Examples with KeyValuePermission ddf.security.permission.KeyValuePermission used on opensource projects

Example 16 with KeyValuePermission

use of ddf.security.permission.KeyValuePermission in project ddf by codice.

the class AuthzRealmTest method testIsPermittedAllSingle.

@Test
public void testIsPermittedAllSingle() {
    permissionList.clear();
    KeyValuePermission kvp = new KeyValuePermission("rule", Arrays.asList("A", "B"));
    permissionList.add(kvp);
    boolean[] permittedArray = testRealm.isPermitted(mockSubjectPrincipal, permissionList);
    for (boolean permitted : permittedArray) {
        Assert.assertEquals(true, permitted);
    }
}

Example 17 with KeyValuePermission

use of ddf.security.permission.KeyValuePermission in project ddf by codice.

the class AuthzRealmTest method testIsPermittedOneMultiple.

@Test
public void testIsPermittedOneMultiple() throws PdpException {
    permissionList.clear();
    KeyValuePermission kvp = new KeyValuePermission("country", Arrays.asList("AUS", "CAN", "GBR"));
    permissionList.add(kvp);
    String ruleClaim = "FineAccessControls";
    String countryClaim = "CountryOfAffiliation";
    // create a new user here with multiple country permissions to test
    List<Permission> permissions = new ArrayList<Permission>();
    KeyValuePermission rulePermission = new KeyValuePermission(ruleClaim);
    rulePermission.addValue("A");
    rulePermission.addValue("B");
    permissions.add(rulePermission);
    KeyValuePermission countryPermission = new KeyValuePermission(countryClaim);
    countryPermission.addValue("USA");
    countryPermission.addValue("AUS");
    permissions.add(countryPermission);
    SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
    authorizationInfo.addObjectPermission(rulePermission);
    authorizationInfo.addObjectPermission(countryPermission);
    authorizationInfo.addRole("admin");
    AuthzRealm testRealm = new AuthzRealm("src/test/resources/policies", new XmlParser()) {

        @Override
        public AuthorizationInfo getAuthorizationInfo(PrincipalCollection principals) {
            return authorizationInfo;
        }
    };
    testRealm.setMatchOneMappings(Arrays.asList("CountryOfAffiliation=country"));
    testRealm.setMatchAllMappings(Arrays.asList("FineAccessControls=rule"));
    testRealm.setRolePermissionResolver(roleString -> Arrays.asList(new KeyValuePermission("role", Arrays.asList(roleString))));
    boolean[] permittedArray = testRealm.isPermitted(mockSubjectPrincipal, permissionList);
    for (boolean permitted : permittedArray) {
        Assert.assertEquals(true, permitted);
    }
}

Example 18 with KeyValuePermission

use of ddf.security.permission.KeyValuePermission in project ddf by codice.

the class AdminConfigPolicy method isPermittedMatchOne.

@Override
public KeyValueCollectionPermission isPermittedMatchOne(CollectionPermission subjectAllCollection, KeyValueCollectionPermission matchOneCollection) {
    if (matchOneCollection.getAction() == null || (!matchOneCollection.getAction().equals(VIEW_FEATURE_ACTION) && !matchOneCollection.getAction().equals(VIEW_SERVICE_ACTION))) {
        return matchOneCollection;
    }
    List<Permission> newMatchOneCollectionPermissions = new ArrayList<>(matchOneCollection.getPermissionList());
    for (Permission permission : matchOneCollection.getPermissionList()) {
        if (!(permission instanceof KeyValuePermission)) {
            continue;
        }
        String matchPermissionName = ((KeyValuePermission) permission).getKey();
        Map<String, List<KeyValueCollectionPermission>> policyPermissions;
        if (matchPermissionName.equals(FEATURE_NAME)) {
            policyPermissions = featurePolicyPermissions;
        } else if (matchPermissionName.equals(SERVICE_PID)) {
            policyPermissions = servicePolicyPermissions;
        } else {
            continue;
        }
        Set<String> valuesToMatch = new HashSet<>();
        valuesToMatch.addAll(((KeyValuePermission) permission).getValues());
        //If there are multiple features in the permission and one is not authorized, the user is not authorized to see any of the features in the group
        for (String matchPermissionValue : ((KeyValuePermission) permission).getValues()) {
            List<KeyValueCollectionPermission> matchOneAttributes = policyPermissions.get(matchPermissionValue);
            //If null, there is no configuration with this attribute in the policy, the feature or service is white listed
            if (matchOneAttributes == null) {
                valuesToMatch.remove(matchPermissionValue);
            } else {
                for (KeyValueCollectionPermission attributePermissions : matchOneAttributes) {
                    if (subjectAllCollection.implies(attributePermissions)) {
                        valuesToMatch.remove(matchPermissionValue);
                        break;
                    }
                }
            }
        }
        if (valuesToMatch.isEmpty()) {
            newMatchOneCollectionPermissions.remove(permission);
        }
    }
    return new KeyValueCollectionPermission(matchOneCollection.getAction(), newMatchOneCollectionPermissions.stream().toArray(KeyValuePermission[]::new));
}

Example 19 with KeyValuePermission

use of ddf.security.permission.KeyValuePermission in project ddf by codice.

the class AdminConfigPolicyTest method testRemoveUnknownAttribute.

@Test
public void testRemoveUnknownAttribute() {
    AdminConfigPolicy adminConfigPolicy = new AdminConfigPolicy();
    List<KeyValuePermission> matchOneServicePermissions = new ArrayList<>();
    matchOneServicePermissions.add(new KeyValuePermission(AdminConfigPolicy.SERVICE_PID, Sets.newHashSet("UNKNOWN_ATTRIBUTE_NAME")));
    KeyValueCollectionPermission requestedServicePermissions = new KeyValueCollectionPermission(AdminConfigPolicy.VIEW_SERVICE_ACTION, matchOneServicePermissions.stream().toArray(KeyValuePermission[]::new));
    assertTrue(adminConfigPolicy.isPermittedMatchAll(getSubjectPermissions(), requestedServicePermissions).isEmpty());
}

Example 20 with KeyValuePermission

use of ddf.security.permission.KeyValuePermission in project ddf by codice.

the class AdminConfigPolicyTest method testValidateAllPermissions.

@Test
public void testValidateAllPermissions() {
    AdminConfigPolicy adminConfigPolicy = new AdminConfigPolicy();
    adminConfigPolicy.setFeaturePolicies(getValidPolicyPermissions());
    adminConfigPolicy.setServicePolicies(getValidPolicyPermissions());
    KeyValueCollectionPermission requestedFeaturePermissions = new KeyValueCollectionPermission(AdminConfigPolicy.VIEW_FEATURE_ACTION, getMatchOnePermissions(AdminConfigPolicy.FEATURE_NAME).stream().toArray(KeyValuePermission[]::new));
    KeyValueCollectionPermission requestedServicePermissions = new KeyValueCollectionPermission(AdminConfigPolicy.VIEW_SERVICE_ACTION, getMatchOnePermissions(AdminConfigPolicy.SERVICE_PID).stream().toArray(KeyValuePermission[]::new));
    assertTrue(adminConfigPolicy.isPermittedMatchOne(getSubjectPermissions(), requestedFeaturePermissions).isEmpty());
    assertTrue(adminConfigPolicy.isPermittedMatchOne(getSubjectPermissions(), requestedServicePermissions).isEmpty());
}