XACMLUtils.java
/*
* Licensed to The Apereo Foundation under one or more contributor license
* agreements. See the NOTICE file distributed with this work for additional
* information regarding copyright ownership.
*
*
* The Apereo Foundation licenses this file to you under the Educational
* Community License, Version 2.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of the License
* at:
*
* http://opensource.org/licenses/ecl2.txt
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations under
* the License.
*
*/
package org.opencastproject.authorization.xacml;
import org.opencastproject.mediapackage.MediaPackage;
import org.opencastproject.security.api.AccessControlEntry;
import org.opencastproject.security.api.AccessControlList;
import org.opencastproject.util.XmlSafeParser;
import org.jboss.security.xacml.core.model.policy.ActionMatchType;
import org.jboss.security.xacml.core.model.policy.ActionType;
import org.jboss.security.xacml.core.model.policy.ActionsType;
import org.jboss.security.xacml.core.model.policy.ApplyType;
import org.jboss.security.xacml.core.model.policy.AttributeDesignatorType;
import org.jboss.security.xacml.core.model.policy.AttributeValueType;
import org.jboss.security.xacml.core.model.policy.ConditionType;
import org.jboss.security.xacml.core.model.policy.EffectType;
import org.jboss.security.xacml.core.model.policy.ObjectFactory;
import org.jboss.security.xacml.core.model.policy.PolicyType;
import org.jboss.security.xacml.core.model.policy.ResourceMatchType;
import org.jboss.security.xacml.core.model.policy.ResourceType;
import org.jboss.security.xacml.core.model.policy.ResourcesType;
import org.jboss.security.xacml.core.model.policy.RuleType;
import org.jboss.security.xacml.core.model.policy.SubjectAttributeDesignatorType;
import org.jboss.security.xacml.core.model.policy.TargetType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.InputStream;
import java.io.StringWriter;
import java.util.List;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBElement;
import javax.xml.bind.JAXBException;
/**
* Utility implementation for dealing with XACML data.
*/
public final class XACMLUtils {
/** XACML rule for combining policies */
public static final String RULE_COMBINING_ALG
= "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides";
/** XACML urn for actions */
public static final String ACTION_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:action:action-id";
/** XACML urn for resources */
public static final String RESOURCE_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:resource:resource-id";
/** XACML urn for subject */
public static final String SUBJECT_IDENTIFIER = "urn:oasis:names:tc:xacml:1.0:subject:subject-id";
/** XACML urn for roles */
public static final String SUBJECT_ROLE_IDENTIFIER = "urn:oasis:names:tc:xacml:2.0:subject:role";
/** XACML urn for string equality */
public static final String XACML_STRING_EQUAL = "urn:oasis:names:tc:xacml:1.0:function:string-equal";
/** XACML urn for string equality */
public static final String XACML_STRING_IS_IN = "urn:oasis:names:tc:xacml:1.0:function:string-is-in";
/** W3C String data type */
public static final String W3C_STRING = "http://www.w3.org/2001/XMLSchema#string";
/** The policy assertion issuer */
public static final String ISSUER = "matterhorn";
/** The JAXB Context to use for marshaling XACML security policy documents */
protected static JAXBContext jBossXacmlJaxbContext;
/** The logging facility */
private static final Logger logger = LoggerFactory.getLogger(XACMLUtils.class);
/** Static initializer for the single JAXB context */
static {
try {
XACMLUtils.jBossXacmlJaxbContext = JAXBContext.newInstance("org.jboss.security.xacml.core.model.policy",
PolicyType.class.getClassLoader());
} catch (JAXBException e) {
throw new RuntimeException(e);
}
}
/**
* Private constructor to disable clients from instantiating this class.
*/
private XACMLUtils() {
}
/**
* Parses a XACML into an {@link AccessControlList}.
* <p>
* Only rules which follow the structure of those created by {@link #getXacml(MediaPackage, AccessControlList)} may be
* successfully parsed. All other rules are ignored.
*
* @param xacml
* the XACML to parse
* @return the ACL, never {@code null}
* @throws XACMLParsingException
* if parsing fails
*/
public static AccessControlList parseXacml(InputStream xacml) throws XACMLParsingException {
try {
@SuppressWarnings("unchecked")
final AccessControlList acl = new AccessControlList();
final List<AccessControlEntry> entries = acl.getEntries();
final PolicyType policy = ((JAXBElement<PolicyType>) XACMLUtils.jBossXacmlJaxbContext
.createUnmarshaller()
.unmarshal(XmlSafeParser.parse(xacml)))
.getValue();
for (Object object : policy.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition()) {
if (!(object instanceof RuleType)) {
throw new XACMLParsingException("Object " + object + " of policy " + policy + " is not of type RuleType");
}
RuleType rule = (RuleType) object;
if (rule.getTarget() == null) {
if (rule.getRuleId().equals("DenyRule")) {
logger.trace("Skipping global deny rule");
continue;
}
throw new XACMLParsingException("Empty rule " + rule + " in policy " + policy);
}
String role = null;
String actionForAce = null;
try {
ActionType action = rule.getTarget().getActions().getAction().get(0);
actionForAce = (String) action.getActionMatch().get(0).getAttributeValue().getContent().get(0);
@SuppressWarnings("unchecked") JAXBElement<ApplyType> apply
= (JAXBElement<ApplyType>) rule.getCondition().getExpression();
for (JAXBElement<?> element : apply.getValue().getExpression()) {
if (element.getValue() instanceof AttributeValueType) {
role = (String) ((AttributeValueType) element.getValue()).getContent().get(0);
break;
}
}
} catch (Exception e) {
throw new XACMLParsingException("Rule " + rule + " of policy " + policy + " could not be parsed", e);
}
if (role == null) {
throw new XACMLParsingException("Unable to find role in rule " + rule + " of policy " + policy);
}
AccessControlEntry ace = new AccessControlEntry(role, actionForAce, rule.getEffect().equals(EffectType.PERMIT));
entries.add(ace);
}
return acl;
} catch (Exception e) {
if (e instanceof XACMLParsingException) {
throw (XACMLParsingException) e;
}
throw new XACMLParsingException("XACML could not be parsed", e);
}
}
/**
* Builds an xml string containing the xacml for the mediapackage.
