Guvnor 5.5 Final: Can I restrict LOGIN Attempts by user
by Zahid Ahmed
Hi,
I have a requirement to restrict login attempts to Guvnor to prevent BruteForceAttacks. For authentication I am using JAAS authentication with Guvnor.
Is there any option in Guvnor/Seam/JAAS to configure such requirement ?
E.g., A user can try a maximum of 3 unsuccessful attempts for login. If user fails in all 3 login attempts then the user has to wait for 5 minutes.
My Environment :
1. JBOSS EAP 6.1.0
2. Drools-Guvnor 5.5.0-Final;
Thanks and Best Regards,
¬
Zahid Ahmed
Senior Software Engineer | Emirates Group IT
P.O. Box 686 | Dubai, United Arab Emirates
T +971 4 203 3912| M +971 55 124 9171
12 years, 9 months
Pluggable Belief Systems in Drools 6.0
by Mark Proctor
http://blog.athico.com/2013/09/pluggable-belief-systems-in-drools-60.html
---
Drools has supported simple truth maintenance for a long time, and followed a similar approach as that in Jess and Clips.
In 6.0 we abstracted the TMS system to allow for pluggable belief systems. This allows a sub system to control what the main working memory can see; i.e. what is inserted for the user to write rules to join against.
There are two interfaces for this the BeliefSystem and the BeliefSet. The BeliefSystem is global to the engine and provides the handling for logical inserts or deletes. It also has a constructor method to provide the LogicalDependency instance; this allows BeliefSystem to have it's own implementation.
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
The BeliefSet is the set of "equals" beliefs; i.e. logical insertions. If you remember in a TMS system a belief is a one or more logical insertions; but only one will ever be visible in the system. Logical means they have a supported rule, which is tracked by a counter. Only when there are no supporters and that counter is zero, is the belief deleted. We've extended this so a logical insertion have an additional value associated with it; which becomes useful in our JTMS implementation, that I'll cover in a moment.
We have a "simple" implementation, that emulates what we had in 5.x, and is still the default.
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
We've added am experimental JTMS implementation, which allows a logical insertion to have a positive or a negative label. This allows for contradiction handling. A logical insertion will only exist in the main working memory, as long as there is no conflict in the labelling - i.e. it must be one or more positive labels, and no minus label.
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
I've covered the bus pass system before, here. The code is still the same, the only difference now with the JTMS plugin is that each logical insertion defaults to a positive label.
rule "IsChild" when
p : Person( age < 16 )then
logicalInsert( new IsChild( p ) )end
rule "IsAdult" when
p : Person( age >= 16 )then logicalInsert( new IsAdult( p ) )end
rule "Issue Child Bus Pass" when p : Person( ) IsChild( person == p )then
logicalInsert(new ChildBusPass( p ) );end
rule "Issue Adult Bus Pass" when p : Person() IsAdult( person == p )then logicalInsert(new AdultBusPass( p ) );end
In the case of someone who is a child, it results in a tree that looks like below.
These are called your "default" rules. Now what happens if you want to add an exception, that contradicts the default rule. JTMS allows a negative insertion for a fact, doing this causes a conflict an the fact will be held in limbo, and not available in the working memory, until the conflict is resolved. For instance we might want an exception rule, that does not allow a bus pass to be issued to someone who is banned.
rule "Do not issue to banned people" when
p : Person( ) Banned( person == p )then
logicalInsert( new ChildBusPass( p ) , “neg” );end
If the person is banned, it results in a tree with one positive and one negative label. The belief system is incremental and cascading, so at any time the exception rule can become true which would result in a cascading undo operation.
We've also added another experimental implementation for Defeasible logic. Interestingly it turned out that Defeasible logic can be derived from the JTMS implementation, using the same BeliefSystem implementation but a custom BeliefSet implementation. The DefeasibleSet can be found here, clearly it is a lot more complicated than the JTMS one. We use mask operations to try and keep it optimal. We haven't added tracking for recursion yet, that is a TODO, and ideally done at compile time.
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
Defeasible augments the JTMS with annotations to provide declarative resolving of conflicts.
@Strict // rule cannot be defeated
@Defeasible // rule can be defeated
@Defeater // rule can defeat other rules, but it's result is not propagated into the working memory
@Defeats // takes list of rules it defeats
rule "Do not issue to banned people" @Defeasible when
p : Person( ) Banned( person == p )then
logicalInsert(new ChildBusPass( p ) , “neg” );end
rule "Exception for children with minor offences" @Defeats("Do not issue to banned people") when
p : Person( )
IsChild( person == p )
Banned( person == p, offence == "minor" )then
logicalInsert(new ChildBusPass( p ) );end
In defeasible logic the exception rule here is called a counter argument, and it is possible for another rule to rebut the counter-arguents, creating an argumentation chain, that rebuttal can also be rebutted. A good presentation on this can be found here.
