Author: sohil.shah(a)jboss.com Date: 2009-02-06 23:39:13 -0500 (Fri, 06 Feb 2009) New Revision: 12791 Added: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/subject/TestRolesDroolsRules.java Removed: modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Machine.java modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java Modified: modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Roles.java modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java Log: Core Component Implementation cleanup. The Component contract is still evolving on the whiteboard Modified: modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java =================================================================== --- modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java 2009-02-06 21:51:50 UTC (rev 12790) +++ modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/http/HttpResource.java 2009-02-07 04:39:13 UTC (rev 12791) @@ -26,18 +26,15 @@ import java.util.HashMap; import java.util.Set; import java.util.HashSet; -import java.text.MessageFormat; import org.jboss.security.authz.model.AttributeExpression; -import org.jboss.security.authz.model.Effect; import org.jboss.security.authz.model.Rule; import org.jboss.security.authz.model.Target; import org.jboss.security.authz.model.Attribute; import org.jboss.security.authz.model.Resource; import org.jboss.security.authz.model.PolicyMetaData; -import org.jboss.security.authz.model.DroolsRuleExpression; -import org.jboss.security.authz.tools.GeneralTool; import org.jboss.security.authz.xacml.ExpressionBuilder; +import org.jboss.security.authz.components.subject.Roles; import org.jboss.security.xacml.interfaces.XACMLConstants; import org.jboss.security.xacml.interfaces.XMLSchemaConstants; @@ -52,41 +49,7 @@ * */ public class HttpResource -{ - //make it package-level access so that unit tests can test these rules - static final String allowedRolesRule = - "import java.util.HashSet\n"+ - "rule \"allowedRolesRule\"\n"+ - "when\n"+ - "$ruleName: String()\n"+ - "$roles: HashSet()\n"+ - "eval($ruleName.contains(\"httpResource://permittedRoles\"))\n"+ - "eval({0})\n"+ - "then\n"+ - "insert(Boolean.TRUE);\n"+ - "end\n"; - - static final String deniedRolesRule = - "import java.util.HashSet\n"+ - "rule \"deniedRolesRule\"\n"+ - "when\n"+ - "$ruleName: String()\n"+ - "$roles: HashSet()\n"+ - "eval($ruleName.contains(\"httpResource://deniedRoles\"))\n"+ - "eval({0})\n"+ - "then\n"+ - "insert(Boolean.TRUE);\n"+ - "end\n"; - - static final String allowedIpsRule = - "rule \"allowedIpsRule\"\n"+ - "when\n"+ - "$ruleName: String()\n"+ - "eval($ruleName.contains(\"httpResource://allowedIps\"))\n"+ - "then\n"+ - "insert(Boolean.TRUE);\n"+ - "end\n"; - +{ /** * The URL that identifies this resource */ @@ -100,17 +63,13 @@ /** * Roles that are allowed access to this resource */ - private Set<String> allowedRoles; + private Roles allowedRoles; /** * Roles that are denied access to this resource */ - private Set<String> deniedRoles; + private Roles deniedRoles; - /** - * A Range/regular expression to specify client IP addresses that have access to this resource - */ - private Set<String> allowedIps; /** * @@ -118,9 +77,6 @@ public HttpResource() { this.parameters = new HashMap<String, String>(); - this.allowedRoles = new HashSet<String>(); - this.deniedRoles = new HashSet<String>(); - this.allowedIps = new HashSet<String>(); } public Map<String, String> getParameters() @@ -146,22 +102,30 @@ this.url = url; } - public Set<String> getAllowedRoles() + public Roles getAllowedRoles() { + if(this.allowedRoles == null) + { + this.allowedRoles = new Roles(); + } return allowedRoles; } - public void setAllowedRoles(Set<String> allowedRoles) + public void setAllowedRoles(Roles allowedRoles) { this.allowedRoles = allowedRoles; } - public Set<String> getDeniedRoles() + public Roles getDeniedRoles() { + if(this.deniedRoles == null) + { + this.deniedRoles = new Roles(); + } return deniedRoles; } - public void setDeniedRoles(Set<String> deniedRoles) + public void setDeniedRoles(Roles deniedRoles) { this.deniedRoles = deniedRoles; } @@ -177,32 +141,14 @@ } public void addAllowedRole(String allowedRole) - { - if(allowedRole == null || allowedRole.trim().length() == 0) - { - throw new IllegalArgumentException("Role Value Must Not Be Empty"); - } - - this.allowedRoles.add(allowedRole); + { + this.getAllowedRoles().addName(allowedRole); } public void addDeniedRole(String deniedRole) - { - if(deniedRole == null || deniedRole.trim().length() == 0) - { - throw new IllegalArgumentException("Role Value Must Not Be Empty"); - } - this.deniedRoles.add(deniedRole); - } - - public void addAllowedIp(String allowedIp) - { - if(allowedIp == null || allowedIp.trim().length() == 0) - { - throw new IllegalArgumentException("Allowed IP Must Not Be Empty"); - } - this.allowedIps.add(allowedIp); - } + { + this.getDeniedRoles().addName(deniedRole); + } //-------Services for Policy Creation--------------------------------------------------------------------------------------------------------------------------------------------------------------------- /** * Creates a Policy Target suggesting that the Policy should apply to this HttpResource @@ -244,35 +190,9 @@ * * @return the rule */ - private Rule getPermittedRolesRule() + private Rule allowIfUserHasRole() { - if(this.allowedRoles == null || this.allowedRoles.isEmpty()) - { - return null; - } - - Rule permitRule = new Rule(); - - String ruleReference = "httpResource://permittedRoles/"+GeneralTool.generateUniqueId(); - permitRule.setRuleId(ruleReference); - permitRule.setEffect(Effect.PERMIT); - - //Generate a Drools Rule Expression - StringBuffer buffer = new StringBuffer(); - for(String role: this.allowedRoles) - { - buffer.append("$roles.contains(\""+role.toLowerCase()+"\") || "); - } - String condition = buffer.toString().trim(); - String rule = MessageFormat.format(HttpResource.allowedRolesRule, - new Object[]{condition.substring(0, condition.length()-2).trim()}); - - DroolsRuleExpression expression = new DroolsRuleExpression(); - expression.setRuleReference(ruleReference); - expression.setRule(rule); - permitRule.setExpression(expression); - - return permitRule; + return this.getAllowedRoles().allowIfUserHasRole(); } /** @@ -280,70 +200,11 @@ * * @return the role */ - private Rule getDeniedRolesRule() + private Rule denyIfUserHasRole() { - if(this.deniedRoles == null || this.deniedRoles.isEmpty()) - { - return null; - } - - Rule denyRule = new Rule(); - - String ruleReference = "httpResource://deniedRoles/"+GeneralTool.generateUniqueId(); - denyRule.setRuleId(ruleReference); - denyRule.setEffect(Effect.DENY); - - //Generate a Drools Rule Expression - StringBuffer buffer = new StringBuffer(); - for(String role: this.deniedRoles) - { - buffer.append("$roles.contains(\""+role.toLowerCase()+"\") || "); - } - String condition = buffer.toString().trim(); - String rule = MessageFormat.format(HttpResource.deniedRolesRule, - new Object[]{condition.substring(0, condition.length()-2).trim()}); - - DroolsRuleExpression expression = new DroolsRuleExpression(); - expression.setRuleReference(ruleReference); - expression.setRule(rule); - denyRule.setExpression(expression); - - return denyRule; + return this.getDeniedRoles().denyIfUserHasRole(); } - - private Rule getAllowedIpsRule() - { - if(this.allowedIps == null || this.allowedIps.isEmpty()) - { - return null; - } - - Rule rule = new Rule(); - - String ruleReference = "httpResource://allowedIps/"+GeneralTool.generateUniqueId(); - rule.setRuleId(ruleReference); - rule.setEffect(Effect.PERMIT); - - //TODO: Generate a Drools Rule Expression - for(String allowedIp: this.allowedIps) - { - /*AttributeExpression expression = new AttributeExpression(); - expression.setFunctionId(XACMLConstants.FUNCTION_REGEXP_IPADDRESS_MATCH); - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS, - XMLSchemaConstants.DATATYPE_IPADDRESS, allowedIp); - expression.setAttribute(attribute); - - rule.setExpression(expression);*/ - } - - DroolsRuleExpression expression = new DroolsRuleExpression(); - expression.setRuleReference(ruleReference); - expression.setRule(HttpResource.allowedIpsRule); - rule.setExpression(expression); - - return rule; - } - + public PolicyMetaData getPolicyMetaData(boolean matchAllParameters) { PolicyMetaData metadata = new PolicyMetaData(); @@ -353,26 +214,17 @@ Set<Rule> rules = new HashSet<Rule>(); //Permitted Roles - Rule permittedRoles = this.getPermittedRolesRule(); - if(permittedRoles != null) - { - rules.add(permittedRoles); - } + if(this.allowedRoles != null) + { + rules.add(this.allowIfUserHasRole()); + } - //Denied Roles - Rule deniedRoles = this.getDeniedRolesRule(); - if(deniedRoles != null) + //Denied Roles + if(this.deniedRoles != null) { - rules.add(deniedRoles); + rules.add(this.denyIfUserHasRole()); } - - //AllowedIP Rules - Rule allowedIps = this.getAllowedIpsRule(); - if(allowedIps != null) - { - rules.add(allowedIps); - } - + metadata.setTarget(target); metadata.setRules(rules); @@ -384,7 +236,7 @@ * * @return the Resource */ - public Resource getURLResource() + public Resource getResource() { Resource urlResource = new Resource(); Deleted: modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Machine.java =================================================================== --- modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Machine.java 2009-02-06 21:51:50 UTC (rev 12790) +++ modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Machine.java 2009-02-07 04:39:13 UTC (rev 12791) @@ -1,285 +0,0 @@ -/****************************************************************************** - * JBoss, a division of Red Hat * - * Copyright 2006, Red Hat Middleware, LLC, and individual * - * contributors as indicated by the @authors tag. See the * - * copyright.txt in the distribution for a full listing of * - * individual contributors. * - * * - * This is free software; you can redistribute it and/or modify it * - * under the terms of the GNU Lesser General Public License as * - * published by the Free Software Foundation; either version 2.1 of * - * the License, or (at your option) any later version. * - * * - * This software is distributed in the hope that it will be useful, * - * but WITHOUT ANY WARRANTY; without even the implied warranty of * - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * - * Lesser General Public License for more details. * - * * - * You should have received a copy of the GNU Lesser General Public * - * License along with this software; if not, write to the Free * - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * - ******************************************************************************/ -package org.jboss.security.authz.components.subject; - -import java.net.InetAddress; - -import org.jboss.security.authz.model.Attribute; -import org.jboss.security.authz.model.AttributeExpression; -import org.jboss.security.authz.model.Effect; -import org.jboss.security.authz.model.Rule; -import org.jboss.security.authz.model.Target; -import org.jboss.security.authz.tools.GeneralTool; -import org.jboss.security.xacml.interfaces.XACMLConstants; -import org.jboss.security.xacml.interfaces.XMLSchemaConstants; - -/** - * The Machine Policy Component represents the "Machine" that is accessing the System - * - * This Component provides an easy to use Developer API for generating commonly used Expressions/Logic related to Machine related information that must be - * represented within an Authorization Policy - * - * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - * - */ -public class Machine -{ - /** - * IP Address of the machine - */ - private InetAddress ipAddress; - - /** - * DNS Name of the machine - */ - private String dnsName; - - /** - * Regular Expression for matching the fact whether the IP Address of the remote Machine falls within the specified range of IP Addresses - */ - private String ipRangeRegEx; - - public Machine() - { - - } - - public InetAddress getIpAddress() - { - return ipAddress; - } - - public void setIpAddress(InetAddress ipAddress) - { - this.ipAddress = ipAddress; - } - - public String getDnsName() - { - return dnsName; - } - - public void setDnsName(String dnsName) - { - this.dnsName = dnsName; - } - - - public String getIpRangeRegEx() - { - return ipRangeRegEx; - } - - public void setIpRangeRegEx(String ipRangeRegEx) - { - this.ipRangeRegEx = ipRangeRegEx; - } - //------------------------------------------------------------------------------------------------------------------------------------------------------------ - /** - * Creates a Rule specifying that the Remote Machine with this IP