/*
* JBoss, Home of Professional Open Source
* Copyright 2005, JBoss Inc., and individual contributors as indicated
* by the @authors tag. See the copyright.txt in the distribution for a
* full listing of individual contributors.
*
* This is free software; you can redistribute it and/or modify it
* under the terms of the GNU Lesser General Public License as
* published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This software is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this software; if not, write to the Free
* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
*/
package org.jboss.security.authorization.modules.web;
import java.security.Principal;
import java.util.Map;
import javax.security.jacc.PolicyContext;
import javax.servlet.http.HttpServletRequest;
import org.jboss.logging.Logger;
import org.jboss.security.AuthorizationManager;
import org.jboss.security.authorization.AuthorizationContext;
import org.jboss.security.authorization.PolicyRegistration;
import org.jboss.security.authorization.Resource;
import org.jboss.security.authorization.ResourceKeys;
import org.jboss.security.authorization.modules.AuthorizationModuleDelegate;
import org.jboss.security.authorization.resources.WebResource;
import org.jboss.security.authorization.sunxacml.JBossXACMLUtil;
import com.sun.xacml.Policy;
import com.sun.xacml.ctx.RequestCtx;
//$Id: WebXACMLPolicyModuleDelegate.java 46543 2006-07-27 20:22:05Z asaldhana $
/**
* XACML based authorization module helper that deals with the web layer
* authorization decisions
* @author <a href="mailto:Anil.Saldhana@jboss.org">Anil Saldhana</a>
* @since Jun 13, 2006
* @version $Revision: 46543 $
*/
public class WebXACMLPolicyModuleDelegate extends AuthorizationModuleDelegate
{
public WebXACMLPolicyModuleDelegate()
{
log = Logger.getLogger(getClass());
trace = log.isTraceEnabled();
}
/**
* @see AuthorizationModuleDelegate#authorize(Resource)
*/
public int authorize(Resource resource)
{
if(resource instanceof WebResource == false)
throw new IllegalArgumentException("resource is not a WebResource");
WebResource webResource = (WebResource) resource;
//Get the contextual map
Map<String,Object> map = resource.getMap();
if(map == null)
throw new IllegalStateException("Map from the Resource is null");
if(map.size() == 0)
throw new IllegalStateException("Map from the Resource is size zero");
//Get the Catalina Request Object
//HttpServletRequest request = (HttpServletRequest)map.get(ResourceKeys.WEB_REQUEST);
HttpServletRequest request = (HttpServletRequest)webResource.getServletRequest();
AuthorizationManager am = (AuthorizationManager) map.get("authorizationManager");
if(am == null)
throw new IllegalStateException("Authorization Manager is null");
if(am instanceof PolicyRegistration)
this.policyRegistration = (PolicyRegistration) am;
Boolean userDataCheck = checkBooleanValue((Boolean)map.get(ResourceKeys.USERDATA_PERM_CHECK));
Boolean roleRefCheck = checkBooleanValue((Boolean)map.get(ResourceKeys.ROLEREF_PERM_CHECK));
//If it is a userDataCheck or a RoleRefCheck, then the base class (RealmBase) decision holds
if(userDataCheck || roleRefCheck)
return AuthorizationContext.PERMIT; //Base class decision holds good
if(request == null)
throw new IllegalStateException("Request is null");
return process(request, am);
}
/**
* Ensure that the bool is a valid value
* @param bool
* @return bool or Boolean.FALSE (when bool is null)
*/
private Boolean checkBooleanValue(Boolean bool)
{
if(bool == null)
return Boolean.FALSE;
return bool;
}
/**
* Process the web request
* @param request
* @param sc
* @return
*/
private int process(HttpServletRequest request, AuthorizationManager am )
{
Principal userP = request.getUserPrincipal();
if(userP == null)
throw new IllegalStateException("User Principal is null");
int result = AuthorizationContext.DENY;
WebXACMLUtil util = new WebXACMLUtil();
try
{
RequestCtx requestCtx = util.createXACMLRequest(request,am, am.getUserRoles(userP));
String contextID = PolicyContext.getContextID();
Policy policy = (Policy)policyRegistration.getPolicy(contextID,null);
if(policy == null)
throw new IllegalStateException("Missing xacml policy for contextid:"+contextID);
result = JBossXACMLUtil.checkXACMLAuthorization(requestCtx,policy);
}
catch(Exception e)
{
if(trace)
log.trace("Exception in processing:",e);
result = AuthorizationContext.DENY;
}
return result;
}
}