Examples with KeyValueCollectionPermission ddf.security.permission.KeyValueCollectionPermission used on opensource projects

Example 11 with KeyValueCollectionPermission

use of ddf.security.permission.KeyValueCollectionPermission in project ddf by codice.

the class FilterPluginTest method makeDecision.

public Answer<Boolean> makeDecision() {
    Map<String, List<String>> testRoleMap = new HashMap<>();
    List<String> testRoles = new ArrayList<>();
    testRoles.add("A");
    testRoles.add("B");
    testRoleMap.put("Roles", testRoles);
    final KeyValueCollectionPermission testUserPermission = new KeyValueCollectionPermission(CollectionPermission.READ_ACTION, testRoleMap);
    return new Answer<Boolean>() {

        @Override
        public Boolean answer(InvocationOnMock invocation) {
            Object[] args = invocation.getArguments();
            Permission incomingPermission = (Permission) args[1];
            return testUserPermission.implies(incomingPermission);
        }
    };
}

Example 12 with KeyValueCollectionPermission

use of ddf.security.permission.KeyValueCollectionPermission in project ddf by codice.

the class AuthzRealmTest method testAddRemoveSetPolicyExtension.

@Test
public void testAddRemoveSetPolicyExtension() {
    PolicyExtension policyExtension = new PolicyExtension() {

        @Override
        public KeyValueCollectionPermission isPermittedMatchAll(CollectionPermission subjectAllCollection, KeyValueCollectionPermission matchAllCollection) {
            throw new NullPointerException();
        }

        @Override
        public KeyValueCollectionPermission isPermittedMatchOne(CollectionPermission subjectAllCollection, KeyValueCollectionPermission matchOneCollection) {
            throw new NullPointerException();
        }
    };
    testRealm.addPolicyExtension(policyExtension);
    testRealm.removePolicyExtension(policyExtension);
    testRealm.setPolicyExtensions(Arrays.asList(policyExtension));
}

Example 13 with KeyValueCollectionPermission

use of ddf.security.permission.KeyValueCollectionPermission in project ddf by codice.

the class AuthzRealm method isPermitted.

