Author: sohil.shah(a)jboss.com
Date: 2009-02-03 12:24:30 -0500 (Tue, 03 Feb 2009)
New Revision: 12767
Added:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServerException.java
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java
Removed:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinder.java
Modified:
modules/authorization/trunk/policy-server/pom.xml
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/PolicyStore.java
modules/authorization/trunk/policy-server/src/main/resources/META-INF/jboss-beans.xml
modules/authorization/trunk/policy-server/src/main/resources/META-INF/pdp-config.xml
modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestPolicyServer.java
Log:
first pass at implementing the EnterprisePolicyFinderModule
Modified: modules/authorization/trunk/policy-server/pom.xml
===================================================================
--- modules/authorization/trunk/policy-server/pom.xml 2009-02-02 11:41:03 UTC (rev 12766)
+++ modules/authorization/trunk/policy-server/pom.xml 2009-02-03 17:24:30 UTC (rev 12767)
@@ -21,6 +21,11 @@
</dependency>
<dependency>
<groupId>org.jboss.security.authz</groupId>
+ <artifactId>jboss-authz-core-components</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.jboss.security.authz</groupId>
<artifactId>jboss-authz-enforcement</artifactId>
<version>${project.version}</version>
</dependency>
@@ -60,8 +65,8 @@
<artifactId>maven-surefire-plugin</artifactId>
<version>2.3.1</version>
<configuration>
- <includes>
- <include>**/TestPolicyServer.java</include>
+ <includes>
+ <include>**/TestPolicyServer.java</include>
</includes>
</configuration>
</plugin>
Modified:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java
===================================================================
---
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServer.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -21,16 +21,24 @@
*/
package org.jboss.security.authz.policy.server;
+import java.util.Set;
+
import org.apache.log4j.Logger;
import org.jboss.security.authz.model.Policy;
+import org.jboss.security.authz.model.PolicyMetaData;
import org.jboss.security.authz.model.PolicyException;
+import org.jboss.security.authz.tools.GeneralTool;
import org.jboss.security.authz.policy.server.decision.PolicyDecisionPoint;
import org.jboss.security.authz.policy.server.spi.PolicyStore;
+import org.jboss.security.authz.policy.server.plugin.HierarchialPolicy;
+import org.jboss.security.authz.policy.server.plugin.EnterprisePolicyFinderModule;
import org.jboss.security.authz.enforcement.Request;
import org.jboss.security.authz.enforcement.Response;
+import org.jboss.security.xacml.sunxacml.finder.PolicyFinderModule;
+
/**
* The Central Policy Server
*
@@ -42,6 +50,7 @@
private PolicyDecisionPoint policyDecisionPoint;
private PolicyStore policyStore;
+ private EnterprisePolicyFinderModule policyFinderModule;
public PolicyServer()
{
@@ -49,7 +58,22 @@
}
public void start()
- {
+ {
+ try
+ {
+ Set<PolicyFinderModule> finders =
this.policyDecisionPoint.getPDPConfiguration().getPolicyFinder().getModules();
+ for(PolicyFinderModule module: finders)
+ {
+ if(module instanceof EnterprisePolicyFinderModule)
+ {
+ this.policyFinderModule = (EnterprisePolicyFinderModule)module;
+ }
+ }
+ }
+ catch(Exception e)
+ {
+ throw new RuntimeException(e);
+ }
}
public void stop()
@@ -105,6 +129,18 @@
}
//------- Provisioning
services-----------------------------------------------------------------------------------------------------------------------------
/**
+ * Generates a new Policy instance based on the supplied MetaData and stores it into
the Policy Store
+ *
+ * @param policyMetaData meta data for the policy to be created
+ */
+ public void newPolicy(PolicyMetaData policyMetaData) throws PolicyException