We are currently working on other Belief System implementations. One is based on the Belief Logic Programmingidea, which uses the concepts of belief combination functions as inspired by Dempster-Shafer. This will allow each logical insertion to have a degree of belief, and the BeliefSystem will be able to process those chains of logical insertions, applying the combination functions.
The other idea we are working on is Bayesian network integration. The BeliefSystem can back onto a Bayesian network, which can control which facts are inserted, or not inserted, into the engine. As the data changes over time, the sub system can add or remove what the main engine sees.
If you find this interesting, and what to have a go at implementing your own and need some help, then don't hesitate to drop onto irc and ask:
http://www.jboss.org/drools/irc
While the system is pluggable, the registration process is currently hard coded into an Enum, which you'll need to update with your implementation:
https://github.com/droolsjbpm/drools/blob/master/drools-core/src/main/jav...
12 years, 9 months
Question about VFS repository
by Carusyte Zhang
Anyone ever tried to use the VFS repository instead of the Guvnor
repository?
I'm stuck with issues not being able to find the sample bpmn2 file, which I
believe has something to do with this block of configurations in jbpm.xml
file:
<repository id="vfs">
<!-- acceptable attributes for parameter
name - name of the property
value - value of the property
system-property - (optional) if set tu true property will
> be set as JVM system property
-->
<!-- simple file system based vfs configuration -->
<parameter name="root" value="default:///tmp/designer-repo" />
>
<parameter name="globaldir" value="/global" />
<parameter name="name" value="Designer Repository"/>
<!-- git based cfs configuration-->
<!--<parameter name="root" value="git://designer-repo" />
<parameter name="globaldir" value="/global" />
<parameter name="username" value="guvnorngtestuser1" />
<parameter name="password" value="test1234" />
<parameter name="origin" value="
> https://github.com/mswiderski/designer-playground.git" />
<parameter name="fetch.cmd" value="?fetch" />
<parameter name="org.kie.nio.git.dir"
> value="/tmp/designer-git-repo" system-property="true"/> -->
</repository>
the 'root' parameter value 'default:///...' seems to be an invalid URI
path, causing the vfs stuff not being able to locate the file.
but I have no idea how to work around this, any kind of information about
this is greatly appreciated!
12 years, 9 months
Drools-Spring usage
by Bryan Memmelaar
Hi -
Following the documentation I have setup a RESTful endpoint at which to call drools from Ruby. I have a use case where I need to generate somewhat "dynamic" rules because each user can configure their rules in a certain way. To accomplish this I have made rule files with unique names (these do not change often, example: 12.drl), and have setup multiple ksession ids, kbase ids that load the different drl files. I name the ksession with the rule name (example: ksession12) and use a lookup in my JSON to direct to the correct rule.
Example:
{"batch-execution": { "lookup":"ksession12", "commands": [ { "insert": <continued....>
My question is this is not working for multiple users. The first user will work correctly and return the executed rule. However the second user (if I switch the lookup) seems to do nothing - not even log the debugging content. I have been through the documentation and am unable to find what I am doing wrong. Can anyone point me in a direction?
I am looking to have multiple rule files and decide based on the lookup what to run. I assume this is pretty basic, but cannot find the right document that talks to it.
thanks
12 years, 9 months
Drools and jBPM Public Training London 2013
by plugtreelabs
We're making a workshop that introduces Business Process Management and
prepares you to be immediately effective in using both Drools and jBPM to
improve your applications. You will learn how to utilize the different
stages of BPM where development is involved, for both versions 5 and 6 of
the Drools and jBPM platform.
We'll discuss several best practices that allow for effective BPM, and how
the jBPM components are more suitable placed into those best practices.
We'll also cover how is the best way to perceive the software writing work
related to running effective Business Processes and rules, and see how this
allows a best fit from an End User perspective.
Where? London, England, Number 1 Poultry, EC2R 8JR
When? October 21-25 , filled with Q&A sessions and workshops, from 10:00 AM
to 18:00 PM, with the last two hours for specialized questions and
workshopping everyday.
By Who? By jBPM commiter and Plugtree's CTO Mariano De Maio (a.k.a. Marian
Buenosayres), jBPM commiter and Plugtree's CTO. Mariano has provided several
contributions to the Drools and jBPM community, including the initial
version of jBPM Form Builder, Drools and jBPM persistence using infinispan,
and jBPM rollback API.
What will it cover? Full theoretical and technical overview of Drools and
jBPM. You can download the full agenda from
http://www.plugtree.com/wp-content/uploads/2013/08/agenda.pdf
We offer different options depending on your interest:
- Introduction: October 21. Full theoretical introduction to Drools and
jBPM components. USD 500.00
- Drools: October 21-23. Introduction + full technical coverage of Drools.
USD 1350.00
- jBPM: October 21, 24 and 25. Introduction + full technical coverage of
jBPM. USD 1350.00
- Full: October 21 + 25. USD 1728.00, and 1929.00 after 9/21/13. Register
and get the early bird pricing!
Or send us an email at trainings(a)plugtree.com for other payment methods. See
you at London!