/**
     * Checks if the corresponding Subject/user contained within the AuthorizationInfo object
     * implies the given Permission.
     *
     * @param permission        the permission being checked.
     * @param authorizationInfo the application-specific subject/user identifier.
     * @return true if the user is permitted
     */
private boolean isPermitted(PrincipalCollection subjectPrincipal, Permission permission, AuthorizationInfo authorizationInfo) {
    Collection<Permission> perms = getPermissions(authorizationInfo);
    String curUser = "<user>";
    if (subjectPrincipal != null && subjectPrincipal.getPrimaryPrincipal() != null) {
        curUser = subjectPrincipal.getPrimaryPrincipal().toString();
    }
    if (!CollectionUtils.isEmpty(perms)) {
        if (permission instanceof KeyValuePermission) {
            permission = new KeyValueCollectionPermission(CollectionPermission.UNKNOWN_ACTION, (KeyValuePermission) permission);
            LOGGER.debug("Should not execute subject.isPermitted with KeyValuePermission. Instead create a KeyValueCollectionPermission with an action.");
        }
        if (permission != null && permission instanceof KeyValueCollectionPermission) {
            KeyValueCollectionPermission kvcp = (KeyValueCollectionPermission) permission;
            List<KeyValuePermission> keyValuePermissions = kvcp.getKeyValuePermissionList();
            List<KeyValuePermission> matchOnePermissions = new ArrayList<>();
            List<KeyValuePermission> matchAllPermissions = new ArrayList<>();
            List<KeyValuePermission> matchAllPreXacmlPermissions = new ArrayList<>();
            for (KeyValuePermission keyValuePermission : keyValuePermissions) {
                String metacardKey = keyValuePermission.getKey();
                // user specified this key in the match all list - remap key
                if (matchAllMap.containsKey(metacardKey)) {
                    KeyValuePermission kvp = new KeyValuePermission(matchAllMap.get(metacardKey), keyValuePermission.getValues());
                    matchAllPermissions.add(kvp);
                // user specified this key in the match one list - remap key
                } else if (matchOneMap.containsKey(metacardKey)) {
                    KeyValuePermission kvp = new KeyValuePermission(matchOneMap.get(metacardKey), keyValuePermission.getValues());
                    matchOnePermissions.add(kvp);
                // this key was not specified in either - default to match all with the
                // same key value
                } else {
                    //creating a KeyValuePermission list to try to quick match all of these permissions
                    //if that fails, then XACML will try to match them
                    //this covers the case where attributes on the user match up perfectly with the permissions being implied
                    //this also allows the xacml permissions to run through the policy extensions
                    matchAllPreXacmlPermissions.add(keyValuePermission);
                }
            }
            CollectionPermission subjectAllCollection = new CollectionPermission(CollectionPermission.UNKNOWN_ACTION, perms);
            KeyValueCollectionPermission matchAllCollection = new KeyValueCollectionPermission(kvcp.getAction(), matchAllPermissions);
            KeyValueCollectionPermission matchAllPreXacmlCollection = new KeyValueCollectionPermission(kvcp.getAction(), matchAllPreXacmlPermissions);
            KeyValueCollectionPermission matchOneCollection = new KeyValueCollectionPermission(kvcp.getAction(), matchOnePermissions);
            matchAllCollection = isPermittedByExtensionAll(subjectAllCollection, matchAllCollection);
            matchAllPreXacmlCollection = isPermittedByExtensionAll(subjectAllCollection, matchAllPreXacmlCollection);
            matchOneCollection = isPermittedByExtensionOne(subjectAllCollection, matchOneCollection);
            MatchOneCollectionPermission subjectOneCollection = new MatchOneCollectionPermission(perms);
            boolean matchAll = subjectAllCollection.implies(matchAllCollection);
            boolean matchAllXacml = subjectAllCollection.implies(matchAllPreXacmlCollection);
            boolean matchOne = subjectOneCollection.implies(matchOneCollection);
            if (!matchAll || !matchOne) {
                SecurityLogger.audit(PERMISSION_FINISH_1_MSG + curUser + PERMISSION_FINISH_2_MSG + permission + "] is not implied.");
            }
            //if we weren't able to automatically imply these permissions, call out to XACML
            if (!matchAllXacml) {
                KeyValueCollectionPermission xacmlPermissions = new KeyValueCollectionPermission(kvcp.getAction(), matchAllPreXacmlPermissions);
                matchAllXacml = xacmlPdp.isPermitted(curUser, authorizationInfo, xacmlPermissions);
                if (!matchAllXacml) {
                    SecurityLogger.audit(PERMISSION_FINISH_1_MSG + curUser + PERMISSION_FINISH_2_MSG + permission + "] is not implied via XACML.");
                }
            }
            return matchAll && matchOne && matchAllXacml;
        }
        for (Permission perm : perms) {
            if (permission != null && perm.implies(permission)) {
                return true;
            }
        }
    }
    SecurityLogger.audit(PERMISSION_FINISH_1_MSG + curUser + PERMISSION_FINISH_2_MSG + permission + "] is not implied.");
    return false;
}

Example 14 with KeyValueCollectionPermission

use of ddf.security.permission.KeyValueCollectionPermission in project ddf by codice.

the class AuthzRealm method isPermittedByExtensionOne.

private KeyValueCollectionPermission isPermittedByExtensionOne(CollectionPermission subjectAllCollection, KeyValueCollectionPermission matchOneCollection) {
    if (!CollectionUtils.isEmpty(policyExtensions)) {
        KeyValueCollectionPermission resultCollection = new KeyValueCollectionPermission();
        resultCollection.addAll(matchOneCollection.getPermissionList());
        resultCollection.setAction(matchOneCollection.getAction());
        for (PolicyExtension policyExtension : policyExtensions) {
            try {
                resultCollection = policyExtension.isPermittedMatchOne(subjectAllCollection, resultCollection);
            } catch (Exception e) {
                SecurityLogger.auditWarn("Policy Extension plugin did not complete correctly. This could allow access to a resource.", e);
                LOGGER.warn("Policy Extension plugin did not complete correctly. This could allow access to a resource.", e);
            }
        }
        return resultCollection;
    }
    return matchOneCollection;
}

