JPolicy.java

package org.objectweb.jonas_lib.security.jacc;

import java.security.CodeSource;
import java.security.Permission;
import java.security.PermissionCollection;
import java.security.Policy;
import java.security.Principal;
import java.security.ProtectionDomain;
import java.security.SecurityPermission;

import javax.security.jacc.EJBMethodPermission;
import javax.security.jacc.EJBRoleRefPermission;
import javax.security.jacc.PolicyConfiguration;
import javax.security.jacc.PolicyConfigurationFactory;
import javax.security.jacc.PolicyContext;
import javax.security.jacc.PolicyContextException;
import javax.security.jacc.WebResourcePermission;
import javax.security.jacc.WebRoleRefPermission;
import javax.security.jacc.WebUserDataPermission;

import org.objectweb.common.TraceCore;

import org.objectweb.jonas_lib.I18n;

import org.objectweb.util.monolog.api.BasicLevel;
import org.objectweb.util.monolog.api.Logger;

public class JPolicy extends Policy {

    private static Logger logger = null;

    private static JPolicy unique = null;

    private static Policy initialPolicy = null;

    private static I18n i18n = I18n.getInstance(JPolicy.class);

    private static PolicyConfigurationFactory policyConfigurationFactory = null;


    public JPolicy() {
        // Retrieve existing policy
        initialPolicy = Policy.getPolicy();

        // init logger
        logger = TraceCore.sec;
    }

    private void initPolicyConfigurationFactory() throws JPolicyException {
        // Check that factory is the JOnAS policy configuration factory
        try {
            policyConfigurationFactory = PolicyConfigurationFactory.getPolicyConfigurationFactory();
        } catch (ClassNotFoundException cnfe) {
            throw new JPolicyException("PolicyConfigurationFactory class implementation was not found : '" + cnfe.getMessage() + "'.");
        } catch (PolicyContextException pce) {
            throw new JPolicyException("PolicyContextException in PolicyConfigurationFactory : '" + pce.getMessage() + "'.");
        }

    }


    public static JPolicy getInstance() {
        if (unique == null) {
            unique = new JPolicy();
        }
        return unique;
    }



    // Section 4.8
    // J2EE 1.4 container can call Policy.implies or Policy.getPermissions
    // with an argument ProtectionDomain that was constructed with the
    // principals of the caller.
    // Then the caller must call implies method on the returned PermissionCollection


    public boolean implies(ProtectionDomain domain, Permission permission) {
        String contextID = PolicyContext.getContextID();

        // Delegating model
        if (contextID == null) {
            return initialPolicy.implies(domain, permission);
        }

        // See 2.5 of JACC. A replacement Policy object may accomplish this
        // by delegating non-javax.security.jacc policy decisions to the
        // corresponding default system Policy implementation class.
        //TODO : change to not instanceof EJB and Web permissions (JACC permissions)
        if (permission instanceof SecurityPermission) {
            return initialPolicy.implies(domain, permission);
        }

        if (!(permission instanceof EJBMethodPermission || permission instanceof EJBRoleRefPermission
              || permission instanceof WebUserDataPermission || permission instanceof WebRoleRefPermission
              || permission instanceof WebResourcePermission)) {
            return initialPolicy.implies(domain, permission);
        }

        if (logger.isLoggable(BasicLevel.DEBUG)) {
            logger.log(BasicLevel.DEBUG, "!= null, Permission being checked = " + permission);
        }

        // configuration was committed ?
        try {
            if (policyConfigurationFactory == null) {
                initPolicyConfigurationFactory();
            }

            if (!policyConfigurationFactory.inService(contextID)) {
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Not in service, return false");
                }
                return false;
            }
        } catch (JPolicyException jpe) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, i18n.getMessage("JPolicy.implies.canNotCheck", jpe.getMessage()));
            }
            return false;
        } catch (PolicyContextException pce) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, i18n.getMessage("JPolicy.implies.canNotCheck", pce.getMessage()));
            }
            return false;
        }

