Examples with ApplicationPrivilegeManager com.sun.identity.entitlement.ApplicationPrivilegeManager used on opensource projects

Example 1 with ApplicationPrivilegeManager

use of com.sun.identity.entitlement.ApplicationPrivilegeManager in project OpenAM by OpenRock.

the class OpenSSOPolicyDataStore method addPolicy.

public void addPolicy(Subject subject, String realm, Privilege privilege) throws EntitlementException {
    // Delegation to applications is currently not configurable, passing super admin (see AME-4959)
    ApplicationPrivilegeManager applPrivilegeMgr = ApplicationPrivilegeManager.getInstance(realm, PrivilegeManager.superAdminSubject);
    if (!applPrivilegeMgr.hasPrivilege(privilege, ApplicationPrivilege.Action.MODIFY)) {
        throw new EntitlementException(326);
    }
    String name = "";
    try {
        Object policy = PrivilegeUtils.privilegeToPolicyObject(realm, privilege);
        name = PrivilegeUtils.getPolicyName(policy);
        if (policy instanceof Policy || policy instanceof com.sun.identity.entitlement.xacml3.core.Policy) {
            String dn = getPolicyDistinguishedName(realm, name);
            if (SMSEntry.checkIfEntryExists(dn, dsameUserToken)) {
                throw new EntitlementException(EntitlementException.POLICY_ALREADY_EXISTS);
            }
            createParentNode(dsameUserToken, realm);
            SMSEntry s = new SMSEntry(dsameUserToken, dn);
            Map<String, Set<String>> map = new HashMap<String, Set<String>>();
            Set<String> setServiceID = new HashSet<String>(2);
            map.put(SMSEntry.ATTR_SERVICE_ID, setServiceID);
            setServiceID.add("NamedPolicy");
            Set<String> setObjectClass = new HashSet<String>(4);
            map.put(SMSEntry.ATTR_OBJECTCLASS, setObjectClass);
            setObjectClass.add(SMSEntry.OC_TOP);
            setObjectClass.add(SMSEntry.OC_SERVICE_COMP);
            Set<String> setValue = new HashSet<String>(2);
            map.put(SMSEntry.ATTR_KEYVAL, setValue);
            setValue.add(POLICY_XML + "=" + PrivilegeUtils.policyToXML(policy));
            s.setAttributes(map);
            String[] logParams = { DNMapper.orgNameToRealmName(realm), name };
            OpenSSOLogger.log(OpenSSOLogger.LogLevel.MESSAGE, Level.INFO, "ATTEMPT_ADD_PRIVILEGE", logParams, subject);
            s.save();
            OpenSSOLogger.log(OpenSSOLogger.LogLevel.MESSAGE, Level.INFO, "SUCCEEDED_ADD_PRIVILEGE", logParams, subject);
            PrivilegeIndexStore pis = PrivilegeIndexStore.getInstance(dsameUserSubject, realm);
            Set<IPrivilege> privileges = new HashSet<IPrivilege>();
            privileges.add(privilege);
            pis.add(privileges);
        } else {
            PrivilegeManager.debug.error("OpenSSOPolicyDataStore.addPolicy: unknown class " + policy.getClass().getName());
        }
    } catch (PolicyException e) {
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name, e.getMessage() };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.ERROR, Level.INFO, "FAILED_ADD_PRIVILEGE", logParams, subject);
        Object[] params = { name };
        throw new EntitlementException(202, params, e);
    } catch (SSOException e) {
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name, e.getMessage() };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.ERROR, Level.INFO, "FAILED_ADD_PRIVILEGE", logParams, subject);
        Object[] params = { name };
        throw new EntitlementException(202, params, e);
    } catch (SMSException e) {
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name, e.getMessage() };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.ERROR, Level.INFO, "FAILED_ADD_PRIVILEGE", logParams, subject);
        Object[] params = { name };
        throw new EntitlementException(202, params, e);
    }
}

Example 2 with ApplicationPrivilegeManager

use of com.sun.identity.entitlement.ApplicationPrivilegeManager in project OpenAM by OpenRock.

the class OpenSSOPolicyDataStore method addReferral.

