PermissionManager.java

package org.objectweb.jonas.web.lib;

import java.net.MalformedURLException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
import java.security.CodeSource;
import java.security.Permission;
import java.security.PermissionCollection;
import java.security.Principal;
import java.security.ProtectionDomain;
import java.security.cert.Certificate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

import javax.security.jacc.PolicyContext;
import javax.security.jacc.PolicyContextException;
import javax.security.jacc.WebResourcePermission;
import javax.security.jacc.WebRoleRefPermission;
import javax.security.jacc.WebUserDataPermission;
import javax.servlet.http.HttpServletRequest;

import org.objectweb.jonas.common.Log;
import org.objectweb.jonas.security.jacc.JPolicyContextHandlerCurrent;
import org.objectweb.jonas.security.jacc.JPolicyContextHandlerData;
import org.objectweb.jonas.security.jacc.JPolicyUserRoleMapping;

import org.objectweb.jonas_lib.deployment.api.SecurityRoleRefDesc;
import org.objectweb.jonas_lib.security.AbsPermissionManager;
import org.objectweb.jonas_lib.security.PermissionManagerException;
import org.objectweb.jonas_web.deployment.api.SecurityConstraintListDesc;
import org.objectweb.jonas_web.deployment.api.SecurityRoleDesc;
import org.objectweb.jonas_web.deployment.api.ServletDesc;
import org.objectweb.jonas_web.deployment.api.WebContainerDeploymentDesc;
import org.objectweb.util.monolog.api.BasicLevel;
import org.objectweb.util.monolog.api.Logger;

public class PermissionManager extends AbsPermissionManager {

    private static Logger logger = null;

    private WebContainerDeploymentDesc webContainerDeploymentDesc = null;

    public PermissionManager(WebContainerDeploymentDesc webContainerDeploymentDesc, String contextId)
            throws PermissionManagerException {
        super(contextId);
        this.webContainerDeploymentDesc = webContainerDeploymentDesc;
        logger = Log.getLogger(Log.JONAS_WEB_PREFIX);
    }

    public void translateServletDeploymentDescriptor() throws PermissionManagerException {
        translateSecurityConstraintElements();
        translateServletSecurityRoleRef();
    }

    protected void translateSecurityConstraintElements() throws PermissionManagerException {
        if (webContainerDeploymentDesc == null || getPolicyConfiguration() == null) {
            throw new PermissionManagerException("PolicyConfiguration or webContainerbDeploymentDesc is null");
        }

        SecurityConstraintListDesc securityConstraintListDesc = webContainerDeploymentDesc
                .getSecurityConstraintListDesc();
        PermissionCollection excludedPermissions = securityConstraintListDesc.getExcludedPermissions();
        PermissionCollection uncheckedPermissions = securityConstraintListDesc.getUncheckedPermissions();
        PermissionCollection rolePermissions = null;
        String roleName = null;
        Map roleMapPermissions = securityConstraintListDesc.getPermissionsByRole();

        try {
            getPolicyConfiguration().addToExcludedPolicy(excludedPermissions);
            getPolicyConfiguration().addToUncheckedPolicy(uncheckedPermissions);

            for (Iterator rolesIt = roleMapPermissions.keySet().iterator(); rolesIt.hasNext();) {
                roleName = (String) rolesIt.next();
                rolePermissions = (PermissionCollection) roleMapPermissions.get(roleName);
                getPolicyConfiguration().addToRole(roleName, rolePermissions);
            }
        } catch (PolicyContextException pce) {
            throw new PermissionManagerException("Can not add add permissions to policy", pce);
        }
    }

    protected void translateServletSecurityRoleRef() throws PermissionManagerException {
        if (webContainerDeploymentDesc == null || getPolicyConfiguration() == null) {
            throw new PermissionManagerException("PolicyConfiguration or webContainerbDeploymentDesc is null");
        }

        Collection servlets = webContainerDeploymentDesc.getServletDescList();

        // List of roles which appear as role-name in a security-role-ref
        List rolesAppearedInSecurityRoleRef = new ArrayList();

