use of com.sun.identity.entitlement.xacml3.core.AttributeValue in project OpenAM by OpenRock.
the class XACMLPrivilegeUtils method resourceNameToMatch.
public static Match resourceNameToMatch(String resourceName, String applicationName) {
if (resourceName == null || resourceName.length() == 0) {
return null;
}
Match match = new Match();
String matchId = XACMLConstants.ENTITLEMENT_RESOURCE_MATCH + ":" + applicationName;
match.setMatchId(matchId);
AttributeValue attributeValue = new AttributeValue();
String dataType = XACMLConstants.XS_STRING;
attributeValue.setDataType(dataType);
attributeValue.getContent().add(resourceName);
AttributeDesignator attributeDesignator = new AttributeDesignator();
String category = XACMLConstants.XACML_RESOURCE_CATEGORY;
attributeDesignator.setCategory(category);
String attributeId = XACMLConstants.XACML_RESOURCE_ID;
attributeDesignator.setAttributeId(attributeId);
String dt = XACMLConstants.XS_STRING;
attributeDesignator.setDataType(dt);
// TOOD: not a constant?
String issuer = XACMLConstants.RESOURCE_ISSUER;
// attributeDesignator.setIssuer(issuer); TODO: verify and fix
boolean mustBePresent = true;
attributeDesignator.setMustBePresent(mustBePresent);
match.setAttributeValue(attributeValue);
match.setAttributeDesignator(attributeDesignator);
return match;
}
use of com.sun.identity.entitlement.xacml3.core.AttributeValue in project OpenAM by OpenRock.
the class XACMLPrivilegeUtils method getRealmsAppsResources.
static JSONObject getRealmsAppsResources(List<Match> matches) throws JSONException {
if (matches == null) {
return null;
}
JSONObject jo = null;
String jsonString = null;
for (Match match : matches) {
String matchId = match.getMatchId();
if ((matchId != null) && matchId.equals(XACMLConstants.JSON_REALMS_APPS_RESOURCES_MATCH)) {
AttributeValue attributeValue = match.getAttributeValue();
if (attributeValue != null) {
List<Object> contentList = attributeValue.getContent();
if ((contentList != null) && !contentList.isEmpty()) {
Object obj = contentList.get(0);
jsonString = obj.toString();
break;
}
}
}
}
if (jsonString != null) {
jo = new JSONObject(jsonString);
}
return jo;
}
use of com.sun.identity.entitlement.xacml3.core.AttributeValue in project OpenAM by OpenRock.
the class XACMLSchemaFactory method adviceExpressionToResourceAttribute.
/**
* Convert the specified {@link com.sun.identity.entitlement.xacml3.core.AdviceExpression} object into a
* {@link com.sun.identity.entitlement.ResourceAttribute}.
*
* @param adviceExpression The specified advice expression
* @return The resource attribute
* @throws com.sun.identity.entitlement.EntitlementException if JSON exceptions occur
*/
public ResourceAttribute adviceExpressionToResourceAttribute(AdviceExpression adviceExpression) throws EntitlementException {
for (AttributeAssignmentExpression attributeAssignmentExpression : adviceExpression.getAttributeAssignmentExpression()) {
JAXBElement<?> jaxbElement = attributeAssignmentExpression.getExpression();
Object value = jaxbElement.getValue();
if (value instanceof AttributeValue) {
AttributeValue attributeValue = (AttributeValue) value;
for (Object content : attributeValue.getContent()) {
if (content instanceof String) {
return resourceAttributeUtil.fromJSON((String) content);
}
}
}
}
return null;
}
use of com.sun.identity.entitlement.xacml3.core.AttributeValue in project OpenAM by OpenRock.
the class XACMLPrivilegeUtils method realmsAppsResourcesToAnyOf.
public static AnyOf realmsAppsResourcesToAnyOf(Set<String> realms, Map<String, Set<String>> appsResources) throws JSONException {
AnyOf anyOf = new AnyOf();
List<AllOf> allOfList = anyOf.getAllOf();
AllOf allOf = new AllOf();
allOfList.add(allOf);
List<Match> matchList = allOf.getMatch();
Match match = new Match();
matchList.add(match);
//FIXME
match.setMatchId(XACMLConstants.JSON_REALMS_APPS_RESOURCES_MATCH);
AttributeValue attributeValue = new AttributeValue();
//FIXME
String dataType = XACMLConstants.JSON_REALMS_APPS_RESOURCES_DATATYPE;
attributeValue.setDataType(dataType);
JSONObject jo = new JSONObject();
jo.put("realms", realms);
jo.put("appsResources", appsResources);
attributeValue.getContent().add(jo.toString());
AttributeDesignator attributeDesignator = new AttributeDesignator();
String category = XACMLConstants.REALMS_APPS_RESOURCES_CATEGORY;
attributeDesignator.setCategory(category);
String attributeId = XACMLConstants.JSON_REALMS_APPS_RESOURCES_ID;
attributeDesignator.setAttributeId(attributeId);
attributeDesignator.setDataType(dataType);
boolean mustBePresent = false;
attributeDesignator.setMustBePresent(mustBePresent);
match.setAttributeValue(attributeValue);
match.setAttributeDesignator(attributeDesignator);
return anyOf;
}
use of com.sun.identity.entitlement.xacml3.core.AttributeValue in project OpenAM by OpenRock.