public void addReferral(Subject subject, String realm, ReferralPrivilege referral) throws EntitlementException {
    String name = referral.getName();
    String dn = getPolicyDistinguishedName(realm, name);
    SSOToken adminToken = SubjectUtils.getSSOToken(subject);
    if (adminToken == null) {
        Object[] params = { name };
        throw new EntitlementException(260, params);
    }
    // Delegation to applications is currently not configurable, passing super admin (see AME-4959)
    ApplicationPrivilegeManager applPrivilegeMgr = ApplicationPrivilegeManager.getInstance(realm, PrivilegeManager.superAdminSubject);
    if (!applPrivilegeMgr.hasPrivilege(referral, ApplicationPrivilege.Action.MODIFY)) {
        throw new EntitlementException(326);
    }
    try {
        createParentNode(dsameUserToken, realm);
        SMSEntry s = new SMSEntry(dsameUserToken, dn);
        Map<String, Set<String>> map = new HashMap<String, Set<String>>();
        Set<String> setServiceID = new HashSet<String>(2);
        map.put(SMSEntry.ATTR_SERVICE_ID, setServiceID);
        setServiceID.add("NamedPolicy");
        Set<String> setObjectClass = new HashSet<String>(4);
        map.put(SMSEntry.ATTR_OBJECTCLASS, setObjectClass);
        setObjectClass.add(SMSEntry.OC_TOP);
        setObjectClass.add(SMSEntry.OC_SERVICE_COMP);
        Set<String> setValue = new HashSet<String>(2);
        map.put(SMSEntry.ATTR_KEYVAL, setValue);
        Policy p = PrivilegeUtils.referralPrivilegeToPolicy(realm, referral);
        setValue.add(POLICY_XML + "=" + p.toXML());
        s.setAttributes(map);
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.MESSAGE, Level.INFO, "ATTEMPT_ADD_REFERRAL", logParams, subject);
        s.save();
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.MESSAGE, Level.INFO, "SUCCEEDED_ADD_REFERRAL", logParams, subject);
        PrivilegeIndexStore pis = PrivilegeIndexStore.getInstance(dsameUserSubject, realm);
        Set<IPrivilege> tmp = new HashSet<IPrivilege>();
        tmp.add(referral);
        pis.add(tmp);
    } catch (PolicyException e) {
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name, e.getMessage() };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.ERROR, Level.INFO, "FAILED_ADD_REFERRAL", logParams, subject);
        Object[] params = { name };
        throw new EntitlementException(261, params, e);
    } catch (SSOException e) {
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name, e.getMessage() };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.ERROR, Level.INFO, "FAILED_ADD_REFERRAL", logParams, subject);
        Object[] params = { name };
        throw new EntitlementException(261, params, e);
    } catch (SMSException e) {
        String[] logParams = { DNMapper.orgNameToRealmName(realm), name, e.getMessage() };
        OpenSSOLogger.log(OpenSSOLogger.LogLevel.ERROR, Level.INFO, "FAILED_ADD_REFERRAL", logParams, subject);
        Object[] params = { name };
        throw new EntitlementException(261, params, e);
    }
}

Example 3 with ApplicationPrivilegeManager

use of com.sun.identity.entitlement.ApplicationPrivilegeManager in project OpenAM by OpenRock.

the class ApplicationPrivilegeCLITest method setSubjects.

@Test(dependsOnMethods = "changeAction")
public void setSubjects() throws Exception {
    String[] args = new String[9];
    args[0] = "update-app-priv-subjects";
    args[1] = CLIConstants.PREFIX_ARGUMENT_LONG + IArgument.REALM_NAME;
    args[2] = "/";
    args[3] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_NAME;
    args[4] = PRIVILEGE_NAME;
    args[5] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_SUBJECT_TYPE;
    args[6] = ApplicationPrivilegeBase.PARAM_SUBJECT_USER;
    args[7] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_SUBJECTS;
    args[8] = user2.getUniversalId();
    CLIRequest req = new CLIRequest(null, args, adminToken);
    cmdManager.addToRequestQueue(req);
    cmdManager.serviceRequestQueue();
    ApplicationPrivilegeManager apm = ApplicationPrivilegeManager.getInstance("/", adminSubject);
    ApplicationPrivilege ap = apm.getPrivilege(PRIVILEGE_NAME);
    Set<AMIdentity> users = new HashSet<AMIdentity>();
    users.add(user2);
    validateSubjects(ap, users, "setSubjects");
}

Example 4 with ApplicationPrivilegeManager

use of com.sun.identity.entitlement.ApplicationPrivilegeManager in project OpenAM by OpenRock.

the class ApplicationPrivilegeCLITest method createApplicationPrivilege.

