diff options
Diffstat (limited to 'sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity')
5 files changed, 403 insertions, 0 deletions
diff --git a/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityImplementationPolicyInterceptor.java b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityImplementationPolicyInterceptor.java new file mode 100644 index 0000000000..773c874a90 --- /dev/null +++ b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityImplementationPolicyInterceptor.java @@ -0,0 +1,83 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.tuscany.sca.policy.identity; + +import java.util.List; + +import javax.security.auth.Subject; + +import org.apache.tuscany.sca.invocation.Invoker; +import org.apache.tuscany.sca.invocation.Message; +import org.apache.tuscany.sca.invocation.Phase; +import org.apache.tuscany.sca.invocation.PhasedInterceptor; +import org.apache.tuscany.sca.policy.security.SecurityUtil; +import org.oasisopen.sca.ServiceRuntimeException; + +/** + * @version $Rev$ $Date$ + */ +public class SecurityIdentityImplementationPolicyInterceptor implements PhasedInterceptor { + private List<SecurityIdentityPolicy> securityIdentityPolicies; + private Invoker next; + + public SecurityIdentityImplementationPolicyInterceptor(List<SecurityIdentityPolicy> securityIdentityPolicies) { + super(); + this.securityIdentityPolicies = securityIdentityPolicies; + } + + /** + * @see org.apache.tuscany.sca.invocation.Interceptor#getNext() + */ + public Invoker getNext() { + return next; + } + + /** + * @see org.apache.tuscany.sca.invocation.Interceptor#setNext(org.apache.tuscany.sca.invocation.Invoker) + */ + public void setNext(Invoker next) { + this.next = next; + } + + public String getPhase() { + return Phase.IMPLEMENTATION_POLICY; + } + + + /** + * @see org.apache.tuscany.sca.invocation.Invoker#invoke(org.apache.tuscany.sca.invocation.Message) + */ + public Message invoke(Message msg) { + try { + + Subject subject = SecurityUtil.getSubject(msg); + + // May do some selection here based on runAs settings. + // by default though there is nothing to do as the implementation + // assumes the callers user credentials + + + } catch (Exception e) { + throw new ServiceRuntimeException(e); + } + return getNext().invoke(msg); + } + +} diff --git a/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityImplementationPolicyProvider.java b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityImplementationPolicyProvider.java new file mode 100644 index 0000000000..29e00dc4b0 --- /dev/null +++ b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityImplementationPolicyProvider.java @@ -0,0 +1,58 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.tuscany.sca.policy.identity; + +import java.util.ArrayList; +import java.util.List; + +import org.apache.tuscany.sca.assembly.Implementation; +import org.apache.tuscany.sca.interfacedef.Operation; +import org.apache.tuscany.sca.invocation.PhasedInterceptor; +import org.apache.tuscany.sca.policy.PolicySet; +import org.apache.tuscany.sca.provider.BasePolicyProvider; +import org.apache.tuscany.sca.runtime.RuntimeComponent; + +/** + * @version $Rev$ $Date$ + */ +public class SecurityIdentityImplementationPolicyProvider extends BasePolicyProvider<SecurityIdentityPolicy> { + private RuntimeComponent component; + private Implementation implementation; + + public SecurityIdentityImplementationPolicyProvider(RuntimeComponent component) { + super(SecurityIdentityPolicy.class, component.getImplementation()); + this.component = component; + this.implementation = component.getImplementation(); + } + + public PhasedInterceptor createInterceptor(Operation operation) { + List<SecurityIdentityPolicy> policies = findPolicies(operation); + if (policies == null || policies.isEmpty()) { + return null; + } else { + return new SecurityIdentityImplementationPolicyInterceptor(findPolicies(operation)); + } + } + + public void start() { + } + + public void stop() { + } +} diff --git a/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicy.java b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicy.java new file mode 100644 index 0000000000..e4c24168c5 --- /dev/null +++ b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicy.java @@ -0,0 +1,75 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.tuscany.sca.policy.identity; + +import javax.xml.namespace.QName; + +import org.apache.tuscany.sca.assembly.xml.Constants; + +/** + * Models the SCA Implementation Security Policy Assertion for Security Identity. + * + * @version $Rev$ $Date$ + */ +public class SecurityIdentityPolicy { + public static final QName NAME = new QName(Constants.SCA11_TUSCANY_NS, "securityIdentity"); + + private boolean useCallerIdentity; + + private String runAsRole; + + public SecurityIdentityPolicy() { + } + + public boolean isUnresolved() { + return false; + } + + public void setUnresolved(boolean unresolved) { + } + + public QName getSchemaName() { + return NAME; + } + + public boolean isUseCallerIdentity() { + return useCallerIdentity; + } + + public void setUseCallerIdentity(boolean useCallerIdentity) { + this.useCallerIdentity = useCallerIdentity; + } + + public String getRunAsRole() { + return runAsRole; + } + + public void setRunAsRole(String runAsRole) { + this.runAsRole = runAsRole; + } + + @Override + public String toString() { + if (useCallerIdentity) { + return "useCallerIdentity"; + } + return "runAs " + runAsRole; + } +} diff --git a/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicyProcessor.java