/*
* JBoss, Home of Professional Open Source
* Copyright 2005, JBoss Inc., and individual contributors as indicated
* by the @authors tag. See the copyright.txt in the distribution for a
* full listing of individual contributors.
*
* This is free software; you can redistribute it and/or modify it
* under the terms of the GNU Lesser General Public License as
* published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This software is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this software; if not, write to the Free
* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
*/
package org.jboss.security.authorization.modules.ejb;
import java.io.ByteArrayOutputStream;
import java.net.URI;
import java.security.Principal;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Set;
import org.jboss.logging.Logger;
import org.jboss.security.authorization.XACMLConstants;
import com.sun.xacml.Indenter;
import com.sun.xacml.attr.StringAttribute;
import com.sun.xacml.attr.TimeAttribute;
import com.sun.xacml.ctx.Attribute;
import com.sun.xacml.ctx.RequestCtx;
import com.sun.xacml.ctx.Subject;
//$Id: EJBXACMLUtil.java 62895 2007-05-08 21:10:34Z anil.saldhana@jboss.com $
/**
* Utility class for the XACML Integration for the EJB Layer
* @author <a href="mailto:Anil.Saldhana@jboss.org">Anil Saldhana</a>
* @since Jul 6, 2006
* @version $Revision: 62895 $
*/
public class EJBXACMLUtil
{
private static Logger log = Logger.getLogger(EJBXACMLUtil.class);
private boolean trace = log.isTraceEnabled();
public EJBXACMLUtil()
{
}
public RequestCtx createXACMLRequest(String ejbName, String methodName,
Principal principal, Set<Principal> roles) throws Exception
{
if(principal == null)
throw new IllegalArgumentException("principal is null");
String action = methodName;
RequestCtx requestCtx = null;
String username = principal.getName();
//Create the subject set
URI subjectAttrUri = new URI(XACMLConstants.SUBJECT_IDENTIFIER);
Attribute subjectAttr = new Attribute(subjectAttrUri,null,null,
new StringAttribute(username));
Set subjectAttrSet = new HashSet();
subjectAttrSet.add(subjectAttr);
subjectAttrSet.addAll(getXACMLRoleSet(roles));
Set subjectSet = new HashSet();
subjectSet.add(new Subject(subjectAttrSet));
//Create the resource set
URI resourceUri = new URI(XACMLConstants.RESOURCE_IDENTIFIER);
Attribute resourceAttr = new Attribute(resourceUri,null,null,
new StringAttribute(ejbName));
Set resourceSet = new HashSet();
resourceSet.add(resourceAttr);
//Create the action set
Set actionSet = new HashSet();
actionSet.add(new Attribute(new URI(XACMLConstants.ACTION_IDENTIFIER),
null,null, new StringAttribute(action)));
//TODO: Get hold of the invocation arguments and populate in the xacml request
//Create the Environment set
Set environSet = new HashSet();
//Current time
URI currentTimeUri = new URI(XACMLConstants.CURRENT_TIME_IDENTIFIER);
Attribute currentTimeAttr = new Attribute(currentTimeUri,null,null,
new TimeAttribute());
environSet.add(currentTimeAttr);
//Create the request context
requestCtx = new RequestCtx(subjectSet,resourceSet,actionSet,environSet);
if(trace)
{
ByteArrayOutputStream baos = new ByteArrayOutputStream();
requestCtx.encode(baos, new Indenter());
log.trace("XACML Request:"+baos.toString());
baos.close();
}
return requestCtx;
}
private Set getXACMLRoleSet(Set<Principal> roles) throws Exception
{
URI roleURI = new URI(XACMLConstants.SUBJECT_ROLE_IDENTIFIER);
Set roleset = new HashSet();
Iterator<Principal> iter = roles != null ? roles.iterator(): null;
while(iter != null && iter.hasNext())
{
Principal role = (Principal)iter.next();
Attribute roleAttr = new Attribute(roleURI,null,null,
new StringAttribute(role.getName()));
roleset.add(roleAttr);
}
return roleset;
}
}