Examples with EntitlementException com.sun.identity.entitlement.EntitlementException used on opensource projects

Example 21 with EntitlementException

use of com.sun.identity.entitlement.EntitlementException in project OpenAM by OpenRock.

the class ResourceEnvIPCondition method getAdviceMessagesforAuthScheme.

/**
     * Returns advice messages for Authentication Scheme condition.
     */
private Set<String> getAdviceMessagesforAuthScheme(String adviceValue, SSOToken token, Map<String, Set<String>> env) throws EntitlementException, SSOException {
    if (debug.messageEnabled()) {
        localDebugName = debugName + ".getAdviceMessagesforAuthScheme(): ";
    }
    Set<String> adviceMessages = new HashSet<String>();
    Set requestAuthSchemes = null;
    Set requestAuthSchemesIgnoreRealm = null;
    if ((env != null) && (env.get(REQUEST_AUTH_SCHEMES) != null)) {
        try {
            requestAuthSchemes = env.get(REQUEST_AUTH_SCHEMES);
            if (debug.messageEnabled()) {
                debug.message(localDebugName + "requestAuthSchemes from env=" + requestAuthSchemes);
            }
        } catch (ClassCastException e) {
            throw new EntitlementException(PROPERTY_VALUE_NOT_DEFINED, new String[] { REQUEST_AUTH_SCHEMES }, e);
        }
    } else {
        if (token != null) {
            requestAuthSchemes = AMAuthUtils.getRealmQualifiedAuthenticatedSchemes(token);
            requestAuthSchemesIgnoreRealm = AMAuthUtils.getAuthenticatedSchemes(token);
            if (debug.messageEnabled()) {
                debug.message(localDebugName + "requestAuthSchemes from ssoToken=" + requestAuthSchemes);
                debug.message(localDebugName + "requestAuthSchemesIgnoreRealm from ssoToken= " + requestAuthSchemesIgnoreRealm);
            }
        }
    }
    if (requestAuthSchemes == null) {
        requestAuthSchemes = Collections.EMPTY_SET;
    }
    if (requestAuthSchemesIgnoreRealm == null) {
        requestAuthSchemesIgnoreRealm = Collections.EMPTY_SET;
    }
    String authScheme = adviceValue;
    if (!requestAuthSchemes.contains(authScheme)) {
        String realm = AMAuthUtils.getRealmFromRealmQualifiedData(authScheme);
        if ((realm != null) && (realm.length() != 0)) {
            adviceMessages.add(authScheme);
            if (debug.messageEnabled()) {
                debug.message(localDebugName + "authScheme not satisfied = " + authScheme);
            }
        } else if ((realm == null) || (realm.length() == 0)) {
            if (!requestAuthSchemesIgnoreRealm.contains(authScheme)) {
                adviceMessages.add(authScheme);
                if (debug.messageEnabled()) {
                    debug.message(localDebugName + "authScheme not satisfied = " + authScheme);
                }
            }
        }
    }
    if (debug.messageEnabled()) {
        debug.message(localDebugName + "authScheme = " + authScheme + ", " + "requestAuthSchemes = " + requestAuthSchemes + ", " + " adviceMessages = " + adviceMessages);
    }
    return adviceMessages;
}

Example 22 with EntitlementException

use of com.sun.identity.entitlement.EntitlementException in project OpenAM by OpenRock.

the class ResourceEnvIPCondition method getMaxRequestAuthLevel.

/**
     * Returns the maximum auth level specified for the REQUEST_AUTH_LEVEL
     * property in the environment Map.
     */
private int getMaxRequestAuthLevel(Map<String, Set<String>> env, String authRealm, String authLevel) throws EntitlementException {
    if (debug.messageEnabled()) {
        localDebugName = debugName + ".getMaxRequestAuthLevel(): ";
    }
    int maxAuthLevel = Integer.MIN_VALUE;
    int currentAuthLevel = Integer.MIN_VALUE;
    if (debug.messageEnabled()) {
        debug.message(localDebugName + "entering: envMap= " + env + ", authRealm= " + authRealm + ", " + "conditionAuthLevel= " + authLevel);
    }
    Object envAuthLevelObject = env.get(REQUEST_AUTH_LEVEL);
    if (envAuthLevelObject != null) {
        if (envAuthLevelObject instanceof Integer) {
            if ((authRealm == null) || (authRealm.length() == 0)) {
                maxAuthLevel = ((Integer) envAuthLevelObject).intValue();
                if (debug.messageEnabled()) {
                    debug.message(localDebugName + "Integer level in env= " + maxAuthLevel);
                }
            }
        } else if (envAuthLevelObject instanceof Set) {
            Set envAuthLevelSet = (Set) envAuthLevelObject;
            if (!envAuthLevelSet.isEmpty()) {
                Iterator iter = envAuthLevelSet.iterator();
                while (iter.hasNext()) {
                    Object envAuthLevelElement = iter.next();
                    if (!(envAuthLevelElement instanceof String)) {
                        if (debug.warningEnabled()) {
                            debug.warning(localDebugName + "requestAuthLevel Set element" + " not String");
                        }
                        throw new EntitlementException(AUTH_LEVEL_NOT_INT_OR_SET);
                    } else {
                        String qualifiedLevel = (String) envAuthLevelElement;
                        currentAuthLevel = getAuthLevel(qualifiedLevel);
                        if ((authRealm == null) || authRealm.length() == 0) {
                            if (currentAuthLevel > maxAuthLevel) {
                                maxAuthLevel = currentAuthLevel;
                            }
                        } else {
                            String realmString = AMAuthUtils.getRealmFromRealmQualifiedData(qualifiedLevel);
                            if (authRealm.equals(realmString) && (currentAuthLevel > maxAuthLevel)) {
                                maxAuthLevel = currentAuthLevel;
                            }
                        }
                    }
                }
            }
        } else {
            if (debug.warningEnabled()) {
                debug.warning(localDebugName + "requestAuthLevel in env neither Integer nor Set");
            }
            throw new EntitlementException(AUTH_LEVEL_NOT_INT_OR_SET);
        }
    }
    if (debug.messageEnabled()) {
        debug.message(localDebugName + "returning: maxAuthLevel=" + maxAuthLevel);
    }
    return maxAuthLevel;
}

