[portal-commits] JBoss Portal SVN: r12297 - in modules/authorization/trunk/PAP: src/main/java/org/jboss/security/authz/pap/service and 1 other directories.
portal-commits at lists.jboss.org
portal-commits at lists.jboss.org
Fri Nov 14 16:07:02 EST 2008
Author: sohil.shah at jboss.com
Date: 2008-11-14 16:07:02 -0500 (Fri, 14 Nov 2008)
New Revision: 12297
Added:
modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/FileSystemPortalObjectPolicyManager.java
modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestPortalObjectPolicyManager.java
Modified:
modules/authorization/trunk/PAP/pom.xml
Log:
backing up some code
Modified: modules/authorization/trunk/PAP/pom.xml
===================================================================
--- modules/authorization/trunk/PAP/pom.xml 2008-11-14 15:29:48 UTC (rev 12296)
+++ modules/authorization/trunk/PAP/pom.xml 2008-11-14 21:07:02 UTC (rev 12297)
@@ -59,7 +59,7 @@
<version>2.3.1</version>
<configuration>
<includes>
- <include>**/TestWebTierPolicyManager.java</include>
+ <include>**/TestPortalObjectPolicyManager.java</include>
</includes>
</configuration>
</plugin>
Added: modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/FileSystemPortalObjectPolicyManager.java
===================================================================
--- modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/FileSystemPortalObjectPolicyManager.java (rev 0)
+++ modules/authorization/trunk/PAP/src/main/java/org/jboss/security/authz/pap/service/FileSystemPortalObjectPolicyManager.java 2008-11-14 21:07:02 UTC (rev 12297)
@@ -0,0 +1,239 @@
+/******************************************************************************
+ * JBoss, a division of Red Hat *
+ * Copyright 2006, Red Hat Middleware, LLC, and individual *
+ * contributors as indicated by the @authors tag. See the *
+ * copyright.txt in the distribution for a full listing of *
+ * individual contributors. *
+ * *
+ * This is free software; you can redistribute it and/or modify it *
+ * under the terms of the GNU Lesser General Public License as *
+ * published by the Free Software Foundation; either version 2.1 of *
+ * the License, or (at your option) any later version. *
+ * *
+ * This software is distributed in the hope that it will be useful, *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU *
+ * Lesser General Public License for more details. *
+ * *
+ * You should have received a copy of the GNU Lesser General Public *
+ * License along with this software; if not, write to the Free *
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org. *
+ ******************************************************************************/
+package org.jboss.security.authz.pap.service;
+
+import java.io.InputStream;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Set;
+import java.util.HashSet;
+
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.DocumentBuilder;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.NodeList;
+
+import org.jboss.security.authz.model.Attribute;
+import org.jboss.security.authz.model.AttributeExpression;
+import org.jboss.security.authz.model.Effect;
+import org.jboss.security.authz.model.PolicyException;
+import org.jboss.security.authz.model.Policy;
+import org.jboss.security.authz.model.Target;
+import org.jboss.security.authz.model.Rule;
+import org.jboss.security.authz.pap.hierarchial.HierarchialPolicy;
+import org.jboss.security.xacml.interfaces.XACMLConstants;
+import org.jboss.security.xacml.interfaces.XMLSchemaConstants;
+
+/**
+ * The PolicyManager provides implementation for the Configuration related services of the PolicyManager. It extends the FileSystemPolicyManager in order to store the managed Policies
+ * on the local file system. This PolicyManager process configuration provided for securing Resources within Portal Object Container.