Address should be Allowed Access - * - * @return the rule - */ - public Rule getAllowedRemoteIP() - { - if(this.ipAddress == null) - { - throw new IllegalStateException("The IP Address is Empty"); - } - - Rule rule = new Rule(); - Target target = new Target(); - - rule.setRuleId(GeneralTool.generateUniqueId()); - rule.setEffect(Effect.PERMIT); - rule.setTarget(target); - - AttributeExpression expression = new AttributeExpression(); - - expression.setFunctionId(XACMLConstants.FUNCTION_STRING_IS_IN); - - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS, - XMLSchemaConstants.DATATYPE_STRING, this.ipAddress.getHostAddress()); - expression.setAttribute(attribute); - - rule.setExpression(expression); - - return rule; - } - - /** - * Creates a Rule specifying that the Remote Machine with this IP Address should be Denied Access - * - * @return the rule - */ - public Rule getDeniedRemoteIP() - { - if(this.ipAddress == null) - { - throw new IllegalStateException("The IP Address is Empty"); - } - - Rule rule = new Rule(); - Target target = new Target(); - - rule.setRuleId(GeneralTool.generateUniqueId()); - rule.setEffect(Effect.DENY); - rule.setTarget(target); - - AttributeExpression expression = new AttributeExpression(); - - expression.setFunctionId(XACMLConstants.FUNCTION_STRING_IS_IN); - - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS, - XMLSchemaConstants.DATATYPE_STRING, this.ipAddress.getHostAddress()); - expression.setAttribute(attribute); - - rule.setExpression(expression); - - return rule; - } - - /** - * Creates a Rule that specifies that the Remote Machine with its DNS address is Allowed Access - * - * @return the rule - */ - public Rule getAllowedRemoteDNS() - { - if(this.dnsName == null || this.dnsName.trim().length() == 0) - { - throw new IllegalStateException("The DNSName is Empty"); - } - - Rule rule = new Rule(); - Target target = new Target(); - - rule.setRuleId(GeneralTool.generateUniqueId()); - rule.setEffect(Effect.PERMIT); - rule.setTarget(target); - - AttributeExpression expression = new AttributeExpression(); - - expression.setFunctionId(XACMLConstants.FUNCTION_STRING_IS_IN); - - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_DNS_NAME, - XMLSchemaConstants.DATATYPE_STRING, this.dnsName); - expression.setAttribute(attribute); - - rule.setExpression(expression); - - return rule; - } - - /** - * Creates a Rule that specifies that the Remote Machine with its DNS address is Denied Access - * - * @return the rule - */ - public Rule getDenyRemoteDNS() - { - if(this.dnsName == null || this.dnsName.trim().length() == 0) - { - throw new IllegalStateException("The DNSName is Empty"); - } - - Rule rule = new Rule(); - Target target = new Target(); - - rule.setRuleId(GeneralTool.generateUniqueId()); - rule.setEffect(Effect.DENY); - rule.setTarget(target); - - AttributeExpression expression = new AttributeExpression(); - - expression.setFunctionId(XACMLConstants.FUNCTION_STRING_IS_IN); - - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_DNS_NAME, - XMLSchemaConstants.DATATYPE_STRING, this.dnsName); - expression.setAttribute(attribute); - - rule.setExpression(expression); - - return rule; - } - - /** - * Creates a Rule specifying that the Remote Machine should be Allowed Access if it falls within the specified IP Range - * - * @return the rule - */ - public Rule getAllowedRemoteIPRange() - { - if(this.ipRangeRegEx == null || this.ipRangeRegEx.trim().length() == 0) - { - throw new IllegalStateException("The IP Range is not specified"); - } - - Rule rule = new Rule(); - Target target = new Target(); - - rule.setRuleId(GeneralTool.generateUniqueId()); - rule.setEffect(Effect.PERMIT); - rule.setTarget(target); - - AttributeExpression expression = new AttributeExpression(); - - expression.setFunctionId(XACMLConstants.FUNCTION_REGEXP_IPADDRESS_MATCH); - - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS, - XMLSchemaConstants.DATATYPE_IPADDRESS, this.ipRangeRegEx); - expression.setAttribute(attribute); - - return rule; - } - - /** - * Creates a Rule specifying that the Remote Machine should be Denied Access if it falls within the specified IP Range - * - * @return the rule - */ - public Rule getDeniedRemoteIPRange() - { - if(this.ipRangeRegEx == null || this.ipRangeRegEx.trim().length() == 0) - { - throw new IllegalStateException("The IP Range is not specified"); - } - - Rule rule = new Rule(); - Target target = new Target(); - - rule.setRuleId(GeneralTool.generateUniqueId()); - rule.setEffect(Effect.DENY); - rule.setTarget(target); - - AttributeExpression expression = new AttributeExpression(); - - expression.setFunctionId(XACMLConstants.FUNCTION_REGEXP_IPADDRESS_MATCH); - - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS, - XMLSchemaConstants.DATATYPE_IPADDRESS, this.ipRangeRegEx); - expression.setAttribute(attribute); - - return rule; - } -} Modified: modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Roles.java =================================================================== --- modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Roles.java 2009-02-06 21:51:50 UTC (rev 12790) +++ modules/authorization/trunk/core-components/src/main/java/org/jboss/security/authz/components/subject/Roles.java 2009-02-07 04:39:13 UTC (rev 12791) @@ -102,7 +102,7 @@ { throw new IllegalArgumentException("Role Name should not be empty!!"); } - this.names.add(name); + this.getNames().add(name); } //-------Services for Policy Generation----------------------------------------------------------------------------------------------------------------------------------------------------- /** @@ -111,7 +111,7 @@ * * @return the rule */ - public Rule allow() + public Rule allowIfUserHasRole() { if(this.getNames().isEmpty()) { @@ -148,7 +148,7 @@ * * @return the rule */ - public Rule deny() + public Rule denyIfUserHasRole() { if(this.getNames().isEmpty()) { Modified: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java =================================================================== --- modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java 2009-02-06 21:51:50 UTC (rev 12790) +++ modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResource.java 2009-02-07 04:39:13 UTC (rev 12791) @@ -90,7 +90,6 @@ httpResource.addParameter("test2", "test2://value"); httpResource.addAllowedRole("admin"); httpResource.addDeniedRole("anonymous"); - httpResource.addAllowedIp("192.168.x.x"); Policy policy = new MockPolicy("testIPRules", httpResource.getPolicyMetaData(true)); Deleted: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java =================================================================== --- modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java 2009-02-06 21:51:50 UTC (rev 12790) +++ modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/http/TestHttpResourceRules.java 2009-02-07 04:39:13 UTC (rev 12791) @@ -1,210 +0,0 @@ -/* -* JBoss, a division of Red Hat -* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ -package org.jboss.security.authz.components.http; - -import java.io.ByteArrayInputStream; -import java.io.InputStreamReader; -import java.io.Reader; -import java.text.MessageFormat; -import java.util.Set; -import java.util.HashSet; -import java.util.Iterator; - -import junit.framework.TestCase; - -import org.apache.log4j.Logger; - - -import org.drools.RuleBase; -import org.drools.RuleBaseFactory; -import org.drools.StatefulSession; -import org.drools.WorkingMemory; -import org.drools.compiler.PackageBuilder; -import org.jboss.security.authz.tools.GeneralTool; - - -/** - * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - */ -public class TestHttpResourceRules extends TestCase -{ - private static Logger log = Logger.getLogger(TestHttpResourceRules.class); - private static String rulePkg = - "package security\n"+ - "import org.jboss.security.authz.model.