        /*
         * For each security-role-ref appearing in the deployment descriptor a
         * corresponding WebRoleRefPermission must be added to the corresponding
         * role. The name of the WebRoleRefPermission must be the servlet-name
         * in whose context the security-role-ref is defined. The actions of the
         * WebRoleRefPermission must be the value of the role-name (that is the
         * reference), appearing in the security-role-ref
         */
        ServletDesc servletDesc = null;
        String servletName = null;
        List roleRefs = null;
        SecurityRoleRefDesc securityRoleRefDesc = null;
        for (Iterator itServlet = servlets.iterator(); itServlet.hasNext();) {
            servletDesc = (ServletDesc) itServlet.next();
            roleRefs = servletDesc.getSecurityRoleRefList();
            servletName = servletDesc.getServletName();
            for (Iterator itRoleRef = roleRefs.iterator(); itRoleRef.hasNext();) {
                securityRoleRefDesc = (SecurityRoleRefDesc) itRoleRef.next();
                /*
                 * The deployment tools must call the addToRole method on the
                 * PolicyConfiguration object to add the WebRoleRefPermission
                 * object resulting from the translation to the role identified
                 * in the role-link appearing in the security-role-ref.
                 */
                Permission webRoleRefPermission = securityRoleRefDesc.getWebRoleRefPermission();

                // Role has appear
                rolesAppearedInSecurityRoleRef.add(securityRoleRefDesc.getRoleName());

                try {
                    getPolicyConfiguration().addToRole(securityRoleRefDesc.getRoleLink(), webRoleRefPermission);
                } catch (PolicyContextException pce) {
                    throw new PermissionManagerException("Can not add add permission '" + webRoleRefPermission
                            + "' to policy", pce);
                }
            }
        }

        /*
         * Additional WebRoleRefPermission objects must be added to the
         * PolicyConfiguration as follows. For each servlet element in the
         * deployment descriptor a WebRoleRefPermission must be added to each
         * security-role whose name does not appear as the role-name in a
         * security-role-ref within the servlet element.
         */
        List securityRoles = webContainerDeploymentDesc.getSecurityRoleList();
        SecurityRoleDesc securityRoleDesc = null;
        String securityRoleName = null;

        for (Iterator itServlet = servlets.iterator(); itServlet.hasNext();) {
            servletDesc = (ServletDesc) itServlet.next();
            servletName = servletDesc.getServletName();

            for (Iterator itSecurityRoles = securityRoles.iterator(); itSecurityRoles.hasNext();) {
                securityRoleDesc = (SecurityRoleDesc) itSecurityRoles.next();
                securityRoleName = securityRoleDesc.getRoleName();
                // if role does not appear as the role-name in a
                // security-role-ref
                // need to create permission
                if (!rolesAppearedInSecurityRoleRef.contains(securityRoleName)) {

                    /*
                     * The name of each such WebRoleRefPermission must be the
                     * servlet-name of the corresponding servlet element. The
                     * actions (that is, reference) of each such
                     * WebRoleRefPermission must be the corresponding
                     * (non-appearing) role-name. The resulting permissions must
                     * be added to the corresponding roles by calling the
                     * addToRole method on the PolicyConfiguration object.
                     */
                    Permission webRoleRefPermission = new WebRoleRefPermission(servletName, securityRoleName);
                    try {
                        getPolicyConfiguration().addToRole(securityRoleName, webRoleRefPermission);
                    } catch (PolicyContextException pce) {
                        throw new PermissionManagerException("Can not add add permission '" + webRoleRefPermission
                                + "' to policy", pce);
                    }
                }
            }
        }

        securityRoles = webContainerDeploymentDesc.getSecurityRoleList();
        for (Iterator itSecurityRoles = securityRoles.iterator(); itSecurityRoles.hasNext();) {
            securityRoleDesc = (SecurityRoleDesc) itSecurityRoles.next();
            securityRoleName = securityRoleDesc.getRoleName();
            Permission webRoleRefPermission = new WebRoleRefPermission("", securityRoleName);
            try {
                getPolicyConfiguration().addToRole(securityRoleName, webRoleRefPermission);
            } catch (PolicyContextException pce) {
                throw new PermissionManagerException("Can not add add permission '" + webRoleRefPermission
                        + "' to policy", pce);
            }
        }
    }

    public boolean checkWebUserDataPermission(HttpServletRequest request, String principalName, String[] roles) {

        try {
            ProtectionDomain protectionDomain = initPolicyContext(request, principalName, roles);

