Author: sohil.shah(a)jboss.com Date: 2009-05-09 14:35:59 -0400 (Sat, 09 May 2009) New Revision: 13330 Added: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestHierarchialPropagation.java Modified: modules/authorization/trunk/enforcement/src/main/java/org/jboss/security/authz/enforcement/Request.java modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java Log: first successful pass at recursive access for hierarchial objects Modified: modules/authorization/trunk/enforcement/src/main/java/org/jboss/security/authz/enforcement/Request.java =================================================================== --- modules/authorization/trunk/enforcement/src/main/java/org/jboss/security/authz/enforcement/Request.java 2009-05-08 19:18:25 UTC (rev 13329) +++ modules/authorization/trunk/enforcement/src/main/java/org/jboss/security/authz/enforcement/Request.java 2009-05-09 18:35:59 UTC (rev 13330) @@ -45,6 +45,11 @@ private Action action; private Environment environment; + /** + * Used to indicate if this request should go through access check based on the tree hierarchy of resources represented by its unique resource URI + */ + private boolean activateHierarchialEnforcement; + public Request() { this.resources = new HashSet<Resource>(); @@ -101,6 +106,17 @@ this.subjects.add(subject); } + + public boolean isActivateHierarchialEnforcement() + { + return activateHierarchialEnforcement; + } + + public void setActivateHierarchialEnforcement(boolean activateHierarchialEnforcement) + { + this.activateHierarchialEnforcement = activateHierarchialEnforcement; + } + public RequestType encode() { RequestType jaxbObject = new RequestType(); Modified: modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java =================================================================== --- modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java 2009-05-08 19:18:25 UTC (rev 13329) +++ modules/authorization/trunk/policy-server/src/main/java/org/jboss/security/authz/policy/server/decision/PolicyDecisionPoint.java 2009-05-09 18:35:59 UTC (rev 13330) @@ -26,6 +26,7 @@ import java.io.OutputStream; import java.io.FileOutputStream; import java.io.IOException; +import java.util.StringTokenizer; import org.apache.log4j.Logger; @@ -33,7 +34,10 @@ import org.jboss.security.authz.enforcement.Request; import org.jboss.security.authz.enforcement.Response; import org.jboss.security.authz.policy.server.PolicyServerException; +import org.jboss.security.authz.model.Resource; +import org.jboss.security.authz.model.Attribute; + import org.jboss.security.xacml.factories.RequestResponseContextFactory; import org.jboss.security.xacml.interfaces.RequestContext; import org.jboss.security.xacml.interfaces.ResponseContext; @@ -43,6 +47,7 @@ import org.jboss.security.xacml.sunxacml.PDPConfig; import org.jboss.security.xacml.sunxacml.ctx.RequestCtx; import org.jboss.security.xacml.sunxacml.ctx.ResponseCtx; +import org.jboss.security.xacml.core.model.context.RequestType; /** * This component processes all incoming Authorization requests and responds with a response @@ -137,41 +142,13 @@ { try { - Response response = new Response(); - RequestContext requestContext = RequestResponseContextFactory.createRequestCtx(); - requestContext.setRequest(request.encode()); - - requestContext.marshall(System.out); - - RequestCtx xacmlRequestCtx = (RequestCtx)requestContext.get(XACMLConstants.REQUEST_CTX); - ResponseCtx xacmlResponseCtx = this.policyDecisionPoint.evaluate(xacmlRequestCtx); - - ResponseContext responseContext = RequestResponseContextFactory.createResponseContext(); - responseContext.set(XACMLConstants.RESPONSE_CTX, xacmlResponseCtx); - - responseContext.marshall(System.out); - - if(responseContext.getDecision() == XACMLConstants.DECISION_PERMIT) - { - response.setAccessGranted(true); - response.setMessage("permit"); - } - else if(responseContext.getDecision() == XACMLConstants.DECISION_DENY) - { - response.setAccessGranted(false); - response.setMessage("deny"); - } - else if(responseContext.getDecision() == XACMLConstants.DECISION_INDETERMINATE) - { - response.setAccessGranted(false); - response.setMessage("indeterminate"); - } - else if(responseContext.getDecision() == XACMLConstants.DECISION_NOT_APPLICABLE) - { - response.setAccessGranted(false); - response.setMessage("notapplicable"); - } + if(request.isActivateHierarchialEnforcement()) + { + return this.checkHierarchialAccess(request); + } + + Response response = this.check(request.encode()); return response; } @@ -213,4 +190,98 @@ { return this.policyDecisionPoint; } + //------------------------------------------------------------------------------------------------------------------------------------------------------------------------- + private Response checkHierarchialAccess(Request request) throws Exception + { + Response