the class XACMLPrivilegeUtils method privilegeToPolicyInternal.
private static Policy privilegeToPolicyInternal(Privilege privilege) throws JAXBException, EntitlementException {
if (privilege == null) {
return null;
}
Policy policy = new Policy();
String privilegeName = privilege.getName();
String applicationName = null;
String entitlementName = null;
Entitlement entitlement = privilege.getEntitlement();
if (entitlement != null) {
applicationName = entitlement.getApplicationName();
entitlementName = entitlement.getName();
}
String policyId = privilegeNameToPolicyId(privilegeName, applicationName);
policy.setPolicyId(policyId);
String description = privilege.getDescription();
policy.setDescription(description);
List<Object> vrList = policy.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition();
JAXBContext jaxbContext = JAXBContext.newInstance(XACMLConstants.XACML3_CORE_PKG);
if (applicationName != null) {
VariableDefinition appName = new VariableDefinition();
vrList.add(appName);
appName.setVariableId(XACMLConstants.APPLICATION_NAME);
AttributeValue cbv = new AttributeValue();
cbv.setDataType(XACMLConstants.XS_STRING);
cbv.getContent().add(applicationName);
JAXBElement<AttributeValue> cbve = objectFactory.createAttributeValue(cbv);
appName.setExpression(cbve);
}
if (entitlementName != null) {
VariableDefinition entName = new VariableDefinition();
vrList.add(entName);
entName.setVariableId(XACMLConstants.ENTITLEMENT_NAME);
AttributeValue cbv = new AttributeValue();
cbv.setDataType(XACMLConstants.XS_STRING);
cbv.getContent().add(entitlementName);
JAXBElement<AttributeValue> cbve = objectFactory.createAttributeValue(cbv);
entName.setExpression(cbve);
}
VariableDefinition createdBy = new VariableDefinition();
vrList.add(createdBy);
createdBy.setVariableId(XACMLConstants.PRIVILEGE_CREATED_BY);
AttributeValue cbv = new AttributeValue();
cbv.setDataType(XACMLConstants.XS_STRING);
cbv.getContent().add(privilege.getCreatedBy());
JAXBElement<AttributeValue> cbve = objectFactory.createAttributeValue(cbv);
createdBy.setExpression(cbve);
VariableDefinition lastModifiedBy = new VariableDefinition();
vrList.add(lastModifiedBy);
lastModifiedBy.setVariableId(XACMLConstants.PRIVILEGE_LAST_MODIFIED_BY);
AttributeValue lmbv = new AttributeValue();
lmbv.setDataType(XACMLConstants.XS_STRING);
lmbv.getContent().add(privilege.getLastModifiedBy());
JAXBElement<AttributeValue> lmbve = objectFactory.createAttributeValue(lmbv);
lastModifiedBy.setExpression(lmbve);
SimpleDateFormat sdf1 = new SimpleDateFormat("yyyy-MM-dd");
SimpleDateFormat sdf2 = new SimpleDateFormat("HH:mm:ss.SSS");
SimpleDateFormat sdf3 = new SimpleDateFormat("yyyy.MM.dd.HH.mm.ss.SSS");
sdf1.setTimeZone(TimeZone.getTimeZone("GMT"));
sdf2.setTimeZone(TimeZone.getTimeZone("GMT"));
sdf3.setTimeZone(TimeZone.getTimeZone("GMT"));
VariableDefinition creationDate = new VariableDefinition();
vrList.add(creationDate);
creationDate.setVariableId(XACMLConstants.PRIVILEGE_CREATION_DATE);
AttributeValue cdv = new AttributeValue();
cdv.setDataType(XACMLConstants.XS_DATE_TIME);
cdv.getContent().add(sdf1.format(privilege.getCreationDate()) + "T" + sdf2.format(privilege.getCreationDate()));
JAXBElement<AttributeValue> cdve = objectFactory.createAttributeValue(cdv);
creationDate.setExpression(cdve);
VariableDefinition lastModifiedDate = new VariableDefinition();
vrList.add(lastModifiedDate);
lastModifiedDate.setVariableId(XACMLConstants.PRIVILEGE_LAST_MODIFIED_DATE);
AttributeValue lmdv = new AttributeValue();
lmdv.setDataType(XACMLConstants.XS_DATE_TIME);
lmdv.getContent().add(sdf1.format(privilege.getLastModifiedDate()) + "T" + sdf2.format(privilege.getLastModifiedDate()));
JAXBElement<AttributeValue> lmdve = objectFactory.createAttributeValue(lmdv);
