Author: sohil.shah(a)jboss.com Date: 2008-12-05 00:54:40 -0500 (Fri, 05 Dec 2008) New Revision: 12349 Added: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsRuleManager.java modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRuleManager.java modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/ExpressionBuilder.java Removed: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/DroolsRuleManager.java modules/authorization/trunk/PAP/src/main/resources/rules/ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestDroolsRuleManager.java Modified: modules/authorization/trunk/PAP/pom.xml modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/hierarchial/HierarchialPolicy.java modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsFunction.java modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/hierarchial/TestHierarchialPolicy.java modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsFunction.java modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRules.java modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Action.java modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/PolicyException.java modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Resource.java modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Subject.java modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Target.java Log: code backup Modified: modules/authorization/trunk/PAP/pom.xml =================================================================== --- modules/authorization/trunk/PAP/pom.xml 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/pom.xml 2008-12-05 05:54:40 UTC (rev 12349) @@ -69,8 +69,8 @@ <artifactId>maven-surefire-plugin</artifactId> <version>2.3.1</version> <configuration> - <includes> - <include>**/TestDroolsRuleManager.java</include> + <includes> + <include>**/TestHierarchialPolicy.java</include> </includes> </configuration> </plugin> Modified: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/hierarchial/HierarchialPolicy.java =================================================================== --- modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/hierarchial/HierarchialPolicy.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/hierarchial/HierarchialPolicy.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -68,9 +68,16 @@ */ public class HierarchialPolicy extends Policy { - public HierarchialPolicy(String policyUri, Target target, Set<Rule> rules) + public HierarchialPolicy(String policyUri, Target target, Set<Rule> rules) throws PolicyException { - super(policyUri, target, rules); + super(policyUri, target, rules); + + //Validate the state of the data + //Make sure there is only one ResourceMatch specified + if(target.getResourceMatches() == null || target.getResourceMatches().size()>1) + { + throw new PolicyException("The HierarchialPolicy type requires there is exactly one match specified for a Resource inside the Policy definition"); + } } @Override @@ -97,21 +104,20 @@ { ResourcesType resourcesType = new ResourcesType(); targetType.setResources(resourcesType); - for(AttributeExpression resourceMatch: resourceMatches) - { - ResourceType resourceType = new ResourceType(); - ResourceMatchType rmt = new ResourceMatchType(); - - rmt.setMatchId(resourceMatch.getFunctionId()); - - rmt.setResourceAttributeDesignator(AttributeDesignatorUtil.getAttributeDesignator(resourceMatch.getAttribute())); - - rmt.setAttributeValue(PolicyAttributeFactory - .createStringAttributeType(resourceMatch.getAttribute().getValue())); - - resourceType.getResourceMatch().add(rmt); - resourcesType.getResource().add(resourceType); - } + + AttributeExpression resourceMatch = resourceMatches.get(0); + ResourceType resourceType = new ResourceType(); + ResourceMatchType rmt = new ResourceMatchType(); + + rmt.setMatchId(resourceMatch.getFunctionId()); + + rmt.setResourceAttributeDesignator(AttributeDesignatorUtil.getAttributeDesignator(resourceMatch.getAttribute())); + + rmt.setAttributeValue(PolicyAttributeFactory + .createStringAttributeType(resourceMatch.getAttribute().getValue())); + + resourceType.getResourceMatch().add(rmt); + resourcesType.getResource().add(resourceType); } //Process the Policy Rules Modified: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsFunction.java =================================================================== --- modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsFunction.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsFunction.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -22,16 +22,11 @@ ******************************************************************************/ package org.jboss.security.authz.pap.plugin; -import java.io.InputStreamReader; -import java.io.Reader; import java.util.List; import java.util.ArrayList; import org.drools.RuleBase; -import org.drools.RuleBaseFactory; import org.drools.WorkingMemory; -import org.drools.rule.Package; -import org.drools.compiler.PackageBuilder; import org.jboss.security.xacml.sunxacml.EvaluationCtx; import org.jboss.security.xacml.sunxacml.cond.EvaluationResult; @@ -50,8 +45,6 @@ { public static final String NAME = FUNCTION_NS + "drools:rule"; - private RuleBase rules = null; - /** * * @param functionName @@ -69,16 +62,7 @@ 0, //FunctionId BooleanAttribute.identifier, //returnType false //returns a Bag of values - ); - - try - { - this.rules = this.readStaticRules(); - } - catch(Exception e) - { - throw new RuntimeException(e); - } + ); } @@ -110,15 +94,8 @@ { EvaluationResult result = null; try - { - //Mock Code - WorkingMemory workingMemory = this.rules.newStatefulSession(); - - //Insert Security related Facts into the Rule Engine - - workingMemory.fireAllRules(); + { - /** * TODO: start a Drools context and evaluate the specified Rule against the data presented in the EvaluationContext */ @@ -132,39 +109,5 @@ result = new EvaluationResult(status); } return result; - } - //-------------------------------------------------------------------------------------------------------------------------------------------------------------- - /** - * Used when using Rule Deployment in a static manner from the classpath - * - * With this approach, the Policy Condition Rules are supplied during server startup. Rule Modifications require a server re-start - */ - private RuleBase readStaticRules() throws Exception - { - //read in the source - Reader source = new InputStreamReader(this.getClass().getResourceAsStream("/rules/security.drl")); - - //optionally read in the DSL (if you are using it). - //Reader dsl = new InputStreamReader( DroolsTest.class.getResourceAsStream( "/mylang.dsl" ) ); - - //Use package builder to build up a rule package. - //An alternative lower level class called "DrlParser" can also be used... - - PackageBuilder builder = new PackageBuilder(); - - //this wil parse and compile in one step - //NOTE: There are 2 methods here, the one argument one is for normal DRL. - builder.addPackageFromDrl(source); - - //Use the following instead of above if you are using a DSL: - //builder.addPackageFromDrl( source, dsl ); - - //get the compiled package (which is serializable) - Package pkg = builder.getPackage(); - - //add the package to a rulebase (deploy the rule package). - RuleBase ruleBase = RuleBaseFactory.newRuleBase(); - ruleBase.addPackage(pkg); - return ruleBase; - } + } } Copied: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsRuleManager.java (from rev 12334, modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/DroolsRuleManager.java) =================================================================== --- modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsRuleManager.java (rev 0) +++ modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/plugin/DroolsRuleManager.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -0,0 +1,203 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.security.authz.pap.plugin; + +import java.io.InputStreamReader; +import java.io.Reader; +import java.io.ByteArrayInputStream; +import java.util.Map; +import java.util.HashMap; + +import org.drools.RuleBase; +import org.drools.RuleBaseFactory; +import org.drools.compiler.PackageBuilder; + +import org.jboss.security.authz.model.DroolsRuleExpression; + +/** + * This service provides management for Drools based authorization Rules/Logic used by the Drools Function extension of the XACML Engine + * + * TODO: Add Database Persistence to the State of this Manager + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + * + */ +public final class DroolsRuleManager +{ + private static String rulePkg = + "package security\n"+ + "import org.jboss.security.authz.model.*;\n"+ + "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; + + private RuleBase activeRuleBase = null; + private Map<String, String> drls = null; + + public DroolsRuleManager() + { + } + + public void start() + { + try + { + this.drls = new HashMap<String, String>(); + this.reloadActiveRuleBase(); + } + catch(Exception e) + { + throw new RuntimeException(e); + } + } + + public void stop() + { + this.activeRuleBase = null; + this.drls = null; + } + //--------------------------------------------------------------------------------------------------------------------------------------------------------- + RuleBase getActiveRuleBase() + { + return this.activeRuleBase; + } + + void addRule(DroolsRuleExpression rule) + { + try + { + if(rule.getRuleReference() == null || rule.getRuleReference().trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + if(rule.getWhen() == null || rule.getWhen().trim().length() == 0) + { + throw new IllegalArgumentException("LHS value is missing"); + } + + + this.drls.put(rule.getRuleReference(), rule.getWhen()); + this.reloadActiveRuleBase(); + } + catch(Exception e) + { + throw new RuntimeException(e); + } + } + + DroolsRuleExpression readRule(String ruleReference) + { + try + { + if(ruleReference == null || ruleReference.trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + + DroolsRuleExpression rule = null; + + String when = this.drls.get(ruleReference); + + rule = new DroolsRuleExpression(); + rule.setRuleReference(ruleReference); + rule.setWhen(when); + + return rule; + } + catch(Exception e) + { + throw new RuntimeException(e); + } + } + + void updateRule(DroolsRuleExpression rule) + { + try + { + if(rule.getRuleReference() == null || rule.getRuleReference().trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + if(rule.getWhen() == null || rule.getWhen().trim().length() == 0) + { + throw new IllegalArgumentException("LHS value is missing"); + } + + this.drls.put(rule.getRuleReference(), rule.getWhen()); + this.reloadActiveRuleBase(); + } + catch(Exception e) + { + throw new RuntimeException(e); + } + } + + void removeRule(String ruleReference) + { + try + { + if(ruleReference == null || ruleReference.trim().length() == 0) + { + throw new IllegalArgumentException("Rule Reference is missing"); + } + + this.drls.remove(ruleReference); + this.reloadActiveRuleBase(); + } + catch(Exception e) + { + throw new RuntimeException(e); + } + } + //----------------------------------------------------------------------------------------------------------------------------------------------------------- + private synchronized void reloadActiveRuleBase() throws Exception + { + StringBuilder buffer = new StringBuilder(); + + buffer.append(DroolsRuleManager.rulePkg+"\n"); + + for(String drl: this.drls.values()) + { + buffer.append(drl+"\n"); + } + + Reader source = new InputStreamReader(new ByteArrayInputStream(buffer.toString().getBytes())); + try + { + PackageBuilder packageBuilder = new PackageBuilder(); + packageBuilder.addPackageFromDrl(source); + + if(this.activeRuleBase == null) + { + this.activeRuleBase = RuleBaseFactory.newRuleBase(); + } + + //Perform the reloading of the RuleBase with the updated Rules + this.activeRuleBase.lock(); + this.activeRuleBase.addPackage(packageBuilder.getPackage()); + this.activeRuleBase.unlock(); + } + finally + { + source.close(); + } + } +} Deleted: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/DroolsRuleManager.java =================================================================== --- modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/DroolsRuleManager.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/DroolsRuleManager.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -1,178 +0,0 @@ -/****************************************************************************** - * JBoss, a division of Red Hat * - * Copyright 2006, Red Hat Middleware, LLC, and individual * - * contributors as indicated by the @authors tag. See the * - * copyright.txt in the distribution for a full listing of * - * individual contributors. * - * * - * This is free software; you can redistribute it and/or modify it * - * under the terms of the GNU Lesser General Public License as * - * published by the Free Software Foundation; either version 2.1 of * - * the License, or (at your option) any later version. * - * * - * This software is distributed in the hope that it will be useful, * - * but WITHOUT ANY WARRANTY; without even the implied warranty of * - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * - * Lesser General Public License for more details. * - * * - * You should have received a copy of the GNU Lesser General Public * - * License along with this software; if not, write to the Free * - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * - ******************************************************************************/ -package org.jboss.security.authz.pap.service; - -import java.io.InputStreamReader; -import java.io.Reader; -import java.io.ByteArrayInputStream; -import java.util.Map; -import java.util.HashMap; - -import org.drools.RuleBase; -import org.drools.RuleBaseFactory; -import org.drools.compiler.PackageBuilder; - -import org.jboss.security.authz.model.DroolsRuleExpression; - -/** - * This service provides management for Drools based authorization Rules/Logic used by the Drools Function extension of the XACML Engine - * - * TODO: Add Database Persistence to the State of this Manager - * - * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - * - */ -public class DroolsRuleManager -{ - private static String rulePkg = - "package security\n"+ - "import org.jboss.security.authz.model.*;\n"+ - "import org.jboss.security.xacml.interfaces.XACMLConstants;\n"; - - private RuleBase activeRuleBase = null; - private Map<String, String> drls = null; - - public DroolsRuleManager() - { - } - - public void start() - { - try - { - this.drls = new HashMap<String, String>(); - this.reloadActiveRuleBase(); - } - catch(Exception e) - { - throw new RuntimeException(e); - } - } - - public void stop() - { - this.activeRuleBase = null; - this.drls = null; - } - //--------------------------------------------------------------------------------------------------------------------------------------------------------- - public RuleBase getActiveRuleBase() - { - return this.activeRuleBase; - } - - public void addRule(DroolsRuleExpression rule) throws Exception - { - if(rule.getRuleReference() == null || rule.getRuleReference().trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - if(rule.getWhen() == null || rule.getWhen().trim().length() == 0) - { - throw new IllegalArgumentException("LHS value is missing"); - } - - - this.drls.put(rule.getRuleReference(), rule.getWhen()); - this.reloadActiveRuleBase(); - } - - public DroolsRuleExpression readRule(String ruleReference) throws Exception - { - if(ruleReference == null || ruleReference.trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - - DroolsRuleExpression rule = null; - - String when = this.drls.get(ruleReference); - - rule = new DroolsRuleExpression(); - rule.setRuleReference(ruleReference); - rule.setWhen(when); - - return rule; - } - - public void updateRule(DroolsRuleExpression rule) throws Exception - { - if(rule.getRuleReference() == null || rule.getRuleReference().trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - if(rule.getWhen() == null || rule.getWhen().trim().length() == 0) - { - throw new IllegalArgumentException("LHS value is missing"); - } - - this.drls.put(rule.getRuleReference(), rule.getWhen()); - this.reloadActiveRuleBase(); - } - - public void removeRule(String ruleReference) throws Exception - { - if(ruleReference == null || ruleReference.trim().length() == 0) - { - throw new IllegalArgumentException("Rule Reference is missing"); - } - - this.drls.remove(ruleReference); - this.reloadActiveRuleBase(); - } - //----------------------------------------------------------------------------------------------------------------------------------------------------------- - private synchronized void reloadActiveRuleBase() throws Exception - { - StringBuilder buffer = new StringBuilder(); - - buffer.append(DroolsRuleManager.rulePkg+"\n"); - - for(String drl: this.drls.values()) - { - buffer.append(drl+"\n"); - } - - - ByteArrayInputStream bis = new ByteArrayInputStream(buffer.toString().getBytes()); - try - { - Reader source = new InputStreamReader(bis); - - PackageBuilder packageBuilder = new PackageBuilder(); - packageBuilder.addPackageFromDrl(source); - - if(this.activeRuleBase == null) - { - this.activeRuleBase = RuleBaseFactory.newRuleBase(); - } - - //Perform the reloading of the RuleBase with the updated Rules - this.activeRuleBase.lock(); - this.activeRuleBase.addPackage(packageBuilder.getPackage()); - this.activeRuleBase.unlock(); - } - finally - { - bis.close(); - } - } -} Modified: modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/hierarchial/TestHierarchialPolicy.java =================================================================== --- modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/hierarchial/TestHierarchialPolicy.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/hierarchial/TestHierarchialPolicy.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -29,9 +29,6 @@ import org.apache.log4j.Logger; -import org.jboss.security.xacml.interfaces.XACMLConstants; -import org.jboss.security.xacml.interfaces.XMLSchemaConstants; - import org.jboss.security.authz.model.*; @@ -58,14 +55,9 @@ { //SetUp the Policy Target Target target = new Target(); - for(int i=0; i<5; i++) - { - AttributeExpression resourceMatch = new AttributeExpression(); - resourceMatch.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); - Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_RESOURCE_ID, - XMLSchemaConstants.DATATYPE_STRING, "http://www.redhat.com/protected/index.html?tier="+i); - resourceMatch.setAttribute(attribute); - target.addResourceMatch(resourceMatch); + for(int i=0; i<1; i++) + { + target.addResourceMatch(ExpressionBuilder.getInstance().createResourceIdE...; } //SetUp the Policy Rules @@ -78,24 +70,13 @@ Target ruleTarget = new Target(); for(int i=0; i<5; i++) - { - AttributeExpression actionMatch = new AttributeExpression(); - actionMatch.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); - Attribute actionAttribute = new Attribute(XACMLConstants.ATTRIBUTEID_ACTION_ID, - XMLSchemaConstants.DATATYPE_STRING, "WRITE:/"+i); - actionMatch.setAttribute(actionAttribute); - ruleTarget.addActionMatch(actionMatch); - } - + { + ruleTarget.addActionMatch(ExpressionBuilder.getInstance().createActionExpression("WRITE:/"+i)); + } writeRule.setTarget(ruleTarget); - - AttributeExpression roleExpression = new AttributeExpression(); - roleExpression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); - Attribute roleAttribute = new Attribute(XACMLConstants.ATTRIBUTEID_ROLE, - XMLSchemaConstants.DATATYPE_STRING, "developer"); - roleExpression.setAttribute(roleAttribute); - writeRule.setExpression(roleExpression); + writeRule.setExpression(ExpressionBuilder.getInstance().createRoleExpression("developer")); + rules.add(writeRule); //Populate the HierarchialPolicy Modified: modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsFunction.java =================================================================== --- modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsFunction.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsFunction.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -176,7 +176,7 @@ return requestContext; } - private Policy getSimplePolicy() + private Policy getSimplePolicy() throws Exception { //SetUp the Policy Target Target target = new Target(); Copied: modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRuleManager.java (from rev 12334, modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestDroolsRuleManager.java) =================================================================== --- modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRuleManager.java (rev 0) +++ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRuleManager.