use of org.jboss.metadata.web.jboss.JBossServletsMetaData in project wildfly by wildfly.
the class WarJACCService method createPermissions.
/** {@inheritDoc} */
@Override
public void createPermissions(WarMetaData metaData, PolicyConfiguration pc) throws PolicyContextException {
JBossWebMetaData jbossWebMetaData = metaData.getMergedJBossWebMetaData();
HashMap<String, PatternInfo> patternMap = qualifyURLPatterns(jbossWebMetaData);
List<SecurityConstraintMetaData> secConstraints = jbossWebMetaData.getSecurityConstraints();
if (secConstraints != null) {
for (SecurityConstraintMetaData secConstraint : secConstraints) {
WebResourceCollectionsMetaData resourceCollectionsMetaData = secConstraint.getResourceCollections();
UserDataConstraintMetaData userDataConstraintMetaData = secConstraint.getUserDataConstraint();
if (resourceCollectionsMetaData != null) {
if (secConstraint.isExcluded() || secConstraint.isUnchecked()) {
// Process the permissions for the excluded/unchecked resources
for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
List<String> httpMethods = new ArrayList<>(resourceCollectionMetaData.getHttpMethods());
List<String> ommisions = resourceCollectionMetaData.getHttpMethodOmissions();
if (httpMethods.isEmpty() && !ommisions.isEmpty()) {
httpMethods.addAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
httpMethods.removeAll(ommisions);
}
List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
for (String urlPattern : urlPatterns) {
PatternInfo info = patternMap.get(urlPattern);
info.descriptor = true;
// Add the excluded methods
if (secConstraint.isExcluded()) {
info.addExcludedMethods(httpMethods);
}
// SECURITY-63: Missing auth-constraint needs unchecked policy
if (secConstraint.isUnchecked() && httpMethods.isEmpty()) {
info.isMissingAuthConstraint = true;
} else {
info.missingAuthConstraintMethods.addAll(httpMethods);
}
}
}
} else {
// Process the permission for the resources x roles
for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
List<String> httpMethods = new ArrayList<>(resourceCollectionMetaData.getHttpMethods());
List<String> methodOmissions = resourceCollectionMetaData.getHttpMethodOmissions();
if (httpMethods.isEmpty() && !methodOmissions.isEmpty()) {
httpMethods.addAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
httpMethods.removeAll(methodOmissions);
}
List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
for (String urlPattern : urlPatterns) {
// Get the qualified url pattern
PatternInfo info = patternMap.get(urlPattern);
info.descriptor = true;
HashSet<String> mappedRoles = new HashSet<String>();
secConstraint.getAuthConstraint().getRoleNames();
List<String> authRoles = secConstraint.getAuthConstraint().getRoleNames();
for (String role : authRoles) {
if ("*".equals(role)) {
// The wildcard ref maps to all declared security-role names
mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
} else {
mappedRoles.add(role);
}
}
info.addRoles(mappedRoles, httpMethods);
// Add the transport to methods
if (userDataConstraintMetaData != null && userDataConstraintMetaData.getTransportGuarantee() != null)
info.addTransport(userDataConstraintMetaData.getTransportGuarantee().name(), httpMethods);
}
}
}
}
}
}
JBossServletsMetaData servlets = jbossWebMetaData.getServlets();
List<ServletMappingMetaData> mappings = jbossWebMetaData.getServletMappings();
if (servlets != null && mappings != null) {
Map<String, List<String>> servletMappingMap = new HashMap<>();
for (ServletMappingMetaData mapping : mappings) {
List<String> list = servletMappingMap.get(mapping.getServletName());
if (list == null) {
servletMappingMap.put(mapping.getServletName(), list = new ArrayList<>());
}
list.addAll(mapping.getUrlPatterns());
}
if (!jbossWebMetaData.isMetadataComplete()) {
for (JBossServletMetaData servlet : servlets) {
ServletSecurityMetaData security = servlet.getServletSecurity();
if (security != null) {
List<String> servletMappings = servletMappingMap.get(servlet.getServletName());
if (servletMappings != null) {
if (security.getHttpMethodConstraints() != null) {
for (HttpMethodConstraintMetaData s : security.getHttpMethodConstraints()) {
if (s.getRolesAllowed() == null || s.getRolesAllowed().isEmpty()) {