*
* @param mediapackage
* the mediapackage
* @param accessControlList
* the tuples of roles to actions
* @return
* @throws JAXBException
*/
public static String getXacml(MediaPackage mediapackage, AccessControlList accessControlList) throws JAXBException {
ObjectFactory jbossXacmlObjectFactory = new ObjectFactory();
PolicyType policy = new PolicyType();
policy.setPolicyId(mediapackage.getIdentifier().toString());
policy.setVersion("2.0");
policy.setRuleCombiningAlgId(XACMLUtils.RULE_COMBINING_ALG);
// TODO: Add target/resources to rule
TargetType policyTarget = new TargetType();
ResourcesType resources = new ResourcesType();
ResourceType resource = new ResourceType();
ResourceMatchType resourceMatch = new ResourceMatchType();
resourceMatch.setMatchId(XACMLUtils.XACML_STRING_EQUAL);
AttributeValueType resourceAttributeValue = new AttributeValueType();
resourceAttributeValue.setDataType(XACMLUtils.W3C_STRING);
resourceAttributeValue.getContent().add(mediapackage.getIdentifier().toString());
AttributeDesignatorType resourceDesignator = new AttributeDesignatorType();
resourceDesignator.setAttributeId(XACMLUtils.RESOURCE_IDENTIFIER);
resourceDesignator.setDataType(XACMLUtils.W3C_STRING);
// now go back up the tree
resourceMatch.setResourceAttributeDesignator(resourceDesignator);
resourceMatch.setAttributeValue(resourceAttributeValue);
resource.getResourceMatch().add(resourceMatch);
resources.getResource().add(resource);
policyTarget.setResources(resources);
policy.setTarget(policyTarget);
// Loop over roleActions and add a rule for each
for (AccessControlEntry ace : accessControlList.getEntries()) {
boolean allow = ace.isAllow();
RuleType rule = new RuleType();
rule.setRuleId(ace.getRole() + "_" + ace.getAction() + (allow ? "_Permit" : "_Deny"));
if (allow) {
rule.setEffect(EffectType.PERMIT);
} else {
rule.setEffect(EffectType.DENY);
}
TargetType target = new TargetType();
ActionsType actions = new ActionsType();
ActionType action = new ActionType();
ActionMatchType actionMatch = new ActionMatchType();
actionMatch.setMatchId(XACMLUtils.XACML_STRING_EQUAL);
AttributeValueType attributeValue = new AttributeValueType();
attributeValue.setDataType(XACMLUtils.W3C_STRING);
attributeValue.getContent().add(ace.getAction());
AttributeDesignatorType designator = new AttributeDesignatorType();
designator.setAttributeId(XACMLUtils.ACTION_IDENTIFIER);
designator.setDataType(XACMLUtils.W3C_STRING);
// now go back up the tree
actionMatch.setActionAttributeDesignator(designator);
actionMatch.setAttributeValue(attributeValue);
action.getActionMatch().add(actionMatch);
actions.getAction().add(action);
target.setActions(actions);
rule.setTarget(target);
ConditionType condition = new ConditionType();
ApplyType apply = new ApplyType();
apply.setFunctionId(XACMLUtils.XACML_STRING_IS_IN);
AttributeValueType conditionAttributeValue = new AttributeValueType();
conditionAttributeValue.setDataType(XACMLUtils.W3C_STRING);
conditionAttributeValue.getContent().add(ace.getRole());
SubjectAttributeDesignatorType subjectDesignator = new SubjectAttributeDesignatorType();
subjectDesignator.setDataType(XACMLUtils.W3C_STRING);
subjectDesignator.setAttributeId(XACMLUtils.SUBJECT_ROLE_IDENTIFIER);
apply.getExpression().add(jbossXacmlObjectFactory.createAttributeValue(conditionAttributeValue));
apply.getExpression().add(jbossXacmlObjectFactory.createSubjectAttributeDesignator(subjectDesignator));
condition.setExpression(jbossXacmlObjectFactory.createApply(apply));
rule.setCondition(condition);
policy.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition().add(rule);
}
// Add the global deny rule
RuleType deny = new RuleType();
deny.setEffect(EffectType.DENY);
deny.setRuleId("DenyRule");
policy.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition().add(deny);
// serialize to xml
StringWriter writer = new StringWriter();
XACMLUtils.jBossXacmlJaxbContext.createMarshaller().marshal(jbossXacmlObjectFactory.createPolicy(policy), writer);
return writer.getBuffer().toString();
}
}