response = new Response(); + + //Check for explicit access control + response = this.check(request.encode()); + + if(response.isNotApplicable()) + { + //Need to go into snapshot mode + Resource resource = request.getResources().iterator().next(); + Attribute uri = resource.getAttributes().iterator().next(); + String fullResourceURI = uri.getValue(); + + StringBuilder buffer = new StringBuilder("/"); + StringTokenizer tokenizer = new StringTokenizer(fullResourceURI, "/"); + Response permitResponse = null; + while(tokenizer.hasMoreTokens()) + { + buffer.append(tokenizer.nextToken()); + uri.setValue(buffer.toString()); + + response = this.check(request.encode()); + + if(response.getMessage().equalsIgnoreCase("deny")) + { + permitResponse = null; + break; + } + + if(response.isAccessGranted()) + { + permitResponse = response; + } + + buffer.append("/"); + } + + if(permitResponse == null) + { + response = new Response(); + response.setAccessGranted(false); + response.setMessage("deny"); + } + else + { + response = permitResponse; + } + } + + return response; + } + + private Response check(RequestType xacmlRequest) throws Exception + { + Response response = new Response(); + + //Check for explicit access control + RequestContext requestContext = RequestResponseContextFactory.createRequestCtx(); + requestContext.setRequest(xacmlRequest); + requestContext.marshall(System.out); + + RequestCtx xacmlRequestCtx = (RequestCtx)requestContext.get(XACMLConstants.REQUEST_CTX); + ResponseCtx xacmlResponseCtx = this.policyDecisionPoint.evaluate(xacmlRequestCtx); + + ResponseContext responseContext = RequestResponseContextFactory.createResponseContext(); + responseContext.set(XACMLConstants.RESPONSE_CTX, xacmlResponseCtx); + + responseContext.marshall(System.out); + + if(responseContext.getDecision() == XACMLConstants.DECISION_PERMIT) + { + response.setAccessGranted(true); + response.setMessage("permit"); + } + else if(responseContext.getDecision() == XACMLConstants.DECISION_DENY) + { + response.setAccessGranted(false); + response.setMessage("deny"); + } + else if(responseContext.getDecision() == XACMLConstants.DECISION_INDETERMINATE) + { + response.setAccessGranted(false); + response.setMessage("indeterminate"); + } + else if(responseContext.getDecision() == XACMLConstants.DECISION_NOT_APPLICABLE) + { + response.setAccessGranted(false); + response.setMessage("notapplicable"); + } + + return response; + } } Added: modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestHierarchialPropagation.java =================================================================== --- modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestHierarchialPropagation.java (rev 0) +++ modules/authorization/trunk/policy-server/src/test/java/org/jboss/security/authz/policy/server/TestHierarchialPropagation.java 2009-05-09 18:35:59 UTC (rev 13330) @@ -0,0 +1,250 @@ +/* +* JBoss, a division of Red Hat +* Copyright 2006, Red Hat Middleware, LLC, and individual contributors as indicated +* by the @authors tag. See the copyright.txt in the distribution for a +* full listing of individual contributors. +* +* This is free software; you can redistribute it and/or modify it +* under the terms of the GNU Lesser General Public License as +* published by the Free Software Foundation; either version 2.1 of +* the License, or (at your option) any later version. +* +* This software is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this software; if not, write to the Free +* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +* 02110-1301 USA, or see the FSF site: http://www.fsf.org. +*/ +package org.jboss.security.authz.policy.server; + +import java.net.URI; + +import junit.framework.TestCase; +import org.apache.log4j.Logger; + +import org.jboss.security.authz.model.Policy; +import org.jboss.security.authz.model.PolicyMetaData; +import org.jboss.security.authz.model.Resource; + +import org.jboss.security.authz.components.resource.URIResource; +import org.jboss.security.authz.components.subject.Roles; +import org.jboss.security.authz.components.action.Operation; +import org.jboss.security.authz.components.action.Read; +import org.jboss.security.authz.components.action.Write; +import org.jboss.security.authz.components.action.Manage; + +import org.jboss.security.authz.enforcement.Request; +import org.jboss.security.authz.enforcement.Response; +import org.jboss.security.authz.policy.server.PolicyServer; + +/** + * @author <a href="mailto:sshah@redhat.com">Sohil Shah</a> + */ +public class TestHierarchialPropagation extends TestCase +{ + private static Logger log = Logger.getLogger(TestHierarchialPropagation.class); + + private PolicyServer policyServer; + + public void setUp() throws Exception + { + Server.bootstrap(); + this.policyServer = (PolicyServer)Server.lookup("/policy-server/PolicyServer"); + } + + public