Examples with Evaluator com.sun.identity.entitlement.Evaluator used on opensource projects

Example 6 with Evaluator

use of com.sun.identity.entitlement.Evaluator in project OpenAM by OpenRock.

the class PolicyEvaluator method getResourceResultsE.

private Set getResourceResultsE(SSOToken token, String resourceName, String scope, Map envParameters) throws SSOException, PolicyException {
    if ((envParameters == null) || envParameters.isEmpty()) {
        envParameters = new HashMap();
    }
    padEnvParameters(token, resourceName, null, envParameters);
    Set resultsSet;
    boolean subTreeSearch = false;
    if (ResourceResult.SUBTREE_SCOPE.equals(scope)) {
        subTreeSearch = true;
    //resultsSet = getResourceResultTree(token, resourceName, scope,
    //                            envParameters).getResourceResults();
    } else if (ResourceResult.STRICT_SUBTREE_SCOPE.equals(scope) || ResourceResult.SELF_SCOPE.equals(scope)) {
    /*
            ResourceResult result = getResourceResultTree(token, resourceName,
                                         scope, envParameters);
            resultsSet = new HashSet();
            resultsSet.add(result);*/
    } else {
        DEBUG.error("PolicyEvaluator: invalid request scope: " + scope);
        String[] objs = { scope };
        throw new PolicyException(ResBundleUtils.rbName, "invalid_request_scope", objs, null);
    }
    SSOToken adminSSOToken = (SSOToken) AccessController.doPrivileged(AdminTokenAction.getInstance());
    try {
        // Parse the resource name before proceeding.
        resourceName = serviceType.canonicalize(resourceName);
        Subject userSubject = SubjectUtils.createSubject(token);
        Evaluator eval = new Evaluator(SubjectUtils.createSubject(adminSSOToken), applicationName);
        List<Entitlement> entitlements = eval.evaluate(realm, userSubject, resourceName, envParameters, subTreeSearch);
        resultsSet = new HashSet();
        if (!entitlements.isEmpty()) {
            if (!subTreeSearch) {
                resultsSet.add(entitlementToResourceResult((Entitlement) entitlements.iterator().next()));
            } else {
                ResourceResult virtualResourceResult = new ResourceResult(ResourceResult.VIRTUAL_ROOT, new PolicyDecision());
                for (Entitlement ent : entitlements) {
                    ResourceResult r = entitlementToResourceResult(ent);
                    virtualResourceResult.addResourceResult(r, serviceType);
                }
                resultsSet.addAll(virtualResourceResult.getResourceResults());
            }
        }
    } catch (Exception e) {
        DEBUG.error("Error in getResourceResults", e);
        //TOFIX
        throw new PolicyException(e.getMessage());
    }
    return resultsSet;
}

Example 7 with Evaluator

use of com.sun.identity.entitlement.Evaluator in project OpenAM by OpenRock.

the class OpenSSOApplicationPrivilegeManager method isPolicyAdmin.

private boolean isPolicyAdmin() {
    if (isDsameUser()) {
        return true;
    }
    Subject adminSubject = SubjectUtils.createSuperAdminSubject();
    try {
        Evaluator eval = new Evaluator(adminSubject, APPL_NAME);
        Set<String> actions = new HashSet<String>();
        actions.add(ACTION_MODIFY);
        String res = "sms://" + DNMapper.orgNameToDN(realm) + "/iPlanetAMPolicyService/*";
        Entitlement e = new Entitlement(res, actions);
        return eval.hasEntitlement(getHiddenRealmDN(), caller, e, Collections.EMPTY_MAP);
    } catch (EntitlementException ex) {
        PrivilegeManager.debug.error("OpenSSOApplicationPrivilegeManager.isPolicyAdmin", ex);
        return false;
    }
}

Example 8 with Evaluator

use of com.sun.identity.entitlement.Evaluator in project OpenAM by OpenRock.

the class OpenProvisioning method testEval.