@Test
public void createApplicationPrivilege() throws Exception {
    String[] args = new String[17];
    args[0] = "add-app-priv";
    args[1] = CLIConstants.PREFIX_ARGUMENT_LONG + IArgument.REALM_NAME;
    args[2] = "/";
    args[3] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_NAME;
    args[4] = PRIVILEGE_NAME;
    args[5] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_APPL_NAME;
    args[6] = ApplicationTypeManager.URL_APPLICATION_TYPE_NAME;
    args[7] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_ACTIONS;
    args[8] = ApplicationPrivilegeBase.PARAM_ACTION_ALL;
    args[9] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_SUBJECT_TYPE;
    args[10] = ApplicationPrivilegeBase.PARAM_SUBJECT_USER;
    args[11] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_SUBJECTS;
    args[12] = user1.getUniversalId();
    args[13] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_DESCRIPTION;
    args[14] = "desc";
    args[15] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_RESOURCES;
    args[16] = "http://www.example.com";
    CLIRequest req = new CLIRequest(null, args, adminToken);
    cmdManager.addToRequestQueue(req);
    cmdManager.serviceRequestQueue();
    ApplicationPrivilegeManager apm = ApplicationPrivilegeManager.getInstance("/", adminSubject);
    ApplicationPrivilege ap = apm.getPrivilege(PRIVILEGE_NAME);
    if (!ap.getDescription().equals("desc")) {
        throw new Exception("ApplicationPrivilegeCLITest.createApplicationPrivilege: " + "description is incorrect.");
    }
    if (!ap.getActionValues().equals(ApplicationPrivilege.PossibleAction.READ_MODIFY_DELEGATE)) {
        throw new Exception("ApplicationPrivilegeCLITest.createApplicationPrivilege: " + "actions is incorrect.");
    }
    Set<String> resources = new HashSet<String>();
    resources.add("http://www.example.com");
    validateResources(ap, resources, "createApplicationPrivilege");
    Set<AMIdentity> users = new HashSet<AMIdentity>();
    users.add(user1);
    validateSubjects(ap, users, "createApplicationPrivilege");
}

Example 5 with ApplicationPrivilegeManager

use of com.sun.identity.entitlement.ApplicationPrivilegeManager in project OpenAM by OpenRock.

the class ApplicationPrivilegeCLITest method removeResources.

@Test(dependsOnMethods = "addResources")
public void removeResources() throws Exception {
    String[] args = new String[9];
    args[0] = "remove-app-priv-resources";
    args[1] = CLIConstants.PREFIX_ARGUMENT_LONG + IArgument.REALM_NAME;
    args[2] = "/";
    args[3] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_NAME;
    args[4] = PRIVILEGE_NAME;
    args[5] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_APPL_NAME;
    args[6] = ApplicationTypeManager.URL_APPLICATION_TYPE_NAME;
    args[7] = CLIConstants.PREFIX_ARGUMENT_LONG + ApplicationPrivilegeBase.PARAM_RESOURCES;
    args[8] = "http://www.example3.com";
    CLIRequest req = new CLIRequest(null, args, adminToken);
    cmdManager.addToRequestQueue(req);
    cmdManager.serviceRequestQueue();
    ApplicationPrivilegeManager apm = ApplicationPrivilegeManager.getInstance("/", adminSubject);
    ApplicationPrivilege ap = apm.getPrivilege(PRIVILEGE_NAME);
    Set<String> resources = new HashSet<String>();
    resources.add("http://www.example1.com");
    resources.add("http://www.example2.com");
    validateResources(ap, resources, "setResources");
}