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -0,0 +1,135 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.security.authz.pap.plugin; + + +import junit.framework.TestCase; + +import org.drools.WorkingMemory; +import org.drools.StatefulSession; + +import org.jboss.security.xacml.interfaces.XACMLConstants; +import org.jboss.security.xacml.interfaces.XMLSchemaConstants; +import org.jboss.security.authz.model.*; +import org.jboss.security.authz.pap.plugin.DroolsRuleManager; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + * + */ +public class TestDroolsRuleManager extends TestCase +{ + private static final String rule1 = + "rule \"Rule1\"\n"+ + "when\n"+ + "$subject: Subject()\n"+ + "String(toString == \"Rule1\")\n"+ + "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ + "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ + "then\n"+ + "System.out.println(\"Rule1 successfully fired\");\n"+ + "end\n"; + + private static final String rule2 = + "rule \"Rule2\"\n"+ + "when\n"+ + "$subject: Subject()\n"+ + "String(toString == \"Rule2\")\n"+ + "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ + "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ + "then\n"+ + "System.out.println(\"Rule2 successfully fired\");\n"+ + "end\n"; + + + private DroolsRuleManager ruleManager = null; + + + @Override + protected void setUp() throws Exception + { + this.ruleManager = new DroolsRuleManager(); + this.ruleManager.start(); + } + + @Override + protected void tearDown() throws Exception + { + this.ruleManager = null; + } + //------------------------------------------------------------------------------------------------------------------------------------------------------------ + public void testAddRule() throws Exception + { + DroolsRuleExpression expression = new DroolsRuleExpression(); + expression.setRuleReference("Rule2"); + expression.setWhen(TestDroolsRuleManager.rule2); + this.ruleManager.addRule(expression); + + WorkingMemory workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule2"); + workingMemory.insert(this.getSubject()); + + //Fire + System.out.println("Firing Rule2........"); + workingMemory.fireAllRules(); + ((StatefulSession)workingMemory).dispose(); + + expression.setRuleReference("Rule1"); + expression.setWhen(TestDroolsRuleManager.rule1); + this.ruleManager.addRule(expression); + + workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule1"); + workingMemory.insert(this.getSubject()); + + //Fire + System.out.println("Firing Rule1........"); + workingMemory.fireAllRules(); + ((StatefulSession)workingMemory).dispose(); + + workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); + workingMemory.insert("Rule2"); + workingMemory.insert(this.getSubject()); + + //Fire + System.out.println("Firing Rule2........"); + workingMemory.fireAllRules(); + ((StatefulSession)workingMemory).dispose(); + } + //----------------------------------------------------------------------------------------------------------------------------------------------------------- + private Subject getSubject() + { + Subject subject = new Subject(); + + subject.setCategory(XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT); + + //Create a Role Attribute + Attribute attribute = new Attribute(); + attribute.setUri(XACMLConstants.ATTRIBUTEID_ROLE); + attribute.setDatatType(XMLSchemaConstants.DATATYPE_STRING); + attribute.setValue("developer"); + subject.addAttribute(attribute); + + return subject; + } +} Modified: modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRules.java =================================================================== --- modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRules.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/plugin/TestDroolsRules.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -31,7 +31,6 @@ import org.jboss.security.xacml.interfaces.XACMLConstants; import org.jboss.security.xacml.interfaces.XMLSchemaConstants; import org.jboss.security.authz.model.*; -import org.jboss.security.authz.pap.service.DroolsRuleManager; /** * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> Deleted: modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestDroolsRuleManager.java =================================================================== --- modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestDroolsRuleManager.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestDroolsRuleManager.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -1,134 +0,0 @@ -/****************************************************************************** - * JBoss, a division of Red Hat * - * Copyright 2006, Red Hat Middleware, LLC, and individual * - * contributors as indicated by the @authors tag. See the * - * copyright.txt in the distribution for a full listing of * - * individual contributors. * - * * - * This is free software; you can redistribute it and/or modify it * - * under the terms of the GNU Lesser General Public License as * - * published by the Free Software Foundation; either version 2.1 of * - * the License, or (at your option) any later version. * - * * - * This software is distributed in the hope that it will be useful, * - * but WITHOUT ANY WARRANTY; without even the implied warranty of * - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * - * Lesser General Public License for more details. * - * * - * You should have received a copy of the GNU Lesser General Public * - * License along with this software; if not, write to the Free * - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * - ******************************************************************************/ -package org.jboss.security.authz.pap.service; - - -import junit.framework.TestCase; - -import org.drools.WorkingMemory; -import org.drools.StatefulSession; - -import org.jboss.security.xacml.interfaces.XACMLConstants; -import org.jboss.security.xacml.interfaces.XMLSchemaConstants; -import org.jboss.security.authz.model.*; -import org.jboss.security.authz.pap.service.DroolsRuleManager; - -/** - * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> - * - */ -public class TestDroolsRuleManager extends TestCase -{ - private static final String rule2 = - "rule \"Rule2\"\n"+ - "when\n"+ - "$subject: Subject()\n"+ - "String(toString == \"Rule2\")\n"+ - "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ - "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ - "then\n"+ - "System.out.println(\"Rule2 successfully fired\");\n"+ - "end\n"; - - private static final String rule1 = - "rule \"Rule1\"\n"+ - "when\n"+ - "$subject: Subject()\n"+ - "String(toString == \"Rule1\")\n"+ - "Subject(category == XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT)\n"+ - "Attribute(uri == XACMLConstants.ATTRIBUTEID_ROLE && value == \"developer\") from $subject.attributes\n"+ - "then\n"+ - "System.out.println(\"Rule1 successfully fired\");\n"+ - "end\n"; - - private DroolsRuleManager ruleManager = null; - - - @Override - protected void setUp() throws Exception - { - this.ruleManager = new DroolsRuleManager(); - this.ruleManager.start(); - } - - @Override - protected void tearDown() throws Exception - { - this.ruleManager = null; - } - //------------------------------------------------------------------------------------------------------------------------------------------------------------ - public void testAddRule() throws Exception - { - DroolsRuleExpression expression = new DroolsRuleExpression(); - expression.setRuleReference("Rule2"); - expression.setWhen(TestDroolsRuleManager.rule2); - this.ruleManager.addRule(expression); - - WorkingMemory workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule2"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule2........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - - expression.setRuleReference("Rule1"); - expression.setWhen(TestDroolsRuleManager.rule1); - this.ruleManager.addRule(expression); - - workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule1"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule1........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - - workingMemory = ruleManager.getActiveRuleBase().newStatefulSession(); - workingMemory.insert("Rule2"); - workingMemory.insert(this.getSubject()); - - //Fire - System.out.println("Firing Rule2........"); - workingMemory.fireAllRules(); - ((StatefulSession)workingMemory).dispose(); - } - //----------------------------------------------------------------------------------------------------------------------------------------------------------- - private Subject getSubject() - { - Subject subject = new Subject(); - - subject.setCategory(XACMLConstants.ATTRIBUTEID_ACCESS_SUBJECT); - - //Create a Role Attribute - Attribute attribute = new Attribute(); - attribute.setUri(XACMLConstants.ATTRIBUTEID_ROLE); - attribute.setDatatType(XMLSchemaConstants.DATATYPE_STRING); - attribute.setValue("developer"); - subject.addAttribute(attribute); - - return subject; - } -} Modified: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Action.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Action.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Action.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -62,5 +62,5 @@ public void setAttributes(Set<Attribute> attributes) { this.attributes = attributes; - } + } } Added: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/ExpressionBuilder.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/ExpressionBuilder.java (rev 0) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/ExpressionBuilder.