Ok, here are examples of implementing a Web PEP using JBossXACML.
Tell me if you find this code useful. If you have any other requirements, do tell me.
package org.jboss.test.security.xacml.bindings.web;
import java.net.URI;
import java.security.Principal;
import java.security.acl.Group;
import java.util.Enumeration;
import javax.servlet.http.HttpServletRequest;
import org.jboss.security.xacml.core.model.context.ActionType;
import org.jboss.security.xacml.core.model.context.AttributeType;
import org.jboss.security.xacml.core.model.context.EnvironmentType;
import org.jboss.security.xacml.core.model.context.RequestType;
import org.jboss.security.xacml.core.model.context.ResourceType;
import org.jboss.security.xacml.core.model.context.SubjectType;
import org.jboss.security.xacml.factories.RequestAttributeFactory;
import org.jboss.security.xacml.factories.RequestResponseContextFactory;
import org.jboss.security.xacml.interfaces.RequestContext;
/**
* PEP for the web layer
* @author Anil.Saldhana
*/
public class WebPEP
{
String ACTION_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:action:action-id";
String CURRENT_TIME_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:environment:current-time";
String RESOURCE_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:resource:resource-id";
String SUBJECT_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:subject:subject-id";
String SUBJECT_ROLE_IDENTIFIER = "urn:oasis:names:tc:xacml:2.0:subject:role";
@SuppressWarnings("unchecked")
public RequestContext createXACMLRequest(HttpServletRequest request,
Principal principal, Group roleGroup) throws Exception
{
RequestContext requestCtx = RequestResponseContextFactory.createRequestCtx();
//Create a subject type
SubjectType subject = new SubjectType();
subject.getAttribute().add(RequestAttributeFactory.createStringAttributeType(
SUBJECT_IDENTIFIER, "jboss.org", principal.getName()));
Enumeration roles = (Enumeration) roleGroup.members();
while(roles.hasMoreElements())
{
Principal rolePrincipal = roles.nextElement();
AttributeType attSubjectID = RequestAttributeFactory.createStringAttributeType(
SUBJECT_ROLE_IDENTIFIER, "jboss.org", rolePrincipal.getName());
subject.getAttribute().add(attSubjectID);
}
//Create a resource type
ResourceType resourceType = new ResourceType();
resourceType.getAttribute().add(RequestAttributeFactory.createAnyURIAttributeType(
RESOURCE_IDENTIFIER, null, new URI(request.getRequestURI())));
//Create an action type
ActionType actionType = new ActionType();
actionType.getAttribute().add(RequestAttributeFactory.createStringAttributeType(
ACTION_IDENTIFIER, "jboss.org", "read"));
//Create an Environment Type (Optional)
EnvironmentType environmentType = new EnvironmentType();
environmentType.getAttribute().add(RequestAttributeFactory.createDateTimeAttributeType(
CURRENT_TIME_IDENTIFIER, null));
//Create a Request Type
RequestType requestType = new RequestType();
requestType.getSubject().add(subject);
requestType.getResource().add(resourceType);
requestType.setAction(actionType);
requestType.setEnvironment(environmentType);
requestCtx.setRequest(requestType);
return requestCtx;
}
}
The test case for the web layer would be as follows:
package org.jboss.test.security.xacml.bindings.web;
import java.io.InputStream;
import java.security.Principal;
import java.security.acl.Group;
import javax.servlet.http.HttpServletRequest;
import junit.framework.TestCase;
import org.jboss.security.xacml.core.JBossPDP;
import org.jboss.security.xacml.interfaces.PolicyDecisionPoint;
import org.jboss.security.xacml.interfaces.RequestContext;
import org.jboss.security.xacml.interfaces.XACMLConstants;
import org.jboss.test.security.xacml.factories.util.XACMLTestUtil;
/**
* Unit Tests for the Web bindings
* @author Anil.Saldhana
*/
public class WebLayerUnitTestCase extends TestCase
{
public void testWebBinding() throws Exception
