Author: shane.bryzak(a)jboss.com Date: 2008-01-20 01:41:39 -0500 (Sun, 20 Jan 2008) New Revision: 7158 Added: trunk/src/main/org/jboss/seam/security/RunAsOperation.java Modified: trunk/src/main/org/jboss/seam/security/Identity.java trunk/src/main/org/jboss/seam/security/RuleBasedIdentity.java Log: JBSEAM-737 Modified: trunk/src/main/org/jboss/seam/security/Identity.java =================================================================== --- trunk/src/main/org/jboss/seam/security/Identity.java 2008-01-19 22:52:43 UTC (rev 7157) +++ trunk/src/main/org/jboss/seam/security/Identity.java 2008-01-20 06:41:39 UTC (rev 7158) @@ -608,6 +608,25 @@ { this.jaasConfigName = jaasConfigName; } + + synchronized void runAs(RunAsOperation operation) + { + Principal savedPrincipal = getPrincipal(); + Subject savedSubject = getSubject(); + + try + { + principal = operation.getPrincipal(); + subject = operation.getSubject(); + + operation.execute(); + } + finally + { + principal = savedPrincipal; + subject = savedSubject; + } + } public void checkEntityPermission(Object entity, EntityAction action) { Modified: trunk/src/main/org/jboss/seam/security/RuleBasedIdentity.java =================================================================== --- trunk/src/main/org/jboss/seam/security/RuleBasedIdentity.java 2008-01-19 22:52:43 UTC (rev 7157) +++ trunk/src/main/org/jboss/seam/security/RuleBasedIdentity.java 2008-01-20 06:41:39 UTC (rev 7158) @@ -11,6 +11,8 @@ import java.util.Iterator; import java.util.List; +import javax.security.auth.Subject; + import org.drools.FactHandle; import org.drools.RuleBase; import org.drools.StatefulSession; @@ -118,6 +120,8 @@ if (securityContext == null) return false; + synchronizeContext(); + List<FactHandle> handles = new ArrayList<FactHandle>(); PermissionCheck check = new PermissionCheck(name, action); @@ -196,18 +200,12 @@ @Override public boolean addRole(String role) { - if (super.addRole(role)) + if (super.addRole(role)) { - StatefulSession securityContext = getSecurityContext(); - - if (securityContext != null) - { - getSecurityContext().insert(new Role(role)); - getSecurityContext().fireAllRules(); - return true; - } + synchronizeContext(); + return true; } - + return false; } @@ -215,24 +213,56 @@ @Override public void removeRole(String role) { - StatefulSession securityContext = getSecurityContext(); - - if (securityContext != null) + super.removeRole(role); + synchronizeContext(); + } + + /** + * Synchronizes the state of the security context with that of the subject + */ + private void synchronizeContext() + { + for ( Group sg : getSubject().getPrincipals(Group.class) ) { - Iterator<Role> iter = securityContext.iterateObjects(new ClassObjectFilter(Role.class)); - while (iter.hasNext()) + if ( ROLES_GROUP.equals( sg.getName() ) ) { - Role r = iter.next(); - if (r.getName().equals(role)) + Enumeration e = sg.members(); + while (e.hasMoreElements()) { - FactHandle fh = getSecurityContext().getFactHandle(r); - getSecurityContext().retract(fh); - break; + Principal role = (Principal) e.nextElement(); + + boolean found = false; + Iterator<Role> iter = getSecurityContext().iterateObjects(new ClassObjectFilter(Role.class)); + while (iter.hasNext()) + { + Role r = iter.next(); + if (r.getName().equals(role.getName())) + { + FactHandle fh = getSecurityContext().getFactHandle(r); + found = true; + break; + } + } + + if (!found) + { + getSecurityContext().insert(new Role(role.getName())); + } + } } + } + + Iterator<Role> iter = getSecurityContext().iterateObjects(new ClassObjectFilter(Role.class)); + while (iter.hasNext()) + { + Role r = iter.next(); + if (!super.hasRole(r.getName())) + { + FactHandle fh = getSecurityContext().getFactHandle(r); + getSecurityContext().retract(fh); + } } - - super.removeRole(role); } Added: trunk/src/main/org/jboss/seam/security/RunAsOperation.java =================================================================== --- trunk/src/main/org/jboss/seam/security/RunAsOperation.java (rev 0) +++ trunk/src/main/org/jboss/seam/security/RunAsOperation.java 2008-01-20 06:41:39 UTC (rev 7158) @@ -0,0 +1,72 @@ +package org.jboss.seam.security; + +import java.security.Principal; +import java.security.acl.Group; + +import javax.security.auth.Subject; + +/** + * Defines a security operation that can be executed within a particular + * security context. + * + * @author Shane Bryzak + */ +public abstract class RunAsOperation +{ + private Principal principal; + private Subject subject; + + public RunAsOperation() + { + principal = new SimplePrincipal(null); + subject = new Subject(); + } + + public abstract void execute(); + + public Principal getPrincipal() + { + return principal; + } + + public Subject getSubject() + { + return subject; + } + + public String[] getRoles() + { + return null; + } + + private boolean addRole(String role) + { + for ( Group sg : getSubject().getPrincipals(Group.class) ) + { + if ( Identity.ROLES_GROUP.equals( sg.getName() ) ) + { + return sg.addMember(new SimplePrincipal(role)); + } + } + + SimpleGroup roleGroup = new SimpleGroup(Identity.ROLES_GROUP); + roleGroup.addMember(new SimplePrincipal(role)); + getSubject().getPrincipals().add(roleGroup); + + return true; + } + + public void run() + { + String[] roles = getRoles(); + if (roles != null) + { + for (String role : getRoles()) + { + addRole(role); + } + } + + Identity.instance().runAs(this); + } +}