lastModifiedDate.setExpression(lmdve);
// PolicyIssuer policyIssuer = null; // optional, TODO
Version version = new Version();
// TODO: use privilege version in future
version.setValue(sdf3.format(privilege.getLastModifiedDate()));
policy.setVersion(version);
// Defaults policyDefaults = null; // optional, TODO
String rca = getRuleCombiningAlgId(applicationName);
policy.setRuleCombiningAlgId(rca);
// String ruleCombiningAlgId = "rca"; // required
// XACML Target contains a list of AnyOf(s)
// XACML AnyOf contains a list of AllOf(s)
// XACML AllOf contains a list of Match(s)
Target target = new Target();
policy.setTarget(target);
List<AnyOf> targetAnyOfList = target.getAnyOf();
EntitlementSubject es = privilege.getSubject();
/* TODO: detect simple subjects and set attribute value and designator
List<AnyOf> anyOfSubjectList = entitlementSubjectToAnyOfList(es);
if (anyOfSubjectList != null) {
targetAnyOfList.addAll(anyOfSubjectList);
}
*/
AnyOf anyOfSubject = entitlementSubjectToAnyOf(es);
if (anyOfSubject != null) {
targetAnyOfList.add(anyOfSubject);
}
Set<String> resources = entitlement.getResourceNames();
List<AnyOf> anyOfResourceList = resourceNamesToAnyOfList(resources, applicationName);
if (anyOfResourceList != null) {
targetAnyOfList.addAll(anyOfResourceList);
}
AnyOf anyOfApplication = applicationNameToAnyOf(applicationName);
if (anyOfApplication != null) {
targetAnyOfList.add(anyOfApplication);
}
Map<String, Boolean> actionValues = entitlement.getActionValues();
List<AnyOf> anyOfActionList = actionNamesToAnyOfList(actionValues.keySet(), applicationName);
if (anyOfActionList != null) {
targetAnyOfList.addAll(anyOfActionList);
}
// PermitRule, DenyRule
Set<String> permitActions = new HashSet<String>();
Set<String> denyActions = new HashSet<String>();
if (actionValues != null) {
Set<String> actionNames = actionValues.keySet();
for (String actionName : actionNames) {
if (Boolean.TRUE.equals(actionValues.get(actionName))) {
permitActions.add(actionName);
} else {
denyActions.add(actionName);
}
}
}
Condition condition = eSubjectConditionToXCondition(privilege.getSubject(), privilege.getCondition());
// Include resource attributes (ResourceProvider) as AdviceExpressions
Set<ResourceAttribute> ra = privilege.getResourceAttributes();
if (ra != null && !ra.isEmpty()) {
AdviceExpressions adviceExpressions = schemaFactory.resourceAttributesToAdviceExpressions(ra);
policy.setAdviceExpressions(adviceExpressions);
}
if (!permitActions.isEmpty()) {
Rule permitRule = new Rule();
vrList.add(permitRule);
permitRule.setRuleId(entitlement.getName() + ":" + XACMLConstants.PREMIT_RULE_SUFFIX);
permitRule.setDescription(XACMLConstants.PERMIT_RULE_DESCRIPTION);
permitRule.setEffect(EffectType.PERMIT);
Target permitTarget = new Target();
permitRule.setTarget(permitTarget);
List<AnyOf> permitTargetAnyOfList = permitTarget.getAnyOf();
List<AnyOf> anyOfPermitActionList = actionNamesToAnyOfList(permitActions, applicationName);
if (anyOfPermitActionList != null) {
permitTargetAnyOfList.addAll(anyOfPermitActionList);
}
if (condition != null) {
permitRule.setCondition(condition);
}
}
if (!denyActions.isEmpty()) {
Rule denyRule = new Rule();
vrList.add(denyRule);
denyRule.setRuleId(entitlement.getName() + ":" + XACMLConstants.DENY_RULE_SUFFIX);
denyRule.setDescription(XACMLConstants.DENY_RULE_DESCRIPTION);
denyRule.setEffect(EffectType.DENY);
Target denyTarget = new Target();
denyRule.setTarget(denyTarget);
List<AnyOf> denyTargetAnyOfList = denyTarget.getAnyOf();
List<AnyOf> anyOfDenyActionList = actionNamesToAnyOfList(denyActions, applicationName);
if (anyOfDenyActionList != null) {
denyTargetAnyOfList.addAll(anyOfDenyActionList);
}
if (condition != null) {
denyRule.setCondition(condition);
}
}
return policy;
}
Aggregations