Examples with AuthorizationDecisionType com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType used on opensource projects

Example 1 with AuthorizationDecisionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType in project midpoint by Evolveum.

the class SchemaTransformer method applySecurityConstraintsPhase.

private <D extends ItemDefinition> void applySecurityConstraintsPhase(D itemDefinition, ObjectSecurityConstraints securityConstraints, AuthorizationPhaseType phase) {
    Validate.notNull(phase);
    AuthorizationDecisionType defaultReadDecision = securityConstraints.getActionDecision(ModelAuthorizationAction.READ.getUrl(), phase);
    AuthorizationDecisionType defaultAddDecision = securityConstraints.getActionDecision(ModelAuthorizationAction.ADD.getUrl(), phase);
    AuthorizationDecisionType defaultModifyDecision = securityConstraints.getActionDecision(ModelAuthorizationAction.MODIFY.getUrl(), phase);
    LOGGER.trace("applySecurityConstraints(itemDefs): def={}, phase={}, defaults R={}, A={}, M={}", new Object[] { itemDefinition, phase, defaultReadDecision, defaultAddDecision, defaultModifyDecision });
    applySecurityConstraintsItemDef(itemDefinition, ItemPath.EMPTY_PATH, securityConstraints, defaultReadDecision, defaultAddDecision, defaultModifyDecision, phase);
}

Example 2 with AuthorizationDecisionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType in project midpoint by Evolveum.

the class AbstractModelIntegrationTest method assertAllowRequestItems.

protected void assertAllowRequestItems(String userOid, String targetRoleOid, AuthorizationDecisionType expectedDefaultDecision, QName... expectedAllowedItemQNames) throws SchemaException, SecurityViolationException, CommunicationException, ObjectNotFoundException, ConfigurationException, ExpressionEvaluationException {
    PrismObject<UserType> user = getUser(userOid);
    PrismObject<RoleType> target = getRole(targetRoleOid);
    ItemSecurityDecisions decisions = modelInteractionService.getAllowedRequestAssignmentItems(user, target);
    display("Request decisions for " + target, decisions);
    assertEquals("Wrong assign default decision", expectedDefaultDecision, decisions.getDefaultDecision());
    assertEquals("Unexpected number of allowed items", expectedAllowedItemQNames.length, decisions.getItemDecisionMap().size());
    decisions.getItemDecisionMap().forEach((path, decision) -> {
        assertEquals("wrong item " + path + " decision", AuthorizationDecisionType.ALLOW, decision);
        QName lastPathName = path.lastNamed().getName();
        if (!Arrays.stream(expectedAllowedItemQNames).anyMatch(qname -> QNameUtil.match(qname, lastPathName))) {
            AssertJUnit.fail("Unexpected path " + path);
        }
    });
}

Example 3 with AuthorizationDecisionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType in project midpoint by Evolveum.

the class SecurityEnforcerImpl method isAuthorizedPhase.