*;\n"+ - "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; - - private RuleBase activeRuleBase; - - public void setUp() throws Exception - { - StringBuilder buffer = new StringBuilder(); - - buffer.append(rulePkg+"\n"); - buffer.append(this.getAllowedRolesRule()+"\n"); - buffer.append(this.getDeniedRolesRule()+"\n"); - buffer.append(HttpResource.allowedIpsRule+"\n"); - - Reader source = new InputStreamReader(new ByteArrayInputStream(buffer.toString().getBytes())); - try - { - PackageBuilder packageBuilder = new PackageBuilder(); - packageBuilder.addPackageFromDrl(source); - - if(this.activeRuleBase == null) - { - this.activeRuleBase = RuleBaseFactory.newRuleBase(); - } - - //Perform the reloading of the RuleBase with the updated Rules - this.activeRuleBase.lock(); - this.activeRuleBase.addPackage(packageBuilder.getPackage()); - this.activeRuleBase.unlock(); - } - finally - { - source.close(); - } - } - - public void tearDown() throws Exception - { - this.activeRuleBase = null; - } - - public void testAllowedRolesRule() throws Exception - { - log.info("Executing----------testAllowedRolesRule"); - WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); - - //SetUp the context data - workingMemory.insert("httpResource://permittedRoles/"+GeneralTool.generateUniqueId()); - Set roles = new HashSet(); - roles.add("admin"); - roles.add("superuser"); - workingMemory.insert(roles); - - workingMemory.fireAllRules(); - - //Extract result - boolean success = false; - Iterator itr = workingMemory.iterateObjects(); - while(itr.hasNext()) - { - Object curr = itr.next(); - if(curr instanceof Boolean) - { - success = ((Boolean)curr).booleanValue(); - } - } - - ((StatefulSession)workingMemory).dispose(); - - assertTrue("Rule did not execute!!", success); - } - - public void testDeniedRolesRule() throws Exception - { - log.info("Executing----------testDeniedRolesRule"); - WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); - - //SetUp the context data - workingMemory.insert("httpResource://deniedRoles/"+GeneralTool.generateUniqueId()); - Set roles = new HashSet(); - roles.add("anonymous"); - workingMemory.insert(roles); - - workingMemory.fireAllRules(); - - //Extract result - boolean success = false; - Iterator itr = workingMemory.iterateObjects(); - while(itr.hasNext()) - { - Object curr = itr.next(); - if(curr instanceof Boolean) - { - success = ((Boolean)curr).booleanValue(); - } - } - - ((StatefulSession)workingMemory).dispose(); - - assertTrue("Rule did not execute!!", success); - } - - public void testAllowedIpsRule() throws Exception - { - log.info("Executing----------testAllowedIpsRule"); - WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); - workingMemory.insert("httpResource://allowedIps/"+GeneralTool.generateUniqueId()); - workingMemory.fireAllRules(); - - //Extract result - boolean success = false; - Iterator itr = workingMemory.iterateObjects(); - while(itr.hasNext()) - { - Object curr = itr.next(); - if(curr instanceof Boolean) - { - success = ((Boolean)curr).booleanValue(); - } - } - - ((StatefulSession)workingMemory).dispose(); - - assertTrue("Rule did not execute!!", success); - } - //------------------------------------------------------------------------------------------------------------------------------------------------------ - private String getAllowedRolesRule() - { - String[] mockRoles = new String[]{"Admin", "SupErUser"}; - - StringBuffer buffer = new StringBuffer(); - for(String role: mockRoles) - { - buffer.append("$roles.contains(\""+role.toLowerCase()+"\") || "); - } - String condition = buffer.toString().trim(); - String rule = MessageFormat.format(HttpResource.allowedRolesRule, - new Object[]{condition.substring(0, condition.length()-2).trim()}); - - return rule; - } - - private String getDeniedRolesRule() - { - String[] mockRoles = new String[]{"Anonymous", "Regular"}; - - StringBuffer buffer = new StringBuffer(); - for(String role: mockRoles) - { - buffer.append("$roles.contains(\""+role.toLowerCase()+"\") || "); - } - String condition = buffer.toString().trim(); - String rule = MessageFormat.format(HttpResource.deniedRolesRule, - new Object[]{condition.substring(0, condition.length()-2).trim()}); - - return rule; - } -} Added: modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/subject/TestRolesDroolsRules.java =================================================================== --- modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/subject/TestRolesDroolsRules.java (rev 0) +++ modules/authorization/trunk/core-components/src/test/java/org/jboss/security/authz/components/subject/TestRolesDroolsRules.java 2009-02-07 04:39:13 UTC (rev 12791) @@ -0,0 +1,185 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.components.subject; + +import java.io.ByteArrayInputStream; +import java.io.InputStreamReader; +import