+ {
+ Policy policy = new HierarchialPolicy(GeneralTool.generateUniqueId(), policyMetaData);
+ this.policyStore.savePolicy(policy);
+ this.policyFinderModule.addPolicy(policy);
+ }
+
+ /**
* Read a stored Policy identified by the unique policyUri
*
* @param policyUri
@@ -124,18 +160,8 @@
{
return this.policyStore.readAllPolicies();
}
-
+
/**
- * Saves a Policy into storage. If this policy already exists in storage, then it
updates it
- *
- * @param policy Policy to be saved into storage
- */
- public void savePolicy(Policy policy) throws PolicyException
- {
- this.policyStore.savePolicy(policy);
- }
-
- /**
* Deletes the specified Policy from storage
*
* @param policyUri unique identifier for the Policy
Added:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServerException.java
===================================================================
---
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServerException.java
(rev 0)
+++
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/PolicyServerException.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -0,0 +1,50 @@
+/******************************************************************************
+ * JBoss, a division of Red Hat *
+ * Copyright 2006, Red Hat Middleware, LLC, and individual *
+ * contributors as indicated by the @authors tag. See the *
+ * copyright.txt in the distribution for a full listing of *
+ * individual contributors. *
+ * *
+ * This is free software; you can redistribute it and/or modify it *
+ * under the terms of the GNU Lesser General Public License as *
+ * published by the Free Software Foundation; either version 2.1 of *
+ * the License, or (at your option) any later version. *
+ * *
+ * This software is distributed in the hope that it will be useful, *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU *
+ * Lesser General Public License for more details. *
+ * *
+ * You should have received a copy of the GNU Lesser General Public *
+ * License along with this software; if not, write to the Free *
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *
+ * 02110-1301 USA, or see the FSF site:
http://www.fsf.org. *
+ ******************************************************************************/
+package org.jboss.security.authz.policy.server;
+
+/**
+ * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a>
+ *
+ */
+public class PolicyServerException extends Exception
+{
+ public PolicyServerException()
+ {
+ super();
+ }
+
+ public PolicyServerException(String message, Throwable cause)
+ {
+ super(message, cause);
+ }
+
+ public PolicyServerException(String message)
+ {
+ super(message);
+ }
+
+ public PolicyServerException(Throwable cause)
+ {
+ super(cause);
+ }
+}
Modified:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java
===================================================================
---
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -27,9 +27,11 @@
import org.jboss.security.authz.enforcement.Request;
import org.jboss.security.authz.enforcement.Response;
+import org.jboss.security.authz.policy.server.PolicyServerException;
import org.jboss.security.xacml.sunxacml.ConfigurationStore;
import org.jboss.security.xacml.sunxacml.PDP;
+import org.jboss.security.xacml.sunxacml.PDPConfig;
/**
* This component processes all incoming Authorization requests and responds with a
response
@@ -45,6 +47,7 @@
private static Logger log = Logger.getLogger(PolicyDecisionPoint.class);
private PDP policyDecisionPoint;
+ private ConfigurationStore store;
public PolicyDecisionPoint()
{
@@ -55,11 +58,11 @@
{
try
{
- ConfigurationStore store = new ConfigurationStore(new
File(Thread.currentThread().getContextClassLoader().
+ this.store = new ConfigurationStore(new
File(Thread.currentThread().getContextClassLoader().
