/*
$Id: PolicyAuthorizer.java,v 1.1 2003/11/13 16:07:07 andreas Exp $
<License>
============================================================================
The Apache Software License, Version 1.1
============================================================================
Copyright (C) 1999-2003 The Apache Software Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without modifica-
tion, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
3. The end-user documentation included with the redistribution, if any, must
include the following acknowledgment: "This product includes software
developed by the Apache Software Foundation (http://www.apache.org/)."
Alternately, this acknowledgment may appear in the software itself, if
and wherever such third-party acknowledgments normally appear.
4. The names "Apache Lenya" and "Apache Software Foundation" must not be
used to endorse or promote products derived from this software without
prior written permission. For written permission, please contact
apache@apache.org.
5. Products derived from this software may not be called "Apache", nor may
"Apache" appear in their name, without prior written permission of the
Apache Software Foundation.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
APACHE SOFTWARE FOUNDATION OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLU-
DING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This software consists of voluntary contributions made by many individuals
on behalf of the Apache Software Foundation and was originally created by
Michael Wechner <michi@apache.org>. For more information on the Apache Soft-
ware Foundation, please see <http://www.apache.org/>.
Lenya includes software developed by the Apache Software Foundation, W3C,
DOM4J Project, BitfluxEditor, Xopus, and WebSHPINX.
</License>
*/
package org.apache.lenya.ac.impl;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.List;
import org.apache.avalon.framework.logger.AbstractLogEnabled;
import org.apache.cocoon.environment.Request;
import org.apache.cocoon.environment.Session;
import org.apache.lenya.ac.AccessControlException;
import org.apache.lenya.ac.AccreditableManager;
import org.apache.lenya.ac.Authorizer;
import org.apache.lenya.ac.Identity;
import org.apache.lenya.ac.Policy;
import org.apache.lenya.ac.PolicyManager;
import org.apache.lenya.ac.Role;
/**
* @author andreas
*
* To change the template for this generated type comment go to
* Window>Preferences>Java>Code Generation>Code and Comments
*/
public class PolicyAuthorizer extends AbstractLogEnabled implements Authorizer {
/**
* Returns the accreditable manager.
* @return An accreditable manager.
*/
public AccreditableManager getAccreditableManager() {
return accreditableManager;
}
/**
* Returns the policy manager.
* @return A policy manager.
*/
public PolicyManager getPolicyManager() {
return policyManager;
}
/**
* Creates a new policy authorizer.
*/
public PolicyAuthorizer() {
}
private PolicyManager policyManager;
/**
* Sets the policy manager.
* @param manager A policy manager.
*/
public void setPolicyManager(PolicyManager manager) {
assert manager != null;
policyManager = manager;
}
private AccreditableManager accreditableManager;
/**
* Sets the accreditable manager.
* @param manager An accreditable manager.
*/
public void setAccreditableManager(AccreditableManager manager) {
assert manager != null;
accreditableManager = manager;
}
/**
* @see org.apache.lenya.cms.ac2.Authorizer#authorize(org.apache.lenya.cms.ac2.Identity, java.lang.String, java.util.Map)
*/
public boolean authorize(Request request)
throws AccessControlException {
Session session = request.getSession(true);
Identity identity = (Identity) session.getAttribute(Identity.class.getName());
if (getLogger().isDebugEnabled()) {
getLogger().debug("Trying to authorize identity: " + identity);
}
boolean authorized;
if (identity.belongsTo(getAccreditableManager())) {
authorized = authorizePolicy(identity, request);
} else {
getLogger().debug(
"Identity ["
+ identity
+ "] not authorized - belongs to wrong accreditable manager.");
authorized = false;
}
getLogger().debug("Authorized: " + authorized);
return authorized;
}
/**
* Authorizes an request for an identity depending on a policy.
* @param identity The identity to authorize.
* @param request The request to authorize.
* @return A boolean value.
* @throws AccessControlException when something went wrong.
*/
protected boolean authorizePolicy(
Identity identity,
Request request)
throws AccessControlException {
String requestUri = request.getRequestURI();
String context = request.getContextPath();
if (context == null) {
context = "";
}
String url = requestUri.substring(context.length());
Policy policy = getPolicyManager().getPolicy(getAccreditableManager(), url);
Role[] roles = policy.getRoles(identity);
saveRoles(request, roles);
boolean authorized = roles.length > 0;
return authorized;
}
/**
* Saves the roles of the current identity to the request.
* @param request The request.
* @param roles The roles.
*/
protected void saveRoles(Request request, Role[] roles) {
String rolesString = "";
for (int i = 0; i < roles.length; i++) {
rolesString += " " + roles[i];
}
getLogger().debug("Adding roles [" + rolesString + " ] to request [" + request + "]");
request.setAttribute(AbstractRole.class.getName(), Arrays.asList(roles));
}
/**
* Fetches the stored roles from the request.
* @param request The request.
* @return A role array.
* @throws AccessControlException If the request does not contain the roles list.
*/
public static Role[] getRoles(Request request) throws AccessControlException {
List roleList = (List) request.getAttribute(AbstractRole.class.getName());
if (roleList == null) {
String message = " URI: [" + request.getRequestURI() + "]\n";
for (Enumeration e = request.getParameterNames(); e.hasMoreElements(); ) {
String key = (String) e.nextElement();
message += " Parameter: [" + key + "] = [" + request.getParameter(key) + "]\n";
}
throw new AccessControlException("Request [" + request + "] does not contain roles: \n" + message);
}
Role[] roles = (Role[]) roleList.toArray(new Role[roleList.size()]);
return roles;
}
}