLE); + attribute.setDataType(XMLSchemaConstants.DATATYPE_STRING); + attribute.setValue("developer"); + subject.addAttribute(attribute); + + return subject; + } } Modified: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/provisioning/TestRelationalDBPolicyStore.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/provisioning/TestRelationalDBPolicyStore.java 2009-08-06 19:57:11 UTC (rev 13699) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/provisioning/TestRelationalDBPolicyStore.java 2009-08-07 18:02:40 UTC (rev 13700) @@ -23,13 +23,13 @@ import java.io.Serializable; import java.util.Set; +import java.util.List; import java.util.HashSet; import junit.framework.TestCase; import org.apache.log4j.Logger; -import org.hibernate.SessionFactory; import org.hibernate.Session; import org.hibernate.Transaction; @@ -45,6 +45,7 @@ import org.jboss.security.authz.model.Attribute; import org.jboss.security.authz.model.Expression; import org.jboss.security.authz.policy.server.plugin.XACMLPolicy; +import org.jboss.security.authz.tools.GeneralTool; /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> @@ -121,6 +122,34 @@ storedMetaData = this.readPolicyMetaData(stored.getMetaData().getId()); assertNull("MetData must be deleted!!", storedMetaData); } + + public void testFindPolicy() throws Exception + { + for(int i=0; i<5; i++) + { + String policyUri = i+"://blahPolicy"; + + //Create and Save a new policy + Policy policy = new XACMLPolicy(policyUri, this.getMockPolicyMetaData()); + Serializable id = this.save(policy); + assertNotNull("Id Should Not be Null!!", id); + log.info("New Policy Id="+id); + } + + Attribute attribute = new Attribute(); + attribute.setUri("uri://resourcematch"); + attribute.setDataType("dataType://resourcematch"); + attribute.setValue("Value://resourcematch"); + Set<Policy> storedPolicies = this.findPolicy(attribute); + for(Policy stored: storedPolicies) + { + assertNotNull("Policy Must Not be Null!!", stored); + assertNotNull("PolicyMetaData Must Not be Null!!", stored.getMetaData()); + log.info("------------------------------------------------------------"); + log.info("Policy Id="+stored.getId()); + log.info("Policy Uri="+stored.getPolicyUri()); + } + } //--------------------------------------------------------------------------------------------------------------------------------------------- private PolicyMetaData getMockPolicyMetaData() { @@ -136,14 +165,14 @@ { Rule rule = new Rule(); - rule.setRuleId("rule://"+i); + rule.setRuleId("rule://"+GeneralTool.generateUniqueId()); if(i%2==0) { rule.setEffect(Effect.PERMIT); DroolsRuleExpression expression = new DroolsRuleExpression(); expression.setRule("drools://rule/"+i); - expression.setRuleReference("drools://rulereference/"+i); + expression.setRuleReference("drools://rulereference/"+GeneralTool.generateUniqueId()); rule.setExpression(expression); Target ruleTarget = this.getMockTarget(); @@ -270,13 +299,12 @@ //-----Hibernate Data Access code----------------------------------------------------------------------------------------------------------------------------------- private Serializable save(Policy policy) throws Exception { - SessionFactory sessionFactory = this.policyStore.sessionFactory; Session session = null; Transaction tx = null; try { //Join or Create a New Session/Transaction - session = sessionFactory.getCurrentSession(); + session = this.policyStore.getHibernateService().getCurrentSession(); tx = session.beginTransaction(); Serializable id = session.save(policy); @@ -301,14 +329,13 @@ } private Policy readPolicy(String policyUri) throws Exception - { - SessionFactory sessionFactory = this.policyStore.sessionFactory; + { Session session = null; Transaction tx = null; try { //Join or Create a New Session/Transaction - session = sessionFactory.getCurrentSession(); + session = this.policyStore.getHibernateService().getCurrentSession(); tx = session.beginTransaction(); Policy policy = (Policy)session.createQuery("from XACMLPolicy where policyUri=?"). @@ -333,15 +360,61 @@ } } + private Set<Policy> findPolicy(Attribute attribute) throws Exception + { + Session session = null; + Transaction tx = null; + try + { + //Join or Create a New Session/Transaction + session = this.policyStore.getHibernateService().getCurrentSession(); + tx = session.beginTransaction(); + + List result = session.createQuery("from XACMLPolicy policy " + + "join policy.metaData.target.resourceMatches match " + + "where match.attribute.uri=? and match.attribute.value=?"). + setString(0, attribute.getUri()).setString(1, attribute.getValue()).list(); + + Set<Policy> policies = new HashSet<Policy>(); + for(Object record: result) + { + Object[] recordData = (Object[])record; + for(Object local: recordData) + { + if(local instanceof Policy) + { + policies.add((Policy)local); + } + } + } + + tx.commit(); + + return policies; + } + catch(Throwable t) + { + log.error(this, t); + tx.rollback(); + throw new RuntimeException(t); + } + finally + { + if(session.isOpen()) + { + session.close(); + } + } + } + private PolicyMetaData readPolicyMetaData(Serializable databaseId) throws Exception - { - SessionFactory sessionFactory = this.policyStore.sessionFactory; + { Session session = null; Transaction tx = null; try { //Join or Create a New Session/Transaction - session = sessionFactory.getCurrentSession(); + session = this.policyStore.getHibernateService().getCurrentSession(); tx = session.beginTransaction(); PolicyMetaData policyMetaData = (PolicyMetaData)session.get(PolicyMetaData.class, databaseId); @@ -366,14 +439,13 @@ } private void deletePolicy(Policy policy) throws Exception - { - SessionFactory sessionFactory = this.policyStore.sessionFactory; + { Session session = null; Transaction tx = null; try { //Join or Create a New Session/Transaction - session = sessionFactory.getCurrentSession(); + session = this.policyStore.getHibernateService().getCurrentSession(); tx = session.beginTransaction(); session.delete(policy);