getResource("META-INF/pdp-config.xml").getFile()));
- store.useDefaultFactories();
+ this.store.useDefaultFactories();
- this.policyDecisionPoint = new PDP(store.getDefaultPDPConfig());
+ this.policyDecisionPoint = new PDP(this.store.getDefaultPDPConfig());
log.info("-------------------------------------------------------");
log.info("Policy Decision Point successfully
started.....................");
@@ -75,6 +78,7 @@
public void stop()
{
this.policyDecisionPoint = null;
+ this.store = null;
}
//-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
/**
@@ -105,4 +109,16 @@
String responseXml = null;
return responseXml;
}
+ //---------Expose some configuration
information--------------------------------------------------------------------------------------------------------------------------------------------------
+ public PDPConfig getPDPConfiguration() throws PolicyServerException
+ {
+ try
+ {
+ return this.store.getDefaultPDPConfig();
+ }
+ catch(Exception e)
+ {
+ throw new PolicyServerException(e);
+ }
+ }
}
Deleted:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinder.java
===================================================================
---
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinder.java 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinder.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -1,52 +0,0 @@
-/******************************************************************************
- * JBoss, a division of Red Hat *
- * Copyright 2006, Red Hat Middleware, LLC, and individual *
- * contributors as indicated by the @authors tag. See the *
- * copyright.txt in the distribution for a full listing of *
- * individual contributors. *
- * *
- * This is free software; you can redistribute it and/or modify it *
- * under the terms of the GNU Lesser General Public License as *
- * published by the Free Software Foundation; either version 2.1 of *
- * the License, or (at your option) any later version. *
- * *
- * This software is distributed in the hope that it will be useful, *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU *
- * Lesser General Public License for more details. *
- * *
- * You should have received a copy of the GNU Lesser General Public *
- * License along with this software; if not, write to the Free *
- * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *
- * 02110-1301 USA, or see the FSF site:
http://www.fsf.org. *
- ******************************************************************************/
-package org.jboss.security.authz.policy.server.plugin;
-
-import org.jboss.security.xacml.sunxacml.finder.PolicyFinder;
-import org.jboss.security.xacml.sunxacml.finder.PolicyFinderModule;
-
-/**
- * A production ready Enterprise Policy Finder that would be used by the Policy
Server/PDP component.
- *
- * It is designed for being production ready from a performance/scalability/clustering
standpoint
- *
- * This particular version will provide performance enhancement by the use of a clustered
cache based on JBoss Cache
- * The actual storage of the policies will be done within a relational database
- *
- * This also allows for runtime modification of Security Policies without requiring any
restart/refresh of the Applications
- *
- * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a>
- *
- */
-public class EnterprisePolicyFinder extends PolicyFinderModule
-{
- public EnterprisePolicyFinder()
- {
-
- }
-
- @Override
- public void init(PolicyFinder finder)
- {
- }
-}
\ No newline at end of file
Copied:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java
(from rev 12766,
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinder.java)
===================================================================
---
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java
(rev 0)
+++
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/plugin/EnterprisePolicyFinderModule.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -0,0 +1,155 @@
+/******************************************************************************
+ * JBoss, a division of Red Hat *
+ * Copyright 2006, Red Hat Middleware, LLC, and individual *
+ * contributors as indicated by the @authors tag. See the *
+ * copyright.txt in the distribution for a full listing of *
+ * individual contributors. *
+ * *
+ * This is free software; you can redistribute it and/or modify it *
+ * under the terms of the GNU Lesser General Public License as *
+ * published by the Free Software Foundation; either version 2.1 of *
+ * the License, or (at your option) any later version. *
+ * *
+ * This software is distributed in the hope that it will be useful, *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU *
+ * Lesser General Public License for more details. *
+ * *
+ * You should have received a copy of the GNU Lesser General Public *
+ * License along with this software; if not, write to the Free *
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *
+ * 02110-1301 USA, or see the FSF site:
http://www.fsf.org. *
+ ******************************************************************************/
+package org.jboss.security.authz.policy.server.plugin;
+
+import java.io.IOException;
+import java.io.ByteArrayInputStream;
+
+import org.apache.log4j.Logger;
+
+import org.jboss.security.authz.model.Policy;
+import org.jboss.security.authz.policy.server.PolicyServerException;
+
+import org.jboss.security.xacml.sunxacml.EvaluationCtx;
+import org.jboss.security.xacml.sunxacml.finder.PolicyFinder;
+import org.jboss.security.xacml.sunxacml.finder.PolicyFinderModule;
+import org.jboss.security.xacml.sunxacml.finder.PolicyFinderResult;
+import org.jboss.security.xacml.sunxacml.support.finder.PolicyReader;
+import org.jboss.security.xacml.sunxacml.support.finder.PolicyCollection;
+import org.jboss.security.xacml.sunxacml.support.finder.TopLevelPolicyException;
+import org.jboss.security.xacml.sunxacml.AbstractPolicy;
+
+/**
+ * A production ready Enterprise Policy Finder that would be used by the Policy
Server/PDP component.
