Examples with ConditionDecision com.sun.identity.entitlement.ConditionDecision used on opensource projects

Example 21 with ConditionDecision

use of com.sun.identity.entitlement.ConditionDecision in project OpenAM by OpenRock.

the class AuthenticateToServiceConditionTest method conditionShouldEvaluateToTrueWhenEnvironmentContainsServicesAndRealmIsPresentAndMatches.

@Test
public void conditionShouldEvaluateToTrueWhenEnvironmentContainsServicesAndRealmIsPresentAndMatches() throws EntitlementException {
    //Given
    String realm = "REALM";
    Subject subject = new Subject();
    String resourceName = "RESOURCE_NAME";
    Map<String, Set<String>> env = new HashMap<String, Set<String>>();
    Set<String> services = new HashSet<String>();
    given(coreWrapper.getDataFromRealmQualifiedData("OTHER_SERVICE_NAME")).willReturn("SERVICE_NAME");
    given(coreWrapper.convertOrgNameToRealmName("REALM")).willReturn("REALM");
    services.add("OTHER_SERVICE_NAME");
    env.put(REQUEST_AUTHENTICATED_TO_SERVICES, services);
    condition.setState("{\"authenticateToService\": \"SERVICE_NAME\"}");
    //When
    ConditionDecision decision = condition.evaluate(realm, subject, resourceName, env);
    //Then
    assertThat(decision.isSatisfied()).isTrue();
    assertThat(decision.getAdvice()).isEmpty();
}

Example 22 with ConditionDecision

use of com.sun.identity.entitlement.ConditionDecision in project OpenAM by OpenRock.

the class AuthenticateToServiceConditionTest method conditionShouldEvaluateToTrueWhenEnvironmentDoesNotContainServicesAndRealmIsPresentAndDoesNotMatch.

@Test
public void conditionShouldEvaluateToTrueWhenEnvironmentDoesNotContainServicesAndRealmIsPresentAndDoesNotMatch() throws EntitlementException {
    //Given
    String realm = "REALM";
    Subject subject = new Subject();
    String resourceName = "RESOURCE_NAME";
    Map<String, Set<String>> env = new HashMap<String, Set<String>>();
    Set<String> services = new HashSet<String>();
    SSOToken ssoToken = mock(SSOToken.class);
    given(coreWrapper.getDataFromRealmQualifiedData("OTHER_SERVICE_NAME")).willReturn("OTHER_SERVICE_NAME");
    given(coreWrapper.convertOrgNameToRealmName("REALM")).willReturn("REALM");
    services.add("OTHER_SERVICE_NAME");
    subject.getPrivateCredentials().add(ssoToken);
    given(entitlementCoreWrapper.getRealmQualifiedAuthenticatedServices(ssoToken)).willReturn(services);
    condition.setState("{\"authenticateToService\": \"SERVICE_NAME\"}");
    //When
    ConditionDecision decision = condition.evaluate(realm, subject, resourceName, env);
    //Then
    assertThat(decision.isSatisfied()).isFalse();
    assertThat(decision.getAdvice()).containsOnly(entry(AUTHENTICATE_TO_SERVICE_CONDITION_ADVICE, Collections.singleton("REALM:SERVICE_NAME")));
}

Example 23 with ConditionDecision

use of com.sun.identity.entitlement.ConditionDecision in project OpenAM by OpenRock.

the class AuthenticateToServiceConditionTest method conditionShouldEvaluateToTrueWhenEnvironmentDoesNotContainServicesAndMatches.

@Test
public void conditionShouldEvaluateToTrueWhenEnvironmentDoesNotContainServicesAndMatches() throws EntitlementException {
    //Given
    String realm = "REALM";
    Subject subject = new Subject();
    String resourceName = "RESOURCE_NAME";
    Map<String, Set<String>> env = new HashMap<String, Set<String>>();
    Set<String> services = new HashSet<String>();
    SSOToken ssoToken = mock(SSOToken.class);
    given(coreWrapper.getRealmFromRealmQualifiedData("SERVICE_NAME")).willReturn("REALM");
    given(coreWrapper.convertOrgNameToRealmName("REALM")).willReturn("REALM");
    services.add("SERVICE_NAME");
    subject.getPrivateCredentials().add(ssoToken);
    given(entitlementCoreWrapper.getRealmQualifiedAuthenticatedServices(ssoToken)).willReturn(services);
    condition.setState("{\"authenticateToService\": \"SERVICE_NAME\"}");
    //When
    ConditionDecision decision = condition.evaluate(realm, subject, resourceName, env);
    //Then
    assertThat(decision.isSatisfied()).isTrue();
    assertThat(decision.getAdvice()).isEmpty();
}