void tearDown() throws Exception + { + } + + public void testExplicitPermit() throws Exception + { + //SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1/level2/index.html")); + resource.setOperation(new Read()); + resource.addAllowed("user"); + + //Provision the new policy + PolicyMetaData metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + contextResource.setOperation(new Read()); + + //Perform enforcement + this.enforce(this.createRequest(contextResource), true); + } + + public void testExplicitDeny() throws Exception + { + //SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1/level2/index.html")); + resource.setOperation(new Read()); + resource.addDenied("user"); + + //Provision the new policy + PolicyMetaData metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + contextResource.setOperation(new Read()); + + //Perform enforcement + this.enforce(this.createRequest(contextResource), false); + } + + public void testPermitInheritance() throws Exception + { + //SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1")); + resource.setOperation(new Read()); + resource.addAllowed("user"); + + //Provision the new policy + PolicyMetaData metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + contextResource.setOperation(new Read()); + + //Perform enforcement + this.enforce(this.createRequest(contextResource), true); + } + + public void testDenyInheritance() throws Exception + { + //SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1")); + resource.setOperation(new Read()); + resource.addDenied("user"); + + //Provision the new policy + PolicyMetaData metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + contextResource.setOperation(new Read()); + + //Perform enforcement + this.enforce(this.createRequest(contextResource), false); + } + + public void testDenyOverridesPermitInheritance() throws Exception + { + //SetUp Permit policy + URIResource resource = new URIResource(); + resource.setUri(new URI("/root/level1")); + resource.setOperation(new Read()); + resource.addAllowed("user"); + + //Provision the new policy + PolicyMetaData metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Setup denied policy + resource = new URIResource(); + resource.setUri(new URI("/root/level1/level2")); + resource.setOperation(new Read()); + resource.addDenied("user"); + + //Provision the new policy + metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + contextResource.setOperation(new Read()); + + //Perform enforcement + this.enforce(this.createRequest(contextResource), false); + } + + public void testNotApplicable() throws Exception + { + //SetUp Resource + URIResource resource = new URIResource(); + resource.setUri(new URI("/root2")); + resource.setOperation(new Read()); + resource.addAllowed("user"); + + //Provision the new policy + PolicyMetaData metadata = resource.getPolicyMetaData(); + policyServer.newPolicy(metadata); + + //Go ahead and produce a RequestContext for a "Permit" Enforcement + URIResource contextResource = new URIResource(); + contextResource.setUri(new URI("/root/level1/level2/index.html")); + contextResource.setOperation(new Read()); + + //Perform enforcement + this.enforce(this.createRequest(contextResource), false); + } + //------------------------------------------------------------------------------------------------------------------------------------------------------ + private Request createRequest(URIResource uriResource) throws Exception + { + //Create a RequestType + Request request = new Request(); + + //Enable Hierarchial Enforcement + request.setActivateHierarchialEnforcement(true); + + //Create Resource + Resource urlResource = uriResource.getResource(); + request.addResource(urlResource); + + //Create Subjects + Roles roles = new Roles(); + roles.addName("user"); + request.addSubject(roles.getSubject()); + + //Create Action + request.setAction(uriResource.getOperation().getAction()); + + return request; + } + + private void enforce(Request request, boolean mustBePermitted) throws Exception + { + + Response response = this.policyServer.evaluate(request); + + assertNotNull(response); + log.info("-----------------------------------"); + log.info("Decision="+response.getMessage()); + + if(mustBePermitted) + { + assertTrue("Access must be granted!!!", response.isAccessGranted()); + } + else + { + assertFalse("Access must be denied!!!", response.isAccessGranted()); + } + } + + private void assertServerState() throws Exception + { + //Assert Policy State of the Server + Policy[] policies = policyServer.readAllPolicies(); + + assertTrue("Policy Store must not be empty!!", (policies != null && policies.length == 1)); + log.info("------------------------------------------------------------------------------"); + log.info(policies[0].generateXACMLPolicy()); + } +}