+ *
+ * It is designed for being production ready from a performance/scalability/clustering
standpoint
+ *
+ * This particular version will provide performance enhancement by the use of a clustered
cache based on JBoss Cache
+ * The actual storage of the policies will be done within a relational database
+ *
+ * This also allows for runtime modification of Security Policies without requiring any
restart/refresh of the Applications
+ *
+ * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a>
+ *
+ */
+public class EnterprisePolicyFinderModule extends PolicyFinderModule
+{
+ private static Logger log = Logger.getLogger(EnterprisePolicyFinderModule.class);
+
+ private PolicyReader reader;
+ private PolicyCollection policies;
+
+ public EnterprisePolicyFinderModule()
+ {
+ this.policies = new PolicyCollection();
+ }
+
+ public void addPolicy(Policy policy) throws PolicyServerException
+ {
+ ByteArrayInputStream bos = null;
+ try
+ {
+ String xacmlPolicyStr = policy.generateXACMLPolicy();
+ bos = new ByteArrayInputStream(xacmlPolicyStr.getBytes());
+
+
+ AbstractPolicy xacmlPolicy = this.reader.readPolicy(bos);
+ this.policies.addPolicy(xacmlPolicy);
+ }
+ catch(Exception e)
+ {
+ log.error(this, e);
+ throw new PolicyServerException(e);
+ }
+ finally
+ {
+ if(bos != null)
+ {
+ try
+ {
+ bos.close();
+ }catch(IOException ioe){}
+ }
+ }
+ }
+ //-----------PolicyFinderModule
Implementation------------------------------------------------------------------------------------------------------------
+ /**
+ * Initializes this module for use by the given finder. Typically this
+ * is called when a <code>PDP</code> is initialized with a
+ * <code>PDPConfig</code> containing the given
<code>PolicyFinder</code>.
+ * Because <code>PolicyFinderModule</code>s usually need to parse
+ * policies, and this requires knowing their <code>PolicyFinder<code>,
+ * parsing is usually done at or after this point in the lifetime
+ * of this module. This might also be a good time to reset any internal
+ * caches or temporary data. Note that this method may be called more
+ * than once in the lifetime of a module.
+ *
+ * @param finder the <code>PolicyFinder</code> using this module
+ */
+ public void init(PolicyFinder finder)
+ {
+ this.reader = new PolicyReader(finder,
java.util.logging.Logger.getLogger(this.getClass().getName()));
+ }
+
+ /**
+ * Returns true if the module supports finding policies based on a
+ * request (ie, target matching). By default this method returns false.
+ *
+ * @return true if request retrieval is supported
+ */
+ public boolean isRequestSupported()
+ {
+ return true;
+ }
+
+ /**
+ * Tries to find one and only one matching policy given the request
+ * represented by the context data. If more than one policy is found,
+ * this is an error and must be reported as such. If no policies are
+ * found, then an empty result must be returned. By default this
+ * method returns an empty result. This method should never return null.