Example 15 with KeyValueCollectionPermission

use of ddf.security.permission.KeyValueCollectionPermission in project ddf by codice.

the class XacmlPdp method createXACMLRequest.

protected RequestType createXACMLRequest(String subject, AuthorizationInfo info, CollectionPermission permission) {
    LOGGER.debug("Creating XACML request for subject: {} and metacard permissions {}", subject, permission);
    RequestType xacmlRequestType = new RequestType();
    xacmlRequestType.setCombinedDecision(false);
    xacmlRequestType.setReturnPolicyIdList(false);
    // Adding filter action
    AttributesType actionAttributes = new AttributesType();
    actionAttributes.setCategory(XACMLConstants.ACTION_CATEGORY);
    AttributeType actionAttribute = new AttributeType();
    actionAttribute.setAttributeId(XACMLConstants.ACTION_ID);
    actionAttribute.setIncludeInResult(false);
    AttributeValueType actionValue = new AttributeValueType();
    actionValue.setDataType(XACMLConstants.STRING_DATA_TYPE);
    LOGGER.trace("Adding action: {} for subject: {}", XACMLConstants.FILTER_ACTION, subject);
    actionValue.getContent().add(permission.getAction());
    actionAttribute.getAttributeValue().add(actionValue);
    actionAttributes.getAttribute().add(actionAttribute);
    xacmlRequestType.getAttributes().add(actionAttributes);
    // Adding permissions for the calling subject
    AttributesType subjectAttributes = createSubjectAttributes(subject, info);
    xacmlRequestType.getAttributes().add(subjectAttributes);
    // Adding permissions for the resource
    AttributesType metadataAttributes = new AttributesType();
    metadataAttributes.setCategory(XACMLConstants.RESOURCE_CATEGORY);
    AttributesType environmentAttributesType = new AttributesType();
    environmentAttributesType.setCategory(XACMLConstants.ENVIRONMENT_CATEGORY);
    if (!CollectionUtils.isEmpty(environmentAttributes)) {
        for (String envAttr : environmentAttributes) {
            String[] attr = envAttr.split("=");
            if (attr.length == 2) {
                AttributeType attributeType = new AttributeType();
                attributeType.setAttributeId(attr[0].trim());
                String[] attrVals = attr[1].split(",");
                for (String attrVal : attrVals) {
                    AttributeValueType attributeValueType = new AttributeValueType();
                    attributeValueType.setDataType(XACMLConstants.STRING_DATA_TYPE);
                    attributeValueType.getContent().add(attrVal.trim());
                    attributeType.getAttributeValue().add(attributeValueType);
                }
                environmentAttributesType.getAttribute().add(attributeType);
            }
        }
    }
    if (permission instanceof KeyValueCollectionPermission) {
        List<KeyValuePermission> tmpList = ((KeyValueCollectionPermission) permission).getKeyValuePermissionList();
        for (KeyValuePermission curPermission : tmpList) {
            AttributeType resourceAttribute = new AttributeType();
            resourceAttribute.setAttributeId(curPermission.getKey());
            resourceAttribute.setIncludeInResult(false);
            if (curPermission.getValues().size() > 0) {
                for (String curPermValue : curPermission.getValues()) {
                    AttributeValueType resourceAttributeValue = new AttributeValueType();
                    resourceAttributeValue.setDataType(getXacmlDataType(curPermValue));
                    LOGGER.trace("Adding permission: {}:{} for incoming resource", new Object[] { curPermission.getKey(), curPermValue });
                    resourceAttributeValue.getContent().add(curPermValue);
                    resourceAttribute.getAttributeValue().add(resourceAttributeValue);
                }
                metadataAttributes.getAttribute().add(resourceAttribute);
            }
        }
        xacmlRequestType.getAttributes().add(metadataAttributes);
        if (!CollectionUtils.isEmpty(environmentAttributes)) {
            xacmlRequestType.getAttributes().add(environmentAttributesType);
        }
    } else {
        LOGGER.warn("Permission on the resource need to be of type KeyValueCollectionPermission, cannot process this resource.");
    }
    return xacmlRequestType;
}