--
View this message in context: http://drools.46999.n3.nabble.com/Drools-and-jBPM-Public-Training-London-...
Sent from the Drools: User forum mailing list archive at Nabble.com.
12 years, 9 months
No errors thrown from KnowledgeAgent
by De Rooms Brecht
Dear Drools users,
I have been testing with the KnowledgeAgent from version 5.4 and 5.5. It
monitors a changeset and is set to incrementally build the
knowledgebase. I noticed that it sometimes crashes but never throws out
errors. This happens for example when I define a type two times and when
I remove a file. Does anyone experience similar behaviour and has an
idea of how I could see the errors? I already tried to check the errors
by building it myself using a knowledgebuilder before I update the file
that the knowledgeAgent monitors but that's quite a dirty solution.
Kind Regards,
De Rooms Brecht
12 years, 9 months
Insert, fire, then retract from consequence
by Jonathan Knehr
I am wondering if I can insert a fact, fire all activated rules, then retract the fact all in a rules consequence.
I have similar behavior using the API that I'd like to be able to do inside a rule, as well.
The idea is that once all the rules that cause activations get fired, it gets retracted immediately. This is so that we don't have to have cleanup rules all over the place, and have to ensure that the salience is set correctly.
Any ideas?
Thanks in advance!
Sent from my iPhone
12 years, 9 months
latest event within a timeframe
by Alexander Wolf
[Drools Version 5.5.0 Final]
Hey -
I got an event E1 that is only valid, if the latest event E2 following E1 within 2 minutes has the value 1
--> I want have the rule fire 2 minutes after E1 but only if E1 is valid
This is my rule:
rule "inform about E1"
when
//event (T1) is the initial trigger
$event1 : Event(type == EventType.T1)
//there is an event (T2) with value 0 between 0,2m after doorClosed
$event2: Event(type == EventType.T2, value == 1, this after [0, 2m] $event1, $timestamp : timestamp)
//there is no newer event (T2) within the timeframe
not Measurement(type == EventType.T2, this after [0, 2m] $event1, timestamp > $timestamp)
then
//print info
log(drools, "E1 valid");
end
An example of Events:
12:00:00 - E1
12:01:00 - E2 ( value = 0 )
12:01:10 - E2 ( value = 0 )
12:01:40 - E2 ( value = 0 )
12:01:50 - E2 ( value = 1 )
12:02:10 - E2 ( value = 0 )
I would expect the output: [log() does log the clock-time when my rule fires)
12:02:00 E1 valid
But what I get is:
12:03:50 E1 valid
So I see that the late coming E2 (@12:02:10) is correctly ignored, the rule result is basically correct, but the rule is fired much to late. (actually 2 minutes after $event2 and not as expected 2 minutes after $event1).
Could someone give me a hint what I did wrong?
Regards,
Alex
12 years, 9 months
Dependency enumeration
by agarwalk
Hi
I have created following enumeration and java class file.
*Enumeration:*
'OrderData.propertyState':(new com.asps.rules.OrderData()).loadStates()
'OrderData.fulfillmentReviewerName[propertyState]':'(new
com.asps.rules.OrderData()).loadReviewers("@{propertyState}")'
*Java class:*
public class OrderData implements Serializable {
private String propertyState;
private String fulfillmentReviewerName;
// getters and setters
public List<String> loadStates() {
List<String> states = new ArrayList<String>();
states.add("CA");
states.add("NY");
states.add("FL");
return states;
}
public List<String> loadReviewers(final String propertyState) {
List<String> reviewers = new ArrayList<String>();
System.out.println("### in load reviewers ### : " + propertyState);
if ("CA".equalsIgnoreCase(propertyState)) {
reviewers.add("A");
reviewers.add("B");
System.out.println("Reviewers : A & B");
} else if ("NY".equalsIgnoreCase(propertyState)) {
reviewers.add("C");
reviewers.add("D");
System.out.println("Reviewers : C& D");
} else if ("FL".equalsIgnoreCase(propertyState)) {
reviewers.add("E");
reviewers.add("F");
System.out.println("Reviewers : E& F");
} else {
reviewers.add("G");
reviewers.add("H");
System.out.println("Reviewers : G& H");
}
return reviewers;
}
}
I created a rule as follows
WHEN
There is an OrderData with:
propertyState[propertyState]* FL* --- This is a drop down which
is being displayed correctly
fulfillmentReviewerName [fulfillmentReviewerName] -- This should
have been the drop down. Values are dependent on the state selected.
When i try to create above rule the enumeration is loaded correctly for
propertyState but the enumeration is not loaded for fulfillmentReviewerName
field. When I saw the logs the correct method and condition is being
invoked (as per Sys out)but drop down does not contain anything.
ANy suggestions?
--
View this message in context: http://drools.46999.n3.nabble.com/Dependency-enumeration-tp3245703p324570...
Sent from the Drools: User forum mailing list archive at Nabble.com.
12 years, 9 months
