From b888080e89880d2dc3837ec7650966498592f1a7 Mon Sep 17 00:00:00 2001 From: Dirk Koehler Date: Tue, 22 Mar 2016 18:07:12 -0700 Subject: [PATCH 1/3] Add support for resource-location attributes Related changes: - removed CategoryContainer(Action,Subject,Resource) string ids - Added support for PEP config defaults for resource, action, subject - renamed policy files to match test class name - removed orphoned config files --- .../java/org/apache/openaz/pepapi/Action.java | 39 ++-- .../org/apache/openaz/pepapi/Resource.java | 93 +++----- .../org/apache/openaz/pepapi/Subject.java | 36 +-- .../openaz/pepapi/std/ActionMapper.java | 21 +- .../openaz/pepapi/std/ResourceMapper.java | 30 ++- .../openaz/pepapi/std/StdPepConfig.java | 7 +- .../openaz/pepapi/std/SubjectMapper.java | 23 +- .../openaz/pepapi/std/test/TestAPI.java | 27 +++ .../openaz/pepapi/std/test/TestConfig.java | 79 +++++++ .../openaz/pepapi/std/test/TestDataTypes.java | 13 -- .../test/resources/policies/TestPolicy001.xml | 71 ------ .../test/resources/policies/TestPolicy002.xml | 142 ------------ .../test/resources/policies/TestPolicy003.xml | 137 ------------ .../test/resources/policies/TestPolicy004.xml | 132 ----------- .../test/resources/policies/TestPolicy005.xml | 207 ------------------ .../test/resources/policies/TestPolicy006.xml | 97 -------- .../src/test/resources/policies/testapi.xml | 114 ++++++++++ .../test/resources/policies/testconfig.xml | 59 +++++ .../test/resources/policies/testdatatypes.xml | 127 +++++++++++ .../test/resources/policies/testmapper.xml | 125 +++++++++++ .../properties/testapi.xacml.properties | 2 +- .../properties/testconfig.xacml.properties | 21 ++ .../properties/testdatatypes.xacml.properties | 2 +- .../properties/testmapper.xacml.properties | 2 +- 24 files changed, 678 insertions(+), 928 deletions(-) create mode 100644 openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java delete mode 100755 openaz-pep/src/test/resources/policies/TestPolicy001.xml delete mode 100755 openaz-pep/src/test/resources/policies/TestPolicy002.xml delete mode 100755 openaz-pep/src/test/resources/policies/TestPolicy003.xml delete mode 100755 openaz-pep/src/test/resources/policies/TestPolicy004.xml delete mode 100755 openaz-pep/src/test/resources/policies/TestPolicy005.xml delete mode 100755 openaz-pep/src/test/resources/policies/TestPolicy006.xml create mode 100755 openaz-pep/src/test/resources/policies/testapi.xml create mode 100755 openaz-pep/src/test/resources/policies/testconfig.xml create mode 100755 openaz-pep/src/test/resources/policies/testdatatypes.xml create mode 100755 openaz-pep/src/test/resources/policies/testmapper.xml create mode 100755 openaz-pep/src/test/resources/properties/testconfig.xacml.properties diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java index efcf3d4..0477945 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java @@ -22,16 +22,12 @@ import org.apache.openaz.xacml.api.XACML3; -; - /** * Container class that maps attributes to predefined XACML Action category. */ public class Action extends CategoryContainer { - public static final String ACTION_ID_KEY = "ACTION_ID_KEY"; - - private String actionIdValue; + private String id; private Action() { super(XACML3.ID_ATTRIBUTE_CATEGORY_ACTION); @@ -46,34 +42,35 @@ public static Action newInstance() { return new Action(); } + /** - * Create a new Action instance containing a single default attribute with the given value + * Creates a new Action instance with id * - * @param actionIdValue + * @param id * @return */ - public static Action newInstance(String actionIdValue) { - Action a = new Action(); - a.actionIdValue = actionIdValue; - a.addAttribute(ACTION_ID_KEY, actionIdValue); + public static Action newInstance(String id) { + Action a = newInstance().withId(id); + a.addAttribute(XACML3.ID_ACTION_ACTION_ID.stringValue(), id); return a; } /** - * Get the value for default attribute. * + * @param id * @return */ - public String getActionIdValue() { - return actionIdValue; + public Action withId(String id) { + this.id = id; + return this; } - @Override - public String toString() { - StringBuilder builder = new StringBuilder(); - builder.append("action-id value: " + actionIdValue); - builder.append("\n"); - builder.append(super.toString()); - return builder.toString(); + /** + * + * @return + */ + public String getId() { + return id; } + } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java index 8d7e1a4..7e374e3 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java @@ -20,19 +20,18 @@ package org.apache.openaz.pepapi; -import java.net.URI; -import java.util.Date; - import org.apache.openaz.xacml.api.XACML3; +import java.net.URI; + /** * Container class that maps attributes to predefined XACML Resource category. */ public final class Resource extends CategoryContainer { - public static final String RESOURCE_ID_KEY = "RESOURCE_ID_KEY"; - - private Object resourceIdValue; + // only java.lang.String or java.net.URI + private Object id; + private URI location; private Resource() { super(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE); @@ -50,97 +49,73 @@ public static Resource newInstance() { /** * Creates a new Resource instance containing a single default attribute with the given String value. * - * @param resourceIdValue + * @param id * @return */ - public static Resource newInstance(String resourceIdValue) { - Resource r = new Resource(); - r.resourceIdValue = resourceIdValue; - r.addAttribute(RESOURCE_ID_KEY, resourceIdValue); + public static Resource newInstance(String id) { + Resource r = newInstance().withId(id); + r.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), id); return r; } /** * Creates a new Resource instance containing a single default attribute with the given URI value. * - * @param resourceIdValue + * @param id * @return */ - public static Resource newInstance(URI resourceIdValue) { - Resource r = new Resource(); - r.resourceIdValue = resourceIdValue; - r.addAttribute(RESOURCE_ID_KEY, resourceIdValue); + public static Resource newInstance(URI id) { + Resource r = newInstance().withId(id); + r.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), id); return r; } /** - * Creates a new Resource instance containing a single default attribute with the given Long value. + * Sets resource id value * - * @param resourceIdValue - * @return + * @return this */ - public static Resource newInstance(Long resourceIdValue) { - Resource r = new Resource(); - r.resourceIdValue = resourceIdValue; - r.addAttribute(RESOURCE_ID_KEY, resourceIdValue); - return r; + public Resource withId(URI id) { + this.id = id; + return this; } /** - * Creates a new Resource instance containing a single default attribute with the given Double value. + * Sets resource id value * - * @param resourceIdValue - * @return + * @return this */ - public static Resource newInstance(Double resourceIdValue) { - Resource r = new Resource(); - r.resourceIdValue = resourceIdValue; - r.addAttribute(RESOURCE_ID_KEY, resourceIdValue); - return r; + public Resource withId(String id) { + this.id = id; + return this; } /** - * Creates a new Resource instance containing a single default attribute with the given Boolean value. + * Sets resource location * - * @param resourceIdValue - * @return + * @return this */ - public static Resource newInstance(Boolean resourceIdValue) { - Resource r = new Resource(); - r.resourceIdValue = resourceIdValue; - r.addAttribute(RESOURCE_ID_KEY, resourceIdValue); - return r; + public