Example 23 with EntitlementException

use of com.sun.identity.entitlement.EntitlementException in project OpenAM by OpenRock.

the class LDAPFilterCondition method setLdapFilter.

// Set by JSON mapping
@SuppressWarnings("unused")
public void setLdapFilter(String ldapFilter) throws EntitlementException {
    final Map<String, Set<String>> properties = new HashMap<String, Set<String>>(condition.getProperties());
    properties.put(LDAP_FILTER, Collections.singleton(ldapFilter));
    try {
        condition.setProperties(properties);
    } catch (PolicyException e) {
        throw new EntitlementException(EntitlementException.INVALID_PROPERTY_VALUE, new Object[] { LDAP_FILTER, ldapFilter }, e);
    }
}

Example 24 with EntitlementException

use of com.sun.identity.entitlement.EntitlementException in project OpenAM by OpenRock.

the class ResourceEnvIPCondition method getAdviceMessagesforRealm.

/**
     * Returns advice messages for Authentication Realm condition.
     */
private Set<String> getAdviceMessagesforRealm(String adviceValue, SSOToken token, Map<String, Set<String>> env) throws EntitlementException, SSOException {
    if (debug.messageEnabled()) {
        localDebugName = debugName + ".getAdviceMessagesforRealm(): ";
    }
    Set<String> adviceMessages = new HashSet<String>();
    Set<String> requestAuthnRealms = new HashSet<String>();
    if ((env != null) && (env.get(REQUEST_AUTHENTICATED_TO_REALMS) != null)) {
        try {
            requestAuthnRealms = env.get(REQUEST_AUTHENTICATED_TO_REALMS);
            if (debug.messageEnabled()) {
                debug.message(localDebugName + "requestAuthnRealms, from request / env = " + requestAuthnRealms);
            }
        } catch (ClassCastException e) {
            throw new EntitlementException(PROPERTY_IS_NOT_A_SET, new String[] { REQUEST_AUTHENTICATED_TO_REALMS }, e);
        }
    } else {
        if (token != null) {
            Set authenticatedRealms = AMAuthUtils.getAuthenticatedRealms(token);
            if (authenticatedRealms != null) {
                requestAuthnRealms.addAll(authenticatedRealms);
            }
            if (debug.messageEnabled()) {
                debug.message(localDebugName + "requestAuthnRealms, from ssoToken = " + requestAuthnRealms);
            }
        }
    }
    String authRealm = adviceValue;
    if (!requestAuthnRealms.contains(authRealm)) {
        adviceMessages.add(authRealm);
        if (debug.messageEnabled()) {
            debug.message(localDebugName + "authenticateToRealm not satisfied = " + authRealm);
        }
    }
    if (debug.messageEnabled()) {
        debug.message(localDebugName + "authRealm = " + authRealm + "," + " requestAuthnRealms = " + requestAuthnRealms + ", adviceMessages = " + adviceMessages);
    }
    return adviceMessages;
}

Example 25 with EntitlementException

use of com.sun.identity.entitlement.EntitlementException in project OpenAM by OpenRock.

the class AuthLevelCondition method evaluate.

/**
     * {@inheritDoc}
     */
@Override
public ConditionDecision evaluate(String realm, Subject subject, String resourceName, Map<String, Set<String>> env) throws EntitlementException {
    if (subject == null) {
        return new ConditionDecision(false, Collections.<String, Set<String>>emptyMap());
    }
    if (authLevel == null) {
        throw new EntitlementException(PROPERTY_VALUE_NOT_DEFINED, new String[] { AUTH_LEVEL }, null);
    }
    boolean allowed = false;
    Map<String, Set<String>> advices = new HashMap<String, Set<String>>();
    if (debug.messageEnabled()) {
        debug.message(getConditionName() + ".getConditionDecision():entering");
    }
    try {
        int maxRequestAuthLevel = getMaxRequestAuthLevel(env);
        if (maxRequestAuthLevel == Integer.MIN_VALUE) {
            SSOToken token = (SSOToken) subject.getPrivateCredentials().iterator().next();
            maxRequestAuthLevel = getMaxRequestAuthLevel(token);
        }
        allowed = isAllowed(maxRequestAuthLevel, advices);
        if (debug.messageEnabled()) {
            debug.message("At " + getConditionName() + ".getConditionDecision():authLevel=" + authLevel + ",maxRequestAuthLevel=" + maxRequestAuthLevel + ",allowed = " + allowed);
        }
    } catch (SSOException e) {
        if (debug.messageEnabled()) {
            debug.message("Problem getting auth level from SSOToken: " + e.getMessage(), e);
        }
    }
    return new ConditionDecision(allowed, advices);
}