            //TODO : cache request to avoid creation of a new
            // WebUserDatapermission each time
            // See JACC 4.12
            WebUserDataPermission webUserDataPermission = new WebUserDataPermission(request);
            boolean accessOK = getPolicy().implies(protectionDomain, webUserDataPermission);

            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Policy.implies result = " + accessOK);
            }
            return accessOK;

        } catch (Exception e) {
            logger.log(BasicLevel.ERROR, "Can't check web user data permission :" + e.getMessage());
            return false;
        }

    }

    public boolean checkWebResourcePermission(HttpServletRequest request, String principalName, String[] roles) {
        try {
            ProtectionDomain protectionDomain = initPolicyContext(request, principalName, roles);

            //TODO : cache request to avoid creation of a new
            // WebResourcePermission each time
            // See JACC 4.12
            WebResourcePermission webResourcePermission = new WebResourcePermission(request);
            boolean accessOK = getPolicy().implies(protectionDomain, webResourcePermission);
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Policy.implies result = " + accessOK);
            }
            return accessOK;

        } catch (Exception e) {
            logger.log(BasicLevel.ERROR, "Can't check web resource permission :" + e.getMessage());
            return false;
        }

    }

    public boolean checkWebRoleRefPermission(HttpServletRequest request, String servletName, String principalName, String[] roles,
            String roleName) {
        try {

            ProtectionDomain protectionDomain = initPolicyContext(request, principalName, roles);

            //TODO : cache request to avoid creation of a new
            // WebRoleRefPermission each time
            // See JACC 4.12
            WebRoleRefPermission webRoleRefPermission = new WebRoleRefPermission(servletName, roleName);
            boolean accessOK = getPolicy().implies(protectionDomain, webRoleRefPermission);
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "Policy.implies result = " + accessOK);
            }
            return accessOK;

        } catch (Exception e) {
            logger.log(BasicLevel.ERROR, "Can't check web role ref permission :" + e.getMessage());
            return false;
        }

    }

    private synchronized ProtectionDomain initPolicyContext(HttpServletRequest request, String principalName, String[] roles)
            throws URISyntaxException, MalformedURLException {

        // Set the policy context
        PolicyContext.setContextID(getContextId());

        // Configure ContextHandler
        JPolicyContextHandlerData jPolicyContextHandlerData = JPolicyContextHandlerCurrent.getCurrent()
                .getJPolicyContextHandlerData();
        if (jPolicyContextHandlerData == null) {
            logger.log(BasicLevel.ERROR, "The Handler data retrieved is null !");
            return null;
        }
        jPolicyContextHandlerData.setHttpServletRequest(request);
        PolicyContext.setHandlerData(jPolicyContextHandlerData);

        // Build Protection Domain with a codesource and array of principal
        URI uri = new URI("file://" + getContextId());
        CodeSource codesource = new CodeSource(new URL(uri.toString()), (Certificate[]) null);

        // Existing mapping ?
        String[] overridedRoles = JPolicyUserRoleMapping.getMappingForPrincipal(getContextId(), principalName);
        if (overridedRoles != null) {
            roles = overridedRoles;
        }

        Principal[] principals = null;
        if (roles != null) {
            principals = new Principal[roles.length];
            for (int k = 0; k < roles.length; k++) {
                principals[k] = new org.objectweb.jonas.security.auth.JPrincipal(roles[k]);
            }
        }

        return new ProtectionDomain(codesource, null, null, principals);
    }

    protected void resetDeploymentDesc() {
        webContainerDeploymentDesc = null;
    }

}

---