@Test
public void testEval() throws Exception {
    SSOToken adminSSOToken = (SSOToken) AccessController.doPrivileged(AdminTokenAction.getInstance());
    Subject adminSubject = SubjectUtils.createSubject(adminSSOToken);
    Set<Principal> userPrincipals = new HashSet<Principal>(2);
    userPrincipals.add(new AuthSPrincipal(jSmith.getUniversalId()));
    Subject userSubject = new Subject(false, userPrincipals, new HashSet(), new HashSet());
    Map<String, Set<String>> envParameters = new HashMap<String, Set<String>>();
    Evaluator eval = new Evaluator(adminSubject, APPLICATION);
    List entitlements = eval.evaluate("/", userSubject, RESOURCE, envParameters, false);
    Entitlement e1 = (Entitlement) entitlements.iterator().next();
    if (!e1.getActionValues().isEmpty()) {
        throw new Exception("OpenProvisioning.test fails because action values is not empty");
    }
    Map<String, Set<String>> mapAdvices = e1.getAdvices();
    Set<String> setAdvices = mapAdvices.get(AttributeLookupCondition.class.getName());
    if (!setAdvices.contains("$USER.postaladdress=$RES.postaladdress")) {
        throw new Exception("OpenProvisioning.test fails because missing advices");
    }
    Set publicCreds = userSubject.getPublicCredentials();
    publicCreds.add("postaladdress=CA");
    Set<String> setLocation = new HashSet<String>();
    setLocation.add("CA");
    envParameters.put("/OP/cropLdap/person/johndoe.postaladdress", setLocation);
    eval = new Evaluator(adminSubject, APPLICATION);
    entitlements = eval.evaluate("/", userSubject, RESOURCE1, envParameters, false);
    e1 = (Entitlement) entitlements.iterator().next();
    if (e1.getActionValues().isEmpty()) {
        throw new Exception("OpenProvisioning.test fails.");
    }
}

Example 9 with Evaluator

use of com.sun.identity.entitlement.Evaluator in project OpenAM by OpenRock.

the class ResourceSetService method isSharedWith.

/**
     * Checks whether a ResourceSet is accessible by a user.
     * @param resourceSet The resource set to check.
     * @param resourceUserId The id of the user to check.
     * @param realm The realm to check in.
     * @return @code{true} if the user can access that ResourceSet.
     */
public boolean isSharedWith(ResourceSetDescription resourceSet, String resourceUserId, String realm) throws InternalServerErrorException {
    Subject subject = createSubject(resourceUserId, realm);
    try {
        Evaluator evaluator = umaProviderSettingsFactory.get(realm).getPolicyEvaluator(subject, resourceSet.getClientId().toLowerCase());
        String sharedResourceName = "uma://" + resourceSet.getId();
        List<Entitlement> entitlements = evaluator.evaluate(realm, subject, sharedResourceName, null, false);
        if (!entitlements.isEmpty() && !entitlements.iterator().next().getActionValues().isEmpty()) {
            return true;
        }
    } catch (EntitlementException | NotFoundException e) {
        throw new InternalServerErrorException(e);
    }
    return false;
}

Example 10 with Evaluator

use of com.sun.identity.entitlement.Evaluator in project OpenAM by OpenRock.

the class ResourceSetServiceTest method mockPolicyEvaluator.

private void mockPolicyEvaluator(String clientId) throws EntitlementException {
    Evaluator policyEvaluator = mock(Evaluator.class);
    given(umaProviderSettings.getPolicyEvaluator(any(Subject.class), anyString())).willReturn(policyEvaluator);
    given(policyEvaluator.evaluate(any(String.class), any(Subject.class), any(String.class), anyMap(), any(Boolean.class))).willReturn(Collections.<Entitlement>emptyList());
    given(umaProviderSettings.getPolicyEvaluator(any(Subject.class), eq(clientId.toLowerCase()))).willReturn(policyEvaluator);
}