        JPolicyConfiguration jPolicyConfiguration = null;
        try {
            PolicyConfiguration pc = policyConfigurationFactory.getPolicyConfiguration(contextID, false);
            if (pc instanceof JPolicyConfiguration) {
                jPolicyConfiguration = (JPolicyConfiguration) pc;
            } else {
                //Maybe it's a delegating policy configuration and we have a configuration for this object
                jPolicyConfiguration = JPolicyConfigurationKeeper.getConfiguration(contextID);
                if (jPolicyConfiguration == null) {
                    throw new RuntimeException("This policy provider can only manage JPolicyConfiguration objects");
                }
            }
        } catch (PolicyContextException pce) {
            if (logger.isLoggable(BasicLevel.ERROR)) {
                logger.log(BasicLevel.ERROR, i18n.getMessage("JPolicy.implies.canNotRetrieve", contextID, pce.getMessage()));
            }
            return false;
        }

        /* JACC 3.2
           The provider must ensure that excluded policy statements take precedence
           over overlapping unchecked policy statements, and that both excluded and
           unchecked policy statements take precedence over overlapping role based policy
           statements.
        */
        PermissionCollection excludedPermissions = jPolicyConfiguration.getExcludedPermissions();
        PermissionCollection uncheckedPermissions = jPolicyConfiguration.getUncheckedPermissions();

        logger.log(BasicLevel.DEBUG, "Check permission");
        logger.log(BasicLevel.DEBUG, "Excluded permissions = " + excludedPermissions);
        logger.log(BasicLevel.DEBUG, "unchecked permissions = " + uncheckedPermissions);

        // excluded ?
        if (excludedPermissions.implies(permission)) {
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Permission '" + permission + "' is excluded, return false");
            }
            return false;
        } else if (uncheckedPermissions.implies(permission)) { // unchecked
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Permission '" + permission + "' is unchecked, return true");
            }
            return true;
        } else {
            // per role if any or false
            if (domain.getPrincipals().length > 0) {
                logger.log(BasicLevel.DEBUG, "There are principals, checking principals...");
                // check roles
                return isImpliedPermissionForPrincipals(jPolicyConfiguration, permission, domain.getPrincipals());
            } else {
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Principals length = 0, there is no principal on this domain");
                }
                // permission not found
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Permission '" + permission + "' not found, return false");
                }
                return false;
            }
        }
    }


    public PermissionCollection getPermissions(ProtectionDomain domain) {

         // Always use delegating model
        return initialPolicy.getPermissions(domain);

        //TODO : retrieve all permissions for a given ProtectionDomain
        //JPolicyConfiguration jPolicyConfiguration = policyConfigurationFactory.getPolicyConfiguration(contextID);
        //return jPolicyConfiguration.getPermissionsForDomain(domain);
        //         String contextID = PolicyContext.getContextID();
        //         // Delegating model
        //         if (contextID == null) {
        //             return initialPolicy.getPermissions(domain);
        //         } else {
        //             // not implemented as not recommended in section 4.8
        //             throw new UnsupportedOperationException("Method getPermissions with a given protection domain is not supported");
        //         }

    }


    public PermissionCollection getPermissions(CodeSource codeSource) {

        // Always use delegating model
        return initialPolicy.getPermissions(codeSource);

        //TODO : retrieve all permissions for a given codesource
        //         String contextID = PolicyContext.getContextID();
        //         if (contextID == null) {
        //             return initialPolicy.getPermissions(codeSource);
        //         } else {
        //             // not implemented
        //             throw new UnsupportedOperationException("Method getPermissions with a given codeSource is not implemented");
        //         }
    }


    public void refresh() {
        initialPolicy.refresh();
    }



    private boolean isImpliedPermissionForPrincipals(JPolicyConfiguration jPolicyConfiguration, Permission permission, Principal[] principals) {
        //if (logger.isLoggable(BasicLevel.DEBUG)) {
        //    logger.log(BasicLevel.DEBUG, "");
        //}
        PermissionCollection permissions = null;
        int i = 0;
        boolean implied = false;
        // for each principal's permissions check if the given permission is implied
        while (i < principals.length && !implied) {
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Checking permission '" + permission + "' with permissions of Principal '" + principals[i].getName() + "'.");
            }
            permissions = jPolicyConfiguration.getPermissionsForPrincipal(principals[i]);

            if (permissions.implies(permission)) {
                if (logger.isLoggable(BasicLevel.DEBUG)) {
                    logger.log(BasicLevel.DEBUG, "Permission implied with principal '" + principals[i].getName() + "'.");
                }
                implied = true;
            }
            i++;
        }
        if (logger.isLoggable(BasicLevel.DEBUG)) {
            if (!implied) {
                logger.log(BasicLevel.DEBUG, "Permission '" + permission + "' was not found in each permissions of the given roles, return false");
            }
        }
        return implied;
    }

}

---