PermissionManager.java

package org.objectweb.jonas_ejb.container;

import java.net.URI;
import java.net.URL;
import java.security.CodeSource;
import java.security.PermissionCollection;
import java.security.Principal;
import java.security.ProtectionDomain;
import java.security.cert.Certificate;
import java.util.Iterator;

import javax.security.jacc.EJBMethodPermission;
import javax.security.jacc.EJBRoleRefPermission;
import javax.security.jacc.PolicyContext;
import javax.security.jacc.PolicyContextException;

import org.objectweb.jonas_ejb.deployment.api.BeanDesc;
import org.objectweb.jonas_ejb.deployment.api.DeploymentDesc;
import org.objectweb.jonas_ejb.deployment.api.ExcludeListDesc;
import org.objectweb.jonas_ejb.deployment.api.MethodPermissionDesc;
import org.objectweb.jonas_ejb.lib.EJBInvocation;

import org.objectweb.jonas_lib.deployment.api.SecurityRoleRefDesc;
import org.objectweb.jonas_lib.security.AbsPermissionManager;
import org.objectweb.jonas_lib.security.PermissionManagerException;

import org.objectweb.jonas.security.jacc.JPolicyContextHandlerCurrent;
import org.objectweb.jonas.security.jacc.JPolicyContextHandlerData;

import org.objectweb.security.context.SecurityContext;
import org.objectweb.security.context.SecurityCurrent;

import org.objectweb.util.monolog.api.BasicLevel;

public class PermissionManager extends AbsPermissionManager {

    private DeploymentDesc ejbDeploymentDesc = null;

    public PermissionManager(DeploymentDesc ejbDeploymentDesc, String contextId) throws PermissionManagerException {
        super(contextId);
        this.ejbDeploymentDesc = ejbDeploymentDesc;
    }

    public void translateEjbDeploymentDescriptor() throws PermissionManagerException {
        translateEjbMethodPermission();
        translateEjbExcludeList();
        translateEjbSecurityRoleRef();
    }

    protected void translateEjbMethodPermission() throws PermissionManagerException {
        if (ejbDeploymentDesc == null || getPolicyConfiguration() == null) {
            throw new PermissionManagerException("PolicyConfiguration or ejbDeploymentDesc is null");
        }

        MethodPermissionDesc methodPermissionDesc = null;
        PermissionCollection permissionCollection = null;

        for (Iterator it = ejbDeploymentDesc.getMethodPermissionsDescList().iterator(); it.hasNext();) {
            methodPermissionDesc = (MethodPermissionDesc) it.next();
            permissionCollection = methodPermissionDesc.getEJBMethodPermissions();
            try {
                // unchecked or roles
                if (methodPermissionDesc.isUnchecked()) {
                    getPolicyConfiguration().addToUncheckedPolicy(permissionCollection);
                } else {
                    for (Iterator rolesIt = methodPermissionDesc.getRoleNameList().iterator(); rolesIt.hasNext();) {
                        getPolicyConfiguration().addToRole((String) rolesIt.next(), permissionCollection);
                    }
                }
            } catch (PolicyContextException pce) {
                throw new PermissionManagerException("Can not add add excluded policy", pce);
            }
        }
    }

    protected void translateEjbExcludeList() throws PermissionManagerException {
        if (ejbDeploymentDesc == null || getPolicyConfiguration() == null) {
            throw new PermissionManagerException("PolicyConfiguration or ejbDeploymentDesc is null");
        }
        ExcludeListDesc excludeListDesc = ejbDeploymentDesc.getExcludeListDesc();
        if (excludeListDesc != null) {
            try {
                getPolicyConfiguration().addToExcludedPolicy(excludeListDesc.getEJBMethodPermissions());
            } catch (PolicyContextException pce) {
                throw new PermissionManagerException("Can not add add excluded policy", pce);
            }
        }
    }

    public void translateEjbSecurityRoleRef() throws PermissionManagerException {
        if (ejbDeploymentDesc == null || getPolicyConfiguration() == null) {
            throw new PermissionManagerException("PolicyConfiguration or ejbDeploymentDesc is null");
        }

        SecurityRoleRefDesc securityRoleRefDesc = null;
        BeanDesc beanDesc = null;

        // Add EJBRoleRefPermission for each bean
        for (Iterator itEjb = ejbDeploymentDesc.getBeanDescIterator(); itEjb.hasNext();) {
            beanDesc = (BeanDesc) itEjb.next();
            for (Iterator it = beanDesc.getSecurityRoleRefDescList().iterator(); it.hasNext();) {
                securityRoleRefDesc = (SecurityRoleRefDesc) it.next();
                try {
                    getPolicyConfiguration().addToRole(securityRoleRefDesc.getRoleLink(),
                            securityRoleRefDesc.getEJBRoleRefPermission());
                } catch (PolicyContextException pce) {
                    throw new PermissionManagerException("Can not add add excluded policy", pce);
                }
            }
        }
    }

    public boolean checkSecurity(String ejbName, EJBInvocation ejbInv, boolean inRunAs) {
        try {
            PolicyContext.setContextID(getContextId());
            String methodSignature = ejbInv.methodPermissionSignature;

