Examples with DelegationEvaluatorImpl com.sun.identity.delegation.DelegationEvaluatorImpl used on opensource projects

Example 1 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class DelegationConfigNode method hasPermission.

boolean hasPermission(String realmName, String serviceName, String action, SSOToken ssoToken) throws DelegationException {
    if (realmName == null) {
        try {
            realmName = DNMapper.orgNameToRealmName(ssoToken.getProperty(Constants.ORGANIZATION));
        } catch (SSOException e) {
            throw new DelegationException(e);
        }
    }
    DelegationEvaluator delegationEvaluator = new DelegationEvaluatorImpl();
    DelegationPermission delegationPermission = getDelegationPermission(realmName, action);
    boolean allowed = false;
    if (serviceName != null) {
        allowed = isAllowed(delegationEvaluator, delegationPermission, ssoToken, serviceName);
    } else {
        Set actions = (Set) permissions.get(AMAdminConstants.PERMISSION_MODIFY);
        for (Iterator i = actions.iterator(); i.hasNext() && !allowed; ) {
            allowed = isAllowed(delegationEvaluator, delegationPermission, ssoToken, (String) i.next());
        }
    }
    return allowed;
}

Example 2 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class SessionService method hasTopLevelAdminRole.

/**
     * Returns true if the user has top level admin role
     *
     * @param tokenUsedForSearch Single Sign on token used to do the search.
     * @param clientID           Client ID of the login user.
     * @throws SessionException
     * @throws SSOException
     */
private boolean hasTopLevelAdminRole(SSOToken tokenUsedForSearch, String clientID) throws SessionException, SSOException {
    boolean topLevelAdmin = false;
    Set actions = CollectionUtils.asSet(PERMISSION_READ, PERMISSION_MODIFY, PERMISSION_DELEGATE);
    try {
        DelegationPermission perm = new DelegationPermission("/", "*", "*", "*", "*", actions, Collections.EMPTY_MAP);
        DelegationEvaluator evaluator = new DelegationEvaluatorImpl();
        topLevelAdmin = evaluator.isAllowed(tokenUsedForSearch, perm, Collections.EMPTY_MAP);
    } catch (DelegationException de) {
        sessionDebug.error("SessionService.hasTopLevelAdminRole: failed to check the delegation permission.", de);
    }
    return topLevelAdmin;
}

Example 3 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class XACMLUtils method hasPermission.

public static boolean hasPermission(String realm, SSOToken adminToken, String action) {
    try {
        DelegationEvaluator de = new DelegationEvaluatorImpl();
        DelegationPermission dp = new DelegationPermission(realm, "rest", "1.0", "policies", action, asSet(action), Collections.<String, String>emptyMap());
        return de.isAllowed(adminToken, dp, Collections.EMPTY_MAP);
    } catch (DelegationException de) {
        DEBUG.error("XACMLUtils.hasPermission", de);
        return false;
    } catch (SSOException ssoe) {
        DEBUG.error("XACMLUtils.hasPermission", ssoe);
        return false;
    }
}

Example 4 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class IdServicesImpl method checkPermission.

private boolean checkPermission(SSOToken token, String realm, String name, Set attrs, IdOperation op, IdType type) throws IdRepoException, SSOException {
    if (!ServiceManager.isConfigMigratedTo70()) {
        // in coexistence mode. Do not perform any delegation check
        return true;
    }
    Set thisAction = null;
    if (op.equals(IdOperation.READ)) {
        // thisAction = readAction;
        // TODO This is a temporary fix where-in all users are
        // being allowed read permisions, till delegation component
        // is fixed to support "user self read" operations
        thisAction = READ_ACTION;
    } else {
        thisAction = WRITE_ACTION;
    }
    try {
        DelegationEvaluator de = new DelegationEvaluatorImpl();
        String resource = type.getName();
        if (name != null) {
            resource += "/" + name;
        }
        DelegationPermission dp = new DelegationPermission(realm, IdConstants.REPO_SERVICE, "1.0", "application", resource, thisAction, Collections.EMPTY_MAP);
        Map envMap = Collections.EMPTY_MAP;
        if (attrs != null) {
            envMap = new HashMap();
            envMap.put(DELEGATION_ATTRS_NAME, attrs);
        }
        if (!de.isAllowed(token, dp, envMap)) {
            Object[] args = { op.getName(), token.getPrincipal().getName() };
            throw new IdRepoException(IdRepoBundle.BUNDLE_NAME, IdRepoErrorCode.ACCESS_DENIED, args);
        }
        return true;
    } catch (DelegationException dex) {
        DEBUG.error("IdServicesImpl.checkPermission Got Delegation Exception: ", dex);
        Object[] args = { op.getName(), token.getPrincipal().getName() };
        throw new IdRepoException(IdRepoBundle.BUNDLE_NAME, IdRepoErrorCode.ACCESS_DENIED, args);
    }
}

Example 5 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class SSOTokenAuthZ method doFilter.

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    int statusCode = HttpServletResponse.SC_OK;
    String statusMessage = null;
    Principal clientPrincipal = ((HttpServletRequest) request).getUserPrincipal();
    if (clientPrincipal instanceof ISubjectable) {
        try {
            Subject clientSubject = ((ISubjectable) clientPrincipal).createSubject();
            DelegationEvaluator eval = new DelegationEvaluatorImpl();
            SSOToken token = SubjectUtils.getSSOToken(clientSubject);
            String action = mapMethodToAction.get(((HttpServletRequest) request).getMethod());
            if (action == null) {
                statusCode = HttpServletResponse.SC_UNAUTHORIZED;
                statusMessage = "Unable to get HTTP method for request.";
            } else {
                Set<String> setAction = new HashSet<String>();
                setAction.add(action);
                DelegationPermission permission = new DelegationPermission("/", "sunEntitlementService", "1.0", "application", getURI(request), setAction, null);
                if (!eval.isAllowed(token, permission, Collections.EMPTY_MAP)) {
                    statusCode = HttpServletResponse.SC_UNAUTHORIZED;
                    statusMessage = "Unauthorized.";
                }
            }
        } catch (Exception e) {
            statusCode = HttpServletResponse.SC_UNAUTHORIZED;
            statusMessage = e.getMessage();
        }
    } else {
        statusCode = HttpServletResponse.SC_UNAUTHORIZED;
        statusMessage = "Unable to obtain subject.";
    }
    if (statusCode == HttpServletResponse.SC_OK) {
        statusCode = validateTokenId((HttpServletRequest) request);
        if (statusCode == HttpServletResponse.SC_OK) {
            chain.doFilter(request, response);
        } else {
            statusMessage = "SSO token is invalid or has expired.";
        }
    }
    if (statusCode != HttpServletResponse.SC_OK) {
        ((HttpServletResponse) response).sendError(statusCode, statusMessage);
        return;
    }
}