private <O extends ObjectType, T extends ObjectType> AccessDecision isAuthorizedPhase(MidPointPrincipal midPointPrincipal, String operationUrl, AuthorizationPhaseType phase, AuthorizationParameters<O, T> params, OwnerResolver ownerResolver, Consumer<Authorization> applicableAutzConsumer, Task task, OperationResult result) throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
    if (AuthorizationConstants.AUTZ_NO_ACCESS_URL.equals(operationUrl)) {
        return AccessDecision.DENY;
    }
    if (phase == null) {
        throw new IllegalArgumentException("No phase");
    }
    AccessDecision decision = AccessDecision.DEFAULT;
    if (LOGGER.isTraceEnabled()) {
        LOGGER.trace("AUTZ: evaluating authorization principal={}, op={}, phase={}, {}", getUsername(midPointPrincipal), operationUrl, phase, params.shortDump());
    }
    final AutzItemPaths allowedItems = new AutzItemPaths();
    Collection<Authorization> authorities = getAuthorities(midPointPrincipal);
    if (authorities != null) {
        for (GrantedAuthority authority : authorities) {
            if (authority instanceof Authorization) {
                Authorization autz = (Authorization) authority;
                String autzHumanReadableDesc = autz.getHumanReadableDesc();
                LOGGER.trace("  Evaluating {}", autzHumanReadableDesc);
                // action
                if (!autz.getAction().contains(operationUrl) && !autz.getAction().contains(AuthorizationConstants.AUTZ_ALL_URL)) {
                    LOGGER.trace("    {} not applicable for operation {}", autzHumanReadableDesc, operationUrl);
                    continue;
                }
                // phase
                if (autz.getPhase() == null) {
                    LOGGER.trace("    {} is applicable for all phases (continuing evaluation)", autzHumanReadableDesc);
                } else {
                    if (autz.getPhase() != phase) {
                        LOGGER.trace("    {} is not applicable for phases {} (breaking evaluation)", autzHumanReadableDesc, phase);
                        continue;
                    } else {
                        LOGGER.trace("    {} is applicable for phases {} (continuing evaluation)", autzHumanReadableDesc, phase);
                    }
                }
                // relation
                if (!isApplicableRelation(autz, params.getRelation())) {
                    LOGGER.trace("    {} not applicable for relation {}", autzHumanReadableDesc, params.getRelation());
                    continue;
                }
                // orderConstraints
                if (!isApplicableOrderConstraints(autz, params.getOrderConstraints())) {
                    if (LOGGER.isTraceEnabled()) {
                        LOGGER.trace("    {} not applicable for orderConstraints {}", autzHumanReadableDesc, SchemaDebugUtil.shortDumpOrderConstraintsList(params.getOrderConstraints()));
                    }
                    continue;
                }
                // object
                if (isApplicableObject(autz, params.getOdo(), midPointPrincipal, ownerResolver, autzHumanReadableDesc, task, result)) {
                    LOGGER.trace("    {} applicable for object {} (continuing evaluation)", autzHumanReadableDesc, params.getAnyObject());
                } else {
                    LOGGER.trace("    {} not applicable for object {}, none of the object specifications match (breaking evaluation)", autzHumanReadableDesc, params.getAnyObject());
                    continue;
                }
                // target
                if (isApplicable(autz.getTarget(), params.getTarget(), midPointPrincipal, ownerResolver, "target", autzHumanReadableDesc, task, result)) {
                    LOGGER.trace("    {} applicable for target {} (continuing evaluation)", autzHumanReadableDesc, params.getAnyObject());
                } else {
                    LOGGER.trace("    {} not applicable for target {}, none of the target specifications match (breaking evaluation)", autzHumanReadableDesc, params.getAnyObject());
                    continue;
                }
                if (applicableAutzConsumer != null) {
                    applicableAutzConsumer.accept(autz);
                }
                // authority is applicable to this situation. now we can process the decision.
                AuthorizationDecisionType autzDecision = autz.getDecision();
                if (autzDecision == null || autzDecision.equals(AuthorizationDecisionType.ALLOW)) {
                    allowedItems.collectItems(autz);
                    LOGGER.trace("    {}: ALLOW operation {} (but continue evaluation)", autzHumanReadableDesc, operationUrl);
                    decision = AccessDecision.ALLOW;
                // Do NOT break here. Other authorization statements may still deny the operation
                } else {
                    // item
                    if (isApplicableItem(autz, params.getOldObject(), params.getDelta())) {
                        LOGGER.trace("    {}: Deny authorization applicable for items (continuing evaluation)", autzHumanReadableDesc);
                    } else {
                        LOGGER.trace("    {} not applicable for items (breaking evaluation)", autzHumanReadableDesc);
                        continue;
                    }
                    LOGGER.trace("    {}: DENY operation {}", autzHumanReadableDesc, operationUrl);
                    decision = AccessDecision.DENY;
                    // Break right here. Deny cannot be overridden by allow. This decision cannot be changed.
                    break;
                }
            } else {
                LOGGER.warn("Unknown authority type {} in user {}", authority.getClass(), getUsername(midPointPrincipal));
            }
        }
    }
    if (decision == AccessDecision.ALLOW) {
        // Still check allowedItems. We may still deny the operation.
        if (allowedItems.isAllItems()) {
            // This means all items are allowed. No need to check anything
            LOGGER.trace("  Empty list of allowed items, operation allowed");
        } else {
            // all items in the object and delta must be allowed
            LOGGER.trace("  Checking for allowed items: {}", allowedItems);
            ItemDecisionFunction itemDecisionFunction = (itemPath, removingContainer) -> decideAllowedItems(itemPath, allowedItems, phase, removingContainer);
            AccessDecision itemsDecision = null;
            if (params.hasDelta()) {
                // Behave as if this is execution phase for delete delta authorizations. We do not want to avoid deleting objects just because there
                // are automatic/operational items that were generated by midPoint. Otherwise we won't be really able to delete any object.
                ItemDecisionFunction itemDecisionFunctionDelete = (itemPath, removingContainer) -> decideAllowedItems(itemPath, allowedItems, AuthorizationPhaseType.EXECUTION, removingContainer);
                itemsDecision = determineDeltaDecision(params.getDelta(), params.getOldObject(), itemDecisionFunction, itemDecisionFunctionDelete);
            } else if (params.hasObject()) {
                itemsDecision = determineObjectDecision(params.getAnyObject(), itemDecisionFunction);
            }
            if (itemsDecision != AccessDecision.ALLOW) {
                LOGGER.trace("    NOT ALLOWED operation because the item decision is {}", itemsDecision);
                decision = AccessDecision.DEFAULT;
            }
        }
    }
    if (LOGGER.isTraceEnabled()) {
        LOGGER.trace("AUTZ result: principal={}, operation={}: {}", getUsername(midPointPrincipal), prettyActionUrl(operationUrl), decision);
    }
    return decision;
}

