diff options
Diffstat (limited to 'branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http')
7 files changed, 271 insertions, 73 deletions
diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java index dd454f21c7..8a2f38115a 100644 --- a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java @@ -30,17 +30,20 @@ import org.apache.tuscany.sca.invocation.Interceptor; import org.apache.tuscany.sca.invocation.Phase; import org.apache.tuscany.sca.policy.PolicySet; import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; +import org.apache.tuscany.sca.policy.security.http.extensibility.LDAPSecurityHandler; import org.apache.tuscany.sca.provider.PolicyProvider; import org.apache.tuscany.sca.runtime.RuntimeComponent; public class LDAPRealmAuthenticationImplementationPolicyProvider implements PolicyProvider { private RuntimeComponent component; private Implementation implementation; + private LDAPSecurityHandler securityHandler; - public LDAPRealmAuthenticationImplementationPolicyProvider(RuntimeComponent component, Implementation implementation) { + public LDAPRealmAuthenticationImplementationPolicyProvider(RuntimeComponent component, Implementation implementation, LDAPSecurityHandler securityHandler) { super(); this.component = component; this.implementation = implementation; + this.securityHandler = securityHandler; } @@ -53,7 +56,7 @@ public class LDAPRealmAuthenticationImplementationPolicyProvider implements Poli if (policies == null || policies.isEmpty()) { return null; } else { - return new LDAPRealmAuthenticationInterceptor(findAuthenticationPolicies(operation), findAuthorizationPolicies(operation)); + return new LDAPRealmAuthenticationInterceptor(securityHandler, findAuthenticationPolicies(operation), findAuthorizationPolicies(operation)); } } diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java index 07ccd78123..3f71891a01 100644 --- a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java @@ -21,28 +21,27 @@ package org.apache.tuscany.sca.policy.security.http; import java.util.List; -import javax.security.auth.Subject; -import javax.security.auth.callback.CallbackHandler; -import javax.security.auth.login.LoginContext; - import org.apache.tuscany.sca.invocation.Interceptor; import org.apache.tuscany.sca.invocation.Invoker; import org.apache.tuscany.sca.invocation.Message; import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; -import org.apache.tuscany.sca.policy.security.http.util.HttpSecurityUtil; +import org.apache.tuscany.sca.policy.security.http.extensibility.LDAPSecurityHandler; import org.osoa.sca.ServiceRuntimeException; /** * @version $Rev$ $Date$ */ public class LDAPRealmAuthenticationInterceptor implements Interceptor { + private LDAPSecurityHandler securityHandler; private List<LDAPRealmAuthenticationPolicy> authenticationPolicies; private List<AuthorizationPolicy> authorizationPolicies; private Invoker next; - public LDAPRealmAuthenticationInterceptor(List<LDAPRealmAuthenticationPolicy> authenticationPolicies, + public LDAPRealmAuthenticationInterceptor(LDAPSecurityHandler securityHandler, + List<LDAPRealmAuthenticationPolicy> authenticationPolicies, List<AuthorizationPolicy> authorizationPolicies) { super(); + this.securityHandler = securityHandler; this.authenticationPolicies = authenticationPolicies; this.authorizationPolicies = authorizationPolicies; } @@ -56,72 +55,12 @@ public class LDAPRealmAuthenticationInterceptor implements Interceptor { } public Message invoke(Message msg) { - Subject subject = null; - Subject authenticatedSubject = null; - try { - // Perform user authentication - LDAPRealmAuthenticationPolicy authenticationPolicy = authenticationPolicies.get(0); - if( authenticationPolicy != null) { - subject = HttpSecurityUtil.getSubject(msg); - CallbackHandler callbackHandler = new LDAPRealmAuthenticationCallbackHandler(subject); - - /* This bypass Java EE */ - LoginContext lc = new LoginContext(authenticationPolicy.getRealmConfigurationName(), callbackHandler); - lc.login(); - - - /* Uses Geronimo to login */ - /* - LoginContext geronimoLoginContext = ContextManager.login(authenticationPolicy.getRealmConfigurationName(), callbackHandler); - - authenticatedSubject = geronimoLoginContext.getSubject(); - if (authenticatedSubject != null) { - //TODO: add authenticated subject to the msg header ? - } - */ - } - - AuthorizationPolicy authorizationPolicy = authorizationPolicies.get(0); - if(authorizationPolicy != null) { - if(authorizationPolicy.getAccessControl() == AuthorizationPolicy.AcessControl.allow) { - /* Geronimo Specific code */ - /* - boolean isAllowed = false; - for (String requiredRole : authorizationPolicy.getRoleNames()) { - isAllowed = isUserInRole(authenticatedSubject, requiredRole); - } - - if(! isAllowed ) { - throw new javax.security.auth.login.LoginException("Insufficient access rights !"); - } - */ - } - - } + securityHandler.handleSecurity(msg, authenticationPolicies, authorizationPolicies); } catch (Exception e) { throw new ServiceRuntimeException(e); } return getNext().invoke(msg); } - - public boolean isUserInRole(Subject subject, String role) { - /* Geronimo Specific code */ - /* - AccessControlContext acc = ContextManager.getCurrentContext(); - - try { - acc.checkPermission(new WebRoleRefPermission("", role)); - } catch (Exception e) { - return false; - } - - return true; - */ - - return false; - } - - } diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationPolicyProviderFactory.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationPolicyProviderFactory.java index 75176bba9b..edc3850976 100644 --- a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationPolicyProviderFactory.java +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationPolicyProviderFactory.java @@ -22,6 +22,8 @@ package org.apache.tuscany.sca.policy.security.http; import org.apache.tuscany.sca.assembly.Binding; import org.apache.tuscany.sca.assembly.Implementation; import org.apache.tuscany.sca.core.ExtensionPointRegistry; +import org.apache.tuscany.sca.policy.security.http.extensibility.LDAPSecurityHandler; +import org.apache.tuscany.sca.policy.security.http.extensibility.LDAPSecurityHandlerExtensionPoint; import org.apache.tuscany.sca.provider.PolicyProvider; import org.apache.tuscany.sca.provider.PolicyProviderFactory; import org.apache.tuscany.sca.runtime.RuntimeComponent; @@ -32,9 +34,13 @@ import org.apache.tuscany.sca.runtime.RuntimeComponentService; * @version $Rev$ $Date$ */ public class LDAPRealmAuthenticationPolicyProviderFactory implements PolicyProviderFactory<LDAPRealmAuthenticationPolicy> { + private LDAPSecurityHandler securityHandler; public LDAPRealmAuthenticationPolicyProviderFactory(ExtensionPointRegistry registry) { super(); + + LDAPSecurityHandlerExtensionPoint securityHandlerExtensionPoint = registry.getExtensionPoint(LDAPSecurityHandlerExtensionPoint.class); + securityHandler = securityHandlerExtensionPoint.getLDAPSecurityHandlers().get(0); } public Class<LDAPRealmAuthenticationPolicy> getModelType() { @@ -42,7 +48,7 @@ public class LDAPRealmAuthenticationPolicyProviderFactory implements PolicyProvi } public PolicyProvider createImplementationPolicyProvider(RuntimeComponent component, Implementation implementation) { - return new LDAPRealmAuthenticationImplementationPolicyProvider(component, implementation); + return new LDAPRealmAuthenticationImplementationPolicyProvider(component, implementation, securityHandler); } public PolicyProvider createReferencePolicyProvider(RuntimeComponent component, @@ -54,7 +60,7 @@ public class LDAPRealmAuthenticationPolicyProviderFactory implements PolicyProvi public PolicyProvider createServicePolicyProvider(RuntimeComponent component, RuntimeComponentService service, Binding binding) { - return new LDAPRealmAuthenticationServicePolicyProvider(component, service, binding); + return new LDAPRealmAuthenticationServicePolicyProvider(component, service, binding, securityHandler); } diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java index 32fce4eb81..5a8b7c7d85 100644 --- a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java @@ -30,6 +30,7 @@ import org.apache.tuscany.sca.invocation.Interceptor; import org.apache.tuscany.sca.invocation.Phase; import org.apache.tuscany.sca.policy.PolicySet; import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; +import org.apache.tuscany.sca.policy.security.http.extensibility.LDAPSecurityHandler; import org.apache.tuscany.sca.provider.PolicyProvider; import org.apache.tuscany.sca.runtime.RuntimeComponent; import org.apache.tuscany.sca.runtime.RuntimeComponentService; @@ -43,14 +44,16 @@ public class LDAPRealmAuthenticationServicePolicyProvider implements PolicyProvi private RuntimeComponent component; private RuntimeComponentService service; private Binding binding; + LDAPSecurityHandler securityHandler; private List<Operation> operations = new ArrayList<Operation>(); - public LDAPRealmAuthenticationServicePolicyProvider(RuntimeComponent component, RuntimeComponentService service, Binding binding) { + public LDAPRealmAuthenticationServicePolicyProvider(RuntimeComponent component, RuntimeComponentService service, Binding binding, LDAPSecurityHandler securityHandler) { super(); this.component = component; this.service = service; this.binding = binding; + this.securityHandler = securityHandler; this.operations.addAll(service.getInterfaceContract().getInterface().getOperations()); } @@ -71,7 +74,7 @@ public class LDAPRealmAuthenticationServicePolicyProvider implements PolicyProvi if (authenticationPolicies == null || authenticationPolicies.isEmpty()) { return null; } else { - return new LDAPRealmAuthenticationInterceptor(authenticationPolicies, authorizationPolicies); + return new LDAPRealmAuthenticationInterceptor(securityHandler, authenticationPolicies, authorizationPolicies); } } diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/DefaultLDAPSecurityExtensionPoint.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/DefaultLDAPSecurityExtensionPoint.java new file mode 100644 index 0000000000..3417bd4936 --- /dev/null +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/DefaultLDAPSecurityExtensionPoint.java @@ -0,0 +1,134 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.tuscany.sca.policy.security.http.extensibility; + +import java.io.IOException; +import java.util.ArrayList; +import java.util.List; +import java.util.Set; + +import org.apache.tuscany.sca.assembly.builder.impl.ProblemImpl; +import org.apache.tuscany.sca.core.ExtensionPointRegistry; +import org.apache.tuscany.sca.core.UtilityExtensionPoint; +import org.apache.tuscany.sca.extensibility.ServiceDeclaration; +import org.apache.tuscany.sca.extensibility.ServiceDiscovery; +import org.apache.tuscany.sca.monitor.Monitor; +import org.apache.tuscany.sca.monitor.MonitorFactory; +import org.apache.tuscany.sca.monitor.Problem; +import org.apache.tuscany.sca.monitor.Problem.Severity; + + +/** + * Default Extension point for LDAP Security Handlers + * + * @version $Rev$ $Date$ + */ + +public class DefaultLDAPSecurityExtensionPoint implements LDAPSecurityHandlerExtensionPoint { + private List<LDAPSecurityHandler> securityHandlers = new ArrayList<LDAPSecurityHandler>(); + + private ExtensionPointRegistry extensionPoints; + private Monitor monitor = null; + + private boolean loaded = false; + + public DefaultLDAPSecurityExtensionPoint(ExtensionPointRegistry extensionPoints) { + this.extensionPoints = extensionPoints; + + UtilityExtensionPoint utilities = extensionPoints.getExtensionPoint(UtilityExtensionPoint.class); + MonitorFactory monitorFactory = utilities.getUtility(MonitorFactory.class); + if (monitorFactory != null) { + this.monitor = monitorFactory.createMonitor(); + } + } + + + public void addLDAPSecurityHandler(LDAPSecurityHandler securityHandler) { + securityHandlers.add(securityHandler); + } + + public void removeLDAPSecurityHandler(LDAPSecurityHandler securityHandler) { + securityHandlers.remove(securityHandler); + } + + public List<LDAPSecurityHandler> getLDAPSecurityHandlers() { + loadHandlers(); + return securityHandlers; + } + + + /** + * Private Utility methods + */ + + /** + * Report a exception. + * + * @param problems + * @param message + * @param model + */ + private void error(String message, Object model, Exception ex) { + if (monitor != null) { + Problem problem = new ProblemImpl(this.getClass().getName(), null, Severity.ERROR, model, message, ex); + monitor.problem(problem); + } + } + + /** + * Lazily load artifact processors registered in the extension point. + */ + @SuppressWarnings("unchecked") + private synchronized void loadHandlers() { + if (loaded) { + return; + } + + // Get the proxy factories declarations + Set<ServiceDeclaration> handlerDeclarations = null; + try { + handlerDeclarations = ServiceDiscovery.getInstance().getServiceDeclarations(LDAPSecurityHandler.class); + } catch (IOException e) { + IllegalStateException ie = new IllegalStateException(e); + error("IllegalStateException", handlerDeclarations, ie); + throw ie; + } + + for (ServiceDeclaration processorDeclaration : handlerDeclarations) { + // Create a factory, and register it + LDAPSecurityHandler securityHandler = null; + try { + Class<LDAPSecurityHandler> securityHandlerClass = (Class<LDAPSecurityHandler>) processorDeclaration.loadClass(); + + securityHandler = securityHandlerClass.newInstance(); + + } catch (Exception e) { + IllegalStateException ie = new IllegalStateException(e); + error("IllegalStateException", securityHandler, ie); + throw ie; + } + + addLDAPSecurityHandler(securityHandler); + } + + loaded = true; + } + +} diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/LDAPSecurityHandler.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/LDAPSecurityHandler.java new file mode 100644 index 0000000000..bf64f8fa30 --- /dev/null +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/LDAPSecurityHandler.java @@ -0,0 +1,63 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.tuscany.sca.policy.security.http.extensibility; + +import java.util.List; + +import org.apache.tuscany.sca.invocation.Message; +import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; +import org.apache.tuscany.sca.policy.security.http.LDAPRealmAuthenticationPolicy; + +public interface LDAPSecurityHandler { + + /** + * The Http Service calls this method prior to servicing the specified request. + * This method controls whether the request is processed in the normal manner + * or an error is returned. + * + * If the request requires authentication and the Authorization header + * in the request is missing or not acceptable, then this method should + * set the WWW-Authenticate header in the response object, set the status + * in the response object to Unauthorized(401) and return false. + * See also RFC 2617: HTTP Authentication: Basic and Digest Access Authentication + * (available at http://www.ietf.org/rfc/rfc2617.txt). + * + * If the request requires a secure connection and the getScheme method + * in the request does not return 'https' or some other acceptable secure protocol, + * then this method should set the status in the response object to Forbidden(403) + * and return false. + * + * When this method returns false, the Http Service will send the response back to + * the client, thereby completing the request. When this method returns true, the + * Http Service will proceed with servicing the request. + * + * If the specified request has been authenticated, this method must set the + * AUTHENTICATION_TYPE request attribute to the type of authentication used, + * and the REMOTE_USER request attribute to the remote user + * (request attributes are set using the setAttribute method on the request). + * If this method does not perform any authentication, it must not set these attributes. + * + * @param msg + * @return + */ + void handleSecurity(Message msg, + List<LDAPRealmAuthenticationPolicy> authenticationPolicies, + List<AuthorizationPolicy> authorizationPolicies) throws javax.security.auth.login.LoginException; +} diff --git a/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/LDAPSecurityHandlerExtensionPoint.java b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/LDAPSecurityHandlerExtensionPoint.java new file mode 100644 index 0000000000..73765c0a10 --- /dev/null +++ b/branches/sca-java-1.5.1/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/extensibility/LDAPSecurityHandlerExtensionPoint.java @@ -0,0 +1,50 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.tuscany.sca.policy.security.http.extensibility; + +import java.util.List; + +/** + * Extension point for LDAP Security Handlers + * + * @version $Rev$ $Date$ + */ +public interface LDAPSecurityHandlerExtensionPoint { + + /** + * Add a LDAP security handler + * @param securityHandler + */ + void addLDAPSecurityHandler (LDAPSecurityHandler securityHandler); + + /** + * Remove a LDAP security handler + * @param securityHandler + */ + void removeLDAPSecurityHandler (LDAPSecurityHandler securityHandler); + + /** + * Return a list of security handlers + * @return + */ + List<LDAPSecurityHandler> getLDAPSecurityHandlers(); + + +} |