            TraceEjb.security.log(BasicLevel.DEBUG, "EjbName = " + ejbName + ", methodSignature = " + methodSignature);

            // Set the information for the Policy provider
            JPolicyContextHandlerData jPolicyContextHandlerData = JPolicyContextHandlerCurrent.getCurrent()
                    .getJPolicyContextHandlerData();
            if (jPolicyContextHandlerData == null) {
                TraceEjb.security.log(BasicLevel.ERROR, "The Handler data retrieved is null !");
                return false;
            }
            jPolicyContextHandlerData.setEjbArguments(ejbInv.arguments);
            jPolicyContextHandlerData.setProcessingBean(ejbInv.bean);

            PolicyContext.setHandlerData(jPolicyContextHandlerData);

            // Build Protection Domain with a codesource and array of principal
            URI uri = new URI("file://" + getContextId());
            CodeSource codesource = new CodeSource(new URL(uri.toString()), (Certificate[]) null);
            SecurityCurrent current = SecurityCurrent.getCurrent();
            final SecurityContext sctx = current.getSecurityContext();

            TraceEjb.security.log(BasicLevel.DEBUG, "Security Context = " + sctx);

            if (sctx != null) {
                TraceEjb.security.log(BasicLevel.DEBUG, "sctx.getCallerPrincipalRoles() = " + sctx.getCallerPrincipalRoles(inRunAs));
            }


            String runAsRole = null;

            Principal[] principals = null;
            if (sctx != null) {
                runAsRole = sctx.peekRunAsRole();
                if (runAsRole != null) {
                    principals = new Principal[sctx.peekRunAsPrincipalRoles().length];
                    for (int k = 0; k < sctx.peekRunAsPrincipalRoles().length; k++) {
                        principals[k] = new org.objectweb.jonas.security.auth.JPrincipal(
                                sctx.peekRunAsPrincipalRoles()[k]);
                    }
                } else {
                    principals = new Principal[sctx.getCallerPrincipalRoles(inRunAs).length];
                    for (int k = 0; k < sctx.getCallerPrincipalRoles(inRunAs).length; k++) {
                        principals[k] = new org.objectweb.jonas.security.auth.JPrincipal(
                                sctx.getCallerPrincipalRoles(inRunAs)[k]);
                    }
               }
            } else {
                TraceEjb.security.log(BasicLevel.DEBUG, "Security context is null");
            }
            ProtectionDomain protectionDomain = new ProtectionDomain(codesource, null, null, principals);

            //TODO : cache ejbName/methodSignature to avoid creation of a new
            // EJBMethodPermission each time
            // See JACC 4.12
            EJBMethodPermission ejbMethodPermission = new EJBMethodPermission(ejbName, methodSignature);
            boolean accessOK = getPolicy().implies(protectionDomain, ejbMethodPermission);
            TraceEjb.security.log(BasicLevel.DEBUG, "Policy.implies result = " + accessOK);
            jPolicyContextHandlerData = null;
            return accessOK;

        } catch (Exception e) {
            TraceEjb.security.log(BasicLevel.ERROR, "Can't check security :" + e.getMessage());
            return false;
        }

    }

    public boolean isCallerInRole(String ejbName, String roleName, boolean inRunAs) {
        try {
            PolicyContext.setContextID(getContextId());
            TraceEjb.security.log(BasicLevel.DEBUG, "roleName = " + roleName);

            // Build Protection Domain with a codesource and array of principal
            URI uri = new URI("file://" + getContextId());
            CodeSource codesource = new CodeSource(new URL(uri.toString()), (Certificate[]) null);
            SecurityCurrent current = SecurityCurrent.getCurrent();
            final SecurityContext sctx = current.getSecurityContext();

            TraceEjb.security.log(BasicLevel.DEBUG, "Security Context = " + sctx);
            TraceEjb.security.log(BasicLevel.DEBUG, "sctx.getCallerPrincipalRoles() = "
                    + sctx.getCallerPrincipalRoles(inRunAs));

            Principal[] principals = null;
            if (sctx != null) {
                principals = new Principal[sctx.getCallerPrincipalRoles(inRunAs).length];
                for (int k = 0; k < sctx.getCallerPrincipalRoles(inRunAs).length; k++) {
                    principals[k] = new org.objectweb.jonas.security.auth.JPrincipal(sctx.getCallerPrincipalRoles(inRunAs)[k]);
                }
            } else {
                TraceEjb.security.log(BasicLevel.DEBUG, "Security context is null");
            }
            ProtectionDomain protectionDomain = new ProtectionDomain(codesource, null, null, principals);

            //TODO :add cache mechanism
            // See JACC 4.12
            EJBRoleRefPermission ejbRoleRefPermission = new EJBRoleRefPermission(ejbName, roleName);
            boolean isInRole = getPolicy().implies(protectionDomain, ejbRoleRefPermission);
            TraceEjb.security.log(BasicLevel.DEBUG, "Policy.implies result = " + isInRole);
            return isInRole;

        } catch (Exception e) {
            TraceEjb.security.log(BasicLevel.ERROR, "Can't check isCallerInRole :" + e.getMessage());
            return false;
        }

    }

    protected void resetDeploymentDesc() {
        ejbDeploymentDesc = null;
    }

}

---