Example 4 with AuthorizationDecisionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType in project midpoint by Evolveum.

the class ObjectSecurityConstraintsImpl method findItemDecision.

public AuthorizationDecisionType findItemDecision(ItemPath itemPath, String actionUrl, AuthorizationPhaseType phase) {
    // We return DENY immediately, and ALLOW only if no DENY is present. So here we remember if we should return ALLOW or null at the end.
    boolean allow = false;
    for (Map.Entry<ItemPath, ItemSecurityConstraintsImpl> entry : itemConstraintMap.entrySet()) {
        ItemPath entryPath = entry.getKey();
        if (entryPath.isSubPathOrEquivalent(itemPath)) {
            ItemSecurityConstraintsImpl itemSecurityConstraints = entry.getValue();
            if (itemSecurityConstraints == null) {
                continue;
            }
            AuthorizationDecisionType actionDecision = getSimpleActionDecision(itemSecurityConstraints.getActionDecisionMap(), actionUrl, phase);
            AuthorizationDecisionType allDecision = getSimpleActionDecision(itemSecurityConstraints.getActionDecisionMap(), AuthorizationConstants.AUTZ_ALL_URL, phase);
            if (actionDecision == AuthorizationDecisionType.DENY || allDecision == AuthorizationDecisionType.DENY) {
                return AuthorizationDecisionType.DENY;
            }
            if (actionDecision == AuthorizationDecisionType.ALLOW || allDecision == AuthorizationDecisionType.ALLOW) {
                allow = true;
            }
        }
    }
    if (allow) {
        return AuthorizationDecisionType.ALLOW;
    } else {
        return null;
    }
}

Example 5 with AuthorizationDecisionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType in project midpoint by Evolveum.

the class ObjectSecurityConstraintsImpl method getActionDecision.

@Override
public AuthorizationDecisionType getActionDecision(String actionUrl, AuthorizationPhaseType phase) {
    AuthorizationDecisionType actionDecision = getSimpleActionDecision(actionDecisionMap, actionUrl, phase);
    AuthorizationDecisionType allDecision = getSimpleActionDecision(actionDecisionMap, AuthorizationConstants.AUTZ_ALL_URL, phase);
    if (actionDecision == null && allDecision == null) {
        return null;
    }
    if (actionDecision == AuthorizationDecisionType.DENY || allDecision == AuthorizationDecisionType.DENY) {
        return AuthorizationDecisionType.DENY;
    }
    if (actionDecision != null) {
        return actionDecision;
    }
    return allDecision;
}