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -0,0 +1,192 @@ +/****************************************************************************** + * JBoss, a division of Red Hat * + * Copyright 2006, Red Hat Middleware, LLC, and individual * + * contributors as indicated by the @authors tag. See the * + * copyright.txt in the distribution for a full listing of * + * individual contributors. * + * * + * This is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as * + * published by the Free Software Foundation; either version 2.1 of * + * the License, or (at your option) any later version. * + * * + * This software is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with this software; if not, write to the Free * + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * + ******************************************************************************/ +package org.jboss.security.authz.model; + +import org.jboss.security.xacml.interfaces.XACMLConstants; +import org.jboss.security.xacml.interfaces.XMLSchemaConstants; + +/** + * ExpressionBuilder provides easy to use operations for generating commonly used Expressions that must be represented within a Policy + * + * The purpose of this class is to provide a user friendly API for Developers to create these commonly used Expressions without having to deal with + * low-level XACML related concepts/API + * + * This API will grow as more and more different types of Expressions are added to the System as part of the core API + * + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + * + */ +public class ExpressionBuilder +{ + private static ExpressionBuilder singleton = null; + + private ExpressionBuilder() + { + + } + + public static ExpressionBuilder getInstance() + { + if(ExpressionBuilder.singleton == null) + { + ExpressionBuilder.singleton = new ExpressionBuilder(); + } + return ExpressionBuilder.singleton; + } + //--------Resource expressions----------------------------------------------------------------------------------------------------------------------------- + /** + * Creates an expression for matching a unique Resource via its unique Id + * + * @param resourceId Unique Id of a Resource in the system that a policy should be applied to + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createResourceIdExpression(String resourceId) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_RESOURCE_ID, + XMLSchemaConstants.DATATYPE_STRING, resourceId); + expression.setAttribute(attribute); + + return expression; + } + + /** + * Creates an expression for matching a Resource Location + * + * @param resourceLocation the Location of a Resource in the system that a policy should be applied to + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createResourceLocationExpression(String resourceLocation) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_RESOURCE_LOCATION, + XMLSchemaConstants.DATATYPE_STRING, resourceLocation); + expression.setAttribute(attribute); + + return expression; + } + + /** + * Creates an expression for matching a File stored on the machine + * + * @param fileName Name of the file + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createFileNameExpression(String fileName) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_SIMPLE_FILE_NAME, + XMLSchemaConstants.DATATYPE_STRING, fileName); + expression.setAttribute(attribute); + + return expression; + } + //---------Action Expressions--------------------------------------------------------------------------------------------------------------------------------- + /** + * Creates an expression for matching an Action + * + * @param action signifies the Action that is to be protected on the resoource in question + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createActionExpression(String action) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute actionAttribute = new Attribute(XACMLConstants.ATTRIBUTEID_ACTION_ID, + XMLSchemaConstants.DATATYPE_STRING, action); + expression.setAttribute(actionAttribute); + + return expression; + } + //---------Subject Expressions---------------------------------------------------------------------------------------------------------------------------------- + /** + * Creates an expression for matching an the Identity of the Authenticated User + * + * @param subjectId Identity of the Authenticated User + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createIdentityExpression(String identity) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_SUBJECT_ID, + XMLSchemaConstants.DATATYPE_STRING, identity); + expression.setAttribute(attribute); + + return expression; + } + + /** + * Creates an expression for matching the Role of the Authenticated User + * + * @param role Role of the Authenticated User + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createRoleExpression(String role) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_ROLE, + XMLSchemaConstants.DATATYPE_STRING, role); + expression.setAttribute(attribute); + + return expression; + } + //---------Environment Expressions------------------------------------------------------------------------------------------------------------------------------ + //---------Custom Expressions----------------------------------------------------------------------------------------------------------------------------------- + /** + * A generic method used to produce an Expression related to the type of Attribute designated by the Attribute Uri specified + * The function used within the Expression is a String equals + * + * @param attributeUri designates the type of Attribute in question + * @param attributeValue the Value of the Attribute for matching + * @return an expression that will be used within the Policy Definition + */ + public AttributeExpression createCustomExpression(String attributeUri, String attributeValue) + { + AttributeExpression expression = new AttributeExpression(); + + expression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL); + + Attribute attribute = new Attribute(attributeUri, + XMLSchemaConstants.DATATYPE_STRING, attributeValue); + expression.setAttribute(attribute); + + return expression; + } +} Modified: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/PolicyException.