+ *
+ * @param context the representation of the request
+ *
+ * @return the result of looking for a matching policy
+ */
+ public PolicyFinderResult findPolicy(EvaluationCtx context)
+ {
+ try
+ {
+ AbstractPolicy policy = this.policies.getPolicy(context);
+ if (policy == null)
+ {
+ return new PolicyFinderResult();
+ }
+ else
+ {
+ return new PolicyFinderResult(policy);
+ }
+ }
+ catch (TopLevelPolicyException e)
+ {
+ return new PolicyFinderResult(e.getStatus());
+ }
+ }
+}
\ No newline at end of file
Modified:
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/PolicyStore.java
===================================================================
---
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/PolicyStore.java 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/spi/PolicyStore.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -30,7 +30,7 @@
*
*/
public interface PolicyStore
-{
+{
/**
* Read a stored Policy identified by the unique policyUri
*
Modified:
modules/authorization/trunk/policy-server/src/main/resources/META-INF/jboss-beans.xml
===================================================================
---
modules/authorization/trunk/policy-server/src/main/resources/META-INF/jboss-beans.xml 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/main/resources/META-INF/jboss-beans.xml 2009-02-03
17:24:30 UTC (rev 12767)
@@ -16,5 +16,8 @@
</bean>
<bean name="/policy-server/PolicyStore"
class="org.jboss.security.authz.policy.server.provisioning.MemoryPolicyStore">
+ </bean>
+
+ <bean name="/policy-server/PolicyDeployer"
class="org.jboss.security.authz.policy.server.provisioning.PolicyDeployer">
</bean>
</deployment>
\ No newline at end of file
Modified:
modules/authorization/trunk/policy-server/src/main/resources/META-INF/pdp-config.xml
===================================================================
---
modules/authorization/trunk/policy-server/src/main/resources/META-INF/pdp-config.xml 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/main/resources/META-INF/pdp-config.xml 2009-02-03
17:24:30 UTC (rev 12767)
@@ -6,7 +6,7 @@
<pdp name="pdp">
<attributeFinderModule
class="org.jboss.security.xacml.sunxacml.finder.impl.CurrentEnvModule"/>
<attributeFinderModule
class="org.jboss.security.xacml.sunxacml.finder.impl.SelectorModule"/>
- <policyFinderModule
class="org.jboss.security.authz.policy.server.plugin.EnterprisePolicyFinder">
+ <policyFinderModule
class="org.jboss.security.authz.policy.server.plugin.EnterprisePolicyFinderModule">
</policyFinderModule>
</pdp>
Modified:
modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestPolicyServer.java
===================================================================
---
modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestPolicyServer.java 2009-02-02
11:41:03 UTC (rev 12766)
+++
modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestPolicyServer.java 2009-02-03
17:24:30 UTC (rev 12767)
@@ -22,24 +22,44 @@
package org.jboss.security.authz.policy.server;
import junit.framework.TestCase;
+import org.apache.log4j.Logger;
+import org.jboss.security.authz.model.Policy;
+import org.jboss.security.authz.components.http.HttpResource;
+import org.jboss.security.authz.policy.server.PolicyServer;
+
/**
* @author <a href="mailto:sshah@redhat.com">Sohil Shah</a>
*/
public class TestPolicyServer extends TestCase
{
+ private static Logger log = Logger.getLogger(TestPolicyServer.class);
+
+ private PolicyServer policyServer;
+
public void setUp() throws Exception
{
Server.bootstrap();
+ this.policyServer =
(PolicyServer)Server.lookup("/policy-server/PolicyServer");
}
public void tearDown() throws Exception
{
-
}
- public void test() throws Exception
+ public void testNewPolicy() throws Exception
{
+ HttpResource httpResource = new HttpResource();
+ httpResource.setUrl("/blah/index.html");
+ httpResource.addParameter("param1", "param1Value");
+ policyServer.newPolicy(httpResource.getPolicyMetaData(true));
+
+ //Assert Policy State of the Server
+ Policy[] policies = policyServer.readAllPolicies();
+
+ assertTrue("Policy Store must not be empty!!", (policies != null &&
policies.length == 1));
+ log.info("------------------------------------------------------------------------------");
+ log.info(policies[0].generateXACMLPolicy());
}
}