Examples with DelegationEvaluator com.sun.identity.delegation.DelegationEvaluator used on opensource projects

Example 1 with DelegationEvaluator

use of com.sun.identity.delegation.DelegationEvaluator in project OpenAM by OpenRock.

the class DelegationConfigNode method hasPermission.

boolean hasPermission(String realmName, String serviceName, String action, SSOToken ssoToken) throws DelegationException {
    if (realmName == null) {
        try {
            realmName = DNMapper.orgNameToRealmName(ssoToken.getProperty(Constants.ORGANIZATION));
        } catch (SSOException e) {
            throw new DelegationException(e);
        }
    }
    DelegationEvaluator delegationEvaluator = new DelegationEvaluatorImpl();
    DelegationPermission delegationPermission = getDelegationPermission(realmName, action);
    boolean allowed = false;
    if (serviceName != null) {
        allowed = isAllowed(delegationEvaluator, delegationPermission, ssoToken, serviceName);
    } else {
        Set actions = (Set) permissions.get(AMAdminConstants.PERMISSION_MODIFY);
        for (Iterator i = actions.iterator(); i.hasNext() && !allowed; ) {
            allowed = isAllowed(delegationEvaluator, delegationPermission, ssoToken, (String) i.next());
        }
    }
    return allowed;
}

Example 2 with DelegationEvaluator

use of com.sun.identity.delegation.DelegationEvaluator in project OpenAM by OpenRock.

the class SessionService method hasTopLevelAdminRole.

/**
     * Returns true if the user has top level admin role
     *
     * @param tokenUsedForSearch Single Sign on token used to do the search.
     * @param clientID           Client ID of the login user.
     * @throws SessionException
     * @throws SSOException
     */
private boolean hasTopLevelAdminRole(SSOToken tokenUsedForSearch, String clientID) throws SessionException, SSOException {
    boolean topLevelAdmin = false;
    Set actions = CollectionUtils.asSet(PERMISSION_READ, PERMISSION_MODIFY, PERMISSION_DELEGATE);
    try {
        DelegationPermission perm = new DelegationPermission("/", "*", "*", "*", "*", actions, Collections.EMPTY_MAP);
        DelegationEvaluator evaluator = new DelegationEvaluatorImpl();
        topLevelAdmin = evaluator.isAllowed(tokenUsedForSearch, perm, Collections.EMPTY_MAP);
    } catch (DelegationException de) {
        sessionDebug.error("SessionService.hasTopLevelAdminRole: failed to check the delegation permission.", de);
    }
    return topLevelAdmin;
}

Example 3 with DelegationEvaluator

use of com.sun.identity.delegation.DelegationEvaluator in project OpenAM by OpenRock.

the class XACMLUtils method hasPermission.

public static boolean hasPermission(String realm, SSOToken adminToken, String action) {
    try {
        DelegationEvaluator de = new DelegationEvaluatorImpl();
        DelegationPermission dp = new DelegationPermission(realm, "rest", "1.0", "policies", action, asSet(action), Collections.<String, String>emptyMap());
        return de.isAllowed(adminToken, dp, Collections.EMPTY_MAP);
    } catch (DelegationException de) {
        DEBUG.error("XACMLUtils.hasPermission", de);
        return false;
    } catch (SSOException ssoe) {
        DEBUG.error("XACMLUtils.hasPermission", ssoe);
        return false;
    }
}

Example 4 with DelegationEvaluator

use of com.sun.identity.delegation.DelegationEvaluator in project OpenAM by OpenRock.

the class IdServicesImpl method checkPermission.

private boolean checkPermission(SSOToken token, String realm, String name, Set attrs, IdOperation op, IdType type) throws IdRepoException, SSOException {
    if (!ServiceManager.isConfigMigratedTo70()) {
        // in coexistence mode. Do not perform any delegation check
        return true;
    }
    Set thisAction = null;
    if (op.equals(IdOperation.READ)) {
        // thisAction = readAction;
        // TODO This is a temporary fix where-in all users are
        // being allowed read permisions, till delegation component
        // is fixed to support "user self read" operations
        thisAction = READ_ACTION;
    } else {
        thisAction = WRITE_ACTION;
    }
    try {
        DelegationEvaluator de = new DelegationEvaluatorImpl();
        String resource = type.getName();
        if (name != null) {
            resource += "/" + name;
        }
        DelegationPermission dp = new DelegationPermission(realm, IdConstants.REPO_SERVICE, "1.0", "application", resource, thisAction, Collections.EMPTY_MAP);
        Map envMap = Collections.EMPTY_MAP;
        if (attrs != null) {
            envMap = new HashMap();
            envMap.put(DELEGATION_ATTRS_NAME, attrs);
        }
        if (!de.isAllowed(token, dp, envMap)) {
            Object[] args = { op.getName(), token.getPrincipal().getName() };
            throw new IdRepoException(IdRepoBundle.BUNDLE_NAME, IdRepoErrorCode.ACCESS_DENIED, args);
        }
        return true;
    } catch (DelegationException dex) {
        DEBUG.error("IdServicesImpl.checkPermission Got Delegation Exception: ", dex);
        Object[] args = { op.getName(), token.getPrincipal().getName() };
        throw new IdRepoException(IdRepoBundle.BUNDLE_NAME, IdRepoErrorCode.ACCESS_DENIED, args);
    }
}

Example 5 with DelegationEvaluator

use of com.sun.identity.delegation.DelegationEvaluator in project OpenAM by OpenRock.

the class SSOTokenAuthZ method doFilter.

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    int statusCode = HttpServletResponse.SC_OK;
    String statusMessage = null;
    Principal clientPrincipal = ((HttpServletRequest) request).getUserPrincipal();
    if (clientPrincipal instanceof ISubjectable) {
        try {
            Subject clientSubject = ((ISubjectable) clientPrincipal).createSubject();
            DelegationEvaluator eval = new DelegationEvaluatorImpl();
            SSOToken token = SubjectUtils.getSSOToken(clientSubject);
            String action = mapMethodToAction.get(((HttpServletRequest) request).getMethod());
            if (action == null) {
                statusCode = HttpServletResponse.SC_UNAUTHORIZED;
                statusMessage = "Unable to get HTTP method for request.";
            } else {
                Set<String> setAction = new HashSet<String>();
                setAction.add(action);
                DelegationPermission permission = new DelegationPermission("/", "sunEntitlementService", "1.0", "application", getURI(request), setAction, null);
                if (!eval.isAllowed(token, permission, Collections.EMPTY_MAP)) {
                    statusCode = HttpServletResponse.SC_UNAUTHORIZED;
                    statusMessage = "Unauthorized.";
                }
            }
        } catch (Exception e) {
            statusCode = HttpServletResponse.SC_UNAUTHORIZED;
            statusMessage = e.getMessage();
        }
    } else {
        statusCode = HttpServletResponse.SC_UNAUTHORIZED;
        statusMessage = "Unable to obtain subject.";
    }
    if (statusCode == HttpServletResponse.SC_OK) {
        statusCode = validateTokenId((HttpServletRequest) request);
        if (statusCode == HttpServletResponse.SC_OK) {
            chain.doFilter(request, response);
        } else {
            statusMessage = "SSO token is invalid or has expired.";
        }
    }
    if (statusCode != HttpServletResponse.SC_OK) {
        ((HttpServletResponse) response).sendError(statusCode, statusMessage);
        return;
    }
}