for (String urlPattern : servletMappings) {
// Get the qualified url pattern
PatternInfo info = patternMap.get(urlPattern);
if (info.descriptor) {
continue;
}
// Add the excluded methods
if (s.getEmptyRoleSemantic() == null || s.getEmptyRoleSemantic() == EmptyRoleSemanticType.PERMIT) {
info.missingAuthConstraintMethods.add(s.getMethod());
} else {
info.addExcludedMethods(Collections.singletonList(s.getMethod()));
}
// Add the transport to methods
if (s.getTransportGuarantee() != null)
info.addTransport(s.getTransportGuarantee().name(), Collections.singletonList(s.getMethod()));
}
} else {
for (String urlPattern : servletMappings) {
// Get the qualified url pattern
PatternInfo info = patternMap.get(urlPattern);
if (info.descriptor) {
continue;
}
HashSet<String> mappedRoles = new HashSet<String>();
List<String> authRoles = s.getRolesAllowed();
for (String role : authRoles) {
if ("*".equals(role)) {
// The wildcard ref maps to all declared security-role names
mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
} else {
mappedRoles.add(role);
}
}
info.addRoles(mappedRoles, Collections.singletonList(s.getMethod()));
// Add the transport to methods
if (s.getTransportGuarantee() != null)
info.addTransport(s.getTransportGuarantee().name(), Collections.singletonList(s.getMethod()));
}
}
}
}
if (security.getRolesAllowed() == null || security.getRolesAllowed().isEmpty()) {
for (String urlPattern : servletMappings) {
// Get the qualified url pattern
PatternInfo info = patternMap.get(urlPattern);
if (info.descriptor) {
continue;
}
// Add the excluded methods
if (security.getEmptyRoleSemantic() == null || security.getEmptyRoleSemantic() == EmptyRoleSemanticType.PERMIT) {
info.isMissingAuthConstraint = true;
} else {
Set<String> methods = new HashSet<>(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
if (security.getHttpMethodConstraints() != null) {
for (HttpMethodConstraintMetaData method : security.getHttpMethodConstraints()) {
methods.remove(method.getMethod());
}
}
info.addExcludedMethods(new ArrayList<>(methods));
}
// Add the transport to methods
if (security.getTransportGuarantee() != null)
info.addTransport(security.getTransportGuarantee().name(), Collections.emptyList());
}
} else {
for (String urlPattern : servletMappings) {
// Get the qualified url pattern
PatternInfo info = patternMap.get(urlPattern);
if (info.descriptor) {
continue;
}
HashSet<String> mappedRoles = new HashSet<String>();
List<String> authRoles = security.getRolesAllowed();
for (String role : authRoles) {
if ("*".equals(role)) {
// The wildcard ref maps to all declared security-role names
mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
} else {
mappedRoles.add(role);
}
}
info.addRoles(mappedRoles, Collections.emptyList());
// Add the transport to methods
if (security.getTransportGuarantee() != null)
info.addTransport(security.getTransportGuarantee().name(), Collections.emptyList());
}
}
}
}
}
}
}
// Create the permissions
for (PatternInfo info : patternMap.values()) {
String qurl = info.getQualifiedPattern();
if (info.isOverridden) {
continue;
}
// Create the excluded permissions
String[] httpMethods = info.getExcludedMethods();
if (httpMethods != null) {
// There were excluded security-constraints
WebResourcePermission wrp = new WebResourcePermission(qurl, httpMethods);
WebUserDataPermission wudp = new WebUserDataPermission(qurl, httpMethods, null);
pc.addToExcludedPolicy(wrp);
pc.addToExcludedPolicy(wudp);
}
// Create the role permissions
Iterator<Map.Entry<String, Set<String>>> roles = info.getRoleMethods();
Set<String> seenMethods = new HashSet<>();
while (roles.hasNext()) {
Map.Entry<String, Set<String>> roleMethods = roles.next();
String role = roleMethods.getKey();
Set<String> methods = roleMethods.getValue();
seenMethods.addAll(methods);
httpMethods = methods.toArray(new String[methods.size()]);
pc.addToRole(role, new WebResourcePermission(qurl, httpMethods));
}
//there are totally 7 http methods from the jacc spec (See WebResourceCollectionMetaData.ALL_HTTP_METHOD_NAMES)
final int NUMBER_OF_HTTP_METHODS = 7;
// JACC 1.1: create !(httpmethods) in unchecked perms
if (jbossWebMetaData.getDenyUncoveredHttpMethods() == null) {