Resource withLocation(URI location) { + addAttribute(XACML3.ID_RESOURCE_RESOURCE_LOCATION.stringValue(), location); + return this; } /** - * Creates a new Resource instance containing a single default attribute with the given - * java.util.Date value. + * Returns the value of the default id attribute * - * @param resourceIdValue * @return */ - public static Resource newInstance(Date resourceIdValue) { - Resource r = new Resource(); - r.resourceIdValue = resourceIdValue; - r.addAttribute(RESOURCE_ID_KEY, resourceIdValue); - return r; + public Object getId() { + return this.id; } /** - * Returns the value of the default resourceIdValue attribute + * Returns the value of the location attribute * * @return */ - public Object getResourceIdValue() { - return resourceIdValue; + public URI getLocation() { + return location; } - @Override - public String toString() { - StringBuilder builder = new StringBuilder(); - builder.append("resource-id value : " + resourceIdValue); - builder.append("\n"); - builder.append(super.toString()); - return builder.toString(); - } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java index 1fedb4f..1059bce 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java @@ -27,9 +27,7 @@ */ public class Subject extends CategoryContainer { - public static final String SUBJECT_ID_KEY = "SUBJECT_ID_KEY"; - - private String subjectIdValue; + private String id; private Subject() { super(XACML3.ID_SUBJECT_CATEGORY_ACCESS_SUBJECT); @@ -47,31 +45,33 @@ public static Subject newInstance() { /** * Creates a new Subject instance containing a single default attribute with the given String value. * - * @param subjectIdValue + * @param id * @return */ - public static Subject newInstance(String subjectIdValue) { - Subject s = new Subject(); - s.subjectIdValue = subjectIdValue; - s.addAttribute(SUBJECT_ID_KEY, subjectIdValue); + public static Subject newInstance(String id) { + Subject s = newInstance().withId(id); + s.addAttribute(XACML3.ID_SUBJECT_SUBJECT_ID.stringValue(), id); return s; } + + /** + * Sets resource id value + * + * @return this + */ + public Subject withId(String id) { + this.id = id; + return this; + } + /** * Returns the value of the default subjectIdValue attribute * * @return */ - public String getSubjectIdValue() { - return subjectIdValue; + public String getId() { + return id; } - @Override - public String toString() { - StringBuilder builder = new StringBuilder(); - builder.append("subject-id value : " + subjectIdValue); - builder.append("\n"); - builder.append(super.toString()); - return builder.toString(); - } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java index 347710a..a18ccb7 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java @@ -21,10 +21,10 @@ package org.apache.openaz.pepapi.std; import org.apache.openaz.pepapi.Action; +import org.apache.openaz.pepapi.PepRequest; +import org.apache.openaz.pepapi.PepRequestAttributes; +import org.apache.openaz.xacml.api.XACML3; -/** - * Created by ajith on 12/11/14. - */ public class ActionMapper extends CategoryContainerMapper { public ActionMapper() { @@ -32,10 +32,17 @@ public ActionMapper() { } @Override - protected String resolveAttributeId(String attributeId) { - if (attributeId.equals(Action.ACTION_ID_KEY)) { - return getPepConfig().getDefaultActionId(); + public void map(Object o, PepRequest pepRequest) { + Action a = (Action) o; + String id = a.getId(); + if (id == null) { + id = getPepConfig().getDefaultActionId(); + if (id != null) { + PepRequestAttributes resourceAttributes = pepRequest + .getPepRequestAttributes(XACML3.ID_ATTRIBUTE_CATEGORY_ACTION); + resourceAttributes.addAttribute(XACML3.ID_ACTION_ACTION_ID.stringValue(), (String) id); + } } - return attributeId; + super.map(o, pepRequest); } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java index 09efe01..3298b8f 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java @@ -20,11 +20,13 @@ package org.apache.openaz.pepapi.std; +import org.apache.openaz.pepapi.PepRequest; +import org.apache.openaz.pepapi.PepRequestAttributes; import org.apache.openaz.pepapi.Resource; +import org.apache.openaz.xacml.api.XACML3; + +import java.net.URI; -/** - * Created by ajith on 12/11/14. - */ public class ResourceMapper extends CategoryContainerMapper { public ResourceMapper() { @@ -32,10 +34,24 @@ public ResourceMapper() { } @Override - protected String resolveAttributeId(String attributeId) { - if (attributeId.equals(Resource.RESOURCE_ID_KEY)) { - return getPepConfig().getDefaultResourceId(); + public void map(Object o, PepRequest pepRequest) { + Resource r = (Resource) o; + Object id = r.getId(); + if (id == null) { + id = getPepConfig().getDefaultResourceId(); + + if (id != null) { + PepRequestAttributes resourceAttributes = pepRequest + .getPepRequestAttributes(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE); + if (id instanceof String) + resourceAttributes.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), (String) id); + else if (id instanceof URI) + resourceAttributes.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), (URI) id); + else + throw new IllegalStateException("resource id is not an instance of String nor java.net.URI but " + + r.getClass().getName()); + } } - return attributeId; + super.map(o, pepRequest); } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java index 94928d6..2c79e95 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java @@ -21,13 +21,11 @@ package org.apache.openaz.pepapi.std; import com.google.common.base.Splitter; - import org.apache.commons.lang3.StringUtils; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.apache.openaz.pepapi.PepConfig; import org.apache.openaz.pepapi.PepResponseBehavior; -import org.apache.openaz.xacml.api.XACML3; import java.util.ArrayList; import java.util.Collections; @@ -68,9 +66,6 @@ public final class StdPepConfig implements PepConfig { public StdPepConfig() { // Defaults - subjectIdURI = XACML3.ID_SUBJECT_SUBJECT_ID.stringValue(); - actionIdURI = XACML3.ID_ACTION_ACTION_ID.stringValue(); - resourceIdURI = XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(); indeterminateBehavior = PepResponseBehavior.THROW_EXCEPTION; notApplicableBehavior = PepResponseBehavior.RETURN_NO; mapperClassNames = Collections.emptyList(); @@ -119,7 +114,7 @@ public StdPepConfig(Properties properties) { if (!StringUtils.isEmpty(mapperClassNameString)) { List mapperClassNames = new ArrayList(); for (String className : Splitter.on(",").omitEmptyStrings().trimResults() - .split(mapperClassNameString)) { + .split(mapperClassNameString)) { mapperClassNames.add(className); } this.mapperClassNames = Collections.unmodifiableList(mapperClassNames); diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java index b2ace5f..ffb2be0 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java @@ -20,11 +20,11 @@ package org.apache.openaz.pepapi.std; +import org.apache.openaz.pepapi.PepRequest; +import org.apache.openaz.pepapi.PepRequestAttributes; import org.apache.openaz.pepapi.Subject; +import org.apache.openaz.xacml.api.XACML3; -/** - * Created by ajith on 12/11/14. - */ public class SubjectMapper extends CategoryContainerMapper { public SubjectMapper() { @@ -32,10 +32,17 @@ public SubjectMapper() { } @Override - protected String resolveAttributeId(String attributeId) { - if (attributeId.equals(Subject.SUBJECT_ID_KEY)) { - return getPepConfig().getDefaultSubjectId(); + public void map(Object o, PepRequest pepRequest) { + Subject s = (Subject) o; + String id = s.getId(); + if (id == null) { + id = getPepConfig().getDefaultSubjectId(); + if (id != null) { + PepRequestAttributes resourceAttributes = pepRequest + .getPepRequestAttributes(XACML3.ID_SUBJECT_CATEGORY_ACCESS_SUBJECT); + resourceAttributes.addAttribute(XACML3.ID_SUBJECT_SUBJECT_ID.stringValue(), (String) id); + } } - return attributeId; + super.map(o, pepRequest); } -} +} \ No newline at end of file diff --git a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java index d6c96b4..85ce0c1 100644 --- a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java +++ b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java @@ -26,6 +26,7 @@ import org.junit.Before; import org.junit.Test; +import java.net.URI; import java.util.ArrayList; import java.util.List; @@ -57,6 +58,32 @@ public void testPermit() { Assert.assertEquals(true, response.allowed()); } + /** + * + */ + @Test + public void testPermitWithLocationMatch() { + Subject subject = Subject.newInstance("Bob"); + Action action = Action.newInstance("read"); + Resource resource = Resource.newInstance(URI.create("/record/patient/Alice")).withLocation(URI.create("http://medical-records.com/")); + PepResponse response = getPepAgent().decide(subject, action, resource); + Assert.assertNotNull(response); + Assert.assertEquals(true, response.allowed()); + } + + /** + * + */ + @Test + public void testPermitWithLocationMismatch() { + Subject subject = Subject.newInstance("Bob"); + Action action = Action.newInstance("read"); + Resource resource = Resource.newInstance(URI.create("/record/patient/Alice")).withLocation(URI.create("http://restricted-records.com/")); + PepResponse response = getPepAgent().decide(subject, action, resource); + Assert.assertNotNull(response); + Assert.assertEquals(false, response.allowed()); + } + /** * */ diff --git a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java new file mode 100644 index 0000000..5d8a68b --- /dev/null +++ b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java @@ -0,0 +1,79 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * + */ + +package org.apache.openaz.pepapi.std.test; + +import org.apache.openaz.pepapi.*; +import org.apache.openaz.pepapi.std.StdPepAgentFactory; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +import java.net.URI; +import java.util.ArrayList; +import java.util.List; + +public class TestConfig { + + private PepAgentFactory pepAgentFactory; + + @Before + public void setup() { + pepAgentFactory = new StdPepAgentFactory("properties/testconfig.xacml.properties"); + } + + /** + * + */ + @Test + public void testPepAgent() { + Assert.assertNotNull(getPepAgent()); + } + + /** + * + */ + @Test + public void testPermitWithDefaultsMatch() { + Subject subject = Subject.newInstance(); + Action action = Action.newInstance(); + Resource resource = Resource.newInstance(); + PepResponse response = getPepAgent().decide(subject, action, resource); + Assert.assertNotNull(response); + Assert.assertEquals(true, response.allowed()); + } + + /** + * + */ + @Test + public void testPermitWithDefaultsMismatch() { + Subject subject = Subject.newInstance("non-default-subject-id"); + Action action = Action.newInstance("non-default-action-id"); + Resource resource = Resource.newInstance("non-default-resource-id"); + PepResponse response = getPepAgent().decide(subject, action, resource); + Assert.assertNotNull(response); + Assert.assertEquals(false, response.allowed()); + } + + public PepAgent getPepAgent() { + return pepAgentFactory.getPepAgent(); + } +} diff --git a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestDataTypes.java b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestDataTypes.java index 4276ea6..8b92958 100644 --- a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestDataTypes.java +++ b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestDataTypes.java @@ -64,19 +64,6 @@ public void testPermitWithURIResource() { Assert.assertEquals(true, response.allowed()); } - /** - * - */ - @Test - public void testPermitWithIntegerResource() { - Subject subject = Subject.newInstance("John Smith"); - Action action = Action.newInstance("view"); - Resource resource = Resource.newInstance(101L); - PepResponse response = getPepAgent().decide(subject, action, resource); - Assert.assertNotNull(response); - Assert.assertEquals(true, response.allowed()); - } - /** * */ diff --git a/openaz-pep/src/test/resources/policies/TestPolicy001.xml b/openaz-pep/src/test/resources/policies/TestPolicy001.xml deleted file mode 100755 index fff89f6..0000000 --- a/openaz-pep/src/test/resources/policies/TestPolicy001.xml +++ /dev/null @@ -1,71 +0,0 @@ - - - - - - - - Julius Hibbert can read or write Bart Simpson's medical record. - - - - - - Julius Hibbert - - - - - - - - http://medico.com/record/patient/BartSimpson - - - - - - - - read - - - - - - write - - - - - - - diff --git a/openaz-pep/src/test/resources/policies/TestPolicy002.xml b/openaz-pep/src/test/resources/policies/TestPolicy002.xml deleted file mode 100755 index 3867f77..0000000 --- a/openaz-pep/src/test/resources/policies/TestPolicy002.xml +++ /dev/null @@ -1,142 +0,0 @@ - - - - - - Policy for Conformance Test IIA001. - - - - - Physicians can read or write Bart Simpson's medical record. - - - - - - Physician - - - - - - - - http://medico.com/record/patient/BartSimpson - - - - - - - - read - - - - - - write - - - - - - - - - Patient is allowed to read his/her medical record. - - - - - - Patient - - - - - - - - http://medico.com/record/patient/BartSimpson - - - - - - - - read - - - - - - - - - - - - - - - - - diff --git a/openaz-pep/src/test/resources/policies/TestPolicy003.xml b/openaz-pep/src/test/resources/policies/TestPolicy003.xml deleted file mode 100755 index edb75a4..0000000 --- a/openaz-pep/src/test/resources/policies/TestPolicy003.xml +++ /dev/null @@ -1,137 +0,0 @@ - - - - - - - - - - - - John Smith - - - - - - - - file://repository/classified/abc - - - - - - - - view - - - - - - - - - - - - John Smith - - - - - - - - file://repository/classified/xyz - - - - - - - - view - - - - - - - - - - - - John Smith - - - - - - - - 101 - - - - - - - - view - - - - - - - diff --git a/openaz-pep/src/test/resources/policies/TestPolicy004.xml b/openaz-pep/src/test/resources/policies/TestPolicy004.xml deleted file mode 100755 index b861425..0000000 --- a/openaz-pep/src/test/resources/policies/TestPolicy004.xml +++ /dev/null @@ -1,132 +0,0 @@ - - - - - - - - - - - - ROLE_DOCUMENT_WRITER - - - - - - - - Document - - - - - - - - write - - - - - - - - - - - - - - - - - - - - - - - ROLE_DOCUMENT_READER - - - - - - - - Document - - - - - - - - read - - - - - - - - - - - - - - - - - diff --git a/openaz-pep/src/test/resources/policies/TestPolicy005.xml b/openaz-pep/src/test/resources/policies/TestPolicy005.xml deleted file mode 100755 index 88c51f0..0000000 --- a/openaz-pep/src/test/resources/policies/TestPolicy005.xml +++ /dev/null @@ -1,207 +0,0 @@ - - - - - - PolicySet for Test 005. - - - - - Policy for Test 005. - - - - - - - - Physician - - - - - - - - PatientMedicalRecord - - - - - - - - read - - - - - - - - - EVAL_SUBJECT_ATTRIBUTE - - - - - - Policy for Test 005. - - - - - - - - Patient - - - - - - - - PatientMedicalRecord - - - - - - - - read - - - - - - - - - EVAL_SUBJECT_ATTRIBUTE - - - - - - - Policy for Test 005. - - - - - - - - InsuranceAgent - - - - - - - - PatientMedicalRecord - - - - - - - - read - - - - - - - - - EVAL_RESOURCE_ATTRIBUTE - EVAL_SUBJECT_ATTRIBUTE - - - - diff --git