java.io.Reader; +import java.text.MessageFormat; +import java.util.Set; +import java.util.HashSet; +import java.util.Iterator; + +import junit.framework.TestCase; + +import org.apache.log4j.Logger; + + +import org.drools.RuleBase; +import org.drools.RuleBaseFactory; +import org.drools.StatefulSession; +import org.drools.WorkingMemory; +import org.drools.compiler.PackageBuilder; +import org.jboss.security.authz.tools.GeneralTool; + + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestRolesDroolsRules extends TestCase +{ + private static Logger log = Logger.getLogger(TestRolesDroolsRules.class); + private static String rulePkg = + "package security\n"+ + "import org.jboss.security.authz.model.*;\n"+ + "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; + + private RuleBase activeRuleBase; + + public void setUp() throws Exception + { + StringBuilder buffer = new StringBuilder(); + + buffer.append(rulePkg+"\n"); + buffer.append(this.getAllowedRolesRule()+"\n"); + buffer.append(this.getDeniedRolesRule()+"\n"); + + Reader source = new InputStreamReader(new ByteArrayInputStream(buffer.toString().getBytes())); + try + { + PackageBuilder packageBuilder = new PackageBuilder(); + packageBuilder.addPackageFromDrl(source); + + if(this.activeRuleBase == null) + { + this.activeRuleBase = RuleBaseFactory.newRuleBase(); + } + + //Perform the reloading of the RuleBase with the updated Rules + this.activeRuleBase.lock(); + this.activeRuleBase.addPackage(packageBuilder.getPackage()); + this.activeRuleBase.unlock(); + } + finally + { + source.close(); + } + } + + public void tearDown() throws Exception + { + this.activeRuleBase = null; + } + + public void testAllowedRolesRule() throws Exception + { + log.info("Executing----------testAllowedRolesRule"); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + + //SetUp the context data + workingMemory.insert("roles://allowRule/"+GeneralTool.generateUniqueId()); + Set roles = new HashSet(); + roles.add("admin"); + roles.add("superuser"); + workingMemory.insert(roles); + + workingMemory.fireAllRules(); + + //Extract result + boolean success = false; + Iterator itr = workingMemory.iterateObjects(); + while(itr.hasNext()) + { + Object curr = itr.next(); + if(curr instanceof Boolean) + { + success = ((Boolean)curr).booleanValue(); + } + } + + ((StatefulSession)workingMemory).dispose(); + + assertTrue("Rule did not execute!!", success); + } + + public void testDeniedRolesRule() throws Exception + { + log.info("Executing----------testDeniedRolesRule"); + WorkingMemory workingMemory = this.activeRuleBase.newStatefulSession(); + + //SetUp the context data + workingMemory.insert("roles://denyRule/"+GeneralTool.generateUniqueId()); + Set roles = new HashSet(); + roles.add("anonymous"); + workingMemory.insert(roles); + + workingMemory.fireAllRules(); + + //Extract result + boolean success = false; + Iterator itr = workingMemory.iterateObjects(); + while(itr.hasNext()) + { + Object curr = itr.next(); + if(curr instanceof Boolean) + { + success = ((Boolean)curr).booleanValue(); + } + } + + ((StatefulSession)workingMemory).dispose(); + + assertTrue("Rule did not execute!!", success); + } + //------------------------------------------------------------------------------------------------------------------------------------------------------ + private String getAllowedRolesRule() + { + String[] mockRoles = new String[]{"Admin", "SupErUser"}; + + StringBuffer buffer = new StringBuffer(); + for(String role: mockRoles) + { + buffer.append("$roles.contains(\""+role.toLowerCase()+"\") || "); + } + String condition = buffer.toString().trim(); + String rule = MessageFormat.format(Roles.allowRule, + new Object[]{condition.substring(0, condition.length()-2).trim()}); + + return rule; + } + + private String getDeniedRolesRule() + { + String[] mockRoles = new String[]{"Anonymous", "Regular"}; + + StringBuffer buffer = new StringBuffer(); + for(String role: mockRoles) + { + buffer.append("$roles.contains(\""+role.toLowerCase()+"\") || "); + } + String condition = buffer.toString().trim(); + String rule = MessageFormat.format(Roles.denyRule, + new Object[]{condition.substring(0, condition.length()-2).trim()}); + + return rule; + } +}