if (seenMethods.size() != NUMBER_OF_HTTP_METHODS) {
WebResourcePermission wrpUnchecked = new WebResourcePermission(qurl, "!" + getCommaSeparatedString(seenMethods.toArray(new String[seenMethods.size()])));
pc.addToUncheckedPolicy(wrpUnchecked);
}
}
if (jbossWebMetaData.getDenyUncoveredHttpMethods() == null) {
// Create the unchecked permissions
String[] missingHttpMethods = info.getMissingMethods();
int length = missingHttpMethods.length;
roles = info.getRoleMethods();
if (length > 0 && !roles.hasNext()) {
// Create the unchecked permissions WebResourcePermissions
WebResourcePermission wrp = new WebResourcePermission(qurl, missingHttpMethods);
pc.addToUncheckedPolicy(wrp);
} else if (!roles.hasNext()) {
pc.addToUncheckedPolicy(new WebResourcePermission(qurl, (String) null));
}
// SECURITY-63: Missing auth-constraint needs unchecked policy
if (info.isMissingAuthConstraint) {
pc.addToUncheckedPolicy(new WebResourcePermission(qurl, (String) null));
} else if (!info.allMethods.containsAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS)) {
List<String> methods = new ArrayList<>(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
methods.removeAll(info.allMethods);
pc.addToUncheckedPolicy(new WebResourcePermission(qurl, methods.toArray(new String[methods.size()])));
}
if (!info.missingAuthConstraintMethods.isEmpty()) {
pc.addToUncheckedPolicy(new WebResourcePermission(qurl, info.missingAuthConstraintMethods.toArray(new String[info.missingAuthConstraintMethods.size()])));
}
}
// Create the unchecked permissions WebUserDataPermissions
Iterator<Map.Entry<String, Set<String>>> transportConstraints = info.getTransportMethods();
while (transportConstraints.hasNext()) {
Map.Entry<String, Set<String>> transportMethods = transportConstraints.next();
String transport = transportMethods.getKey();
Set<String> methods = transportMethods.getValue();
httpMethods = new String[methods.size()];
methods.toArray(httpMethods);
WebUserDataPermission wudp = new WebUserDataPermission(qurl, httpMethods, transport);
pc.addToUncheckedPolicy(wudp);
// with the url pattern and null
if ("NONE".equals(transport)) {
WebUserDataPermission wudp1 = new WebUserDataPermission(qurl, null);
pc.addToUncheckedPolicy(wudp1);
} else {
// JACC 1.1: Transport is CONFIDENTIAL/INTEGRAL, add a !(http methods)
WebUserDataPermission wudpNonNull = new WebUserDataPermission(qurl, "!" + getCommaSeparatedString(httpMethods));
pc.addToUncheckedPolicy(wudpNonNull);
}
}
}
Set<String> declaredRoles = jbossWebMetaData.getSecurityRoleNames();
declaredRoles.add(ANY_AUTHENTICATED_USER_ROLE);
/*
* Create WebRoleRefPermissions for all servlet/security-role-refs along with all the cross product of servlets and
* security-role elements that are not referenced via a security-role-ref as described in JACC section 3.1.3.2
*/
JBossServletsMetaData servletsMetaData = jbossWebMetaData.getServlets();
for (JBossServletMetaData servletMetaData : servletsMetaData) {
Set<String> unrefRoles = new HashSet<String>(declaredRoles);
String servletName = servletMetaData.getName();
SecurityRoleRefsMetaData roleRefsMetaData = servletMetaData.getSecurityRoleRefs();
// Perform the unreferenced roles processing for every servlet name
if (roleRefsMetaData != null) {
for (SecurityRoleRefMetaData roleRefMetaData : roleRefsMetaData) {
String roleRef = roleRefMetaData.getRoleLink();
String roleName = roleRefMetaData.getRoleName();
WebRoleRefPermission wrrp = new WebRoleRefPermission(servletName, roleName);
pc.addToRole(roleRef, wrrp);
// Remove the role from the unreferencedRoles
unrefRoles.remove(roleName);
}
}
// in a security-role-ref within the servlet element.
for (String unrefRole : unrefRoles) {
WebRoleRefPermission unrefP = new WebRoleRefPermission(servletName, unrefRole);
pc.addToRole(unrefRole, unrefP);
}
}
// such permission must be the role-name of the corresponding role.
for (String role : declaredRoles) {
WebRoleRefPermission wrrep = new WebRoleRefPermission("", role);
pc.addToRole(role, wrrep);
}
}
use of org.jboss.metadata.web.jboss.JBossServletsMetaData in project wildfly by wildfly.
the class AbstractMetaDataBuilderPOJO method getServletClassMappings.