+ * It uses the HierarchialPolicy implementation to represent the Portal Object Policies
+ *
+ * The Policies allow for features such as "Implied Access" and "Recursive Access"
+ *
+ * @author <a href="mailto:sshah at redhat.com">Sohil Shah</a>
+ *
+ */
+public class FileSystemPortalObjectPolicyManager extends FileSystemPolicyManager
+{
+ /**
+ *
+ *
+ */
+ public FileSystemPortalObjectPolicyManager()
+ {
+ }
+ //------Configuration service of the PolicyManager implementation----------------------------------------------------------------------------------------------------------------
+ /**
+ * Generates a Policy that can be represented in system level XACML format. The xmlConfiguration is a user friendly XML configuration that is within the context
+ * of the Portal Object Container. For instance, to apply Access Control at the Portal Object Container, the XML configuration consists of Portal Resources such as
+ * Page, Portal, and Window and Actions in the context of the Portal Object Container such as Render Portal Object, Render a particular Window State, Render a particular
+ * Portlet Mode etc
+ *
+ * @param xmlConfiguration User Friendly XML configuration within the context of the Portal Object Container
+ * @return a Policy that can be represented in system level XACML format
+ */
+ public Policy generatePolicy(String xmlConfiguration) throws PolicyException
+ {
+ InputStream xmlStream = null;
+ try
+ {
+ Policy policy = null;
+
+ xmlStream = new ByteArrayInputStream(xmlConfiguration.getBytes());
+ DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ Document document = builder.parse(xmlStream);
+
+ Element portalAclElem = (Element)document.getElementsByTagName("portal-acl").item(0);
+ Element pageElem = (Element)portalAclElem.getElementsByTagName("page").item(0);
+
+ Target target = this.parseTarget(pageElem);
+
+ Set<Rule> rules = this.parseRules(pageElem);
+
+ policy = new HierarchialPolicy(String.valueOf(this.getUniqueId()), target, rules);
+
+ return policy;
+ }
+ catch(Exception e)
+ {
+ throw new PolicyException(e);
+ }
+ finally
+ {
+ if(xmlStream != null)
+ {
+ try{xmlStream.close();}catch(IOException ioe){}
+ }
+ }
+ }
+ //XMLParsing----------------------------------------------------------------------------------------------------------------------------------------------------
+ private Target parseTarget(Element portalObjectElem) throws Exception
+ {
+ Target target = new Target();
+
+ //Add uniqueUri as a Resource To Match
+ Element uniqueUriElem = (Element)portalObjectElem.getElementsByTagName("unique-uri").item(0);
+ String uniqueUri = uniqueUriElem.getTextContent();
+ AttributeExpression pageUriMatch = new AttributeExpression();
+ pageUriMatch.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL);
+ Attribute attribute = new Attribute("unique-uri",
+ XMLSchemaConstants.DATATYPE_STRING, uniqueUri);
+ pageUriMatch.setAttribute(attribute);
+ target.addResourceMatch(pageUriMatch);
+
+ return target;
+ }
+
+ private Set<Rule> parseRules(Element portalObjectElem) throws Exception
+ {
+ Set<Rule> rules = new HashSet<Rule>();
+
+ NodeList actionNodes = portalObjectElem.getElementsByTagName("action");
+ for(int actionIndex=0; actionIndex<actionNodes.getLength(); actionIndex++)
+ {
+ Element actionElem = (Element)actionNodes.item(actionIndex);
+ String actionName = ((Element)actionElem.getElementsByTagName("name").item(0)).getTextContent();
+
+ NodeList conditionNodes = actionElem.getElementsByTagName("condition");
+ for(int i=0; i<conditionNodes.getLength(); i++)
+ {
+ Element conditionElement = (Element)conditionNodes.item(i);
+
+ //Process Roles related conditions
+ NodeList roleNodes = conditionElement.getElementsByTagName("role-name");
+ if(roleNodes.getLength() >0)
+ {
+ rules.addAll(this.parseRoleRules(actionName, roleNodes));
+ }
+
+ //Process IP Ranges
+ NodeList ipNodes = conditionElement.getElementsByTagName("ip-range");
+ if(ipNodes.getLength() >0)
+ {
+ rules.addAll(this.parseIpRules(actionName, ipNodes));
+ }
+ }
+ }
+ return rules;
+ }
+
+ private Set<Rule> parseRoleRules(String actionName, NodeList roleNodes)
+ {
+ Set<Rule> roleRules = new HashSet<Rule>();
+
+ for(int j=0; j<roleNodes.getLength(); j++)
+ {
+ Element roleNameElem = (Element)roleNodes.item(j);
+ String roleName = roleNameElem.getTextContent();
+
+ Rule roleRule = new Rule();
+ roleRule.setRuleId(String.valueOf(this.getUniqueId()));
+ roleRule.setEffect(Effect.PERMIT);
+
+ AttributeExpression roleExpression = new AttributeExpression();
+ roleExpression.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL);
+ Attribute roleAttribute = new Attribute(XACMLConstants.ATTRIBUTEID_ROLE,
+ XMLSchemaConstants.DATATYPE_STRING, roleName);
+ roleExpression.setAttribute(roleAttribute);
+
+ Target ruleTarget = new Target();
+ AttributeExpression actionMatch = new AttributeExpression();
+ actionMatch.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL);
+ Attribute actionAttribute = new Attribute(XACMLConstants.ATTRIBUTEID_ACTION_ID,
+ XMLSchemaConstants.DATATYPE_STRING, actionName);
+ actionMatch.setAttribute(actionAttribute);
+ ruleTarget.addActionMatch(actionMatch);