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/PolicyException.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/PolicyException.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -28,7 +28,6 @@ */ public class PolicyException extends Exception { - public PolicyException() { super(); Modified: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Resource.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Resource.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Resource.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -24,6 +24,7 @@ import java.util.Set; + /** * Represents the protected Resource of the system upon which various Actions can be performed * @@ -62,5 +63,5 @@ public void setAttributes(Set<Attribute> attributes) { this.attributes = attributes; - } + } } Modified: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Subject.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Subject.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Subject.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -100,7 +100,5 @@ } this.attributes.add(attribute); - } - - + } } Modified: modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Target.java =================================================================== --- modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Target.java 2008-12-04 23:14:45 UTC (rev 12348) +++ modules/authorization/trunk/common/src/main/java/org/jboss/security/authz/model/Target.java 2008-12-05 05:54:40 UTC (rev 12349) @@ -42,7 +42,15 @@ public Target() { + this.resources = new ArrayList<Resource>(); + this.actions = new ArrayList<Action>(); + this.subjects = new ArrayList<Subject>(); + this.environments = new ArrayList<Environment>(); + this.resourceMatches = new ArrayList<AttributeExpression>(); + this.actionMatches = new ArrayList<AttributeExpression>(); + this.subjectMatches = new ArrayList<AttributeExpression>(); + this.environmentMatches = new ArrayList<AttributeExpression>(); } public List<Action> getActions() @@ -52,6 +60,10 @@ public void setActions(List<Action> actions) { + if(actions == null) + { + actions = new ArrayList<Action>(); + } this.actions = actions; } @@ -62,6 +74,10 @@ public void setEnvironments(List<Environment> environments) { + if(environments == null) + { + environments = new ArrayList<Environment>(); + } this.environments = environments; } @@ -72,6 +88,10 @@ public void setResources(List<Resource> resources) { + if(resources == null) + { + resources = new ArrayList<Resource>(); + } this.resources = resources; } @@ -82,6 +102,10 @@ public void setSubjects(List<Subject> subjects) { + if(subjects == null) + { + subjects = new ArrayList<Subject>(); + } this.subjects = subjects; } @@ -92,6 +116,10 @@ public void setActionMatches(List<AttributeExpression> actionMatches) { + if(actionMatches == null) + { + actionMatches = new ArrayList<AttributeExpression>(); + } this.actionMatches = actionMatches; } @@ -102,6 +130,10 @@ public void setEnvironmentMatches(List<AttributeExpression> environmentMatches) { + if(environmentMatches == null) + { + environmentMatches = new ArrayList<AttributeExpression>(); + } this.environmentMatches = environmentMatches; } @@ -112,6 +144,10 @@ public void setResourceMatches(List<AttributeExpression> resourceMatches) { + if(resourceMatches == null) + { + resourceMatches = new ArrayList<AttributeExpression>(); + } this.resourceMatches = resourceMatches; } @@ -122,24 +158,50 @@ public void setSubjectMatches(List<AttributeExpression> subjectMatches) { + if(subjectMatches == null) + { + subjectMatches = new ArrayList<AttributeExpression>(); + } this.subjectMatches = subjectMatches; } //-------------------------------------------------------------------------------------------------------------------------------------------------------- + public void addResource(Resource resource) + { + this.resources.add(resource); + } + + public void addSubject(Subject subject) + { + this.subjects.add(subject); + } + + public void addAction(Action action) + { + this.actions.add(action); + } + + public void addEnvironment(Environment environment) + { + this.environments.add(environment); + } + public void addResourceMatch(AttributeExpression resourceMatch) - { - if(this.resourceMatches == null) - { - this.resourceMatches = new ArrayList<AttributeExpression>(); - } + { this.resourceMatches.add(resourceMatch); } public void addActionMatch(AttributeExpression actionMatch) - { - if(this.actionMatches == null) - { - this.actionMatches = new ArrayList<AttributeExpression>(); - } + { this.actionMatches.add(actionMatch); } + + public void addSubjectMatch(AttributeExpression subjectMatch) + { + this.subjectMatches.add(subjectMatch); + } + + public void addEnvironmentMatch(AttributeExpression envMatch) + { + this.environmentMatches.add(envMatch); + } }