/**
* Returns servlet name to servlet class mappings.
*
* @param jbossWebMD jboss web meta data
* @return servlet name to servlet mappings
*/
private Map<String, String> getServletClassMappings(final JBossWebMetaData jbossWebMD, final List<POJOEndpoint> pojoEndpoints) {
final Map<String, String> mappings = new HashMap<String, String>();
final JBossServletsMetaData servlets = WebMetaDataHelper.getServlets(jbossWebMD);
for (final POJOEndpoint pojoEndpoint : pojoEndpoints) {
final String pojoName = pojoEndpoint.getName();
final String pojoClassName = pojoEndpoint.getClassName();
mappings.put(pojoName, pojoClassName);
if (!pojoEndpoint.isDeclared()) {
final String endpointName = pojoEndpoint.getName();
final String endpointClassName = pojoEndpoint.getClassName();
WebMetaDataHelper.newServlet(endpointName, endpointClassName, servlets);
}
}
return mappings;
}
use of org.jboss.metadata.web.jboss.JBossServletsMetaData in project wildfly by wildfly.
the class WebMetaDataHelper method getServlets.
/**
* Gets servlets meta data from jboss web meta data. If not found it creates new servlets meta data and associates them
* with jboss web meta data.
*
* @param jbossWebMD jboss web meta data
* @return servlets meta data
*/
public static JBossServletsMetaData getServlets(final JBossWebMetaData jbossWebMD) {
JBossServletsMetaData servletsMD = jbossWebMD.getServlets();
if (servletsMD == null) {
servletsMD = new JBossServletsMetaData();
jbossWebMD.setServlets(servletsMD);
}
return servletsMD;
}
use of org.jboss.metadata.web.jboss.JBossServletsMetaData in project wildfly by wildfly.
the class WarJACCService method qualifyURLPatterns.
/**
* JACC url pattern Qualified URL Pattern Names.
*
* The rules for qualifying a URL pattern are dependent on the rules for determining if one URL pattern matches another as
* defined in Section 3.1.3.3, Servlet URL-Pattern Matching Rules, and are described as follows: - If the pattern is a path
* prefix pattern, it must be qualified by every path-prefix pattern in the deployment descriptor matched by and different
* from the pattern being qualified. The pattern must also be qualified by every exact pattern appearing in the deployment
* descriptor that is matched by the pattern being qualified. - If the pattern is an extension pattern, it must be qualified
* by every path-prefix pattern appearing in the deployment descriptor and every exact pattern in the deployment descriptor
* that is matched by the pattern being qualified. - If the pattern is the default pattern, "/", it must be qualified by
* every other pattern except the default pattern appearing in the deployment descriptor. - If the pattern is an exact
* pattern, its qualified form must not contain any qualifying patterns.
*
* URL patterns are qualified by appending to their String representation, a colon separated representation of the list of
* patterns that qualify the pattern. Duplicates must not be included in the list of qualifying patterns, and any qualifying
* pattern matched by another qualifying pattern may5 be dropped from the list.
*
* Any pattern, qualified by a pattern that matches it, is overridden and made irrelevant (in the translation) by the
* qualifying pattern. Specifically, all extension patterns and the default pattern are made irrelevant by the presence of
* the path prefix pattern "/*" in a deployment descriptor. Patterns qualified by the "/*" pattern violate the
* URLPatternSpec constraints of WebResourcePermission and WebUserDataPermission names and must be rejected by the
* corresponding permission constructors.