{
PolicyDecisionPoint pdp = getPDP();
assertNotNull("JBossPDP is != null", pdp);
Principal p = new Principal()
{
public String getName()
{
return "testuser";
}
};
//Create Role Group
Group grp = XACMLTestUtil.getRoleGroup("developer");
String requestURI = "http://test/developer-guide.html";
HttpRequestUtil util = new HttpRequestUtil();
HttpServletRequest req = util.createRequest(p, requestURI);
//Check PERMIT condition
WebPEP pep = new WebPEP();
RequestContext request = pep.createXACMLRequest(req, p, grp);
if(debug)
request.marshall(System.out);
assertEquals("Access Allowed?", XACMLConstants.DECISION_PERMIT,
XACMLTestUtil.getDecision(pdp,request));
}
public void testNegativeAccessWebBinding() throws Exception
{
PolicyDecisionPoint pdp = getPDP();
assertNotNull("JBossPDP is != null", pdp);
Principal p = new Principal()
{
public String getName()
{
return "testuser";
}
};
//Create Role Group
Group grp = XACMLTestUtil.getRoleGroup("imposter");
String requestURI = "http://test/developer-guide.html";
HttpRequestUtil util = new HttpRequestUtil();
HttpServletRequest req = util.createRequest(p, requestURI);
//Check DENY condition
WebPEP pep = new WebPEP();
RequestContext request = pep.createXACMLRequest(req, p, grp);
if(debug)
request.marshall(System.out);
assertEquals("Access Disallowed?", XACMLConstants.DECISION_DENY,
XACMLTestUtil.getDecision(pdp,request));
}
private PolicyDecisionPoint getPDP()
{
ClassLoader tcl = Thread.currentThread().getContextClassLoader();
InputStream is = tcl.getResourceAsStream("test/config/webConfig.xml");
assertNotNull("InputStream != null", is);
return new JBossPDP(is);
}
}
Now here is the util class that creates a test HttpServletRequest:
package org.jboss.test.security.xacml.bindings.web;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.security.Principal;
import java.util.Enumeration;
import java.util.Locale;
import java.util.Map;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletInputStream;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
/**
* Utility class for the web binding
* @author Anil.Saldhana
*/
public class HttpRequestUtil
{
public HttpServletRequest createRequest(final Principal gp, final String uri)
{
return new HttpServletRequest(){
public String getAuthType() {
return null;
}
public String getContextPath() {
return null;
}
public Cookie[] getCookies() {
return null;
}
public long getDateHeader(String arg0) {
return 0;
}
public String getHeader(String arg0) {
return null;
}
@SuppressWarnings("unchecked")
public Enumeration getHeaderNames() {
return null;
}
@SuppressWarnings("unchecked")
public Enumeration getHeaders(String arg0) {
return null;
}
public int getIntHeader(String arg0) {
return 0;
}
public String getMethod() {
return "GET";
}
public String getPathInfo() {
return null;
}
public String getPathTranslated() {
return null;
}
public String getQueryString() {
return null;
}
public String getRemoteUser() {
return null;
}
public String getRequestURI() {
return uri;
}
public StringBuffer getRequestURL() {
return null;
}
public String getRequestedSessionId() {
return null;
}
public String getServletPath() {
return null;
}
public HttpSession getSession() {
return null;
}
public HttpSession getSession(boolean arg0) {
return null;
}
public Principal getUserPrincipal() {
return gp;
}
public boolean isRequestedSessionIdFromCookie() {
return false;
}
public boolean isRequestedSessionIdFromURL() {
return false;
}
public boolean isRequestedSessionIdFromUrl() {
return false;
}
public boolean isRequestedSessionIdValid() {
return false;
}
public boolean isUserInRole(String arg0) {
return false;
}
public Object getAttribute(String arg0) {
return null;
}
@SuppressWarnings("unchecked")
public Enumeration getAttributeNames() {
return null;
}
public String getCharacterEncoding() {
return null;
}
public int getContentLength() {
return 0;
}
public String getContentType() {