b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicyProcessor.java new file mode 100644 index 0000000000..3c91b9fbcf --- /dev/null +++ b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicyProcessor.java @@ -0,0 +1,131 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.tuscany.sca.policy.identity; + +import static javax.xml.stream.XMLStreamConstants.END_ELEMENT; +import static javax.xml.stream.XMLStreamConstants.START_ELEMENT; + +import javax.xml.namespace.QName; +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamReader; +import javax.xml.stream.XMLStreamWriter; + +import org.apache.tuscany.sca.contribution.processor.ContributionReadException; +import org.apache.tuscany.sca.contribution.processor.ContributionResolveException; +import org.apache.tuscany.sca.contribution.processor.ContributionWriteException; +import org.apache.tuscany.sca.contribution.processor.ProcessorContext; +import org.apache.tuscany.sca.contribution.processor.StAXArtifactProcessor; +import org.apache.tuscany.sca.contribution.resolver.ModelResolver; +import org.apache.tuscany.sca.core.FactoryExtensionPoint; +import org.apache.tuscany.sca.monitor.Monitor; +import org.apache.tuscany.sca.monitor.Problem; +import org.apache.tuscany.sca.monitor.Problem.Severity; + +/** + * + * @version $Rev$ $Date$ + */ +public class SecurityIdentityPolicyProcessor implements StAXArtifactProcessor<SecurityIdentityPolicy> { + private static final String ROLE = "role"; + + public QName getArtifactType() { + return SecurityIdentityPolicy.NAME; + } + + public SecurityIdentityPolicyProcessor(FactoryExtensionPoint modelFactories) { + } + + /** + * Report a error. + * + * @param problems + * @param message + * @param model + */ + private void error(Monitor monitor, String message, Object model, Object... messageParameters) { + if (monitor != null) { + Problem problem = monitor.createProblem(this.getClass().getName(), "policy-security-validation-messages", Severity.ERROR, model, message, (Object[])messageParameters); + monitor.problem(problem); + } + } + + public SecurityIdentityPolicy read(XMLStreamReader reader, ProcessorContext context) throws ContributionReadException, XMLStreamException { + SecurityIdentityPolicy policy = new SecurityIdentityPolicy(); + int event = reader.getEventType(); + QName start = reader.getName(); + while (true) { + switch (event) { + case START_ELEMENT: + String ac = reader.getName().getLocalPart(); + if ("runAs".equals(ac)) { + String roleName = reader.getAttributeValue(null, ROLE); + if (roleName == null) { + error(context.getMonitor(), "RequiredAttributeRolesMissing", reader); + //throw new IllegalArgumentException("Required attribute 'roles' is missing."); + } else { + policy.setRunAsRole(roleName); + } + } else if ("useCallerIdentity".equals(ac)) { + policy.setUseCallerIdentity(true); + } + break; + case END_ELEMENT: + if (start.equals(reader.getName())) { + if (reader.hasNext()) { + reader.next(); + } + return policy; + } + + } + if (reader.hasNext()) { + event = reader.next(); + } else { + return policy; + } + } + } + + public void write(SecurityIdentityPolicy policy, XMLStreamWriter writer, ProcessorContext context) throws ContributionWriteException, + XMLStreamException { + writer.writeStartElement(SecurityIdentityPolicy.NAME.getLocalPart()); + + String child = policy.isUseCallerIdentity() ? "useCallerIdentity" : "runAs"; + writer.writeStartElement(child); + + if (!policy.isUseCallerIdentity()) { + writer.writeAttribute(ROLE, policy.getRunAsRole()); + } + + writer.writeEndElement(); + writer.writeEndElement(); + } + + public Class<SecurityIdentityPolicy> getModelType() { + return SecurityIdentityPolicy.class; + } + + public void resolve(SecurityIdentityPolicy policy, ModelResolver resolver, ProcessorContext context) throws ContributionResolveException { + + if (policy.getRunAsRole() != null) + //right now nothing to resolve + policy.setUnresolved(false); + } + +} diff --git a/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicyProviderFactory.java b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicyProviderFactory.java new file mode 100644 index 0000000000..80e1494796 --- /dev/null +++ b/sca-java-2.x/tags/2.0.1-RC1/modules/policy-security/src/main/java/org/apache/tuscany/sca/policy/identity/SecurityIdentityPolicyProviderFactory.java @@ -0,0 +1,56 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.tuscany.sca.policy.identity; + +import org.apache.tuscany.sca.assembly.Endpoint; +import org.apache.tuscany.sca.assembly.EndpointReference; +import org.apache.tuscany.sca.core.ExtensionPointRegistry; +import org.apache.tuscany.sca.provider.PolicyProvider; +import org.apache.tuscany.sca.provider.PolicyProviderFactory; +import org.apache.tuscany.sca.runtime.RuntimeComponent; + +/** + * @version $Rev$ $Date$ + */ +public class SecurityIdentityPolicyProviderFactory implements PolicyProviderFactory<SecurityIdentityPolicy> { + private ExtensionPointRegistry registry; + + public SecurityIdentityPolicyProviderFactory(ExtensionPointRegistry registry) { + super(); + this.registry = registry; + } + + public PolicyProvider createImplementationPolicyProvider(RuntimeComponent component) { + return new SecurityIdentityImplementationPolicyProvider(component); + } + + public PolicyProvider createReferencePolicyProvider(EndpointReference endpointReference) { + return null; + } + + public PolicyProvider createServicePolicyProvider(Endpoint endpoint) { + return null; + } + + public Class<SecurityIdentityPolicy> getModelType() { + return SecurityIdentityPolicy.class; + } + +} |