*
* @param metaData - the web deployment metadata
* @return HashMap<String, PatternInfo>
*/
static HashMap<String, PatternInfo> qualifyURLPatterns(JBossWebMetaData metaData) {
ArrayList<PatternInfo> prefixList = new ArrayList<PatternInfo>();
ArrayList<PatternInfo> extensionList = new ArrayList<PatternInfo>();
ArrayList<PatternInfo> exactList = new ArrayList<PatternInfo>();
HashMap<String, PatternInfo> patternMap = new HashMap<String, PatternInfo>();
PatternInfo defaultInfo = null;
List<SecurityConstraintMetaData> constraints = metaData.getSecurityConstraints();
if (constraints != null) {
for (SecurityConstraintMetaData constraint : constraints) {
WebResourceCollectionsMetaData resourceCollectionsMetaData = constraint.getResourceCollections();
if (resourceCollectionsMetaData != null) {
for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
for (String url : urlPatterns) {
int type = getPatternType(url);
PatternInfo info = patternMap.get(url);
if (info == null) {
info = new PatternInfo(url, type);
patternMap.put(url, info);
switch(type) {
case PREFIX:
prefixList.add(info);
break;
case EXTENSION:
extensionList.add(info);
break;
case EXACT:
exactList.add(info);
break;
case DEFAULT:
defaultInfo = info;
break;
}
}
}
}
}
}
}
JBossServletsMetaData servlets = metaData.getServlets();
List<ServletMappingMetaData> mappings = metaData.getServletMappings();
if (!metaData.isMetadataComplete() && servlets != null && mappings != null) {
Map<String, List<String>> servletMappingMap = new HashMap<>();
for (ServletMappingMetaData mapping : mappings) {
List<String> list = servletMappingMap.get(mapping.getServletName());
if (list == null) {
servletMappingMap.put(mapping.getServletName(), list = new ArrayList<>());
}
list.addAll(mapping.getUrlPatterns());
}
for (JBossServletMetaData servlet : servlets) {
ServletSecurityMetaData security = servlet.getServletSecurity();
if (security != null) {
List<String> servletMappings = servletMappingMap.get(servlet.getServletName());
if (servletMappings != null) {
for (String url : servletMappings) {
int type = getPatternType(url);
PatternInfo info = patternMap.get(url);
if (info == null) {
info = new PatternInfo(url, type);
patternMap.put(url, info);
switch(type) {
case PREFIX:
prefixList.add(info);
break;
case EXTENSION:
extensionList.add(info);
break;
case EXACT:
exactList.add(info);
break;
case DEFAULT:
defaultInfo = info;
break;
}
}
}
}
}
}
}
// Qualify all prefix patterns
for (int i = 0; i < prefixList.size(); i++) {
PatternInfo info = prefixList.get(i);
// Qualify by every other prefix pattern matching this pattern
for (int j = 0; j < prefixList.size(); j++) {
if (i == j)
continue;
PatternInfo other = prefixList.get(j);
if (info.matches(other))
info.addQualifier(other);
}
// Qualify by every exact pattern that is matched by this pattern
for (PatternInfo other : exactList) {
if (info.matches(other))
info.addQualifier(other);
}
}
// Qualify all extension patterns
for (PatternInfo info : extensionList) {
// Qualify by every path prefix pattern
for (PatternInfo other : prefixList) {
// Any extension
info.addQualifier(other);
}
// Qualify by every matching exact pattern
for (PatternInfo other : exactList) {
if (info.isExtensionFor(other))
info.addQualifier(other);
}
}
// Qualify the default pattern
if (defaultInfo == null) {
defaultInfo = new PatternInfo("/", DEFAULT);
patternMap.put("/", defaultInfo);
}
for (PatternInfo info : patternMap.values()) {
if (info == defaultInfo)
continue;
defaultInfo.addQualifier(info);
}
return patternMap;
}
use of org.jboss.metadata.web.jboss.JBossServletsMetaData in project wildfly by wildfly.
the class WebMetaDataCreator method createServlets.
/**
* Creates servlets part of web.xml descriptor.
* <p/>
* <pre>
* <servlet>
* <servlet-name>EJBEndpointShortName</servlet-name>
* <servlet-class>EJBEndpointTargetBeanName</servlet-class>
* </servlet>
* </pre>
*
* @param dep webservice deployment
* @param jbossWebMD jboss web meta data
*/
private void createServlets(final Deployment dep, final JBossWebMetaData jbossWebMD) {
WSLogger.ROOT_LOGGER.trace("Creating servlets");
final JBossServletsMetaData servlets = WebMetaDataHelper.getServlets(jbossWebMD);
for (final Endpoint endpoint : dep.getService().getEndpoints()) {
final String endpointName = endpoint.getShortName();
final String endpointClassName = endpoint.getTargetBeanName();
WSLogger.ROOT_LOGGER.tracef("Servlet name: %s, class: %s", endpointName, endpointClassName);
WebMetaDataHelper.newServlet(endpointName, endpointClassName, servlets);
}
}
Aggregations