return null;
}
public ServletInputStream getInputStream() throws IOException {
return null;
}
public String getLocalAddr() {
return null;
}
public String getLocalName() {
return null;
}
public int getLocalPort() {
return 0;
}
public Locale getLocale() {
return null;
}
@SuppressWarnings("unchecked")
public Enumeration getLocales() {
return null;
}
public String getParameter(String arg0) {
return null;
}
@SuppressWarnings("unchecked")
public Map getParameterMap() {
return null;
}
@SuppressWarnings("unchecked")
public Enumeration getParameterNames() {
return null;
}
public String[] getParameterValues(String arg0) {
return null;
}
public String getProtocol() {
return null;
}
public BufferedReader getReader() throws IOException {
return null;
}
public String getRealPath(String arg0) {
return null;
}
public String getRemoteAddr() {
return null;
}
public String getRemoteHost() {
return null;
}
public int getRemotePort() {
return 0;
}
public RequestDispatcher getRequestDispatcher(String arg0) {
return null;
}
public String getScheme() {
return null;
}
public String getServerName() {
return null;
}
public int getServerPort() {
return 0;
}
public boolean isSecure() {
return false;
}
public void removeAttribute(String arg0) {
}
public void setAttribute(String arg0, Object arg1) {
}
public void setCharacterEncoding(String arg0)
throws UnsupportedEncodingException {
}};
}
}
Here is the XACMLTestUtil class:
package org.jboss.test.security.xacml.factories.util;
import java.io.InputStream;
import java.security.Principal;
import java.security.acl.Group;
import java.util.Enumeration;
import java.util.Vector;
import junit.framework.TestCase;
import org.jboss.security.xacml.factories.RequestResponseContextFactory;
import org.jboss.security.xacml.interfaces.PolicyDecisionPoint;
import org.jboss.security.xacml.interfaces.RequestContext;
import org.jboss.security.xacml.interfaces.ResponseContext;
import org.jboss.security.xacml.interfaces.XACMLConstants;
/**
* Utility class for the JBossXACML Tests
* @author Anil.Saldhana
*/
public class XACMLTestUtil
{
//Enable for request trace
private static boolean debug = "true".equals(System.getProperty("debug","false"));
/**
* Get the decision from the PDP
* @param pdp
* @param requestFileLoc a file where the xacml request is stored
* @return
* @throws Exception
*/
public static int getDecision(PolicyDecisionPoint pdp,
String requestFileLoc) throws Exception
{
ClassLoader tcl = Thread.currentThread().getContextClassLoader();
InputStream is = tcl.getResourceAsStream(requestFileLoc);
RequestContext request = RequestResponseContextFactory.createRequestCtx();
request.readRequest(is);
ResponseContext response = pdp.evaluate(request);
if(response == null)
throw new RuntimeException("Response is null");
return response.getDecision();
}
/**
* Get the decision from the PDP
* @param pdp
* @param request RequestContext containing the request
* @return
* @throws Exception
*/
public static int getDecision(PolicyDecisionPoint pdp, RequestContext request)
throws Exception
{
ResponseContext response = pdp.evaluate(request);
if(debug)
response.marshall(System.out);
TestCase.assertNotNull("Response is not null", response);
return response.getDecision();
}
/**
* Get a Group with the passed rolename
* @param roleName rolename which will be placed as a principal
* @return
*/
public static Group getRoleGroup( final String roleName)
{
return new Group() {
private Vector vect = new Vector();
public boolean addMember(final Principal principal)
{
return vect.add(principal);
}
public boolean isMember(Principal principal)
{
return vect.contains(principal);
}
public Enumeration members()
{
vect.add(new Principal()
{
public String getName()
{
return roleName;
}});
return vect.elements();
}
public boolean removeMember(Principal principal)
{
return vect.remove(principal);
}
public String getName()
{
return "ROLES";
}
};
}
}
