idpp/plugin/IDPPAuthorizer.java

	IDPPAuthorizer.java revision 4a2f0f0be43dfd4c1b490cbf3cc48b6ba6084b1c
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster/**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * The contents of this file are subject to the terms
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * of the Common Development and Distribution License
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * (the License). You may not use this file except in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * compliance with the License.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * You can obtain a copy of the License at
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * opensso/legal/CDDLv1.0.txt
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * See the License for the specific language governing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * permission and limitations under the License.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * When distributing Covered Code, include this CDDL
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Header Notice in each file and include the License file
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * at opensso/legal/CDDLv1.0.txt.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * If applicable, add the following below the CDDL Header,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * with the fields enclosed by brackets [] replaced by
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * your own identifying information:
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * $Id: IDPPAuthorizer.java,v 1.6 2008/08/19 19:12:22 veiming Exp $
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterpackage com.sun.identity.liberty.ws.idpp.plugin;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.iplanet.sso.SSOToken;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.policy.*;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.policy.interfaces.Condition;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Map;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.HashMap;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Iterator;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.ResourceBundle;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Set;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.HashSet;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.List;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.interfaces.Authorizer;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.idpp.common.*;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.debug.Debug;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.locale.Locale;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster/**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * The class <code>IDPPAuthorizer</code> is the default implementation of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * IDPP Authorization and implements <code>Authorizer</code>. It
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * provides an allow ,deny, interact for consent, interact for value action
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * based on the resource that a WSC is requesting for.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * This makes use of existing OpenSSO policy frame work by defining
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * policy as action values in the personal profile service.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterpublic class IDPPAuthorizer implements Authorizer {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static ResourceBundle bundle =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        Locale.getInstallResourceBundle("fmPersonalProfile");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static Debug debug = Debug.getInstance("libIDWSF");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static PolicyEvaluator evaluator = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    static {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster      try {
          evaluator = new PolicyEvaluator(IDPPConstants.IDPP_SERVICE);
      } catch (Exception ex) {
          debug.error("IDPPAuthorizer:Static Init failed", ex);
      }
    }


    /**
     *Default constructor
     */
    public IDPPAuthorizer() {}

    /**
     * Checks whether this is authorized
     * IDPPAuthorizer implements this class.
     * @param credential credential
     * @param action action
     * @param data object
     * @param env env map
     * @return true if authorized, otherwise false.
     */
    public boolean isAuthorized(Object credential, String action,
    Object data, Map env) {
       return false;
    }

    /**
     * Returns authorization decision to query or modify the select data
     * @param credential SSOToken of a WSC.
     * @param action request action.
     * @param data Object who is being accessed.
     * @param env A Map contains information useful for policy evaluation.
     *          The following key is defined and its value should be passed in:
     *          Key: <code>USER_ID</code>
     *          Value: id of the user whose resource is being accessed.
     *          Key: <code>AUTH_TYPE</code>
     *          Value: The authentication mechanism WSC used.
     *          Key: <code>MESSAGE</code>
     *          Value:
     *          <code>com.sun.identity.liberty.ws.soapbinding.Message</code>.
     * @return Object AuthorizationDecision object contains authorization
     *             decision information for the given data.
     *             For Personal Profile service, this object would be the
     *             String authZ decision value.
     * @exception Exception
     */

    public Object getAuthorizationDecision(
                  Object credential,
                  String action,
                  Object data,
                  java.util.Map env)
    throws Exception {
        debug.message("IDPPAuthorizer.getAuthorizationDecision:Init");
        if(credential == null || action == null || data == null) {
          debug.error("IDPPAuthorizer.isAuthorized:null input");
          throw new Exception(
          bundle.getString("nullInputParams"));
       }
       try {
           SSOToken token = (SSOToken)credential;
           String resource = (String)data;
           Set actions = new HashSet(1);
           actions.add(action);

           Map map = null;
           String userid = (String) env.get(USER_ID);
           if (debug.messageEnabled()) {
               debug.message("IDPPAuthorizer.getAuthorizationDecision: uid="
                   + userid);
           }
           if ((userid != null) && (userid.length() != 0)) {
               HashSet set = new HashSet();
               set.add(userid);
               map = new HashMap();
               map.put(Condition.INVOCATOR_PRINCIPAL_UUID, set);
           }

           PolicyDecision policyDecision =  evaluator.getPolicyDecision(
                     token, resource, actions, map);

           if(policyDecision == null) {
              if(debug.messageEnabled()) {
                 debug.message("IDPPAuthorizer.getAuthorization" +
                     "Decision:PolicyDecision is null");
              }
              return IDPPConstants.AUTHZ_DENY;
           }

           Map actionDecisions = policyDecision.getActionDecisions();
           ActionDecision actionDecision = (ActionDecision)
                          actionDecisions.get(action);

           if(actionDecision == null) {
              if(debug.messageEnabled()) {
                 debug.message("IDPPAuthorizer.getAuthorization" +
                     "Decision:ActionDecision is null");
              }
              return IDPPConstants.AUTHZ_DENY;
           }

           Set values = (Set)actionDecision.getValues();
           if(values == null || values.isEmpty()) {
              if(debug.messageEnabled()) {
                 debug.message("IDPPAuthorizer.getAuthorization" +
                     "Decision:values are null");
              }
              return IDPPConstants.AUTHZ_DENY;
           }

           if(debug.messageEnabled()) {
              debug.message("IDPPAuthorizer.getAuthorization" +
                  "Decision: action values:" + values);
           }

           if(values.contains(IDPPConstants.AUTHZ_DENY)) {
              return IDPPConstants.AUTHZ_DENY;
           }

           if(values.contains(IDPPConstants.INTERACT_FOR_VALUE)) {
              return IDPPConstants.INTERACT_FOR_VALUE;
           }

           if(values.contains(IDPPConstants.INTERACT_FOR_CONSENT)) {
              return IDPPConstants.INTERACT_FOR_CONSENT;
           }

           Iterator iter = values.iterator();
           return (String)iter.next();

       } catch (Exception ex) {
           debug.error("IDPPAuthorizer.getAuthorizationDecision:"+
               "Exception during authorization.", ex);
           throw ex;
       }

    }

}