diff options
Diffstat (limited to 'branches/sca-java-1.x/modules/policy-security-http/src/main/java')
3 files changed, 155 insertions, 16 deletions
diff --git a/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java b/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java index 9b0ab3c8a1..bb1950f7f8 100644 --- a/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java +++ b/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationImplementationPolicyProvider.java @@ -29,8 +29,7 @@ import org.apache.tuscany.sca.interfacedef.Operation; import org.apache.tuscany.sca.invocation.Interceptor; import org.apache.tuscany.sca.invocation.Phase; import org.apache.tuscany.sca.policy.PolicySet; -import org.apache.tuscany.sca.policy.security.jaas.JaasAuthenticationInterceptor; -import org.apache.tuscany.sca.policy.security.jaas.JaasAuthenticationPolicy; +import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; import org.apache.tuscany.sca.provider.PolicyProvider; import org.apache.tuscany.sca.runtime.RuntimeComponent; @@ -50,11 +49,11 @@ public class LDAPRealmAuthenticationImplementationPolicyProvider implements Poli } public Interceptor createInterceptor(Operation operation) { - List<LDAPRealmAuthenticationPolicy> policies = findPolicies(operation); + List<LDAPRealmAuthenticationPolicy> policies = findAuthenticationPolicies(operation); if (policies == null || policies.isEmpty()) { return null; } else { - return new LDAPRealmAuthenticationInterceptor(findPolicies(operation)); + return new LDAPRealmAuthenticationInterceptor(findAuthenticationPolicies(operation), findAuthorizationPolicies(operation)); } } @@ -67,16 +66,15 @@ public class LDAPRealmAuthenticationImplementationPolicyProvider implements Poli * @param op * @return */ - private List<LDAPRealmAuthenticationPolicy> findPolicies(Operation op) { + private List<LDAPRealmAuthenticationPolicy> findAuthenticationPolicies(Operation op) { List<LDAPRealmAuthenticationPolicy> polices = new ArrayList<LDAPRealmAuthenticationPolicy>(); - // FIXME: How do we get a list of effective policySets for a given operation? if (implementation instanceof OperationsConfigurator) { OperationsConfigurator operationsConfigurator = (OperationsConfigurator)implementation; for (ConfiguredOperation cop : operationsConfigurator.getConfiguredOperations()) { if (cop.getName().equals(op.getName())) { for (PolicySet ps : cop.getPolicySets()) { for (Object p : ps.getPolicies()) { - if (JaasAuthenticationPolicy.class.isInstance(p)) { + if (LDAPRealmAuthenticationPolicy.class.isInstance(p)) { polices.add((LDAPRealmAuthenticationPolicy)p); } } @@ -95,4 +93,32 @@ public class LDAPRealmAuthenticationImplementationPolicyProvider implements Poli } return polices; } + + private List<AuthorizationPolicy> findAuthorizationPolicies(Operation op) { + List<AuthorizationPolicy> polices = new ArrayList<AuthorizationPolicy>(); + if (implementation instanceof OperationsConfigurator) { + OperationsConfigurator operationsConfigurator = (OperationsConfigurator)implementation; + for (ConfiguredOperation cop : operationsConfigurator.getConfiguredOperations()) { + if (cop.getName().equals(op.getName())) { + for (PolicySet ps : cop.getPolicySets()) { + for (Object p : ps.getPolicies()) { + if (AuthorizationPolicy.class.isInstance(p)) { + polices.add((AuthorizationPolicy)p); + } + } + } + } + } + } + + List<PolicySet> policySets = component.getPolicySets(); + for (PolicySet ps : policySets) { + for (Object p : ps.getPolicies()) { + if (AuthorizationPolicy.class.isInstance(p)) { + polices.add((AuthorizationPolicy)p); + } + } + } + return polices; + } } diff --git a/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java b/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java index 787d41f584..0de09c6129 100644 --- a/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java +++ b/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationInterceptor.java @@ -19,15 +19,20 @@ package org.apache.tuscany.sca.policy.security.http; +import java.security.AccessControlContext; import java.util.List; import javax.security.auth.Subject; import javax.security.auth.callback.CallbackHandler; import javax.security.auth.login.LoginContext; +import javax.security.jacc.WebRoleRefPermission; +import javax.servlet.http.HttpServletRequest; +import org.apache.geronimo.security.ContextManager; import org.apache.tuscany.sca.invocation.Interceptor; import org.apache.tuscany.sca.invocation.Invoker; import org.apache.tuscany.sca.invocation.Message; +import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; import org.apache.tuscany.sca.policy.security.http.util.HttpSecurityUtil; import org.osoa.sca.ServiceRuntimeException; @@ -36,11 +41,14 @@ import org.osoa.sca.ServiceRuntimeException; */ public class LDAPRealmAuthenticationInterceptor implements Interceptor { private List<LDAPRealmAuthenticationPolicy> authenticationPolicies; + private List<AuthorizationPolicy> authorizationPolicies; private Invoker next; - public LDAPRealmAuthenticationInterceptor(List<LDAPRealmAuthenticationPolicy> authenticationPolicies) { + public LDAPRealmAuthenticationInterceptor(List<LDAPRealmAuthenticationPolicy> authenticationPolicies, + List<AuthorizationPolicy> authorizationPolicies) { super(); this.authenticationPolicies = authenticationPolicies; + this.authorizationPolicies = authorizationPolicies; } public Invoker getNext() { @@ -52,17 +60,72 @@ public class LDAPRealmAuthenticationInterceptor implements Interceptor { } public Message invoke(Message msg) { + Subject subject = null; + Subject authenticatedSubject = null; + try { - for (LDAPRealmAuthenticationPolicy policy : authenticationPolicies) { - Subject subject = HttpSecurityUtil.getSubject(msg); + // Perform user authentication + LDAPRealmAuthenticationPolicy authenticationPolicy = authenticationPolicies.get(0); + if( authenticationPolicy != null) { + subject = HttpSecurityUtil.getSubject(msg); CallbackHandler callbackHandler = new LDAPRealmAuthenticationCallbackHandler(subject); - LoginContext lc = new LoginContext(policy.getRealmConfigurationName(), callbackHandler); + + /* This bypass Java EE */ + LoginContext lc = new LoginContext(authenticationPolicy.getRealmConfigurationName(), callbackHandler); lc.login(); + + + /* Uses Geronimo to login */ + /* + LoginContext geronimoLoginContext = ContextManager.login(authenticationPolicy.getRealmConfigurationName(), callbackHandler); + + authenticatedSubject = geronimoLoginContext.getSubject(); + if (authenticatedSubject != null) { + //TODO: add authenticated subject to the msg header ? + } + */ } + + AuthorizationPolicy authorizationPolicy = authorizationPolicies.get(0); + if(authorizationPolicy != null) { + if(authorizationPolicy.getAccessControl() == AuthorizationPolicy.AcessControl.allow) { + /* Geronimo Specific code */ + /* + boolean isAllowed = false; + for (String requiredRole : authorizationPolicy.getRoleNames()) { + isAllowed = isUserInRole(authenticatedSubject, requiredRole); + } + + if(! isAllowed ) { + throw new javax.security.auth.login.LoginException("Insufficient access rights !"); + } + */ + } + + } + } catch (Exception e) { throw new ServiceRuntimeException(e); } return getNext().invoke(msg); } + + public boolean isUserInRole(Subject subject, String role) { + /* Geronimo Specific code */ + /* + AccessControlContext acc = ContextManager.getCurrentContext(); + + try { + acc.checkPermission(new WebRoleRefPermission("", role)); + } catch (Exception e) { + return false; + } + + return true; + */ + + return false; + } + } diff --git a/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java b/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java index dfe72bee36..fe14987948 100644 --- a/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java +++ b/branches/sca-java-1.x/modules/policy-security-http/src/main/java/org/apache/tuscany/sca/policy/security/http/LDAPRealmAuthenticationServicePolicyProvider.java @@ -29,6 +29,7 @@ import org.apache.tuscany.sca.interfacedef.Operation; import org.apache.tuscany.sca.invocation.Interceptor; import org.apache.tuscany.sca.invocation.Phase; import org.apache.tuscany.sca.policy.PolicySet; +import org.apache.tuscany.sca.policy.authorization.AuthorizationPolicy; import org.apache.tuscany.sca.provider.PolicyProvider; import org.apache.tuscany.sca.runtime.RuntimeComponent; import org.apache.tuscany.sca.runtime.RuntimeComponentService; @@ -59,16 +60,18 @@ public class LDAPRealmAuthenticationServicePolicyProvider implements PolicyProvi } public Interceptor createInterceptor(Operation operation) { - List<LDAPRealmAuthenticationPolicy> policies = null; + List<LDAPRealmAuthenticationPolicy> authenticationPolicies = null; + List<AuthorizationPolicy> authorizationPolicies = null; if (operation != null) { - policies = findPolicies(operation); + authenticationPolicies = findAuthenticationPolicies(operation); + authorizationPolicies = findAuthorizationPolicies(operation); } - if (policies == null || policies.isEmpty()) { + if (authenticationPolicies == null || authenticationPolicies.isEmpty()) { return null; } else { - return new LDAPRealmAuthenticationInterceptor(policies); + return new LDAPRealmAuthenticationInterceptor(authenticationPolicies, authorizationPolicies); } } @@ -82,7 +85,7 @@ public class LDAPRealmAuthenticationServicePolicyProvider implements PolicyProvi * @param op * @return */ - private List<LDAPRealmAuthenticationPolicy> findPolicies(Operation op) { + private List<LDAPRealmAuthenticationPolicy> findAuthenticationPolicies(Operation op) { List<LDAPRealmAuthenticationPolicy> polices = new ArrayList<LDAPRealmAuthenticationPolicy>(); // FIXME: How do we get a list of effective policySets for a given operation? for(Operation operation : operations) { @@ -123,5 +126,52 @@ public class LDAPRealmAuthenticationServicePolicyProvider implements PolicyProvi return polices; } + + /** + * + * @param op + * @return + */ + private List<AuthorizationPolicy> findAuthorizationPolicies(Operation op) { + List<AuthorizationPolicy> polices = new ArrayList<AuthorizationPolicy>(); + // FIXME: How do we get a list of effective policySets for a given operation? + for(Operation operation : operations) { + if (operation.getName().equals(op.getName())) { + for (PolicySet ps : operation.getPolicySets()) { + for (Object p : ps.getPolicies()) { + if (AuthorizationPolicy.class.isInstance(p)) { + polices.add((AuthorizationPolicy)p); + } + } + } + } + } + + if (service instanceof OperationsConfigurator) { + OperationsConfigurator operationsConfigurator = (OperationsConfigurator)service; + for (ConfiguredOperation cop : operationsConfigurator.getConfiguredOperations()) { + if (cop.getName().equals(op.getName())) { + for (PolicySet ps : cop.getApplicablePolicySets()) { + for (Object p : ps.getPolicies()) { + if (AuthorizationPolicy.class.isInstance(p)) { + polices.add((AuthorizationPolicy)p); + } + } + } + } + } + } + + List<PolicySet> policySets = service.getPolicySets(); + for (PolicySet ps : policySets) { + for (Object p : ps.getPolicies()) { + if (AuthorizationPolicy.class.isInstance(p)) { + polices.add((AuthorizationPolicy)p); + } + } + } + + return polices; + } } |