+
+ roleRule.setTarget(ruleTarget);
+ roleRule.setExpression(roleExpression);
+
+ roleRules.add(roleRule);
+ }
+
+ return roleRules;
+ }
+
+ private Set<Rule> parseIpRules(String actionName, NodeList ipNodes)
+ {
+ Set<Rule> ipRules = new HashSet<Rule>();
+
+ for(int j=0; j<ipNodes.getLength(); j++)
+ {
+ Element ipElem = (Element)ipNodes.item(j);
+ String ipRange = ipElem.getTextContent();
+
+ Rule rule = new Rule();
+ rule.setRuleId(String.valueOf(this.getUniqueId()));
+ rule.setEffect(Effect.PERMIT);
+
+ AttributeExpression expression = new AttributeExpression();
+ expression.setFunctionId(XACMLConstants.FUNCTION_REGEXP_IPADDRESS_MATCH);
+ Attribute attribute = new Attribute(XACMLConstants.ATTRIBUTEID_IP_ADDRESS,
+ XMLSchemaConstants.DATATYPE_IPADDRESS, ipRange);
+ expression.setAttribute(attribute);
+
+ Target ruleTarget = new Target();
+ AttributeExpression actionMatch = new AttributeExpression();
+ actionMatch.setFunctionId(XACMLConstants.FUNCTION_STRING_EQUAL);
+ Attribute actionAttribute = new Attribute(XACMLConstants.ATTRIBUTEID_ACTION_ID,
+ XMLSchemaConstants.DATATYPE_STRING, actionName);
+ actionMatch.setAttribute(actionAttribute);
+ ruleTarget.addActionMatch(actionMatch);
+
+ rule.setTarget(ruleTarget);
+ rule.setExpression(expression);
+
+ ipRules.add(rule);
+ }
+
+ return ipRules;
+ }
+
+ private synchronized long getUniqueId()
+ {
+ return System.currentTimeMillis();
+ }
+}
Added: modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestPortalObjectPolicyManager.java
===================================================================
--- modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestPortalObjectPolicyManager.java (rev 0)
+++ modules/authorization/trunk/PAP/src/test/java/org/jboss/security/authz/pap/service/TestPortalObjectPolicyManager.java 2008-11-14 21:07:02 UTC (rev 12297)
@@ -0,0 +1,97 @@
+/******************************************************************************
+ * JBoss, a division of Red Hat *
+ * Copyright 2006, Red Hat Middleware, LLC, and individual *
+ * contributors as indicated by the @authors tag. See the *
+ * copyright.txt in the distribution for a full listing of *
+ * individual contributors. *
+ * *
+ * This is free software; you can redistribute it and/or modify it *
+ * under the terms of the GNU Lesser General Public License as *
+ * published by the Free Software Foundation; either version 2.1 of *
+ * the License, or (at your option) any later version. *
+ * *
+ * This software is distributed in the hope that it will be useful, *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU *
+ * Lesser General Public License for more details. *
+ * *
+ * You should have received a copy of the GNU Lesser General Public *
+ * License along with this software; if not, write to the Free *
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org. *
+ ******************************************************************************/
+package org.jboss.security.authz.pap.service;
+
+import junit.framework.TestCase;
+
+import org.apache.log4j.Logger;
+
+import org.jboss.security.authz.model.Policy;
+
+/**
+ * @author <a href="mailto:sshah at redhat.com">Sohil Shah</a>
+ *
+ */
+public class TestPortalObjectPolicyManager extends TestCase
+{
+ /**
+ *
+ */
+ private static Logger log = Logger.getLogger(TestPortalObjectPolicyManager.class);
+
+ /**
+ * A simple developer-friendly Portal Page policy that specifies:
+ *
+ * This Policy suggests that the 'View Action on the specified Portal Page is accessibly if the following conditions are met:
+ *
+ * a) The Logged in User Belongs to the specified 'Root-Admin' and 'Marketing Team' roles AND
+ * b) The User Logged in From the Internal Network only via a "Internal IP Address"
+ *
+ * Notice: This configuration is not muddled by the vast low-level details of XACML Policy representation. That part is automated by the
+ * PAP (Policy Administration Point) Component of the Authorization System
+ */
+ private static String simplePortalPagePolicy = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"+
+ "<portal-acl>"+
+ "<page>"+
+ "<unique-uri>/{portal-name}/{portal-page}/{portal-sub-page}</unique-uri>"+
+ "<action>"+
+ "<name>View</name>"+
+ "<description>Ability to Render this Page</description>"+
+ "<conditions>"+
+ "<condition>"+
+ "<role-name>Root-Admin</role-name>"+
+ "<role-name>Marketing Team</role-name>"+
+ "</condition>"+
+ "<condition>"+
+ "<ip-range>192.168.xxx.xxx</ip-range>"+
+ "</condition>"+
+ "</conditions>"+
+ "</action>"+
+ "</page>"+
+ "</portal-acl>";
+
+ /**
+ *
+ */
+ protected void setUp() throws Exception
+ {
+ }
+
+
+ protected void tearDown() throws Exception
+ {
+ }
+
+
+ public void testSimplePortalPagePolicy() throws Exception
+ {
+ PolicyManager policyManager = new FileSystemPortalObjectPolicyManager();
+ Policy policy = policyManager.generatePolicy(simplePortalPagePolicy);
+
+ assertNotNull(policy);
+
+ log.info("------------------------------------------------------");
+ log.info(policy.generateXACMLPolicy());
+ log.info("------------------------------------------------------");
+ }
+}
More information about the portal-commits
mailing list