a/openaz-pep/src/test/resources/policies/TestPolicy006.xml b/openaz-pep/src/test/resources/policies/TestPolicy006.xml deleted file mode 100755 index f739f2d..0000000 --- a/openaz-pep/src/test/resources/policies/TestPolicy006.xml +++ /dev/null @@ -1,97 +0,0 @@ - - - - - - PolicySet for Test 005. - - - - - Policy for Test 005. - - - - - - - - John Smith - - - - - - - - resource1 - - - - - - - - view - - - - - - - - - Filtering - EVAL_SUBJECT_ATTRIBUTE - - - EVAL_SUBJECT_ATTRIBUTE - - - - diff --git a/openaz-pep/src/test/resources/policies/testapi.xml b/openaz-pep/src/test/resources/policies/testapi.xml new file mode 100755 index 0000000..1aa5ce7 --- /dev/null +++ b/openaz-pep/src/test/resources/policies/testapi.xml @@ -0,0 +1,114 @@ + + + + + + + + Julius Hibbert can read or write Bart Simpson's medical record. + + + + + + Julius Hibbert + + + + + + + + http://medico.com/record/patient/BartSimpson + + + + + + + + read + + + + + + write + + + + + + + + + + + + + Bob + + + + + + + + /record/patient/Alice + + + + + + + + http://medical-records.com/ + + + + + + + + read + + + + + + + diff --git a/openaz-pep/src/test/resources/policies/testconfig.xml b/openaz-pep/src/test/resources/policies/testconfig.xml new file mode 100755 index 0000000..23a8bdc --- /dev/null +++ b/openaz-pep/src/test/resources/policies/testconfig.xml @@ -0,0 +1,59 @@ + + + + + + + + + + + + default-subject-id + + + + + + + + default-resource-id + + + + + + + + default-action-id + + + + + + + diff --git a/openaz-pep/src/test/resources/policies/testdatatypes.xml b/openaz-pep/src/test/resources/policies/testdatatypes.xml new file mode 100755 index 0000000..7465988 --- /dev/null +++ b/openaz-pep/src/test/resources/policies/testdatatypes.xml @@ -0,0 +1,127 @@ + + + + + + + + + + + + John Smith + + + + + + + + file://repository/classified/abc + + + + + + + + view + + + + + + + + + + + + John Smith + + + + + + + + file://repository/classified/xyz + + + + + + + + view + + + + + + + + + + + + John Smith + + + + + + + + 101 + + + + + + + + view + + + + + + + diff --git a/openaz-pep/src/test/resources/policies/testmapper.xml b/openaz-pep/src/test/resources/policies/testmapper.xml new file mode 100755 index 0000000..e964a02 --- /dev/null +++ b/openaz-pep/src/test/resources/policies/testmapper.xml @@ -0,0 +1,125 @@ + + + + + + + + + + + + ROLE_DOCUMENT_WRITER + + + + + + + + Document + + + + + + + + write + + + + + + + + + + + + + + + + + + + + + + + ROLE_DOCUMENT_READER + + + + + + + + Document + + + + + + + + read + + + + + + + + + + + + + + + + + diff --git a/openaz-pep/src/test/resources/properties/testapi.xacml.properties b/openaz-pep/src/test/resources/properties/testapi.xacml.properties index 7ba87d7..8b9098a 100755 --- a/openaz-pep/src/test/resources/properties/testapi.xacml.properties +++ b/openaz-pep/src/test/resources/properties/testapi.xacml.properties @@ -14,7 +14,7 @@ xacml.openaz.functionDefinitionFactory=org.apache.openaz.xacml.pdp.std.StdFuncti xacml.openaz.policyFinderFactory=org.apache.openaz.xacml.pdp.std.StdPolicyFinderFactory xacml.rootPolicies=testPolicy -testPolicy.file=src/test/resources/policies/TestPolicy001.xml +testPolicy.file=src/test/resources/policies/testapi.xml # If there is a standard policy for the engine: # xacml.att.stdPolicyFinderFactory.rootPolicyFile=/etc/stdpolicyset.xml diff --git a/openaz-pep/src/test/resources/properties/testconfig.xacml.properties b/openaz-pep/src/test/resources/properties/testconfig.xacml.properties new file mode 100755 index 0000000..f4f71d4 --- /dev/null +++ b/openaz-pep/src/test/resources/properties/testconfig.xacml.properties @@ -0,0 +1,21 @@ +# Default XACML Properties File +# Standard API Factories +# +xacml.dataTypeFactory=org.apache.openaz.xacml.std.StdDataTypeFactory +xacml.pdpEngineFactory=org.apache.openaz.xacml.pdp.OpenAZPDPEngineFactory +xacml.pepEngineFactory=org.apache.openaz.xacml.std.pep.StdEngineFactory +xacml.pipFinderFactory=org.apache.openaz.xacml.std.pip.StdPIPFinderFactory + +# OpenAZ PDP Implementation Factories +# +xacml.openaz.evaluationContextFactory=org.apache.openaz.xacml.pdp.std.StdEvaluationContextFactory +xacml.openaz.combiningAlgorithmFactory=org.apache.openaz.xacml.pdp.std.StdCombiningAlgorithmFactory +xacml.openaz.functionDefinitionFactory=org.apache.openaz.xacml.pdp.std.StdFunctionDefinitionFactory +xacml.openaz.policyFinderFactory=org.apache.openaz.xacml.pdp.std.StdPolicyFinderFactory + +xacml.rootPolicies=testPolicy +testPolicy.file=src/test/resources/policies/testconfig.xml + +pep.subject.id=default-subject-id +pep.action.id=default-action-id +pep.resource.id=default-resource-id \ No newline at end of file diff --git a/openaz-pep/src/test/resources/properties/testdatatypes.xacml.properties b/openaz-pep/src/test/resources/properties/testdatatypes.xacml.properties index c4e8ef5..90cc014 100755 --- a/openaz-pep/src/test/resources/properties/testdatatypes.xacml.properties +++ b/openaz-pep/src/test/resources/properties/testdatatypes.xacml.properties @@ -14,7 +14,7 @@ xacml.openaz.functionDefinitionFactory=org.apache.openaz.xacml.pdp.std.StdFuncti xacml.openaz.policyFinderFactory=org.apache.openaz.xacml.pdp.std.StdPolicyFinderFactory xacml.rootPolicies=testPolicy -testPolicy.file=src/test/resources/policies/TestPolicy003.xml +testPolicy.file=src/test/resources/policies/testdatatypes.xml # If there is a standard policy for the engine: # xacml.att.stdPolicyFinderFactory.rootPolicyFile=/etc/stdpolicyset.xml diff --git a/openaz-pep/src/test/resources/properties/testmapper.xacml.properties b/openaz-pep/src/test/resources/properties/testmapper.xacml.properties index 22c67a3..10b0f02 100755 --- a/openaz-pep/src/test/resources/properties/testmapper.xacml.properties +++ b/openaz-pep/src/test/resources/properties/testmapper.xacml.properties @@ -14,7 +14,7 @@ xacml.openaz.functionDefinitionFactory=org.apache.openaz.xacml.pdp.std.StdFuncti xacml.openaz.policyFinderFactory=org.apache.openaz.xacml.pdp.std.StdPolicyFinderFactory xacml.rootPolicies=testPolicy -testPolicy.file=src/test/resources/policies/TestPolicy004.xml +testPolicy.file=src/test/resources/policies/testmapper.xml #pep properties pep.issuer=test From 43082dc5104edf4498a7ea223059ff5d589ff9a1 Mon Sep 17 00:00:00 2001 From: Dirk Koehler Date: Wed, 1 Jun 2016 15:52:43 +0200 Subject: [PATCH 2/3] Introduce APIs to set attribute identifiers This mainly addresses a concern raised where someone may want to set an attribute id (e.g. key of subject-id) which deviates from what XACML defines in its specification. --- .../java/org/apache/openaz/pepapi/Action.java | 37 +++++--- .../org/apache/openaz/pepapi/Resource.java | 88 ++++++++++++++----- .../org/apache/openaz/pepapi/Subject.java | 38 +++++--- .../openaz/pepapi/std/ActionMapper.java | 9 +- .../openaz/pepapi/std/ResourceMapper.java | 13 ++- .../openaz/pepapi/std/SubjectMapper.java | 9 +- .../openaz/pepapi/std/test/TestAPI.java | 6 +- 7 files changed, 136 insertions(+), 64 deletions(-) diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java index 0477945..00b7908 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java @@ -20,6 +20,7 @@ package org.apache.openaz.pepapi; +import org.apache.openaz.xacml.api.Identifier; import org.apache.openaz.xacml.api.XACML3; /** @@ -27,7 +28,8 @@ */ public class Action extends CategoryContainer { - private String id; + public static final Identifier DEFAULT_IDENTIFIER_ID = XACML3.ID_ACTION_ACTION_ID; + private String idValue; private Action() { super(XACML3.ID_ATTRIBUTE_CATEGORY_ACTION); @@ -42,35 +44,48 @@ public static Action newInstance() { return new Action(); } + /** + * Creates a new Subject instance containing a single default attribute with the given String value. + * + * @param idValue + * @return + */ + public static Action newInstance(String idValue) { + return newInstance().withId(idValue); + } /** - * Creates a new Action instance with id + * Sets the Id of the action * - * @param id + * @param idValue * @return */ - public static Action newInstance(String id) { - Action a = newInstance().withId(id); - a.addAttribute(XACML3.ID_ACTION_ACTION_ID.stringValue(), id); - return a; + public Action withId(String idValue) { + this.idValue = idValue; + addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); + return this; } /** + * Sets the id of the action and allows to set/override the default attribute key * - * @param id + * @param idKey + * @param idValue * @return */ - public Action withId(String id) { - this.id = id; + public Action withId(Identifier idKey, String idValue) { + this.idValue = idValue; + addAttribute(idKey.stringValue(), idValue); return this; } /** + * Returns the value of the id * * @return */ public String getId() { - return id; + return idValue; } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java index 7e374e3..1392722 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java @@ -20,6 +20,7 @@ package org.apache.openaz.pepapi; +import org.apache.openaz.xacml.api.Identifier; import org.apache.openaz.xacml.api.XACML3; import java.net.URI; @@ -29,9 +30,11 @@ */ public final class Resource extends CategoryContainer { - // only java.lang.String or java.net.URI - private Object id; - private URI location; + public static final Identifier DEFAULT_IDENTIFIER_ID = XACML3.ID_RESOURCE_RESOURCE_ID; + public static final Identifier DEFAULT_IDENTIFIER_LOCATION = XACML3.ID_RESOURCE_RESOURCE_LOCATION; + + private Object idValue; // only java.lang.String or java.net.URI + private URI locationValue; private Resource() { super(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE); @@ -49,64 +52,105 @@ public static Resource newInstance() { /** * Creates a new Resource instance containing a single default attribute with the given String value. * - * @param id + * @param idValue * @return */ - public static Resource newInstance(String id) { - Resource r = newInstance().withId(id); - r.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), id); - return r; + public static Resource newInstance(String idValue) { + return newInstance().withId(idValue); } /** * Creates a new Resource instance containing a single default attribute with the given URI value. * - * @param id + * @param idValue * @return */ - public static Resource newInstance(URI id) { - Resource r = newInstance().withId(id); - r.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), id); - return r; + public static Resource newInstance(URI idValue) { + return newInstance().withId(idValue); + } + + /** + * Sets resource id value + * + * @param idValue + * @return this + */ + public Resource withId(URI idValue) { + this.idValue = idValue; + addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); + return this; + } + + /** + * Sets resource id value + * + * @param id + * @param idValue + * @return this + */ + public Resource withId(Identifier id, URI idValue) { + this.idValue = idValue; + addAttribute(id.stringValue(), idValue); + return this; } /** * Sets resource id value * + * @param idValue * @return this */ - public Resource withId(URI id) { - this.id = id; + public Resource withId(String idValue) { + this.idValue = idValue; + addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); return this; } /** * Sets resource id value * + * @param id + * @param idValue * @return this */ - public Resource withId(String id) { - this.id = id; + public Resource withId(Identifier id, String idValue) { + this.idValue = idValue; + addAttribute(id.stringValue(), idValue); return this; } /** * Sets resource location * + * @param locationValue + * @return this + */ + public Resource withLocation(URI locationValue) { + this.locationValue = locationValue; + addAttribute(DEFAULT_IDENTIFIER_LOCATION.stringValue(), locationValue); + return this; + } + + /** + * Sets resource location + * + * @param id + * @param locationValue * @return this */ - public Resource withLocation(URI location) { - addAttribute(XACML3.ID_RESOURCE_RESOURCE_LOCATION.stringValue(), location); + public Resource withLocation(Identifier id, URI locationValue) { + this.locationValue = locationValue; + addAttribute(id.stringValue(), locationValue); return this; } /** - * Returns the value of the default id attribute + * Returns the value of the id attribute * * @return */ public Object getId() { - return this.id; + return this.idValue; } /** @@ -115,7 +159,7 @@ public Object getId() { * @return */ public URI getLocation() { - return location; + return locationValue; } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java index 1059bce..c06e0c2 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java @@ -20,6 +20,7 @@ package org.apache.openaz.pepapi; +import org.apache.openaz.xacml.api.Identifier; import org.apache.openaz.xacml.api.XACML3; /** @@ -27,7 +28,8 @@ */ public class Subject extends CategoryContainer { - private String id; + public static final Identifier DEFAULT_IDENTIFIER_ID = XACML3.ID_SUBJECT_SUBJECT_ID; + private String idValue; private Subject() { super(XACML3.ID_SUBJECT_CATEGORY_ACCESS_SUBJECT); @@ -45,33 +47,45 @@ public static Subject newInstance() { /** * Creates a new Subject instance containing a single default attribute with the given String value. * - * @param id + * @param idValue * @return */ - public static Subject newInstance(String id) { - Subject s = newInstance().withId(id); - s.addAttribute(XACML3.ID_SUBJECT_SUBJECT_ID.stringValue(), id); - return s; + public static Subject newInstance(String idValue) { + return newInstance().withId(idValue); } + /** + * Sets the Id of the subject + * + * @param idValue + * @return + */ + public Subject withId(String idValue) { + this.idValue = idValue; + addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); + return this; + } /** - * Sets resource id value + * Sets the id of the subject and allows to set/override the default attribute key * - * @return this + * @param idKey + * @param idValue + * @return */ - public Subject withId(String id) { - this.id = id; + public Subject withId(Identifier idKey, String idValue) { + this.idValue = idValue; + addAttribute(idKey.stringValue(), idValue); return this; } /** - * Returns the value of the default subjectIdValue attribute + * Returns the value of the id * * @return */ public String getId() { - return id; + return idValue; } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java index a18ccb7..f334621 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java @@ -23,7 +23,6 @@ import org.apache.openaz.pepapi.Action; import org.apache.openaz.pepapi.PepRequest; import org.apache.openaz.pepapi.PepRequestAttributes; -import org.apache.openaz.xacml.api.XACML3; public class ActionMapper extends CategoryContainerMapper { @@ -33,14 +32,14 @@ public ActionMapper() { @Override public void map(Object o, PepRequest pepRequest) { - Action a = (Action) o; - String id = a.getId(); + Action action = (Action) o; + String id = action.getId(); if (id == null) { id = getPepConfig().getDefaultActionId(); if (id != null) { PepRequestAttributes resourceAttributes = pepRequest - .getPepRequestAttributes(XACML3.ID_ATTRIBUTE_CATEGORY_ACTION); - resourceAttributes.addAttribute(XACML3.ID_ACTION_ACTION_ID.stringValue(), (String) id); + .getPepRequestAttributes(action.getCategoryIdentifier()); + resourceAttributes.addAttribute(Action.DEFAULT_IDENTIFIER_ID.stringValue(), (String) id); } } super.map(o, pepRequest); diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java index 3298b8f..a88733c 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java @@ -23,7 +23,6 @@ import org.apache.openaz.pepapi.PepRequest; import org.apache.openaz.pepapi.PepRequestAttributes; import org.apache.openaz.pepapi.Resource; -import org.apache.openaz.xacml.api.XACML3; import java.net.URI; @@ -35,21 +34,21 @@ public ResourceMapper() { @Override public void map(Object o, PepRequest pepRequest) { - Resource r = (Resource) o; - Object id = r.getId(); + Resource resource = (Resource) o; + Object id = resource.getId(); if (id == null) { id = getPepConfig().getDefaultResourceId(); if (id != null) { PepRequestAttributes resourceAttributes = pepRequest - .getPepRequestAttributes(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE); + .getPepRequestAttributes(resource.getCategoryIdentifier()); if (id instanceof String) - resourceAttributes.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), (String) id); + resourceAttributes.addAttribute(Resource.DEFAULT_IDENTIFIER_ID.stringValue(), (String) id); else if (id instanceof URI) - resourceAttributes.addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), (URI) id); + resourceAttributes.addAttribute(Resource.DEFAULT_IDENTIFIER_ID.stringValue(), (URI) id); else throw new IllegalStateException("resource id is not an instance of String nor java.net.URI but " + - r.getClass().getName()); + resource.getClass().getName()); } } super.map(o, pepRequest); diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java index ffb2be0..2787c37 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java @@ -23,7 +23,6 @@ import org.apache.openaz.pepapi.PepRequest; import org.apache.openaz.pepapi.PepRequestAttributes; import org.apache.openaz.pepapi.Subject; -import org.apache.openaz.xacml.api.XACML3; public class SubjectMapper extends CategoryContainerMapper { @@ -33,14 +32,14 @@ public SubjectMapper() { @Override public void map(Object o, PepRequest pepRequest) { - Subject s = (Subject) o; - String id = s.getId(); + Subject subject = (Subject) o; + String id = subject.getId(); if (id == null) { id = getPepConfig().getDefaultSubjectId(); if (id != null) { PepRequestAttributes resourceAttributes = pepRequest - .getPepRequestAttributes(XACML3.ID_SUBJECT_CATEGORY_ACCESS_SUBJECT); - resourceAttributes.addAttribute(XACML3.ID_SUBJECT_SUBJECT_ID.stringValue(), (String) id); + .getPepRequestAttributes(subject.getCategoryIdentifier()); + resourceAttributes.addAttribute(Subject.DEFAULT_IDENTIFIER_ID.stringValue(), (String) id); } } super.map(o, pepRequest); diff --git a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java index 85ce0c1..9c16caf 100644 --- a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java +++ b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestAPI.java @@ -65,7 +65,8 @@ public void testPermit() { public void testPermitWithLocationMatch() { Subject subject = Subject.newInstance("Bob"); Action action = Action.newInstance("read"); - Resource resource = Resource.newInstance(URI.create("/record/patient/Alice")).withLocation(URI.create("http://medical-records.com/")); + Resource resource = Resource.newInstance(URI.create("/record/patient/Alice")) + .withLocation(URI.create("http://medical-records.com/")); PepResponse response = getPepAgent().decide(subject, action, resource); Assert.assertNotNull(response); Assert.assertEquals(true, response.allowed()); @@ -78,7 +79,8 @@ public void testPermitWithLocationMatch() { public void testPermitWithLocationMismatch() { Subject subject = Subject.newInstance("Bob"); Action action = Action.newInstance("read"); - Resource resource = Resource.newInstance(URI.create("/record/patient/Alice")).withLocation(URI.create("http://restricted-records.com/")); + Resource resource = Resource.newInstance(URI.create("/record/patient/Alice")) + .withLocation(URI.create("http://restricted-records.com/")); PepResponse response = getPepAgent().decide(subject, action, resource); Assert.assertNotNull(response); Assert.assertEquals(false, response.allowed()); From 498427e1ebd445a1a149d9337ed09f3f75ebcb03 Mon Sep 17 00:00:00 2001 From: Dirk Koehler Date: Tue, 21 Jun 2016 11:30:37 -0700 Subject: [PATCH 3/3] Removed support to for setting default ids This commit removes the rather 'confusing' feature of being able to override the default key for subject, resource and action ids defined by XACML spec. Users who relied on feature can easily switch to use #addAttribute to achieve the same. --- .../java/org/apache/openaz/pepapi/Action.java | 36 +++----- .../org/apache/openaz/pepapi/PepConfig.java | 15 ---- .../org/apache/openaz/pepapi/Resource.java | 83 +++++-------------- .../org/apache/openaz/pepapi/Subject.java | 33 ++------ .../openaz/pepapi/std/ActionMapper.java | 17 ---- .../openaz/pepapi/std/ResourceMapper.java | 26 ------ .../openaz/pepapi/std/StdPepConfig.java | 42 ---------- .../openaz/pepapi/std/SubjectMapper.java | 17 ---- .../openaz/pepapi/std/test/TestConfig.java | 79 ------------------ .../test/resources/policies/testconfig.xml | 59 ------------- .../properties/testconfig.xacml.properties | 21 ----- 11 files changed, 39 insertions(+), 389 deletions(-) delete mode 100644 openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java delete mode 100755 openaz-pep/src/test/resources/policies/testconfig.xml delete mode 100755 openaz-pep/src/test/resources/properties/testconfig.xacml.properties diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java index 00b7908..a4bdd0d 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Action.java @@ -20,7 +20,6 @@ package org.apache.openaz.pepapi; -import org.apache.openaz.xacml.api.Identifier; import org.apache.openaz.xacml.api.XACML3; /** @@ -28,8 +27,7 @@ */ public class Action extends CategoryContainer { - public static final Identifier DEFAULT_IDENTIFIER_ID = XACML3.ID_ACTION_ACTION_ID; - private String idValue; + private String id; private Action() { super(XACML3.ID_ATTRIBUTE_CATEGORY_ACTION); @@ -47,45 +45,31 @@ public static Action newInstance() { /** * Creates a new Subject instance containing a single default attribute with the given String value. * - * @param idValue + * @param id * @return */ - public static Action newInstance(String idValue) { - return newInstance().withId(idValue); + public static Action newInstance(String id) { + return newInstance().withId(id); } /** * Sets the Id of the action * - * @param idValue + * @param id * @return */ - public Action withId(String idValue) { - this.idValue = idValue; - addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); + public Action withId(String id) { + this.id = id; + addAttribute(XACML3.ID_ACTION_ACTION_ID.stringValue(), id); return this; } - - /** - * Sets the id of the action and allows to set/override the default attribute key - * - * @param idKey - * @param idValue - * @return - */ - public Action withId(Identifier idKey, String idValue) { - this.idValue = idValue; - addAttribute(idKey.stringValue(), idValue); - return this; - } - - /** +/** * Returns the value of the id * * @return */ public String getId() { - return idValue; + return id; } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/PepConfig.