Example 24 with ConditionDecision

use of com.sun.identity.entitlement.ConditionDecision in project OpenAM by OpenRock.

the class OpenSSOPrivilege method internalEvaluate.

private List<Entitlement> internalEvaluate(Subject adminSubject, String realm, Subject subject, String applicationName, String resourceName, Set<String> actionNames, Map<String, Set<String>> environment, boolean recursive) throws EntitlementException {
    Entitlement originalEntitlement = getEntitlement();
    if (!isActive()) {
        Entitlement entitlement = new Entitlement(originalEntitlement.getApplicationName(), originalEntitlement.getResourceName(), Collections.<String>emptySet());
        return Arrays.asList(entitlement);
    }
    // First evaluate subject conditions.
    SubjectDecision subjectDecision = doesSubjectMatch(adminSubject, realm, subject, resourceName, environment);
    if (!subjectDecision.isSatisfied()) {
        Entitlement entitlement = new Entitlement(originalEntitlement.getApplicationName(), originalEntitlement.getResourceName(), Collections.<String>emptySet());
        entitlement.setAdvices(subjectDecision.getAdvices());
        return Arrays.asList(entitlement);
    }
    // Second evaluate environment conditions.
    ConditionDecision conditionDecision = doesConditionMatch(realm, subject, resourceName, environment);
    if (!conditionDecision.isSatisfied()) {
        Entitlement entitlement = new Entitlement(originalEntitlement.getApplicationName(), originalEntitlement.getResourceName(), Collections.<String>emptySet());
        entitlement.setAdvices(conditionDecision.getAdvice());
        entitlement.setTTL(conditionDecision.getTimeToLive());
        return Arrays.asList(entitlement);
    }
    // Finally verify the resource.
    Set<String> matchedResources = originalEntitlement.evaluate(adminSubject, realm, subject, applicationName, resourceName, actionNames, environment, recursive);
    if (PolicyConstants.DEBUG.messageEnabled()) {
        PolicyConstants.DEBUG.message("[PolicyEval] OpenSSOPrivilege.evaluate: resources=" + matchedResources);
    }
    // Retrieve the collection of response attributes base on the resource.
    Map<String, Set<String>> attributes = getAttributes(adminSubject, realm, subject, resourceName, environment);
    squashMaps(attributes, conditionDecision.getResponseAttributes());
    List<Entitlement> results = new ArrayList<>();
    for (String matchedResource : matchedResources) {
        Entitlement entitlement = new Entitlement(originalEntitlement.getApplicationName(), matchedResource, originalEntitlement.getActionValues());
        entitlement.setAdvices(conditionDecision.getAdvice());
        entitlement.setAttributes(attributes);
        entitlement.setTTL(conditionDecision.getTimeToLive());
        results.add(entitlement);
    }
    return results;
}

Example 25 with ConditionDecision

use of com.sun.identity.entitlement.ConditionDecision in project OpenAM by OpenRock.

the class AMIdentityMembershipConditionTest method conditionShouldEvaluateToFalseWhenConfiguredIdentityCanHaveMembersButInvocatorIsNotAMember.

@Test
public void conditionShouldEvaluateToFalseWhenConfiguredIdentityCanHaveMembersButInvocatorIsNotAMember() throws EntitlementException, IdRepoException, SSOException {
    //Given
    String realm = "REALM";
    Subject subject = new Subject();
    String resourceName = "RESOURCE_NAME";
    Map<String, Set<String>> env = new HashMap<String, Set<String>>();
    AMIdentity invocatorIdentity = mock(AMIdentity.class);
    AMIdentity identity = mock(AMIdentity.class);
    IdType invocatorIdType = mock(IdType.class);
    IdType identityIdType = mock(IdType.class);
    env.put(INVOCATOR_PRINCIPAL_UUID, Collections.singleton("INVOCATOR_UUID"));
    condition.setState("{\"amIdentityName\": [\"IDENTITY\"]}");
    given(coreWrapper.getIdentity(adminToken, "INVOCATOR_UUID")).willReturn(invocatorIdentity);
    given(coreWrapper.getIdentity(adminToken, "IDENTITY")).willReturn(identity);
    given(invocatorIdentity.getType()).willReturn(invocatorIdType);
    given(identity.getType()).willReturn(identityIdType);
    given(identityIdType.canHaveMembers()).willReturn(Collections.singleton(invocatorIdType));
    given(invocatorIdentity.isMember(identity)).willReturn(false);
    //When
    ConditionDecision decision = condition.evaluate(realm, subject, resourceName, env);
    //Then
    assertThat(decision.isSatisfied()).isFalse();
    assertThat(decision.getAdvice()).isEmpty();
}