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/PepConfig.java index e09f291..bafa19c 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/PepConfig.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/PepConfig.java @@ -31,21 +31,6 @@ public interface PepConfig { */ String getIssuer(); - /** - * @return - */ - String getDefaultSubjectId(); - - /** - * @return - */ - String getDefaultResourceId(); - - /** - * @return - */ - String getDefaultActionId(); - /** * @return */ diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java index 1392722..8d8e379 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Resource.java @@ -20,7 +20,6 @@ package org.apache.openaz.pepapi; -import org.apache.openaz.xacml.api.Identifier; import org.apache.openaz.xacml.api.XACML3; import java.net.URI; @@ -30,11 +29,8 @@ */ public final class Resource extends CategoryContainer { - public static final Identifier DEFAULT_IDENTIFIER_ID = XACML3.ID_RESOURCE_RESOURCE_ID; - public static final Identifier DEFAULT_IDENTIFIER_LOCATION = XACML3.ID_RESOURCE_RESOURCE_LOCATION; - - private Object idValue; // only java.lang.String or java.net.URI - private URI locationValue; + private Object id; // only java.lang.String or java.net.URI + private URI location; private Resource() { super(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE); @@ -52,57 +48,32 @@ public static Resource newInstance() { /** * Creates a new Resource instance containing a single default attribute with the given String value. * - * @param idValue + * @param id * @return */ - public static Resource newInstance(String idValue) { - return newInstance().withId(idValue); + public static Resource newInstance(String id) { + return newInstance().withId(id); } /** * Creates a new Resource instance containing a single default attribute with the given URI value. * - * @param idValue + * @param id * @return */ - public static Resource newInstance(URI idValue) { - return newInstance().withId(idValue); - } - - /** - * Sets resource id value - * - * @param idValue - * @return this - */ - public Resource withId(URI idValue) { - this.idValue = idValue; - addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); - return this; + public static Resource newInstance(URI id) { + return newInstance().withId(id); } /** * Sets resource id value * * @param id - * @param idValue - * @return this - */ - public Resource withId(Identifier id, URI idValue) { - this.idValue = idValue; - addAttribute(id.stringValue(), idValue); - return this; - } - - /** - * Sets resource id value - * - * @param idValue * @return this */ - public Resource withId(String idValue) { - this.idValue = idValue; - addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); + public Resource withId(URI id) { + this.id = id; + addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), id); return this; } @@ -110,37 +81,23 @@ public Resource withId(String idValue) { * Sets resource id value * * @param id - * @param idValue - * @return this - */ - public Resource withId(Identifier id, String idValue) { - this.idValue = idValue; - addAttribute(id.stringValue(), idValue); - return this; - } - - /** - * Sets resource location - * - * @param locationValue * @return this */ - public Resource withLocation(URI locationValue) { - this.locationValue = locationValue; - addAttribute(DEFAULT_IDENTIFIER_LOCATION.stringValue(), locationValue); + public Resource withId(String id) { + this.id = id; + addAttribute(XACML3.ID_RESOURCE_RESOURCE_ID.stringValue(), id); return this; } /** * Sets resource location * - * @param id - * @param locationValue + * @param location * @return this */ - public Resource withLocation(Identifier id, URI locationValue) { - this.locationValue = locationValue; - addAttribute(id.stringValue(), locationValue); + public Resource withLocation(URI location) { + this.location = location; + addAttribute(XACML3.ID_RESOURCE_RESOURCE_LOCATION.stringValue(), location); return this; } @@ -150,7 +107,7 @@ public Resource withLocation(Identifier id, URI locationValue) { * @return */ public Object getId() { - return this.idValue; + return this.id; } /** @@ -159,7 +116,7 @@ public Object getId() { * @return */ public URI getLocation() { - return locationValue; + return location; } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java index c06e0c2..9f19a57 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/Subject.java @@ -20,7 +20,6 @@ package org.apache.openaz.pepapi; -import org.apache.openaz.xacml.api.Identifier; import org.apache.openaz.xacml.api.XACML3; /** @@ -28,8 +27,7 @@ */ public class Subject extends CategoryContainer { - public static final Identifier DEFAULT_IDENTIFIER_ID = XACML3.ID_SUBJECT_SUBJECT_ID; - private String idValue; + private String id; private Subject() { super(XACML3.ID_SUBJECT_CATEGORY_ACCESS_SUBJECT); @@ -47,35 +45,22 @@ public static Subject newInstance() { /** * Creates a new Subject instance containing a single default attribute with the given String value. * - * @param idValue + * @param id * @return */ - public static Subject newInstance(String idValue) { - return newInstance().withId(idValue); + public static Subject newInstance(String id) { + return newInstance().withId(id); } /** * Sets the Id of the subject * - * @param idValue + * @param id * @return */ - public Subject withId(String idValue) { - this.idValue = idValue; - addAttribute(DEFAULT_IDENTIFIER_ID.stringValue(), idValue); - return this; - } - - /** - * Sets the id of the subject and allows to set/override the default attribute key - * - * @param idKey - * @param idValue - * @return - */ - public Subject withId(Identifier idKey, String idValue) { - this.idValue = idValue; - addAttribute(idKey.stringValue(), idValue); + public Subject withId(String id) { + this.id = id; + addAttribute(XACML3.ID_SUBJECT_SUBJECT_ID.stringValue(), id); return this; } @@ -85,7 +70,7 @@ public Subject withId(Identifier idKey, String idValue) { * @return */ public String getId() { - return idValue; + return id; } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java index f334621..41b8b2f 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ActionMapper.java @@ -21,27 +21,10 @@ package org.apache.openaz.pepapi.std; import org.apache.openaz.pepapi.Action; -import org.apache.openaz.pepapi.PepRequest; -import org.apache.openaz.pepapi.PepRequestAttributes; public class ActionMapper extends CategoryContainerMapper { public ActionMapper() { super(Action.class); } - - @Override - public void map(Object o, PepRequest pepRequest) { - Action action = (Action) o; - String id = action.getId(); - if (id == null) { - id = getPepConfig().getDefaultActionId(); - if (id != null) { - PepRequestAttributes resourceAttributes = pepRequest - .getPepRequestAttributes(action.getCategoryIdentifier()); - resourceAttributes.addAttribute(Action.DEFAULT_IDENTIFIER_ID.stringValue(), (String) id); - } - } - super.map(o, pepRequest); - } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java index a88733c..ce7e436 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/ResourceMapper.java @@ -20,37 +20,11 @@ package org.apache.openaz.pepapi.std; -import org.apache.openaz.pepapi.PepRequest; -import org.apache.openaz.pepapi.PepRequestAttributes; import org.apache.openaz.pepapi.Resource; -import java.net.URI; - public class ResourceMapper extends CategoryContainerMapper { public ResourceMapper() { super(Resource.class); } - - @Override - public void map(Object o, PepRequest pepRequest) { - Resource resource = (Resource) o; - Object id = resource.getId(); - if (id == null) { - id = getPepConfig().getDefaultResourceId(); - - if (id != null) { - PepRequestAttributes resourceAttributes = pepRequest - .getPepRequestAttributes(resource.getCategoryIdentifier()); - if (id instanceof String) - resourceAttributes.addAttribute(Resource.DEFAULT_IDENTIFIER_ID.stringValue(), (String) id); - else if (id instanceof URI) - resourceAttributes.addAttribute(Resource.DEFAULT_IDENTIFIER_ID.stringValue(), (URI) id); - else - throw new IllegalStateException("resource id is not an instance of String nor java.net.URI but " + - resource.getClass().getName()); - } - } - super.map(o, pepRequest); - } } diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java index 2c79e95..9debb7f 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/StdPepConfig.java @@ -38,12 +38,6 @@ public final class StdPepConfig implements PepConfig { private static final String PEP_ISSUER = "pep.issuer"; - private static final String PEP_DEFAULT_SUBJECT_ID = "pep.subject.id"; - - private static final String PEP_DEFAULT_ACTION_ID = "pep.action.id"; - - private static final String PEP_DEFAULT_RESOURCE_ID = "pep.resource.id"; - private static final String PEP_INDETERMINATE_BEHAVIOR = "pep.indeterminate.behavior"; private static final String PEP_NOTAPPLICABLE_BEHAVIOR = "pep.notapplicable.behavior"; @@ -52,12 +46,6 @@ public final class StdPepConfig implements PepConfig { private String issuer; - private String subjectIdURI; - - private String actionIdURI; - - private String resourceIdURI; - private PepResponseBehavior indeterminateBehavior; private PepResponseBehavior notApplicableBehavior; @@ -75,21 +63,6 @@ public StdPepConfig(Properties properties) { this(); issuer = properties.getProperty(PEP_ISSUER); - String subjectIdURI = properties.getProperty(PEP_DEFAULT_SUBJECT_ID); - if (!StringUtils.isEmpty(subjectIdURI)) { - this.subjectIdURI = subjectIdURI; - } - - String actionIdURI = properties.getProperty(PEP_DEFAULT_ACTION_ID); - if (!StringUtils.isEmpty(actionIdURI)) { - this.actionIdURI = actionIdURI; - } - - String resourceIdURI = properties.getProperty(PEP_DEFAULT_RESOURCE_ID); - if (!StringUtils.isEmpty(resourceIdURI)) { - this.resourceIdURI = resourceIdURI; - } - String indeterminateString = properties.getProperty(PEP_INDETERMINATE_BEHAVIOR); if (!StringUtils.isEmpty(indeterminateString)) { PepResponseBehavior indeterminateBehavior = PepResponseBehavior.valueOf(indeterminateString); @@ -127,21 +100,6 @@ public String getIssuer() { return issuer; } - @Override - public String getDefaultSubjectId() { - return subjectIdURI; - } - - @Override - public String getDefaultResourceId() { - return resourceIdURI; - } - - @Override - public String getDefaultActionId() { - return actionIdURI; - } - @Override public PepResponseBehavior getIndeterminateBehavior() { return indeterminateBehavior; diff --git a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java index 2787c37..e98b5a2 100644 --- a/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java +++ b/openaz-pep/src/main/java/org/apache/openaz/pepapi/std/SubjectMapper.java @@ -20,8 +20,6 @@ package org.apache.openaz.pepapi.std; -import org.apache.openaz.pepapi.PepRequest; -import org.apache.openaz.pepapi.PepRequestAttributes; import org.apache.openaz.pepapi.Subject; public class SubjectMapper extends CategoryContainerMapper { @@ -29,19 +27,4 @@ public class SubjectMapper extends CategoryContainerMapper { public SubjectMapper() { super(Subject.class); } - - @Override - public void map(Object o, PepRequest pepRequest) { - Subject subject = (Subject) o; - String id = subject.getId(); - if (id == null) { - id = getPepConfig().getDefaultSubjectId(); - if (id != null) { - PepRequestAttributes resourceAttributes = pepRequest - .getPepRequestAttributes(subject.getCategoryIdentifier()); - resourceAttributes.addAttribute(Subject.DEFAULT_IDENTIFIER_ID.stringValue(), (String) id); - } - } - super.map(o, pepRequest); - } } \ No newline at end of file diff --git a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java b/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java deleted file mode 100644 index 5d8a68b..0000000 --- a/openaz-pep/src/test/java/org/apache/openaz/pepapi/std/test/TestConfig.java +++ /dev/null @@ -1,79 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - * - */ - -package org.apache.openaz.pepapi.std.test; - -import org.apache.openaz.pepapi.*; -import org.apache.openaz.pepapi.std.StdPepAgentFactory; -import org.junit.Assert; -import org.junit.Before; -import org.junit.Test; - -import java.net.URI; -import java.util.ArrayList; -import java.util.List; - -public class TestConfig { - - private PepAgentFactory pepAgentFactory; - - @Before - public void setup() { - pepAgentFactory = new StdPepAgentFactory("properties/testconfig.xacml.properties"); - } - - /** - * - */ - @Test - public void testPepAgent() { - Assert.assertNotNull(getPepAgent()); - } - - /** - * - */ - @Test - public void testPermitWithDefaultsMatch() { - Subject subject = Subject.newInstance(); - Action action = Action.newInstance(); - Resource resource = Resource.newInstance(); - PepResponse response = getPepAgent().decide(subject, action, resource); - Assert.assertNotNull(response); - Assert.assertEquals(true, response.allowed()); - } - - /** - * - */ - @Test - public void testPermitWithDefaultsMismatch() { - Subject subject = Subject.newInstance("non-default-subject-id"); - Action action = Action.newInstance("non-default-action-id"); - Resource resource = Resource.newInstance("non-default-resource-id"); - PepResponse response = getPepAgent().decide(subject, action, resource); - Assert.assertNotNull(response); - Assert.assertEquals(false, response.allowed()); - } - - public PepAgent getPepAgent() { - return pepAgentFactory.getPepAgent(); - } -} diff --git a/openaz-pep/src/test/resources/policies/testconfig.xml b/openaz-pep/src/test/resources/policies/testconfig.xml deleted file mode 100755 index 23a8bdc..0000000 --- a/openaz-pep/src/test/resources/policies/testconfig.xml +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - default-subject-id - - - - - - - - default-resource-id - - - - - - - - default-action-id - - - - - - - diff --git a/openaz-pep/src/test/resources/properties/testconfig.xacml.properties b/openaz-pep/src/test/resources/properties/testconfig.xacml.properties deleted file mode 100755 index f4f71d4..0000000 --- a/openaz-pep/src/test/resources/properties/testconfig.xacml.properties +++ /dev/null @@ -1,21 +0,0 @@ -# Default XACML Properties File -# Standard API Factories -# -xacml.dataTypeFactory=org.apache.openaz.xacml.std.StdDataTypeFactory -xacml.pdpEngineFactory=org.apache.openaz.xacml.pdp.OpenAZPDPEngineFactory -xacml.pepEngineFactory=org.apache.openaz.xacml.std.pep.StdEngineFactory -xacml.pipFinderFactory=org.apache.openaz.xacml.std.pip.StdPIPFinderFactory - -# OpenAZ PDP Implementation Factories -# -xacml.openaz.evaluationContextFactory=org.apache.openaz.xacml.pdp.std.StdEvaluationContextFactory -xacml.openaz.combiningAlgorithmFactory=org.apache.openaz.xacml.pdp.std.StdCombiningAlgorithmFactory -xacml.openaz.functionDefinitionFactory=org.apache.openaz.xacml.pdp.std.StdFunctionDefinitionFactory -xacml.openaz.policyFinderFactory=org.apache.openaz.xacml.pdp.std.StdPolicyFinderFactory - -xacml.rootPolicies=testPolicy -testPolicy.file=src/test/resources/policies/testconfig.xml - -pep.subject.id=default-subject-id -pep.action.id=default-action-id -pep.resource.id=default-resource-id \ No newline at end of file